version: 1.53.0

feat: add pt-BR locale

README.md

@@ -428,7 +428,7 @@ For commercial licensing questions, hosted service permissions, or other use cas
 
 Do not publish security vulnerabilities in public GitHub issues.
 
-Report security issues privately using the contact information provided in the repository or on the TaskView website.
+Report security issues privately — see [SECURITY.md](SECURITY.md) for the reporting channels, response times, scope, and safe-harbor terms.
 
 When running TaskView in production:
 

SECURITY.md

@@ -0,0 +1,46 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
+
+Report them privately using one of these channels:
+
+- **GitHub private vulnerability reporting** (preferred): open the **Security** tab of this repository and click **Report a vulnerability**.
+- **Email**: [support@taskview.tech](mailto:support@taskview.tech) with `[security]` in the subject.
+
+Please include as much of the following as you can:
+
+- A description of the issue and its impact
+- Affected component (API, web app, MCP server, mobile app) and version
+- Steps to reproduce, or a proof of concept
+- Any suggested mitigation
+
+## What to expect
+
+- We will acknowledge your report within **5 business days**.
+- We will keep you informed about progress and aim to release a fix for confirmed issues within **90 days** of the report, sooner for critical issues.
+- Once a fix is released, we publish a GitHub Security Advisory for the affected versions and credit the reporter, unless they prefer to stay anonymous.
+- We ask that you give us a reasonable time to fix the issue before disclosing it publicly.
+
+## Supported versions
+
+Security fixes are released for the latest minor version line only. Self-hosted installations should upgrade to the latest release to receive them.
+
+## Scope
+
+In scope:
+
+- The TaskView API server, web app, MCP server, and mobile app in this repository
+- The hosted service at `app.taskview.tech`
+
+Out of scope:
+
+- Vulnerabilities in third-party dependencies that are not exploitable in TaskView (report them upstream)
+- Findings that require a compromised admin account or physical access to the server
+- Missing security headers, rate limiting, or best-practice recommendations without a demonstrated impact
+- Denial-of-service testing against the hosted service
+
+## Safe harbor
+
+We will not pursue legal action against researchers who act in good faith: test only against their own self-hosted instance or their own accounts on the hosted service, avoid accessing or modifying other users' data, and report findings privately as described above.

api/.env.example

@@ -19,6 +19,9 @@ ACCESS_LIFE_TIME=1d
 REFRESH_LIFE_TIME=2d
 JWT_ALG=HS256
 
+# SSO: comma-separated email domains that skip DNS/HTTP ownership proof (air-gapped installs)
+#SSO_TRUSTED_DOMAINS=company.com,corp.local
+
 # SMTP Configuration
 SMTP_HOST=smtp.domain.com
 SMTP_PORT=465
@@ -27,6 +30,10 @@ SMTP_PASSWORD=your_smtp_password_here
 SMTP_ENCRYPTION=ssl
 SMTP_FROM_NAME=TaskView
 SMTP_FROM_EMAIL=your_email@example.com
+# Email a person when they are invited to a project (requires SMTP)
+INVITE_EMAIL_ENABLED=false
+# Max invite emails one user may trigger per hour (default 30)
+# INVITE_EMAIL_HOURLY_LIMIT=30
 
 # Encryption (32-byte hex key for AES-256-GCM)
 # Generate a key: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
@@ -48,6 +55,14 @@ GITLAB_INTEGRATION_CALLBACK_URL=http://localhost:1401/module/integrations/oauth/
 # GITLAB_BASE_URL=https://gitlab.yourcompany.com
 # GITLAB_API_URL=https://gitlab.yourcompany.com/api/v4
 
+# Gitea Integration OAuth
+GITEA_INTEGRATION_CLIENT_ID=
+GITEA_INTEGRATION_CLIENT_SECRET=
+GITEA_INTEGRATION_CALLBACK_URL=http://localhost:1401/module/integrations/oauth/gitea/callback
+# For self-hosted Gitea, override these:
+# GITEA_BASE_URL=https://gitea.yourcompany.com
+# GITEA_API_URL=https://gitea.yourcompany.com/api/v1
+
 # Firebase Cloud Messaging (push notifications for mobile, optional)
 # Path to Firebase service account JSON file
 # FIREBASE_CREDENTIALS_PATH=./firebase-credentials.json

api/ecosystem.config.js

@@ -1,9 +1,38 @@
+// https://github.com/Gimanh/taskview-community/issues/88
+// GH-88: one worker per core ('max') multiplied by the per-worker DB pool
+// (DB_POOL_MAX, default 20) exhausts Postgres max_connections (default 100)
+// on many-core hosts. Default to 2 workers; scale explicitly via PM2_INSTANCES.
+// If you set PM2_INSTANCES to 'max', size DB_POOL_MAX yourself so that
+// workers × DB_POOL_MAX stays below the Postgres max_connections limit.
+const rawInstances = process.env.PM2_INSTANCES;
+const instances = rawInstances === 'max'
+    ? 'max'
+    : Number(rawInstances) > 0
+        ? Number(rawInstances)
+        : 2;
+
+const poolMax = Number(process.env.DB_POOL_MAX) > 0 ? Number(process.env.DB_POOL_MAX) : 20;
+
+if (instances === 'max') {
+    console.warn(
+        '[taskview] PM2_INSTANCES=max spawns one worker per CPU core, each with its own '
+        + `DB pool (${poolMax} connections). Make sure workers x DB_POOL_MAX stays below `
+        + 'the Postgres max_connections limit (default 100).'
+    );
+} else if (instances * poolMax > 80) {
+    console.warn(
+        `[taskview] DB connection budget: ${instances} worker(s) x ${poolMax} pool connections = `
+        + `${instances * poolMax} potential connections. Postgres default max_connections is 100 - `
+        + 'lower PM2_INSTANCES or DB_POOL_MAX if the database rejects connections.'
+    );
+}
+
 module.exports = {
     apps: [
         {
             name: 'taskview-server',
             script: 'taskview-server.js',
-            instances: 'max',
+            instances,
             watch: true,
             ignore_watch: ['logs'],
             autorestart: true,

api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "taskview-ce-api-server",
-  "version": "1.49.0",
+  "version": "1.53.0",
   "scripts": {
     "dev": "bun run --watch ./server.ts",
     "start": "NODE_ENV=production node ./dist/taskview-server.js",

api/production.ecosystem.config.js

@@ -1,11 +1,38 @@
+// GH-88: one worker per core ('max') multiplied by the per-worker DB pool
+// (DB_POOL_MAX, default 20) exhausts Postgres max_connections (default 100)
+// on many-core hosts. Default to 2 workers; scale explicitly via PM2_INSTANCES.
+// If you set PM2_INSTANCES to 'max', size DB_POOL_MAX yourself so that
+// workers × DB_POOL_MAX stays below the Postgres max_connections limit.
+const rawInstances = process.env.PM2_INSTANCES;
+const instances = rawInstances === 'max'
+    ? 'max'
+    : Number(rawInstances) > 0
+        ? Number(rawInstances)
+        : 2;
+
+const poolMax = Number(process.env.DB_POOL_MAX) > 0 ? Number(process.env.DB_POOL_MAX) : 20;
+
+if (instances === 'max') {
+    console.warn(
+        '[taskview] PM2_INSTANCES=max spawns one worker per CPU core, each with its own '
+        + `DB pool (${poolMax} connections). Make sure workers x DB_POOL_MAX stays below `
+        + 'the Postgres max_connections limit (default 100).'
+    );
+} else if (instances * poolMax > 80) {
+    console.warn(
+        `[taskview] DB connection budget: ${instances} worker(s) x ${poolMax} pool connections = `
+        + `${instances * poolMax} potential connections. Postgres default max_connections is 100 - `
+        + 'lower PM2_INSTANCES or DB_POOL_MAX if the database rejects connections.'
+    );
+}
+
 module.exports = {
     apps: [
         {
             name: 'taskview-server',
             script: 'taskview-server.js',
-            instances: 'max',
-            watch: true,
-            ignore_watch: ['logs'],
+            instances,
+            watch: false,
             autorestart: true,
             max_memory_restart: '1G',
             env_production: {

api/src/App.ts

@@ -5,6 +5,9 @@ import { corsMiddleware } from './middlewares/cors';
 import errorHandler from './middlewares/error-handler';
 import routes from './routes';
 import passport, { initPassportLogin } from './tv-modules/auth/strategies/passport-login';
+import { LoginMethods } from './tv-modules/auth/LoginMethods';
+import { InviteEmailDispatcher } from './tv-modules/collaboration/InviteEmailDispatcher';
+import { PublicApiUrl } from './modules/public-url';
 import cookieParser from 'cookie-parser';
 import { registerAllEventHandlers, startAllWorkers } from './core/all-events';
 
@@ -13,6 +16,10 @@ export default class App {
     public port: number;
 
     constructor(port: number) {
+        LoginMethods.validateOnStartup();
+        PublicApiUrl.validateOnStartup();
+        InviteEmailDispatcher.validateOnStartup();
+
         this.app = express();
         this.port = port;
 
@@ -31,7 +38,17 @@ export default class App {
     protected extendApp(): void { }
     protected extendMiddlewares(): void { }
 
+    private resolveTrustProxy(): boolean | number | string {
+        const raw = process.env.TRUST_PROXY?.trim();
+        if (!raw || raw.toLowerCase() === 'false') return false;
+        if (raw.toLowerCase() === 'true') return true;
+        if (/^\d+$/.test(raw)) return Number(raw);
+        return raw;
+    }
+
     private initializeMiddlewares() {
+        this.app.set('trust proxy', this.resolveTrustProxy());
+
         //add tvJson method, clien need response format like {response: data}
         this.app.use((_req: Request, res: Response, next) => {
             res.tvJson = function (data: any) {

api/src/core/EventBus.ts

@@ -1,6 +1,7 @@
 import { EventEmitter } from 'node:events';
 import type { RecurrenceRulesSchemaTypeForSelect, SprintsSchemaTypeForSelect, TasksSchemaTypeForSelect } from 'taskview-db-schemas';
 import type { TimeEntryWithUser } from '../tv-modules/time-tracking/types';
+import type { InviteEmailLocale } from '../tv-modules/collaboration/collaboration.server.types';
 import { $logger } from '../modules/logget';
 
 export interface AppEvents {
@@ -8,7 +9,7 @@ export interface AppEvents {
     'task.updated': { task: TasksSchemaTypeForSelect; changes: Record<string, unknown>; initiatorId: number };
     'task.assigneesChanged': { taskId: number; userIds: number[]; initiatorId: number };
     'task.deleted': { taskId: number; goalId: number; initiatorId: number };
-    'collaboration.userAdded': { goalId: number; email: string; initiatorId: number };
+    'collaboration.userAdded': { goalId: number; email: string; initiatorId: number; locale: InviteEmailLocale };
     'collaboration.userRemoved': { goalId: number; collaborationUserId: number; initiatorId: number };
     'collaboration.rolesChanged': { goalId: number; collaborationUserId: number; initiatorId: number };
     'time-entry.started': { entry: TimeEntryWithUser; taskId: number; userId: number; goalId: number };

api/src/core/all-events.ts

@@ -7,6 +7,7 @@ import { TimeTrackingDispatcher } from '../tv-modules/time-tracking/TimeTracking
 import { SprintsDispatcher } from '../tv-modules/sprints/SprintsDispatcher';
 import { RecurrenceDispatcher } from '../tv-modules/recurrence/RecurrenceDispatcher';
 import { MessagingDispatcher } from '../tv-modules/messaging/MessagingDispatcher';
+import { InviteEmailDispatcher } from '../tv-modules/collaboration/InviteEmailDispatcher';
 
 const dispatchers: Dispatcher[] = [
     new NotificationDispatcher(),
@@ -16,6 +17,7 @@ const dispatchers: Dispatcher[] = [
     new SprintsDispatcher(),
     new RecurrenceDispatcher(),
     new MessagingDispatcher(),
+    new InviteEmailDispatcher(),
 ];
 
 export function registerAllEventHandlers() {

api/src/migrations/taskview/migrate.json

@@ -704,5 +704,51 @@
         "description": [
             "Add external_team_id to messaging_identity_map so Slack identities are keyed by (provider, team, user) — prevents cross-workspace identity collision"
         ]
+    },
+    "55": {
+        "version": "1.60.0",
+        "name": "Recurrence schedule mode",
+        "releaseDate": "20260712",
+        "scripts": [
+            "/1.60.0/0.alter-recurrence-add-schedule-mode.sql"
+        ],
+        "description": [
+            "Add schedule_mode to recurrence_rules: 'fixed' (calendar schedule) or 'after-completion' (next occurrence = completion day + interval)"
+        ]
+    },
+    "56": {
+        "version": "1.61.0",
+        "name": "Gitea integration provider",
+        "releaseDate": "20260726",
+        "scripts": [
+            "/1.61.0/0.alter-integrations-provider-check-gitea.sql"
+        ],
+        "description": [
+            "Extend integrations_provider_check constraint to allow the 'gitea' provider alongside 'github' and 'gitlab'"
+        ]
+    },
+    "57": {
+        "version": "1.62.0",
+        "name": "Invite email rate limiting",
+        "releaseDate": "20260730",
+        "scripts": [
+            "/1.62.0/0.create-invite-emails.sql"
+        ],
+        "description": [
+            "Log of sent project-invite emails (collaboration.invite_emails) backing the per-recipient cooldown and the hourly per-initiator sending cap"
+        ]
+    },
+    "58": {
+        "version": "1.63.0",
+        "name": "SSO domain verification",
+        "releaseDate": "20260813",
+        "scripts": [
+            "/1.63.0/0.sso-domain-verification.sql",
+            "/1.63.0/1.sso-domain-verified-unique.sql"
+        ],
+        "description": [
+            "SSO configs require proving ownership of email_domain_restriction before login is allowed: DNS TXT taskview-sso-verify=<token> or https://<domain>/.well-known/taskview-sso-verify.txt. Air-gapped installs can skip this for listed domains via SSO_TRUSTED_DOMAINS.",
+            "Replaces the plain UNIQUE(email_domain_restriction) with a partial unique index over verified configs only, so an unverified config can no longer squat a domain and block its real owner — multiple orgs may hold a pending config for the same domain, but only one can verify it (first-to-verify wins)."
+        ]
     }
-}
+}

api/src/migrations/taskview/sql/1.60.0/0.alter-recurrence-add-schedule-mode.sql

@@ -0,0 +1,10 @@
+-- 'fixed' — occurrences follow the calendar schedule (rrule anchored at dtstart);
+-- 'after-completion' — the next occurrence is one FREQ/INTERVAL step after the
+-- day the current instance was completed (Todoist "every!"), no calendar anchor.
+ALTER TABLE tasks.recurrence_rules
+    ADD COLUMN IF NOT EXISTS schedule_mode VARCHAR(20) NOT NULL DEFAULT 'fixed';
+
+ALTER TABLE tasks.recurrence_rules
+    DROP CONSTRAINT IF EXISTS recurrence_schedule_mode_valid;
+ALTER TABLE tasks.recurrence_rules
+    ADD CONSTRAINT recurrence_schedule_mode_valid CHECK (schedule_mode IN ('fixed', 'after-completion'));

api/src/migrations/taskview/sql/1.61.0/0.alter-integrations-provider-check-gitea.sql

@@ -0,0 +1,2 @@
+ALTER TABLE tasks.integrations DROP CONSTRAINT IF EXISTS integrations_provider_check;
+ALTER TABLE tasks.integrations ADD CONSTRAINT integrations_provider_check CHECK (provider IN ('github', 'gitlab', 'gitea'));

api/src/migrations/taskview/sql/1.62.0/0.create-invite-emails.sql

@@ -0,0 +1,13 @@
+-- Log of sent project-invite emails, used to rate-limit sending:
+-- a 24h per-recipient cooldown and an hourly cap per initiator.
+-- Rows older than 24 hours are pruned opportunistically before each insert.
+CREATE TABLE IF NOT EXISTS collaboration.invite_emails (
+    id           INTEGER GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    initiator_id INTEGER NOT NULL REFERENCES tv_auth.users(id) ON DELETE CASCADE,
+    email        VARCHAR(255) NOT NULL,
+    goal_id      INTEGER NOT NULL REFERENCES tasks.goals(id) ON DELETE CASCADE,
+    sent_at      TIMESTAMP NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_invite_emails_initiator_sent ON collaboration.invite_emails(initiator_id, sent_at);
+CREATE INDEX IF NOT EXISTS idx_invite_emails_goal_email_sent ON collaboration.invite_emails(goal_id, email, sent_at);

api/src/migrations/taskview/sql/1.63.0/0.sso-domain-verification.sql

@@ -0,0 +1,3 @@
+ALTER TABLE tv_auth.sso_configs
+  ADD COLUMN IF NOT EXISTS domain_verify_token VARCHAR,
+  ADD COLUMN IF NOT EXISTS domain_verified_at TIMESTAMP;

api/src/migrations/taskview/sql/1.63.0/1.sso-domain-verified-unique.sql

@@ -0,0 +1,6 @@
+ALTER TABLE tv_auth.sso_configs
+  DROP CONSTRAINT IF EXISTS sso_configs_email_domain_restriction_key;
+
+CREATE UNIQUE INDEX IF NOT EXISTS sso_configs_verified_domain_uniq
+  ON tv_auth.sso_configs (email_domain_restriction)
+  WHERE domain_verified_at IS NOT NULL;

api/src/modules/public-url.ts

@@ -0,0 +1,28 @@
+import type { Request } from 'express';
+
+export class PublicApiUrl {
+    static configured(): string | null {
+        const raw = process.env.API_PUBLIC_URL;
+        if (!raw || !raw.trim()) return null;
+        return raw.trim().replace(/\/+$/, '');
+    }
+
+    static base(req: Request): string {
+        return PublicApiUrl.configured() ?? `${req.protocol}://${req.get('host')}`;
+    }
+
+    static validateOnStartup(): void {
+        const raw = process.env.API_PUBLIC_URL;
+        if (!raw || !raw.trim()) return;
+
+        let parsed: URL;
+        try {
+            parsed = new URL(raw.trim());
+        } catch {
+            throw new Error(`API_PUBLIC_URL is not a valid URL: "${raw}"`);
+        }
+        if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') {
+            throw new Error(`API_PUBLIC_URL must be an http(s) URL, got: "${raw}"`);
+        }
+    }
+}

api/src/tv-modules/analytics/sections/SectionRegistry.ts

@@ -5,18 +5,12 @@ import { OverdueKpi } from './kpi/OverdueKpi'
 import { ThroughputSection } from './productivity/ThroughputSection'
 import { PriorityMixOverTimeSection } from './productivity/PriorityMixOverTimeSection'
 import { WorkloadByAssigneeSection } from './workload/WorkloadByAssigneeSection'
-import { BlockedByDependenciesSection } from './workload/BlockedByDependenciesSection'
-import { OverdueByAgeSection } from './quality/OverdueByAgeSection'
 import { StaleTasksSection } from './quality/StaleTasksSection'
 import { StatusDistributionSection } from './usage/StatusDistributionSection'
-import { ActiveProjectsSection } from './usage/ActiveProjectsSection'
 import { IncomeExpenseMonthSection } from './financial/IncomeExpenseMonthSection'
 import { IncomeExpensePerProjectSection } from './financial/IncomeExpensePerProjectSection'
 import { IncomePerProjectMonthSection } from './financial/IncomePerProjectMonthSection'
 import { ExpensePerProjectMonthSection } from './financial/ExpensePerProjectMonthSection'
-import { IncomePerTagMonthSection } from './financial/IncomePerTagMonthSection'
-import { ExpensePerTagMonthSection } from './financial/ExpensePerTagMonthSection'
-import { TopProjectsByAmountSection } from './financial/TopProjectsByAmountSection'
 import { AmountCoverageKpi } from './financial/AmountCoverageKpi'
 import { TotalIncomeKpi } from './financial/TotalIncomeKpi'
 import { TotalExpenseKpi } from './financial/TotalExpenseKpi'
@@ -59,6 +53,12 @@ import { sectionLocales } from './locales'
 //    - entered_at) for rows in that status. Without a transition log, this
 //    metric cannot be computed correctly.
 // ---------------------------------------------------------------------------
+// import { BlockedByDependenciesSection } from './workload/BlockedByDependenciesSection'
+// import { ActiveProjectsSection } from './usage/ActiveProjectsSection'
+// import { OverdueByAgeSection } from './quality/OverdueByAgeSection'
+// import { TopProjectsByAmountSection } from './financial/TopProjectsByAmountSection'
+// import { IncomePerTagMonthSection } from './financial/IncomePerTagMonthSection'
+// import { ExpensePerTagMonthSection } from './financial/ExpensePerTagMonthSection'
 // import { AgingOpenTasksSection } from './workload/AgingOpenTasksSection'
 // import { TimeInKanbanStatusSection } from './workload/TimeInKanbanStatusSection'
 // import { CycleTimeKpi } from './kpi/CycleTimeKpi'
@@ -82,25 +82,25 @@ const builders: SectionBuilder[] = [
   new PriorityMixOverTimeSection(),
   // Workload
   new WorkloadByAssigneeSection(),
-  new BlockedByDependenciesSection(),
+  // new BlockedByDependenciesSection(), // disabled
   // new TimeInKanbanStatusSection(), // disabled — see top-of-file comment
   // new AgingOpenTasksSection(), // disabled — see top-of-file comment
   // Quality
-  new OverdueByAgeSection(),
+  // new OverdueByAgeSection(), // disabled
   // new CycleTimeHistogramSection(), // disabled — see top-of-file comment
   new StaleTasksSection(),
   // new CycleTimePerProjectSection(), // disabled — see top-of-file comment
   // Usage
   new StatusDistributionSection(),
-  new ActiveProjectsSection(),
+  // new ActiveProjectsSection(), // disabled
   // Financial
   new IncomeExpenseMonthSection(),
   new IncomeExpensePerProjectSection(),
   new IncomePerProjectMonthSection(),
   new ExpensePerProjectMonthSection(),
-  new IncomePerTagMonthSection(),
-  new ExpensePerTagMonthSection(),
-  new TopProjectsByAmountSection(),
+  // new IncomePerTagMonthSection(), // disabled
+  // new ExpensePerTagMonthSection(), // disabled
+  // new TopProjectsByAmountSection(), // disabled
 ]
 
 export class SectionRegistry {

api/src/tv-modules/analytics/sections/financial/tagAmountPayload.ts

@@ -2,7 +2,7 @@ import type { AnalyticsDataset, AnalyticsSeriesPayload, LocalizedText } from 'ta
 import type { AmountPerTagMonthSectionRow } from '../row.types'
 import { UNTAGGED_TAG_ID } from '../../types'
 
-const UNTAGGED_LABEL: LocalizedText = { ru: 'Без тегов', en: 'Untagged' }
+const UNTAGGED_LABEL: LocalizedText = { ru: 'Без тегов', en: 'Untagged', de: 'Ohne Tags', es: 'Sin etiquetas' }
 
 export type BuildTagAmountPayloadArgs = {
   rows: AmountPerTagMonthSectionRow[]

api/src/tv-modules/auth/AuthController.ts

@@ -6,7 +6,11 @@ import { z } from 'zod';
 import { Email } from '../../core/Email';
 import { $logger } from '../../modules/logget';
 import {
+    ChangeDefaultUserCredentialsSchema,
+    ChangeOwnPasswordByPasswordSchema,
+    ChangeOwnPasswordSchema,
     ChangePasswordDataScheme,
+    type PasswordChangeConfirmationMode,
     ConfirmEmailReqDataSchema,
     RefreshTokenSchema,
     RemindPasswordSchema,
@@ -15,6 +19,7 @@ import {
     UserJwtPayloadSchema,
 } from '../../types/auth.types';
 import { generateString, isEmail, time } from '../../utils/helpers';
+import { LoginMethods } from './LoginMethods';
 import EnEmailTemplate from './mail/confirm-email-en';
 import RuEmailTemplate from './mail/confirm-email-ru';
 import LoginCodeEmailTemplate from './mail/login-code-en';
@@ -23,6 +28,10 @@ import { OrganizationRepository } from '../organizations/OrganizationRepository'
 import { GoalsRepository } from '../goals/GoalsRepository';
 
 const LOGIN_CODE_TTL_MS = 5 * 60 * 1000;
+const PASSWORD_CHANGE_CODE_TTL_S = 15 * 60;
+const PASSWORD_CHANGE_CODE_RESEND_COOLDOWN_S = 60;
+// Seeded by migration 0.0.0 (app_permissions.sql) on self-hosted installs.
+const DEFAULT_USER_EMAIL = 'test@mail.dest';
 
 export default class AuthController {
     private readonly jwtAlg: Algorithm = process.env.JWT_ALG as Algorithm;
@@ -144,6 +153,11 @@ export default class AuthController {
         }
 
         if (!userData) {
+            if (!(await this.canCreateAccount(req, email))) {
+                $logger.info(`[AuthController:sendLoginCode] public registration disabled, email not invited`);
+                return res.status(403).send({ registrationDisabled: true });
+            }
+
             const password = this.makeidLogin(7),
                 login = this.makeidLogin(7);
 
@@ -218,6 +232,11 @@ export default class AuthController {
         );
 
         if (!userData) {
+            if (!(await this.canCreateAccount(req, user.email))) {
+                $logger.info(`[AuthController:loginByProvider] public registration disabled, email not invited`);
+                return res.redirect(`${process.env.APP_URL}/login?sso_error=registration-disabled`);
+            }
+
             const password = this.makeidLogin(7);
             const login = this.makeidLogin(7);
 
@@ -348,6 +367,16 @@ export default class AuthController {
         // Invalidate code immediately to prevent replay attacks
         await req.appUser.authManager.repository.updateLoginCode(null, userData.email);
 
+        if (userData.block) {
+            if (!userData.confirm_email_code) {
+                return res.status(403).send({ message: 'account_blocked' });
+            }
+            const confirmed = await req.appUser.authManager.repository.markEmailConfirmed(userData.email);
+            if (!confirmed) {
+                return res.status(500).end();
+            }
+        }
+
         const sessionId = await req.appUser.authManager.sessionStorage.createSession(
             userData.id,
             req.ip,
@@ -421,6 +450,11 @@ export default class AuthController {
             return res.status(400).end();
         }
 
+        if (!(await this.canCreateAccount(req, email))) {
+            $logger.info(`[AuthController:registration] public registration disabled, email not invited`);
+            return res.status(403).send({ registrationDisabled: true });
+        }
+
         password = hashSync(password, 10);
 
         if (!(await this.comparePasswords(passwordRepeat, password))) {
@@ -656,6 +690,193 @@ export default class AuthController {
         return res.json(newTokens);
     };
 
