test: Add anyOf and not integration coverage

Add /filters (anyOf) and /blocked (not) fixture endpoints in both the
YAML and JSON test-spec twins. Register five new IT tests across two new
nested classes (Filters, Blocked) in OpenApiServerIT: valid string,
valid integer, and short-string-rejected for anyOf; accepted-token and
forbidden-token for not. Also clarify the empty-schema comment in
SchemaParserTest to be more precise about what permissive ObjectSchema
means.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: thced

src/test/java/com/retailsvc/http/OpenApiServerIT.java

@@ -489,4 +489,113 @@ void postShape_missingDiscriminatorReturns400() {
       }
     }
   }
+
+  @Nested
+  class Filters {
+
+    String path = "/filters";
+
+    @Test
+    void postFilter_validStringValueReturns200() {
+      try (var server = newServer(Map.of("post-filter", new EchoHandler()));
+          var client = httpClient()) {
+        var body = "{\"value\":\"abcd\"}";
+        var request = newRequest(server, path, "POST", ofString(body));
+
+        var response = client.send(request, BodyHandlers.ofString());
+
+        assertThat(response.statusCode()).isEqualTo(200);
+      } catch (IOException e) {
+        fail(e);
+      } catch (InterruptedException e) {
+        Thread.currentThread().interrupt();
+        fail(e);
+      }
+    }
+
+    @Test
+    void postFilter_validIntegerValueReturns200() {
+      try (var server = newServer(Map.of("post-filter", new EchoHandler()));
+          var client = httpClient()) {
+        var body = "{\"value\":42}";
+        var request = newRequest(server, path, "POST", ofString(body));
+
+        var response = client.send(request, BodyHandlers.ofString());
+
+        assertThat(response.statusCode()).isEqualTo(200);
+      } catch (IOException e) {
+        fail(e);
+      } catch (InterruptedException e) {
+        Thread.currentThread().interrupt();
+        fail(e);
+      }
+    }
+
+    @Test
+    void postFilter_shortStringMatchesNoBranchReturns400() {
+      // "ab" has length < 3 (string branch fails) and is not an integer (integer branch fails).
+      try (var server = newServer(Map.of("post-filter", new EchoHandler()));
+          var client = httpClient()) {
+        var body = "{\"value\":\"ab\"}";
+        var request = newRequest(server, path, "POST", ofString(body));
+
+        var response = client.send(request, BodyHandlers.ofString());
+
+        assertThat(response.statusCode()).isEqualTo(400);
+        assertThat(response.headers().firstValue("Content-Type").orElse(""))
+            .contains("application/problem+json");
+        assertThat(response.body()).contains("anyOf");
+      } catch (IOException e) {
+        fail(e);
+      } catch (InterruptedException e) {
+        Thread.currentThread().interrupt();
+        fail(e);
+      }
+    }
+  }
+
+  @Nested
+  class Blocked {
+
+    String path = "/blocked";
+
+    @Test
+    void postBlocked_acceptedTokenReturns200() {
+      try (var server = newServer(Map.of("post-blocked", new EchoHandler()));
+          var client = httpClient()) {
+        var body = "{\"token\":\"allowed\"}";
+        var request = newRequest(server, path, "POST", ofString(body));
+
+        var response = client.send(request, BodyHandlers.ofString());
+
+        assertThat(response.statusCode()).isEqualTo(200);
+      } catch (IOException e) {
+        fail(e);
+      } catch (InterruptedException e) {
+        Thread.currentThread().interrupt();
+        fail(e);
+      }
+    }
+
+    @Test
+    void postBlocked_forbiddenTokenReturns400() {
+      try (var server = newServer(Map.of("post-blocked", new EchoHandler()));
+          var client = httpClient()) {
+        var body = "{\"token\":\"forbidden\"}";
+        var request = newRequest(server, path, "POST", ofString(body));
+
+        var response = client.send(request, BodyHandlers.ofString());
+
+        assertThat(response.statusCode()).isEqualTo(400);
+        assertThat(response.headers().firstValue("Content-Type").orElse(""))
+            .contains("application/problem+json");
+        assertThat(response.body()).contains("not");
+      } catch (IOException e) {
+        fail(e);
+      } catch (InterruptedException e) {
+        Thread.currentThread().interrupt();
+        fail(e);
+      }
+    }
+  }
 }

src/test/java/com/retailsvc/http/spec/schema/SchemaParserTest.java

@@ -237,8 +237,8 @@ void multipleCombinatorsInOneSchemaWrapInAllOf() {
 
   @Test
   void parsesEmptySchemaAsPermissiveObject() {
-    // {} accepts anything that's an object; this is the JSON Schema 3.1 default
-    // and a behaviour change from the previous parser, which returned NullSchema.
+    // {} emits no type assertion (permissive ObjectSchema); JSON Schema 3.1 default.
+    // Behaviour change from the previous parser, which returned NullSchema.
     Schema s = SchemaParser.parse(Map.of());
     assertThat(s).isInstanceOf(ObjectSchema.class);
     ObjectSchema obj = (ObjectSchema) s;

src/test/resources/openapi.json

@@ -202,6 +202,54 @@
         },
         "responses": { "200": { "description": "OK" } }
       }
+    },
+    "/filters": {
+      "post": {
+        "operationId": "post-filter",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": ["value"],
+                "properties": {
+                  "value": {
+                    "anyOf": [
+                      { "type": "string", "minLength": 3 },
+                      { "type": "integer" }
+                    ]
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": { "200": { "description": "OK" } }
+      }
+    },
+    "/blocked": {
+      "post": {
+        "operationId": "post-blocked",
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "required": ["token"],
+                "properties": {
+                  "token": {
+                    "type": "string",
+                    "not": { "enum": ["forbidden"] }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": { "200": { "description": "OK" } }
+      }
     }
   },
   "components": {

src/test/resources/openapi.yaml

@@ -138,6 +138,45 @@ paths:
         "200":
           description: OK
 
+  /filters:
+    post:
+      operationId: post-filter
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [value]
+              properties:
+                value:
+                  anyOf:
+                    - type: string
+                      minLength: 3
+                    - type: integer
+      responses:
+        "200":
+          description: OK
+
+  /blocked:
+    post:
+      operationId: post-blocked
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [token]
+              properties:
+                token:
+                  type: string
+                  not:
+                    enum: [forbidden]
+      responses:
+        "200":
+          description: OK
+
 components:
   parameters:
     Name-Header: