Merge branch 'master' of git+ssh://git.taler.net/exchange

19 files changed, 905 insertions, 217 deletions

diff --git a/contrib/ci/ci.sh b/contrib/ci/ci.sh
index dd7277c01..f0be84242 100755
--- a/contrib/ci/ci.sh
+++ b/contrib/ci/ci.sh
@@ -5,7 +5,7 @@ set -exvuo pipefail
 OCI_RUNTIME=$(which podman)
 REPO_NAME=$(basename "${PWD}")
 JOB_NAME="${1}"
-JOB_CONTAINER=$((grep CONTAINER_NAME contrib/ci/jobs/${JOB_NAME}/config.ini | cut -d' ' -f 3) || echo "${REPO_NAME}")
+JOB_CONTAINER=$((grep CONTAINER_NAME contrib/ci/jobs/${JOB_NAME}/config.ini | cut -d' ' -f 3) || echo "localhost/${REPO_NAME}")
 JOB_ARCH=$((grep CONTAINER_ARCH contrib/ci/jobs/${JOB_NAME}/config.ini | cut -d' ' -f 3) || echo "${2:-amd64}")
 CONTAINER_BUILD=$((grep CONTAINER_BUILD contrib/ci/jobs/${JOB_NAME}/config.ini | cut -d' ' -f 3) || echo "True")
 
diff --git a/src/exchange/taler-exchange-httpd_batch-deposit.c b/src/exchange/taler-exchange-httpd_batch-deposit.c
index 835a974fc..84f27dd94 100644
--- a/src/exchange/taler-exchange-httpd_batch-deposit.c
+++ b/src/exchange/taler-exchange-httpd_batch-deposit.c
@@ -250,13 +250,29 @@ batch_deposit_transaction (void *cls,
               in_conflict ? "in conflict" : "no conflict");
   if (in_conflict)
   {
-    /* FIXME: #8002 conflicting contract != insufficient funds */
+    struct TALER_MerchantWireHashP h_wire;
+
+    if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT !=
+        TEH_plugin->get_wire_hash_for_contract (
+          TEH_plugin->cls,
+          &bd->merchant_pub,
+          &bd->h_contract_terms,
+          &h_wire))
+    {
+      TALER_LOG_WARNING (
+        "Failed to retrieve conflicting contract details from database\n");
+      *mhd_ret = TALER_MHD_reply_with_error (connection,
+                                             MHD_HTTP_INTERNAL_SERVER_ERROR,
+                                             TALER_EC_GENERIC_DB_STORE_FAILED,
+                                             "batch-deposit");
+      return qs;
+    }
+
     *mhd_ret
-      = TEH_RESPONSE_reply_coin_insufficient_funds (
+      = TEH_RESPONSE_reply_coin_conflicting_contract (
           connection,
           TALER_EC_EXCHANGE_DEPOSIT_CONFLICTING_CONTRACT,
-          &bd->cdis[0 /* SEE FIXME-#8002 Oec above! */].coin.denom_pub_hash,
-          &bd->cdis[0 /* SEE FIXME-#8002 Oec above! */].coin.coin_pub);
+          &h_wire);
     return GNUNET_DB_STATUS_HARD_ERROR;
   }
   if (! balance_ok)
diff --git a/src/exchange/taler-exchange-httpd_responses.c b/src/exchange/taler-exchange-httpd_responses.c
index a6d2c7ffc..8993ea50f 100644
--- a/src/exchange/taler-exchange-httpd_responses.c
+++ b/src/exchange/taler-exchange-httpd_responses.c
@@ -180,6 +180,21 @@ TEH_RESPONSE_reply_coin_insufficient_funds (
 
 
 MHD_RESULT
+TEH_RESPONSE_reply_coin_conflicting_contract (
+  struct MHD_Connection *connection,
+  enum TALER_ErrorCode ec,
+  const struct TALER_MerchantWireHashP *h_wire)
+{
+  return TALER_MHD_REPLY_JSON_PACK (
+    connection,
+    TALER_ErrorCode_get_http_status_safe (ec),
+    GNUNET_JSON_pack_data_auto ("h_wire",
+                                h_wire),
+    TALER_JSON_pack_ec (ec));
+}
+
+
+MHD_RESULT
 TEH_RESPONSE_reply_coin_denomination_conflict (
   struct MHD_Connection *connection,
   enum TALER_ErrorCode ec,
diff --git a/src/exchange/taler-exchange-httpd_responses.h b/src/exchange/taler-exchange-httpd_responses.h
index 57aeefe42..24b24621f 100644
--- a/src/exchange/taler-exchange-httpd_responses.h
+++ b/src/exchange/taler-exchange-httpd_responses.h
@@ -183,6 +183,23 @@ TEH_RESPONSE_reply_coin_denomination_conflict (
   const struct TALER_DenominationSignature *prev_denom_sig);
 
