Skip to content

fix(ux-security): address UI, auth feedback and SVG config issues (#263, #265, #266, #267) - #293

Open
ghzhost wants to merge 1 commit into
MergeFi:mainfrom
ghzhost:fix/ux-security-issues-263-265-266-267
Open

fix(ux-security): address UI, auth feedback and SVG config issues (#263, #265, #266, #267)#293
ghzhost wants to merge 1 commit into
MergeFi:mainfrom
ghzhost:fix/ux-security-issues-263-265-266-267

Conversation

@ghzhost

@ghzhost ghzhost commented Aug 21, 2026

Copy link
Copy Markdown

Summary of Changes

This PR resolves 4 open quality, UX and security issues:

  1. Issue IssueActions shows the identical disabled "No action available" label for a merged-awaiting-payout bounty and a refunded/expired one #263 - Distinguish merged status in IssueActions:
    • merged status now displays "Payout pending" rather than falling back to "No action available", aligning with maintainer pipeline semantics.
  2. Issue auth/callback/page.tsx wraps CallbackClient in Suspense with no fallback, so the sign-in-completion page renders blank during the boundary's initial resolution #265 - Suspense fallback on Auth Callback:
    • Added a visible fallback centered text ("Finishing sign-in…") on AuthCallbackPage to eliminate the blank window during client suspense resolution.
  3. Issue next.config.ts enables dangerouslyAllowSVG without the companion contentSecurityPolicy/contentDispositionType hardening Next.js recommends for it #266 - Harden Next.js SVG Image Optimization:
    • Added contentSecurityPolicy: "default-src 'self'; script-src 'none'; sandbox;" and contentDispositionType: "attachment" alongside dangerouslyAllowSVG in next.config.ts per Next.js security recommendations.
  4. Issue CallbackClient's error hint always blames "the mergefi-backend is running" regardless of the actual sign-in failure reason #267 - Contextual diagnostic hint in CallbackClient:
    • For missing token errors from GitHub OAuth, guides user back to /connect rather than asserting the backend is offline.

Verification

  • Production build (npm run build) succeeds cleanly with Next.js Turbopack and TypeScript type-checking.

Closes #263, Closes #265, Closes #266, Closes #267

ghzhost
fix(ux-security): address issues MergeFi#263, MergeFi#265, MergeFi#266,
6957667 
MergeFi#267

- Issue MergeFi#263: Display 'Payout pending' button state for merged bounties in IssueActions
- Issue MergeFi#265: Provide Suspense fallback for auth callback page to prevent blank flash
- Issue MergeFi#266: Harden dangerouslyAllowSVG in next.config.ts with CSP and attachment disposition
- Issue MergeFi#267: Distinguish missing token troubleshooting hint from backend connectivity error
@vercel

vercel Bot commented Aug 21, 2026

Copy link
Copy Markdown

Someone is attempting to deploy a commit to the chonilius' projects Team on Vercel.

A member of the Team first needs to authorize it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment