fix: validate ?tab= before trusting it in ContributorDashboardClient

src/app/dashboard/contributor/ContributorDashboardClient.test.tsx

@@ -14,6 +14,7 @@
 import { act, render, screen, waitFor } from "@testing-library/react";
 import ContributorDashboardClient from "./ContributorDashboardClient";
 import { useAuth } from "@/context/AuthContext";
+import { useSearchParams } from "next/navigation";
 import { apiRequest, fetchBounties, type FetchResult } from "@/lib/api";
 import { mockBounties } from "@/lib/mock-data";
 import type { Bounty } from "@/types";
@@ -27,12 +28,13 @@ jest.mock("@/context/AuthContext", () => ({ useAuth: jest.fn() }));
 jest.mock("next/navigation", () => ({
   useRouter: () => ({ replace: jest.fn(), refresh: jest.fn() }),
   usePathname: () => "/dashboard/contributor",
-  useSearchParams: () => new URLSearchParams(),
+  useSearchParams: jest.fn(() => new URLSearchParams()),
 }));
 
 const mockUseAuth = useAuth as jest.MockedFunction<typeof useAuth>;
 const mockApiRequest = apiRequest as jest.MockedFunction<typeof apiRequest>;
 const mockFetchBounties = fetchBounties as jest.MockedFunction<typeof fetchBounties>;
+const mockUseSearchParams = useSearchParams as jest.MockedFunction<typeof useSearchParams>;
 
 interface Snapshot {
   totalEarnings: string;
@@ -113,6 +115,44 @@ describe("ContributorDashboardClient — data-source badge", () => {
   });
 });
 
+describe("ContributorDashboardClient — ?tab= param validation (#692)", () => {
+  it("falls back to the active tab when ?tab= has an unrecognized value", async () => {
+    mockUseSearchParams.mockReturnValueOnce(
+      new URLSearchParams("tab=foo") as ReturnType<typeof useSearchParams>,
+    );
+    mockApiRequest.mockResolvedValue(SNAPSHOT);
+    setUser({ id: "u1", username: "alice" });
+
+    render(<ContributorDashboardClient />);
+    await screen.findByText("Live data");
+
+    expect(screen.getByRole("tab", { name: /Active/i })).toHaveAttribute(
+      "aria-selected",
+      "true",
+    );
+    expect(screen.getByRole("tab", { name: /Completed/i })).toHaveAttribute(
+      "aria-selected",
+      "false",
+    );
+  });
+
+  it("honors a valid ?tab=completed value", async () => {
+    mockUseSearchParams.mockReturnValueOnce(
+      new URLSearchParams("tab=completed") as ReturnType<typeof useSearchParams>,
+    );
+    mockApiRequest.mockResolvedValue(SNAPSHOT);
+    setUser({ id: "u1", username: "alice" });
+
+    render(<ContributorDashboardClient />);
+    await screen.findByText("Live data");
+
+    expect(screen.getByRole("tab", { name: /Completed/i })).toHaveAttribute(
+      "aria-selected",
+      "true",
+    );
+  });
+});
+
 describe("ContributorDashboardClient — out-of-order response guard", () => {
   it("keeps the last-started stats request's data when an earlier one resolves later", async () => {
     const first = deferred<Snapshot | null>();

src/app/dashboard/contributor/ContributorDashboardClient.tsx

@@ -71,8 +71,11 @@ export default function ContributorDashboardClient() {
   const [bounties, setBounties] = useState<Bounty[]>(mockBounties);
   const [statsSource, setStatsSource] = useState<DataSource>("loading");
   const [bountiesSource, setBountiesSource] = useState<DataSource>("loading");
+  // Only "active"/"completed" are valid tab values — anything else (a stale
+  // bookmark, a mistyped `?tab=foo`) falls back to "active" instead of
+  // selecting neither tab and rendering no panel at all (#692).
   const [tab, setTabState] = useState<"active" | "completed">(
-    (searchParams.get("tab") as "active" | "completed") || "active"
+    searchParams.get("tab") === "completed" ? "completed" : "active"
   );
   // Explicit fetch status: starts "loading" so cards shimmer rather than
   // flashing zeroes while the auth check + API call are in flight.