Lemin Kanban

A beautifully designed, production-quality Kanban board for personal task management. Built with Next.js 16, TypeScript, SQLite, and a warm paper-inspired aesthetic.

<img width="1793" height="971" alt="image" src="https://github.com/user-attachments/assets/bdcf17ab-f57f-41ed-90be-466bf8975875" />

What's New in v9.5.0 🎉

"The WIP Limits Update" - Set per-column Work in Progress limits with drag prevention, color-coded progress bars, and a clean inline editor. Columns enforce their limits on both drag-and-drop and button-based moves.

See the full Changelog below.

Features

Core Features

• Multiple Boards - Create, rename, and delete personal Kanban boards with cover images
• Board & Column Archive - Archive boards and columns instead of deleting them, restore anytime from the archive panel
• Board Ordering - Rearrange boards on the dashboard
• Board Filters - Filter and search boards
• Columns - Default Todo/Doing/Done columns with ability to add, rename, and delete
• Column Dragging - Reorder columns by dragging them directly
• Column Reordering - Move columns left/right with arrow buttons
• Collapsible Columns - Collapse columns to save space, auto-expand on drag
• Column Colors - 7 custom colors (Gray, Yellow, Green, Blue, Purple, Pink, Red)
• Cards - Full CRUD with title, description, labels, due dates, priorities, and checklists
• Card Priorities - 4 levels (Low, Medium, High, Critical) with color-coded indicators
• Custom Label Colors - Assign one of 10 colors to any label (Red, Orange, Amber, Green, Teal, Blue, Indigo, Purple, Pink, Gray), global per user across all boards
• Card Images - Upload up to 4 images per card (PNG, JPEG, WebP, GIF) with lightbox viewer and copy-to-clipboard
• Subtasks/Checklists - Add task checklists to cards with visual progress bars
• Drag & Drop - Move cards between columns with visual feedback
• WIP Limits - Set per-column Work in Progress limits with color-coded indicators (amber at limit, red over limit)
• Board Zoom - Zoom in/out with buttons, trackpad pinch, or touch gestures (50%-150%)
• UI Zoom - Adjust interface scale (80%-120%) with slider in Settings > Design
• Full Touch Support - Drag cards, pinch to zoom - works great on iPad and mobile
• Keyboard Accessible - Arrow buttons for moving cards without drag & drop, full keyboard shortcut support
• SSE Live Updates - Board changes appear instantly without page reload
• Auto-Reconnect - SSE connection recovers automatically on disconnect or tab switch
• Deploy Notification - Live countdown banner warns users before server restart, auto-reloads when back
• Board Export - Export boards as CSV or JSON for backup or analysis
• Board Import - Import boards from JSON backup files
• Keyboard Shortcuts - Navigate and manage boards with keyboard (press ? for help)
• Activity Log - Track the last 20 events per board
• Search & Filter - Find cards by title, description, or label

Security & Privacy 🔐

• Single-Session Enforcement - Only one active session per account, new logins kick old sessions
• Secure Authentication - Cookie-based sessions with bcrypt password hashing, double password confirmation on registration
• Token Fingerprinting - Session tokens never exposed to client-side JavaScript
• Login Activity Tracking - See who accessed your account and from where
• Failed Login Alerts - Get notified of suspicious login attempts
• Account Deletion - Self-service deletion with 30-day recovery period
• Privacy Policy - Full transparency about data handling
• Rate Limiting - Protection against brute-force attacks

Feedback 💬

• User Feedback - Send feedback directly from the app (up to 5 per user)
• Public Showcase - Admin-published feedback displayed on the landing page with star filters
• Auto-Translation - Feedback is auto-translated to English on publish (Google Translate)
• Admin Replies - Admin can respond to feedback from the admin panel
• Publish Toggle - Admin can publish/unpublish individual feedback from the dashboard
• Inbox Notifications - Users get inbox messages and popups when admin replies
• Admin Notifications - Admin gets inbox messages when new feedback arrives
• Privacy - Only first names shown publicly, never emails; account deletion removes showcase entries

Inbox & Notifications 📬

• Unified Inbox - All your notifications in one place
• Account Updates - Notifications for password, name, and email changes
• Security Alerts - Warnings for failed login attempts
• Feedback Replies - Notifications when admin responds to your feedback
• What's New - In-app release notes and changelog
• Unread Indicators - Visual badges with your accent color

Customization 🎨

• Dark Mode - Full dark theme support with warm tones
• 6 Accent Colors - Orange, Blue, Green, Purple, Rose Pink, Hot Pink
• Custom Label Colors - Long-press a label in the card modal to pick from 10 palette colors; adapts to Light/Dark mode automatically
• Simple Card Design - Option to hide move arrows and delete buttons
• Simple Column Mode - Option to hide column move arrows for cleaner look
• UI Zoom Slider - Scale interface from 80% to 120% for better readability
• Responsive - Works on mobile, tablet, and desktop

MCP Server 🤖

• OAuth 2.1 - Connect Claude Code or Claude.ai with browser-based login (no tokens to copy)
• Dynamic Client Registration - Clients register automatically per RFC 7591
• Token Refresh - Access tokens refresh automatically (1h access, 30d refresh)
• Connection Management - View, rename, and revoke OAuth connections in Settings
• Consent UI - Accept/deny interface for OAuth tool connections
• 24 Tools - Full CRUD for boards, columns, cards, subtasks, activities, label colors, and archive/restore
• Rate Limiting - API protection against too many requests
• Documentation - Setup guide with copy buttons at /docs/mcp

Settings ⚙️

• Account Tab - Update name, email, password (double confirmation) with always-visible save button
• Security Tab - View login history and manage account deletion
• Design Tab - Theme, accent color, and simple card design preferences
• AI Copilot Tab - OAuth connections and Claude integration setup
• Features Tab - Toggle experimental features (Coming soon)
• Credits Tab - Open source acknowledgments and support options (v8.5.0)
• Privacy Tab - Data handling information
• Feedback Tab - Send feedback directly to the admin (up to 5 messages)
• Report Bug Tab - Direct link to GitHub Issues

Tech Stack

• Framework: Next.js 16 (App Router, Turbopack)
• Language: TypeScript (end-to-end)
• Database: SQLite with Prisma ORM
• Styling: Tailwind CSS v4
• Auth: iron-session (cookie-based)
• MCP: mcp-handler + @modelcontextprotocol/sdk
• Drag & Drop: @dnd-kit
• Validation: Zod
• Testing: Vitest (unit) + Playwright (E2E)

Prerequisites

• Node.js 18+ (LTS recommended)
• npm 9+

Installation

# Clone the repository
git clone https://github.com/leminkozey/mini-kanban.git
cd mini-kanban

# Install dependencies
npm install

# Set up environment variables
cp .env.example .env
# Edit .env and set a secure SESSION_SECRET

# Run database migrations
npm run db:migrate

# Seed demo data (optional)
npm run db:seed

Running the App

# Development server
npm run dev

# Production build
npm run build
npm start

# Open http://localhost:3000

Updating

If you have an existing installation:

# 1. Stop the app

# 2. Backup your database!
cp prisma/dev.db prisma/dev.db.backup

# 3. Pull new code
git pull origin main

# 4. Install dependencies
npm install

# 5. Regenerate Prisma client
npx prisma generate

# 6. Apply database migrations (keeps your data)
npx prisma migrate deploy

# 7. Rebuild
npm run build

# 8. Start
npm start

Important Notes:

• The dev.db file contains all your data - never delete it during updates
• New database fields are added automatically with safe defaults
• Existing users will see a Privacy Policy update popup on first login

Migrating Data from Another Server

# On the OLD server:
cp prisma/dev.db /path/to/backup/dev.db

# Transfer to new server
scp prisma/dev.db user@newserver:/path/to/mini-kanban/prisma/

# On the NEW server:
npx prisma generate
npx prisma migrate deploy
npm run build
npm start

The dev.db file contains:

• All user accounts (emails, passwords, settings)
• All boards, columns, and cards
• Activity logs and notifications
• Login attempt history

Database Commands

npm run db:migrate   # Run migrations
npm run db:push      # Push schema changes (dev)
npm run db:seed      # Seed demo data
npm run db:studio    # Open Prisma Studio (GUI)

Testing

# Unit & Integration Tests
npm test
npm run test:watch

# End-to-End Tests
npm run test:e2e
npm run test:e2e:ui

Project Structure

mini-kanban/
├── prisma/
│   ├── schema.prisma      # Database schema
│   ├── seed.ts            # Demo data seeder
│   └── migrations/        # Database migrations
├── src/
│   ├── app/
│   │   ├── api/           # API route handlers
│   │   ├── board/         # Board view page
│   │   ├── dashboard/     # User dashboard
│   │   ├── login/         # Login page
│   │   ├── register/      # Register page
│   │   ├── privacy/       # Privacy policy page
│   │   ├── docs/mcp/      # MCP documentation page
│   │   └── page.tsx       # Landing page
│   ├── components/
│   │   ├── auth/          # Auth forms
│   │   ├── board/         # Kanban components
│   │   ├── settings/      # Settings modal
│   │   └── ui/            # Reusable UI components
│   ├── hooks/
│   │   ├── useBoardEvents.ts # SSE live update hook
│   │   └── useKeyboardShortcuts.ts # Keyboard shortcuts hook
│   └── lib/
│       ├── auth.ts        # Auth utilities
│       ├── db.ts          # Prisma client
│       ├── event-bus.ts   # SSE event emitter singleton
│       ├── session.ts     # Session config
│       ├── activity.ts    # Activity logging
│       ├── notifications.ts # Notification system
│       ├── privacy.ts     # Privacy policy versioning
│       ├── releases.ts    # Release notes
│       ├── translate.ts   # Google Translate helper
│       ├── label-colors.ts # Label color palette & helpers
│       └── validations.ts # Zod schemas
└── tests/

Demo Account

npm run db:seed

Creates a demo account:

• Email: [email protected]
• Password: demo123

To remove: sqlite3 prisma/dev.db "DELETE FROM User WHERE email = '[email protected]';"

API Endpoints

Auth

• POST /api/auth/register - Create account
• POST /api/auth/login - Login
• POST /api/auth/logout - Logout
• GET /api/auth/me - Get session status & token fingerprint
• POST /api/auth/claim-session - Claim session for current tab
• GET /api/auth/profile - Get current user
• PATCH /api/auth/profile - Update profile & settings
• POST /api/auth/accept-privacy - Accept privacy policy

Boards

• GET /api/boards - List user's boards
• POST /api/boards - Create board
• GET /api/boards/[id] - Get board with columns/cards
• PATCH /api/boards/[id] - Rename board
• DELETE /api/boards/[id] - Delete board
• POST /api/boards/[id]/archive - Archive board
• DELETE /api/boards/[id]/archive - Restore archived board
• GET /api/boards/[id]/archived-columns - List archived columns
• POST /api/columns/[id]/archive - Archive column
• DELETE /api/columns/[id]/archive - Restore archived column
• GET /api/boards/[id]/events - SSE stream for live board updates
• POST /api/deploy-notify - Trigger deploy restart notification
• GET /api/deploy-notify/events - SSE stream for deploy events
• GET /api/boards/[id]/export/csv - Export board as CSV
• GET /api/boards/[id]/export/json - Export board as JSON
• POST /api/boards/import - Import board from JSON

MCP

• POST /api/mcp - MCP endpoint (24 tools: boards, columns, cards, subtasks, activities, label colors, archive/restore)

OAuth 2.1

• GET /.well-known/oauth-protected-resource - Protected Resource Metadata (RFC 9728)
• GET /.well-known/oauth-authorization-server - Authorization Server Metadata (RFC 8414)
• POST /api/oauth/register - Dynamic Client Registration (RFC 7591)
• GET /api/oauth/authorize - Authorization endpoint (redirects to consent page)
• POST /api/oauth/authorize - Process consent (approve/deny)
• POST /api/oauth/token - Token exchange (auth code + refresh token)
• POST /api/oauth/revoke - Token revocation (RFC 7009)
• GET /api/auth/oauth-sessions - List active OAuth connections
• PATCH /api/auth/oauth-sessions - Rename OAuth connection
• DELETE /api/auth/oauth-sessions - Revoke OAuth connection

Card Images

• POST /api/cards/[cardId]/images - Upload image to card
• GET /api/cards/[cardId]/images - Get all images for a card
• DELETE /api/card-images/[id] - Delete an image

Feedback

• GET /api/feedback - Get user's feedback
• POST /api/feedback - Submit feedback (max 5 per user)
• GET /api/feedback/replies - Get replies to user's feedback
• GET /api/public/feedback - Get published feedback (no auth, cached)
• GET /api/admin/feedback - List all feedback (admin only)
• POST /api/admin/feedback/reply - Reply to feedback (admin only)
• PATCH /api/admin/feedback/publish - Publish/unpublish feedback (admin only)

Notifications

• GET /api/notifications - Get user notifications
• PATCH /api/notifications - Mark as read

Account

• POST /api/auth/delete-account - Request account deletion
• POST /api/auth/cancel-deletion - Cancel deletion request
• GET /api/auth/login-attempts - Get login history

Environment Variables

| Variable | Description | Default | |----------|-------------|---------| | DATABASE_URL | SQLite database path | file:./prisma/dev.db | | SESSION_SECRET | 32+ char secret for sessions | Required | | COOKIE_SECURE | Set to false for HTTP | true in production | | OAUTH_ISSUER_URL | Public URL for OAuth metadata | http://localhost:3000 | | DEPLOY_SECRET | Secret for deploy notification endpoint | — |

Generate a secure secret:

openssl rand -base64 32

Deploy Notification Banner

When you deploy a new version, the server can notify all connected users with a live countdown banner before the restart. Users see "Server restarting in X:XX" with a warning that unsaved changes may be lost. After the countdown, the page automatically reloads when the server is back.

How it works

1. Your CI/CD pipeline sends a POST request to /api/deploy-notify before restarting
2. The server broadcasts the restart timestamp to all connected clients via SSE
3. Clients show a centered banner with a 3-minute countdown
4. After the countdown, clients poll until the server responds and then auto-reload

Setup

1. Generate a deploy secret:

openssl rand -hex 32

2. Add to .env on the server:

DEPLOY_SECRET="your-generated-secret-here"

3. Add to your GitHub Actions deploy workflow (before the restart step):

- name: Notify connected users
  run: |
    curl -s -X POST https://your-domain.com/api/deploy-notify \
      -H "X-Deploy-Secret: ${{ secrets.DEPLOY_SECRET }}" || true

- name: Wait for countdown
  run: sleep 180

- name: Restart server
  run: # your restart command here

4. Add DEPLOY_SECRET to your GitHub repository secrets:

Go to Settings > Secrets and variables > Actions > New repository secret, name it DEPLOY_SECRET with the same value as in .env.

API

| Endpoint | Method | Description | |----------|--------|-------------| | /api/deploy-notify | POST | Trigger deploy notification (requires X-Deploy-Secret header) | | /api/deploy-notify/events | GET | SSE stream for deploy events (no auth, public) |

Testing locally

# 1. Set DEPLOY_SECRET in .env
echo 'DEPLOY_SECRET="test"' >> .env

# 2. Start dev server
npm run dev

# 3. Open browser at http://localhost:3000

# 4. Trigger notification
curl -X POST http://localhost:3000/api/deploy-notify -H "X-Deploy-Secret: test"

# 5. Banner appears with 3:00 countdown

Design Philosophy

The UI uses a warm, paper-inspired aesthetic with:

• Instrument Serif for headings (elegant, editorial)
• DM Sans for body text (clean, modern)
• Warm cream backgrounds with deep ink text
• Colorful column backgrounds (beige, yellow, green)
• 5 customizable accent colors
• Full dark mode with warm tones
• Subtle noise texture for depth
• Smooth animations for delight

Changelog

v9.5.0 - "The WIP Limits Update" (2026-02-23)

