- Implemented BlogBodySanitizer to clean HTML content before saving articles, ensuring security against XSS attacks.
- Added tests for BlogBodySanitizer to verify that unsafe tags and attributes are stripped from the content.
- Introduced ApiLeastPrivilegeTest to ensure that unauthorized users cannot access sensitive API routes, maintaining strict access control.
Rebuild admin Topbar to match clinic-pro-tauri header:
- Icon order: theme -> settings -> bell (was theme -> bell -> settings)
- Settings gear now navigates to the role-based settings page
instead of opening the personalization panel
- Search placeholder changed to «جستجو», dropped the ⌘K hint
- Add ProfileMenu: avatar + user name + context/role subtitle + caret,
with a dropdown (profile / payments / settings / personalization / logout).
Links are role-aware; personalization keeps the existing settings panel.
Frontend-only, no API changes. Adds ProfileMenu.test + Topbar.test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
hamed