 /**
+ * Send the salted hash of the merchant's bank account from conflicting
+ * contract.  With this information, the merchant's private key and
+ * the hash of the contract terms, the client can retrieve more details
+ * about the conflicting deposit
+ *
+ * @param connection connection to the client
+ * @param ec error code to return
+ * @param h_wire the salted hash of the merchant's bank account
+ * @return MHD result code
+ */
+MHD_RESULT
+TEH_RESPONSE_reply_coin_conflicting_contract (
+  struct MHD_Connection *connection,
+  enum TALER_ErrorCode ec,
+  const struct TALER_MerchantWireHashP *h_wire);
+
+/**
  * Send proof that a request is invalid to client because of
  * a conflicting value for the age commitment hash of a coin.
  * This function will create a message with the conflicting
diff --git a/src/exchangedb/Makefile.am b/src/exchangedb/Makefile.am
index 847f2d880..89e6d9c9a 100644
--- a/src/exchangedb/Makefile.am
+++ b/src/exchangedb/Makefile.am
@@ -117,6 +117,7 @@ libtaler_plugin_exchangedb_postgres_la_SOURCES = \
   pg_get_policy_details.h pg_get_policy_details.c \
   pg_persist_policy_details.h pg_persist_policy_details.c \
   pg_do_deposit.h pg_do_deposit.c \
+  pg_get_wire_hash_for_contract.h pg_get_wire_hash_for_contract.c \
   pg_add_policy_fulfillment_proof.h pg_add_policy_fulfillment_proof.c \
   pg_do_melt.h pg_do_melt.c \
   pg_do_refund.h pg_do_refund.c \
diff --git a/src/exchangedb/exchange_do_deposit.sql b/src/exchangedb/exchange_do_deposit.sql
index 7116117ff..1156c7de5 100644
--- a/src/exchangedb/exchange_do_deposit.sql
+++ b/src/exchangedb/exchange_do_deposit.sql
@@ -142,7 +142,6 @@ THEN
   IF NOT FOUND
   THEN
     -- Deposit exists, but with *strange* differences. Not allowed.
-    -- FIXME #8002:  Surely we need to provide the client more data in this case.
     out_conflict=TRUE;
     RETURN;
   END IF;
diff --git a/src/exchangedb/pg_do_deposit.c b/src/exchangedb/pg_do_deposit.c
index 64e7886a7..0ba45b628 100644
--- a/src/exchangedb/pg_do_deposit.c
+++ b/src/exchangedb/pg_do_deposit.c
@@ -83,7 +83,6 @@ TEH_PG_do_deposit (
       GNUNET_PQ_result_spec_uint32 ("insufficient_balance_coin_index",
                                     bad_balance_index),
       balance_ok),
-    /* FIXME #8002:  We need more data to communicate the conflict to the client */
     GNUNET_PQ_result_spec_bool ("conflicted",
                                 ctr_conflict),
     GNUNET_PQ_result_spec_end
diff --git a/src/exchangedb/pg_get_wire_hash_for_contract.c b/src/exchangedb/pg_get_wire_hash_for_contract.c
new file mode 100644
index 000000000..5ff092a6c
--- /dev/null
+++ b/src/exchangedb/pg_get_wire_hash_for_contract.c
@@ -0,0 +1,81 @@
+/*
+   This file is part of TALER
+   Copyright (C) 2023 Taler Systems SA
+
+   TALER is free software; you can redistribute it and/or modify it under the
+   terms of the GNU General Public License as published by the Free Software
+   Foundation; either version 3, or (at your option) any later version.
+
+   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+   A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License along with
+   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+ */
+/**
+ * @file exchangedb/pg_get_wire_hash_for_contract.c
+ * @brief Implementation of the get_wire_hash_for_contract function for Postgres
+ * @author Özgür Kesim
+ */
+#include "platform.h"
+#include "taler_error_codes.h"
+#include "taler_dbevents.h"
+#include "taler_exchangedb_plugin.h"
+#include "taler_pq_lib.h"
+#include "pg_get_wire_hash_for_contract.h"
+#include "pg_helper.h"
+
+
+enum GNUNET_DB_QueryStatus
+TEH_PG_get_wire_hash_for_contract (
+  void *cls,
+  const struct TALER_MerchantPublicKeyP *merchant_pub,
+  const struct TALER_PrivateContractHashP *h_contract_terms,
+  struct TALER_MerchantWireHashP *h_wire)
+{
+  struct PostgresClosure *pg = cls;
+  enum GNUNET_DB_QueryStatus qs;
+  struct GNUNET_PQ_QueryParam params[] = {
+    GNUNET_PQ_query_param_auto_from_type (merchant_pub),
+    GNUNET_PQ_query_param_auto_from_type (h_contract_terms),
+    GNUNET_PQ_query_param_end
+  };
+  char *payto_uri;
+  struct TALER_WireSaltP wire_salt;
+  struct GNUNET_PQ_ResultSpec rs[] = {
+    GNUNET_PQ_result_spec_auto_from_type ("wire_salt",
+                                          &wire_salt),
+    GNUNET_PQ_result_spec_string ("payto_uri",
+                                  &payto_uri),
+    GNUNET_PQ_result_spec_end
+  };
+
+  /* check if the necessary records exist and get them */
+  PREPARE (pg,
+           "get_wire_hash_for_contract",
+           "SELECT"
+           "bdep.wire_salt"
+           ",wt.payto_uri"
+           " FROM coin_deposits"
+           "    JOIN batch_deposits bdep"
+           "      USING (batch_deposit_serial_id)"
+           "    JOIN wire_targets wt"
+           "      USING (wire_target_h_payto)"
+           " WHERE bdep.merchant_pub=$1"
+           "   AND bdep.h_contract_terms=$2");
+  /* NOTE: above query might be more efficient if we computed the shard
+     from the merchant_pub and included that in the query */
+  qs = GNUNET_PQ_eval_prepared_singleton_select (pg->conn,
+                                                 "get_wire_hash_for_contract",
+                                                 params,
+                                                 rs);
+  if (GNUNET_DB_STATUS_SUCCESS_ONE_RESULT == qs)
+  {
+    TALER_merchant_wire_signature_hash (payto_uri,
+                                        &wire_salt,
+                                        h_wire);
+    GNUNET_PQ_cleanup_result (rs);
+  }
+  return qs;
+}
diff --git a/src/exchangedb/pg_get_wire_hash_for_contract.h b/src/exchangedb/pg_get_wire_hash_for_contract.h
new file mode 100644
index 000000000..f95cd29c1
--- /dev/null
+++ b/src/exchangedb/pg_get_wire_hash_for_contract.h
@@ -0,0 +1,46 @@
+/*
+   This file is part of TALER
+   Copyright (C) 2022 Taler Systems SA
+
+   TALER is free software; you can redistribute it and/or modify it under the
+   terms of the GNU General Public License as published by the Free Software
+   Foundation; either version 3, or (at your option) any later version.
+
+   TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+   WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+   A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License along with
+   TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+ */
+/**
+ * @file exchangedb/pg_get_wire_hash_for_contract.h
+ * @brief implementation of the get_wire_hash_for_contract function for Postgres
+ * @author Özgür Kesim
+ */
+#ifndef PG_GET_WIRE_HASH_FOR_CONTRACT_H
+#define PG_GET_WIRE_HASH_FOR_CONTRACT_H
+
+#include "taler_util.h"
+#include "taler_json_lib.h"
+#include "taler_exchangedb_plugin.h"
+
+/**
+ * Try to get the salted hash of a merchant's bank account to a deposit
+ * contract. This is necessary in the event of a conflict with a given
+ * (merchant_pub, h_contract_terms) during deposit.
+ *
+ * @param cls closure
+ * @param merchant_pub merchant public key
+ * @param h_contract_terms hash of the proposal data
+ * @param[out] h_wire salted hash of a merchant's bank account
+ * @return transaction status code
+ */
+enum GNUNET_DB_QueryStatus
+TEH_PG_get_wire_hash_for_contract (
+  void *cls,
+  const struct TALER_MerchantPublicKeyP *merchant_pub,
+  const struct TALER_PrivateContractHashP *h_contract_terms,
+  struct TALER_MerchantWireHashP *h_wire);
+
+#endif
diff --git a/src/exchangedb/plugin_exchangedb_postgres.c b/src/exchangedb/plugin_exchangedb_postgres.c
index 7d9044a1e..4e7bccbd2 100644
--- a/src/exchangedb/plugin_exchangedb_postgres.c
+++ b/src/exchangedb/plugin_exchangedb_postgres.c
@@ -121,6 +121,7 @@
 #include "pg_get_policy_details.h"
 #include "pg_persist_policy_details.h"
 #include "pg_do_deposit.h"
+#include "pg_get_wire_hash_for_contract.h"
 #include "pg_add_policy_fulfillment_proof.h"
 #include "pg_do_melt.h"
 #include "pg_do_refund.h"
@@ -584,6 +585,8 @@ libtaler_plugin_exchangedb_postgres_init (void *cls)
     = &TEH_PG_persist_policy_details;
   plugin->do_deposit
     = &TEH_PG_do_deposit;
+  plugin->get_wire_hash_for_contract
+    = &TEH_PG_get_wire_hash_for_contract;
   plugin->add_policy_fulfillment_proof
     = &TEH_PG_add_policy_fulfillment_proof;
   plugin->do_melt
diff --git a/src/include/taler_exchangedb_plugin.h b/src/include/taler_exchangedb_plugin.h
index 25d3b17f9..278114c72 100644
--- a/src/include/taler_exchangedb_plugin.h
+++ b/src/include/taler_exchangedb_plugin.h
@@ -4400,6 +4400,25 @@ struct TALER_EXCHANGEDB_Plugin
 
 
   /**
+   * Try to retrieve the salted hash of the merchant's bank account to a
+   * deposit contract. Used in case of conflicts for a given (merchant_pub,
+   * h_contract_terms) to provide the client the necessary input to retrieve
+   * more details about the conflict.
+   *
+   * @param cls the plugin closure
+   * @param merchant_pub public key of the merchant
+   * @param h_contract_terms contract to check for
+   * @param[out] h_wire hash of the wire details
+   */
+  enum GNUNET_DB_QueryStatus
+    (*get_wire_hash_for_contract)(
+    void *cls,
+    const struct TALER_MerchantPublicKeyP *merchant_pub,
+    const struct TALER_PrivateContractHashP *h_contract_terms,
+    struct TALER_MerchantWireHashP *h_wire);
+
+
+  /**
    * Check if we have the specified deposit already in the database.
    *
    * @param cls the `struct PostgresClosure` with the plugin-specific state
diff --git a/src/include/taler_testing_lib.h b/src/include/taler_testing_lib.h
index 90f6ade88..1e8ae9d8f 100644
--- a/src/include/taler_testing_lib.h
+++ b/src/include/taler_testing_lib.h
@@ -43,12 +43,12 @@
  * quite any time after the command "run" method has been called.
  */
 #define TALER_TESTING_FAIL(is) \
-  do \
-  { \
-    GNUNET_break (0); \
-    TALER_TESTING_interpreter_fail (is); \
-    return; \
-  } while (0)
+        do \
+        { \
+          GNUNET_break (0); \
+          TALER_TESTING_interpreter_fail (is); \
+          return; \
+        } while (0)
 
 
 /**
@@ -60,16 +60,16 @@
  * @param expected expected HTTP status code
  */
 #define TALER_TESTING_unexpected_status(is,status,expected)             \
-  do {                                                                  \
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                                \
-                "Unexpected response code %u (expected: %u) to command %s in %s:%u\n", \
-                status,                                                 \
-                expected,                                               \
-                TALER_TESTING_interpreter_get_current_label (is),       \
-                __FILE__,                                               \
-                __LINE__);                                              \
-    TALER_TESTING_interpreter_fail (is);                                \
-  } while (0)
+        do {                                                                  \
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                                \
+                      "Unexpected response code %u (expected: %u) to command %s in %s:%u\n", \
+                      status,                                                 \
+                      expected,                                               \
+                      TALER_TESTING_interpreter_get_current_label (is),       \
+                      __FILE__,                                               \
+                      __LINE__);                                              \
+          TALER_TESTING_interpreter_fail (is);                                \
+        } while (0)
 