Features 🚀

• 📊 WIP Limits - Set per-column card limits to keep work in progress under control
  • Inline editor with the same pattern as "Add a card" for consistency
  • Color-coded progress bar below column header (green → amber → red)
• 🚫 Drag Prevention - Cards cannot be dragged into a full column
• 🚫 Move Button Prevention - Button-based card moves respect WIP limits with error toast
• 🖱️ Click Outside to Close - Clicking outside any open editor closes it

Technical Details 🔧

• src/components/board/KanbanColumn.tsx - WIP editor, progress bar, click-outside refs
• src/components/board/KanbanBoard.tsx - handleSetWipLimit with optimistic update, drag/move prevention
• src/app/api/columns/[columnId]/route.ts - PATCH handler supports wipLimit updates with activity logging
• src/lib/activity.ts - Added column.updated activity type
• src/lib/validations.ts - wipLimit validation (1-100, nullable)

---

v9.4.0 - "The Translation & DnD Fix Update" (2026-02-23)

Features 🚀

• 🌐 Translated Feedback Replies - Admin replies are auto-translated to English on the public landing page
  • Added replyEn field to Feedback model
  • Translation happens on publish, same as comments
• 👁️ Show Original Toggle - View the original untranslated text for any translated feedback
  • Toggle between "Original" and "Translated" on the landing page feedback cards
  • Shows original comment and/or reply when translations are available

Bug Fixes 🐛

• 🐛 DnD Card Position Fix - Cards now land exactly where you drop them
  • Replaced shift-based reordering with normalize approach (reassigns sequential 0, 1, 2, ...)
  • Fixes wrong positions caused by negative or non-sequential order values in DB
  • Cross-column moves also normalize the source column
• 🐛 DnD Column Position Fix - Columns no longer randomly reorder after dragging
  • Only operates on non-archived columns
  • Same normalize approach prevents order gaps
• 🐛 Archived Columns SSR Fix - Archived columns no longer reappear after page refresh
  • Added where: { archivedAt: null } filter to SSR board page query
• 🐛 Export Archived Fix - CSV and JSON exports now correctly exclude archived columns

Technical Details 🔧

• prisma/schema.prisma - Added replyEn String? to Feedback model
• src/app/api/admin/feedback/publish/route.ts - Translate reply on publish
• src/app/api/public/feedback/route.ts - Serve replyEn ?? reply + original fields
• src/app/api/feedback/route.ts - Admin notification strings translated to English
• src/components/landing/FeedbackShowcase.tsx - Show original toggle in FeedbackCard
• src/app/api/cards/[cardId]/move/route.ts - Rewritten with normalize approach
• src/app/api/columns/[columnId]/move/route.ts - Rewritten with normalize approach, archived filter
• src/app/board/[boardId]/page.tsx - Added archivedAt filter to SSR columns query
• src/app/api/boards/[boardId]/export/csv/route.ts - Added archivedAt filter
• src/app/api/boards/[boardId]/export/json/route.ts - Added archivedAt filter

---

v9.3.0 - "The Refinement Update" (2026-02-23)

Features 🚀

• 📦 Column & Board Archive - Archive instead of delete, restore anytime
  • Columns with cards: trash icon opens Delete/Archive/Cancel dialog
  • Empty columns: deleted instantly without dialog
  • Archive Panel in board toolbar shows all archived columns with restore button
  • Dashboard archive toggle to switch between active and archived boards
  • Archived boards show Restore + Delete buttons, no Create button
  • MCP get_board filters archived columns by default (includeArchived param available)
• 🚀 Deploy Notification Banner - Live countdown warns users before server restart
  • GitHub Actions POSTs to /api/deploy-notify before restart
  • All connected clients see centered 3-minute countdown via SSE
  • Auto-polls and reloads when server is back
• 🤖 4 New MCP Tools - archive_column, restore_column, archive_board, restore_board

Improvements ✨

• ✨ Smooth Toast Exit - Toasts fade out gracefully instead of vanishing
• 🔧 Settings Close Button - Repositioned outside modal to avoid scrollbar overlap
• 📋 Compact Admin Feedback - Table fits without horizontal scrolling
• 📋 Copy Card Images - Copy images to clipboard from thumbnail hover or lightbox view
• 🎯 Priority Selector Animation - Smooth sliding indicator on selection, color fill on hover
• 👁️ OAuth Deny Button - Proper button styling for better visibility
• 🎯 Toolbar Hover Colors - All toolbar icons consistently darken on hover
• 📬 Inbox Icon Hover - Now matches other toolbar button hover behavior
• 💾 Persist Dismissals - Announcement and inbox seen-releases synced to DB

Bug Fixes 🐛

• 🛡️ Session Stability - 3 consecutive 401s required before logout, network errors don't trigger logout
• 🐛 Board Delete Toast - No more false "deleted externally" after self-delete or archive
• 🐛 Archived Empty State - Shows "No archived boards yet" instead of create prompt
• 🐛 WhatsNew Scroll Lock - Background no longer scrolls when modal is open on landing page
• 🐛 FAQ Grid Expansion - Clicking one FAQ item no longer stretches the adjacent card

Security Fixes 🔒

• ⏱️ Deploy Secret - timingSafeEqual for deploy secret comparison
• 🔒 Settings Bypass - Server-managed keys stripped from client settings input

