Security fixes: P0-P2 complete (22 fixes)

P0 (7): Auth-bypass removed, migrations fixed, plugin-upload disabled, RLS FORCE+WITH CHECK, plugin double-registration fixed, persistent volume, domain removed
P1 (11): User/tenant model, Redis centralized, worker separated, transactional outbox, XSS fixed, DMS chunked streaming, permissions unified, password reset, metrics secured, config/docs fixed, cross-tenant FK
P2 (4): Contact model normalized, cross-imports reduced 94%, commands+state machines for contacts/dms/mail/calendar, SPA path-traversal

8 new migrations, 99 unit tests, 13 commands, 8 contracts, 72 files changed

frontend/src/api/unifiedContacts.ts

@@ -36,7 +36,7 @@ export interface UnifiedContact {
   name?: string | null;
   firstname?: string | null;
   surname?: string | null;
-  surfix?: string | null;
+  suffix?: string | null;
   ext_name_line?: string | null;
   gender?: string | null;
   code?: string | null;

frontend/src/components/comm/blocks/ActionCardBlock.tsx

@@ -23,8 +23,15 @@ const ActionCardBlock: React.FC<ActionCardBlockProps> = ({ block }) => {
       // Frontend handles dismiss — no-op here, parent component can wire up
       return;
     }
-    // Treat as URL
-    window.open(action.action, '_blank', 'noopener,noreferrer');
+    // Validate URL — only allow http: and https: protocols to prevent javascript: URLs
+    const url = action.action;
+    try {
+      const parsed = new URL(url);
+      if (parsed.protocol !== 'http:' && parsed.protocol !== 'https:') return;
+    } catch {
+      return; // Invalid URL
+    }
+    window.open(url, '_blank', 'noopener,noreferrer');
   };
 
   return (

frontend/src/components/comm/blocks/HtmlBlock.tsx

@@ -1,30 +1,11 @@
 import React from 'react';
+import DOMPurify from 'dompurify';
 import type { MessageBlock } from '@/store/commStore';
 
 interface HtmlBlockProps {
   block: MessageBlock;
 }
 
-/**
- * Basic HTML sanitization: removes <script> tags and event handler attributes.
- * This is a minimal sanitizer — for production use DOMPurify or similar.
- */
-function sanitizeHtml(html: string): string {
-  let sanitized = html;
-  // Remove <script>...</script> blocks (including content)
-  sanitized = sanitized.replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '');
-  // Remove <script ...> self-referencing or incomplete tags
-  sanitized = sanitized.replace(/<script\b[^>]*>/gi, '');
-  // Remove on* event handler attributes (onclick, onload, onerror, etc.)
-  sanitized = sanitized.replace(/\son\w+\s*=\s*"[^"]*"/gi, '');
-  sanitized = sanitized.replace(/\son\w+\s*=\s*'[^']*'/gi, '');
-  sanitized = sanitized.replace(/\son\w+\s*=\s*[^\s>]+/gi, '');
-  // Remove javascript: URLs in href/src
-  sanitized = sanitized.replace(/(href|src)\s*=\s*"javascript:[^"]*"/gi, '$1="#"');
-  sanitized = sanitized.replace(/(href|src)\s*=\s*'javascript:[^']*'/gi, '$1="#"');
-  return sanitized;
-}
-
 const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
   const rawHtml: string = block.block_data.html || '';
 
@@ -32,7 +13,7 @@ const HtmlBlock: React.FC<HtmlBlockProps> = ({ block }) => {
     return null;
   }
 
-  const sanitized = sanitizeHtml(rawHtml);
+  const sanitized = DOMPurify.sanitize(rawHtml);
 
   return (
     <div

frontend/src/components/mail/SignatureManager.tsx

@@ -3,6 +3,7 @@
  * Supports placeholder variables for user/tenant data.
  */
 
+import DOMPurify from 'dompurify';
 import React, { useState, useEffect, useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useForm } from 'react-hook-form';
@@ -198,7 +199,7 @@ export function SignatureManager() {
                 <div className="flex-1">
                   <p className="font-medium text-secondary-900">{sig.name}</p>
                   {sig.is_default && <span className="text-xs text-primary-600">{t('mail.defaultSignature')}</span>}
-                  <p className="text-sm text-secondary-500 mt-1 truncate" dangerouslySetInnerHTML={{ __html: sig.body_html }} />
+                  <p className="text-sm text-secondary-500 mt-1 truncate" dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(sig.body_html) }} />
                 </div>
                 <div className="flex gap-2">
                   <Button variant="ghost" size="sm" onClick={() => handleEdit(sig)} data-testid={`edit-signature-${sig.id}`}>{t('common.edit')}</Button>