fix: improve validation and submitting on profile page

[alexdln]

🧭 Context

When updating the form, I received a 500 error and the form simply shut down.

There were two issues: insufficient validation on the server and no validation on the client.

📚 Description

Added conditions on the server that the URL is valid and on the client that it is a form - this enables native validation and allows the form to be submitted when pressing "Enter" in the fields (f.e. I always submit this way)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview, Comment	Mar 2, 2026 3:33pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored	Preview	Mar 2, 2026 3:33pm
npmx-lunaria	Ignored		Mar 2, 2026 3:33pm

[coderabbitai]

📝 Walkthrough

Walkthrough

The pull request modifies the profile editing functionality across frontend and backend. On the frontend, the edit UI container changes from a div to a form element with an @submit.prevent handler, and button elements are updated with explicit type attributes. On the backend, URL validation is introduced for the website field, rejecting requests with invalid URLs with a 400 error before schema validation occurs.

🚥 Pre-merge checks | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	The PR description lacks substantive detail about the changes, containing only template placeholders and no concrete information about the modifications or their rationale.	Provide a detailed description of the changes made, explain the problems being solved, and clarify the rationale for the implementation choices.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

🧹 Nitpick comments (1)

server/api/social/profile/[identifier]/index.put.ts (1)

17-21: Redundant URL validation may cause inconsistent behaviour.

The manual URL.canParse() check duplicates the schema's v.url() validation. These two mechanisms can have subtly different rules (e.g., handling of special protocols like javascript: or data:), which could lead to:

• A URL passing pre-validation but failing schema validation (or vice versa)
• Inconsistent error messages for the same input
• Two places to maintain if validation rules change

Consider removing the manual check and relying solely on the schema, or extracting a shared validation helper used by both.

Option 1: Remove redundant pre-validation

   const requestBody = await readBody(event)
-  if (requestBody.website && !URL.canParse(requestBody.website)) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid website' })
-  }
-
   const body = parse(ProfileEditBodySchema, requestBody)

Valibot will throw a validation error if the website is invalid, which can be caught and transformed into a 400 response if needed.

Option 2: Wrap schema parsing to provide friendly errors

+import { safeParse } from 'valibot'
+
   const requestBody = await readBody(event)
-  if (requestBody.website && !URL.canParse(requestBody.website)) {
-    throw createError({ statusCode: 400, statusMessage: 'Invalid website' })
+  const result = safeParse(ProfileEditBodySchema, requestBody)
+  if (!result.success) {
+    throw createError({ statusCode: 400, statusMessage: 'Invalid request body' })
   }
-
-  const body = parse(ProfileEditBodySchema, requestBody)
+  const body = result.output

---

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between ae1c62d and 9083219.

📒 Files selected for processing (2)

• app/pages/profile/[identity]/index.vue
• server/api/social/profile/[identifier]/index.put.ts

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!