Technical Details 🔧

• prisma/schema.prisma - Added archivedAt DateTime? to Board and Column models
• src/app/api/columns/[columnId]/archive/route.ts - New: Archive/restore column endpoint
• src/app/api/boards/[boardId]/archive/route.ts - New: Archive/restore board endpoint
• src/app/api/boards/[boardId]/archived-columns/route.ts - New: List archived columns
• src/components/board/ArchivePanel.tsx - New: Slide-in panel for archived columns
• src/components/ui/ConfirmDialog.tsx - Extended with optional 3rd button (Cancel/Archive/Delete)
• src/app/api/deploy-notify/route.ts - New: Deploy notification trigger endpoint
• src/hooks/useDeployNotification.ts - New: SSE hook for deploy events
• src/components/ui/DeployBanner.tsx - New: Countdown banner component

---

v9.2.0 - "The Polish Update" (2026-02-22)

Improvements ✨

• 🎬 Smooth Modal Close - All modals now slide out gracefully instead of disappearing instantly
• 🌙 No More Theme Flash - Dark mode and accent color apply instantly on page load
• 💾 Settings Cache - Theme preferences cached in localStorage for zero-delay rendering

---

v9.0.0 - "The Power User Update" (2026-02-22)

Features 🚀

• 🎯 Card Priorities - 4 levels (Low, Medium, High, Critical) with color-coded indicators
  • Colored top bar and badge on each card
  • 5-segment selector in card modal (None/Low/Med/High/Crit)
  • Priority tracked in activity log
• 📤 Board Export - Export any board as CSV or JSON
  • CSV with sanitized fields (formula injection protection)
  • JSON backup with full board data (columns, cards, subtasks)
• 📥 Board Import - Restore boards from JSON backup files
  • Zod validation, per-column/card/subtask limits
  • Server-side body size check (5MB)
• ⌨️ Keyboard Shortcuts - Full keyboard navigation
  • Press ? for shortcuts help modal
  • N to create new board, 1-9 to open boards
  • Cmd/Ctrl+E to export, Cmd/Ctrl+I to import
• 🌐 Auto-Translate Feedback - Published feedback auto-translated to English via Google Translate
  • Detected language preserved, English originals left unchanged
  • Graceful fallback on errors (shows original text)

Security Fixes 🔒

• CSV Injection Prevention - Formula-triggering chars prefixed with ' in CSV export
• Nullish Coalescing - Fixed || to ?? for nullable priority fields
• Escape Key Race Condition - Shortcuts modal checked before other Escape handlers
• Body Size Validation - Import route validates Content-Length server-side
• Input Limits - Per-card subtask limit (100), per-column card limit (100) on import

Technical Details 🔧

• prisma/schema.prisma - Added priority String? to Card, commentEn String? to Feedback
• src/hooks/useKeyboardShortcuts.ts - New: Keyboard shortcut hook with input detection
• src/components/KeyboardShortcutsModal.tsx - New: Grouped shortcuts help modal
• src/lib/translate.ts - New: Google Translate helper (free API, no key needed)
• src/app/api/boards/[boardId]/export/csv/route.ts - New: CSV export endpoint
• src/app/api/boards/[boardId]/export/json/route.ts - New: JSON export endpoint
• src/app/api/boards/import/route.ts - New: Board import with validation
• src/lib/validations.ts - Added priority schema (Zod enum)

---

v8.8.0 - "The Feedback Showcase Update" (2026-02-22)

Features 🚀

• ⭐ Public Feedback Showcase - Admin-published feedback displayed on the landing page
  • Auto-scrolling carousel when more than 3 items, pauses on hover
  • Static grid layout for 1-3 items
  • Mobile: native horizontal scroll with snap points
• 🔍 Star Rating Filter - Pill-shaped filter buttons to filter showcase by star count
• 👁️ Admin Publish Toggle - Publish/unpublish individual feedback items from the admin dashboard
• 🗑️ Custom Delete Modal - Replaced browser confirm() with styled modal in Inbox (matches board delete popup)

Improvements ✨

• 📜 Privacy Policy Updated - New Section 8 (Feedback) with data handling details for the showcase
• 📝 Feedback Notice - Note in Settings > Feedback about potential public display
• 📢 Announcement Popup - Animated demo showing feedback submission flow

Technical Details 🔧

• prisma/schema.prisma - Added isPublished Boolean @default(false) with index to Feedback model
• src/app/api/public/feedback/route.ts - New: Public GET endpoint, no auth, 5min cache, first-name-only display
• src/app/api/admin/feedback/publish/route.ts - New: Admin PATCH to toggle isPublished
• src/components/landing/FeedbackShowcase.tsx - New: Client component with cards, carousel, star filter
• src/app/globals.css - New: @keyframes scrollCarousel and carousel CSS

---

v8.7.0 - "The Custom Label Colors Update" (2026-02-22)

Features 🚀

• 🎨 Custom Label Colors - Assign one of 10 palette colors to any label; colors are stored globally per user and apply across all boards
  • 10-color palette: Red, Orange, Amber, Green, Teal, Blue, Indigo, Purple, Pink, Gray
  • Each color has distinct Light and Dark mode variants (background, text, border)
  • New labels get a random color assigned automatically (never Red)
• 📱 Inline Color Picker - Long-press (500 ms) on a label pill in the Card Modal opens a color picker inline
  • Quick tap removes the label from the card (unchanged behavior)
  • Scale animation (press feedback) on pointer-down
  • Clicking outside the picker closes it without changes
• 🔄 Dynamic Label Rendering - Labels across cards, filter chips, and suggestion pills all render with their assigned palette color via getLabelStyle()
• 🤖 3 New MCP Tools - Label colors are now fully manageable via the MCP API:
  • get_label_colors - Returns all label-color assignments and the available palette
  • set_label_color - Assigns a palette color to a label (case-insensitive, global)
  • remove_label_color - Removes a custom color assignment, reverting the label to gray

