Fix admin authorization and harden chat requests

src/app.js

@@ -2,6 +2,7 @@
  * @file Verbindet Express, Sitzungen, Datenbank und Routen und verwaltet den Server-Lebenszyklus.
  */
 import fs from "fs";
+import {createRequire} from "node:module";
 import {randomUUID} from "crypto";
 import {performance} from "perf_hooks";
 import express from "express";
@@ -225,7 +226,11 @@ function enforceSessionVersion(repositories) {
         const user = repositories.getUser(req.session.user);
         const currentVersion = Number(user?.session_version || 0);
         const sessionVersion = Number(req.session.sessionVersion || 0);
-        if (user && currentVersion === sessionVersion) return next();
+        if (user && currentVersion === sessionVersion) {
+            // Read the role on every request so revocation also affects existing sessions.
+            req.account = user;
+            return next();
+        }
 
         req.session.destroy(() => {
             if (req.path === "/session") {
@@ -296,6 +301,12 @@ export function createApp(options = {}) {
     app.locals.close = createCloseHandler(closeHandlers);
 
     app.use(createPagesRouter(config));
+    const require = createRequire(import.meta.url);
+    const dompurifyPath = require.resolve("dompurify").replace(/purify\.cjs\.js$/, "purify.min.js");
+    app.get("/vendor/dompurify.js", (_req, res) => {
+        res.set("Cache-Control", "no-cache");
+        res.sendFile(dompurifyPath);
+    });
     app.use(express.static(config.publicDir, {
         maxAge: config.staticMaxAge,
         etag: config.staticEtag,