Hartmut 1833182e90 fix(security): harden input validation schemas and fix SSR sanitize bypass ...

- blueprint rolePresets: cap array at 100 items to prevent storage abuse
- notification CreateManagedNotification: add .max() on title (500),
  body (2000), type (100), entityType/entityId (200), link (1000),
  taskAction (200)
- settings: add .max() on all string config fields; add regex allowlist
  (/^[a-zA-Z0-9._-]+$/) on model name fields (geminiModel,
  azureDalleDeployment, azureOpenAiDeployment) to prevent path manipulation
- sanitizeHtml: fix SSR bypass — server-side branch now strips HTML tags
  instead of returning the raw string unchanged

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-09 21:38:16 +02:00

..

e2e

test(e2e): add Playwright tests for core workflows

2026-04-09 19:30:43 +02:00

public

feat: user invite flow, deactivate/delete, favicon, dashboard loading fix, admin full-width

2026-04-02 20:19:26 +02:00

src

fix(security): harden input validation schemas and fix SSR sanitize bypass

2026-04-09 21:38:16 +02:00

.gitignore

test(e2e): fix dev-system test suite — storageState + strict-mode + signout

2026-04-01 19:09:49 +02:00

next-env.d.ts

feat(platform): checkpoint current implementation state

2026-04-01 07:42:03 +02:00

next.config.ts

feat(web): add error boundaries, loading skeletons, render fixes and tree-shaking

2026-04-09 08:35:28 +02:00

package.json

feat(timeline): add pulse animation for in-flight drag mutations

2026-04-09 13:28:46 +02:00

playwright.ci.config.ts

ci(e2e): add Playwright smoke tests to deploy-test workflow

2026-04-02 23:25:12 +02:00

playwright.config.ts

feat(planning): ship holiday-aware planning and assistant upgrades

2026-03-28 22:49:28 +01:00

playwright.dev.config.ts

test(e2e): fix dev-system test suite — storageState + strict-mode + signout

2026-04-01 19:09:49 +02:00

postcss.config.js

chore(repo): initialize planarchy workspace

2026-03-14 14:31:09 +01:00

sentry.client.config.ts

feat: integrate Sentry error tracking

2026-03-22 18:38:27 +01:00

sentry.edge.config.ts

feat: integrate Sentry error tracking

2026-03-22 18:38:27 +01:00

sentry.server.config.ts

feat: integrate Sentry error tracking

2026-03-22 18:38:27 +01:00

tailwind.config.ts

fix: add missing brand-950 to Tailwind config

2026-03-22 20:39:08 +01:00

tsconfig.json

feat(planning): ship holiday-aware planning and assistant upgrades

2026-03-28 22:49:28 +01:00

tsconfig.typecheck.json

feat(platform): checkpoint current implementation state

2026-04-01 07:42:03 +02:00

typecheck-env.d.ts

feat(platform): checkpoint current implementation state

2026-04-01 07:42:03 +02:00

vitest.config.mts

feat(platform): checkpoint current implementation state

2026-04-01 07:42:03 +02:00