- Pending workspace invites with accept/decline + bell notifications;
invite permission extendable via workspace.invite group right
- Notifications API (list/unread, mark read, read-all) + realtime push
to per-user socket rooms; chat messages notify other members
- Workspace team chat API (list/post/delete) + chat:join socket rooms
- Image uploads (multer, 5MB image-only) served from /uploads
- Teams (managers/members), team-owned workspaces (TEAM badge), team
task boards (team_id) and task assignees (workspace members only)
- Permission groups with teams.create/edit/invite + workspace.invite,
default Team Creators seeding, hasPerm/canManageTeam guards
- Public registration disabled after install; admins create users
(pending invites auto-link); users gain bg_glass setting
- Crash fix: express-async-errors + 400 on malformed IDs instead of
unhandled rejections killing the server
- Settings window with tabs: profile (name, email, avatar, password),
appearance (light/dark/system), language (de/en/zh), background
(gradient presets, custom URL, blur toggle); persisted server-side
- i18n dictionaries (de/en/zh) applied across nav, sidebar, tasks,
calendar, time tracking, admin, invites and comments
- Greeting header with time-of-day message, live clock and date; cooler
theme, cards, kanban, calendar grid and data-table styling
- Shared sidebar: nav, collapsible books with per-book pages, top-level
pages, search; user chip opens settings
- Tasks kanban with priorities, overdue flags and book/page links;
calendar month view fed by task deadlines; time view with entries,
durations and totals; top-right live timer with optional book link
- User discovery autocomplete in the invite card; editor gains tables
and checklists; standalone theme buttons removed
- Schema: books, tasks (book/page links, status, priority, due_at),
time_entries (open entry = running timer), user profile columns
(avatar, locale, theme, bg_image, bg_blur)
- Books CRUD; pages can live in a book (book_id, validated same-workspace)
- Tasks CRUD with status filter and due_at range query for the calendar
- Time API: start (409 if running), stop (computes duration), list with
open timer, update, delete
- Users: fuzzy discovery for invites, PATCH /me profile/appearance,
password change; members list now includes avatars
- Admin API (is_admin guard): overview counts, user list, grant/revoke
admin, delete user (self-demote/delete blocked)
- Auth: register/login/me with bcrypt (12 rounds) and JWT bearer tokens
- Workspaces: CRUD, role-based members (owner/admin/member/viewer), invite by email
- Pages: nested hierarchy, TipTap JSON+HTML content, archive, search, comments
- Realtime: Socket.IO rooms per page with JWT handshake, live edits, presence, typing
- DB schema with triggers (owner membership, updated_at) and migrate script
- Helmet, CORS allow-list, rate limiting, /api/health with DB check
- Dockerfile (migrate-on-boot) for compose/production
x3