d418c367cb
Security hardening and fix all compile warnings
...
Security fixes:
- Validate theme background image URLs against whitelist pattern
- Add board permission check to Socket.IO join-board handler
- Disable raw HTML passthrough in markdown parser (XSS prevention)
- Add UUID validation on avatar and branding route params (path traversal)
- Add security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
- Validate webhook URLs (HTTPS only, block internal addresses)
- Add import payload size limit (5MB)
- Remove server uptime from health endpoint
- Make seed password configurable via SEED_ADMIN_PASSWORD env var
- Patch DOMPurify dependency vulnerability via npm audit fix
Warning fixes:
- Convert $state(prop) to $effect.pre sync pattern (state_referenced_locally)
- Add for/id pairings to form labels (a11y_label_has_associated_control)
- Add svelte-ignore for intentional autofocus usage (a11y_autofocus)
- Add ARIA roles to interactive/overlay divs (a11y_no_static_element_interactions)
- Add aria-label to icon-only buttons (a11y_consider_explicit_label)
- Add keyboard handler alongside click events (a11y_click_events_have_key_events)
- Fix non-reactive fileInput declaration
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-03-07 18:36:47 -05:00
6ed0349507
Phase 7: Search, filters, templates, and archive UI
...
Add full-text card search (PostgreSQL tsvector + GIN index) with navbar
SearchBar, client-side board filters (label/assignee/due date), board
templates (3 system templates + save-as-template API), and archive
toggle for both board listing and board view.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-26 00:42:20 -05:00
80c17d4c6f
Auto-create tenant for any hostname that reaches the app
...
DNS is the gatekeeper — if a request arrives, it was pointed
here intentionally. Every new hostname gets its own tenant
automatically, no manual setup or seeding required.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-25 22:30:05 -05:00
7b540a37ee
Rebrand to Pounce, the Open Source Kanban Solution
...
- Rename project from "kanban" to "pounce"
- Update landing page: "Pounce on your tasks"
- Replace navbar icon with cat paw
- Update seed hostname to pounce.catrenelle.com
- Write proper README with setup instructions
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-25 22:24:43 -05:00
bdb8af6ca2
Add kanban.catrenelle.com to seed hostnames
...
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-25 22:13:27 -05:00
2f398711c8
Initial implementation: multi-tenant Kanban board (Phase 1)
...
Complete Phase 1 foundation with working board, column, and card CRUD:
- SvelteKit + TypeScript + Tailwind CSS v4 + adapter-node
- Full Prisma schema with 18 tables (tenants, users, boards, columns, cards, etc.)
- Multi-tenant architecture with hostname-based tenant resolution
- Email/password auth with bcrypt + session cookies
- Board/Column/Card API routes with full CRUD
- Fractional indexing for drag-and-drop ordering
- Board view with svelte-dnd-action for column and card drag-and-drop
- Card modal with inline editing
- Auth pages (login, register)
- Board listing with create form
- RLS policies SQL script for tenant isolation
- Prisma RLS client extensions (forTenant/bypassRLS)
- Permission helpers (canEditBoard, canManageMembers, etc.)
- Socket.IO server setup (dev Vite plugin + production Express server)
- Client-side socket store for real-time updates
- Docker Compose (app + PostgreSQL 16) + multi-stage Dockerfile
- Database seed script (default tenant + admin user)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com >
2026-02-25 20:58:49 -05:00
Catherine Renelle