---
id: TST-COM-ORD-022
title: 'Promotion codes: what is refused and what is never a 500 (R-4, end to end)'
kind: api-lifecycle
product_area: commerce
module: orders
revision: 1
status: draft
source_sha:
  services-commerce: c8b66a98e2490617aec38ba5c8165dd9bd0a8f9b
repository: services-commerce
files:
  - modules/checkout/tests/e2e/checkout-promotion-code-refusals.e2e.spec.js
implements:
  - ATS-COM-ORD-004-02
environment: local
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 2
isolation: The suite creates its own test workspace records and removes them using the fixture cleanup.
evidence:
  - provenance: test
    source: 'services-commerce:modules/checkout/tests/e2e/checkout-promotion-code-refusals.e2e.spec.js'
    test_cases:
      - 'answers 404 to the removal of a code the checkout does not carry, naming the code'
      - answers 404 to the removal of a code that was entered and removed already
      - 'refuses a code with a slash and a percent sign, 400, with the sentence (D-REC-6)'
      - >-
        refuses the other characters of a LIKE pattern and a path as text, 400: a backslash, a percent alone,
        ß
      - >-
        enters an underscore, a hyphen and a mixed-case code with spaces, rejecting it in the breakdown as no
        promotion has it
      - 'refuses a code holding a NUL character, 400, where the database would refuse the text as a 500'
      - 'refuses a code with no character that counts, 400'
scenario_coverage:
  - scenario: ATS-COM-ORD-004-02
    test_cases:
      - 'refuses a code with a slash and a percent sign, 400, with the sentence (D-REC-6)'
      - 'refuses a code holding a NUL character, 400, where the database would refuse the text as a 500'
      - 'refuses a code with no character that counts, 400'
    scope: >-
      The cited cases exercise the scenario’s listed fixture outcomes; this register makes no verified
      conformance claim.
---

# Promotion codes: what is refused and what is never a 500 (R-4, end to end)

## Verification Boundary

The suite drives the composed local API dispatcher and its registered routes.

## What This Suite Proves

The registered cases check promotion codes: what is refused and what is never a 500 (R-4, end to end) with their fixture records and assertions. Scenario bindings name only the examples those cases exercise.

## What It Does Not Prove

A registered file supplies no run result or verified conformance by itself. Local fixtures do not establish deployed cross-service behavior or complete browser journeys.

## Real Dependencies and Test Doubles

PostgreSQL and the exercised Commerce persistence or workflow code are real. Remote service records, clocks and transports follow the suite’s fixtures.

## Must Not Be Doubled

The database constraints, role restrictions, locks and transactions exercised by this suite must use PostgreSQL.