feat: enhance security by implementing HttpOnly refresh tokens and in-memory access token management

- Added isomorphic-dompurify for improved XSS protection
- Refactored token storage to use in-memory management for access tokens
- Implemented server-side route handlers for OAuth token management
- Introduced security headers in next.config.js
- Removed client-side exposure of client_secret and sensitive tokens
- Updated API interceptors to handle token refresh logic
- Cleaned up cookie management for refresh tokens

lib/sanitize.js

@@ -1,19 +1,17 @@
-const DANGEROUS_TAGS = ['script', 'iframe', 'object', 'embed', 'link', 'meta', 'base', 'form'];
+import DOMPurify from "isomorphic-dompurify";
 
 export function sanitizeHtml(html) {
-  if (!html || typeof html !== 'string') return '';
+  if (!html || typeof html !== "string") return "";
 
-  let sanitized = html;
-
-  DANGEROUS_TAGS.forEach((tag) => {
-    const openClose = new RegExp(`<${tag}[\\s\\S]*?(?:<\\/${tag}>|/?>)`, 'gi');
-    sanitized = sanitized.replace(openClose, '');
+  return DOMPurify.sanitize(html, {
+    ALLOWED_TAGS: [
+      "p", "br", "strong", "em", "b", "i", "u", "ul", "ol", "li", "a",
+      "h2", "h3", "h4", "h5", "blockquote", "img", "span", "div",
+      "table", "thead", "tbody", "tr", "td", "th",
+    ],
+    ALLOWED_ATTR: ["href", "target", "rel", "src", "alt", "title"],
+    ALLOW_DATA_ATTR: false,
   });
-
-  sanitized = sanitized.replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]*)/gi, '');
-  sanitized = sanitized.replace(/(?:javascript|vbscript):/gi, '');
-
-  return sanitized;
 }
 
 export function safeJsonParse(str, fallback = null) {