bug: Report Issue form bypasses validation for required fields

[timothyfroehlich]

Description
The "Report an Issue" form allows submission even if the required "Machine" and "Severity" fields are left empty, as long as the "Issue Title" field is populated. This results in incomplete data being submitted and the user being redirected to the success page incorrectly.

Steps to Reproduce

1. Navigate to /report.
2. Enter a value in "Issue Title" (e.g., "Test Title").
3. Leave "Machine" and "Severity" unselected.
4. Click "Submit Issue Report".

Expected Behavior
The form should block submission and display validation errors for the missing "Machine" and "Severity" fields.

Actual Behavior
The form submits successfully, and the user is redirected to /report/success.

Screenshots
(See attached screenshot in artifacts: title_only_submit_1765162117461.png)

[traycerai]

Plan

Observations

The public issue reporting form at /report has default values set for both the "Machine" (defaultValue={firstMachineId}) and "Severity" (defaultValue="playable") select fields. This causes the HTML5 required attribute to be ineffective since the fields are never empty. The server-side validation in file:src/app/report/validation.ts and file:src/app/report/schemas.ts is correctly configured but never triggers validation errors because valid default values are always present. The form bypasses proper validation, allowing submissions without explicit user selection.

Approach

Remove the defaultValue attributes from both Machine and Severity select fields and add placeholder options with empty values as the first option in each dropdown. This ensures users must make explicit selections. The existing server-side Zod validation will properly catch empty submissions and display appropriate error messages. This approach maintains consistency with the validation schema expectations and provides better UX by forcing deliberate user choices for critical fields.

Implementation Steps

1. Update Machine Select Field in Public Report Form

File: file:src/app/report/page.tsx

Modify the Machine select field (lines 75-93):

• Remove the defaultValue={firstMachineId} prop from the <select> element
• Add an empty string as the defaultValue instead: defaultValue=""
• Add a placeholder option as the first option in the select dropdown with an empty value and disabled/selected attributes
• The placeholder option should read something like "Select a machine..." to guide users

Visual structure:

<select defaultValue="">
  <option value="" disabled>Select a machine...</option>
  {existing machine options}
</select>

2. Update Severity Select Field in Public Report Form

File: file:src/app/report/page.tsx

Modify the Severity select field (lines 133-147):

• Remove the defaultValue="playable" prop from the <select> element
• Add an empty string as the defaultValue instead: defaultValue=""
• Add a placeholder option as the first option in the select dropdown with an empty value and disabled/selected attributes
• The placeholder option should read something like "Select severity level..." to guide users

Visual structure:

<select defaultValue="">
  <option value="" disabled>Select severity level...</option>
  {existing severity options}
</select>

3. Verify Server-Side Validation

Files: file:src/app/report/validation.ts, file:src/app/report/schemas.ts, file:src/app/report/actions.ts

No changes needed. The existing validation logic already handles empty/invalid values correctly:

• publicIssueSchema in schemas.ts validates machineId as UUID and severity as enum
• parsePublicIssueForm in validation.ts extracts form data and returns appropriate error messages
• submitPublicIssueAction in actions.ts calls validation and redirects with error messages via redirectWithError

4. Update E2E Tests (if needed)

File: file:e2e/smoke/public-reporting.spec.ts

Review the test at lines 19-61 to ensure it still passes. The test already explicitly selects machine and severity values (lines 43 and 49), so it should continue working correctly. If the test fails due to the placeholder option, update the selection logic to account for the new first option being a placeholder.

5. Verify Unit Tests

File: file:src/test/unit/public-issue-validation.test.ts

No changes needed. The existing unit tests already validate the expected behavior:

• Test at lines 34-46 verifies that missing machineId returns an error
• Test at lines 48-61 verifies that invalid severity values return an error

These tests confirm the validation logic works as expected.

Expected Behavior After Implementation

Scenario	Current Behavior	Expected Behavior
Submit with only title filled	✅ Submits successfully	❌ Shows validation error
Submit without selecting machine	✅ Submits with first machine	❌ Shows "Please select a machine" error
Submit without selecting severity	✅ Submits with "playable"	❌ Shows "Select a severity" error
Submit with all fields filled	✅ Submits successfully	✅ Submits successfully

Data Flow

sequenceDiagram
    participant User
    participant Form as /report Form
    participant Action as submitPublicIssueAction
    participant Validation as parsePublicIssueForm
    participant Schema as publicIssueSchema
    participant DB as Database

    User->>Form: Fills title only
    User->>Form: Clicks Submit
    Form->>Action: FormData with empty machineId/severity
    Action->>Validation: Parse FormData
    Validation->>Schema: Validate with Zod
    Schema-->>Validation: Validation fails (empty values)
    Validation-->>Action: {success: false, error: "machineId: Please select a machine"}
    Action->>Form: Redirect to /report?error=...
    Form->>User: Display error message
    
    User->>Form: Selects machine & severity
    User->>Form: Clicks Submit
    Form->>Action: FormData with all required fields
    Action->>Validation: Parse FormData
    Validation->>Schema: Validate with Zod
    Schema-->>Validation: Validation succeeds
    Validation-->>Action: {success: true, data: {...}}
    Action->>DB: Create issue
    DB-->>Action: Success
    Action->>User: Redirect to /report/success

Loading

Import In IDE

🤖 Prompt for AI Agents

## Observations

The public issue reporting form at `/report` has default values set for both the "Machine" (`defaultValue={firstMachineId}`) and "Severity" (`defaultValue="playable"`) select fields. This causes the HTML5 `required` attribute to be ineffective since the fields are never empty. The server-side validation in `file:src/app/report/validation.ts` and `file:src/app/report/schemas.ts` is correctly configured but never triggers validation errors because valid default values are always present. The form bypasses proper validation, allowing submissions without explicit user selection.

