feat: add admin dashboard and core API routes with Docker configuration

app/actions/auth.ts

@@ -3,8 +3,23 @@
 import { prisma } from "@/lib/prisma";
 import { revalidatePath } from "next/cache";
 
+function escapeHtml(value: string): string {
+  return value
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#39;");
+}
+
 export async function reactivateUserAccount(userId: string, reason: string) {
   try {
+    if (!userId || typeof reason !== "string" || reason.trim().length === 0) {
+      return { success: false, error: "Paramètres invalides" };
+    }
+
+    const sanitizedReason = reason.trim().slice(0, 1000);
+
     const user = await prisma.user.findUnique({
       where: { id: userId },
       select: { id: true, name: true, email: true, deletedAt: true }
@@ -23,24 +38,24 @@ export async function reactivateUserAccount(userId: string, reason: string) {
       data: {
         deletedAt: null,
         deletionScheduledAt: null,
-        reactivationReason: reason
+        reactivationReason: sanitizedReason
       }
     });
 
     // Optionnel : Envoyer un mail de confirmation
     const settings = await prisma.siteSetting.findUnique({ where: { id: "singleton" } });
     if (settings?.reactivateAccountTemplate) {
-        const { sendEmail } = await import("@/lib/mail");
-        const html = settings.reactivateAccountTemplate
-            .replace(/{name}/g, user.name)
-            .replace(/{siteName}/g, settings.siteName)
-            .replace(/{reason}/g, reason);
-            
-        await sendEmail({
-            to: user.email,
-            subject: settings.reactivateAccountSubject,
-            html
-        });
+      const { sendEmail } = await import("@/lib/mail");
+      const html = settings.reactivateAccountTemplate
+        .replace(/{name}/g, escapeHtml(user.name || ""))
+        .replace(/{siteName}/g, escapeHtml(settings.siteName || "Afrohub"))
+        .replace(/{reason}/g, escapeHtml(sanitizedReason));
+
+      await sendEmail({
+        to: user.email,
+        subject: settings.reactivateAccountSubject,
+        html
+      });
     }
 
     revalidatePath("/");