+    getLoginOptions = async (_req: Request, res: Response) => {
+        return res.status(200).send({
+            magicLink: LoginMethods.isEnabled('magic-link'),
+            password: LoginMethods.isEnabled('password'),
+            sso: LoginMethods.isEnabled('sso'),
+            socialProviders: LoginMethods.availableSocialProviders(),
+            publicRegistration: LoginMethods.publicRegistrationAllowed(),
+        });
+    };
+
+    private canCreateAccount = async (req: Request, email: string): Promise<boolean> => {
+        if (LoginMethods.publicRegistrationAllowed()) return true;
+        return await req.appUser.authManager.repository.isEmailInvited(email);
+    };
+
+    private passwordChangeConfirmationMode(): PasswordChangeConfirmationMode {
+        return process.env.PASSWORD_CHANGE_CONFIRMATION === 'password' ? 'password' : 'email';
+    }
+
+    getPasswordChangeMode = async (_req: Request, res: Response) => {
+        return res.status(200).send({ mode: this.passwordChangeConfirmationMode() });
+    };
+
+    sendPasswordChangeCode = async (req: Request, res: Response) => {
+        if (this.passwordChangeConfirmationMode() !== 'email') {
+            return res.status(403).send();
+        }
+
+        const userEmail = req.appUser.getUserData()?.email;
+        if (!userEmail) {
+            return res.status(400).end();
+        }
+
+        const userData = await req.appUser.authManager.repository.getUserByLogin(userEmail, true);
+        if (!userData) {
+            return res.status(400).end();
+        }
+
+        const now = Math.floor(Date.now() / 1000);
+        const sinceLastCode = userData.remind_password_time ? now - userData.remind_password_time : null;
+        if (sinceLastCode !== null && sinceLastCode < PASSWORD_CHANGE_CODE_RESEND_COOLDOWN_S) {
+            return res.status(429).send({
+                message: 'Please wait before requesting another code.',
+                retryAfter: PASSWORD_CHANGE_CODE_RESEND_COOLDOWN_S - sinceLastCode,
+            });
+        }
+
+        // High-entropy code: the shared remind_password_code column is also redeemable
+        // via the unauthenticated /password/reset endpoint, so a short numeric code
+        // would be brute-forceable there.
+        const code = generateString(12);
+        const saved = await req.appUser.authManager.repository.setReminderCodeAndTime(userEmail, code, now);
+        if (!saved) {
+            $logger.error(`Can not save password change code for user ${userData.id}`);
+            return res.status(500).end();
+        }
+
+        const text = `Your TaskView password change code is ${code}\n\nUse this code to confirm your new password. The code expires in 15 minutes.\n\nIf you didn't request this change, ignore this email.`;
+
+        Email.send({
+            text,
+            to: userEmail,
+            subject: `Your TaskView password change code: ${code}`,
+            from: process.env.SMTP_FROM_EMAIL as string,
+        })
+            .then((ok) => {
+                if (!ok) $logger.error({ to: userEmail }, 'Failed to send password change code email');
+            })
+            .catch((err) => $logger.error({ err, to: userEmail }, 'Failed to send password change code email'));
+
+        return res.status(200).end();
+    };
+
+    changeOwnPassword = async (req: Request, res: Response) => {
+        const userEmail = req.appUser.getUserData()?.email;
+        if (!userEmail) {
+            return res.status(400).end();
+        }
+
+        const userData = await req.appUser.authManager.repository.getUserByLogin(userEmail, true);
+        if (!userData) {
+            return res.status(400).send();
+        }
+
+        if (this.passwordChangeConfirmationMode() === 'password') {
+            const parsedData = ChangeOwnPasswordByPasswordSchema.safeParse(req.body);
+            if (!parsedData.success) {
+                return res.status(400).send();
+            }
+
+            const validPassword = await this.comparePasswords(parsedData.data.currentPassword, userData.password);
+            if (!validPassword) {
+                return res.status(403).send({ field: 'currentPassword' });
+            }
+
+            return this.applyNewPassword(res, req, userData.id, parsedData.data.password);
+        }
+
+        const parsedData = ChangeOwnPasswordSchema.safeParse(req.body);
+        if (!parsedData.success) {
+            return res.status(400).send();
+        }
+
+        if (!userData.remind_password_code || !userData.remind_password_time) {
+            return res.status(400).send();
+        }
+
+        const now = Math.floor(Date.now() / 1000);
+        if (now > userData.remind_password_time + PASSWORD_CHANGE_CODE_TTL_S) {
+            return res.status(400).send();
+        }
+
+        if (userData.remind_password_code !== parsedData.data.code) {
+            return res.status(400).send();
+        }
+
+        await req.appUser.authManager.repository.setReminderCodeAndTime(userEmail, null, null);
+
+        return this.applyNewPassword(res, req, userData.id, parsedData.data.password);
+    };
+
+    private async applyNewPassword(res: Response, req: Request, userId: number, newPassword: string) {
+        const passwordHash = hashSync(newPassword, 10);
+        const result = await req.appUser.authManager.repository.updateUserPassword(passwordHash, userId);
+        if (!result) {
+            $logger.error(`Can not update password for user ${userId}`);
+            return res.status(500).send();
+        }
+
+        const currentSessionId = req.appUser.getTokenId();
+        await req.appUser.authManager.sessionStorage.deleteAllSessions(userId, currentSessionId);
+
+        return res.status(200).send({ changed: true });
+    }
+
+    changeDefaultUserCredentials = async (req: Request, res: Response) => {
+        const parsedData = ChangeDefaultUserCredentialsSchema.safeParse(req.body);
+        if (!parsedData.success) {
+            return res.status(400).send();
+        }
+
+        const userEmail = req.appUser.getUserData()?.email;
+        if (!userEmail) {
+            return res.status(400).end();
+        }
+
+        const userData = await req.appUser.authManager.repository.getUserByLogin(userEmail, true);
+        if (!userData || userData.email.toLowerCase() !== DEFAULT_USER_EMAIL) {
+            return res.status(403).send();
+        }
+
+        const validPassword = await this.comparePasswords(parsedData.data.currentPassword, userData.password);
+        if (!validPassword) {
+            return res.status(403).send({ field: 'currentPassword' });
+        }
+
+        const { login, email } = parsedData.data;
+
+        if (login !== userData.login && (await req.appUser.authManager.repository.getUserByLogin(login))) {
+            return res.status(409).send({ field: 'login' });
+        }
+        if (email !== userData.email && (await req.appUser.authManager.repository.getUserByLogin(email, true))) {
+            return res.status(409).send({ field: 'email' });
+        }
+
+        const updated = await req.appUser.authManager.repository.updateUserCredentials({
+            userId: userData.id,
+            oldEmail: userData.email,
+            login,
+            email,
+            passwordHash: hashSync(parsedData.data.password, 10),
+        });
+        if (updated === 'conflict') {
+            return res.status(409).send({ field: 'email' });
+        }
+        if (updated !== 'ok') {
+            return res.status(500).send();
+        }
+
+        // JWTs carry login/email and refresh does not re-read them from the DB,
+        // so drop every session and make the user sign in with the new credentials.
+        await req.appUser.authManager.sessionStorage.deleteAllSessions(userData.id);
+        this.clearRefreshToken(res);
+
+        return res.status(200).send({ changed: true });
+    };
+
     sendDeleteAccountCode = async (req: Request, res: Response) => {
         const userId = req.appUser.getUserData()?.id;
         const userEmail = req.appUser.getUserData()?.email;

api/src/tv-modules/auth/AuthModel.ts

@@ -1,6 +1,8 @@
+import { eq, sql } from 'drizzle-orm';
+import { CollaborationUsersSchema, OrganizationMembersSchema, SsoIdentitiesSchema, UsersSchema } from 'taskview-db-schemas';
 import { Database } from '../../modules/db';
 import { $logger } from '../../modules/logget';
-import type { RegisterUserInDb, UserDbRecord } from '../../types/auth.types';
+import type { RegisterUserInDb, UpdateUserCredentialsArgs, UpdateUserEmailArgs, UpdateUserCredentialsResult, UserDbRecord } from '../../types/auth.types';
 
 export default class AuthModel {
     private readonly db: Database;
@@ -67,6 +69,28 @@ export default class AuthModel {
         }
     }
 
+    async isEmailInvited(email: string): Promise<boolean> {
+        const normalized = email.toLowerCase();
+        try {
+            const orgMembers = await this.db.dbDrizzle
+                .select({ email: OrganizationMembersSchema.email })
+                .from(OrganizationMembersSchema)
+                .where(sql`lower(${OrganizationMembersSchema.email}) = ${normalized}`)
+                .limit(1);
+            if (orgMembers.length > 0) return true;
+
+            const collaborators = await this.db.dbDrizzle
+                .select({ email: CollaborationUsersSchema.email })
+                .from(CollaborationUsersSchema)
+                .where(sql`lower(${CollaborationUsersSchema.email}) = ${normalized}`)
+                .limit(1);
+            return collaborators.length > 0;
+        } catch (error: unknown) {
+            $logger.error(error, '[AuthModel:isEmailInvited] failed to check invitations');
+            return false;
+        }
+    }
+
     async fetchUserById(id: number): Promise<UserDbRecord | false> {
         const query = 'SELECT * FROM tv_auth.users WHERE id = $1;';
         try {
@@ -95,6 +119,21 @@ export default class AuthModel {
         }
     }
 
+    async markEmailConfirmed(email: string): Promise<boolean> {
+        if (!email) return false;
+
+        try {
+            const result = await this.db.dbDrizzle
+                .update(UsersSchema)
+                .set({ confirmEmailCode: null, block: 0 })
+                .where(eq(UsersSchema.email, email));
+            return (result.rowCount ?? 0) > 0;
+        } catch (error) {
+            $logger.error(error, `Error marking email confirmed for ${email}`);
+            return false;
+        }
+    }
+
     async confirmEmail(login: string, code: string, block: number): Promise<boolean> {
         const query = `UPDATE tv_auth.users 
                    SET confirm_email_code = NULL, block = $1 
@@ -133,6 +172,69 @@ export default class AuthModel {
         }
     }
 
+    async updateUserCredentials(args: UpdateUserCredentialsArgs): Promise<UpdateUserCredentialsResult> {
+        try {
+            await this.db.dbDrizzle.transaction(async (tx) => {
+                await tx
+                    .update(UsersSchema)
+                    .set({ login: args.login, email: args.email, password: args.passwordHash })
+                    .where(eq(UsersSchema.id, args.userId));
+                await tx
+                    .update(OrganizationMembersSchema)
+                    .set({ email: args.email })
+                    .where(eq(OrganizationMembersSchema.email, args.oldEmail));
+                await tx
+                    .update(CollaborationUsersSchema)
+                    .set({ email: args.email })
+                    .where(eq(CollaborationUsersSchema.email, args.oldEmail));
+                await tx
+                    .update(SsoIdentitiesSchema)
+                    .set({ email: args.email })
+                    .where(eq(SsoIdentitiesSchema.userId, args.userId));
+            });
+            return 'ok';
+        } catch (error) {
+            // unique(organization_id, email): the new email is already an invited member of one of the user's orgs
+            const pgCode = (error as { code?: string })?.code ?? (error as { cause?: { code?: string } })?.cause?.code;
+            if (pgCode === '23505') {
+                return 'conflict';
+            }
+            $logger.error(error, `Can not update credentials for user ${args.userId}`);
+            return 'error';
+        }
+    }
+
+    async updateUserEmail(args: UpdateUserEmailArgs): Promise<UpdateUserCredentialsResult> {
+        try {
+            await this.db.dbDrizzle.transaction(async (tx) => {
+                await tx
+                    .update(UsersSchema)
+                    .set({ email: args.email })
+                    .where(eq(UsersSchema.id, args.userId));
+                await tx
+                    .update(OrganizationMembersSchema)
+                    .set({ email: args.email })
+                    .where(eq(OrganizationMembersSchema.email, args.oldEmail));
+                await tx
+                    .update(CollaborationUsersSchema)
+                    .set({ email: args.email })
+                    .where(eq(CollaborationUsersSchema.email, args.oldEmail));
+                await tx
+                    .update(SsoIdentitiesSchema)
+                    .set({ email: args.email })
+                    .where(eq(SsoIdentitiesSchema.userId, args.userId));
+            });
+            return 'ok';
+        } catch (error) {
+            const pgCode = (error as { code?: string })?.code ?? (error as { cause?: { code?: string } })?.cause?.code;
+            if (pgCode === '23505') {
+                return 'conflict';
+            }
+            $logger.error(error, `Can not update email for user ${args.userId}`);
+            return 'error';
+        }
+    }
+
     async updateUserPassword(password: string, userId: number): Promise<boolean> {
         try {
             const query = 'UPDATE tv_auth.users SET password = $1 WHERE id = $2';

api/src/tv-modules/auth/AuthRoutes.ts

@@ -2,6 +2,8 @@ import { Router, type NextFunction, type Request, type Response } from 'express'
 import type { Routable } from '../../types/routable.type';
 import AuthController from './AuthController';
 import { IsLoggedIn } from './middlewares/is-logged-in';
+import { RejectApiTokenAuth } from '../api-tokens/middlewares/RejectApiTokenAuth';
+import { RequireAnyLoginMethod, RequireLoginMethod, RequireSocialProvider } from './middlewares/require-login-method';
 import passport from './strategies/passport-login';
 import { ExternalProviderScope } from './strategies/external-auth.types';
 export default class AuthRoutes implements Routable {
@@ -19,13 +21,20 @@ export default class AuthRoutes implements Routable {
     }
 
     initRoutes() {
-        this.router.post('/send-login-code', this.authController.sendLoginCode);
-        this.router.post('/login-by-code', this.authController.loginByCode);
-        this.router.post('/login', this.authController.login);
+        this.router.get('/login-options', this.authController.getLoginOptions);
+        this.router.post('/send-login-code', [RequireLoginMethod('magic-link')], this.authController.sendLoginCode);
+        // Shared one-time-code redemption: magic-link emails, SSO callbacks and social
+        // OAuth callbacks all complete the login through this endpoint
+        this.router.post('/login-by-code', [RequireAnyLoginMethod(['magic-link', 'sso', 'social'])], this.authController.loginByCode);
+        this.router.post('/login', [RequireLoginMethod('password')], this.authController.login);
         this.router.post('/registration', this.authController.registration);
         this.router.get('/confirm/email/:code/login/:login', this.authController.confirmEmail);
-        this.router.post('/email/recovery', this.authController.remindPassword);
-        this.router.post('/password/reset', this.authController.changeRemindedPassword);
+        this.router.post('/email/recovery', [RequireLoginMethod('password')], this.authController.remindPassword);
+        this.router.post('/password/reset', [RequireLoginMethod('password')], this.authController.changeRemindedPassword);
+        this.router.get('/password/change/mode', [IsLoggedIn], this.authController.getPasswordChangeMode);
+        this.router.post('/password/change/code', [IsLoggedIn, RejectApiTokenAuth], this.authController.sendPasswordChangeCode);
+        this.router.post('/password/change', [IsLoggedIn, RejectApiTokenAuth], this.authController.changeOwnPassword);
+        this.router.post('/credentials/change', [IsLoggedIn, RejectApiTokenAuth], this.authController.changeDefaultUserCredentials);
         this.router.post('/logout', [IsLoggedIn], this.authController.logout);
         this.router.post('/refresh/token', this.authController.refreshTokens);
         this.router.post('/delete/account/code', [IsLoggedIn], this.authController.sendDeleteAccountCode);
@@ -33,6 +42,7 @@ export default class AuthRoutes implements Routable {
 
         this.router.get(
             '/provider/:providerName',
+            RequireSocialProvider,
             (req: Request, res: Response, next: NextFunction) => passport.authenticate(req.params.providerName, {
                 scope: ExternalProviderScope[req.params.providerName],
                 session: false,
@@ -43,6 +53,7 @@ export default class AuthRoutes implements Routable {
         );
         this.router.get(
             '/provider/:providerName/callback',
+            RequireSocialProvider,
             (req: Request, res: Response, next: NextFunction) => passport.authenticate(req.params.providerName, {
                 scope: ExternalProviderScope[req.params.providerName], session: false
             })(req, res, next),
@@ -51,6 +62,7 @@ export default class AuthRoutes implements Routable {
 
         this.router.post(
             '/provider/:providerName/callback',
+            RequireSocialProvider,
             (req: Request, res: Response, next: NextFunction) => passport.authenticate(req.params.providerName, {
                 scope: ExternalProviderScope[req.params.providerName], session: false
             })(req, res, next),

api/src/tv-modules/auth/LoginMethods.ts

@@ -0,0 +1,80 @@
+import type { LoginMethod } from '../../types/auth.types';
+
+export class LoginMethods {
+    static readonly ALL: LoginMethod[] = ['magic-link', 'password', 'sso', 'social'];
+
+    static enabled(): Set<LoginMethod> {
+        const raw = process.env.AUTH_LOGIN_METHODS;
+        if (!raw || !raw.trim()) {
+            return new Set(LoginMethods.ALL);
+        }
+        return new Set(LoginMethods.parse(raw).valid);
+    }
+
+    static isEnabled(method: LoginMethod): boolean {
+        return LoginMethods.enabled().has(method);
+    }
+
+    static publicRegistrationAllowed(): boolean {
+        return process.env.ALLOW_PUBLIC_REGISTRATION?.trim().toLowerCase() !== 'false';
+    }
+
+    static validateOnStartup(): void {
+        const registrationRaw = process.env.ALLOW_PUBLIC_REGISTRATION;
+        if (registrationRaw !== undefined && registrationRaw.trim() !== '') {
+            const normalized = registrationRaw.trim().toLowerCase();
+            if (normalized !== 'true' && normalized !== 'false') {
+                throw new Error(
+                    `ALLOW_PUBLIC_REGISTRATION has unrecognized value "${registrationRaw}". Allowed: true, false`
+                );
+            }
+        }
+
+        const raw = process.env.AUTH_LOGIN_METHODS;
+        if (!raw || !raw.trim()) return;
+
+        const { valid, invalid } = LoginMethods.parse(raw);
+        if (invalid.length > 0) {
+            throw new Error(
+                `AUTH_LOGIN_METHODS contains unknown values: ${invalid.join(', ')}. Allowed: ${LoginMethods.ALL.join(', ')}`
+            );
+        }
+        if (valid.length === 0) {
+            throw new Error('AUTH_LOGIN_METHODS disables every login method — nobody would be able to sign in');
+        }
+    }
+
+    static configuredSocialProviders(): string[] {
+        const providers: string[] = [];
+        if (process.env.GOOGLE_CLIENT_ID && process.env.GOOGLE_CLIENT_SECRET && process.env.GOOGLE_CALLBACK_URL) {
+            providers.push('google');
+        }
+        if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET && process.env.GITHUB_CALLBACK_URL) {
+            providers.push('github');
+        }
+        if (
+            process.env.APPLE_CLIENT_ID &&
+            process.env.APPLE_TEAM_ID &&
+            process.env.APPLE_KEY_ID &&
+            process.env.APPLE_CALLBACK_URL &&
+            process.env.APPLE_KEY_LOCATION
+        ) {
+            providers.push('apple');
+        }
+        return providers;
+    }
+
+    static availableSocialProviders(): string[] {
+        return LoginMethods.isEnabled('social') ? LoginMethods.configuredSocialProviders() : [];
+    }
+
+    private static parse(raw: string): { valid: LoginMethod[]; invalid: string[] } {
+        const values = raw
+            .split(',')
+            .map((value) => value.trim().toLowerCase())
+            .filter(Boolean);
+        const valid = values.filter((value): value is LoginMethod => (LoginMethods.ALL as string[]).includes(value));
+        const invalid = values.filter((value) => !(LoginMethods.ALL as string[]).includes(value));
+        return { valid, invalid };
+    }
+}

api/src/tv-modules/auth/__tests__/Auth.spec.ts

@@ -512,4 +512,65 @@ describe('Login API', () => {
 
         expect(te).toBe(0);
     });
+
+    it('loginByCode confirms and admits a blocked-unconfirmed account', async () => {
+        deleteTestUserEmail = `${Date.now()}test@mail.dest`;
+        const email = deleteTestUserEmail;
+
+        await axios.post(`${url}/module/auth/registration`, {
+            email,
+            password: 'user1!#Q',
+            passwordRepeat: 'user1!#Q',
+        });
+
+        const userModel = new AuthModel();
+        const before = await userModel.getUserByLogin(email, true);
+        expect(before).toBeTruthy();
+        expect((before as any).block).toBe(1);
+        expect((before as any).confirm_email_code).toBeTruthy();
+
+        const code = '654321';
+        await userModel.updateLoginCode(`${code}:${Date.now()}`, email);
+
+        const response = await axios.post(`${url}/module/auth/login-by-code`, { email, code });
+
+        expect(response.status).toBe(200);
+        expect(response.data.access).toBeTruthy();
+        expect(response.data.refresh).toBeTruthy();
+
+        const after = await userModel.getUserByLogin(email, true);
+        expect((after as any).block).toBe(0);
+        expect((after as any).confirm_email_code).toBeNull();
+    });
+
+    it('loginByCode rejects a banned account (blocked, no confirm code)', async () => {
+        deleteTestUserEmail = `${Date.now()}test@mail.dest`;
+        const email = deleteTestUserEmail;
+
+        await axios.post(`${url}/module/auth/registration`, {
+            email,
+            password: 'user1!#Q',
+            passwordRepeat: 'user1!#Q',
+        });
+
+        const db = Database.getInstance();
+        await db.query('update tv_auth.users set block = 1, confirm_email_code = null where email = $1', [email]);
+
+        const userModel = new AuthModel();
+        const code = '112233';
+        await userModel.updateLoginCode(`${code}:${Date.now()}`, email);
+
+        let status = 0;
+        let message = '';
+        await axios.post(`${url}/module/auth/login-by-code`, { email, code }).catch((err) => {
+            status = err.response.status;
+            message = err.response.data.message;
+        });
+
+        expect(status).toBe(403);
+        expect(message).toBe('account_blocked');
+
+        const after = await userModel.getUserByLogin(email, true);
+        expect((after as any).block).toBe(1);
+    });
 });

api/src/tv-modules/auth/middlewares/require-login-method.ts

@@ -0,0 +1,29 @@
+import type { NextFunction, Request, Response } from 'express';
+import type { LoginMethod } from '../../../types/auth.types';
+import { LoginMethods } from '../LoginMethods';
+
+export const RequireLoginMethod = (method: LoginMethod) => {
+    return (_req: Request, res: Response, next: NextFunction) => {
+        if (!LoginMethods.isEnabled(method)) {
+            return res.status(403).send();
+        }
+        return next();
+    };
+};
+
+export const RequireAnyLoginMethod = (methods: LoginMethod[]) => {
+    return (_req: Request, res: Response, next: NextFunction) => {
+        if (!methods.some((method) => LoginMethods.isEnabled(method))) {
+            return res.status(403).send();
+        }
+        return next();
+    };
+};
+
+export const RequireSocialProvider = (req: Request, res: Response, next: NextFunction) => {
+    const providerName = String(req.params.providerName || '').toLowerCase();
+    if (!LoginMethods.availableSocialProviders().includes(providerName)) {
+        return res.status(403).send();
+    }
+    return next();
+};

api/src/tv-modules/auth/strategies/apple.strategy.ts

@@ -16,8 +16,7 @@ export function initAppleStrategy() {
         !process.env.APPLE_KEY_ID ||
         !process.env.APPLE_CALLBACK_URL ||
         !process.env.APPLE_KEY_LOCATION) {
-        $logger.warn("APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_CALLBACK_URL, and APPLE_KEY_LOCATION must be set");
-        console.warn("APPLE_CLIENT_ID, APPLE_TEAM_ID, APPLE_KEY_ID, APPLE_CALLBACK_URL, and APPLE_KEY_LOCATION must be set");
+        $logger.debug("Apple login is not configured (APPLE_CLIENT_ID / APPLE_TEAM_ID / APPLE_KEY_ID / APPLE_CALLBACK_URL / APPLE_KEY_LOCATION) — skipping");
         return;
     }
 

api/src/tv-modules/auth/strategies/github.strategy.ts

@@ -7,8 +7,7 @@ import type { VerifyCallback } from "passport-google-oauth20";
 
 export function initGithubStrategy() {
     if (!process.env.GITHUB_CLIENT_ID || !process.env.GITHUB_CLIENT_SECRET || !process.env.GITHUB_CALLBACK_URL) {
-        $logger.warn("GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and GITHUB_CALLBACK_URL must be set");
-        console.warn("GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET, and GITHUB_CALLBACK_URL must be set");
+        $logger.debug("GitHub login is not configured (GITHUB_CLIENT_ID / GITHUB_CLIENT_SECRET / GITHUB_CALLBACK_URL) — skipping");
         return;
     }
 

api/src/tv-modules/auth/strategies/google.strategy.ts

@@ -5,8 +5,7 @@ import type { ExternalAuthUser } from "./external-auth.types";
 
 export function initGoogleStrategy() {
     if (!process.env.GOOGLE_CLIENT_ID || !process.env.GOOGLE_CLIENT_SECRET || !process.env.GOOGLE_CALLBACK_URL) {
-        $logger.warn("GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_CALLBACK_URL must be set");
-        console.warn("GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, and GOOGLE_CALLBACK_URL must be set");
+        $logger.debug("Google login is not configured (GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET / GOOGLE_CALLBACK_URL) — skipping");
         return;
     }
     const options = {

api/src/tv-modules/collaboration-roles/middlewares/CanFetchRolesPermissionsCollaborationRoles.ts

@@ -1,8 +1,12 @@
 import type { NextFunction, Request, Response } from 'express';
+import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
 import { $logger } from '../../../modules/logget';
+import { GoalPermissions } from '../../../types/auth.types';
+import { logError } from '../../../utils/api';
 
 export const CanFetchRolesPermissionsCollaborationRoles = async (req: Request, res: Response, next: NextFunction) => {
-    const goalId = req.body.goalId ? req.body.goalId : req.params.goalId;
+    // the only route using this guard names the goal in the path
+    const goalId = req.params.goalId;
 
     if (!goalId) {
         return res.status(400).end();
@@ -19,5 +23,18 @@ export const CanFetchRolesPermissionsCollaborationRoles = async (req: Request, r
         return next();
     }
 
+    const permissions = await req.appUser.permissionsFetcher
+        .getPermissionsForType(Number(goalId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_GOAL)
+        .catch(logError);
+
+    if (!permissions) {
+        $logger.error('Can not get permissions for CanFetchRolesPermissionsCollaborationRoles middleware');
+        return res.status(500).end();
+    }
+
+    if (permissions.hasPermissions(GoalPermissions.GOAL_CAN_MANAGE_USERS)) {
+        return next();
+    }
+
     return res.status(403).end();
 };

api/src/tv-modules/collaboration/CollaborationController.ts

@@ -16,6 +16,7 @@ import {
 } from './collaboration.types';
 
 export class CollaborationController {
+    /** @deprecated */
     fetchAllUsers = async (req: Request, res: Response) => {
         const users = await req.appUser.collaborationManager.fetchAllUsers();
         return res.tvJson(users);
@@ -82,19 +83,30 @@ export class CollaborationController {
             return res.status(400).send(output.summary);
         }
 
-        const user = await req.appUser.collaborationManager.addUserNew(output);
+        const result = await req.appUser.collaborationManager.addUserNew(output);
 
-        if (user) {
+        // created=false means the person was already in the goal — re-POSTing must not re-notify
+        if (result?.created) {
             eventBus.emit('collaboration.userAdded', {
                 goalId: output.goalId,
                 email: output.email.toLowerCase(),
                 initiatorId: req.appUser.getUserData()!.id,
+                locale: this.resolveLocale(req),
             });
         }
 
-        return res.tvJson(user ?? null);
+        return res.tvJson(result?.user ?? null);
     };
 
+    // The invitee has no stored locale (often no account yet), so localize by the inviter's browser language
+    private resolveLocale(req: Request): 'en' | 'ru' {
+        const acceptLanguage = req.headers['accept-language'];
+        if (!acceptLanguage) return 'en';
+
+        const languages = acceptLanguage.split(',').map((lang) => lang.split(';')[0].trim().toLowerCase());
+        return languages.some((lang) => lang === 'ru' || lang.startsWith('ru-')) ? 'ru' : 'en';
+    }
+
     deleteUserNew = async (req: Request, res: Response) => {
         const output = CollaborationArkTypeDeleteUser(req.body);
 

api/src/tv-modules/collaboration/CollaborationManager.ts

@@ -2,6 +2,7 @@ import type { AppUser } from '../../core/AppUser';
 import { GoalPermissions } from '../../types/auth.types';
 import { CollaborationRepository } from './CollaborationRepository';
 import type {
+    CollaborationAddUserResult,
     CollaborationArgAddUser,
     CollaborationArgDeleteUser,
     CollaborationArgToggleUserRoles,
@@ -24,6 +25,7 @@ export class CollaborationManager {
         this.repository = new CollaborationRepository();
     }
 
+    /** @deprecated */
     async fetchAllUsers(): Promise<CollaborationUserWithRoles[] | false> {
         const sharedGoals = await this.user.goalsManager.fetchSharedGoals();
 
@@ -69,6 +71,7 @@ export class CollaborationManager {
         return Object.values(resultMap);
     }
 
+    /** @deprecated */
     async fetchUsersForGoal(args: FetchGoalUsersArg): Promise<CollaborationUserWithRoles[] | false> {
         const users = await this.repository.fetchUsersForGoal(args.goalId);
 
