info:
  name: User Isolation - Cross-User Access
  type: http
  seq: 2
http:
  method: DELETE
  url: '{{base_url}}/api/saved-filters/{{other_user_filter_id}}'
  auth: inherit

docs: |-
  ## User Isolation - Cross-User Access

  Tests that users cannot access or modify filters created by other users.

  **Scenario:**
  1. User A creates a filter
  2. User B attempts to delete User A's filter
  3. Expect 404 Not Found (user isolation)

  **Expected Behavior:**
  - User A can CRUD their own filters
  - User B cannot access User A's filters
  - API returns 404 (not 403) for security (doesn't reveal filter existence)

  **Test Setup:**
  ```bash
  # Step 1: Create regular user (User A)
  USER_A_EMAIL="usera@test.com"
  USER_A_PASS="password123"
  
  # Create user and get token
  USER_A_TOKEN=$(curl -s -X POST \
    -H "Content-Type: application/json" \
    -d "{
      \"email\": \"$USER_A_EMAIL\",
      \"username\": \"usera\",
      \"password\": \"$USER_A_PASS\",
      \"first_name\": \"User\",
      \"last_name\": \"A\"
    }" \
    "{{base_url}}/api/auth/register" | jq -r '.token')

  # Step 2: User A creates a filter
  FILTER_RESPONSE=$(curl -s -X POST \
    -H "Authorization: Bearer $USER_A_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "User A Private Filter",
      "resource_type": "media-items",
      "filters": {"search": "private"}
    }' \
    "{{base_url}}/api/saved-filters")

  FILTER_ID=$(echo $FILTER_RESPONSE | jq -r '.id')
  
  echo "User A created filter: $FILTER_ID"
  ```

  **Test Steps:**
  ```bash
  # Step 3: Admin user attempts to delete User A's filter
  curl -X DELETE \
    -H "Authorization: Bearer {{admin_token}}" \
    "{{base_url}}/api/saved-filters/$FILTER_ID"

  # Expected Response: 404 Not Found
  # {
  #   "error": "failed to delete filter"
  # }
  ```

  **Expected Status Codes:**
  - 404: Not Found (filter doesn't exist OR doesn't belong to user)
  - NOT 403: Forbidden (we don't reveal whether filter exists)

  **Security Considerations:**
  - Never reveal whether a filter ID exists for another user
  - Always return 404 for cross-user access attempts
  - Prevents user enumeration attacks
  - Each user sees only their own filters

  **Additional Test Cases:**
  
  **Get Another User's Filter:**
  ```bash
  # User B tries to get User A's filter details
  curl -H "Authorization: Bearer $USER_B_TOKEN" \
    "{{base_url}}/api/saved-filters/$FILTER_ID"

  # Expected: 404 Not Found
  ```

  **Update Another User's Filter:**
  ```bash
  # User B tries to update User A's filter
  curl -X PUT \
    -H "Authorization: Bearer $USER_B_TOKEN" \
    -H "Content-Type: application/json" \
    -d '{
      "name": "Hacked Filter",
      "resource_type": "media-items",
      "filters": {}
    }' \
    "{{base_url}}/api/saved-filters/$FILTER_ID"

  # Expected: 404 Not Found
  ```

  **List Only Own Filters:**
  ```bash
  # User A lists their filters
  curl -H "Authorization: Bearer $USER_A_TOKEN" \
    "{{base_url}}/api/saved-filters?resource_type=media-items"

  # Expected: Only User A's filters returned

  # User B lists filters for same resource type
  curl -H "Authorization: Bearer $USER_B_TOKEN" \
    "{{base_url}}/api/saved-filters?resource_type=media-items"

  # Expected: Only User B's filters returned (different result)
  ```

  **Database-Level Isolation:**
  - All queries include `WHERE user_id = @user_id` clause
  - Service layer validates ownership before operations
  - JWT token provides user_id for automatic scoping
