Information zum Kontoabgleich und zur Namensänderung

[bmueller]

[New adapter] Kanban board

Current release: 0.3.2. What changed since 0.3.0 is at the bottom under "New in 0.3.2".

A Kanban board as a dedicated ioBroker adapter. What I wanted was shared task management that feels like a normal Kanban board, but tied into the smart home. It brings its own web server, serves a single-page app with no framework, and keeps every open view in sync over a WebSocket. Every event lands in a state that scripts and Node-RED can read, and the board embeds into Lovelace as a webpage card.

Features

• Own web server (default port 8095). The UI comes straight from the adapter, so a UI update needs no iobroker upload
• Multiple boards with freely configurable columns (name, order, display limit, WIP limit, the "new" and "done" flags)
• Cards with title, Markdown description, assignees, due date (optionally with a time of day), labels, colour, priority, checklist, link, location and calendar invite
• Recurring tasks: daily, weekly, monthly, yearly, nth weekday, nth working day including public-holiday calculation, plus free cron expressions
• Trash per board: deleted cards stay restorable for 30 days, and old done cards can move there automatically
• Per-column sorting in five modes with a direction toggle, or keep ordering by hand with drag and drop
• Drag and drop with mouse and touch, live sync over WebSocket to every open view
• Multiple users without a login: the user list lives in the instance settings, and each board decides who is assignable. The chips in the header double as a person filter that is remembered per board
• E-mail notifications through the email adapter on assignment, due date and card events, switchable per event and per user, with a calendar invite attached
• Eleven languages (de, en, fr, nl, it, es, pl, pt, ru, uk, zh-cn), plus a per-instance date and time format, light/dark/auto theme, accent colour and custom CSS

Integration

• REST API for everything the UI can do. Reading is open on the LAN, writing needs a token
• Inbound webhooks with a separate token per integration, restrictable to individual boards
• Outbound webhooks: a JSON POST to any URL on every event
• sendTo and the action state for ioBroker scripts, using the same command vocabulary
• Mirror states per board and per user (card count, overdue cards, last event) for dashboards and script triggers
• iframe friendly, with ?embed=1 for Lovelace webpage cards

Other services such as Telegram or Pushover are deliberately not hard-wired. Every event is written to the state kanban.0.lastEvent and, if configured, sent as an outbound webhook, so a short script can route it anywhere. A ready-to-copy Telegram example is in the docs, and Pushover, Pushbullet or WhatsApp need nothing but a different send line.

Mobile

On narrow screens the board stacks the columns, and each one folds away like an accordion. Dialogs open full screen with a fixed action bar. To move a card, press and hold it; while dragging, a row of target columns appears along the top.

Requirements and installation

You need js-controller 6.0.11 or newer and Node.js 22 or newer. For e-mail notifications you also need a configured email instance, and for region-accurate public holidays the optional feiertage adapter.

The adapter is not in the official ioBroker repository yet, inclusion is in progress. Until then install it through Adapters, install from own URL:

https://github.com/bmueller77/ioBroker.kanban

Then create an instance, check the port under Instances and open http://<host>:8095/.

Worth knowing before you start

The board works without a login. Anyone who can reach the port can read and edit. Writing through the API is token protected, which stops other websites and naive scanners, but it is no substitute for network isolation: a device on the same network that loads the page can read the token along with it. The adapter is built for a LAN. If you want it reachable from outside, bind the port to the LAN only and put an authenticating reverse proxy in front.

New in 0.3.2

Most of it comes from the German thread, thanks to @muuulle for the detailed feedback there. Five of the points raised are in.

Due date colours, now in four steps. Red means the moment has passed, orange due today, yellow due tomorrow, neutral later, green done.

Two differently computed questions sit behind that. The lead-time window (yellow) is planning and counts in calendar days: yellow is exactly the next calendar day. Not a rolling 24-hour window, "tomorrow" stays tomorrow all day. The setting Remind X days before due governs only how early the reminder mail goes out; it does not affect the colours on the board.

