fix: logo URL validation shows cryptic error instead of meaningful message #213

New Issue

MrUnknownDE · 2026-04-05T17:02:41+02:00

MrUnknownDE commented

2026-04-05 17:02:41 +02:00

Originally created by @shreyaspapi on 2/23/2026

Community Contribution License Agreement

By creating this pull request, I grant the project maintainers an unlimited,
perpetual license to use, modify, and redistribute these contributions under any terms they
choose, including both the AGPLv3 and the Fossorial Commercial license terms. I
represent that I have the right to grant this license for all contributed content.

Summary

Fixes #2325

Replaced z.union([z.literal(""), z.string().superRefine(...)]) with a single z.string().superRefine(...) that handles the empty string case internally
Applied the same fix to both client-side (AuthPageBrandingForm.tsx) and server-side (upsertLoginPageBranding.ts) validation schemas

Problem

When entering a logo URL that fails validation (e.g., the server doesn't return an image/* content-type), users see the cryptic error:

Too big: expected string to have <=0 characters

This happens because Zod's z.union tries all branches when one fails. The first branch (z.literal("")) expects an empty string, so its error message about <=0 characters gets surfaced instead of the actual validation error from the superRefine branch.

Fix

Move the empty string check inside the superRefine callback as an early return. This eliminates the z.union entirely, so validation errors (invalid URL, non-image content-type, network errors, etc.) are always reported directly to the user.

How to test?

All existing validation cases are preserved:

Empty string (no logo) -> passes
Invalid URL -> "Must be a valid URL"
URL returns non-200 -> "Failed to load image..."
URL doesn't serve image content-type -> "URL does not point to an image..."
Network/fetch error -> specific error message
Enterprise local path validation -> unchanged

*Originally created by @shreyaspapi on 2/23/2026* ## Community Contribution License Agreement By creating this pull request, I grant the project maintainers an unlimited, perpetual license to use, modify, and redistribute these contributions under any terms they choose, including both the AGPLv3 and the Fossorial Commercial license terms. I represent that I have the right to grant this license for all contributed content. ## Summary Fixes #2325 - Replaced `z.union([z.literal(""), z.string().superRefine(...)])` with a single `z.string().superRefine(...)` that handles the empty string case internally - Applied the same fix to both client-side (`AuthPageBrandingForm.tsx`) and server-side (`upsertLoginPageBranding.ts`) validation schemas ## Problem When entering a logo URL that fails validation (e.g., the server doesn't return an `image/*` content-type), users see the cryptic error: > `Too big: expected string to have <=0 characters` This happens because Zod's `z.union` tries all branches when one fails. The first branch (`z.literal("")`) expects an empty string, so its error message about `<=0 characters` gets surfaced instead of the actual validation error from the `superRefine` branch. ## Fix Move the empty string check inside the `superRefine` callback as an early return. This eliminates the `z.union` entirely, so validation errors (invalid URL, non-image content-type, network errors, etc.) are always reported directly to the user. ## How to test? All existing validation cases are preserved: - Empty string (no logo) -> passes - Invalid URL -> `"Must be a valid URL"` - URL returns non-200 -> `"Failed to load image..."` - URL doesn't serve image content-type -> `"URL does not point to an image..."` - Network/fetch error -> specific error message - Enterprise local path validation -> unchanged

MrUnknownDE closed this issue

2026-04-05 17:02:41 +02:00

Sign in to join this conversation.

Branches Tags

main

dev

dependabot/npm_and_yarn/dev-minor-updates-b4e5d6b9c5

revert-2766-feature/systemd-install-instructions

dependabot/npm_and_yarn/prod-patch-updates-05702d39f2

dependabot/npm_and_yarn/next-16.2.1

dependabot/npm_and_yarn/recharts-3.8.1

alerting-rules

private-site-ha

dependabot/docker/docker/library/node-25-slim

ssh

delete-account

msg-delivery

org-only-idp

cicd

patch

site-targets-auto-login

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/pangolin#213