feat: Implement Phase 2 cross-cutting services with email and notification enhancements

- Refactor email verification and password reset utilities to use new email service.
- Introduce email delivery queue and notification delivery model for better tracking.
- Enhance file validation and storage services for improved security and ownership management.
- Add cron job for cleaning inactive notifications with retention policy.
- Update document worker to handle document generation and storage more efficiently.
- Implement logging improvements in activity and log workers.
- Create comprehensive documentation for new API endpoints and services.
- Add unit tests for file validation and notification policies to ensure robustness.

app/utils/mail.util.js

@@ -32,12 +32,14 @@ if (process.env.NODE_ENV !== "test" && process.env.ENABLE_MAIL === "true") {
 
 // Utility to load template and replace placeholders
 const loadTemplate = (templateName, variables = {}) => {
+  if (!/^[a-zA-Z0-9_-]+$/.test(templateName)) throw new Error("Invalid email template");
   const templatePath = path.join(__dirname, "../templates/emails", `${templateName}.html`);
   let template = fs.readFileSync(templatePath, "utf-8");
 
   Object.keys(variables).forEach((key) => {
     const regex = new RegExp(`{{${key}}}`, "g");
-    template = template.replace(regex, variables[key]);
+    const escaped = String(variables[key] ?? "").replace(/[&<>"']/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char]);
+    template = template.replace(regex, escaped);
   });
 
   return template;
@@ -90,5 +92,5 @@ const sendMail = async (options) => {
 };
 
 
-module.exports = { sendMail };
+module.exports = { sendMail, loadTemplate };