## Approach

Remove the `defaultValue` attributes from both Machine and Severity select fields and add placeholder options with empty values as the first option in each dropdown. This ensures users must make explicit selections. The existing server-side Zod validation will properly catch empty submissions and display appropriate error messages. This approach maintains consistency with the validation schema expectations and provides better UX by forcing deliberate user choices for critical fields.

## Implementation Steps

### 1. Update Machine Select Field in Public Report Form

**File:** `file:src/app/report/page.tsx`

Modify the Machine select field (lines 75-93):

- Remove the `defaultValue={firstMachineId}` prop from the `<select>` element
- Add an empty string as the `defaultValue` instead: `defaultValue=""`
- Add a placeholder option as the first option in the select dropdown with an empty value and disabled/selected attributes
- The placeholder option should read something like "Select a machine..." to guide users

**Visual structure:**
```
<select defaultValue="">
  <option value="" disabled>Select a machine...</option>
  {existing machine options}
</select>
```

### 2. Update Severity Select Field in Public Report Form

**File:** `file:src/app/report/page.tsx`

Modify the Severity select field (lines 133-147):

- Remove the `defaultValue="playable"` prop from the `<select>` element
- Add an empty string as the `defaultValue` instead: `defaultValue=""`
- Add a placeholder option as the first option in the select dropdown with an empty value and disabled/selected attributes
- The placeholder option should read something like "Select severity level..." to guide users

**Visual structure:**
```
<select defaultValue="">
  <option value="" disabled>Select severity level...</option>
  {existing severity options}
</select>
```

### 3. Verify Server-Side Validation

**Files:** `file:src/app/report/validation.ts`, `file:src/app/report/schemas.ts`, `file:src/app/report/actions.ts`

No changes needed. The existing validation logic already handles empty/invalid values correctly:

- `publicIssueSchema` in `schemas.ts` validates `machineId` as UUID and `severity` as enum
- `parsePublicIssueForm` in `validation.ts` extracts form data and returns appropriate error messages
- `submitPublicIssueAction` in `actions.ts` calls validation and redirects with error messages via `redirectWithError`

### 4. Update E2E Tests (if needed)

**File:** `file:e2e/smoke/public-reporting.spec.ts`

Review the test at lines 19-61 to ensure it still passes. The test already explicitly selects machine and severity values (lines 43 and 49), so it should continue working correctly. If the test fails due to the placeholder option, update the selection logic to account for the new first option being a placeholder.

### 5. Verify Unit Tests

**File:** `file:src/test/unit/public-issue-validation.test.ts`

No changes needed. The existing unit tests already validate the expected behavior:
- Test at lines 34-46 verifies that missing `machineId` returns an error
- Test at lines 48-61 verifies that invalid severity values return an error

These tests confirm the validation logic works as expected.

## Expected Behavior After Implementation

| Scenario | Current Behavior | Expected Behavior |
|----------|-----------------|-------------------|
| Submit with only title filled | ✅ Submits successfully | ❌ Shows validation error |
| Submit without selecting machine | ✅ Submits with first machine | ❌ Shows "Please select a machine" error |
| Submit without selecting severity | ✅ Submits with "playable" | ❌ Shows "Select a severity" error |
| Submit with all fields filled | ✅ Submits successfully | ✅ Submits successfully |

## Data Flow

```mermaid
sequenceDiagram
    participant User
    participant Form as /report Form
    participant Action as submitPublicIssueAction
    participant Validation as parsePublicIssueForm
    participant Schema as publicIssueSchema
    participant DB as Database

    User->>Form: Fills title only
    User->>Form: Clicks Submit
    Form->>Action: FormData with empty machineId/severity
    Action->>Validation: Parse FormData
    Validation->>Schema: Validate with Zod
    Schema-->>Validation: Validation fails (empty values)
    Validation-->>Action: {success: false, error: "machineId: Please select a machine"}
    Action->>Form: Redirect to /report?error=...
    Form->>User: Display error message
    
    User->>Form: Selects machine & severity
    User->>Form: Clicks Submit
    Form->>Action: FormData with all required fields
    Action->>Validation: Parse FormData
    Validation->>Schema: Validate with Zod
    Schema-->>Validation: Validation succeeds
    Validation-->>Action: {success: true, data: {...}}
    Action->>DB: Create issue
    DB-->>Action: Success
    Action->>User: Redirect to /report/success
```

---

Execution Information

Branch: main
Commit: 76d3b4e

---

💡 Tips

Supported Commands (Inside Comments)

• Use @traycerai generate to iterate on the previous version of the implementation plan.

Supported Commands (Inside Description)

• Add @traycerai ignore anywhere in the ticket description to prevent this ticket from being processed.
• Add @traycerai branch:<branch-name> anywhere in the ticket description to specify the target branch for the implementation plan.

Community

• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.