Technical Details 🔧

• src/lib/label-colors.ts - New: LABEL_COLOR_PALETTE, getLabelStyle(), getRandomLabelColor(), isValidLabelColorKey()
• prisma/schema.prisma - New labelColors String? field on User model
• src/app/api/auth/profile/route.ts - GET + PATCH now handle labelColors with merge pattern and palette whitelist
• src/components/board/BoardHeader.tsx - Sets data-label-colors attribute on documentElement
• src/components/board/KanbanBoard.tsx - Central isDark + labelColors state with MutationObserver; auto-assigns random colors to new labels
• src/components/board/KanbanColumn.tsx - Forwards labelColors + isDark props down to cards
• src/components/board/KanbanCard.tsx - Replaced hardcoded CSS label classes with dynamic inline styles via getLabelStyle()
• src/components/board/CardModal.tsx - Long-press color picker with longPressTimer, pressedLabel state, and colorPickerRef

---

v8.6.0 - "The Zoom Persistence Update" (2026-02-22)

Features 🚀

• 💾 Zoom Persistence - Board zoom is saved globally per user and persists after page reload
• 🔧 Reset Button Left - Reset button appears on the left so zoom button positions stay stable
• 🎨 Hot Pink Accent - New accent color as 6th option in Settings
• 🗑️ Inbox Delete - Delete individual or all messages in the inbox
• 🏷️ Label Autocomplete - Existing labels as colored clickable tags, tag input with inline pills and backspace delete

Bug Fixes 🐛

• 🛡️ Settings Merge Fix - Settings are now merged server-side instead of overwritten
• 🔒 Settings Whitelist - Only known keys (theme, accentColor, copilotEnabled, simpleCardDesign, uiZoom, boardZoom) are stored
• 🔄 Zoom Feedback Loop Fix - MutationObserver checks if value actually changed before setting zoomSourceRef
• 🐛 Stale State in Inbox Delete - deleteNotification now reads the current state instead of closure value
• 🐛 Duplicate Labels Prevented - Same labels can no longer be added multiple times (case-insensitive)
• 🗑️ Delete-All Confirm - "Delete all" in inbox now requires confirmation
• 🧹 Dead Code - Unused labelContainerRef removed
• 🧹 Timeout Cleanup - Zoom-save timeout is properly cleaned up on unmount

---

v8.5.0 - "The Feedback & Polish Update" (2026-02-20)

Major Features 🚀

• 💬 Feedback-System - Users can send up to 5 feedback messages directly from Settings
  • Admin receives inbox notifications for new feedback
  • Admin can reply to feedback from the admin panel
  • Users receive inbox messages and popups when admin replies
• 🤖 OAuth replaces API Tokens - MCP connection simplified, legacy token management removed
• ✅ OAuth Consent UI - Full accept/deny interface for OAuth tool connections

Improvements ✨

• 🖼️ Larger Card Images - Images on cards are now displayed larger for better visibility
• 🔐 Password Confirmation - Double password input on registration for safety
• 🎨 Activity Button - Unified button design, consistent with all other buttons
• 🛡️ Admin Panel - Improved admin dashboard with feedback management

Technical Details 🔧

• src/app/api/feedback/route.ts - Feedback submission endpoint (5 per user limit)
• src/app/api/feedback/replies/route.ts - Fetch feedback replies
• src/app/api/admin/feedback/route.ts - Admin feedback listing
• src/app/api/admin/feedback/reply/route.ts - Admin reply endpoint

---

v8.0.0 - "The Claude Integration Update" (2026-02-20)

Major Features 🚀

• 🤖 OAuth 2.1 - Full OAuth 2.1 Authorization Server built into the app
  • PKCE S256 mandatory for all clients
  • Dynamic Client Registration (RFC 7591)
  • Token rotation with replay detection
  • Browser-based consent flow — no manual token copying
• 🌐 Claude.ai Support - Connect via Claude.ai's MCP connector (HTTPS redirect URIs)
• 🔗 Connection Management - View, rename, and revoke OAuth connections in Settings
• 📖 Updated Documentation - Setup guide with copy buttons for easy setup
• 📢 Announcement Popup - New users see the Claude integration announcement

Improvements ✨

• AI Copilot Tab - Redesigned Settings tab with OAuth connections, collapsible API tokens section
• Code Blocks - Copy buttons on all code examples in documentation

Technical Details 🔧

• src/lib/oauth.ts - Core OAuth logic (PKCE, token lifecycle, client registration)
• src/app/oauth/authorize/page.tsx - Consent page with success/deny animations
• src/app/api/oauth/ - Authorization, token, registration, and revocation endpoints
• src/app/.well-known/ - OAuth metadata endpoints (RFC 8414, RFC 9728)
• prisma/schema.prisma - OAuthClient, OAuthAuthorizationCode, OAuthAccessToken, OAuthRefreshToken models

---

v7.0.0 - "The Card Images Update" (2026-02-19)

