Discovered while validating Newman collection fixes (#33). Two distinct bugs in openbuilt-templates-marketplace.postman_collection.json step 'POST createFromTemplate':
-
Same-user + same-slug collision: returns {"error":"clone_failed"} instead of the documented {"error":"slug_collision"} (per REQ-OBT-005 of openbuilt-templates-marketplace). The 409 status code is right; the error code label is wrong, so consumer apps can't distinguish a collision (recoverable: prompt for new slug) from a generic clone failure (escalate).
-
Different-user + same-slug: returns 500 instead of 201. The spec says different users should be able to clone the same template under their own ownership; the server-side ownership scoping isn't isolating per-caller. A 500 here suggests an unhandled exception when the cross-user copy code path runs (likely a unique-constraint or RBAC service call).
Both surface as Newman assertions fail in step 'POST createFromTemplate — same user + same slug → 409 slug_collision' and 'POST createFromTemplate — different user + same slug → 201 (cross-user reuse OK)'.
These are server-side bugs in the templates-marketplace Application/ApplicationsController code, not Newman issues — the collection assertions are correctly enforcing the spec.
Discovered while validating Newman collection fixes (#33). Two distinct bugs in
openbuilt-templates-marketplace.postman_collection.jsonstep 'POST createFromTemplate':Same-user + same-slug collision: returns
{"error":"clone_failed"}instead of the documented{"error":"slug_collision"}(per REQ-OBT-005 of openbuilt-templates-marketplace). The 409 status code is right; the error code label is wrong, so consumer apps can't distinguish a collision (recoverable: prompt for new slug) from a generic clone failure (escalate).Different-user + same-slug: returns 500 instead of 201. The spec says different users should be able to clone the same template under their own ownership; the server-side ownership scoping isn't isolating per-caller. A 500 here suggests an unhandled exception when the cross-user copy code path runs (likely a unique-constraint or RBAC service call).
Both surface as Newman assertions fail in step 'POST createFromTemplate — same user + same slug → 409 slug_collision' and 'POST createFromTemplate — different user + same slug → 201 (cross-user reuse OK)'.
These are server-side bugs in the templates-marketplace Application/ApplicationsController code, not Newman issues — the collection assertions are correctly enforcing the spec.