@@ -103,6 +106,7 @@ export class CollaborationManager {
         return Object.values(resultMap);
     }
 
+    /** @deprecated*/
     async toggleUserRoles(args: ToggleUserRolesArg): Promise<number[] | false> {
         return await this.repository.updateUserRoles(args.userId, args.roles);
     }
@@ -120,7 +124,7 @@ export class CollaborationManager {
         return await this.repository.deleteUser(args);
     }
 
-    async addUserNew(args: CollaborationArgAddUser): Promise<CollaborationUserWithRoles | null> {
+    async addUserNew(args: CollaborationArgAddUser): Promise<CollaborationAddUserResult | null> {
         const email = args.email.toLowerCase();
 
         const goal = await this.user.goalsManager.goalsRepository.findGoalById(args.goalId);
@@ -131,19 +135,22 @@ export class CollaborationManager {
             }
         }
 
-        const user = await this.repository.addUserForCollaborationNew({
+        const result = await this.repository.addUserForCollaborationNew({
             ...args,
             email,
         });
-        if (!user) return null;
+        if (!result) return null;
 
         return {
-            ...user,
-            goalId: args.goalId,
-            goal_id: args.goalId,
-            invitation_date: user.invitationDate,
-            roles: [],
-            goalOwner: false,
+            user: {
+                ...result.user,
+                goalId: args.goalId,
+                goal_id: args.goalId,
+                invitation_date: result.user.invitationDate,
+                roles: [],
+                goalOwner: false,
+            },
+            created: result.created,
         };
     }
 
@@ -177,7 +184,7 @@ export class CollaborationManager {
             return [];
         }
 
-        
+
         const resultMap: Record<string, CollaborationUserWithRoles> = {};
 
         users.forEach((item) => {
@@ -210,7 +217,7 @@ export class CollaborationManager {
             return [];
         }
 
-        
+
         const resultMap: Record<string, CollaborationUserWithRoles> = {};
 
         users.forEach((item) => {

api/src/tv-modules/collaboration/CollaborationRepository.ts

@@ -1,5 +1,6 @@
-import { and, eq, inArray } from 'drizzle-orm';
+import { and, eq, exists, inArray } from 'drizzle-orm';
 import {
+    CollaborationRolesSchema,
     CollaborationUsersSchema,
     type CollaborationUsersSchemaTypeForSelect,
     CollaborationUsersToGoalsSchema,
@@ -10,6 +11,7 @@ import { $logger } from '../../modules/logget';
 import { logError } from '../../utils/api';
 import { callWithCatch } from '../../utils/helpers';
 import type {
+    CollaborationAddUserRepoResult,
     CollaborationArgAddUser,
     CollaborationArgDeleteUser,
     CollaborationArgToggleUserRoles,
@@ -23,6 +25,7 @@ export class CollaborationRepository {
         this.db = Database.getInstance();
     }
 
+    /** @deprecated */
     async fetchAllUsers(goalIds: number[]): Promise<FetchUsersForGoal[] | false> {
         if (goalIds.length === 0) {
             return [];
@@ -34,6 +37,10 @@ export class CollaborationRepository {
           FROM collaboration.users u
           left join collaboration.users_to_goals utg on u.id = utg.user_id
           LEFT JOIN collaboration.users_to_roles utr ON u.id = utr.user_id
+            AND EXISTS (
+              SELECT 1 FROM collaboration.roles r
+              WHERE r.id = utr.role_id AND r.goal_id = utg.goal_id
+            )
           WHERE utg.goal_id IN (${placeholders})
         `;
 
@@ -91,7 +98,8 @@ export class CollaborationRepository {
         return result.rows[0];
     }
 
-    
+
+    /** @deprecated */
     async fetchUsersForGoal(goalId: number): Promise<FetchUsersForGoal[] | false> {
         const query = `
           SELECT u.*, u.invitation_date::text, utr.role_id, utg.goal_id
@@ -111,6 +119,7 @@ export class CollaborationRepository {
         return result.rows;
     }
 
+    /** @deprecated */
     async fetchUsersForGoals(goalIds: number[]): Promise<FetchUsersForGoal[] | false> {
         if (goalIds.length === 0) {
             return [];
@@ -145,6 +154,7 @@ export class CollaborationRepository {
         return !!(result.rowCount && result.rowCount > 0);
     }
 
+    /** @deprecated */
     async updateUserRoles(userId: number, roles: number[]): Promise<number[] | false> {
         const deleteQuery = `DELETE FROM collaboration.users_to_roles WHERE user_id = $1`;
         let i = 1;
@@ -197,8 +207,8 @@ export class CollaborationRepository {
 
     async addUserForCollaborationNew(
         args: CollaborationArgAddUser
-    ): Promise<CollaborationUsersSchemaTypeForSelect | null> {
-        const user = await callWithCatch(() =>
+    ): Promise<CollaborationAddUserRepoResult | null> {
+        return await callWithCatch(() =>
             this.db.dbDrizzle.transaction(async (tx) => {
                 let userId: number;
                 let user: CollaborationUsersSchemaTypeForSelect;
@@ -217,18 +227,14 @@ export class CollaborationRepository {
                     user = userTransaction;
                 }
 
-                await tx.insert(CollaborationUsersToGoalsSchema).values({
+                const linked = await tx.insert(CollaborationUsersToGoalsSchema).values({
                     userId: userId,
                     goalId: args.goalId,
-                }).onConflictDoNothing();
+                }).onConflictDoNothing().returning();
 
-                return user;
+                return { user, created: linked.length > 0 };
             })
         );
-
-        if (!user) return null;
-
-        return user;
     }
 
     async deleteUserNew(args: CollaborationArgDeleteUser) {
@@ -250,13 +256,29 @@ export class CollaborationRepository {
     async toggleUserRolesNew(args: CollaborationArgToggleUserRoles): Promise<number[]> {
         const result = await callWithCatch(() =>
             this.db.dbDrizzle.transaction(async (tx) => {
-                await tx
-                    .delete(CollaborationUsersToRolesSchema)
-                    .where(eq(CollaborationUsersToRolesSchema.userId, args.userId));
-                if (args.roles.length > 0) {
+
+                const goalRoles = await tx
+                    .select({ id: CollaborationRolesSchema.id })
+                    .from(CollaborationRolesSchema)
+                    .where(eq(CollaborationRolesSchema.goalId, args.goalId));
+                const goalRoleIds = goalRoles.map((role) => role.id);
+
+                if (goalRoleIds.length > 0) {
+                    await tx
+                        .delete(CollaborationUsersToRolesSchema)
+                        .where(
+                            and(
+                                eq(CollaborationUsersToRolesSchema.userId, args.userId),
+                                inArray(CollaborationUsersToRolesSchema.roleId, goalRoleIds)
+                            )
+                        );
+                }
+
+                const rolesToAssign = args.roles.filter((roleId) => goalRoleIds.includes(roleId));
+                if (rolesToAssign.length > 0) {
                     return await tx
                         .insert(CollaborationUsersToRolesSchema)
-                        .values(args.roles.map((roleId) => ({ userId: args.userId, roleId })))
+                        .values(rolesToAssign.map((roleId) => ({ userId: args.userId, roleId })))
                         .returning();
                 }
                 return [];
@@ -287,7 +309,20 @@ export class CollaborationRepository {
                 )
                 .leftJoin(
                     CollaborationUsersToRolesSchema,
-                    eq(CollaborationUsersSchema.id, CollaborationUsersToRolesSchema.userId)
+                    and(
+                        eq(CollaborationUsersSchema.id, CollaborationUsersToRolesSchema.userId),
+                        exists(
+                            this.db.dbDrizzle
+                                .select()
+                                .from(CollaborationRolesSchema)
+                                .where(
+                                    and(
+                                        eq(CollaborationRolesSchema.id, CollaborationUsersToRolesSchema.roleId),
+                                        eq(CollaborationRolesSchema.goalId, CollaborationUsersToGoalsSchema.goalId)
+                                    )
+                                )
+                        )
+                    )
                 )
                 .where(inArray(CollaborationUsersToGoalsSchema.goalId, goalIds))
         );
@@ -311,7 +346,20 @@ export class CollaborationRepository {
                 )
                 .leftJoin(
                     CollaborationUsersToRolesSchema,
-                    eq(CollaborationUsersSchema.id, CollaborationUsersToRolesSchema.userId)
+                    and(
+                        eq(CollaborationUsersSchema.id, CollaborationUsersToRolesSchema.userId),
+                        exists(
+                            this.db.dbDrizzle
+                                .select()
+                                .from(CollaborationRolesSchema)
+                                .where(
+                                    and(
+                                        eq(CollaborationRolesSchema.id, CollaborationUsersToRolesSchema.roleId),
+                                        eq(CollaborationRolesSchema.goalId, CollaborationUsersToGoalsSchema.goalId)
+                                    )
+                                )
+                        )
+                    )
                 )
                 .where(eq(CollaborationUsersToGoalsSchema.goalId, goalId))
         );

api/src/tv-modules/collaboration/CollaborationRoutes.ts

@@ -5,7 +5,7 @@ import { IsOrgMemberIfProvided } from '../../middlewares/is-org-member';
 import { CollaborationController } from './CollaborationController';
 import { CanAddUserCollaboration } from './middlewares/CanAddUserCollaboration';
 import { CanDeleteUserCollaboration } from './middlewares/CanDeleteUserCollaboration';
-// import { CanFetchUsersCollaboration } from './middlewares/CanFetchUsersCollaboration';
+import { CanFetchUsersCollaboration } from './middlewares/CanFetchUsersCollaboration';
 import { CanToggleRolesCollaboration } from './middlewares/CanToggleRolesCollaboration';
 
 export default class CollaborationRoutes implements Routable {
@@ -56,6 +56,10 @@ export default class CollaborationRoutes implements Routable {
         /**
          * Fetch users for goal for collaboration
          */
-        this.router.get('/:goalId', [IsLoggedIn], this.collaborationController.fetchUsersForGoalNew);
+        this.router.get(
+            '/:goalId',
+            [IsLoggedIn, CanFetchUsersCollaboration],
+            this.collaborationController.fetchUsersForGoalNew
+        );
     }
 }

api/src/tv-modules/collaboration/InviteEmailDispatcher.ts

@@ -0,0 +1,183 @@
+import { and, count, eq, gte, lt, sql } from 'drizzle-orm';
+import { GoalsSchema, InviteEmailsSchema, OrganizationsSchema, UsersSchema } from 'taskview-db-schemas';
+import type { Dispatcher } from '../../core/Dispatcher';
+import { Email } from '../../core/Email';
+import { eventBus, type AppEvents } from '../../core/EventBus';
+import { Database } from '../../modules/db';
+import { $logger } from '../../modules/logget';
+import { escapeHtml, parsePositiveInt } from '../../utils/helpers';
+import InviteEmailTemplateEn from './mail/invite-en';
+import InviteEmailTemplateRu from './mail/invite-ru';
+import type { InviteEmailRateLimitArgs, InviteEmailSendArgs } from './collaboration.server.types';
+
+const DEFAULT_HOURLY_LIMIT = 30;
+
+export class InviteEmailDispatcher implements Dispatcher {
+    static enabled(): boolean {
+        return process.env.INVITE_EMAIL_ENABLED?.trim().toLowerCase() === 'true';
+    }
+
+    static hourlyLimit(): number {
+        return parsePositiveInt(process.env.INVITE_EMAIL_HOURLY_LIMIT) ?? DEFAULT_HOURLY_LIMIT;
+    }
+
+    static validateOnStartup(): void {
+        const enabledRaw = process.env.INVITE_EMAIL_ENABLED;
+        if (enabledRaw !== undefined && enabledRaw.trim() !== '') {
+            const normalized = enabledRaw.trim().toLowerCase();
+            if (normalized !== 'true' && normalized !== 'false') {
+                throw new Error(`INVITE_EMAIL_ENABLED has unrecognized value "${enabledRaw}". Allowed: true, false`);
+            }
+        }
+
+        const limitRaw = process.env.INVITE_EMAIL_HOURLY_LIMIT;
+        if (limitRaw !== undefined && limitRaw.trim() !== '' && parsePositiveInt(limitRaw) === null) {
+            throw new Error(
+                `INVITE_EMAIL_HOURLY_LIMIT has unrecognized value "${limitRaw}". Expected a positive integer`
+            );
+        }
+    }
+
+    register(): void {
+        eventBus.on('collaboration.userAdded', (data) => this.onUserAdded(data));
+    }
+
+    async registerWorkers(): Promise<void> {}
+
+    private async onUserAdded(data: AppEvents['collaboration.userAdded']): Promise<void> {
+        if (!InviteEmailDispatcher.enabled() || !process.env.SMTP_HOST) return;
+
+        const db = Database.getInstance();
+
+        const [goal] = await db.dbDrizzle
+            .select({ name: GoalsSchema.name, organizationId: GoalsSchema.organizationId })
+            .from(GoalsSchema)
+            .where(eq(GoalsSchema.id, data.goalId))
+            .limit(1);
+        if (!goal) return;
+
+        const [inviter] = await db.dbDrizzle
+            .select({ login: UsersSchema.login })
+            .from(UsersSchema)
+            .where(eq(UsersSchema.id, data.initiatorId))
+            .limit(1);
+        if (!inviter) return;
+
+        const allowed = await this.passesRateLimit({
+            initiatorId: data.initiatorId,
+            email: data.email,
+            goalId: data.goalId,
+        });
+        if (!allowed) return;
+
+        const link = await this.buildGoalLink(data.goalId, goal.organizationId);
+        if (!link) {
+            $logger.warn('APP_URL is not set — skipping invite email');
+            return;
+        }
+
+        await db.dbDrizzle.insert(InviteEmailsSchema).values({
+            initiatorId: data.initiatorId,
+            email: data.email,
+            goalId: data.goalId,
+        });
+
+        const fallbackName = data.locale === 'ru' ? 'Пользователь TaskView' : 'A TaskView user';
+
+        await this.sendInviteEmail({
+            email: data.email,
+            inviterName: this.truncate(inviter.login?.trim() || fallbackName),
+            goalName: this.truncate(goal.name || ''),
+            link,
+            locale: data.locale,
+        });
+    }
+
+    // Two rules: a 24h cooldown per (goal, recipient) — closes the delete/re-add resend loop —
+    // and an hourly cap per initiator against using the instance as a mail relay.
+    // Rows older than the cooldown window are pruned first, keeping the table tiny.
+    private async passesRateLimit(args: InviteEmailRateLimitArgs): Promise<boolean> {
+        const db = Database.getInstance();
+
+        await db.dbDrizzle
+            .delete(InviteEmailsSchema)
+            .where(lt(InviteEmailsSchema.sentAt, sql`now() - interval '24 hours'`));
+
+        const [cooldown] = await db.dbDrizzle
+            .select({ id: InviteEmailsSchema.id })
+            .from(InviteEmailsSchema)
+            .where(and(eq(InviteEmailsSchema.goalId, args.goalId), eq(InviteEmailsSchema.email, args.email)))
+            .limit(1);
+        if (cooldown) return false;
+
+        const [hourly] = await db.dbDrizzle
+            .select({ count: count() })
+            .from(InviteEmailsSchema)
+            .where(
+                and(
+                    eq(InviteEmailsSchema.initiatorId, args.initiatorId),
+                    gte(InviteEmailsSchema.sentAt, sql`now() - interval '1 hour'`)
+                )
+            );
+        if ((hourly?.count ?? 0) >= InviteEmailDispatcher.hourlyLimit()) {
+            $logger.warn(
+                { initiatorId: args.initiatorId, goalId: args.goalId },
+                'Invite email hourly limit reached — skipping send'
+            );
+            return false;
+        }
+
+        return true;
+    }
+
+    private async sendInviteEmail(args: InviteEmailSendArgs): Promise<void> {
+        const template = args.locale === 'ru' ? InviteEmailTemplateRu : InviteEmailTemplateEn;
+        const subject =
+            args.locale === 'ru'
+                ? `${args.inviterName} приглашает вас в проект «${args.goalName}» в TaskView`
+                : `${args.inviterName} invited you to "${args.goalName}" on TaskView`;
+        const text =
+            args.locale === 'ru'
+                ? `${args.inviterName} приглашает вас присоединиться к проекту «${args.goalName}» в TaskView.\n\nОткрыть проект: ${args.link}`
+                : `${args.inviterName} has invited you to join the project "${args.goalName}" on TaskView.\n\nOpen the project: ${args.link}`;
+
+        // Single-pass replace with a function: no re-substitution of placeholders inside
+        // inserted values, and no special treatment of $-patterns in the replacement
+        const values: Record<string, string> = {
+            inviter: args.inviterName,
+            project: args.goalName,
+            link: args.link,
+        };
+        const html = template.replace(/\{(inviter|project|link)\}/g, (_, key: string) => escapeHtml(values[key]));
+
+        await Email.send({
+            text,
+            subject,
+            to: args.email,
+            from: process.env.SMTP_FROM_EMAIL as string,
+            attachment: [{ data: html, alternative: true }],
+        });
+    }
+
+    // Frontend project route is /:orgSlug/:projectId; goals without an organization fall back to the app root
+    private async buildGoalLink(goalId: number, organizationId: number | null): Promise<string | null> {
+        const appUrl = (process.env.APP_URL ?? '').replace(/\/+$/, '');
+        if (!appUrl) return null;
+        if (!organizationId) return appUrl;
+
+        const db = Database.getInstance();
+        const [org] = await db.dbDrizzle
+            .select({ slug: OrganizationsSchema.slug })
+            .from(OrganizationsSchema)
+            .where(eq(OrganizationsSchema.id, organizationId))
+            .limit(1);
+        if (!org?.slug) return appUrl;
+
+        return `${appUrl}/${encodeURIComponent(org.slug)}/${goalId}`;
+    }
+
+    private truncate(value: string): string {
+        const max = 80;
+        return value.length > max ? `${value.slice(0, max)}…` : value;
+    }
+}

api/src/tv-modules/collaboration/__tests__/InviteEmailDispatcher.spec.ts

@@ -0,0 +1,233 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { Email } from '../../../core/Email';
+import type { AppEvents } from '../../../core/EventBus';
+import { Database } from '../../../modules/db';
+import { InviteEmailDispatcher } from '../InviteEmailDispatcher';
+
+vi.mock('../../../core/Email', () => ({
+    Email: {
+        send: vi.fn().mockResolvedValue(true),
+    },
+}));
+
+vi.mock('../../../modules/db', () => ({
+    Database: {
+        getInstance: vi.fn(),
+    },
+}));
+
+// Each select() call consumes the next result; the returned query is both awaitable
+// (count query) and .limit()-able (lookups), matching the Drizzle chains in the dispatcher
+function mockDb(selectResults: unknown[][]) {
+    const queue = [...selectResults];
+    const insertValues = vi.fn(async () => undefined);
+    const dbDrizzle = {
+        select: vi.fn(() => {
+            const rows = queue.shift() ?? [];
+            const query = {
+                limit: async () => rows,
+                then: (resolve: (rows: unknown[]) => void, reject: (err: unknown) => void) =>
+                    Promise.resolve(rows).then(resolve, reject),
+            };
+            return { from: () => ({ where: () => query }) };
+        }),
+        delete: vi.fn(() => ({ where: async () => undefined })),
+        insert: vi.fn(() => ({ values: insertValues })),
+    };
+    vi.mocked(Database.getInstance).mockReturnValue({ dbDrizzle } as any);
+    return { dbDrizzle, insertValues };
+}
+
+const goalRow = { name: 'Marketing', organizationId: 3 };
+const inviterRow = { login: 'Alice' };
+const noCooldown: unknown[] = [];
+const underLimit = [{ count: 0 }];
+const orgRow = [{ slug: 'acme' }];
+
+const inviteEvent: AppEvents['collaboration.userAdded'] = {
+    goalId: 42,
+    email: 'invitee@example.com',
+    initiatorId: 7,
+    locale: 'en',
+};
+
+describe('InviteEmailDispatcher', () => {
+    const dispatcher = new InviteEmailDispatcher();
+    const onUserAdded = (data: typeof inviteEvent) => (dispatcher as any).onUserAdded(data);
+    const sentHtml = () => (vi.mocked(Email.send).mock.calls[0][0] as any).attachment[0].data as string;
+
+    beforeEach(() => {
+        process.env.INVITE_EMAIL_ENABLED = 'true';
+        process.env.SMTP_HOST = 'smtp.test';
+        process.env.SMTP_FROM_EMAIL = 'noreply@test';
+        process.env.APP_URL = 'http://localhost:3000';
+    });
+
+    afterEach(() => {
+        delete process.env.INVITE_EMAIL_ENABLED;
+        delete process.env.INVITE_EMAIL_HOURLY_LIMIT;
+        vi.clearAllMocks();
+    });
+
+    it('does not send when the flag is off', async () => {
+        process.env.INVITE_EMAIL_ENABLED = 'false';
+        mockDb([]);
+
+        await onUserAdded(inviteEvent);
+
+        expect(Email.send).not.toHaveBeenCalled();
+    });
+
+    it('does not send when the flag is unset', async () => {
+        delete process.env.INVITE_EMAIL_ENABLED;
+        mockDb([]);
+
+        await onUserAdded(inviteEvent);
+
+        expect(Email.send).not.toHaveBeenCalled();
+    });
+
+    it('sends a localized email with a project deep link and records the send', async () => {
+        const { insertValues } = mockDb([[goalRow], [inviterRow], noCooldown, underLimit, orgRow]);
+
+        await onUserAdded(inviteEvent);
+
+        expect(Email.send).toHaveBeenCalledTimes(1);
+        const message = vi.mocked(Email.send).mock.calls[0][0] as any;
+        expect(message.to).toBe('invitee@example.com');
+        expect(message.from).toBe('noreply@test');
+        expect(message.subject).toBe('Alice invited you to "Marketing" on TaskView');
+        expect(message.text).toContain('http://localhost:3000/acme/42');
+
+        const html = sentHtml();
+        expect(html).toContain("You've been invited to a project");
+        expect(html).toContain('Alice');
+        expect(html).toContain('href="http://localhost:3000/acme/42"');
+
+        expect(insertValues).toHaveBeenCalledWith({
+            initiatorId: 7,
+            email: 'invitee@example.com',
+            goalId: 42,
+        });
+    });
+
+    it('uses the Russian template for the ru locale', async () => {
+        mockDb([[{ name: 'Маркетинг', organizationId: null }], [{ login: 'Алиса' }], noCooldown, underLimit]);
+
+        await onUserAdded({ ...inviteEvent, locale: 'ru' });
+
+        const message = vi.mocked(Email.send).mock.calls[0][0] as any;
+        expect(message.subject).toBe('Алиса приглашает вас в проект «Маркетинг» в TaskView');
+        expect(sentHtml()).toContain('Вас пригласили в проект');
+        expect(sentHtml()).toContain('href="http://localhost:3000"');
+    });
+
+    it('skips the send during the per-recipient cooldown', async () => {
+        const { insertValues } = mockDb([[goalRow], [inviterRow], [{ id: 1 }]]);
+
+        await onUserAdded(inviteEvent);
+
+        expect(Email.send).not.toHaveBeenCalled();
+        expect(insertValues).not.toHaveBeenCalled();
+    });
+
+    it('skips the send when the hourly limit is reached', async () => {
+        const { insertValues } = mockDb([[goalRow], [inviterRow], noCooldown, [{ count: 30 }]]);
+
+        await onUserAdded(inviteEvent);
+
+        expect(Email.send).not.toHaveBeenCalled();
+        expect(insertValues).not.toHaveBeenCalled();
+    });
+
+    it('respects a custom INVITE_EMAIL_HOURLY_LIMIT', async () => {
+        process.env.INVITE_EMAIL_HOURLY_LIMIT = '2';
+        mockDb([[goalRow], [inviterRow], noCooldown, [{ count: 2 }]]);
+
+        await onUserAdded(inviteEvent);
+
+        expect(Email.send).not.toHaveBeenCalled();
+
+        mockDb([[goalRow], [inviterRow], noCooldown, [{ count: 1 }], orgRow]);
+
+        await onUserAdded(inviteEvent);
+
+        expect(Email.send).toHaveBeenCalledTimes(1);
+    });
+
+    it('escapes user-controlled values in the html', async () => {
+        mockDb([
+            [{ name: '<img src=x onerror=alert(1)>', organizationId: null }],
+            [{ login: 'Bob & "Co"' }],
+            noCooldown,
+            underLimit,
+        ]);
+
+        await onUserAdded(inviteEvent);
+
+        const html = sentHtml();
+        expect(html).not.toContain('<img src=x');
+        expect(html).toContain('&lt;img src=x onerror=alert(1)&gt;');
+        expect(html).toContain('Bob &amp; &quot;Co&quot;');
+    });
+
+    it('is immune to $-patterns and placeholder strings in user values', async () => {
+        mockDb([
+            [{ name: 'Project $` name', organizationId: null }],
+            [{ login: '{link}' }],
+            noCooldown,
+            underLimit,
+        ]);
+
+        await onUserAdded(inviteEvent);
+
+        const html = sentHtml();
+        expect(html).toContain('Project $` name');
+        expect(html).toContain('{link}');
+        expect(html).toContain('href="http://localhost:3000"');
+    });
+
+    it('truncates overlong user values', async () => {
+        mockDb([
+            [{ name: 'p'.repeat(200), organizationId: null }],
+            [{ login: 'i'.repeat(200) }],
+            noCooldown,
+            underLimit,
+        ]);
+
+        await onUserAdded(inviteEvent);
+
+        const message = vi.mocked(Email.send).mock.calls[0][0] as any;
+        expect(message.subject).toContain(`"${'p'.repeat(80)}…"`);
+        expect(message.text).toContain(`${'i'.repeat(80)}… has invited`);
+    });
+
+    it('does not send when the goal no longer exists', async () => {
+        mockDb([[]]);
+
+        await onUserAdded(inviteEvent);
+
+        expect(Email.send).not.toHaveBeenCalled();
+    });
+
+    it('validateOnStartup rejects unrecognized values', () => {
+        process.env.INVITE_EMAIL_ENABLED = 'ture';
+        expect(() => InviteEmailDispatcher.validateOnStartup()).toThrow('INVITE_EMAIL_ENABLED');
+
+        process.env.INVITE_EMAIL_ENABLED = 'false';
+        expect(() => InviteEmailDispatcher.validateOnStartup()).not.toThrow();
+
+        process.env.INVITE_EMAIL_HOURLY_LIMIT = 'abc';
+        expect(() => InviteEmailDispatcher.validateOnStartup()).toThrow('INVITE_EMAIL_HOURLY_LIMIT');
+
+        process.env.INVITE_EMAIL_HOURLY_LIMIT = '0';
+        expect(() => InviteEmailDispatcher.validateOnStartup()).toThrow('INVITE_EMAIL_HOURLY_LIMIT');
+
+        process.env.INVITE_EMAIL_HOURLY_LIMIT = '10';
+        expect(() => InviteEmailDispatcher.validateOnStartup()).not.toThrow();
+
+        delete process.env.INVITE_EMAIL_ENABLED;
+        delete process.env.INVITE_EMAIL_HOURLY_LIMIT;
+        expect(() => InviteEmailDispatcher.validateOnStartup()).not.toThrow();
+    });
+});

api/src/tv-modules/collaboration/collaboration.server.types.ts

@@ -1,4 +1,5 @@
 import { type } from 'arktype';
+import type { CollaborationUsersSchemaTypeForSelect } from 'taskview-db-schemas';
 
 export const CollaborationArkTypeAddUser = type({
     goalId: 'number',
@@ -97,3 +98,30 @@ export const CollaborationArkTypeToggleRolePermission = type({
 });
 
 export type CollaborationArgToggleRolePermission = typeof CollaborationArkTypeToggleRolePermission.infer;
+
+// created=false means the person was already a collaborator of the goal — no invitation happened
+export type CollaborationAddUserRepoResult = {
+    user: CollaborationUsersSchemaTypeForSelect;
+    created: boolean;
+};
+
+export type CollaborationAddUserResult = {
+    user: CollaborationUserWithRoles;
+    created: boolean;
+};
+
+export type InviteEmailLocale = 'en' | 'ru';
+
+export type InviteEmailSendArgs = {
+    email: string;
+    inviterName: string;
+    goalName: string;
+    link: string;
+    locale: InviteEmailLocale;
+};
+
+export type InviteEmailRateLimitArgs = {
+    initiatorId: number;
+    email: string;
+    goalId: number;
+};