Major Features 🚀

• 🖼️ Card Images - Upload up to 4 images per card
  • Supports PNG, JPEG, WebP, and GIF formats
  • Smart grid layout on cards (1-4 images with adaptive layouts)
  • Click to open fullscreen lightbox with smooth animations
  • Delete images directly from the card modal
• 🛡️ Secure Image Uploads - Multi-layer validation
  • Magic byte verification (checks actual file headers, not just MIME type)
  • Format whitelist (only real image formats accepted)
  • 2MB client-side + 3MB server-side size limits
  • Base64 data URI storage (no file system attack surface)

Technical Details 🔧

• src/components/board/ImageLightbox.tsx - Fullscreen image viewer with ESC/click-outside close
• src/app/api/cards/[cardId]/images/route.ts - Image upload and retrieval endpoints
• src/app/api/card-images/[id]/route.ts - Image deletion with TOCTOU protection
• prisma/schema.prisma - CardImage model with cascade delete

---

v6.1.0 - "The Live Sync Update" (2026-02-16)

Major Features 🚀

• 🔴 SSE Live Updates - Board changes appear instantly without page reload
  • Server-Sent Events endpoint at /api/boards/[id]/events
  • EventEmitter-based event bus for real-time board change propagation
  • Changes via MCP, API, or other tabs are reflected immediately
• 🔄 Auto-Reconnect - SSE connection recovers automatically
  • Exponential backoff on disconnect
  • Reconnects when tab becomes visible again
  • Heartbeat to keep connection alive

Improvements ✨

• 🛡️ Rate Limiting - API protection against too many rapid requests
• 🤖 MCP Full Test - All 17 MCP tools verified (create, update, move, delete)

Technical Details 🔧

• src/lib/event-bus.ts - EventEmitter singleton for board update events
• src/hooks/useBoardEvents.ts - Client hook with EventSource, backoff, and visibility-reconnect
• src/app/api/boards/[boardId]/events/route.ts - SSE endpoint with auth and heartbeat

---

v6.0.0 - "The MCP & Board Management Update" (2026-02-15)

Major Features 🚀

• 🤖 MCP Server - Built-in Model Context Protocol endpoint at /api/mcp
  • Connect Claude Code, Claude Desktop, or any MCP-compatible AI tool
  • 17 tools for managing boards, columns, cards, subtasks, and activities
  • Full setup guide and documentation at /docs/mcp
• 🔑 API Token Management - New API tab in Settings
  • Create and manage up to 5 API tokens per account
  • Bearer token authentication (lk_ prefix)
  • Revoke tokens instantly
• 🖼️ Board Images - Add cover images to boards for visual organization
• 📌 Board Ordering - Rearrange boards on the dashboard by dragging or reordering
• 🔍 Board Filters - Filter and search boards on the dashboard

Documentation 📖

• MCP Setup Guide - Full documentation page with setup instructions for Claude Code and Claude Desktop
• Tool Reference - Complete list of all 17 MCP tools with descriptions
• Security Notes - Token handling best practices

---

v5.5.0 - "The Polish & Features Update" (2026-02-04)

Major Features 🚀

• ✅ Subtasks/Checklists - Add checklists to cards with:
  • Visual progress bar showing completion percentage
  • Check/uncheck items with single click
  • Add new items with input field
  • Clean, integrated UI within card modal
• ↔️ Column Dragging - Reorder columns by dragging them directly (in addition to arrow buttons)
• 🔍 UI Zoom - New zoom slider in Settings > Design (80%-120%)
  • Scale the entire interface for better readability
  • Works with touch on mobile/iPad
  • Larger touch targets for mobile usability
• 🎯 Simple Column Mode - Hide column move arrows for a cleaner, minimal look
• 👥 Last Active in Admin Dashboard - Admin panel now shows when each user was last active

Improvements ✨

• ⬇️ Landing Page Auto-Scroll - Clicking the arrow on landing page automatically scrolls down
• 📱 Touch Support for UI Zoom - Slider works perfectly with touch input
• 🎯 Larger Touch Targets - Improved mobile usability across the UI
• 📐 Modal Sizing - CardModal now matches SettingsModal dimensions (600x480px)

Bug Fixes 🐛

• Delete Modal Close - Edit Card modal now properly closes when deleting a card
• Green Border on Checklist - Removed unwanted green outline on checklist input fields
• Add Button Visibility - Add button now disappears correctly after adding checklist item
• Modal Layout - Fixed modal sizing inconsistencies

Security Improvements 🔒

• Various security enhancements and code hardening

---

v5.0.0 - "The Admin Update" (2026-02-03)

Major Features 🚀

• 🔐 Admin Dashboard - Secure admin panel with:
  • Platform statistics (users, boards, cards, online count)
  • User management with online status indicators
  • User deletion with cryptographic signature verification
• 🔑 Asymmetric Encryption - Ed25519 key-based admin authentication
  • Public key stored on server, private key kept secret
  • Challenge/response signature verification for sensitive actions
  • 5-minute challenge expiry for security
• 👥 Online Status Tracking - See who's currently active (5-minute threshold)

Security Improvements 🔒

• Admin Role System - Database-level role field (user/admin)
• Signature Verification - Admin actions require cryptographic proof
• Session Guard Improvements - Fixed redirect loops when users are deleted
• DB Verification - getCurrentUser() and requireAuth() now verify user exists in database

Bug Fixes 🐛

• Drag & Drop Position - Fixed card floating far from cursor (zoom transform issue)
• Settings Accent Ring - Fixed accent color selection ring being cut off
• Redirect Loop - Fixed infinite redirect when user account is deleted while active
• Settings Scrollbar - Removed unnecessary scrollbar in Design tab

