Add expiry and purpose to Stripe Connect OAuth state tokens

Extend TokenVerifier with optional expires_in and purpose, then use a 15-minute stripe_connect purpose for OAuth state to limit replay while keeping reload tolerance.

Fix Stripe Connect OAuth state surviving page reloads

Replace session-stored random state with signed TokenVerifier tokens so each authorize URL remains valid even if the org page is re-rendered before callback.

🔒️ Sanitize HTML and add CSP header to public pmail endpoint

Harden public pmail rendering against XSS and unsafe content:

• Add Content-Security-Policy header on the public pmail route to restrict resource loading.
• Sanitize both markdown-rendered and raw email bodies via Sanitize.fragment using Sanitize::Config::DANDELION to strip dangerous tags/attributes before they reach the browser.
• Replace javascript:; placeholder link in mailer docs with a real https URL to avoid encouraging unsafe link patterns.

🔧 Upgrade Cursor model variant to xhigh in bug review workflow

The grok-4.5-xhigh variant provides deeper reasoning capabilities, which should yield more thorough and accurate bug detection in the daily automated review.

👽️ Switch Cursor model from composer-2.5 to grok-4.5 in daily bug review workflow

🔥 Remove obsolete .windsurf/workflows symlink pointing to ../commands

🔒️ Prevent XSS via uploaded files Add RejectsActiveContent concern to Attachment, Comment, and Upload models to block active content (html, htm, xhtml, svg, svgz, xml, js) from being uploaded. Return proper error messages on upload and comment failures.

✨ Parenthesize assert block to fix RuboCop AmbiguousBlockAssociation

✨ Add support for api.luma.com iCal feed host

Add api.luma.com as a supported Luma iCal feed host alongside api2.luma.com.

Refactor Luma feed hosts into a dedicated constant to make it easier to maintain and extend the list of supported hosts in the future. Update documentation and add tests to verify both host formats are accepted.

🔒️ Add iCal feed host allowlist to prevent SSRF attacks

Add ALLOWED_FEED_HOSTS constant and validate iCal URLs against the allowlist before fetching. This restricts calendar imports to trusted hosts: Luma, Google Calendar, Outlook, and iCloud.

Add redirect callback to reject unexpected hosts during Luma page fetches. Only use Luma's own CDN for og:image URLs to prevent SSRF via arbitrary image meta tags.

Update validation to use the same normalize_feed_url method for consistency. Add test for rejecting disallowed hosts.

🐛 (stripe_connect_helper.rb): coerce client_id to string before CGI escaping to avoid type errors

🛂 Add commentable viewer authorization checks to comment routes

🔒️ Secure Stripe Connect OAuth flow with state validation

The previous implementation used the organisation ID as the OAuth state parameter, which is a security vulnerability. An attacker could craft a callback URL with any organisation ID to gain unauthorized access to that organisation's Stripe Connect flow.

Changes: - Generate a cryptographically random state and store the organisation ID in the session instead of the URL - Validate the state on callback using secure_compare to prevent timing attacks - Update views to use the new helper instead of embedding the organisation ID in the Stripe OAuth URL

This implements proper CSRF protection for the OAuth callback as required by the OAuth 2.0 specification.

🔒️ Scope nested attribute id checks to parent association

Nested attribute validation checked if a record existed globally rather than belonging to the parent, allowing cross-record modification or destruction. Scope the check to the parent's association for provider_links, ticket_types, and ticket_groups.

Extract reject_if lambdas to named predicate methods for readability and testability, and add test coverage for ticket type nested attributes.

✨ feat(layout): resolve theme color from event with fallbacks

✨ (event_payment_handlers.js): handle embedded stripe payment by opening a new window for the session url
✨ (stripe.rb): include session_url in the payment response so the frontend can redirect to the stripe session page in case of embedded form

🐛 (purchase.js): gate in-page alert behind embedded config

Use window.alert when the app is not embedded, and only fall back to the #purchase-alert element in embedded mode, where native browser dialogs are unavailable. Skip hiding the in-page alert on submit in non-embedded mode since it isn't used there.

Fix embedded ticket checkout blocked by sandboxed confirm dialogs

Replace native alerts with in-page validation messages and skip confirm() on ticket_form_only embeds so checkout works in Google Sites iframes.

⬆️ (Gemfile.lock): upgrade css_parser from 2.1.0 to 3.0.0
⬆️ (Gemfile.lock): add ssrf_filter ~> 1.5 dependency

🔒 (evm/opencollective): scope payment reconciliation to the scanned org/event

Prevent cross-tenant ticket completion by matching unpaid orders only within the organisation wallet or event collective being reconciled.