Card overdue: when the card carries a time of day, 17:00 for instance, it is overdue at 17:01, and that is exactly when the cardDue event fires. Without a time, the colour changes at midnight.

Counts in the column header. Next to the column title sits not only the card count but, on request, also the number of cards in that column that are due tomorrow, due today or already overdue. Clicking the number opens the picker; the choice is stored per column and per device. That way a collapsed column still tells you what is coming.

The card editor is reorganised. The two required fields come first: title, and directly below it assignees. Everything else sits in collapsible sections - description, labels and colour, link, location, recurrence, checklist. The right-hand end of each section header says what is inside: an excerpt of the description, the chosen labels with a colour marker, the location, the recurrence pattern, the state of the checklist. Which sections are open is remembered per device and applies to the next new card as well.

User IDs stay stable. The ID is locked as soon as a card or an avatar image hangs on it - it used to be renameable, which left the cards pointing nowhere. Where that already happened, there is a repair under Settings, Users, Orphaned assignees: it lists every orphaned ID with its card count and the boards involved, and moves it over to an existing person, avatar picture and board memberships included.

The states overdueCount and overdueList went stale when a card became overdue purely because the date rolled over. They hang on the minute tick now and follow the same rule as the red colouring.

New recurrence kind: every X days (after the previous one is done). The two X days kinds look alike and count differently. "Every X days" keeps a fixed grid from the start date: a card due every 30 days that is finished ten days late has its next date on the next grid point, so in 20 days. The new kind counts from the completion of the preceding card, which would be a full 30 days.

Also in: the trash has the same sort toggle as every other column. A card can no longer be created directly in a done column - that used to work, and the card then carried no completion timestamp: it dropped out of the age-in-column sort, out of the display limit for done cards and out of the automatic cleanup, and stayed there forever. Moving and editing are unchanged. Deleting a card with a calendar invite now sends a cancellation instead of leaving the appointment standing. Keyboard operation works throughout, hit areas are on 24 px, contrasts checked against WCAG. Fresh instances no longer ship with example users.

Plus around seventy further fixes from eight rounds of testing. The full changelog is in the README of the repository, including the history of older versions.

Security, please read

Two holes that affect everyone who uses the API:

The write token was readable by any website. Access-Control-Allow-Origin: * sat on every route, including the page that hands the token to the UI. Any website you had open could scan the network for the adapter in the background, read that page, take the token and then change or delete cards and boards. CORS is now limited to /api and /webhook, and only to origins you list, with an empty default. Only browser access was ever affected, since scripts and curl never went through that check.

A board-restricted token could escape its boards. On /api the restriction was not checked at all, and on the command route any allowed board named somewhere in the body counted as proof. What counts now is the board the call actually touches.

Also: a token row left blank used to match every request that carried no token, and an empty "allowed boards" field counted as "all" instead of "none". Both are fixed. Tokens are no longer accepted as a URL parameter, and the internal SPA secret lives in the adapter's file storage instead of a readable state.

Important for existing automations

The API no longer quietly straightens out bad input. An unknown columnId used to land in the first column, an invalid due was dropped, and getBoard on an unknown board answered with 200 and null. All three now return an error.

Fixed since 0.2.1

• on tablets, cards could not be dragged into another column.
• cards landed in the wrong place when dragged while a filter or a display limit was active.
• After switching boards, the views dialog kept offering the users of the previous board.
• A board refresh could pull you back to the board you had just left.
• A recurrence did not pass time of day, location and the calendar flag on to the follow-up card.
• A board whose member list pointed nowhere after renaming user IDs became unusable.
• Ticking a checklist item scrolled the board back to the top. Live sync now reconnects reliably after an adapter restart.

---

Feedback and requests are welcome in this thread. The full documentation is in the repository under docs/en/README.md, and the complete changelog is in the README.

[bmueller]

Version 0.3.2 is out.

The focus was the feedback from the German thread: due date colours in four steps, switchable counts in the column header, a reorganised card editor with the required fields at the top and everything else in collapsible sections, and user IDs that stay stable, with a repair for the assignees that were already orphaned.

What is in it is listed in the first post under "New in 0.3.2".