Failing luhn test

[steveklabnik]

  Scenario: Tokenization fails luhn test                                                                                                                           
    When I make a POST request to /cards with the body:                                                                                                            
      """                                                                                                                                                          
        {                                                                                                                                                          
          "number": "4111111111111112",                                                                                                                            
          "expiration_month": 12,                                                                                                                                  
          "expiration_year": 2016                                                                                                                                  
        }                                                                                                                                                          
      """                                                                                                                                                          
    Then I should get a 409 status code                                                                                                                            
    And the response is valid according to the "errors" schema                                                                                                     
    And the fields on this error match:                                                                                                                            
      """                                                                                                                                                          
        {                                                                                                                                                          
          "category_code": "card-not-validated"                                                                                                                    
        }                                                                                                                                                          
      """    

Yields

Card number is not valid. Card number must consist of numbers, dashes, and spaces only. Your request id is OHM3152487e7d7111e39cac02a1fe53e539..                   
<409> expected but was                                                                                                                                             
<400>. (MiniTest::Assertion)   

Which is correct?

[matthewfl]

I think we had a long discussion about this before when it came up with 409. IIRC, the reason was this is a user entry problem, and not a problem with the payload itself.

10.4.1 400 Bad Request

The request could not be understood by the server due to malformed syntax. The client SHOULD NOT repeat the request without modifications.

10.4.10 409 Conflict

The request could not be completed due to a conflict with the current state of the resource. This code is only allowed in situations where it is expected that the user might be able to resolve the conflict and resubmit the request. The response body SHOULD include enough

information for the user to recognize the source of the conflict. Ideally, the response entity would include enough information for the user or user agent to fix the problem; however, that might not be possible and is not required.

Conflicts are most likely to occur in response to a PUT request. For example, if versioning were being used and the entity being PUT included changes to a resource which conflict with those made by an earlier (third-party) request, the server might use the 409 response to indicate that it can't complete the request. In this case, the response entity would likely contain a list of the differences between the two versions in a format defined by the response Content-Type.

[steveklabnik]

Seems good, I like 409 for this purpose.

[steveklabnik]

@matthewfl have we moved forward on this one at all?

[matthewfl]

@steveklabnik https://github.com/PoundPay/balanced/pull/353 the fix is in that pr

[matthewfl]

this should be fixed now