feat: tighten CORS policy and improve payroll history empty states

backend/.env.example

@@ -21,6 +21,9 @@ NODE_ENV=development
 # CORS origin allowed by backend APIs.
 CORS_ORIGIN=http://localhost:5173
 
+# Optional additional CORS origins (comma-separated), e.g. staging + production apps.
+# CORS_ALLOWED_ORIGINS=https://staging.payd.io,https://app.payd.io
+
 # Frontend base URL used for auth redirects.
 FRONTEND_URL=http://localhost:5173
 

backend/src/config/env.ts

@@ -8,7 +8,7 @@ const envSchema = z.object({
   DATABASE_URL: z.string().default('postgres://localhost:5432/payd_test'),
   REDIS_URL: z.string().optional(),
   NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
-  CORS_ORIGIN: z.string().default('http://localhost:5173'),
+  CORS_ORIGIN: z.string().optional(),
   CORS_ALLOWED_ORIGINS: z.string().optional(),
   THROTTLING_TPM: z.string().default('100'),
   THROTTLING_MAX_QUEUE_SIZE: z.string().default('1000'),

frontend/src/__tests__/TransactionHistory.integration.test.tsx

@@ -163,11 +163,13 @@ describe('TransactionHistory Integration', () => {
 
     // Wait for empty state to appear
     await waitFor(() => {
-      expect(getByText('No transactions found')).toBeInTheDocument();
+      expect(getByText('No transactions yet')).toBeInTheDocument();
     });
 
     // When no filters are active, should show default message
-    expect(getByText(/No transaction history available yet/)).toBeInTheDocument();
+    expect(
+      getByText(/Your payroll history will appear here once payments are sent/)
+    ).toBeInTheDocument();
   });
 
   test('displays error state and retry button on API failure', async () => {

frontend/src/pages/RevenueSplitDashboard.tsx

@@ -238,7 +238,7 @@ export default function RevenueSplitDashboard() {
           <h1 className="text-4xl font-black tracking-tight">
             Revenue Split <span className="text-accent">Dashboard</span>
           </h1>
-          <p className="mt-2 font-mono text-sm tracking-wider text-zinc-500 uppercase">
+          <p className="mt-2 font-mono text-sm tracking-wider text-zinc-300 uppercase">
             Contract-backed allocations, live balances, and indexed distributions
           </p>
         </div>
@@ -268,13 +268,13 @@ export default function RevenueSplitDashboard() {
         <section className="card glass noise xl:col-span-1">
           <div className="mb-4 flex items-center justify-between">
             <h2 className="text-lg font-bold">Current Allocation Splits</h2>
-            <span className="rounded-full border border-zinc-700 px-3 py-1 text-[11px] uppercase tracking-wide text-zinc-400">
+            <span className="rounded-full border border-zinc-700 px-3 py-1 text-[11px] uppercase tracking-wide text-zinc-300">
               On-chain
             </span>
           </div>
 
           {chartData.length === 0 ? (
-            <p className="text-sm text-zinc-400">No allocation data loaded.</p>
+            <p className="text-sm text-zinc-300">No allocation data loaded.</p>
           ) : (
             <div className="space-y-5">
               <div className="h-64">
@@ -379,7 +379,7 @@ export default function RevenueSplitDashboard() {
           </div>
 
           <div className="mt-5 flex flex-wrap items-center justify-between gap-3">
-            <div className="text-xs text-zinc-400">
+            <div className="text-xs text-zinc-300">
               <p>Total allocation must be exactly 100%.</p>
               <p>Submission uses a signed contract call only after simulation passes.</p>
             </div>
@@ -403,7 +403,7 @@ export default function RevenueSplitDashboard() {
         <section className="card glass noise xl:col-span-1">
           <h2 className="mb-4 text-lg font-bold">Live Recipient Balances</h2>
           {recipientBalances.length === 0 ? (
-            <p className="text-sm text-zinc-400">No recipient distributions available yet.</p>
+            <p className="text-sm text-zinc-300">No recipient distributions available yet.</p>
           ) : (
             <div className="space-y-2">
               {recipientBalances.map((row) => (
@@ -431,17 +431,17 @@ export default function RevenueSplitDashboard() {
           <div className="mb-4 flex items-center justify-between">
             <h2 className="text-lg font-bold">Historical Distribution Events</h2>
             {orgPublicKey ? (
-              <span className="font-mono text-[11px] text-zinc-500">
+              <span className="font-mono text-[11px] text-zinc-300">
                 Org: {orgPublicKey.slice(0, 6)}...{orgPublicKey.slice(-4)}
               </span>
             ) : null}
           </div>
           {events.length === 0 ? (
-            <p className="text-sm text-zinc-400">No backend indexed distribution events found.</p>
+            <p className="text-sm text-zinc-300">No backend indexed distribution events found.</p>
           ) : (
             <div className="overflow-x-auto">
               <table className="w-full text-sm">
-                <thead className="border-b border-zinc-800 text-left text-zinc-500">
+                <thead className="border-b border-zinc-800 text-left text-zinc-300">
                   <tr>
                     <th className="py-2 pr-4">Date</th>
                     <th className="py-2 pr-4">Recipient</th>
@@ -472,7 +472,7 @@ export default function RevenueSplitDashboard() {
                             {event.txHash.slice(0, 10)}...
                           </a>
                         ) : (
-                          <span className="text-zinc-500">N/A</span>
+                          <span className="text-zinc-300">N/A</span>
                         )}
                       </td>
                     </tr>

frontend/src/pages/TransactionHistory.tsx

@@ -274,11 +274,13 @@ export default function TransactionHistory() {
               <div className="w-16 h-16 rounded-full bg-surface-hi flex items-center justify-center mx-auto mb-6 border border-hi">
                 <Activity className="w-8 h-8 opacity-40 text-muted" />
               </div>
-              <p className="text-lg font-bold text-text mb-1">No transactions found</p>
+              <p className="text-lg font-bold text-text mb-1">
+                {activeFilterCount > 0 ? 'No transactions found' : 'No transactions yet'}
+              </p>
               <p className="text-sm">
                 {activeFilterCount > 0
                   ? 'Try adjusting your filters.'
-                  : 'No transaction history available yet.'}
+                  : 'Your payroll history will appear here once payments are sent.'}
               </p>
             </div>
           ) : null}