fix(iap-localizations): trim name and description to ASC limits

- Enforce 30-char limit on `name` and 45-char limit on `description` before sending to ASC
- Surface ASC validation errors as 400 with detailed messages instead of generic 500
- Align server-side trimming with iOS app's `LocaleCard` constraints to prevent data loss

Author: hanrw

CHANGELOG.md

@@ -23,6 +23,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Cursor pagination for IAP/Subscription price points** — `listPricePoints` now accepts `limit` + `cursor` and returns `PaginatedResponse { data, nextCursor, totalCount }`. CLI: `asc iap price-points list --iap-id X --limit 200 --cursor <token>`. REST: `GET /api/v1/iap/{id}/price-points?territory=CHN&limit=200&cursor=<token>` returns `{ data, nextCursor, totalCount }`. Frontends loop until `nextCursor` is absent. Mirrors iOS's `loadPricePoints(territory:limit:cursor:) → PaginatedResult`.
 
 ### Fixed
+- **`POST/PATCH /api/v1/iap/{id}/localizations` returned bare 500 on ASC validation failures + dropped over-limit content** — when the description exceeded ASC's 45-character cap (or name exceeded 30), Hummingbird's default error path returned 500 with no body, browsers showed "Failed to fetch", and the user lost the typed text. The controller now (1) trims `name` to 30 grapheme clusters and `description` to 45 before sending, matching the iOS app's `LocaleCard` `limit:` constants, and (2) catches any remaining ASC error (e.g., invalid locale) and surfaces it as `400 Bad Request` with the underlying message so the UI can render a meaningful inline error.
 - **IAP/Subscription availability returned only ~10 territories instead of all ~175** — the parent endpoint's `include=availableTerritories` truncates the relationship to a single page. `getAvailability` now issues two parallel calls (attributes + dedicated `/availableTerritories?limit=200`) so the full territory list reaches the frontend's Availability tab. Matches the iOS SDK's `fetchAvailability` composition.
 - **`SubscriptionGroup._links` was empty** — `GET /api/v1/apps/{id}/subscription-groups` items now embed populated `_links` for `listSubscriptions`, `listLocalizations`, `createSubscription`, `createLocalization`, `update`, `delete`. Migrated `SubscriptionGroup` from raw `affordances` to `structuredAffordances` so `apiLinks` auto-derives, and registered `_subscriptionGroupLocalizationRoutes` in `RESTPathResolver.ensureInitialized` so the nested localizations path resolves.
 - **`/api/v1/subscription-groups/{id}/subscriptions` returned 404** — the `_links.listSubscriptions` URL had no controller. Added `SubscriptionsController` and wired it in `RESTRoutes.swift`. Each subscription's `_links` already advertise the full child surface (localizations, availability, price-schedule, offers, etc.).

Sources/ASCCommand/Commands/Web/Controllers/IAPLocalizationsController.swift

@@ -4,6 +4,19 @@ import Hummingbird
 import HummingbirdWebSocket
 import Infrastructure
 
+/// ASC's IAP localization field constraints. Public so future controllers and validators
+/// can stay in sync with the iOS app's `LocaleCard` limits (`limit: 30` / `limit: 45`).
+enum IAPLocalizationLimits {
+    static let nameMaxChars = 30
+    static let descriptionMaxChars = 45
+}
+
+/// Trims to the given grapheme-cluster count. ASC counts characters the same way Swift's
+/// `String.count` does, so `.prefix(_:)` matches what the iOS view counter shows.
+private func clamp(_ value: String, to limit: Int) -> String {
+    value.count <= limit ? value : String(value.prefix(limit))
+}
+
 /// Routes that return `InAppPurchaseLocalization` resources.
 struct IAPLocalizationsController: Sendable {
     let repo: any InAppPurchaseLocalizationRepository
@@ -25,16 +38,20 @@ struct IAPLocalizationsController: Sendable {
             guard let name = json["name"] as? String else {
                 return jsonError("Missing name", status: .badRequest)
             }
-            // ASC enforces field constraints (name ≤30, description ≤45 chars) and validates
-            // the locale code. Without an explicit catch, Hummingbird returns a generic 500
-            // with no body and the browser shows "Failed to fetch". Surface the underlying
-            // message so the UI can render ASC's actual reason.
+            // ASC enforces field constraints (name ≤30, description ≤45 grapheme clusters).
+            // Trim before sending so callers don't have to validate client-side, and surface
+            // any remaining ASC error (e.g. invalid locale) as a 400 with the real message
+            // instead of Hummingbird's generic empty 500.
+            let trimmedName = clamp(name, to: IAPLocalizationLimits.nameMaxChars)
+            let trimmedDescription = (json["description"] as? String).map {
+                clamp($0, to: IAPLocalizationLimits.descriptionMaxChars)
+            }
             do {
                 let created = try await self.repo.createLocalization(
                     iapId: iapId,
                     locale: locale,
-                    name: name,
-                    description: json["description"] as? String
+                    name: trimmedName,
+                    description: trimmedDescription
                 )
                 return try restFormat(created)
             } catch {
@@ -48,11 +65,18 @@ struct IAPLocalizationsController: Sendable {
             }
             let body = try await request.body.collect(upTo: 64 * 1024)
             let json = (try? JSONSerialization.jsonObject(with: body) as? [String: Any]) ?? [:]
+            // Trim to ASC's limits (name ≤30, description ≤45) — same reasoning as POST.
+            let trimmedName = (json["name"] as? String).map {
+                clamp($0, to: IAPLocalizationLimits.nameMaxChars)
+            }
+            let trimmedDescription = (json["description"] as? String).map {
+                clamp($0, to: IAPLocalizationLimits.descriptionMaxChars)
+            }
             do {
                 let updated = try await self.repo.updateLocalization(
                     localizationId: localizationId,
-                    name: json["name"] as? String,
-                    description: json["description"] as? String
+                    name: trimmedName,
+                    description: trimmedDescription
                 )
                 return try restFormat(updated)
             } catch {