api/src/tv-modules/collaboration/mail/invite-en.ts

@@ -0,0 +1,50 @@
+export default `<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8" />
+    <meta name="format-detection" content="telephone=no" />
+    <meta name="color-scheme" content="only" />
+    <title>Project invitation</title>
+</head>
+<body style="margin: 0; padding: 0; background-color: #f5f7fa; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="background-color: #f5f7fa;">
+        <tr>
+            <td align="center" style="padding: 40px 16px;">
+                <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="max-width: 480px; background-color: #ffffff; border-radius: 12px; box-shadow: 0 1px 3px rgba(0, 0, 0, 0.06);">
+                    <tr>
+                        <td style="padding: 40px 32px 24px; text-align: center;">
+                            <div style="font-size: 18px; font-weight: 600; color: #000000; letter-spacing: 0.5px;">TaskView</div>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td style="padding: 0 32px 16px; text-align: center;">
+                            <h1 style="margin: 0; font-size: 20px; font-weight: 600; color: #18181b;">You've been invited to a project</h1>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td style="padding: 0 32px 28px; text-align: center;">
+                            <p style="margin: 0; font-size: 14px; line-height: 1.6; color: #71717a;"><span style="font-weight: 600; color: #18181b;">{inviter}</span> has invited you to join the project<br /><span style="font-weight: 600; color: #18181b;">{project}</span></p>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td align="center" style="padding: 0 32px 28px;">
+                            <a href="{link}" style="display: inline-block; padding: 12px 32px; background-color: #16a34a; border-radius: 8px; font-size: 15px; font-weight: 600; color: #ffffff; text-decoration: none;">Open project</a>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td style="padding: 0 32px 32px; text-align: center;">
+                            <p style="margin: 0; font-size: 12px; line-height: 1.5; color: #a1a1aa;">If the button doesn't work, copy this link into your browser:<br /><a href="{link}" style="color: #16a34a; word-break: break-all;">{link}</a></p>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td style="padding: 0 32px 40px; text-align: center; border-top: 1px solid #f4f4f5;">
+                            <p style="margin: 24px 0 0; font-size: 13px; line-height: 1.5; color: #a1a1aa;">You received this email because someone invited you to a project on TaskView. If you weren't expecting it, you can safely ignore this email.</p>
+                        </td>
+                    </tr>
+                </table>
+                <p style="margin: 24px 0 0; font-size: 12px; color: #a1a1aa; text-align: center;">© TaskView</p>
+            </td>
+        </tr>
+    </table>
+</body>
+</html>`

api/src/tv-modules/collaboration/mail/invite-ru.ts

@@ -0,0 +1,50 @@
+export default `<!DOCTYPE html>
+<html lang="ru">
+<head>
+    <meta charset="UTF-8" />
+    <meta name="format-detection" content="telephone=no" />
+    <meta name="color-scheme" content="only" />
+    <title>Приглашение в проект</title>
+</head>
+<body style="margin: 0; padding: 0; background-color: #f5f7fa; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Oxygen, Ubuntu, sans-serif;">
+    <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="background-color: #f5f7fa;">
+        <tr>
+            <td align="center" style="padding: 40px 16px;">
+                <table role="presentation" width="100%" cellpadding="0" cellspacing="0" border="0" style="max-width: 480px; background-color: #ffffff; border-radius: 12px; box-shadow: 0 1px 3px rgba(0, 0, 0, 0.06);">
+                    <tr>
+                        <td style="padding: 40px 32px 24px; text-align: center;">
+                            <div style="font-size: 18px; font-weight: 600; color: #000000; letter-spacing: 0.5px;">TaskView</div>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td style="padding: 0 32px 16px; text-align: center;">
+                            <h1 style="margin: 0; font-size: 20px; font-weight: 600; color: #18181b;">Вас пригласили в проект</h1>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td style="padding: 0 32px 28px; text-align: center;">
+                            <p style="margin: 0; font-size: 14px; line-height: 1.6; color: #71717a;"><span style="font-weight: 600; color: #18181b;">{inviter}</span> приглашает вас присоединиться к проекту<br /><span style="font-weight: 600; color: #18181b;">{project}</span></p>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td align="center" style="padding: 0 32px 28px;">
+                            <a href="{link}" style="display: inline-block; padding: 12px 32px; background-color: #16a34a; border-radius: 8px; font-size: 15px; font-weight: 600; color: #ffffff; text-decoration: none;">Открыть проект</a>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td style="padding: 0 32px 32px; text-align: center;">
+                            <p style="margin: 0; font-size: 12px; line-height: 1.5; color: #a1a1aa;">Если кнопка не работает, скопируйте эту ссылку в браузер:<br /><a href="{link}" style="color: #16a34a; word-break: break-all;">{link}</a></p>
+                        </td>
+                    </tr>
+                    <tr>
+                        <td style="padding: 0 32px 40px; text-align: center; border-top: 1px solid #f4f4f5;">
+                            <p style="margin: 24px 0 0; font-size: 13px; line-height: 1.5; color: #a1a1aa;">Вы получили это письмо, потому что вас пригласили в проект в TaskView. Если вы не ожидали приглашения, просто проигнорируйте это письмо.</p>
+                        </td>
+                    </tr>
+                </table>
+                <p style="margin: 24px 0 0; font-size: 12px; color: #a1a1aa; text-align: center;">© TaskView</p>
+            </td>
+        </tr>
+    </table>
+</body>
+</html>`

api/src/tv-modules/collaboration/middlewares/CanFetchUsersCollaboration.ts

@@ -21,7 +21,8 @@ export const CanFetchUsersCollaboration = async (req: Request, res: Response, ne
 
     if (
         permissions.hasPermissions(GoalPermissions.TASKS_CAN_ASSIGN_USERS) ||
-        permissions.hasPermissions(GoalPermissions.GOAL_CAN_MANAGE_USERS)
+        permissions.hasPermissions(GoalPermissions.GOAL_CAN_MANAGE_USERS) ||
+        permissions.hasPermissions(GoalPermissions.TASKS_CAN_WATCH_ASSIGNED_USERS)
     ) {
         return next();
     }

api/src/tv-modules/goals/GoalsManager.ts

@@ -237,7 +237,7 @@ export default class GoalsManager {
 
         await this.user.collaborationManager.repository.toggleUserRolesNew({
             goalId,
-            userId: collabUser.id,
+            userId: collabUser.user.id,
             roles: [role.id],
         })
     }

api/src/tv-modules/graph/GraphControler.ts

@@ -33,6 +33,15 @@ export class GraphController {
         return res.tvJson(edges);
     };
 
+    fetchTaskEdges = async (req: Request, res: Response) => {
+        const taskId = Number(req.params.taskId);
+        if (!Number.isFinite(taskId)) {
+            return res.status(400).send('Task ID is required');
+        }
+        const edges = await req.appUser.graphManager.fetchEdgesForTask(taskId);
+        return res.tvJson(edges);
+    };
+
     deleteEdge = async (req: Request, res: Response) => {
         if (!req.params.id) {
             return res.status(400).send('Edge ID is required');

api/src/tv-modules/graph/GraphManager.ts

@@ -19,6 +19,10 @@ export class GraphManager {
         return await this.repository.fetchAllEdges(goalId);
     }
 
+    async fetchEdgesForTask(taskId: number) {
+        return await this.repository.fetchEdgesForTask(taskId);
+    }
+
     async deleteEdge(id: number) {
         return await this.repository.deleteEdge(id);
     }

api/src/tv-modules/graph/GraphRepository.ts

@@ -1,4 +1,4 @@
-import { eq } from 'drizzle-orm';
+import { eq, or } from 'drizzle-orm';
 import { GraphRelationsSchema } from 'taskview-db-schemas';
 import { Database } from '../../modules/db';
 import { callWithCatch } from '../../utils/helpers';
@@ -32,6 +32,16 @@ export class GraphRepository {
         return result ?? [];
     }
 
+    public async fetchEdgesForTask(taskId: number): Promise<GraphReturnRelationsType[]> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle
+                .select()
+                .from(GraphRelationsSchema)
+                .where(or(eq(GraphRelationsSchema.fromTaskId, taskId), eq(GraphRelationsSchema.toTaskId, taskId)))
+        );
+        return result ?? [];
+    }
+
     public async deleteEdge(id: number): Promise<boolean> {
         const result = await callWithCatch(() =>
             this.db.dbDrizzle.delete(GraphRelationsSchema).where(eq(GraphRelationsSchema.id, id))

api/src/tv-modules/graph/GraphRoutes.ts

@@ -21,6 +21,7 @@ export default class GraphRoutes implements Routable {
 
     initRoutes() {
         this.router.post('', [IsLoggedIn, CanManageGraph], this.graphController.addEdge);
+        this.router.get('/task/:taskId', [IsLoggedIn, CanViewGraph], this.graphController.fetchTaskEdges);
         this.router.get('/:goalId', [IsLoggedIn, CanViewGraph], this.graphController.fetchAllEdges);
         this.router.delete('/:id', [IsLoggedIn, CanManageGraph], this.graphController.deleteEdge);
     }

api/src/tv-modules/graph/middlewares/resolveGoalId.ts

@@ -3,28 +3,32 @@ import { GraphRepository } from '../GraphRepository';
 import { TasksRepository } from '../../tasks/TasksRepository';
 
 /**
- * Resolves goalId from graph request.
- * - GET /:goalId → params.goalId
- * - POST (addEdge) → resolve via fromTaskId (body.source)
- * - DELETE /:id → resolve via edge id
+ * Resolves the single goal a graph request belongs to.
+ *
+ * The source is chosen by what the route actually carries, not by probing every
+ * field in turn: a route parameter always wins, and only a request with no
+ * parameters at all (addEdge) is resolved from the body. Reading the body first
+ * would let a caller point the guard at a task they own while the handler acts
+ * on someone else's edge.
+ *
+ * A graph lives inside one project, so an edge whose endpoints sit in different
+ * goals is not a permission question — it is an impossible object. It resolves
+ * to null and the guards reject it before any permission is considered, the same
+ * invariant the tasks.check_task_graph_relation_goal trigger enforces in the DB.
  */
 export async function resolveGoalId(req: Request): Promise<number | null> {
-    // Direct goalId in params (fetchAllEdges)
+    // fetchAllEdges: GET /:goalId
     if (req.params.goalId) {
-        const id = Number(req.params.goalId);
-        return isNaN(id) ? null : id;
+        const goalId = Number(req.params.goalId);
+        return isNaN(goalId) ? null : goalId;
     }
 
-    // addEdge: resolve goalId from task
-    if (req.body?.source) {
-        const taskId = Number(req.body.source);
-        if (isNaN(taskId)) return null;
-        const tasksRepo = new TasksRepository();
-        const task = await tasksRepo.fetchTaskByIdNew(taskId);
-        return task?.goalId ?? null;
+    // fetchTaskEdges: GET /task/:taskId
+    if (req.params.taskId) {
+        return goalIdForTask(req.params.taskId);
     }
 
-    // deleteEdge: resolve goalId from edge
+    // deleteEdge: DELETE /:id
     if (req.params.id) {
         const edgeId = Number(req.params.id);
         if (isNaN(edgeId)) return null;
@@ -33,5 +37,25 @@ export async function resolveGoalId(req: Request): Promise<number | null> {
         return edge?.goalId ?? null;
     }
 
+    // addEdge: POST with { source, target } — both endpoints must be in one goal
+    if (req.body?.source) {
+        const sourceGoalId = await goalIdForTask(req.body.source);
+        if (sourceGoalId === null) return null;
+
+        const targetGoalId = await goalIdForTask(req.body.target);
+        if (targetGoalId !== sourceGoalId) return null;
+
+        return sourceGoalId;
+    }
+
     return null;
 }
+
+async function goalIdForTask(rawTaskId: unknown): Promise<number | null> {
+    const taskId = Number(rawTaskId);
+    if (!taskId || isNaN(taskId)) return null;
+
+    const tasksRepo = new TasksRepository();
+    const task = await tasksRepo.fetchTaskByIdNew(taskId);
+    return task?.goalId ?? null;
+}

api/src/tv-modules/integrations/IntegrationsController.ts

@@ -1,11 +1,14 @@
 import { type } from 'arktype';
 import type { Request, Response } from 'express';
 import { logError } from '../../utils/api';
+import { $logger } from '../../modules/logget';
+import { integrationsDebugLog } from './debugLog';
 import { decrypt } from '../../utils/crypto';
 import AuthController from '../auth/AuthController';
 import { IntegrationsRepository } from './IntegrationsRepository';
 import { verifyGitHubWebhookSignature, GITHUB_BASE_URL } from './providers/github.provider';
 import { verifyGitLabWebhookToken, GITLAB_BASE_URL } from './providers/gitlab.provider';
+import { verifyGiteaWebhookSignature, GITEA_BASE_URL } from './providers/gitea.provider';
 import { IntegrationsArkTypeAdd, IntegrationsArkTypeDelete, IntegrationsArkTypeFetch, IntegrationsArkTypeSelectRepo, IntegrationsArkTypeToggle } from './types';
 
 export default class IntegrationsController {
@@ -47,23 +50,29 @@ export default class IntegrationsController {
 
     initiateOAuth = async (req: Request, res: Response) => {
         try {
+            integrationsDebugLog({ step: 'initiate:start', data: { provider: req.params.provider, projectId: req.query.projectId, hasToken: !!req.query.token } });
             const token = req.query.token as string;
             if (!token) {
+                integrationsDebugLog({ step: 'initiate:reject', data: 'token is required' });
                 return res.status(401).send('token is required');
             }
             const userPayload = await AuthController.validateTokens(token);
             if (!userPayload?.userData?.id) {
+                integrationsDebugLog({ step: 'initiate:reject', data: 'invalid token' });
                 return res.status(401).send('Invalid token');
             }
 
             const provider = req.params.provider;
             const projectId = Number(req.query.projectId);
             if (!projectId || isNaN(projectId)) {
+                integrationsDebugLog({ step: 'initiate:reject', data: 'projectId is required' });
                 return res.status(400).send('projectId is required');
             }
             const url = req.appUser.integrationsManager.getOAuthUrl(provider, projectId, userPayload.userData.id);
+            integrationsDebugLog({ step: 'initiate:redirect', data: { userId: userPayload.userData.id, url } });
             return res.redirect(url);
-        } catch (err) {
+        } catch (err: any) {
+            integrationsDebugLog({ step: 'initiate:error', data: { message: err?.message, stack: err?.stack } });
             logError(err);
             return res.status(500).send('Failed to initiate OAuth');
         }
@@ -74,15 +83,36 @@ export default class IntegrationsController {
             const provider = req.params.provider;
             const code = req.query.code as string;
             const state = req.query.state as string;
+            integrationsDebugLog({ step: 'callback:start', data: { provider, hasCode: !!code, hasState: !!state, queryKeys: Object.keys(req.query) } });
 
             if (!code || !state) {
+                integrationsDebugLog({ step: 'callback:reject', data: 'missing code or state' });
                 return res.redirect(`${process.env.APP_URL}?oauth=error`);
             }
 
-            const { projectId, userLogin } = await req.appUser.integrationsManager.handleOAuthCallback(provider, code, state);
-            return res.redirect(`${process.env.APP_URL}/${userLogin}/${projectId}/integrations?oauth=success`);
-        } catch (err) {
-            logError(err);
+            const { projectId, orgSlug } = await req.appUser.integrationsManager.handleOAuthCallback(provider, code, state);
+            integrationsDebugLog({ step: 'callback:success', data: { projectId, orgSlug } });
+            return res.redirect(`${process.env.APP_URL}/${orgSlug}/${projectId}/integrations?oauth=success`);
+        } catch (err: any) {
+            integrationsDebugLog({
+                step: 'callback:error',
+                data: {
+                    message: err?.message,
+                    responseStatus: err?.response?.status,
+                    responseData: err?.response?.data,
+                    stack: err?.stack,
+                },
+            });
+            $logger.error(
+                {
+                    provider: req.params.provider,
+                    errorMessage: err?.message,
+                    responseStatus: err?.response?.status,
+                    responseData: err?.response?.data,
+                    stack: err?.stack,
+                },
+                '[integrations] OAuth callback failed',
+            );
             return res.redirect(`${process.env.APP_URL}?oauth=error`);
         }
     };
@@ -210,6 +240,91 @@ export default class IntegrationsController {
         }
     };
 
+    handleGiteaWebhook = async (req: Request, res: Response) => {
+        try {
+            const signature = req.headers['x-gitea-signature'] as string;
+            const event = req.headers['x-gitea-event'] as string;
+
+            if (!signature) {
+                return res.status(401).send('Missing signature');
+            }
+
+            if (event !== 'issues') {
+                return res.status(200).send('OK');
+            }
+
+            const repoFullName = req.body?.repository?.full_name;
+            if (!repoFullName) {
+                return res.status(400).send('Missing repository');
+            }
+
+            const repo = new IntegrationsRepository();
+            const integrations = await repo.fetchAllActiveByRepoFullName(repoFullName);
+            if (integrations.length === 0) {
+                return res.status(404).send('Integration not found');
+            }
+
+            // Verify signature with the first integration that has a webhook secret
+            const withSecret = integrations.find((i) => i.webhookSecretEncrypted);
+            if (!withSecret) {
+                return res.status(401).send('No webhook secret');
+            }
+            const secret = decrypt(withSecret.webhookSecretEncrypted!);
+            const rawBody = (req as any).rawBody as Buffer;
+            if (!rawBody || !verifyGiteaWebhookSignature({ rawBody, signature, secret })) {
+                return res.status(401).send('Invalid signature');
+            }
+
+            const action = req.body.action as string;
+            const issue = req.body.issue;
+            if (!issue) {
+                return res.status(200).send('OK');
+            }
+
+            const issueNumber = issue.number as number;
+            const issueTitle = issue.title as string;
+            const issueBody = (issue.body as string) || null;
+
+            for (const integration of integrations) {
+                const mapping = await repo.fetchMappingByIssueNumber(integration.id, issueNumber);
+
+                if (action === 'opened') {
+                    if (!mapping) {
+                        await repo.createTaskAndMapping(
+                            integration.projectId,
+                            issueTitle,
+                            integration.id,
+                            issueNumber,
+                            'open',
+                            issueBody,
+                            false,
+                            `${GITEA_BASE_URL}/${repoFullName}/issues/${issueNumber}`,
+                        );
+                    }
+                } else if (action === 'edited') {
+                    if (mapping) {
+                        await repo.updateTaskTitleAndNote(mapping.taskId, issueTitle, issueBody);
+                    }
+                } else if (action === 'closed') {
+                    if (mapping) {
+                        await repo.updateTaskComplete(mapping.taskId, true);
+                        await repo.updateMappingState(mapping.id, 'closed');
+                    }
+                } else if (action === 'reopened') {
+                    if (mapping) {
+                        await repo.updateTaskComplete(mapping.taskId, false);
+                        await repo.updateMappingState(mapping.id, 'open');
+                    }
+                }
+            }
+
+            return res.status(200).send('OK');
+        } catch (err) {
+            logError(err);
+            return res.status(500).send('Webhook processing failed');
+        }
+    };
+
     handleGitLabWebhook = async (req: Request, res: Response) => {
         try {
             const token = req.headers['x-gitlab-token'] as string;

api/src/tv-modules/integrations/IntegrationsManager.ts

@@ -8,10 +8,12 @@ import { $logger } from '../../modules/logget';
 import { IntegrationsRepository } from './IntegrationsRepository';
 import { TasksRepository } from '../tasks/TasksRepository';
 import type { IntegrationsSchemaTypeForSelect } from 'taskview-db-schemas';
-import type { IntegrationsArgAdd, IntegrationsArgDelete, IntegrationsArgFetch, IntegrationsArgSelectRepo, IntegrationsArgToggle, OAuthStatePayload, RepoItemForClient } from './types';
+import type { IntegrationProvider, IntegrationsArgAdd, IntegrationsArgDelete, IntegrationsArgFetch, IntegrationsArgSelectRepo, IntegrationsArgToggle, OAuthStatePayload, RepoItemForClient } from './types';
 import { randomBytes } from 'crypto';
 import { getGitHubOAuthUrl, exchangeGitHubCode, fetchGitHubRepos, fetchGitHubIssues, createGitHubWebhook, updateGitHubIssueState, GITHUB_BASE_URL } from './providers/github.provider';
 import { getGitLabOAuthUrl, exchangeGitLabCode, fetchGitLabRepos, fetchGitLabIssues, createGitLabWebhook, updateGitLabIssueState, refreshGitLabToken, GITLAB_BASE_URL } from './providers/gitlab.provider';
+import { getGiteaOAuthUrl, exchangeGiteaCode, fetchGiteaRepos, fetchGiteaIssues, createGiteaWebhook, updateGiteaIssueState, refreshGiteaToken, verifyGiteaToken, GITEA_BASE_URL } from './providers/gitea.provider';
+import { integrationsDebugLog } from './debugLog';
 
 export class IntegrationsManager {
     public readonly repository: IntegrationsRepository;
@@ -55,13 +57,16 @@ export class IntegrationsManager {
             return getGitHubOAuthUrl(state);
         } else if (provider === 'gitlab') {
             return getGitLabOAuthUrl(state);
+        } else if (provider === 'gitea') {
+            return getGiteaOAuthUrl(state);
         }
         throw new Error(`Unknown provider: ${provider}`);
     }
 
-    async handleOAuthCallback(provider: string, code: string, state: string): Promise<{ projectId: number; userLogin: string }> {
+    async handleOAuthCallback(provider: string, code: string, state: string): Promise<{ projectId: number; orgSlug: string }> {
         $logger.debug({ provider }, '[integrations] handleOAuthCallback start');
         const payload = jwt.verify(state, process.env.JWT_SIGN as string) as OAuthStatePayload;
+        integrationsDebugLog({ step: 'callback:state-verified', data: { userId: payload.userId, projectId: payload.projectId, provider: payload.provider } });
 
         if (payload.provider !== provider) {
             $logger.error({ provider, payloadProvider: payload.provider }, '[integrations] provider mismatch in state');
@@ -69,6 +74,7 @@ export class IntegrationsManager {
         }
 
         const userLogin = await this.repository.fetchUserLogin(payload.userId);
+        integrationsDebugLog({ step: 'callback:user-fetched', data: { userLogin } });
         if (!userLogin) {
             $logger.error({ userId: payload.userId }, '[integrations] user not found during OAuth callback');
             throw new Error('User not found');
@@ -84,19 +90,35 @@ export class IntegrationsManager {
             const tokens = await exchangeGitLabCode(code);
             accessTokenEncrypted = encrypt(tokens.accessToken);
             refreshTokenEncrypted = encrypt(tokens.refreshToken);
+        } else if (provider === 'gitea') {
+            const tokens = await exchangeGiteaCode(code);
+            integrationsDebugLog({ step: 'callback:token-exchanged', data: { hasAccessToken: !!tokens.accessToken, hasRefreshToken: !!tokens.refreshToken } });
+            accessTokenEncrypted = encrypt(tokens.accessToken);
+            refreshTokenEncrypted = tokens.refreshToken ? encrypt(tokens.refreshToken) : null;
         } else {
             throw new Error(`Unknown provider: ${provider}`);
         }
+        integrationsDebugLog({ step: 'callback:tokens-encrypted' });
 
-        await this.repository.createWithToken(
-            provider as 'github' | 'gitlab',
+        const created = await this.repository.createWithToken(
+            provider as IntegrationProvider,
             payload.projectId,
             accessTokenEncrypted,
             refreshTokenEncrypted,
         );
+        if (!created) {
+            integrationsDebugLog({ step: 'callback:db-insert-failed' });
+            throw new Error('Failed to store integration record');
+        }
+        integrationsDebugLog({ step: 'callback:integration-created', data: { integrationId: created.id } });
 
-        $logger.debug({ provider, projectId: payload.projectId, userLogin }, '[integrations] OAuth callback completed');
-        return { projectId: payload.projectId, userLogin };
+        // The app routes are /:orgSlug/:projectId/... — redirect must use the slug
+        // of the project's organization, falling back to the user login for legacy
+        // projects without an organization.
+        const orgSlug = await this.repository.fetchProjectOrgSlug(payload.projectId) ?? userLogin;
+
+        $logger.debug({ provider, projectId: payload.projectId, orgSlug }, '[integrations] OAuth callback completed');
+        return { projectId: payload.projectId, orgSlug };
     }
 
     async fetchRepos(integrationId: number): Promise<RepoItemForClient[]> {
@@ -126,6 +148,16 @@ export class IntegrationsManager {
                 description: r.description,
                 url: r.web_url,
             }));
+        } else if (integration.provider === 'gitea') {
+            const repos = await fetchGiteaRepos(accessToken);
+            return repos.map((r) => ({
+                id: r.id,
+                fullName: r.full_name,
+                name: r.name,
+                isPrivate: r.private,
+                description: r.description,
+                url: r.html_url,
+            }));
         }
 
         return [];
@@ -174,6 +206,14 @@ export class IntegrationsManager {
         } else if (integration.provider === 'gitlab' && integration.repoExternalId) {
             const result = await createGitLabWebhook(accessToken, Number(integration.repoExternalId), webhookUrl, webhookSecret);
             webhookId = String(result.id);
+        } else if (integration.provider === 'gitea') {
+            const result = await createGiteaWebhook({
+                accessToken,
+                repoFullName: integration.repoFullName,
+                webhookUrl,
+                secret: webhookSecret,
+            });
+            webhookId = String(result.id);
         } else {
             return;
         }
@@ -197,12 +237,11 @@ export class IntegrationsManager {
         const existingMappings = await this.repository.fetchMappingsByIntegrationId(integrationId);
         const mappingsByIssueNumber = new Map(existingMappings.map((m) => [m.issueNumber, m]));
 
+        const issueUrlPrefix = this.getIssueUrlPrefix(integration);
+
         // Backfill sourceUrl for existing tasks that don't have it yet
         if (existingMappings.length > 0) {
-            const baseUrl = integration.provider === 'github' ? GITHUB_BASE_URL : GITLAB_BASE_URL;
-            const issuePath = integration.provider === 'gitlab' ? '/-/issues/' : '/issues/';
-            const prefix = `${baseUrl}/${integration.repoFullName}${issuePath}`;
-            await this.repository.backfillSourceUrls(integrationId, prefix).catch(logError);
+            await this.repository.backfillSourceUrls(integrationId, issueUrlPrefix).catch(logError);
         }
 
         type NewIssueItem = { goalId: number; description: string; integrationId: number; issueNumber: number; issueState: string; note: string | null; complete: boolean; kanbanOrder: number; sourceUrl: string | null };
@@ -263,6 +302,34 @@ export class IntegrationsManager {
                     sourceUrl: `${GITLAB_BASE_URL}/${integration.repoFullName}/-/issues/${issue.iid}`,
                 });
             }
+        } else if (integration.provider === 'gitea') {
+            const issues = await fetchGiteaIssues({ accessToken, repoFullName: integration.repoFullName, since });
+            for (const issue of issues) {
+                const existing = mappingsByIssueNumber.get(issue.number);
+                if (existing) {
+                    const isClosed = issue.state === 'closed';
+                    const targetState = isClosed ? 'closed' : 'open';
+                    await this.repository.updateTaskComplete(existing.taskId, isClosed).catch(logError);
+                    if (existing.issueState !== targetState) {
+                        await this.repository.updateMappingState(existing.id, targetState).catch(logError);
+                    }
+                    await this.repository.updateTaskTitleAndNote(existing.taskId, issue.title, issue.body ?? null).catch(logError);
+                    await this.repository.updateTaskSourceUrl(existing.taskId, `${issueUrlPrefix}${issue.number}`).catch(logError);
+                    continue;
+                }
+                const isClosed = issue.state === 'closed';
+                newItems.push({
+                    goalId: integration.projectId,
+                    description: issue.title,
+                    integrationId,
+                    issueNumber: issue.number,
+                    issueState: isClosed ? 'closed' : 'open',
+                    note: issue.body ?? null,
+                    complete: isClosed,
+                    kanbanOrder: 0,
+                    sourceUrl: `${issueUrlPrefix}${issue.number}`,
+                });
+            }
         }
 
