Harden request validation and admin UX cues

Backend/Endpoints/PublicClipEndpoints.cs

@@ -11,13 +11,20 @@ public static partial class PublicEndpoints
 {
     private static async Task<IResult> CreateClip(
         HttpContext context,
-        CreateClipRequest request,
+        CreateClipRequest? request,
         AwardsDbContext db,
         IUserSessionService userSessionService,
         IRiskFlagService riskFlagService,
         IRiskRuleService riskRuleService)
     {
-        if (!TryNormalizeExternalUrl(request.ClipUrl, out var clipUrl))
+        var validationError = ValidateCreateClipRequest(request);
+        if (validationError is not null)
+        {
+            return validationError;
+        }
+
+        var validatedRequest = request!;
+        if (!TryNormalizeExternalUrl(validatedRequest.ClipUrl, out var clipUrl))
         {
             return Results.BadRequest(new { message = "A valid http(s) clip link is required." });
         }
@@ -44,7 +51,7 @@ public static partial class PublicEndpoints
             return Results.BadRequest(new { message });
         }
 
-        var season = await db.Seasons.FirstOrDefaultAsync(item => item.Year == request.Year);
+        var season = await db.Seasons.FirstOrDefaultAsync(item => item.Year == validatedRequest.Year);
         var clipSeasonResolution = EnsurePublicWriteSeason(season, "nomination");
         if (clipSeasonResolution.Result is not null)
         {
@@ -53,26 +60,26 @@ public static partial class PublicEndpoints
 
         season = clipSeasonResolution.Season!;
 
-        var selectedCandidate = request.CandidateId is int candidateId
+        var selectedCandidate = validatedRequest.CandidateId is int candidateId
             ? await db.Candidates
                 .AsNoTracking()
                 .FirstOrDefaultAsync(item => item.Id == candidateId && item.SeasonId == season.Id)
             : null;
-        if (request.CandidateId is not null && selectedCandidate is null)
+        if (validatedRequest.CandidateId is not null && selectedCandidate is null)
         {
             return Results.BadRequest(new { message = "The selected candidate does not exist for this season." });
         }
 
-        if (request.CategoryId is int requestedCategoryId
+        if (validatedRequest.CategoryId is int requestedCategoryId
             && selectedCandidate is not null
             && selectedCandidate.CategoryId != requestedCategoryId)
         {
             return Results.BadRequest(new { message = "The selected candidate does not belong to the selected category." });
         }
 
-        var resolvedCategoryId = request.CategoryId ?? selectedCandidate?.CategoryId;
-        var normalizedTitle = request.Title?.Trim() ?? string.Empty;
-        var submittedCreator = request.Creator?.Trim();
+        var resolvedCategoryId = validatedRequest.CategoryId ?? selectedCandidate?.CategoryId;
+        var normalizedTitle = validatedRequest.Title?.Trim() ?? string.Empty;
+        var submittedCreator = validatedRequest.Creator?.Trim();
         var normalizedCreator = string.IsNullOrWhiteSpace(submittedCreator)
             ? selectedCandidate?.DisplayName ?? string.Empty
             : submittedCreator;
@@ -96,7 +103,7 @@ public static partial class PublicEndpoints
             }
         }
 
-        var submitterIdResult = await ResolveSubmitterIdAsync(context, request.TwitchUserId, userSessionService);
+        var submitterIdResult = await ResolveSubmitterIdAsync(context, validatedRequest.TwitchUserId, userSessionService);
         if (submitterIdResult.Result is not null)
         {
             return submitterIdResult.Result;