 /**
  * Log an error message about us receiving an unexpected HTTP
@@ -82,18 +82,18 @@
  * @param body received JSON-reply
  */
 #define TALER_TESTING_unexpected_status_with_body(is,status,expected,body) \
-  do {                                                                  \
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                                \
-                "Unexpected response code %u (expected: %u) to "        \
-                "command %s in %s:%u\nwith body:\n>>%s<<\n",            \
-                status,                                                 \
-                expected,                                               \
-                TALER_TESTING_interpreter_get_current_label (is),       \
-                __FILE__,                                               \
-                __LINE__,                                               \
-                json_dumps (body, JSON_INDENT (2)));                    \
-    TALER_TESTING_interpreter_fail (is);                                \
-  } while (0)
+        do {                                                                  \
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                                \
+                      "Unexpected response code %u (expected: %u) to "        \
+                      "command %s in %s:%u\nwith body:\n>>%s<<\n",            \
+                      status,                                                 \
+                      expected,                                               \
+                      TALER_TESTING_interpreter_get_current_label (is),       \
+                      __FILE__,                                               \
+                      __LINE__,                                               \
+                      json_dumps (body, JSON_INDENT (2)));                    \
+          TALER_TESTING_interpreter_fail (is);                                \
+        } while (0)
 
 
 /**
@@ -104,14 +104,14 @@
  * @param label command label of the incomplete command
  */
 #define TALER_TESTING_command_incomplete(is,label)                      \
-  do {                                                                  \
-    GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                                \
-                "Command %s (%s:%u) did not complete (at %s)\n",        \
-                label,                                                  \
-                __FILE__,                                               \
-                __LINE__,                                               \
-                TALER_TESTING_interpreter_get_current_label (is));      \
-  } while (0)
+        do {                                                                  \
+          GNUNET_log (GNUNET_ERROR_TYPE_ERROR,                                \
+                      "Command %s (%s:%u) did not complete (at %s)\n",        \
+                      label,                                                  \
+                      __FILE__,                                               \
+                      __LINE__,                                               \
+                      TALER_TESTING_interpreter_get_current_label (is));      \
+        } while (0)
 
 
 /**
@@ -311,10 +311,10 @@ struct TALER_TESTING_Command
    * @return #GNUNET_OK on success
    */
   enum GNUNET_GenericReturnValue
-  (*traits)(void *cls,
-            const void **ret,
-            const char *trait,
-            unsigned int index);
+    (*traits)(void *cls,
+              const void **ret,
+              const char *trait,
+              unsigned int index);
 
   /**
    * When did the execution of this command start?
@@ -1081,10 +1081,39 @@ TALER_TESTING_cmd_withdraw_amount (const char *label,
 
 
 /**
+ * Create a batch withdraw command, letting the caller specify the type of
+ * conflict between the coins and the desired amounts as string.
+ *
+ * Takes a variable, non-empty list of the denomination amounts via VARARGS,
+ * similar to #TALER_TESTING_cmd_withdraw_amount(), just using a batch
+ * withdraw.
+ *
+ * @param label command label.
+ * @param reserve_reference command providing us with a reserve to withdraw from
+ * @param conflict if true, enforce a conflict (same priv key, different denom and age commiment)
+ * @param age if > 0, age restriction applies (same for all coins)
+ * @param expected_response_code which HTTP response code
+ *        we expect from the exchange.
+ * @param amount how much we withdraw for the first coin
+ * @param ... NULL-terminated list of additional amounts to withdraw (one per coin)
+ * @return the withdraw command to be executed by the interpreter.
+ */
+struct TALER_TESTING_Command
+TALER_TESTING_cmd_batch_withdraw_with_conflict (
+  const char *label,
+  const char *reserve_reference,
+  bool conflict,
+  uint8_t age,
+  unsigned int expected_response_code,
+  const char *amount,
+  ...);
+
+/**
  * Create a batch withdraw command, letting the caller specify
  * the desired amounts as string.  Takes a variable, non-empty
  * list of the denomination amounts via VARARGS, similar to
  * #TALER_TESTING_cmd_withdraw_amount(), just using a batch withdraw.
+ * The coins are generated without a conflict (different private keys).
  *
  * @param label command label.
  * @param reserve_reference command providing us with a reserve to withdraw from
@@ -1095,13 +1124,20 @@ TALER_TESTING_cmd_withdraw_amount (const char *label,
  * @param ... NULL-terminated list of additional amounts to withdraw (one per coin)
  * @return the withdraw command to be executed by the interpreter.
  */
-struct TALER_TESTING_Command
-TALER_TESTING_cmd_batch_withdraw (const char *label,
-                                  const char *reserve_reference,
-                                  uint8_t age,
-                                  unsigned int expected_response_code,
-                                  const char *amount,
-                                  ...);
+#define TALER_TESTING_cmd_batch_withdraw(label, \
+                                         reserve_reference, \
+                                         age, \
+                                         expected_response_code, \
+                                         amount, \
+                                         ...) \
+        TALER_TESTING_cmd_batch_withdraw_with_conflict ( \
+          (label), \
+          (reserve_reference), \
+          false, \
+          (age), \
+          (expected_response_code), \
+          (amount), \
+          __VA_ARGS__)
 
