From 6957667ca0fe1d8df06c00ad206a0f6d8c7e581b Mon Sep 17 00:00:00 2001
From: ghzhost <patricknasci@ghzhost.com>
Date: Fri, 21 Aug 2026 15:40:21 +0000
Subject: [PATCH] fix(ux-security): address issues #263, #265, #266, #267

- Issue #263: Display 'Payout pending' button state for merged bounties in IssueActions
- Issue #265: Provide Suspense fallback for auth callback page to prevent blank flash
- Issue #266: Harden dangerouslyAllowSVG in next.config.ts with CSP and attachment disposition
- Issue #267: Distinguish missing token troubleshooting hint from backend connectivity error
---
 next.config.ts                           | 2 ++
 src/app/auth/callback/CallbackClient.tsx | 4 +++-
 src/app/auth/callback/page.tsx           | 8 +++++++-
 src/app/issues/[id]/IssueActions.tsx     | 4 +++-
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/next.config.ts b/next.config.ts
index c1d5c09..61333ee 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -59,6 +59,8 @@ const nextConfig: NextConfig = {
   devIndicators: false,
   images: {
     dangerouslyAllowSVG: true,
+    contentSecurityPolicy: "default-src 'self'; script-src 'none'; sandbox;",
+    contentDispositionType: "attachment",
     remotePatterns: [
       { protocol: "https", hostname: "avatars.githubusercontent.com" },
       { protocol: "https", hostname: "api.dicebear.com" },
diff --git a/src/app/auth/callback/CallbackClient.tsx b/src/app/auth/callback/CallbackClient.tsx
index 0d72519..91a8a7d 100644
--- a/src/app/auth/callback/CallbackClient.tsx
+++ b/src/app/auth/callback/CallbackClient.tsx
@@ -28,7 +28,9 @@ export function CallbackClient() {
         <>
           <p className="font-medium text-rose-600">{error}</p>
           <p className="mt-2 text-sm text-slate-500 dark:text-slate-400">
-            Make sure the mergefi-backend is running and reachable.
+            {searchParams.get("token")
+              ? "Make sure the mergefi-backend is running and reachable."
+              : "Please return to /connect and try signing in again."}
           </p>
         </>
       ) : (
diff --git a/src/app/auth/callback/page.tsx b/src/app/auth/callback/page.tsx
index b4674a1..84636c5 100644
--- a/src/app/auth/callback/page.tsx
+++ b/src/app/auth/callback/page.tsx
@@ -3,7 +3,13 @@ import { CallbackClient } from "./CallbackClient";
 
 export default function AuthCallbackPage() {
   return (
-    <Suspense>
+    <Suspense
+      fallback={
+        <div className="mx-auto max-w-md px-6 py-24 text-center text-slate-500 dark:text-slate-400">
+          Finishing sign-in…
+        </div>
+      }
+    >
       <CallbackClient />
     </Suspense>
   );
diff --git a/src/app/issues/[id]/IssueActions.tsx b/src/app/issues/[id]/IssueActions.tsx
index 3b91ae4..7fd0283 100644
--- a/src/app/issues/[id]/IssueActions.tsx
+++ b/src/app/issues/[id]/IssueActions.tsx
@@ -102,7 +102,9 @@ export function IssueActions({ bounty }: { bounty: Bounty }) {
               ? "Payout complete"
               : bounty.status === "in_review"
                 ? "Awaiting PR merge"
-                : "No action available"}
+                : bounty.status === "merged"
+                  ? "Payout pending"
+                  : "No action available"}
           </Button>
         )}
       </div>