@autobusal/utilities 1.1.1 → 1.2.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to this package are documented here. This project follows [Keep a Changelog](https://keepachangelog.com/) and [Semantic Versioning](https://semver.org/).
 
+## [1.2.0] - 2026-07-25
+
+### Added
+
+- `GetChannelStatus(t)`: shared disabled/dedicated/main select values for
+  the Telegram and WhatsApp admin settings tabs (and any future per-label
+  messaging channel).
+
+## [1.1.2] - 2026-07-24
+
+### Added
+
+- New `sanitizeHtml(html)` helper (wraps DOMPurify) for sanitizing admin-authored CMS content (pages, articles, notifications, policies, affiliate terms, document previews) before rendering via `dangerouslySetInnerHTML`. Added `dompurify` as a dependency.
+
 ## [1.1.1] - 2026-07-19
 
 ### Added

package/index.ts

@@ -3,11 +3,13 @@ import { Validate, Display } from './form';
 import { error, notify, success } from './notify';
 import { getAllowed, getLanguages, getPayments } from './options';
 import { getSex, getOptionsSex } from './passengers';
-import { GetStatus, GetEnvironment, DisplayStatus } from './users';
+import { GetStatus, GetEnvironment, GetChannelStatus, DisplayStatus } from './users';
 import { getRandomNumber } from './numbers';
 import { getParams } from './manage';
+import { sanitizeHtml } from './sanitize';
 
 export {
+  sanitizeHtml,
   Validate,
   Display,
   error,
@@ -27,5 +29,6 @@ export {
   getRandomNumber,
   getSex,
   GetStatus,
-  GetEnvironment
+  GetEnvironment,
+  GetChannelStatus
 };

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "@autobusal/utilities",
-  "version": "1.1.1",
+  "version": "1.2.0",
   "author": "Ferjolt Ozuni",
   "type": "module",
-  "main": "index.ts"
+  "main": "index.ts",
+  "dependencies": {
+    "dompurify": "^3.4.12"
+  }
 }

package/sanitize.ts

@@ -0,0 +1,11 @@
+import DOMPurify from 'dompurify';
+
+// Sanitizes admin-authored HTML (CMS pages, articles, notifications, policies,
+// affiliate terms, document previews) before it's rendered via
+// dangerouslySetInnerHTML. These fields are only writable by an admin-type
+// account today, but rendering them unsanitized still means a compromised or
+// phished admin can persist JS that runs in every visitor's and every other
+// admin's browser - this is the defense-in-depth layer for that case.
+export const sanitizeHtml = (html: string | null | undefined): string => (
+  DOMPurify.sanitize(html ?? '')
+);

package/users.tsx

@@ -35,6 +35,25 @@ export const GetEnvironment = (t: TFunction<'common'>) => ([
   }
 ]);
 
+// Edited: Ferjolt Ozuni - Date: 2026-07-25
+// Shared by the Telegram and WhatsApp admin settings tabs (and any future
+// per-label messaging channel): disabled, this label's own credentials, or
+// routed through the main label's - same three-state model Raiffeisen's
+// payment domain toggle uses (that one has no "disabled" option since a
+// separate Available toggle covers on/off there).
+export const GetChannelStatus = (t: TFunction<'common'>) => ([
+  {
+    id: 'disabled',
+    name: t('admin_label.manage.channel_status.disabled', { ns: 'common' })
+  }, {
+    id: 'dedicated',
+    name: t('admin_label.manage.channel_status.dedicated', { ns: 'common' })
+  }, {
+    id: 'main',
+    name: t('admin_label.manage.channel_status.main', { ns: 'common' })
+  }
+]);
+
 const Status = styled.span<{ $type: string }>`
   display: inline-block;
   padding: 3px 5px;