info:
  name: Filter Validation - Edge Cases
  type: http
  seq: 5
http:
  method: POST
  url: '{{base_url}}/api/saved-filters'
  auth: inherit
  body:
    type: json
    jsonBody: "{\n    \"name\": \"\",\n    \"resource_type\": \"media-items\"\
      ,\n    \"filters\": {}\n  }"

docs: |-
  ## Filter Validation - Edge Cases

  Tests various validation edge cases including empty names, invalid resource types, malformed JSON, etc.

  **Test Cases:**

  **Test 1: Empty Filter Name**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "",
      "resource_type": "media-items",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 400 Bad Request
  # {
  #   "error": "name and resource_type are required"
  # }
  ```

  **Test 2: Missing Name Field**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "resource_type": "media-items",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 400 Bad Request
  # Missing required field validation
  ```

  **Test 3: Missing Resource Type**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "Test Filter",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 400 Bad Request
  # {
  #   "error": "name and resource_type are required"
  # }
  ```

  **Test 4: Invalid Resource Type**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "Test Filter",
      "resource_type": "invalid-type",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 400 Bad Request or success
  # Note: Current validation allows any string (extensible design)
  # Future: May validate against allowed resource types
  ```

  **Test 5: Empty Filters Object**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "Empty Filter",
      "resource_type": "media-items",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 201 Created
  # Empty filters object is valid (matches no criteria)
  ```

  **Test 6: Very Long Filter Name**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "This is a very long filter name that exceeds one hundred characters and should be rejected by the validation logic in the handler",
      "resource_type": "media-items",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 400 Bad Request or 201 Created
  # Note: Plan specifies max 100 chars, but validation may not be enforced
  ```

  **Test 7: Special Characters in Name**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "Filter with <script>alert(\"xss\")</script>",
      "resource_type": "media-items",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 201 Created (input sanitized)
  # Note: Names are stored as-is, no HTML escaping needed
  ```

  **Test 8: Unicode Characters in Name**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "🚀 Sci-Fi Books 📚",
      "resource_type": "media-items",
      "filters": {
        "genre_filter": "Science Fiction",
        "search": "科幻"
      }
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 201 Created
  # Unicode (emoji, CJK characters) should be supported
  ```

  **Test 9: Malformed JSON**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "Test",
      "resource_type": "media-items",
      "filters": {
  "missing closing brace": "broken"
  }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 400 Bad Request
  # {
  #   "error": "invalid request body"
  # }
  ```

  **Test 10: Invalid Filter ID Format**
  ```bash
  curl -X PUT \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "Updated",
      "resource_type": "media-items",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters/not-a-uuid"

  # Expected: 400 Bad Request
  # {
  #   "error": "invalid filter ID"
  # }
  ```

  **Test 11: Missing Filters Field**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "Test Filter",
      "resource_type": "media-items"
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 400 Bad Request
  # Missing required field
  ```

  **Test 12: Whitespace-Only Name**
  ```bash
  curl -X POST \
    -H "Authorization: Bearer YOUR_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "   ",
      "resource_type": "media-items",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters"

  # Expected: 400 Bad Request
  # Name validation should reject whitespace-only names
  ```

  **Validation Rules Summary:**

  **Required Fields:**
  - `name`: Non-empty string (max 100 chars per plan)
  - `resource_type`: Non-empty string
  - `filters`: Object (can be empty {})

  **Optional Fields:**
  - None (all 3 fields are required)

  **Field Validation:**
  - Name uniqueness checked per user + resource type
  - Filter ID must be valid UUID for PUT/DELETE
  - Filters must be valid JSON object

  **Common Validation Errors:**
  ```json
  {
    "error": "name and resource_type are required"
  }
  ```

  ```json
  {
    "error": "invalid request body"
  }
  ```

  ```json
  {
    "error": "invalid filter ID"
  }
  ```

  ```json
  {
    "error": "filter with name 'X' already exists for this resource type"
  }
  ```