         // Issues come newest-first from API.
@@ -319,6 +386,13 @@ export class IntegrationsManager {
                 mapping.issueNumber,
                 complete ? 'close' : 'reopen',
             );
+        } else if (integration.provider === 'gitea') {
+            await updateGiteaIssueState({
+                accessToken,
+                repoFullName: integration.repoFullName,
+                issueNumber: mapping.issueNumber,
+                state: targetState,
+            });
         }
 
         await this.repository.updateMappingState(mapping.id, targetState);
@@ -326,41 +400,56 @@ export class IntegrationsManager {
         return true;
     }
 
+    private getIssueUrlPrefix(integration: IntegrationsSchemaTypeForSelect): string {
+        if (integration.provider === 'gitlab') {
+            return `${GITLAB_BASE_URL}/${integration.repoFullName}/-/issues/`;
+        }
+        const baseUrl = integration.provider === 'gitea' ? GITEA_BASE_URL : GITHUB_BASE_URL;
+        return `${baseUrl}/${integration.repoFullName}/issues/`;
+    }
+
     private async getAccessToken(integration: IntegrationsSchemaTypeForSelect): Promise<string | null> {
         if (!integration.accessTokenEncrypted) return null;
 
         const accessToken = decrypt(integration.accessTokenEncrypted);
 
-        if (integration.provider !== 'gitlab' || !integration.refreshTokenEncrypted) {
+        const hasExpiringToken = integration.provider === 'gitlab' || integration.provider === 'gitea';
+        if (!hasExpiringToken || !integration.refreshTokenEncrypted) {
             return accessToken;
         }
 
         // Try the current token, refresh on 401
         try {
-            const axios = (await import('axios')).default;
-            const gitlabApiUrl = process.env.GITLAB_API_URL || 'https://gitlab.com/api/v4';
-            await axios.get(`${gitlabApiUrl}/user`, {
-                headers: { Authorization: `Bearer ${accessToken}` },
-            });
+            if (integration.provider === 'gitea') {
+                await verifyGiteaToken(accessToken);
+            } else {
+                const axios = (await import('axios')).default;
+                const gitlabApiUrl = process.env.GITLAB_API_URL || 'https://gitlab.com/api/v4';
+                await axios.get(`${gitlabApiUrl}/user`, {
+                    headers: { Authorization: `Bearer ${accessToken}` },
+                });
+            }
             return accessToken;
         } catch (err: any) {
             if (err?.response?.status !== 401) return accessToken;
-            $logger.debug({ integrationId: integration.id }, '[integrations] GitLab token expired (401), refreshing');
+            $logger.debug({ integrationId: integration.id, provider: integration.provider }, '[integrations] token expired (401), refreshing');
         }
 
         // Token expired, refresh it
         try {
             const refreshToken = decrypt(integration.refreshTokenEncrypted);
-            const tokens = await refreshGitLabToken(refreshToken);
+            const tokens = integration.provider === 'gitea'
+                ? await refreshGiteaToken(refreshToken)
+                : await refreshGitLabToken(refreshToken);
             await this.repository.updateTokens(
                 integration.id,
                 encrypt(tokens.accessToken),
                 encrypt(tokens.refreshToken),
             );
-            $logger.debug({ integrationId: integration.id }, '[integrations] GitLab token refreshed successfully');
+            $logger.debug({ integrationId: integration.id, provider: integration.provider }, '[integrations] token refreshed successfully');
             return tokens.accessToken;
         } catch (err) {
-            $logger.error({ integrationId: integration.id, err }, '[integrations] GitLab token refresh failed');
+            $logger.error({ integrationId: integration.id, provider: integration.provider, err }, '[integrations] token refresh failed');
             return null;
         }
     }

api/src/tv-modules/integrations/IntegrationsRepository.ts

@@ -1,8 +1,8 @@
 import { and, eq, ne, isNull, sql } from 'drizzle-orm';
-import { IntegrationsSchema, IntegrationTaskMapSchema, TasksSchema, UsersSchema, type IntegrationsSchemaTypeForSelect, type IntegrationTaskMapSchemaTypeForSelect } from 'taskview-db-schemas';
+import { GoalsSchema, IntegrationsSchema, IntegrationTaskMapSchema, OrganizationsSchema, TasksSchema, UsersSchema, type IntegrationsSchemaTypeForSelect, type IntegrationTaskMapSchemaTypeForSelect } from 'taskview-db-schemas';
 import { Database } from '../../modules/db';
 import { callWithCatch } from '../../utils/helpers';
-import type { IntegrationsArgAdd, IntegrationsArgDelete, IntegrationsArgSelectRepo, IntegrationsArgToggle } from './types';
+import type { IntegrationProvider, IntegrationsArgAdd, IntegrationsArgDelete, IntegrationsArgSelectRepo, IntegrationsArgToggle } from './types';
 import { TasksRepository } from '../tasks/TasksRepository';
 
 export class IntegrationsRepository {
@@ -62,7 +62,7 @@ export class IntegrationsRepository {
     }
 
     async createWithToken(
-        provider: 'github' | 'gitlab',
+        provider: IntegrationProvider,
         projectId: number,
         accessTokenEncrypted: string,
         refreshTokenEncrypted?: string | null,
@@ -322,6 +322,17 @@ export class IntegrationsRepository {
         return !!result;
     }
 
+    async fetchProjectOrgSlug(projectId: number): Promise<string | null> {
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle.select({ slug: OrganizationsSchema.slug })
+                .from(GoalsSchema)
+                .innerJoin(OrganizationsSchema, eq(GoalsSchema.organizationId, OrganizationsSchema.id))
+                .where(eq(GoalsSchema.id, projectId))
+        );
+        if (!result || result.length === 0) return null;
+        return result[0].slug;
+    }
+
     async fetchUserLogin(userId: number): Promise<string | null> {
         const result = await callWithCatch(() =>
             this.db.dbDrizzle.select({ login: UsersSchema.login }).from(UsersSchema)

api/src/tv-modules/integrations/IntegrationsRoutes.ts

@@ -31,5 +31,6 @@ export default class IntegrationsRoutes implements Routable {
         this.router.get('/oauth/:provider/callback', this.controller.handleOAuthCallback);
         this.router.post('/webhook/github', this.controller.handleGitHubWebhook);
         this.router.post('/webhook/gitlab', this.controller.handleGitLabWebhook);
+        this.router.post('/webhook/gitea', this.controller.handleGiteaWebhook);
     }
 }

api/src/tv-modules/integrations/debugLog.ts

@@ -0,0 +1,15 @@
+import { appendFileSync } from 'fs';
+import type { IntegrationsDebugLogEntry } from './types';
+
+// TEMPORARY debug instrumentation for the integrations OAuth flow.
+// Remove this file and all integrationsDebugLog() calls once the Gitea
+// connect issue is resolved.
+const LOG_PATH = '/private/tmp/claude-501/-Users-nikolaygiman-Programming-HandScreamInc-taskview/1d568266-6fbf-457c-83c2-5c5ca619edf1/scratchpad/integrations-debug.log';
+
+export function integrationsDebugLog(entry: IntegrationsDebugLogEntry): void {
+    try {
+        appendFileSync(LOG_PATH, `${JSON.stringify({ ts: new Date().toISOString(), ...entry })}\n`);
+    } catch {
+        // debug logging must never break the flow
+    }
+}

api/src/tv-modules/integrations/middlewares/resolveProjectId.ts

@@ -2,22 +2,26 @@ import type { Request } from 'express';
 import { IntegrationsRepository } from '../IntegrationsRepository';
 
 /**
- * Resolves projectId from request.
- * Checks body (projectId, integrationId, id) and query (projectId, integrationId).
+ * Resolves the project to authorize the request against.
+ *
+ * When the request names an integration, the project is derived from that
+ * integration and a projectId supplied by the caller is ignored: every handler
+ * that takes an integration id acts on the integration, so authorizing a
+ * caller-supplied project would guard a different object than the one touched.
+ *
+ * Only create and fetch carry no integration id — there the project itself is
+ * the object being acted on, so it is read from the request.
  */
 export async function resolveProjectId(req: Request): Promise<number | null> {
-    // Direct projectId in body or query
-    const directId = req.body?.projectId ?? req.query?.projectId;
-    if (directId) {
-        const id = Number(directId);
-        return isNaN(id) ? null : id;
+    const integrationId = Number(req.body?.integrationId || req.query?.integrationId || req.body?.id);
+    if (integrationId && !isNaN(integrationId)) {
+        const repo = new IntegrationsRepository();
+        const integration = await repo.fetchById(integrationId);
+        return integration?.projectId ?? null;
     }
 
-    // integrationId from body or query, or id from body
-    const integrationId = Number(req.body?.integrationId || req.query?.integrationId || req.body?.id);
-    if (!integrationId || isNaN(integrationId)) return null;
+    const projectId = Number(req.body?.projectId || req.query?.projectId);
+    if (!projectId || isNaN(projectId)) return null;
 
-    const repo = new IntegrationsRepository();
-    const integration = await repo.fetchById(integrationId);
-    return integration?.projectId ?? null;
+    return projectId;
 }

api/src/tv-modules/integrations/providers/gitea.provider.ts

@@ -0,0 +1,182 @@
+import axios from 'axios';
+import { createHmac, timingSafeEqual } from 'crypto';
+import type { GiteaCreateWebhookArgs, GiteaFetchIssuesArgs, GiteaUpdateIssueStateArgs, GiteaVerifyWebhookSignatureArgs } from '../types';
+
+export const GITEA_BASE_URL = (process.env.GITEA_BASE_URL || 'https://gitea.com').replace(/\/+$/, '');
+const GITEA_API_URL = process.env.GITEA_API_URL || `${GITEA_BASE_URL}/api/v1`;
+
+export type GiteaRepo = {
+    id: number;
+    full_name: string;
+    name: string;
+    private: boolean;
+    description: string | null;
+    html_url: string;
+};
+
+export type GiteaIssue = {
+    number: number;
+    title: string;
+    body: string | null;
+    state: 'open' | 'closed';
+    html_url: string;
+};
+
+export function getGiteaOAuthUrl(state: string): string {
+    const clientId = process.env.GITEA_INTEGRATION_CLIENT_ID;
+    const redirectUri = process.env.GITEA_INTEGRATION_CALLBACK_URL;
+    if (!clientId || !redirectUri) {
+        throw new Error('Gitea integration OAuth is not configured');
+    }
+    const params = new URLSearchParams({
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        response_type: 'code',
+        state,
+    });
+    return `${GITEA_BASE_URL}/login/oauth/authorize?${params.toString()}`;
+}
+
+export async function exchangeGiteaCode(code: string): Promise<{ accessToken: string; refreshToken: string | null }> {
+    const res = await axios.post<{ access_token: string; refresh_token?: string; token_type: string }>(
+        `${GITEA_BASE_URL}/login/oauth/access_token`,
+        {
+            client_id: process.env.GITEA_INTEGRATION_CLIENT_ID,
+            client_secret: process.env.GITEA_INTEGRATION_CLIENT_SECRET,
+            code,
+            grant_type: 'authorization_code',
+            redirect_uri: process.env.GITEA_INTEGRATION_CALLBACK_URL,
+        },
+        {
+            headers: { Accept: 'application/json' },
+        },
+    );
+    if (!res.data.access_token) {
+        throw new Error('Failed to exchange Gitea code for token');
+    }
+    return {
+        accessToken: res.data.access_token,
+        refreshToken: res.data.refresh_token ?? null,
+    };
+}
+
+export async function refreshGiteaToken(refreshToken: string): Promise<{ accessToken: string; refreshToken: string }> {
+    const res = await axios.post<{ access_token: string; refresh_token: string; token_type: string }>(
+        `${GITEA_BASE_URL}/login/oauth/access_token`,
+        {
+            client_id: process.env.GITEA_INTEGRATION_CLIENT_ID,
+            client_secret: process.env.GITEA_INTEGRATION_CLIENT_SECRET,
+            refresh_token: refreshToken,
+            grant_type: 'refresh_token',
+        },
+        {
+            headers: { Accept: 'application/json' },
+        },
+    );
+    if (!res.data.access_token) {
+        throw new Error('Failed to refresh Gitea token');
+    }
+    return {
+        accessToken: res.data.access_token,
+        refreshToken: res.data.refresh_token,
+    };
+}
+
+export async function verifyGiteaToken(accessToken: string): Promise<void> {
+    await axios.get(`${GITEA_API_URL}/user`, {
+        headers: { Authorization: `Bearer ${accessToken}` },
+    });
+}
+
+export async function fetchGiteaRepos(accessToken: string): Promise<GiteaRepo[]> {
+    const repos: GiteaRepo[] = [];
+    let page = 1;
+    const perPage = 50;
+
+    while (true) {
+        const res = await axios.get<GiteaRepo[]>(`${GITEA_API_URL}/user/repos`, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+            },
+            params: {
+                limit: perPage,
+                page,
+            },
+        });
+        repos.push(...res.data);
+        if (res.data.length < perPage) break;
+        page++;
+    }
+
+    return repos;
+}
+
+export async function fetchGiteaIssues(args: GiteaFetchIssuesArgs): Promise<GiteaIssue[]> {
+    const issues: GiteaIssue[] = [];
+    let page = 1;
+    const perPage = 50;
+
+    while (true) {
+        const res = await axios.get<GiteaIssue[]>(`${GITEA_API_URL}/repos/${args.repoFullName}/issues`, {
+            headers: {
+                Authorization: `Bearer ${args.accessToken}`,
+            },
+            params: {
+                state: 'all',
+                // Gitea returns pull requests from the issues endpoint too — this excludes them
+                type: 'issues',
+                limit: perPage,
+                page,
+                ...(args.since ? { since: args.since } : {}),
+            },
+        });
+        issues.push(...res.data);
+        if (res.data.length < perPage) break;
+        page++;
+    }
+
+    return issues;
+}
+
+export async function createGiteaWebhook(args: GiteaCreateWebhookArgs): Promise<{ id: number }> {
+    const res = await axios.post<{ id: number }>(
+        `${GITEA_API_URL}/repos/${args.repoFullName}/hooks`,
+        {
+            type: 'gitea',
+            active: true,
+            events: ['issues'],
+            config: {
+                url: args.webhookUrl,
+                content_type: 'json',
+                secret: args.secret,
+            },
+        },
+        {
+            headers: {
+                Authorization: `Bearer ${args.accessToken}`,
+            },
+        },
+    );
+    return { id: res.data.id };
+}
+
+export function verifyGiteaWebhookSignature(args: GiteaVerifyWebhookSignatureArgs): boolean {
+    const expected = createHmac('sha256', args.secret).update(args.rawBody).digest('hex');
+    try {
+        return timingSafeEqual(Buffer.from(args.signature), Buffer.from(expected));
+    } catch {
+        return false;
+    }
+}
+
+export async function updateGiteaIssueState(args: GiteaUpdateIssueStateArgs): Promise<void> {
+    await axios.patch(
+        `${GITEA_API_URL}/repos/${args.repoFullName}/issues/${args.issueNumber}`,
+        { state: args.state },
+        {
+            headers: {
+                Authorization: `Bearer ${args.accessToken}`,
+            },
+        },
+    );
+}

api/src/tv-modules/integrations/types.ts

@@ -1,7 +1,7 @@
 import { type } from 'arktype';
 
 export const IntegrationsArkTypeAdd = type({
-    provider: "'github' | 'gitlab'",
+    provider: "'github' | 'gitlab' | 'gitea'",
     repoFullName: 'string',
     projectId: 'number',
 });
@@ -30,10 +30,43 @@ export const IntegrationsArkTypeSelectRepo = type({
 });
 export type IntegrationsArgSelectRepo = typeof IntegrationsArkTypeSelectRepo.infer;
 
+export type IntegrationProvider = 'github' | 'gitlab' | 'gitea';
+
 export type OAuthStatePayload = {
     userId: number;
     projectId: number;
-    provider: 'github' | 'gitlab';
+    provider: IntegrationProvider;
+};
+
+export type GiteaFetchIssuesArgs = {
+    accessToken: string;
+    repoFullName: string;
+    since?: string;
+};
+
+export type GiteaCreateWebhookArgs = {
+    accessToken: string;
+    repoFullName: string;
+    webhookUrl: string;
+    secret: string;
+};
+
+export type GiteaVerifyWebhookSignatureArgs = {
+    rawBody: Buffer;
+    signature: string;
+    secret: string;
+};
+
+export type GiteaUpdateIssueStateArgs = {
+    accessToken: string;
+    repoFullName: string;
+    issueNumber: number;
+    state: 'open' | 'closed';
+};
+
+export type IntegrationsDebugLogEntry = {
+    step: string;
+    data?: unknown;
 };
 
 export type RepoItemForClient = {

api/src/tv-modules/kanban/KanbanRoutes.ts

@@ -1,10 +1,11 @@
 import { Router } from 'express';
 import type { Routable } from '../../types/routable.type';
+import { GoalPermissions } from '../../types/auth.types';
 import { IsLoggedIn } from '../auth/middlewares/is-logged-in';
 import { KanbanController } from './KanbanController';
-import { CanManageKanban } from './middlewares/CanManageKanban';
-import { CanViewKanban } from './middlewares/CanViewKanban';
-import { CanFetchTasks } from './middlewares/CanFetchTasks';
+import { goalIdFromBody, goalIdFromParam, goalIdFromStatusBody } from './middlewares/goal-id-resolvers';
+import { requireKanbanPermission } from './middlewares/require-kanban-permission';
+
 export default class KanbanRoutes implements Routable {
     private readonly router: ReturnType<typeof Router>;
     private readonly kanbanController: KanbanController;
@@ -20,17 +21,89 @@ export default class KanbanRoutes implements Routable {
     }
 
     initRoutes() {
-        this.router.post('/fetch-statuses', [IsLoggedIn, CanViewKanban], this.kanbanController.fetchAllColumns);
-        this.router.post('/add-status', [IsLoggedIn, CanManageKanban], this.kanbanController.addStatus);
-        this.router.post('/delete-status', [IsLoggedIn, CanManageKanban], this.kanbanController.deleteStatus);
-        this.router.post('/update-status', [IsLoggedIn, CanManageKanban], this.kanbanController.updateStatus);
+        this.router.post(
+            '/fetch-statuses',
+            [
+                IsLoggedIn,
+                requireKanbanPermission({
+                    anyOf: [GoalPermissions.KANBAN_CAN_VIEW],
+                    resolveGoalId: goalIdFromBody,
+                }),
+            ],
+            this.kanbanController.fetchAllColumns
+        );
 
-        // this.router.get('columns/:goalId', [IsLoggedIn], this.kanbanController.fetchAllColumns);
-        this.router.get('/tasks/:goalId/:columnId/:cursor', [IsLoggedIn, CanViewKanban, CanFetchTasks], this.kanbanController.fetchTasksForColumn);
+        this.router.post(
+            '/add-status',
+            [
+                IsLoggedIn, requireKanbanPermission({
+                    anyOf: [GoalPermissions.KANBAN_CAN_MANAGE],
+                    resolveGoalId: goalIdFromBody
+                })
+            ],
+            this.kanbanController.addStatus
+        );
+
+        this.router.post(
+            '/delete-status',
+            [
+                IsLoggedIn, requireKanbanPermission({
+                    anyOf: [GoalPermissions.KANBAN_CAN_MANAGE],
+                    resolveGoalId: goalIdFromStatusBody
+                })
+            ],
+            this.kanbanController.deleteStatus
+        );
+
+        this.router.post(
+            '/update-status',
+            [
+                IsLoggedIn, requireKanbanPermission({
+                    anyOf: [GoalPermissions.KANBAN_CAN_MANAGE],
+                    resolveGoalId: goalIdFromStatusBody
+                })
+            ],
+            this.kanbanController.updateStatus
+        );
+
+        this.router.get(
+            '/tasks/:goalId/:columnId/:cursor',
+            [
+                IsLoggedIn,
+                requireKanbanPermission({
+                    anyOf: [GoalPermissions.KANBAN_CAN_VIEW],
+                    resolveGoalId: goalIdFromParam,
+                }),
+                requireKanbanPermission({
+                    anyOf: [GoalPermissions.COMPONENT_CAN_WATCH_CONTENT],
+                    resolveGoalId: goalIdFromParam,
+                }),
+            ],
+            this.kanbanController.fetchTasksForColumn
+        );
 
         //we do not use this route in the client (no logic for this route on the client side)!!!
-        this.router.get('/tasks-order/:goalId/:columnId/:cursor', [IsLoggedIn, CanManageKanban], this.kanbanController.getTasksOrderForColumnAndCursor);
+        this.router.get(
+            '/tasks-order/:goalId/:columnId/:cursor',
+            [
+                IsLoggedIn, requireKanbanPermission({
+                    anyOf: [GoalPermissions.KANBAN_CAN_VIEW],
+                    resolveGoalId: goalIdFromParam
+                })
+            ],
+            this.kanbanController.getTasksOrderForColumnAndCursor
+        );
 
-        this.router.patch('/update-tasks-order-and-column', [IsLoggedIn, CanManageKanban], this.kanbanController.updateTasksOrderAndColumn);
+        this.router.patch(
+            '/update-tasks-order-and-column',
+            [
+                IsLoggedIn,
+                requireKanbanPermission({
+                    anyOf: [GoalPermissions.KANBAN_CAN_MANAGE],
+                    resolveGoalId: goalIdFromBody
+                })
+            ],
+            this.kanbanController.updateTasksOrderAndColumn
+        );
     }
 }

api/src/tv-modules/kanban/middlewares/CanFetchTasks.ts

@@ -1,33 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-import { KanbanArkTypeCanManageKanban } from '../types';
-import { ArkErrors } from 'arktype';
-
-export const CanFetchTasks = async (req: Request, res: Response, next: NextFunction) => {
-    const props = req.body.goalId ? req.body : req.params;
-
-    const data = KanbanArkTypeCanManageKanban(props);
-
-    if (data instanceof ArkErrors) {
-        return res.status(400).send(data.summary);
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(data.goalId, GoalPermissionsFetcher.PERMISSION_TYPE_FOR_GOAL)
-        .catch(logError);
-
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanAddTask middleware');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.COMPONENT_CAN_WATCH_CONTENT)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/kanban/middlewares/CanManageKanban.ts

@@ -1,54 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { ALL_TASKS_LIST_ID, DEFAULT_ID } from '../../../types/tasks.types';
-import { logError } from '../../../utils/api';
-import { KanbanArkTypeCanManageKanban } from '../types';
-import { ArkErrors } from 'arktype';
-
-export const CanManageKanban = async (req: Request, res: Response, next: NextFunction) => {
-    let props = req.body.goalId ? req.body : req.params;
-
-    switch (req.url) {
-        case '/update-status':
-            const result = await req.appUser.kanbanManager.repository.fetchStatus(req.body.id);
-            props = {
-                goalId: result?.goal_id,
-            };
-            break;
-        case '/delete-status':
-            const result2 = await req.appUser.kanbanManager.repository.fetchStatus(req.body.id);
-            props = {
-                goalId: result2?.goal_id,
-            };
-            break;
-        default:
-            break;
-    }
-
-    const data = KanbanArkTypeCanManageKanban(props);
-
-    if (data instanceof ArkErrors) {
-        return res.status(400).send(data.summary);
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(data.goalId, GoalPermissionsFetcher.PERMISSION_TYPE_FOR_GOAL)
-        .catch(logError);
-
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanAddTask middleware');
-        return res.status(500).end();
-    }
-
-    if (
-        permissions.hasPermissions(GoalPermissions.COMPONENT_CAN_ADD_TASKS) ||
-        permissions.hasPermissions(GoalPermissions.TASKS_CAN_ADD_SUBTASKS)
-    ) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/kanban/middlewares/CanViewKanban.ts

@@ -1,33 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-import { KanbanArkTypeCanManageKanban } from '../types';
-import { ArkErrors } from 'arktype';
-
-export const CanViewKanban = async (req: Request, res: Response, next: NextFunction) => {
-    const props = req.body.goalId ? req.body : req.params;
-
-    const data = KanbanArkTypeCanManageKanban(props);
-
-    if (data instanceof ArkErrors) {
-        return res.status(400).send(data.summary);
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(data.goalId, GoalPermissionsFetcher.PERMISSION_TYPE_FOR_GOAL)
-        .catch(logError);
-
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanAddTask middleware');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.KANBAN_CAN_VIEW)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/kanban/middlewares/goal-id-resolvers.ts

@@ -0,0 +1,19 @@
+import type { Request } from 'express';
+
+export function goalIdFromParam(req: Request): number | null {
+    const goalId = Number(req.params.goalId);
+    return goalId && !isNaN(goalId) ? goalId : null;
+}
+
+export function goalIdFromBody(req: Request): number | null {
+    const goalId = Number(req.body?.goalId);
+    return goalId && !isNaN(goalId) ? goalId : null;
+}
+
+export async function goalIdFromStatusBody(req: Request): Promise<number | null> {
+    const statusId = Number(req.body?.id);
+    if (!statusId || isNaN(statusId)) return null;
+
+    const status = await req.appUser.kanbanManager.repository.fetchStatus(statusId);
+    return status?.goal_id ?? null;
+}

api/src/tv-modules/kanban/middlewares/require-kanban-permission.ts

@@ -0,0 +1,24 @@
+import type { NextFunction, Request, Response } from 'express';
+import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
+import { $logger } from '../../../modules/logget';
+import { logError } from '../../../utils/api';
+import type { RequireKanbanPermissionArgs } from '../types';
+
+export function requireKanbanPermission({ anyOf, resolveGoalId }: RequireKanbanPermissionArgs) {
+    return async (req: Request, res: Response, next: NextFunction) => {
+        const goalId = await resolveGoalId(req);
+        if (!goalId) return res.status(400).end();
+
+        const permissions = await req.appUser.permissionsFetcher
+            .getPermissionsForType(goalId, GoalPermissionsFetcher.PERMISSION_TYPE_FOR_GOAL)
+            .catch(logError);
+
+        if (!permissions) {
+            $logger.error('Can not resolve kanban permissions');
+            return res.status(500).end();
+        }
+
+        if (anyOf.some((permission) => permissions.hasPermissions(permission))) return next();
+        return res.status(403).end();
+    };
+}

api/src/tv-modules/kanban/types.ts

@@ -1,6 +1,8 @@
 import { type } from 'arktype';
+import type { Request } from 'express';
 import { z } from 'zod';
 import { StringToNumber } from '../../types/app.types';
+import type { GoalPermissionType } from '../../types/auth.types';
 
 // ============ Arktype schemas ============
 
@@ -102,11 +104,13 @@ export const KanbanArkTypeUpdateTasksOrder = type({
 
 export type KanbanArgUpdateTasksOrder = typeof KanbanArkTypeUpdateTasksOrder.infer;
 
-export const KanbanArkTypeCanManageKanban = type({
-    goalId: NumberFromString,
-});
+export type KanbanGoalIdResolver = (req: Request) => Promise<number | null> | number | null;
 
-export type KanbanArgCanManageKanban = typeof KanbanArkTypeCanManageKanban.infer;
+export type RequireKanbanPermissionArgs = {
+    /** the caller must hold at least ONE of these */
+    anyOf: GoalPermissionType[];
+    resolveGoalId: KanbanGoalIdResolver;
+};
 
 // ============ Deprecated Zod schemas ============
 

api/src/tv-modules/messaging/utils.ts

@@ -21,16 +21,7 @@ export function isSafeUrl(url: string): boolean {
     }
 }
 
-// Escapes HTML text and attribute contexts (the quotes matter inside href="...")
-// so a user-controlled value can't break out of a Telegram HTML message.
-export function escapeHtml(text: string): string {
-    return text
-        .replace(/&/g, '&')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;');
-}
+export { escapeHtml } from '../../utils/helpers';
 