 /**
  * Create an age-withdraw command, letting the caller specify
@@ -2231,7 +2267,7 @@ TALER_TESTING_cmd_oauth_with_birthdate (const char *label,
  * @param port the TCP port to listen on
  */
 #define TALER_TESTING_cmd_oauth(label, port) \
-  TALER_TESTING_cmd_oauth_with_birthdate ((label), NULL, (port))
+        TALER_TESTING_cmd_oauth_with_birthdate ((label), NULL, (port))
 
 
 /* ****************** P2P payment commands ****************** */
@@ -2560,13 +2596,13 @@ TALER_TESTING_get_trait (const struct TALER_TESTING_Trait *traits,
  * statically allocated data of type @a type.
  */
 #define TALER_TESTING_MAKE_DECL_SIMPLE_TRAIT(name,type)   \
-  enum GNUNET_GenericReturnValue                          \
-    TALER_TESTING_get_trait_ ## name (                    \
-    const struct TALER_TESTING_Command *cmd,              \
-    type **ret);                                          \
-  struct TALER_TESTING_Trait                              \
-    TALER_TESTING_make_trait_ ## name (                   \
-    type * value);
+        enum GNUNET_GenericReturnValue                          \
+        TALER_TESTING_get_trait_ ## name (                    \
+          const struct TALER_TESTING_Command *cmd,              \
+          type **ret);                                          \
+        struct TALER_TESTING_Trait                              \
+        TALER_TESTING_make_trait_ ## name (                   \
+          type * value);
 
 
 /**
@@ -2574,27 +2610,27 @@ TALER_TESTING_get_trait (const struct TALER_TESTING_Trait *traits,
  * allocated data of type @a type.
  */
 #define TALER_TESTING_MAKE_IMPL_SIMPLE_TRAIT(name,type)  \
-  enum GNUNET_GenericReturnValue                         \
-    TALER_TESTING_get_trait_ ## name (                   \
-    const struct TALER_TESTING_Command *cmd,             \
-    type **ret)                                          \
-  {                                                      \
-    if (NULL == cmd->traits) return GNUNET_SYSERR;       \
-    return cmd->traits (cmd->cls,                        \
-                        (const void **) ret,             \
-                        TALER_S (name),                  \
-                        0);                              \
-  }                                                      \
-  struct TALER_TESTING_Trait                             \
-    TALER_TESTING_make_trait_ ## name (                  \
-    type * value)                                        \
-  {                                                      \
-    struct TALER_TESTING_Trait ret = {                   \
-      .trait_name = TALER_S (name),                      \
-      .ptr = (const void *) value                        \
-    };                                                   \
-    return ret;                                          \
-  }
+        enum GNUNET_GenericReturnValue                         \
+        TALER_TESTING_get_trait_ ## name (                   \
+          const struct TALER_TESTING_Command *cmd,             \
+          type * *ret)                                          \
+        {                                                      \
+          if (NULL == cmd->traits) return GNUNET_SYSERR;       \
+          return cmd->traits (cmd->cls,                        \
+                              (const void **) ret,             \
+                              TALER_S (name),                  \
+                              0);                              \
+        }                                                      \
+        struct TALER_TESTING_Trait                             \
+        TALER_TESTING_make_trait_ ## name (                  \
+          type * value)                                        \
+        {                                                      \
+          struct TALER_TESTING_Trait ret = {                   \
+            .trait_name = TALER_S (name),                      \
+            .ptr = (const void *) value                        \
+          };                                                   \
+          return ret;                                          \
+        }
 
 
 /**
@@ -2602,15 +2638,15 @@ TALER_TESTING_get_trait (const struct TALER_TESTING_Trait *traits,
  * statically allocated data of type @a type.
  */
 #define TALER_TESTING_MAKE_DECL_INDEXED_TRAIT(name,type)  \
-  enum GNUNET_GenericReturnValue                          \
-    TALER_TESTING_get_trait_ ## name (                    \
-    const struct TALER_TESTING_Command *cmd,              \
-    unsigned int index,                                   \
-    type **ret);                                          \
-  struct TALER_TESTING_Trait                              \
-    TALER_TESTING_make_trait_ ## name (                   \
-    unsigned int index,                                   \
-    type * value);
+        enum GNUNET_GenericReturnValue                          \
+        TALER_TESTING_get_trait_ ## name (                    \
+          const struct TALER_TESTING_Command *cmd,              \
+          unsigned int index,                                   \
+          type **ret);                                          \
+        struct TALER_TESTING_Trait                              \
+        TALER_TESTING_make_trait_ ## name (                   \
+          unsigned int index,                                   \
+          type *value);
 
