fix(submissions): tighten Zod schema + surface backend debug info

- Add max constraints that previously only existed on the backend DTO so
  validation fires inline (projectName 100, description 5000, URL 500).
- ApiErrorField gains an optional `debug` field that the backend Prisma
  filter populates outside production.
- useSubmission's error formatter prefers `debug` over the generic field
  message when present, so toasts show the real Prisma reason behind
  "Data validation failed" instead of a blank "validation: …" line.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 0xdevcollins

components/hackathons/submissions/SubmissionForm.tsx

@@ -95,9 +95,15 @@ const LICENSE_OPTIONS = [
 type License = (typeof LICENSE_OPTIONS)[number];
 
 const baseSubmissionSchema = z.object({
-  projectName: z.string().min(3, 'Project name must be at least 3 characters'),
+  projectName: z
+    .string()
+    .min(3, 'Project name must be at least 3 characters')
+    .max(100, 'Project name cannot exceed 100 characters'),
   category: z.string().min(1, 'Please select a category'),
-  description: z.string().min(50, 'Description must be at least 50 characters'),
+  description: z
+    .string()
+    .min(50, 'Description must be at least 50 characters')
+    .max(5000, 'Description cannot exceed 5000 characters'),
   logo: z.string().optional(),
   banner: z.string().optional(),
   videoUrl: z
@@ -110,7 +116,13 @@ const baseSubmissionSchema = z.object({
   links: z.array(
     z.object({
       type: z.string(),
-      url: z.union([z.string().url('Please enter a valid URL'), z.literal('')]),
+      url: z.union([
+        z
+          .string()
+          .url('Please enter a valid URL')
+          .max(500, 'URL cannot exceed 500 characters'),
+        z.literal(''),
+      ]),
     })
   ),
   participationType: z.enum(['INDIVIDUAL', 'TEAM']),

hooks/hackathon/use-submission.ts

@@ -17,12 +17,16 @@ import { reportError } from '@/lib/error-reporting';
 function getApiErrorMessage(err: unknown, fallback: string): string {
   const apiErr = err as ApiError | undefined;
   if (apiErr && typeof apiErr.message === 'string' && apiErr.message) {
-    const firstField =
-      Array.isArray(apiErr.errors) && apiErr.errors.length > 0
-        ? apiErr.errors[0].message
-        : null;
-    if (firstField && firstField !== apiErr.message) {
-      return `${apiErr.message}: ${firstField}`;
+    const first = Array.isArray(apiErr.errors) ? apiErr.errors[0] : undefined;
+    const fieldMsg = first?.message;
+    // `debug` is only present outside production; surfaces the real Prisma
+    // reason when the generic "Data validation failed" fires.
+    const debug = first?.debug;
+    if (debug && debug !== apiErr.message) {
+      return `${apiErr.message}: ${debug}`;
+    }
+    if (fieldMsg && fieldMsg !== apiErr.message) {
+      return `${apiErr.message}: ${fieldMsg}`;
     }
     return apiErr.message;
   }

lib/api/api.ts

@@ -26,6 +26,8 @@ export interface ApiResponse<T = unknown> {
 export interface ApiErrorField {
   field?: string;
   message: string;
+  /** Populated by the backend Prisma filter outside production. */
+  debug?: string;
 }
 
 export interface ApiError {