 // Slack mrkdwn requires escaping these three in text (incl. link labels).
 export function escapeSlackText(text: string): string {

api/src/tv-modules/recurrence/RecurrenceGenerator.ts

@@ -84,12 +84,20 @@ export class RecurrenceGenerator {
                 // Completed late → next from today, not a pile of overdue copies (Todoist behavior).
                 const today = RecurrenceParser.todayInTimezone(rule.timezone);
                 const afterDate = rule.lastInstanceDate > today ? rule.lastInstanceDate : today;
-                const nextDate = RecurrenceParser.nextOccurrenceDate({
-                    rrule: rule.rrule,
-                    dtstart: rule.dtstart,
-                    afterDate,
-                    skipDates,
-                });
+                // Fixed series follow the calendar schedule; after-completion series
+                // take one interval step from the completion day. Stepping from
+                // max(lastInstanceDate, today) keeps instance dates strictly
+                // increasing, so the (rule_id, instance_date) unique index can
+                // never collide with an earlier instance of the series.
+                const nextDate =
+                    rule.scheduleMode === 'after-completion'
+                        ? RecurrenceParser.nextDateAfterCompletion({ rrule: rule.rrule, afterDate })
+                        : RecurrenceParser.nextOccurrenceDate({
+                              rrule: rule.rrule,
+                              dtstart: rule.dtstart,
+                              afterDate,
+                              skipDates,
+                          });
                 if (!nextDate) {
                     await tx
                         .update(RecurrenceRulesSchema)

api/src/tv-modules/recurrence/RecurrenceManager.ts

@@ -61,10 +61,12 @@ export class RecurrenceManager {
             return fail('invalid_rule', 'timezone must be a valid IANA name');
         }
 
+        const scheduleMode = args.scheduleMode ?? 'fixed';
         let dtstart: Date;
         let hasTime: boolean;
         try {
             RecurrenceParser.validateRuleString(args.rrule);
+            if (scheduleMode === 'after-completion') RecurrenceParser.validateForAfterCompletion(args.rrule);
             ({ date: dtstart, hasTime } = RecurrenceParser.parseDtstart(args.dtstart));
         } catch (err) {
             return fail('invalid_rule', (err as Error).message);
@@ -99,6 +101,7 @@ export class RecurrenceManager {
                 dtstart,
                 hasTime,
                 timezone: args.timezone,
+                scheduleMode,
                 lastInstanceDate: originInstanceDate,
                 notifyOnOccurrence: args.notifyOnOccurrence ?? false,
                 creatorId: this.initiatorId,
@@ -196,13 +199,26 @@ export class RecurrenceManager {
             }
             patch.timezone = args.timezone;
         }
-        if (patch.rrule !== undefined || patch.dtstart !== undefined) {
-            const nextDate = RecurrenceParser.nextOccurrenceDate({
-                rrule: patch.rrule ?? rule.rrule,
-                dtstart: patch.dtstart ?? rule.dtstart,
-                afterDate: RecurrenceParser.todayInTimezone(patch.timezone ?? rule.timezone),
-                skipDates: new Set<string>(),
-            });
+        if (args.scheduleMode !== undefined) patch.scheduleMode = args.scheduleMode;
+        const effectiveMode = patch.scheduleMode ?? rule.scheduleMode;
+        if (effectiveMode === 'after-completion') {
+            try {
+                RecurrenceParser.validateForAfterCompletion(patch.rrule ?? rule.rrule);
+            } catch (err) {
+                return fail('invalid_rule', (err as Error).message);
+            }
+        }
+        if (patch.rrule !== undefined || patch.dtstart !== undefined || patch.scheduleMode !== undefined) {
+            const afterDate = RecurrenceParser.todayInTimezone(patch.timezone ?? rule.timezone);
+            const nextDate =
+                effectiveMode === 'after-completion'
+                    ? RecurrenceParser.nextDateAfterCompletion({ rrule: patch.rrule ?? rule.rrule, afterDate })
+                    : RecurrenceParser.nextOccurrenceDate({
+                          rrule: patch.rrule ?? rule.rrule,
+                          dtstart: patch.dtstart ?? rule.dtstart,
+                          afterDate,
+                          skipDates: new Set<string>(),
+                      });
             if (!nextDate) return fail('invalid_rule', 'rule produces no occurrences');
         }
         if (args.notifyOnOccurrence !== undefined) patch.notifyOnOccurrence = args.notifyOnOccurrence;

api/src/tv-modules/recurrence/RecurrenceParser.ts

@@ -1,10 +1,17 @@
 import { DateTime } from 'luxon';
 import { RRule } from 'rrule';
-import type { InstanceWindow, InstanceWindowArgs, NextOccurrenceArgs, ParseRuleArgs } from './types';
+import type { InstanceWindow, InstanceWindowArgs, NextDateAfterCompletionArgs, NextOccurrenceArgs, ParseRuleArgs } from './types';
 
 const ALLOWED_FREQUENCIES = new Set<number>([RRule.YEARLY, RRule.MONTHLY, RRule.WEEKLY, RRule.DAILY]);
 const MAX_COUNT = 10000;
 
+const FREQ_TO_STEP_UNIT: Record<number, 'years' | 'months' | 'weeks' | 'days'> = {
+    [RRule.YEARLY]: 'years',
+    [RRule.MONTHLY]: 'months',
+    [RRule.WEEKLY]: 'weeks',
+    [RRule.DAILY]: 'days',
+};
+
 /**
  * All recurrence math happens in a single floating wall-clock frame:
  * `dtstart` is a Date whose UTC components equal the wall-clock components of
@@ -41,6 +48,40 @@ export class RecurrenceParser {
         return RRule.parseString(rruleString).count ?? null;
     }
 
+    /**
+     * After-completion series step from the completion day, so calendar anchors
+     * (BYDAY, BYMONTHDAY) have no defined meaning for them — reject instead of
+     * silently ignoring what the client asked for.
+     */
+    static validateForAfterCompletion(rruleString: string): void {
+        const options = RRule.parseString(rruleString);
+        if (options.byweekday !== undefined && options.byweekday !== null) {
+            throw new Error('BYDAY is not supported for after-completion series');
+        }
+        if (options.bymonthday !== undefined && options.bymonthday !== null) {
+            throw new Error('BYMONTHDAY is not supported for after-completion series');
+        }
+    }
+
+    /**
+     * Next date of an after-completion series: one FREQ/INTERVAL step after
+     * `afterDate` (the completion day), no calendar anchor. Month/year steps
+     * clamp to the last valid day (Jan 31 + 1 month → Feb 28). COUNT is
+     * enforced by the caller via instances_created (same as fixed series);
+     * returns null when the step lands past UNTIL — the series is over.
+     */
+    static nextDateAfterCompletion(args: NextDateAfterCompletionArgs): string | null {
+        const options = RRule.parseString(args.rrule);
+        const unit = options.freq !== undefined ? FREQ_TO_STEP_UNIT[options.freq] : undefined;
+        if (!unit) return null;
+        const nextDate = DateTime.fromISO(args.afterDate, { zone: 'utc' })
+            .plus({ [unit]: options.interval ?? 1 })
+            .toISODate();
+        if (!nextDate) return null;
+        if (options.until && nextDate > RecurrenceParser.toIsoDate(options.until)) return null;
+        return nextDate;
+    }
+
     /**
      * First occurrence date strictly after `afterDate`, skipping explicit skip
      * dates. COUNT is intentionally stripped: the cap is "N materialized

api/src/tv-modules/recurrence/types.ts

@@ -2,6 +2,7 @@ import { type } from 'arktype';
 import type {
     RecurrenceRulesSchemaTypeForInsert,
     RecurrenceRulesSchemaTypeForSelect,
+    RecurrenceScheduleMode,
     TasksSchemaTypeForSelect,
 } from 'taskview-db-schemas';
 
@@ -12,6 +13,7 @@ export const RecurrenceArkTypeCreate = type({
     rrule: 'string > 0',
     dtstart: 'string', // 'YYYY-MM-DDTHH:mm:ss' floating wall-clock, no TZ suffix
     timezone: 'string > 0', // IANA name, e.g. 'Europe/Moscow'
+    'scheduleMode?': '"fixed" | "after-completion"',
     'notifyOnOccurrence?': 'boolean',
 });
 
@@ -20,6 +22,7 @@ export const RecurrenceArkTypeUpdate = type({
     'rrule?': 'string > 0',
     'dtstart?': 'string',
     'timezone?': 'string > 0',
+    'scheduleMode?': '"fixed" | "after-completion"',
     'notifyOnOccurrence?': 'boolean',
     'templateOverrides?': type({
         'description?': 'string',
@@ -63,6 +66,11 @@ export type NextOccurrenceArgs = {
     afterDate: string;
     skipDates: Set<string>;
 };
+export type NextDateAfterCompletionArgs = {
+    rrule: string;
+    /** 'YYYY-MM-DD' — the completion day; the next date is one FREQ/INTERVAL step after it. */
+    afterDate: string;
+};
 export type InstanceWindowArgs = {
     /** 'YYYY-MM-DD' wall-clock occurrence date in the rule's timezone. */
     occurrenceDate: string;
@@ -93,6 +101,7 @@ export type RecurrenceRulePatchArgs = {
         dtstart: Date;
         hasTime: boolean;
         timezone: string;
+        scheduleMode: RecurrenceScheduleMode;
         state: 'active' | 'paused' | 'ended';
         lastInstanceDate: string;
         instancesCreated: number;

api/src/tv-modules/sso/SsoController.ts

@@ -3,16 +3,26 @@ import { type } from 'arktype'
 import { hashSync } from 'bcryptjs'
 import type { Request, Response } from 'express'
 import { $logger } from '../../modules/logget'
+import { PublicApiUrl } from '../../modules/public-url'
 import { logError } from '../../utils/api'
-import { generateString, isEmail } from '../../utils/helpers'
+import { generateLetters, generateString } from '../../utils/helpers'
 import AuthModel from '../auth/AuthModel'
 import { GoalsRepository } from '../goals/GoalsRepository'
 import { OrganizationRepository } from '../organizations/OrganizationRepository'
 import { createSsoProvider } from './providers/provider-factory'
 import { SsoRepository } from './SsoRepository'
 import { parseSamlMetadata } from './saml-metadata-parser'
-import { generateLoginCode, stripSecrets, validateMetadataUrl } from './sso.utils'
-import { SsoConfigArkTypeCreate, SsoConfigArkTypeUpdate } from './types'
+import { generateLoginCode, isSsoDomainVerified, stripSecrets, validateMetadataUrl } from './sso.utils'
+import {
+  SsoConfigArkTypeCreate,
+  SsoConfigArkTypeUpdate,
+  SsoDomainNotVerifiedError,
+  type ApplySsoIdpEmailArgs,
+  type ResolveSsoUserArgs,
+  type ResolveSsoUserResult,
+  type SsoCallbackError,
+} from './types'
+import type { UserDbRecord } from '../../types/auth.types'
 
 export class SsoController {
   private readonly ssoRepo = new SsoRepository()
@@ -20,6 +30,103 @@ export class SsoController {
   private readonly orgRepo = new OrganizationRepository()
   private readonly goalsRepo = new GoalsRepository()
 
+  private async resolveLogin(preferredUsername?: string): Promise<string> {
+    const base = preferredUsername?.trim().slice(0, 50)
+    if (!base) return generateString(7)
+
+    if (!(await this.authModel.getUserByLogin(base))) return base
+
+    for (let attempt = 0; attempt < 10; attempt++) {
+      const suffix = `.${generateLetters(3)}`
+      const candidate = `${base.slice(0, 50 - suffix.length)}${suffix}`
+      if (!(await this.authModel.getUserByLogin(candidate))) return candidate
+    }
+
+    return generateString(7)
+  }
+
+  private redirectSsoError(res: Response, error: SsoCallbackError) {
+    return res.redirect(`${process.env.APP_URL}/login?sso_error=${error}`)
+  }
+
+  private async createSsoUser(args: ResolveSsoUserArgs): Promise<UserDbRecord | false> {
+    const password = generateString(16)
+    const login = await this.resolveLogin(args.preferredUsername)
+    const id = await this.authModel.registerUserInDb({
+      login,
+      email: args.email,
+      password: hashSync(password, 10),
+      block: 0,
+      confirmEmailCode: '',
+    })
+
+    if (!id) {
+      $logger.error('Failed to create user during SSO login')
+      return false
+    }
+
+    const personalOrgSlug = `org-${crypto.randomUUID().slice(0, 8)}`
+    const personalOrg = await this.orgRepo.create({ name: `${login}'s workspace`, slug: personalOrgSlug }, id, true)
+    if (personalOrg) {
+      await this.orgRepo.addMember(personalOrg.id, args.email, 'owner')
+      await this.goalsRepo.createInboxGoal({ ownerId: id, organizationId: personalOrg.id })
+    }
+
+    return await this.authModel.fetchUserById(id)
+  }
+
+  private async applyIdpEmail(args: ApplySsoIdpEmailArgs): Promise<'ok' | 'email_in_use' | 'error'> {
+    if (args.user.email.toLowerCase() === args.email) return 'ok'
+
+    const taken = await this.authModel.getUserByLogin(args.email, true)
+    if (taken && taken.id !== args.user.id) return 'email_in_use'
+
+    const result = await this.authModel.updateUserEmail({
+      userId: args.user.id,
+      oldEmail: args.user.email,
+      email: args.email,
+    })
+    if (result === 'conflict') return 'email_in_use'
+    if (result !== 'ok') return 'error'
+    return 'ok'
+  }
+
+  private async resolveSsoUser(args: ResolveSsoUserArgs): Promise<ResolveSsoUserResult> {
+    const identity = await this.ssoRepo.findIdentity({
+      ssoConfigId: args.ssoConfigId,
+      externalId: args.externalId,
+    })
+
+    if (identity) {
+      const user = await this.authModel.fetchUserById(identity.userId)
+      if (!user) return { ok: false, error: 'authentication_failed' }
+
+      const emailResult = await this.applyIdpEmail({ user, email: args.email })
+      if (emailResult === 'email_in_use') return { ok: false, error: 'email_in_use' }
+      if (emailResult !== 'ok') return { ok: false, error: 'authentication_failed' }
+
+      const refreshed = await this.authModel.fetchUserById(user.id)
+      if (!refreshed) return { ok: false, error: 'authentication_failed' }
+      return { ok: true, user: refreshed }
+    }
+
+    const existing = await this.authModel.getUserByLogin(args.email, true)
+    if (existing) {
+      const linked = await this.ssoRepo.findIdentityByUser({
+        ssoConfigId: args.ssoConfigId,
+        userId: existing.id,
+      })
+      if (linked && linked.externalId !== args.externalId) {
+        return { ok: false, error: 'email_in_use' }
+      }
+      return { ok: true, user: existing }
+    }
+
+    const created = await this.createSsoUser(args)
+    if (!created) return { ok: false, error: 'authentication_failed' }
+    return { ok: true, user: created }
+  }
+
   initiateLogin = async (req: Request, res: Response) => {
     const configId = Number(req.params.configId)
     if (!configId) return res.status(400).tvJson({ message: 'Invalid config ID' })
@@ -27,6 +134,10 @@ export class SsoController {
     const config = await this.ssoRepo.findEnabledById(configId)
     if (!config) return res.status(404).tvJson({ message: 'SSO provider not found' })
 
+    if (!isSsoDomainVerified(config)) {
+      return res.redirect(`${process.env.APP_URL}/login?sso_error=domain_unverified`)
+    }
+
     try {
       const provider = createSsoProvider(config)
       const relayState = JSON.stringify({ platform: req.query.platform || '' })
@@ -44,50 +155,40 @@ export class SsoController {
     const config = await this.ssoRepo.findEnabledById(configId)
     if (!config) return res.status(404).tvJson({ message: 'SSO provider not found' })
 
+    if (!isSsoDomainVerified(config)) {
+      return res.redirect(`${process.env.APP_URL}/login?sso_error=domain_unverified`)
+    }
+
     try {
       const provider = createSsoProvider(config)
       const ssoResult = await provider.handleCallback(req)
 
-      if (config.emailDomainRestriction) {
-        const domain = ssoResult.email.split('@')[1]
-        if (domain !== config.emailDomainRestriction) {
-          return res.status(403).tvJson({ message: 'Email domain not allowed for this SSO provider' })
-        }
+      if (!config.emailDomainRestriction) {
+        return this.redirectSsoError(res, 'authentication_failed')
       }
 
-      let userData = await this.authModel.getUserByLogin(ssoResult.email, isEmail(ssoResult.email))
-
-      if (!userData) {
-        const password = generateString(16)
-        const login = generateString(7)
-        const id = await this.authModel.registerUserInDb({
-          login,
-          email: ssoResult.email,
-          password: hashSync(password, 10),
-          block: 0,
-          confirmEmailCode: '',
-        })
-
-        if (!id) {
-          $logger.error('Failed to create user during SSO login')
-          return res.status(500).tvJson({ message: 'Failed to create user' })
-        }
-
-        const personalOrgSlug = `org-${crypto.randomUUID().slice(0, 8)}`
-        const personalOrg = await this.orgRepo.create({ name: `${login}'s workspace`, slug: personalOrgSlug }, id, true)
-        if (personalOrg) {
-          await this.orgRepo.addMember(personalOrg.id, ssoResult.email, 'owner')
-          await this.goalsRepo.createInboxGoal({ ownerId: id, organizationId: personalOrg.id })
-        }
-
-        userData = await this.authModel.getUserByLogin(ssoResult.email, isEmail(ssoResult.email))
+      const domain = ssoResult.email.split('@')[1]
+      if (domain !== config.emailDomainRestriction) {
+        return res.status(403).tvJson({ message: 'Email domain not allowed for this SSO provider' })
       }
 
-      if (!userData) {
-        return res.status(500).tvJson({ message: 'Failed to resolve user after SSO login' })
+      const resolved = await this.resolveSsoUser({
+        ssoConfigId: config.id,
+        email: ssoResult.email,
+        externalId: ssoResult.externalId,
+        preferredUsername: ssoResult.preferredUsername,
+      })
+      if (!resolved.ok) {
+        return this.redirectSsoError(res, resolved.error)
       }
 
-      await this.orgRepo.addMember(config.organizationId, ssoResult.email, config.defaultOrgRole)
+      const userData = resolved.user
+
+      if (userData.block && !userData.confirm_email_code) {
+        return this.redirectSsoError(res, 'account_blocked')
+      }
+
+      await this.orgRepo.addMember(config.organizationId, userData.email, config.defaultOrgRole)
 
       await this.ssoRepo.upsertIdentity({
         userId: userData.id,
@@ -131,7 +232,7 @@ export class SsoController {
     if (!domain) return res.tvJson(null)
 
     const config = await this.ssoRepo.findEnabledByDomain(domain)
-    if (!config) return res.tvJson(null)
+    if (!config || !isSsoDomainVerified(config)) return res.tvJson(null)
 
     return res.tvJson({
       id: config.id,
@@ -140,6 +241,16 @@ export class SsoController {
     })
   }
 
+  getPublicUrls = async (req: Request, res: Response) => {
+    const base = PublicApiUrl.base(req)
+    return res.tvJson({
+      apiBaseUrl: base,
+      callbackUrlTemplate: `${base}/module/sso/callback/{id}`,
+      scimEndpointUrl: `${base}/scim/v2`,
+      apiPublicUrlConfigured: PublicApiUrl.configured() !== null,
+    })
+  }
+
   listConfigs = async (req: Request, res: Response) => {
     const orgId = Number(req.query.organizationId)
     if (!orgId) return res.status(400).tvJson({ message: 'organizationId is required' })
@@ -154,11 +265,18 @@ export class SsoController {
       return res.status(400).send(out.summary)
     }
 
-    const existing = await this.ssoRepo.findEnabledByDomain(out.emailDomainRestriction)
-    if (existing) {
+    const domain = out.emailDomainRestriction.toLowerCase()
+
+    const sameOrg = await this.ssoRepo.findByDomainAndOrg({ domain, organizationId: out.organizationId })
+    if (sameOrg) {
       return res.status(409).tvJson({ message: 'SSO config for this domain already exists' })
     }
 
+    const verified = await this.ssoRepo.findVerifiedByDomain(domain)
+    if (verified) {
+      return res.status(409).tvJson({ message: 'This domain is already verified by another organization' })
+    }
+
     const config = await req.appUser.ssoManager.createConfig(out).catch(logError)
     if (!config) {
       return res.status(500).tvJson({ message: 'Failed to create SSO config' })
@@ -175,8 +293,33 @@ export class SsoController {
       return res.status(400).send(out.summary)
     }
 
-    const config = await req.appUser.ssoManager.updateConfig(configId, out).catch(logError)
-    return res.tvJson(config ? stripSecrets(config) : null)
+    if (out.emailDomainRestriction) {
+      const domain = out.emailDomainRestriction.toLowerCase()
+
+      const verified = await this.ssoRepo.findVerifiedByDomain(domain)
+      if (verified && verified.id !== configId) {
+        return res.status(409).tvJson({ message: 'This domain is already verified by another organization' })
+      }
+
+      const current = await this.ssoRepo.findById(configId)
+      if (current) {
+        const sameOrg = await this.ssoRepo.findByDomainAndOrg({ domain, organizationId: current.organizationId })
+        if (sameOrg && sameOrg.id !== configId) {
+          return res.status(409).tvJson({ message: 'SSO config for this domain already exists' })
+        }
+      }
+    }
+
+    try {
+      const config = await req.appUser.ssoManager.updateConfig(configId, out)
+      return res.tvJson(config ? stripSecrets(config) : null)
+    } catch (error) {
+      if (error instanceof SsoDomainNotVerifiedError) {
+        return res.status(403).tvJson({ message: 'Domain is not verified' })
+      }
+      logError(error)
+      return res.tvJson(null)
+    }
   }
 
   parseMetadata = async (req: Request, res: Response) => {
@@ -202,6 +345,28 @@ export class SsoController {
     }
   }
 
+  startDomainVerification = async (req: Request, res: Response) => {
+    const configId = Number(req.params.configId)
+    if (!configId) return res.status(400).end()
+
+    const result = await req.appUser.ssoManager.startDomainVerification(configId).catch(logError)
+    if (!result) {
+      return res.status(404).tvJson({ message: 'SSO config not found' })
+    }
+    return res.tvJson(result)
+  }
+
+  checkDomainVerification = async (req: Request, res: Response) => {
+    const configId = Number(req.params.configId)
+    if (!configId) return res.status(400).end()
+
+    const result = await req.appUser.ssoManager.checkDomainVerification(configId).catch(logError)
+    if (!result) {
+      return res.status(404).tvJson({ message: 'SSO config not found' })
+    }
+    return res.tvJson(result)
+  }
+
   generateScimToken = async (req: Request, res: Response) => {
     const configId = Number(req.params.configId)
     if (!configId) return res.status(400).end()

api/src/tv-modules/sso/SsoManager.ts

@@ -1,8 +1,22 @@
 import type { AppUser } from '../../core/AppUser'
 import { encrypt, encryptField } from '../../utils/crypto'
 import { SsoRepository } from './SsoRepository'
-import { SSO_SECRET_FIELDS } from './sso.utils'
-import type { SsoConfigArgCreate, SsoConfigArgUpdate } from './types'
+import {
+  SSO_SECRET_FIELDS,
+  generateDomainVerifyToken,
+  isSsoDomainVerified,
+  isTrustedSsoDomain,
+  proveSsoDomainOwnership,
+  ssoDomainVerifyDnsRecord,
+  ssoDomainVerifyHttpUrl,
+} from './sso.utils'
+import {
+  SsoDomainNotVerifiedError,
+  type CheckDomainVerificationResult,
+  type SsoConfigArgCreate,
+  type SsoConfigArgUpdate,
+  type StartDomainVerificationResult,
+} from './types'
 
 export class SsoManager {
   public readonly repository: SsoRepository
@@ -18,11 +32,14 @@ export class SsoManager {
   }
 
   async createConfig(data: SsoConfigArgCreate) {
+    const domain = data.emailDomainRestriction.toLowerCase()
+    const trusted = isTrustedSsoDomain(domain)
+
     return await this.repository.create({
       organizationId: data.organizationId,
       protocol: data.protocol,
       displayName: data.displayName,
-      enabled: data.enabled ?? 1,
+      enabled: trusted ? (data.enabled ?? 1) : 0,
       samlEntryPoint: data.samlEntryPoint ?? null,
       samlIssuer: data.samlIssuer ?? null,
       samlCert: encryptField(data.samlCert),
@@ -36,12 +53,22 @@ export class SsoManager {
       oidcCallbackUrl: data.oidcCallbackUrl ?? null,
       oidcScope: data.oidcScope ?? null,
       defaultOrgRole: data.defaultOrgRole ?? 'member',
-      emailDomainRestriction: data.emailDomainRestriction.toLowerCase(),
+      emailDomainRestriction: domain,
+      domainVerifyToken: generateDomainVerifyToken(),
+      domainVerifiedAt: trusted ? new Date() : null,
     })
   }
 
   async updateConfig(configId: number, data: SsoConfigArgUpdate) {
-    const encrypted: Partial<SsoConfigArgUpdate> = { ...data }
+    const current = await this.repository.findById(configId)
+    if (!current) return null
+
+    const encrypted: Partial<SsoConfigArgUpdate> & {
+      domainVerifyToken?: string
+      domainVerifiedAt?: Date | null
+      enabled?: number
+    } = { ...data }
+
     for (const field of SSO_SECRET_FIELDS) {
       if (field in encrypted) {
         if (encrypted[field]) {
@@ -51,9 +78,87 @@ export class SsoManager {
         }
       }
     }
+
+    if (data.emailDomainRestriction) {
+      const domain = data.emailDomainRestriction.toLowerCase()
+      encrypted.emailDomainRestriction = domain
+      if (domain !== current.emailDomainRestriction) {
+        const trusted = isTrustedSsoDomain(domain)
+        encrypted.domainVerifyToken = generateDomainVerifyToken()
+        encrypted.domainVerifiedAt = trusted ? new Date() : null
+        if (!trusted) encrypted.enabled = 0
+        await this.repository.deleteIdentitiesByConfig(configId)
+      }
+    }
+
+    const nextDomain = encrypted.emailDomainRestriction ?? current.emailDomainRestriction
+    const nextVerifiedAt = 'domainVerifiedAt' in encrypted
+      ? encrypted.domainVerifiedAt
+      : current.domainVerifiedAt
+    const wouldBeVerified = isTrustedSsoDomain(nextDomain) || !!nextVerifiedAt
+
+    if (data.enabled === 1 && !wouldBeVerified) {
+      throw new SsoDomainNotVerifiedError()
+    }
+
     return await this.repository.update(configId, encrypted)
   }
 
+  async startDomainVerification(configId: number): Promise<StartDomainVerificationResult | null> {
+    const config = await this.repository.findById(configId)
+    if (!config) return null
+
+    let token = config.domainVerifyToken
+    if (!token) {
+      token = generateDomainVerifyToken()
+      const updated = await this.repository.update(configId, { domainVerifyToken: token })
+      if (!updated) return null
+    }
+
+    return {
+      token,
+      dnsRecord: ssoDomainVerifyDnsRecord(token),
+      httpUrl: ssoDomainVerifyHttpUrl(config.emailDomainRestriction),
+      isDomainVerified: isSsoDomainVerified({ ...config, domainVerifyToken: token }),
+      isDomainTrusted: isTrustedSsoDomain(config.emailDomainRestriction),
+    }
+  }
+
+  async checkDomainVerification(configId: number): Promise<CheckDomainVerificationResult | null> {
+    const config = await this.repository.findById(configId)
+    if (!config) return null
+
+    if (!config.domainVerifyToken) {
+      return {
+        verified: isSsoDomainVerified(config),
+        method: isTrustedSsoDomain(config.emailDomainRestriction) ? 'trusted' : null
+      }
+    }
+
+    const method = await proveSsoDomainOwnership({
+      domain: config.emailDomainRestriction,
+      token: config.domainVerifyToken,
+    })
+
+    if (!method) {
+      return { verified: isSsoDomainVerified(config), method: null }
+    }
+
+    if (!config.domainVerifiedAt || method === 'trusted') {
+      const updated = await this.repository.update(configId, {
+        domainVerifiedAt: new Date(),
+        enabled: 1,
+      })
+      // The partial unique index rejects a second verified config for the same
+      // domain another organization proved ownership first.
+      if (!updated) {
+        return { verified: false, method: null }
+      }
+    }
+
+    return { verified: true, method }
+  }
+
   async deleteConfig(configId: number) {
     return await this.repository.delete(configId)
   }

api/src/tv-modules/sso/SsoRepository.ts

@@ -1,4 +1,4 @@
-import { and, eq } from 'drizzle-orm'
+import { and, eq, isNotNull } from 'drizzle-orm'
 import {
   SsoConfigsSchema,
   SsoIdentitiesSchema,
@@ -8,6 +8,12 @@ import {
 } from 'taskview-db-schemas'
 import { Database } from '../../modules/db'
 import { callWithCatch } from '../../utils/helpers'
+import type {
+  FindSsoConfigByDomainAndOrgArgs,
+  FindSsoIdentityArgs,
+  FindSsoIdentityByUserArgs,
+  UpsertSsoIdentityArgs,
+} from './types'
 
 export class SsoRepository {
   private readonly db: Database
@@ -16,6 +22,38 @@ export class SsoRepository {
     this.db = Database.getInstance()
   }
 