 
 /**
@@ -2618,116 +2654,116 @@ TALER_TESTING_get_trait (const struct TALER_TESTING_Trait *traits,
  * allocated data of type @a type.
  */
 #define TALER_TESTING_MAKE_IMPL_INDEXED_TRAIT(name,type) \
-  enum GNUNET_GenericReturnValue                         \
-    TALER_TESTING_get_trait_ ## name (                   \
-    const struct TALER_TESTING_Command *cmd,             \
-    unsigned int index,                                  \
-    type **ret)                                          \
-  {                                                      \
-    if (NULL == cmd->traits) return GNUNET_SYSERR;       \
-    return cmd->traits (cmd->cls,                        \
-                        (const void **) ret,             \
-                        TALER_S (name),                  \
-                        index);                          \
-  }                                                      \
-  struct TALER_TESTING_Trait                             \
-    TALER_TESTING_make_trait_ ## name (                  \
-    unsigned int index,                                  \
-    type * value)                                        \
-  {                                                      \
-    struct TALER_TESTING_Trait ret = {                   \
-      .index = index,                                    \
-      .trait_name = TALER_S (name),                      \
-      .ptr = (const void *) value                        \
-    };                                                   \
-    return ret;                                          \
-  }
+        enum GNUNET_GenericReturnValue                         \
+        TALER_TESTING_get_trait_ ## name (                   \
+          const struct TALER_TESTING_Command *cmd,             \
+          unsigned int index,                                  \
+          type * *ret)                                          \
+        {                                                      \
+          if (NULL == cmd->traits) return GNUNET_SYSERR;       \
+          return cmd->traits (cmd->cls,                        \
+                              (const void **) ret,             \
+                              TALER_S (name),                  \
+                              index);                          \
+        }                                                      \
+        struct TALER_TESTING_Trait                             \
+        TALER_TESTING_make_trait_ ## name (                  \
+          unsigned int index,                                  \
+          type * value)                                        \
+        {                                                      \
+          struct TALER_TESTING_Trait ret = {                   \
+            .index = index,                                    \
+            .trait_name = TALER_S (name),                      \
+            .ptr = (const void *) value                        \
+          };                                                   \
+          return ret;                                          \
+        }
 
 
 /**
  * Call #op on all simple traits.
  */
 #define TALER_TESTING_SIMPLE_TRAITS(op) \
-  op (bank_row, const uint64_t)                                    \
-  op (officer_pub, const struct TALER_AmlOfficerPublicKeyP)        \
-  op (officer_priv, const struct TALER_AmlOfficerPrivateKeyP)      \
-  op (officer_name, const char)                                    \
-  op (aml_decision, enum TALER_AmlDecisionState)                   \
-  op (aml_justification, const char)                               \
-  op (auditor_priv, const struct TALER_AuditorPrivateKeyP)         \
-  op (auditor_pub, const struct TALER_AuditorPublicKeyP)           \
-  op (master_priv, const struct TALER_MasterPrivateKeyP)           \
-  op (master_pub, const struct TALER_MasterPublicKeyP)             \
-  op (purse_priv, const struct TALER_PurseContractPrivateKeyP)     \
-  op (purse_pub, const struct TALER_PurseContractPublicKeyP)       \
-  op (merge_priv, const struct TALER_PurseMergePrivateKeyP)        \
-  op (merge_pub, const struct TALER_PurseMergePublicKeyP)          \
-  op (contract_priv, const struct TALER_ContractDiffiePrivateP)    \
-  op (reserve_priv, const struct TALER_ReservePrivateKeyP)         \
-  op (reserve_sig, const struct TALER_ReserveSignatureP)           \
-  op (h_payto, const struct TALER_PaytoHashP)                      \
-  op (planchet_secret, const struct TALER_PlanchetMasterSecretP)   \
-  op (refresh_secret, const struct TALER_RefreshMasterSecretP)     \
-  op (reserve_pub, const struct TALER_ReservePublicKeyP)           \
-  op (merchant_priv, const struct TALER_MerchantPrivateKeyP)       \
-  op (merchant_pub, const struct TALER_MerchantPublicKeyP)         \
-  op (merchant_sig, const struct TALER_MerchantSignatureP)         \
-  op (wtid, const struct TALER_WireTransferIdentifierRawP)         \
-  op (bank_auth_data, const struct TALER_BANK_AuthenticationData)  \
-  op (contract_terms, const json_t)                                \
-  op (wire_details, const json_t)                                  \
-  op (exchange_url, const char)                                    \
-  op (auditor_url, const char)                                     \
-  op (exchange_bank_account_url, const char)                       \
-  op (taler_uri, const char)                                       \
-  op (payto_uri, const char)                                       \
-  op (kyc_url, const char)                                         \
-  op (web_url, const char)                                         \
-  op (row, const uint64_t)                                         \
-  op (legi_requirement_row, const uint64_t)                        \
-  op (array_length, const unsigned int)                            \
-  op (credit_payto_uri, const char)                                \
-  op (debit_payto_uri, const char)                                 \
-  op (order_id, const char)                                        \
-  op (amount, const struct TALER_Amount)                           \
-  op (amount_with_fee, const struct TALER_Amount)                  \
-  op (batch_cmds, struct TALER_TESTING_Command)                    \
-  op (uuid, const struct GNUNET_Uuid)                              \
-  op (fresh_coins, const struct TALER_TESTING_FreshCoinData *)     \
-  op (claim_token, const struct TALER_ClaimTokenP)                 \
-  op (relative_time, const struct GNUNET_TIME_Relative)            \
-  op (fakebank, struct TALER_FAKEBANK_Handle)                      \
-  op (keys, struct TALER_EXCHANGE_Keys)                            \
-  op (process, struct GNUNET_OS_Process *)
+        op (bank_row, const uint64_t)                                    \
+        op (officer_pub, const struct TALER_AmlOfficerPublicKeyP)        \
+        op (officer_priv, const struct TALER_AmlOfficerPrivateKeyP)      \
+        op (officer_name, const char)                                    \
+        op (aml_decision, enum TALER_AmlDecisionState)                   \
+        op (aml_justification, const char)                               \
+        op (auditor_priv, const struct TALER_AuditorPrivateKeyP)         \
+        op (auditor_pub, const struct TALER_AuditorPublicKeyP)           \
+        op (master_priv, const struct TALER_MasterPrivateKeyP)           \
+        op (master_pub, const struct TALER_MasterPublicKeyP)             \
+        op (purse_priv, const struct TALER_PurseContractPrivateKeyP)     \
+        op (purse_pub, const struct TALER_PurseContractPublicKeyP)       \
+        op (merge_priv, const struct TALER_PurseMergePrivateKeyP)        \
+        op (merge_pub, const struct TALER_PurseMergePublicKeyP)          \
+        op (contract_priv, const struct TALER_ContractDiffiePrivateP)    \
+        op (reserve_priv, const struct TALER_ReservePrivateKeyP)         \
+        op (reserve_sig, const struct TALER_ReserveSignatureP)           \
+        op (h_payto, const struct TALER_PaytoHashP)                      \
+        op (planchet_secret, const struct TALER_PlanchetMasterSecretP)   \
+        op (refresh_secret, const struct TALER_RefreshMasterSecretP)     \
+        op (reserve_pub, const struct TALER_ReservePublicKeyP)           \
+        op (merchant_priv, const struct TALER_MerchantPrivateKeyP)       \
+        op (merchant_pub, const struct TALER_MerchantPublicKeyP)         \
+        op (merchant_sig, const struct TALER_MerchantSignatureP)         \
+        op (wtid, const struct TALER_WireTransferIdentifierRawP)         \
+        op (bank_auth_data, const struct TALER_BANK_AuthenticationData)  \
+        op (contract_terms, const json_t)                                \
+        op (wire_details, const json_t)                                  \
+        op (exchange_url, const char)                                    \
+        op (auditor_url, const char)                                     \
+        op (exchange_bank_account_url, const char)                       \
+        op (taler_uri, const char)                                       \
+        op (payto_uri, const char)                                       \
+        op (kyc_url, const char)                                         \
+        op (web_url, const char)                                         \
+        op (row, const uint64_t)                                         \
+        op (legi_requirement_row, const uint64_t)                        \
+        op (array_length, const unsigned int)                            \
+        op (credit_payto_uri, const char)                                \
+        op (debit_payto_uri, const char)                                 \
+        op (order_id, const char)                                        \
+        op (amount, const struct TALER_Amount)                           \
+        op (amount_with_fee, const struct TALER_Amount)                  \
+        op (batch_cmds, struct TALER_TESTING_Command)                    \
+        op (uuid, const struct GNUNET_Uuid)                              \
+        op (fresh_coins, const struct TALER_TESTING_FreshCoinData *)     \
+        op (claim_token, const struct TALER_ClaimTokenP)                 \
+        op (relative_time, const struct GNUNET_TIME_Relative)            \
+        op (fakebank, struct TALER_FAKEBANK_Handle)                      \
+        op (keys, struct TALER_EXCHANGE_Keys)                            \
+        op (process, struct GNUNET_OS_Process *)
 
