Repository: freeCodeCamp/freeCodeCamp
File: api/src/routes/settings.ts (TypeScript)

Code before:
import { type FastifyPluginCallbackTypebox } from '@fastify/type-provider-typebox';
import badWordsFilter from 'bad-words';
import { isValidUsername } from '../../../utils/validate';
// we have to use this file as JavaScript because it is used by the old api.
import { blocklistedUsernames } from '../../../config/constants.js';
import { schemas } from '../schemas';

export const isPictureWithProtocol = (picture?: string): boolean => {
  let hasURLProtocol = true;
  try {
    const url = picture ? new URL(picture) : null;
    return (hasURLProtocol =
      !!url && (url.protocol == 'http:' || url.protocol == 'https:'));
  } catch {
    // eslint-disable-next-line @typescript-eslint/no-unused-vars
    return (hasURLProtocol = false);
  }
};

export const settingRoutes: FastifyPluginCallbackTypebox = (
  fastify,
  _options,
  done
) => {
  // The order matters here, since we want to reject invalid cross site requests
  // before checking if the user is authenticated.
  // eslint-disable-next-line @typescript-eslint/unbound-method
  fastify.addHook('onRequest', fastify.csrfProtection);
  fastify.addHook('onRequest', fastify.authenticateSession);

  fastify.put(
    '/update-my-profileui',
    {
      schema: schemas.updateMyProfileUI
    },
    async (req, reply) => {
      try {
        await fastify.prisma.user.update({
          where: { id: req.session.user.id },
          data: {
            profileUI: {

Review comment (suggestion):
```suggestion
  if (!picture) return false;
  try {
    const url = new URL(picture);
    return url.protocol == 'http:' || url.protocol == 'https:';
  } catch {
    return false;
```
I think this is a little more readable.

Code after:
import { type FastifyPluginCallbackTypebox } from '@fastify/type-provider-typebox';
import badWordsFilter from 'bad-words';
import { isValidUsername } from '../../../utils/validate';
// we have to use this file as JavaScript because it is used by the old api.
import { blocklistedUsernames } from '../../../config/constants.js';
import { schemas } from '../schemas';

export const isPictureWithProtocol = (picture?: string): boolean => {
  if (!picture) return false;
  try {
    const url = new URL(picture);
    return url.protocol == 'http:' || url.protocol == 'https:';
  } catch {
    return false;
  }
};

export const settingRoutes: FastifyPluginCallbackTypebox = (
  fastify,
  _options,
  done
) => {
  // The order matters here, since we want to reject invalid cross site requests
  // before checking if the user is authenticated.
  // eslint-disable-next-line @typescript-eslint/unbound-method
  fastify.addHook('onRequest', fastify.csrfProtection);
  fastify.addHook('onRequest', fastify.authenticateSession);

  fastify.put(
    '/update-my-profileui',
    {
      schema: schemas.updateMyProfileUI
    },
    async (req, reply) => {
      try {
        await fastify.prisma.user.update({
          where: { id: req.session.user.id },
          data: {
            profileUI: {
              isLocked: req.body.profileUI.isLocked,
              showAbout: req.body.profileUI.showAbout,