Fix: Auth 500 error, script tag warning, dynamic import, rate limit

src/lib/auth.ts

@@ -53,7 +53,7 @@ export async function getSession(): Promise<{
 
   if (!userId) return null;
 
-  const user = await db.user.findUnique({
+  const user = await db.user.findFirst({
     where: { id: userId, deletedAt: null },
     select: sessionUserSelect,
   });

src/lib/rate-limit.ts

@@ -23,8 +23,8 @@ setInterval(() => {
 // ─── Preset Limits ────────────────────────────────────────────────────
 
 export const RATE_LIMITS = {
-  // Auth endpoints: 5 requests per minute (strict)
-  auth: { limit: 5, windowMs: 60 * 1000 },
+  // Auth endpoints: 20 requests per minute (allows retries & multiple tabs)
+  auth: { limit: 20, windowMs: 60 * 1000 },
 
   // Data read endpoints: 60 requests per minute (generous)
   dataRead: { limit: 60, windowMs: 60 * 1000 },

src/lib/utils.ts

@@ -4,3 +4,24 @@ import { twMerge } from "tailwind-merge"
 export function cn(...inputs: ClassValue[]) {
   return twMerge(clsx(inputs))
 }
+
+/**
+ * Sanitize HTML content by removing script tags and dangerous event handlers.
+ * This prevents React's "Encountered a script tag" warning and XSS attacks
+ * when using dangerouslySetInnerHTML.
+ */
+export function sanitizeHtml(html: string): string {
+  if (!html) return '';
+  return html
+    // Remove <script> tags and their content
+    .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
+    // Remove on* event handler attributes (onclick, onload, onerror, etc.)
+    .replace(/\s+on\w+\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>]+)/gi, '')
+    // Remove javascript: URLs
+    .replace(/href\s*=\s*(?:"javascript:[^"]*"|'javascript:[^']*')/gi, 'href="#"')
+    // Remove <iframe> tags
+    .replace(/<iframe\b[^<]*(?:(?!<\/iframe>)<[^<]*)*<\/iframe>/gi, '')
+    // Remove <object> and <embed> tags
+    .replace(/<object\b[^<]*(?:(?!<\/object>)<[^<]*)*<\/object>/gi, '')
+    .replace(/<embed\b[^>]*>/gi, '');
+}