 
 /**
  * Call #op on all indexed traits.
  */
 #define TALER_TESTING_INDEXED_TRAITS(op)                                \
-  op (denom_pub, const struct TALER_EXCHANGE_DenomPublicKey)            \
-  op (denom_sig, const struct TALER_DenominationSignature)              \
-  op (amounts, const struct TALER_Amount)                               \
-  op (deposit_amount, const struct TALER_Amount)                        \
-  op (deposit_fee_amount, const struct TALER_Amount)                    \
-  op (age_commitment, const struct TALER_AgeCommitment)                 \
-  op (age_commitment_proof, const struct TALER_AgeCommitmentProof)      \
-  op (h_age_commitment, const struct TALER_AgeCommitmentHash)           \
-  op (reserve_history, const struct TALER_EXCHANGE_ReserveHistoryEntry) \
-  op (coin_history, const struct TALER_EXCHANGE_CoinHistoryEntry) \
-  op (planchet_secrets, const struct TALER_PlanchetMasterSecretP)       \
-  op (exchange_wd_value, const struct TALER_ExchangeWithdrawValues)     \
-  op (coin_priv, const struct TALER_CoinSpendPrivateKeyP)               \
-  op (coin_pub, const struct TALER_CoinSpendPublicKeyP)                 \
-  op (coin_sig, const struct TALER_CoinSpendSignatureP)                 \
-  op (absolute_time, const struct GNUNET_TIME_Absolute)                 \
-  op (timestamp, const struct GNUNET_TIME_Timestamp)                    \
-  op (wire_deadline, const struct GNUNET_TIME_Timestamp)                \
-  op (refund_deadline, const struct GNUNET_TIME_Timestamp)              \
-  op (exchange_pub, const struct TALER_ExchangePublicKeyP)              \
-  op (exchange_sig, const struct TALER_ExchangeSignatureP)              \
-  op (blinding_key, const union GNUNET_CRYPTO_BlindingSecretP)         \
-  op (h_blinded_coin, const struct TALER_BlindedCoinHashP)
+        op (denom_pub, const struct TALER_EXCHANGE_DenomPublicKey)            \
+        op (denom_sig, const struct TALER_DenominationSignature)              \
+        op (amounts, const struct TALER_Amount)                               \
+        op (deposit_amount, const struct TALER_Amount)                        \
+        op (deposit_fee_amount, const struct TALER_Amount)                    \
+        op (age_commitment, const struct TALER_AgeCommitment)                 \
+        op (age_commitment_proof, const struct TALER_AgeCommitmentProof)      \
+        op (h_age_commitment, const struct TALER_AgeCommitmentHash)           \
+        op (reserve_history, const struct TALER_EXCHANGE_ReserveHistoryEntry) \
+        op (coin_history, const struct TALER_EXCHANGE_CoinHistoryEntry) \
+        op (planchet_secrets, const struct TALER_PlanchetMasterSecretP)       \
+        op (exchange_wd_value, const struct TALER_ExchangeWithdrawValues)     \
+        op (coin_priv, const struct TALER_CoinSpendPrivateKeyP)               \
+        op (coin_pub, const struct TALER_CoinSpendPublicKeyP)                 \
+        op (coin_sig, const struct TALER_CoinSpendSignatureP)                 \
+        op (absolute_time, const struct GNUNET_TIME_Absolute)                 \
+        op (timestamp, const struct GNUNET_TIME_Timestamp)                    \
+        op (wire_deadline, const struct GNUNET_TIME_Timestamp)                \
+        op (refund_deadline, const struct GNUNET_TIME_Timestamp)              \
+        op (exchange_pub, const struct TALER_ExchangePublicKeyP)              \
+        op (exchange_sig, const struct TALER_ExchangeSignatureP)              \
+        op (blinding_key, const union GNUNET_CRYPTO_BlindingSecretP)         \
+        op (h_blinded_coin, const struct TALER_BlindedCoinHashP)
 