+  async findVerifiedByDomain(domain: string): Promise<SsoConfigsSchemaTypeForSelect | null> {
+    const result = await callWithCatch(() =>
+      this.db.dbDrizzle
+        .select()
+        .from(SsoConfigsSchema)
+        .where(
+          and(
+            eq(SsoConfigsSchema.emailDomainRestriction, domain.toLowerCase()),
+            isNotNull(SsoConfigsSchema.domainVerifiedAt),
+          )
+        )
+    )
+    if (!result || result.length === 0) return null
+    return result[0]
+  }
+
+  async findByDomainAndOrg(args: FindSsoConfigByDomainAndOrgArgs): Promise<SsoConfigsSchemaTypeForSelect | null> {
+    const result = await callWithCatch(() =>
+      this.db.dbDrizzle
+        .select()
+        .from(SsoConfigsSchema)
+        .where(
+          and(
+            eq(SsoConfigsSchema.emailDomainRestriction, args.domain.toLowerCase()),
+            eq(SsoConfigsSchema.organizationId, args.organizationId),
+          )
+        )
+    )
+    if (!result || result.length === 0) return null
+    return result[0]
+  }
+
   async findEnabledByDomain(domain: string): Promise<SsoConfigsSchemaTypeForSelect | null> {
     const result = await callWithCatch(() =>
       this.db.dbDrizzle
@@ -146,12 +184,41 @@ export class SsoRepository {
     return !!(result?.rowCount && result.rowCount > 0)
   }
 
-  async upsertIdentity(data: {
-    userId: number
-    ssoConfigId: number
-    externalId: string
-    email: string
-  }): Promise<SsoIdentitiesSchemaTypeForSelect | null> {
+  async findIdentity(args: FindSsoIdentityArgs): Promise<SsoIdentitiesSchemaTypeForSelect | null> {
+    const result = await this.db.dbDrizzle
+      .select()
+      .from(SsoIdentitiesSchema)
+      .where(
+        and(
+          eq(SsoIdentitiesSchema.ssoConfigId, args.ssoConfigId),
+          eq(SsoIdentitiesSchema.externalId, args.externalId),
+        )
+      )
+    if (result.length === 0) return null
+    return result[0]
+  }
+
+  async findIdentityByUser(args: FindSsoIdentityByUserArgs): Promise<SsoIdentitiesSchemaTypeForSelect | null> {
+    const result = await this.db.dbDrizzle
+      .select()
+      .from(SsoIdentitiesSchema)
+      .where(
+        and(
+          eq(SsoIdentitiesSchema.ssoConfigId, args.ssoConfigId),
+          eq(SsoIdentitiesSchema.userId, args.userId),
+        )
+      )
+    if (result.length === 0) return null
+    return result[0]
+  }
+
+  async deleteIdentitiesByConfig(ssoConfigId: number): Promise<void> {
+    await this.db.dbDrizzle
+      .delete(SsoIdentitiesSchema)
+      .where(eq(SsoIdentitiesSchema.ssoConfigId, ssoConfigId))
+  }
+
+  async upsertIdentity(data: UpsertSsoIdentityArgs): Promise<SsoIdentitiesSchemaTypeForSelect | null> {
     const existing = await callWithCatch(() =>
       this.db.dbDrizzle
         .select()

api/src/tv-modules/sso/SsoRoutes.ts

@@ -3,6 +3,7 @@ import type { Routable } from '../../types/routable.type'
 import { IsLoggedIn } from '../auth/middlewares/is-logged-in'
 import { IsOrgAdmin } from '../organizations/middlewares/IsOrgAdmin'
 import { IsSsoConfigAdmin } from './middlewares/IsSsoConfigAdmin'
+import { RequireLoginMethod } from '../auth/middlewares/require-login-method'
 import { SsoController } from './SsoController'
 
 export default class SsoRoutes implements Routable {
@@ -20,16 +21,19 @@ export default class SsoRoutes implements Routable {
   }
 
   initRoutes() {
-    this.router.get('/providers', this.controller.listPublicProviders)
-    this.router.get('/login/:configId', this.controller.initiateLogin)
-    this.router.get('/callback/:configId', this.controller.handleCallback)
-    this.router.post('/callback/:configId', this.controller.handleCallback)
+    this.router.get('/providers', [RequireLoginMethod('sso')], this.controller.listPublicProviders)
+    this.router.get('/login/:configId', [RequireLoginMethod('sso')], this.controller.initiateLogin)
+    this.router.get('/callback/:configId', [RequireLoginMethod('sso')], this.controller.handleCallback)
+    this.router.post('/callback/:configId', [RequireLoginMethod('sso')], this.controller.handleCallback)
 
+    this.router.get('/admin/public-urls', [IsLoggedIn], this.controller.getPublicUrls)
     this.router.get('/admin/metadata', [IsLoggedIn, IsOrgAdmin], this.controller.parseMetadata)
     this.router.get('/admin/configs', [IsLoggedIn, IsOrgAdmin], this.controller.listConfigs)
     this.router.post('/admin/configs', [IsLoggedIn, IsOrgAdmin], this.controller.createConfig)
     this.router.patch('/admin/configs/:configId', [IsLoggedIn, IsSsoConfigAdmin], this.controller.updateConfig)
     this.router.delete('/admin/configs/:configId', [IsLoggedIn, IsSsoConfigAdmin], this.controller.deleteConfig)
+    this.router.post('/admin/configs/:configId/verify-domain', [IsLoggedIn, IsSsoConfigAdmin], this.controller.startDomainVerification)
+    this.router.post('/admin/configs/:configId/verify-domain/check', [IsLoggedIn, IsSsoConfigAdmin], this.controller.checkDomainVerification)
     this.router.post('/admin/configs/:configId/scim-token', [IsLoggedIn, IsSsoConfigAdmin], this.controller.generateScimToken)
     this.router.patch('/admin/configs/:configId/scim', [IsLoggedIn, IsSsoConfigAdmin], this.controller.toggleScim)
   }

api/src/tv-modules/sso/__tests__/sso.utils.test.ts

@@ -0,0 +1,49 @@
+import { describe, it, expect } from 'vitest'
+import { deriveSamlEmail } from '../sso.utils'
+
+const EMAIL_NAMEID_FORMAT = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
+const PERSISTENT_NAMEID_FORMAT = 'urn:oasis:names:tc:SAML:2.0:nameid-format:persistent'
+const EMAIL_CLAIM = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'
+
+describe('deriveSamlEmail', () => {
+  it('takes the email attribute and lowercases it', () => {
+    expect(deriveSamlEmail({ email: 'User@Company.com', nameID: 'abc' })).toBe('user@company.com')
+  })
+
+  it('falls back to the xmlsoap emailaddress claim', () => {
+    expect(deriveSamlEmail({ [EMAIL_CLAIM]: 'a@b.com', nameID: 'abc' })).toBe('a@b.com')
+  })
+
+  it('uses nameID only when the NameID Format is emailAddress', () => {
+    expect(deriveSamlEmail({
+      nameID: 'user@company.com',
+      nameIDFormat: EMAIL_NAMEID_FORMAT,
+    })).toBe('user@company.com')
+  })
+
+  it('does not use nameID for a non-email NameID Format', () => {
+    expect(deriveSamlEmail({
+      nameID: 'user@company.com',
+      nameIDFormat: PERSISTENT_NAMEID_FORMAT,
+    })).toBeNull()
+  })
+
+  it('does not use nameID when no format is provided', () => {
+    expect(deriveSamlEmail({ nameID: 'user@company.com' })).toBeNull()
+  })
+
+  it('prefers the email attribute over an emailAddress-format nameID', () => {
+    expect(deriveSamlEmail({
+      email: 'attr@company.com',
+      nameID: 'name@company.com',
+      nameIDFormat: EMAIL_NAMEID_FORMAT,
+    })).toBe('attr@company.com')
+  })
+
+  it('returns null for a blank or non-string email attribute', () => {
+    expect(deriveSamlEmail({ email: '   ', nameID: 'abc' })).toBeNull()
+    expect(deriveSamlEmail({ email: 123, nameID: 'abc' })).toBeNull()
+    expect(deriveSamlEmail({ nameID: 'abc' })).toBeNull()
+    expect(deriveSamlEmail({})).toBeNull()
+  })
+})

api/src/tv-modules/sso/providers/oidc.provider.ts

@@ -2,6 +2,7 @@ import { randomBytes } from 'crypto'
 import * as client from 'openid-client'
 import type { Request, Response } from 'express'
 import type { SsoConfigsSchemaTypeForSelect } from 'taskview-db-schemas'
+import { PublicApiUrl } from '../../../modules/public-url'
 import type { SsoProvider, SsoAuthResult } from './sso-provider.interface'
 
 export class OidcProvider implements SsoProvider {
@@ -28,7 +29,12 @@ export class OidcProvider implements SsoProvider {
     return this.oidcConfig
   }
 
-  async initiateLogin(_req: Request, res: Response, relayState?: string): Promise<void> {
+  private resolveCallbackUrl(req: Request): string {
+    return this.config.oidcCallbackUrl?.trim()
+      || `${PublicApiUrl.base(req)}/module/sso/callback/${this.config.id}`
+  }
+
+  async initiateLogin(req: Request, res: Response, relayState?: string): Promise<void> {
     const config = await this.getOidcConfig()
     const scope = this.config.oidcScope ?? 'openid email profile'
     const codeVerifier = client.randomPKCECodeVerifier()
@@ -63,7 +69,7 @@ export class OidcProvider implements SsoProvider {
     })
 
     const params = new URLSearchParams({
-      redirect_uri: this.config.oidcCallbackUrl!,
+      redirect_uri: this.resolveCallbackUrl(req),
       scope,
       code_challenge: codeChallenge,
       code_challenge_method: 'S256',
@@ -110,7 +116,8 @@ export class OidcProvider implements SsoProvider {
       throw new Error('CSRF state mismatch — possible CSRF attack')
     }
 
-    const currentUrl = new URL(req.originalUrl, `${req.protocol}://${req.get('host')}`)
+    const callbackOrigin = new URL(this.resolveCallbackUrl(req)).origin
+    const currentUrl = new URL(req.originalUrl, callbackOrigin)
     const tokens = await client.authorizationCodeGrant(config, currentUrl, {
       pkceCodeVerifier: codeVerifier,
       expectedState: returnedState,
@@ -127,6 +134,7 @@ export class OidcProvider implements SsoProvider {
       email: (claims.email as string).toLowerCase(),
       externalId: claims.sub,
       displayName: claims.name as string | undefined,
+      preferredUsername: claims.preferred_username as string | undefined,
       provider: `oidc-${this.config.id}`,
     }
   }

api/src/tv-modules/sso/providers/saml.provider.ts

@@ -1,6 +1,9 @@
 import { SAML, ValidateInResponseTo } from '@node-saml/node-saml'
 import type { Request, Response } from 'express'
 import type { SsoConfigsSchemaTypeForSelect } from 'taskview-db-schemas'
+import { PublicApiUrl } from '../../../modules/public-url'
+import { deriveSamlEmail } from '../sso.utils'
+import type { SamlOptionsArgs } from '../types'
 import type { SsoProvider, SsoAuthResult } from './sso-provider.interface'
 import { SamlDbCacheProvider } from './saml-cache-provider'
 
@@ -11,12 +14,12 @@ function normalizeCert(cert: string): string {
     .replace(/[\s\r\n]/g, '')
 }
 
-function buildSamlOptions(config: SsoConfigsSchemaTypeForSelect, mode: 'assertion' | 'response') {
+function buildSamlOptions({ config, mode, callbackUrl }: SamlOptionsArgs) {
   return {
     entryPoint: config.samlEntryPoint!,
     issuer: config.samlIssuer!,
     idpCert: normalizeCert(config.samlCert!),
-    callbackUrl: config.samlCallbackUrl!,
+    callbackUrl,
     wantAssertionsSigned: mode === 'assertion',
     wantAuthnResponseSigned: mode === 'response',
     validateInResponseTo: ValidateInResponseTo.always,
@@ -31,29 +34,38 @@ function buildSamlOptions(config: SsoConfigsSchemaTypeForSelect, mode: 'assertio
 }
 
 export class SamlProvider implements SsoProvider {
-  private readonly samlAssertion: SAML
-  private readonly samlResponse: SAML
   private readonly config: SsoConfigsSchemaTypeForSelect
 
   constructor(config: SsoConfigsSchemaTypeForSelect) {
     this.config = config
-    this.samlAssertion = new SAML(buildSamlOptions(config, 'assertion'))
-    this.samlResponse = new SAML(buildSamlOptions(config, 'response'))
+  }
+
+  private resolveCallbackUrl(req: Request): string {
+    return this.config.samlCallbackUrl?.trim()
+      || `${PublicApiUrl.base(req)}/module/sso/callback/${this.config.id}`
   }
 
   async initiateLogin(req: Request, res: Response, relayState?: string): Promise<void> {
-    const loginUrl = await this.samlAssertion.getAuthorizeUrlAsync(relayState ?? '', req.hostname, {})
+    const saml = new SAML(buildSamlOptions({
+      config: this.config,
+      mode: 'assertion',
+      callbackUrl: this.resolveCallbackUrl(req),
+    }))
+    const loginUrl = await saml.getAuthorizeUrlAsync(relayState ?? '', req.hostname, {})
     res.redirect(loginUrl)
   }
 
   async handleCallback(req: Request): Promise<SsoAuthResult> {
+    const callbackUrl = this.resolveCallbackUrl(req)
     let profile
 
     try {
-      const result = await this.samlAssertion.validatePostResponseAsync(req.body)
+      const saml = new SAML(buildSamlOptions({ config: this.config, mode: 'assertion', callbackUrl }))
+      const result = await saml.validatePostResponseAsync(req.body)
       profile = result.profile
     } catch {
-      const result = await this.samlResponse.validatePostResponseAsync(req.body)
+      const saml = new SAML(buildSamlOptions({ config: this.config, mode: 'response', callbackUrl }))
+      const result = await saml.validatePostResponseAsync(req.body)
       profile = result.profile
     }
 
@@ -61,14 +73,13 @@ export class SamlProvider implements SsoProvider {
       throw new Error('SAML response missing nameID')
     }
 
-    const email = (
-      profile.email
-      ?? profile['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress']
-      ?? profile.nameID
-    ) as string
+    const email = deriveSamlEmail(profile as Record<string, unknown>)
+    if (!email) {
+      throw new Error('SAML response missing email attribute')
+    }
 
     return {
-      email: email.toLowerCase(),
+      email,
       externalId: profile.nameID,
       displayName: (profile.displayName
         ?? profile['http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name']) as string | undefined,

api/src/tv-modules/sso/providers/sso-provider.interface.ts

@@ -4,6 +4,7 @@ export type SsoAuthResult = {
   email: string
   externalId: string
   displayName?: string
+  preferredUsername?: string
   provider: string
 }
 

api/src/tv-modules/sso/sso.utils.ts

@@ -1,11 +1,64 @@
+import { randomBytes } from 'crypto'
+import { resolveTxt } from 'node:dns/promises'
 import type { SsoConfigsSchemaTypeForSelect } from 'taskview-db-schemas'
 import { decryptField } from '../../utils/crypto'
 import { generateString } from '../../utils/helpers'
+import type { CheckSsoDomainProofArgs, SsoDomainVerificationMethod } from './types'
 
 export const SSO_SECRET_FIELDS = ['samlCert', 'samlSigningKey', 'samlSigningCert', 'oidcClientSecret'] as const
 
-export function stripSecrets(config: SsoConfigsSchemaTypeForSelect) {
+export const SSO_DOMAIN_TXT_PREFIX = 'taskview-sso-verify='
+export const SSO_DOMAIN_WELL_KNOWN_PATH = '/.well-known/taskview-sso-verify.txt'
+
+export function generateDomainVerifyToken(): string {
+  return `tvdom_${randomBytes(32).toString('hex')}`
+}
+
+const SAML_EMAIL_NAMEID_FORMAT = 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress'
+const SAML_EMAIL_CLAIM = 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress'
+
+export function deriveSamlEmail(profile: Record<string, unknown>): string | null {
+  const fromAttribute = profile.email ?? profile[SAML_EMAIL_CLAIM]
+  if (typeof fromAttribute === 'string' && fromAttribute.trim()) {
+    return fromAttribute.trim().toLowerCase()
+  }
+  if (profile.nameIDFormat === SAML_EMAIL_NAMEID_FORMAT
+    && typeof profile.nameID === 'string' && profile.nameID.trim()) {
+    return profile.nameID.trim().toLowerCase()
+  }
+  return null
+}
+
+export function trustedSsoDomains(): string[] {
+  const raw = process.env.SSO_TRUSTED_DOMAINS
+  if (!raw?.trim()) return []
+  return raw
+    .split(',')
+    .map((domain) => domain.trim().toLowerCase())
+    .filter(Boolean)
+}
+
+export function isTrustedSsoDomain(domain: string): boolean {
+  return trustedSsoDomains().includes(domain.trim().toLowerCase())
+}
+
+export function isSsoDomainVerified(config: SsoConfigsSchemaTypeForSelect): boolean {
+  if (isTrustedSsoDomain(config.emailDomainRestriction)) return true
+  return !!config.domainVerifiedAt
+}
+
+export function ssoDomainVerifyHttpUrl(domain: string): string {
+  const protocol = process.env.NODE_ENV === 'production' ? 'https' : 'http'
+  return `${protocol}://${domain}${SSO_DOMAIN_WELL_KNOWN_PATH}`
+}
+
+export function ssoDomainVerifyDnsRecord(token: string): string {
+  return `${SSO_DOMAIN_TXT_PREFIX}${token}`
+}
+
+export function toClientSsoConfig(config: SsoConfigsSchemaTypeForSelect) {
   const { samlCert, samlSigningKey, samlSigningCert, oidcClientSecret, scimToken, ...safe } = config
+  const token = config.domainVerifyToken
   return {
     ...safe,
     hasSamlCert: !!samlCert,
@@ -13,9 +66,65 @@ export function stripSecrets(config: SsoConfigsSchemaTypeForSelect) {
     hasSamlSigningCert: !!samlSigningCert,
     hasOidcClientSecret: !!oidcClientSecret,
     hasScimToken: !!scimToken,
+    isDomainVerified: isSsoDomainVerified(config),
+    isDomainTrusted: isTrustedSsoDomain(config.emailDomainRestriction),
+    domainVerifyDnsRecord: token ? ssoDomainVerifyDnsRecord(token) : null,
+    domainVerifyHttpUrl: ssoDomainVerifyHttpUrl(config.emailDomainRestriction),
   }
 }
 
+export function stripSecrets(config: SsoConfigsSchemaTypeForSelect) {
+  return toClientSsoConfig(config)
+}
+
+function tokenMatchesProof(body: string, token: string): boolean {
+  const trimmed = body.trim()
+  return trimmed === token || trimmed === ssoDomainVerifyDnsRecord(token)
+}
+
+export async function checkSsoDomainDnsTxt(args: CheckSsoDomainProofArgs): Promise<boolean> {
+  try {
+    const records = await resolveTxt(args.domain)
+    return records.some((chunks) => tokenMatchesProof(chunks.join(''), args.token))
+  } catch {
+    return false
+  }
+}
+
+export async function checkSsoDomainHttpFile(args: CheckSsoDomainProofArgs): Promise<boolean> {
+  const urls = process.env.NODE_ENV === 'production'
+    ? [`https://${args.domain}${SSO_DOMAIN_WELL_KNOWN_PATH}`]
+    : [
+      `https://${args.domain}${SSO_DOMAIN_WELL_KNOWN_PATH}`,
+      `http://${args.domain}${SSO_DOMAIN_WELL_KNOWN_PATH}`,
+    ]
+
+  for (const url of urls) {
+    const urlError = validateMetadataUrl(url)
+    if (urlError) continue
+
+    try {
+      const response = await fetch(url, {
+        redirect: 'error',
+        signal: AbortSignal.timeout(5000),
+      })
+      if (!response.ok) continue
+      if (tokenMatchesProof(await response.text(), args.token)) return true
+    } catch {
+      continue
+    }
+  }
+
+  return false
+}
+
+export async function proveSsoDomainOwnership(args: CheckSsoDomainProofArgs): Promise<SsoDomainVerificationMethod | null> {
+  if (isTrustedSsoDomain(args.domain)) return 'trusted'
+  if (await checkSsoDomainDnsTxt(args)) return 'dns'
+  if (await checkSsoDomainHttpFile(args)) return 'http'
+  return null
+}
+
 export function decryptSsoConfig(config: SsoConfigsSchemaTypeForSelect): SsoConfigsSchemaTypeForSelect {
   return {
     ...config,

api/src/tv-modules/sso/types.ts

@@ -1,4 +1,12 @@
 import { type } from 'arktype'
+import type { SsoConfigsSchemaTypeForSelect } from 'taskview-db-schemas'
+import type { UserDbRecord } from '../../types/auth.types'
+
+export type SamlOptionsArgs = {
+  config: SsoConfigsSchemaTypeForSelect
+  mode: 'assertion' | 'response'
+  callbackUrl: string
+}
 
 export const SsoProtocols = {
   SAML: 'saml',
@@ -52,7 +60,76 @@ export const SsoConfigArkTypeUpdate = type({
   'oidcScope?': 'string',
 
   'defaultOrgRole?': "'admin' | 'member'",
-  'emailDomainRestriction?': 'string',
+  'emailDomainRestriction?': 'string > 0',
 })
 
 export type SsoConfigArgUpdate = typeof SsoConfigArkTypeUpdate.infer
+
+export type CheckSsoDomainProofArgs = {
+  domain: string
+  token: string
+}
+
+export type SsoDomainVerificationMethod = 'dns' | 'http' | 'trusted'
+
+export type StartDomainVerificationResult = {
+  token: string
+  dnsRecord: string
+  httpUrl: string
+  isDomainVerified: boolean
+  isDomainTrusted: boolean
+}
+
+export type CheckDomainVerificationResult = {
+  verified: boolean
+  method: SsoDomainVerificationMethod | null
+}
+
+export class SsoDomainNotVerifiedError extends Error {
+  readonly code = 'domain_unverified'
+
+  constructor() {
+    super('SSO domain is not verified')
+    this.name = 'SsoDomainNotVerifiedError'
+  }
+}
+
+export type FindSsoConfigByDomainAndOrgArgs = {
+  domain: string
+  organizationId: number
+}
+
+export type FindSsoIdentityArgs = {
+  ssoConfigId: number
+  externalId: string
+}
+
+export type FindSsoIdentityByUserArgs = {
+  ssoConfigId: number
+  userId: number
+}
+
+export type UpsertSsoIdentityArgs = {
+  userId: number
+  ssoConfigId: number
+  externalId: string
+  email: string
+}
+
+export type ResolveSsoUserArgs = {
+  ssoConfigId: number
+  email: string
+  externalId: string
+  preferredUsername?: string
+}
+
+export type ApplySsoIdpEmailArgs = {
+  user: UserDbRecord
+  email: string
+}
+
+export type SsoCallbackError = 'authentication_failed' | 'email_in_use' | 'account_blocked'
+
+export type ResolveSsoUserResult =
+  | { ok: true, user: UserDbRecord }
+  | { ok: false, error: SsoCallbackError }

api/src/tv-modules/start/StartManager.ts

@@ -89,7 +89,7 @@ export class StartManager {
         await this.fetchSharedGoals(organizationId);
         const goalIds = await this.getAllGoalsIds(organizationId);
 
-        const tasks = await this.repository.searchTask(description.trim(), goalIds);
+        const tasks = await this.repository.searchTask({ description, goalsIds: goalIds });
         return tasks;
     }
 }

api/src/tv-modules/start/StartRepository.ts

@@ -1,5 +1,5 @@
-import { and, eq, inArray, isNotNull, or } from 'drizzle-orm';
-import { GoalsSchema, GoalsListSchema } from 'taskview-db-schemas';
+import { and, eq, ilike, inArray, isNotNull, isNull, or } from 'drizzle-orm';
+import { GoalsSchema, GoalsListSchema, TasksSchema } from 'taskview-db-schemas';
 import type { AppUser } from '../../core/AppUser';
 import { Database } from '../../modules/db';
 import { $logger } from '../../modules/logget';
@@ -8,7 +8,7 @@ import { logError } from '../../utils/api';
 import { callWithCatch } from '../../utils/helpers';
 import type { TagToTaskInDb } from '../tags/tags.types';
 import { TaskItemForClient } from '../tasks/TaskItemForClient';
-import type { AssigneesForTaskFromDb, FetchAllListsResult, UsersByProjectsFromDb } from './start.types';
+import type { AssigneesForTaskFromDb, FetchAllListsResult, SearchTaskArgs, SearchTaskResult, UsersByProjectsFromDb } from './start.types';
 
 //TODO: refactor 
 export class StartRepository {
@@ -371,31 +371,38 @@ export class StartRepository {
         return [...taskIdToTaskMap.values()];
     }
 
-    async searchTask(description: string, goalsIds: number[]): Promise<TaskItemForClient[]> {
-        if (goalsIds.length === 0 || !description.trim()) {
+    async searchTask(args: SearchTaskArgs): Promise<SearchTaskResult[]> {
+        const description = args.description.trim();
+        if (args.goalsIds.length === 0 || !description) {
             return [];
         }
-        const placeholders = goalsIds.map((_id, index) => {
-            return `$${index + 1}`;
-        });
 
