The embed section passed code through SafeHtmlContent which ran DOMPurify
with FORBID_TAGS including 'iframe', silently removing the element.
Replaced SafeHtmlContent with a new sanitizeEmbedHtml() that uses a
whitelist of ALLOWED_TAGS: ['iframe'] and restricts src to https: only,
so Google Forms, YouTube, and other https embeds render while javascript:
sources and non-iframe tags are still blocked.
* feat: add README for @cio/db package and remove existingAccounts.json
* load session, load profile and organization, add create profile hook
* chore: cache session request
The trick was passing all the cookies to the backend. Previously I was only passing the better-auth.session_token and not better-auth.session_data. Read about the difference here https://www.better-auth.com/docs/concepts/cookies#custom-cookies
* feat: login, logout, onboarding, verify email, reset password.
* feat: complete change email and email verification
* feat: standardise how we make rpc calls and create org endpoints
* fix ui errors
* fix: handle potential undefined customerId and standardize avatar URL property
* refactor: standardize custom domain handling and update telegram chat ID references
* chore: add tailwind prefix to @cio/ui
this fixed the media query issues because @cio/ui classes were overriding this dashboard tailwind build
* chore: clean up org sidebar
* chore: persist mode state
* feat: implement order breadcrumbs
* chore: upgrade to better auth 1.4
* chore: address common auth flow bugs and setup app for others to setup locally.
Rotimi Best