LOOPIN-64 — Complete Event Create and Update Validation #138

Type

Backend / Validation / Security

Priority

Critical

Description

Implement reusable cross-field validation for event create and update requests so invalid event state is rejected consistently before persistence.

Scope

• Require the start time to be sufficiently in the future.
• Require endDateTime to be later than startDateTime.
• Define and enforce a maximum event duration.
• Enforce free/paid price consistency.
• Define price precision, scale, minimum, and maximum limits.
• Accept only HTTP or HTTPS image URLs.
• Require latitude and longitude to be provided together.
• Limit the number of interest IDs.
• Reject null interest IDs.
• Define duplicate interest ID behavior.
• Apply equivalent rules to create and update requests.
• Use an injectable Clock for deterministic tests.
• Return consistent validation error responses.

Acceptance Criteria

• Invalid date, duration, price, URL, coordinate, and interest combinations return 400.
• Create and update requests use the same business rules.
• Date validation tests do not depend on the machine clock.
• Validation errors use the project's standard error format.
• Valid existing event flows remain compatible.
• mvn test passes.

Required Test Cases

• Start time in the past or below the required lead time.
• End time equal to start time.
• End time before start time.
• Event duration above the configured maximum.
• Free event with non-zero price.
• Paid event with null, zero, negative, over-scale, or excessive price.
• Only latitude supplied.
• Only longitude supplied.
• Invalid URI scheme such as ftp:.
• Excessive number of interests.
• Null or duplicate interest IDs.
• Valid create and valid update requests.

Deliverables

• Reusable event request validator.
• Injectable application Clock.
• Unit tests for cross-field rules.
• API integration tests for deterministic 400 responses.

Out of Scope

• Event moderation rules.
• Currency conversion.
• Media upload implementation.