fix: tighten username whitespace handling

- Trim the draft in ChangeUsernameDialog before validating and saving,
  closing without a request when nothing changed
- Normalize PATCH /me input via usernameSchema (trim + non-empty)
- Trim the POST /me/claim-legacy username so copy/pasted credentials
  still match imported usernames
- Reject legacy imports containing usernames with leading or trailing
  whitespace rather than storing them verbatim

Author: jpenilla

src/lib/components/ChangeUsernameDialog.svelte

@@ -14,9 +14,10 @@
   let draftUsername = $state("");
   let saveError = $state<string | null>(null);
   let saving = $state(false);
+  let trimmedDraftUsername = $derived(draftUsername.trim());
   let usernameError = $derived.by(() => {
-    if (draftUsername.length > 64) return "Username must be 64 characters or fewer.";
-    if (!draftUsername.trim()) return "Enter a username.";
+    if (trimmedDraftUsername.length > 64) return "Username must be 64 characters or fewer.";
+    if (!trimmedDraftUsername) return "Enter a username.";
     return undefined;
   });
   let wasOpen = false;
@@ -29,22 +30,25 @@
     wasOpen = open;
   });
 
+  let unchanged = $derived(trimmedDraftUsername === (auth.username ?? ""));
+
   function close(): void {
     if (!saving) open = false;
   }
 
   async function save(): Promise<void> {
-    if (usernameError) {
-      saveError = null;
+    saveError = null;
+    if (unchanged) {
+      open = false;
       return;
     }
+    if (usernameError) return;
 
     saving = true;
-    saveError = null;
     try {
       const user = await fetchApi<UserProfile>("/me", {
         method: "PATCH",
-        body: { username: draftUsername.trim() },
+        body: { username: trimmedDraftUsername },
       });
       auth.setUser(user);
       await Promise.all([

src/lib/domain.ts

@@ -3,7 +3,7 @@ import { epochMilliseconds, minecraftVersionSchema, nonEmptyString } from "./sch
 
 export const PATCH_STATUSES = ["AVAILABLE", "WIP", "DONE"] as const;
 
-export const usernameSchema = v.pipe(nonEmptyString, v.maxLength(64));
+export const usernameSchema = v.pipe(v.string(), v.trim(), v.nonEmpty(), v.maxLength(64));
 const nonNegativeInteger = v.pipe(v.number(), v.safeInteger(), v.minValue(0));
 
 export const patchStatusSchema = v.picklist(PATCH_STATUSES);

src/lib/schemas.ts

@@ -1,6 +1,6 @@
 import * as v from "valibot";
 
-export const nonEmptyString = v.pipe(v.string(), v.minLength(1));
+export const nonEmptyString = v.pipe(v.string(), v.nonEmpty());
 export const minecraftVersionSchema = nonEmptyString;
 export const epochMilliseconds = v.pipe(
   v.number(),

src/lib/server/api.ts

@@ -57,7 +57,13 @@ const createApi = ({ localIdentity, enforceSameOrigin = true }: ApiOptions = {})
   });
   api.post(
     "/me/claim-legacy",
-    vValidator("json", v.strictObject({ username: nonEmptyString, password: nonEmptyString })),
+    vValidator(
+      "json",
+      v.strictObject({
+        username: v.pipe(v.string(), v.trim(), v.nonEmpty()),
+        password: nonEmptyString,
+      }),
+    ),
     async (c) => {
       const input = c.req.valid("json");
       const result = await database(c.env).claimLegacyUser(currentUser(c).id, input.username, input.password);
@@ -129,7 +135,15 @@ const createApi = ({ localIdentity, enforceSameOrigin = true }: ApiOptions = {})
       "json",
       v.strictObject({
         exportedAt: epochMilliseconds,
-        legacyUsers: v.array(v.strictObject({ username: nonEmptyString, passwordHash: nonEmptyString })),
+        legacyUsers: v.array(
+          v.strictObject({
+            username: v.pipe(
+              nonEmptyString,
+              v.check((username) => username.trim() === username, "Username has leading or trailing whitespace."),
+            ),
+            passwordHash: nonEmptyString,
+          }),
+        ),
         patches: v.pipe(v.array(patchSchema), v.minLength(1)),
       }),
       (result, c) => {

test/api.test.ts

@@ -26,9 +26,9 @@ const exportPatch = (overrides: Record<string, unknown> = {}) => ({
   duration: 5_000,
   ...overrides,
 });
-const exportPayload = (patches: Record<string, unknown>[]) => ({
+const exportPayload = (patches: Record<string, unknown>[], legacyUsers: Record<string, unknown>[] = []) => ({
   exportedAt: 1_700_000_000_000,
-  legacyUsers: [],
+  legacyUsers,
   patches,
 });
 
@@ -227,6 +227,14 @@ describe("Patch Roulette API", () => {
     expect((await api("/import-legacy-data", json(payload, "bob"))).status).toBe(409);
   });
 
+  it("rejects legacy users whose usernames have leading or trailing whitespace", async () => {
+    const response = await api(
+      "/import-legacy-data",
+      json(exportPayload([exportPatch()], [{ username: " old-alice ", passwordHash: hashSync("old-password", 4) }])),
+    );
+    expect(response.status).toBe(400);
+  });
+
   it("rejects patch records with impossible lifecycle fields", async () => {
     const invalidPatches = [
       exportPatch({ status: "AVAILABLE", responsibleUser: "alice", duration: null }),