hamedandClaude Sonnet 4.6
59e0a0fe4f
Security: - Disable SSL verification only in development (lib/req.js) - Wrap all JSON.parse(cookie) calls in try-catch via safeJsonParse utility - Sanitize dangerouslySetInnerHTML in blog/clinic with sanitizeHtml utility - Fix open redirect in payment page — validate URL origin before redirect - Fix cookie cleanup on 401 — use js-cookie with correct domain scope Performance: - Wrap ItemDoctor with React.memo to prevent unnecessary re-renders - Replace <img> with Next.js <Image> in blog Caption component Functionality: - Fix memory leak in Recode.js — store intervals in refs, cleanup on unmount - Add null guard on retryIcon.current before classList manipulation - Fix getParsedUserInfo in helper to handle malformed cookie gracefully Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
22 lines
636 B
JavaScript
22 lines
636 B
JavaScript
import { AbilityBuilder, createMongoAbility } from "@casl/ability";
|
|
import { safeJsonParse } from "./sanitize";
|
|
|
|
export function defineAbilitiesFor(user) {
|
|
const { can, cannot, build } = new AbilityBuilder(createMongoAbility);
|
|
|
|
if (user) {
|
|
can("access", "Dashboard");
|
|
cannot("access", "Login");
|
|
const parsedData = safeJsonParse(user.value);
|
|
const roles = parsedData?.roles;
|
|
if (roles && Array.isArray(Object.values(roles)) && Object.values(roles).includes("representation")) {
|
|
can("access", "Panel");
|
|
}
|
|
} else {
|
|
can("access", "Login");
|
|
cannot("access", "Dashboard");
|
|
}
|
|
|
|
return build();
|
|
}
|