Validate and deduplicate custom difficulty presets

lib/api.ts

@@ -13,7 +13,11 @@ import {
   viewpointSchema,
 } from "../shared/protocol";
 import { mediaUrl, mediaUrls } from "./catalog";
-import { ServiceError, checkServiceError } from "./service-error";
+import {
+  ServiceError,
+  checkServiceError,
+  checkDifficultyPresetError,
+} from "./service-error";
 import { requestOrigin, verifyOrigin } from "./request-origin";
 import { browserAccount } from "./request-security";
 import { jsonBody } from "./json-body";
@@ -165,12 +169,7 @@ export async function handle(request: NextRequest, path: string[]) {
           .insert(body)
           .select("id,name,seconds,zoom")
           .single();
-        if (error?.code === "23505")
-          throw new ServiceError(
-            "A difficulty with that name already exists",
-            409,
-          );
-        checkServiceError(error);
+        checkDifficultyPresetError(error);
         return NextResponse.json({ preset: data });
       }
     }
@@ -202,10 +201,7 @@ export async function handle(request: NextRequest, path: string[]) {
         const body = z
           .object({
             datasetId: idSchema,
-            difficulty: z.union([
-              z.enum(["easy", "normal", "hard"]),
-              idSchema,
-            ]),
+            difficulty: z.union([z.enum(["easy", "normal", "hard"]), idSchema]),
           })
           .parse(await jsonBody(request));
         const secret = cookieSecret(request) || randomBytes(32).toString("hex");

lib/service-error.ts

@@ -7,10 +7,28 @@ export class ServiceError extends Error {
   }
 }
 
-export function checkServiceError(error: { message: string; code?: string } | null) {
+export function checkDifficultyPresetError(
+  error: { message: string; code?: string } | null,
+) {
+  if (error?.code === "23505")
+    throw new ServiceError("A difficulty with that name already exists", 409);
+  if (error?.code === "23514")
+    throw new ServiceError(
+      "Use a name with 2–40 characters and a round time of 15–600 seconds in 15-second steps",
+      400,
+    );
+  checkServiceError(error);
+}
+
+export function checkServiceError(
+  error: { message: string; code?: string } | null,
+) {
   if (!error) return;
   if (error.code === "P0001") throw new Error(error.message);
-  if (error.code === "PGRST116") throw new ServiceError("Record not found", 404);
+  if (error.code === "PGRST116")
+    throw new ServiceError("Record not found", 404);
   console.error("Supabase request failed:", error.code, error.message);
-  throw new ServiceError("MineGeo could not reach its data service. Please try again.");
+  throw new ServiceError(
+    "MineGeo could not reach its data service. Please try again.",
+  );
 }