Privacy & Documentation 📋

• Privacy Policy Updated - Added sections for online status tracking and admin access
• Admin Setup Guide - Instructions for Ed25519 key generation in .env.example

---

v4.0.0 - "The Big Update" (2026-02-02)

Rebranding 🎨

• New Name - Mini Kanban is now Lemin Kanban
• New Landing Page - Completely redesigned with floating cards, interactive feature demos, and animated FAQ

Major Features 🚀

• 🔍 Board Zoom - Zoom in/out (50%-150%) with:
  • Zoom buttons in toolbar
  • Trackpad pinch gestures
  • Touch pinch-to-zoom on iPad/mobile
• 📱 Full Touch Support - Drag cards, pinch to zoom - works great on iPad and mobile devices
• 🎯 Simple Card Design - New setting to hide move arrows and delete buttons for a cleaner look

Improvements ✨

• 🌙 Dark Mode Stabilized - More consistent colors and better contrast
• 🎨 New Color Picker Icon - Updated column color tool design
• 📐 Mobile Viewport Fix - Better handling of browser chrome on mobile (dvh)

Bug Fixes 🐛

• Card Position Fix - Cards now drop exactly where you release them (same-column reordering)
• Touch Pinch Zoom - Fixed zoom gesture interruption when lifting one finger
• Color Mode Drag Block - Drag is now properly disabled when in color mode
• Wheel Zoom Throttling - Added throttling to prevent performance issues

Removed 🗑️

• Glow Effects - Removed from settings for a cleaner, simpler design

---

v3.3.0 - "The Security & UX Update" (2026-02-02)

Major Features 🚀

• 🔐 Single-Session Enforcement - Only one active session per account allowed
  • New logins automatically kick previous sessions
  • Popup notification when kicked with "Reconnect" or "Logout" options
  • Token fingerprinting for secure session comparison
• ✅ Custom Confirm Dialogs - Replaced browser confirm() with styled modals
  • Board deletion confirmation
  • Card deletion confirmation
  • Consistent design with the app

Security Improvements 🔒

• Token Fingerprinting - Session tokens are never exposed to client, only SHA-256 fingerprints
• Timing Attack Protection - Login response time is constant whether user exists or not
• IP Validation - Basic validation for rate-limiting IP extraction
• Improved Warnings - Better documentation for production deployment (rate-limit, IP spoofing)

Bug Fixes 🐛

• Fixed unused imports in session management
• Fixed redundant session cleanup in logout
• Added explicit cookie path configuration

API Changes

• GET /api/auth/me - Now returns tokenFingerprint instead of raw sessionToken
• POST /api/auth/claim-session - New endpoint for claiming session (kicks other tabs)
• Login/Register responses now include tokenFingerprint

---

v3.1.0 - "The Column Power Update" (2026-02-01)

Major Features 🚀

• ↔️ Column Reordering - Move columns left/right with dedicated arrow buttons
• 📁 Collapsible Columns - Collapse columns to save space, remembers state per column
• 🎨 Column Color Mode - Paint bucket tool with 7 colors (Gray, Yellow, Green, Blue, Purple, Pink, Red)
• 📏 Independent Column Heights - Each column remembers its collapsed height

Bug Fixes 🐛

• Card Position Reset - Fixed cards resetting position when renaming columns
• Rapid Card Movement Crash - Fixed client crash when moving cards too quickly
• Drag State Consistency - Improved drag & drop reliability

Technical Improvements 🔧

• API Validation - Added bounds checking for column move operations
• Optimistic Updates - Better revert handling on API errors
• localStorage Persistence - Column colors and collapsed states persist across sessions

---

v2.0.0 - "The Security & Communication Update" (2026-02-01)

Major Features 🚀

• 📬 Inbox System - Unified notification center with Account Updates and What's New tabs
• 🔐 Account Security - Login tracking, failed attempt alerts, device/location info
• 🗑️ Account Deletion - Self-service with 30-day recovery grace period
• 📋 Privacy Policy - Full transparency page with update popup for existing users
• 🐛 Report Bug - Direct link to GitHub Issues in settings
• 📰 What's New - In-app release notes with unread indicators

Medium Features ✨

• ⚙️ Policy Tab - Privacy information in settings
• 🔑 Password Visibility - Toggle to show/hide password in forms
• 💝 Support Card - "Support this project" in Credits tab
• 💾 Always-visible Save - Account settings save button stays visible while scrolling
• 🔐 Login Fixes - Improved error handling and user feedback

Small Improvements 🔧

• 👤 Profile Dropdown Arrow - Better UX indicator
• 📜 Open Source Credits - Acknowledgments in Credits tab
• 🚪 Logout Redirect - Now redirects to home page
• 📜 Scrollbar Fix - Fixed scrolling in Account settings
• 🏷️ Label Contrast - Improved label visibility in light mode

Security Fixes 🔒

• Notification Ownership - Users can only access their own notifications
• Rate Limiting - Enhanced protection on auth endpoints
• Session Validation - Improved authentication checks

v1.0.0 - Initial Release (2026-01-15)

• Launch of Mini Kanban
• Boards, columns, and cards
• Drag & drop functionality
• Dark mode and accent colors
• User authentication

License

MIT © 2026 leminkozey

Note: Commercial use of this software requires explicit permission from the author. Personal use and self-hosting are welcome. If you'd like to use this commercially, please reach out via GitHub.

Author

Made with ❤️ by @leminkozey