-        const result = await this.db.query<TaskItemInDb>(
-            `select * from tasks.tasks where goal_id in (${placeholders.join(',')}) and complete = FALSE and parent_id is null and description ILIKE $${goalsIds.length + 1}`,
-            [...goalsIds, `%${description}%`]
+        const idMatch = description.match(/^#(\d+)$/);
+        const searchCondition = idMatch
+            ? eq(TasksSchema.id, Number(idMatch[1]))
+            : and(
+                eq(TasksSchema.complete, false),
+                isNull(TasksSchema.parentId),
+                ilike(TasksSchema.description, `%${description}%`),
+            );
+
+        const result = await callWithCatch(() =>
+            this.db.dbDrizzle
+                .select()
+                .from(TasksSchema)
+                .where(and(inArray(TasksSchema.goalId, args.goalsIds), searchCondition))
         );
 
         if (!result) {
             return [];
         }
 
-        const map: Map<number, TaskItemForClient> = new Map();
-
-        result.rows.forEach((t) => {
-            if (!map.get(t.id)) {
-                map.set(t.id, new TaskItemForClient(t));
-            }
-        });
-
-        return [...map.values()];
+        return result.map((task) => ({
+            ...task,
+            tags: [],
+            assignedUsers: [],
+            historyId: null,
+            subtasks: [],
+        }));
     }
 }

api/src/tv-modules/start/start.types.ts

@@ -1,3 +1,17 @@
+import type { TasksSchemaTypeForSelect } from 'taskview-db-schemas';
+
+export type SearchTaskArgs = {
+    description: string;
+    goalsIds: number[];
+};
+
+export type SearchTaskResult = TasksSchemaTypeForSelect & {
+    tags: number[];
+    assignedUsers: number[];
+    historyId: number | null;
+    subtasks: SearchTaskResult[];
+};
+
 export type FetchAllListsResult = {
     goalName: string | null;
     listName: string | null;

api/src/tv-modules/tasks/TasksRoutes.ts

@@ -2,25 +2,14 @@ import { Router } from 'express';
 import type { Routable } from '../../types/routable.type';
 import { IsLoggedIn } from '../auth/middlewares/is-logged-in';
 import { CanAddTaskNew } from './middlewares/CanAddTaskNew';
-// import { CanAddTask } from './middlewares/CanAddTask';
-// import { CanUpdateTaskStatus } from './middlewares/CanUpdateTaskStatus';
 import { CanDeleteTask } from './middlewares/CanDeleteTask';
-// import { CanUpdateTaskAssignee } from './middlewares/CanUpdateTaskAssignee';
 import { CanFetchTask } from './middlewares/CanFetchTask';
-// import { CanUpdateTaskDescription } from './middlewares/CanUpdateTaskDescription';
-// import { CanUpdateTaskNote } from './middlewares/CanUpdateTaskNote';
-// import { CanUpdateTaskDeadline } from './middlewares/CanUpdateTaskDeadline';
-// import { CanFetchSubtasks } from './middlewares/CanFetchSubtasks';
-// import { CanUpdateTaskPriority } from './middlewares/CanUpdateTaskPriority';
-// import { CanMoveTask } from './middlewares/CanMoveTask';
-// import { CanSeeTaskAssignedUsers } from './middlewares/CanSeeTaskAssignedUsers';
 import { CanFetchTaskHistory } from './middlewares/CanFetchTaskHistory';
 import { CanFetchTasks } from './middlewares/CanFetchTasks';
 import { CanRecoveryTaskHistory } from './middlewares/CanRecoveryTaskHistory';
 import { CanUpdateTask } from './middlewares/CanUpdateTask';
 import { CanUpdateTaskAssigneeNew } from './middlewares/CanUpdateTaskAssigneeNew';
 import { TasksController } from './TasksController';
-// import { MainCanCreateTaskAction } from './middlewares/MainCanCreateTaskAction';
 
 export default class TasksRoutes implements Routable {
     private readonly router: ReturnType<typeof Router>;

api/src/tv-modules/tasks/middlewares/CanAddTask.ts

@@ -1,39 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { ALL_TASKS_LIST_ID, DEFAULT_ID } from '../../../types/tasks.types';
-import { logError } from '../../../utils/api';
-
-export const CanAddTask = async (req: Request, res: Response, next: NextFunction) => {
-    const listId = req.body.componentId;
-
-    if (!listId) {
-        return res.status(400).end();
-    }
-
-    let permissions;
-    if (Number(listId) === ALL_TASKS_LIST_ID && req.body.goalId && req.body.goalId !== DEFAULT_ID) {
-        permissions = await req.appUser.permissionsFetcher
-            .getPermissionsForType(Number(req.body.goalId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_GOAL)
-            .catch(logError);
-    } else {
-        permissions = await req.appUser.permissionsFetcher
-            .getPermissionsForType(Number(listId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASKLIST)
-            .catch(logError);
-    }
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanAddTask middleware');
-        return res.status(500).end();
-    }
-
-    if (
-        permissions.hasPermissions(GoalPermissions.COMPONENT_CAN_ADD_TASKS) ||
-        permissions.hasPermissions(GoalPermissions.TASKS_CAN_ADD_SUBTASKS)
-    ) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/tasks/middlewares/CanFetchSubtasks.ts

@@ -1,28 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-
-export const CanFetchSubtasks = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.query.taskId;
-
-    if (!taskId) {
-        return res.status(400).end();
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(Number(taskId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASK)
-        .catch(logError);
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanFetchSubtasks');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.TASKS_CAN_WATCH_SUBTASKS)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/tasks/middlewares/CanFetchTask.ts

@@ -5,7 +5,7 @@ import { GoalPermissions } from '../../../types/auth.types';
 import { logError } from '../../../utils/api';
 
 export const CanFetchTask = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.query.taskId || req.params.taskId;
+    const taskId = req.params.taskId;
 
     if (!taskId) {
         return res.status(400).end();

api/src/tv-modules/tasks/middlewares/CanMoveTask.ts

@@ -1,28 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-
-export const CanMoveTask = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.body.taskId;
-
-    if (!taskId) {
-        return res.status(400).end();
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(Number(taskId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASK)
-        .catch(logError);
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanMoveTask');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.TASKS_CAN_DELETE)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/tasks/middlewares/CanSeeTaskAssignedUsers.ts

@@ -1,28 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-
-export const CanSeeTaskAssignedUsers = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.body.taskId;
-
-    if (!taskId) {
-        return res.status(400).end();
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(Number(taskId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASK)
-        .catch(logError);
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanSeeTaskAssignedUsers');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.TASKS_CAN_WATCH_ASSIGNED_USERS)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/tasks/middlewares/CanUpdateTaskAssignee.ts

@@ -1,29 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-
-/** @deprecated */
-export const CanUpdateTaskAssignee = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.body.taskId;
-
-    if (!taskId) {
-        return res.status(400).end();
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(Number(taskId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASK)
-        .catch(logError);
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanUpdateTaskDescription');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.TASKS_CAN_ASSIGN_USERS)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/tasks/middlewares/CanUpdateTaskDeadline.ts

@@ -1,28 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-
-export const CanUpdateTaskDeadline = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.body.taskId;
-
-    if (!taskId) {
-        return res.status(400).end();
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(Number(taskId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASK)
-        .catch(logError);
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanUpdateTaskDeadline');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.TASKS_CAN_EDIT_DEADLINE)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/tasks/middlewares/CanUpdateTaskDescription.ts

@@ -1,28 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-
-export const CanUpdateTaskDescription = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.body.taskId;
-
-    if (!taskId) {
-        return res.status(400).end();
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(Number(taskId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASK)
-        .catch(logError);
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanUpdateTaskDescription');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.TASKS_CAN_EDIT_DESCRIPTION)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/tasks/middlewares/CanUpdateTaskNote.ts

@@ -1,28 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-
-export const CanUpdateTaskNote = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.body.taskId;
-
-    if (!taskId) {
-        return res.status(400).end();
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(Number(taskId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASK)
-        .catch(logError);
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanUpdateTaskNote');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.TASKS_CAN_EDIT_NOTE)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/tasks/middlewares/CanUpdateTaskPriority.ts

@@ -1,28 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-
-export const CanUpdateTaskPriority = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.body.taskId;
-
-    if (!taskId) {
-        return res.status(400).end();
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(Number(taskId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASK)
-        .catch(logError);
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanUpdateTaskPriority');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.TASKS_CAN_EDIT_PRIORITY)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/tasks/middlewares/CanUpdateTaskStatus.ts

@@ -1,28 +0,0 @@
-import type { NextFunction, Request, Response } from 'express';
-import { GoalPermissionsFetcher } from '../../../core/GoalPermissionsFetcher';
-import { $logger } from '../../../modules/logget';
-import { GoalPermissions } from '../../../types/auth.types';
-import { logError } from '../../../utils/api';
-
-export const CanUpdateTaskStatus = async (req: Request, res: Response, next: NextFunction) => {
-    const taskId = req.body.taskId;
-
-    if (!taskId) {
-        return res.status(400).end();
-    }
-
-    const permissions = await req.appUser.permissionsFetcher
-        .getPermissionsForType(Number(taskId), GoalPermissionsFetcher.PERMISSION_TYPE_FOR_TASK)
-        .catch(logError);
-
-    if (!permissions) {
-        $logger.error('Can not get permissions for CanAddTask middleware');
-        return res.status(500).end();
-    }
-
-    if (permissions.hasPermissions(GoalPermissions.TASKS_CAN_EDIT_STATUS)) {
-        return next();
-    }
-
-    return res.status(403).end();
-};

api/src/tv-modules/ui-preferences/types.ts

@@ -44,6 +44,8 @@ const firstDayOfWeekArkType = type('number.integer').narrow((v, ctx) =>
 
 export const UiSettingsArkType = type({
   'firstDayOfWeek?': firstDayOfWeekArkType,
+  'defaultProjectId?': 'number.integer >= 1',
+  'defaultView?': "'tasks' | 'kanban' | 'graph' | 'sprints'",
 })
 
 export type UiSettings = typeof UiSettingsArkType.infer

api/src/types/app.types.ts

@@ -23,6 +23,17 @@ export const AppEnvSchema = z.object({
     SMTP_FROM_EMAIL: z.string().optional(),
     APP_URL: z.string(),
 
+    // Send an email to a person when they are invited to a project (requires SMTP); default off
+    INVITE_EMAIL_ENABLED: z.string().optional(),
+    // Max invite emails one user may trigger per hour (default 30)
+    INVITE_EMAIL_HOURLY_LIMIT: z.string().optional(),
+
+    // How account password changes are confirmed: code sent by email (default) or current password
+    PASSWORD_CHANGE_CONFIRMATION: z.enum(['email', 'password']).optional(),
+
+    // Comma-separated list of enabled login methods (magic-link, password, sso, social); unset = all enabled
+    AUTH_LOGIN_METHODS: z.string().optional(),
+
     TELEGRAM_BOT_TOKEN: z.string().optional(),
     TELEGRAM_BOT_USERNAME: z.string().optional(),
     TELEGRAM_WEBHOOK_SECRET: z.string().optional(),

api/src/types/auth.types.ts

@@ -62,6 +62,67 @@ export const ChangePasswordDataScheme = z
 
 export type ChangePasswordData = z.infer<typeof ChangePasswordDataScheme>;
 
+export const ChangeOwnPasswordSchema = z
+    .object({
+        code: z.string().min(1).max(64),
+        password: z.string().min(6).max(128),
+        passwordRepeat: z.string().max(128),
+    })
+    .refine((data) => data.password === data.passwordRepeat, {
+        message: "Passwords don't match",
+        path: ['passwordRepeat'],
+    });
+
+export type ChangeOwnPassword = z.infer<typeof ChangeOwnPasswordSchema>;
+
+export const ChangeOwnPasswordByPasswordSchema = z
+    .object({
+        currentPassword: z.string().min(1).max(128),
+        password: z.string().min(6).max(128),
+        passwordRepeat: z.string().max(128),
+    })
+    .refine((data) => data.password === data.passwordRepeat, {
+        message: "Passwords don't match",
+        path: ['passwordRepeat'],
+    });
+
+export type ChangeOwnPasswordByPassword = z.infer<typeof ChangeOwnPasswordByPasswordSchema>;
+
+export type PasswordChangeConfirmationMode = 'email' | 'password';
+
+export type LoginMethod = 'magic-link' | 'password' | 'sso' | 'social';
+
+export const ChangeDefaultUserCredentialsSchema = z
+    .object({
+        currentPassword: z.string().min(1).max(128),
+        login: z.string().min(3).max(64).regex(/^[a-zA-Z0-9._-]+$/).toLowerCase(),
+        email: z.string().email().max(255).toLowerCase(),
+        password: z.string().min(6).max(128),
+        passwordRepeat: z.string().max(128),
+    })
+    .refine((data) => data.password === data.passwordRepeat, {
+        message: "Passwords don't match",
+        path: ['passwordRepeat'],
+    });
+
+export type ChangeDefaultUserCredentials = z.infer<typeof ChangeDefaultUserCredentialsSchema>;
+
+export type UpdateUserCredentialsArgs = {
+    userId: number;
+    oldEmail: string;
+    login: string;
+    email: string;
+    passwordHash: string;
+};
+
+export type UpdateUserEmailArgs = {
+    userId: number;
+    oldEmail: string;
+    email: string;
+};
+
+export type UpdateUserCredentialsResult = 'ok' | 'conflict' | 'error';
+
 export const RefreshTokenSchema = z.object({
     refreshToken: z.string(),
 });

api/src/utils/helpers.ts

@@ -2,6 +2,17 @@ import { randomInt } from 'crypto';
 import { UAParser } from 'ua-parser-js';
 import { $logger } from '../modules/logget';
 
+// Escapes HTML text and attribute contexts (the quotes matter inside href="...")
+// so a user-controlled value can't break out of the surrounding markup.
+export function escapeHtml(text: string): string {
+    return text
+        .replace(/&/g, '&')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;')
+        .replace(/'/g, '&#39;');
+}
+
 export function isEmail(email: string): boolean {
     const re =
         /^(([^<>()[\]\\.,;:\s@"]+(\.[^<>()[\]\\.,;:\s@"]+)*)|(".+"))@((\[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\])|(([a-zA-Z\-0-9]+\.)+[a-zA-Z]{2,}))$/;
@@ -18,6 +29,15 @@ export function generateString(length: number) {
     return result
 }
 
+export function generateLetters(length: number) {
+    let result = ''
+    const characters = 'abcdefghijklmnopqrstuvwxyz'
+    for (let i = 0; i < length; i++) {
+        result += characters.charAt(randomInt(characters.length))
+    }
+    return result
+}
+
 export function time() {
     return Math.floor(Date.now() / 1000);
 }

build-dockers.sh

@@ -37,9 +37,18 @@ cd web
 bash build-docker-web.sh $VERSION
 cd ..
 
+# Build CE MCP
+echo "========================================="
+echo "Building CE MCP Server..."
+echo "========================================="
+cd taskview-packages/taskview-mcp
+bash build-docker-mcp.sh $VERSION gimanhead/taskview-ce-mcp
+cd ../..
+
 echo "========================================="
 echo "Build complete!"
 echo "Images built:"
 echo "  - gimanhead/taskview-ce-api-server:$VERSION"
 echo "  - gimanhead/taskview-ce-webapp:$VERSION"
+echo "  - gimanhead/taskview-ce-mcp:$VERSION"
 echo "========================================="

docs/1.getting-started/1.index.md

@@ -1,6 +1,6 @@
 ---
 title: What is TaskView
-description: TaskView is an open-source, self-hosted project and task management platform. Features Kanban boards, dependency graphs, team collaboration, RBAC, GitHub/GitLab sync, and full data ownership. Free alternative to other PM for teams who need privacy and control.
+description: TaskView is a source-available, self-hosted project and task management platform. Features Kanban boards, dependency graphs, team collaboration, RBAC, GitHub/GitLab sync, and full data ownership. Free alternative to other PM for teams who need privacy and control.
 navigation:
   icon: i-lucide-house
 ---

docs/1.getting-started/2.installation.md

@@ -40,7 +40,12 @@ DB_USER="taskview_db_user"
 DB_PASSWORD="your_secure_password"
 DB_NAME="taskviewdb"
 DB_PORT=5432
+# Postgres connections per API worker (this is the default)
+DB_POOL_MAX=20
 APP_PORT=1401
+# API worker processes (this is the default). Accepts a number or "max" (one worker per CPU core).
+# Keep PM2_INSTANCES x DB_POOL_MAX below the Postgres max_connections limit (default 100).
+PM2_INSTANCES=2
 JWT_ALG="HS256"
 JWT_SIGN="secret"
 ACCESS_LIFE_TIME="3d"
@@ -144,8 +149,24 @@ services:
   taskview-webapp:
     image: gimanhead/taskview-ce-webapp:latest
     restart: unless-stopped
+    environment:
+      # The web app will always use this API server and hide the server selector on the login page.
+      # Remove this variable if you want to pick the API server manually on the login page.
+      TASKVIEW_API_URL: "http://localhost:1725"
     ports:
       - "8888:80"
+  # Enable to let AI assistants (Claude Code, Cursor, ...) work with your instance
+  # over MCP, read https://taskview.tech/docs/integrations/mcp
+  # taskview-mcp:
+  #   image: gimanhead/taskview-ce-mcp:latest
+  #   restart: unless-stopped
+  #   environment:
+  #     TASKVIEW_URL: "http://taskview-api-server:1401"
+  #   ports:
+  #     - "3100:3100"
+  #   depends_on:
+  #     - taskview-api-server
+  #   networks: [backend]
   # Enable for realtime notification read https://taskview.tech/docs/configuration/environment-variables#centrifugo-configuration-file 
   # centrifugo:
   #   image: centrifugo/centrifugo:v6
@@ -175,14 +196,16 @@ Go to [http://localhost:8888](http://localhost:8888) in your browser. You'll see
 
 ### Configure the API server
 
-Before logging in, you need to tell the web app where the API server is running. Click the **server settings** icon on the login page and add the API server URL:
+The web app (port 8888) serves the frontend, while the API server (port 1725) handles authentication, projects, tasks, and all backend operations.
+
+If you set `TASKVIEW_API_URL` on the `taskview-webapp` service (as in the compose file above), there is nothing to configure — the web app already knows where the API is, and the server selector is hidden from the login page.
+
+Without `TASKVIEW_API_URL`, click the **server settings** section on the login page and add the API server URL manually:
 
 ```
 http://localhost:1725
 ```
 
-This is the API server that handles authentication, projects, tasks, and all backend operations. The web app (port 8888) serves the frontend, while the API server (port 1725) handles the data.
-
 ### Log in with the default user
 
 The database migration creates a default user so you can log in right away:
@@ -193,31 +216,25 @@ The database migration creates a default user so you can log in right away:
 Use these credentials to verify that everything is working - check that the UI loads, you can create a project, add tasks, etc.
 
 ::callout{icon="i-lucide-alert-triangle" color="error"}
-**Important:** The default user is for initial setup only. Once you've confirmed the system works, delete the default user and create your own account with a secure password.
+**Important:** The default credentials are publicly known — anyone who has read this page can sign in to a fresh installation. Claim the account right after the first login.
 ::
 
-### Replacing the default user
+### Claim the default account
+
+Make the default account your own — no SMTP or database access needed:
 
 1. Log in with the default credentials
-2. Register a new account with your real email and a strong password
-3. Delete the default `admin` account
+2. Open **Account settings** — the highlighted **Login and email** card is shown at the top (it is visible only to the default user)
+3. Set your own login, email and a strong password, confirm with the current password (`user1!#Q`), and click **Save and sign out**
+4. Sign in again with your new login and password
 
-If you prefer to create the first user directly in the database, generate a password hash:
+![The Login and email card in Account settings for claiming the default account](/taskview/change-def-account.png)
 
-```ts
-import { hashSync } from 'bcryptjs'
+Your organizations, projects and permissions are preserved. Once the email is changed, the card disappears and the claim endpoint is disabled.
 
-const passwordHash = hashSync('your-secure-password', 12)
-console.log(passwordHash)
-```
-
-Or as a one-liner:
-
-```bash
-node -e "console.log(require('bcryptjs').hashSync('your-secure-password', 12))"
-```
-
-Then insert the user into the database with the generated hash.
+::callout{icon="i-lucide-mail" color="info"}
+Changing the password later requires a confirmation code sent by email. If your installation has no SMTP, set `PASSWORD_CHANGE_CONFIRMATION="password"` in `.env.taskview` so password changes are confirmed with the current password instead. See [Environment Variables](/docs/configuration/environment-variables#authentication).
+::
 
 ## Updating
 
@@ -233,7 +250,10 @@ The migration container will automatically apply any new database changes on sta
 ## Production tips
 
 - **Use a reverse proxy** (Nginx, Caddy, Traefik) to terminate SSL and serve everything over HTTPS
-- **Update `APP_URL` and `API_URL`** in `.env.taskview` to match your production domain
+- **Update `APP_URL`** in `.env.taskview` and `TASKVIEW_API_URL` on the webapp service to match your production domains
+- **Trim the login page** — set `AUTH_LOGIN_METHODS` in `.env.taskview` to offer only the sign-in methods you actually use (e.g. `AUTH_LOGIN_METHODS="password"`). Google/GitHub/Apple buttons are shown only when the provider is configured.
+- **Close the instance** — set `ALLOW_PUBLIC_REGISTRATION="false"` so strangers can't create accounts: only emails invited to an organization or project (and users coming through your SSO provider) can sign in and get an account on first login. See [how it works](/docs/configuration/environment-variables#closing-an-instance-how-allow_public_registrationfalse-works).
+- **Scale API workers deliberately** — the API runs `PM2_INSTANCES` worker processes (default `2`), and each worker opens its own pool of up to `DB_POOL_MAX` Postgres connections (default `20`). Before raising either value (or using `PM2_INSTANCES=max`), make sure `workers × DB_POOL_MAX` stays below your Postgres `max_connections` (default `100`) — otherwise the API fails with *"sorry, too many clients already"*. The API logs a warning on startup when the budget looks too high.
 - **Back up the database** - the `pgdata` volume contains all your data
 - **Set `restart: unless-stopped`** on all services so they survive server reboots
 - **SMTP setup** - add SMTP variables to `.env.taskview` if you want email features (password recovery, invitations). See [Configuration](/docs/configuration/environment-variables) for details.

docs/2.features/10.organizations.md

@@ -50,7 +50,7 @@ Only **owners** and **admins** can manage members. The **Members** tab is not vi
 2. Go to the **Members** tab
 3. Enter an email address and click **Add Member**
 
-New members are added with the **member** role by default. You can change their role to **admin** using the role dropdown next to their name. Members can only be invited by email. The person needs to have a TaskView account with that email.
+New members are added with the **member** role by default. You can change their role to **admin** using the role dropdown next to their name. Members are invited by email address. The person doesn't need a TaskView account yet - membership is stored against the email, so you can add someone in advance and they join the organization as soon as they sign up with that address.
 
 ::callout{icon="i-lucide-alert-triangle" color="warning"}
 When a project member with the **Manage users** permission invites someone into a project, that person is automatically added to the organization as a **member** - even though only admins and owners can add members directly. This is by design: a person can't be in a project without being in its organization. The auto-added member gets the minimum role and can't manage the organization.
@@ -82,3 +82,21 @@ Organizations and projects have separate permission systems:
 Being an organization admin doesn't automatically give you permissions inside projects. You still need to be added to each project and assigned a project role. See [Roles and Permissions](/docs/collaboration/roles-and-permissions) for project-level access control.
 
 The member list API endpoint is restricted to owners and admins. Regular members cannot fetch the list of organization members.
+
+## Who can see which projects
+
+| Who | Sees |
+|-----|------|
+| **Organization owner** | **Every project of the organization**, including projects created by other members |
+| **Organization admin** | Only the projects they were added to |
+| **Organization member** | Only the projects they were added to |
+
+Projects created inside an organization belong to the organization, not to the person who created them: the organization owner is recorded as their owner. That is what keeps a project reachable when the person who created it leaves the company - nothing is lost with them. The flip side is that the owner sees every project of their organization, whoever created it.
+
+Everyone else - admins included - gets access to a project only by being added to it and given a project role. Being an organization admin means administering the organization (members, settings, SSO), not its content.
+
+::callout{icon="i-lucide-shield-alert" color="warning"}
+**Access is granted explicitly, never inherited from a title.** There is deliberately no "admins can see all projects" switch: if a project should be visible to someone, they get invited to it. This keeps sensitive projects - finance, HR, salaries - private by default instead of silently opening them the moment someone is promoted to admin.
+
+The one exception is the organization owner, who sees everything by design (see above). If a project must stay private from the owner too, keep it in your **personal workspace** rather than in the organization.
+::

docs/2.features/11.sso.md

@@ -22,6 +22,23 @@ Users who sign in via SSO are automatically added to the organization that owns
 
 Go to your organization's settings → **SSO** tab. You need the **admin** or **owner** role.
 
+### Domain verification
+
+SSO login stays off until the organization proves it owns the email domain (so another org on a shared instance cannot claim `gmail.com` or your company domain).
+
+After you save the SSO config, TaskView shows a verification token. Use **one** of:
+
+1. **DNS TXT** — add a TXT record on the domain:
+   `taskview-sso-verify=<token>`
+2. **HTTP file** — serve the token (plain text) at:
+   `https://<domain>/.well-known/taskview-sso-verify.txt`
+
+Then click **Check domain**. Either method is enough. After a successful check, SSO login is enabled.
+
+**Closed-network / air-gapped installs:** you may not have public DNS. Set `SSO_TRUSTED_DOMAINS=company.com,corp.local` on the API server. Domains in that list skip the DNS/HTTP check and are treated as verified.
+
+Existing SSO configs created before this check are not verified: logins stop until an admin completes verification or the domain is listed in `SSO_TRUSTED_DOMAINS`.
+
 ### SAML 2.0
 
 **Required fields:**
@@ -35,6 +52,10 @@ Go to your organization's settings → **SSO** tab. You need the **admin** or **
 | IdP Certificate | Your IdP's public signing certificate (base64, without BEGIN/END headers) |
 | ACS URL (Callback) | The URL where your IdP sends SAML responses. Shown after creating the config - copy it to your IdP |
 
+::callout{icon="i-lucide-network" color="warning"}
+**Running behind a reverse proxy?** Set [`API_PUBLIC_URL`](/docs/configuration/environment-variables#application) to the public address of your API server. The ACS/Callback URL and the SCIM endpoint shown on this screen are built from it — without the variable they fall back to the address your browser used, which behind a proxy can be an internal host that your IdP cannot reach.
+::
+
 **Using Metadata URL (recommended):**
 
 Instead of filling fields manually, paste your IdP's metadata URL and click **Sync**. This auto-fills the IdP SSO URL, Certificate, and Logout URL from the metadata XML.
@@ -141,6 +162,8 @@ Request IDs expire after 5 minutes.
 | POST | `/module/sso/admin/configs` | Create SSO config |
 | PATCH | `/module/sso/admin/configs/{configId}` | Update SSO config |
 | DELETE | `/module/sso/admin/configs/{configId}` | Delete SSO config |
+| POST | `/module/sso/admin/configs/{configId}/verify-domain` | Return DNS TXT and HTTP well-known proof for the domain |
+| POST | `/module/sso/admin/configs/{configId}/verify-domain/check` | Check DNS TXT then HTTP file; enable SSO on success |
 
 ## Database tables
 

docs/2.features/12.ui-customization.md

@@ -0,0 +1,47 @@
+---
+title: UI Customization
+description: Personalize TaskView per user - reorder and hide task fields and analytics blocks, set the first day of week, and pick a default project and view to open right after signing in.
+navigation:
+  icon: i-lucide-sliders-horizontal
+---
+
+TaskView lets every user tune the interface to how they actually work. All settings on this page are personal — they are stored per user on the server and follow you across devices and browsers.
+
+Open **Settings → UI customization** from the user menu.
+
+## Reorder and hide items
+
+Three sections are driven by drag-and-drop lists:
+
+- **Tasks** — the fields shown in the task detail view (note, status, priority, assignees, tags, deadline, sprint, estimate, time tracking, history, …)
+- **Analytics — Indicators** — the KPI tiles on the analytics page
+- **Analytics — Charts** — the charts on the analytics page
+
+For every item you can:
+
+- **Reorder** — drag by the handle on the left
+- **Show / hide** — toggle visibility
+- **Narrow / wide** — for task fields, choose whether the field takes half or the full width of the detail view
+
+All available items are listed here; permission checks still apply at render time, so an enabled item may stay hidden if you lack the permission to see it.
+
+## Others
+
+### First day of week
+
+Sets which day calendars start on. Applies to all date pickers across the app. "Default" follows your locale.
+
+### Default project and view
+
+Normally, after signing in you land on the home screen and navigate to your project and board manually. If you always start in the same place, set it as the default:
+
+- **Default project** — the project TaskView opens right after you sign in (or reopen the app with an active session)
+- **Default view** — which view of that project to open: **Tasks**, **Kanban**, **Graph** or **Sprints**
+
+When a default project is set, a quick-jump button with the project name also appears in the sidebar next to **Inbox** — click it from anywhere to return to your project in the chosen view.
+
+If the default project is deleted or you lose access to it, TaskView falls back to the home screen. Choose "Home screen (default)" to turn the feature off.
+
+## How it is stored
+
+Preferences are saved automatically (no Save button) through the `ui-preferences` API and kept per user account. Resetting the browser or switching devices does not lose them.