 TALER_TESTING_SIMPLE_TRAITS (TALER_TESTING_MAKE_DECL_SIMPLE_TRAIT)
 
diff --git a/src/testing/.gitignore b/src/testing/.gitignore
index 6cac81c82..e1075ab16 100644
--- a/src/testing/.gitignore
+++ b/src/testing/.gitignore
@@ -10,6 +10,8 @@ test_exchange_api_revocation_cs
 test_exchange_api_revocation_rsa
 test_exchange_api_age_restriction_cs
 test_exchange_api_age_restriction_rsa
+test_exchange_api_conflicts_cs
+test_exchange_api_conflicts_rsa
 report*
 test_exchange_management_api_cs
 test_exchange_management_api_rsa
diff --git a/src/testing/Makefile.am b/src/testing/Makefile.am
index 6a07c933d..ae713ab67 100644
--- a/src/testing/Makefile.am
+++ b/src/testing/Makefile.am
@@ -155,6 +155,8 @@ check_PROGRAMS = \
   test_exchange_api_rsa \
   test_exchange_api_age_restriction_cs \
   test_exchange_api_age_restriction_rsa \
+  test_exchange_api_conflicts_cs \
+  test_exchange_api_conflicts_rsa \
   test_exchange_api_keys_cherry_picking_cs \
   test_exchange_api_keys_cherry_picking_rsa \
   test_exchange_api_revocation_cs \
@@ -307,6 +309,38 @@ test_exchange_api_age_restriction_rsa_LDADD = \
   -ljansson \
   $(XLIB)
 
+test_exchange_api_conflicts_cs_SOURCES = \
+  test_exchange_api_conflicts.c
+test_exchange_api_conflicts_cs_LDADD = \
+  libtalertesting.la \
+  $(top_builddir)/src/lib/libtalerexchange.la \
+  $(LIBGCRYPT_LIBS) \
+  $(top_builddir)/src/bank-lib/libtalerfakebank.la \
+  $(top_builddir)/src/bank-lib/libtalerbank.la \
+  $(top_builddir)/src/json/libtalerjson.la \
+  $(top_builddir)/src/util/libtalerutil.la \
+  $(top_builddir)/src/extensions/libtalerextensions.la \
+  -lgnunetcurl \
+  -lgnunetutil \
+  -ljansson \
+  $(XLIB)
+
+test_exchange_api_conflicts_rsa_SOURCES = \
+  test_exchange_api_conflicts.c
+test_exchange_api_conflicts_rsa_LDADD = \
+  libtalertesting.la \
+  $(top_builddir)/src/lib/libtalerexchange.la \
+  $(LIBGCRYPT_LIBS) \
+  $(top_builddir)/src/bank-lib/libtalerfakebank.la \
+  $(top_builddir)/src/bank-lib/libtalerbank.la \
+  $(top_builddir)/src/json/libtalerjson.la \
+  $(top_builddir)/src/util/libtalerutil.la \
+  $(top_builddir)/src/extensions/libtalerextensions.la \
+  -lgnunetcurl \
+  -lgnunetutil \
+  -ljansson \
+  $(XLIB)
+
 test_exchange_p2p_cs_SOURCES = \
   test_exchange_p2p.c
 test_exchange_p2p_cs_LDADD = \
diff --git a/src/testing/test_exchange_api_conflicts-cs.conf b/src/testing/test_exchange_api_conflicts-cs.conf
new file mode 100644
index 000000000..c15d55490
--- /dev/null
+++ b/src/testing/test_exchange_api_conflicts-cs.conf
@@ -0,0 +1,4 @@
+# This file is in the public domain.
+#
+@INLINE@ test_exchange_api_conflicts.conf
+@INLINE@ coins-cs.conf
diff --git a/src/testing/test_exchange_api_conflicts-rsa.conf b/src/testing/test_exchange_api_conflicts-rsa.conf
new file mode 100644
index 000000000..f56111eee
--- /dev/null
+++ b/src/testing/test_exchange_api_conflicts-rsa.conf
@@ -0,0 +1,4 @@
+# This file is in the public domain.
+#
+@INLINE@ test_exchange_api_conflicts.conf
+@INLINE@ coins-rsa.conf
diff --git a/src/testing/test_exchange_api_conflicts.c b/src/testing/test_exchange_api_conflicts.c
new file mode 100644
index 000000000..070809d9d
--- /dev/null
+++ b/src/testing/test_exchange_api_conflicts.c
@@ -0,0 +1,312 @@
+/*
+  This file is part of TALER
+  Copyright (C) 2023 Taler Systems SA
+
+  TALER is free software; you can redistribute it and/or modify
+  it under the terms of the GNU General Public License as
+  published by the Free Software Foundation; either version 3, or
+  (at your option) any later version.
+
+  TALER is distributed in the hope that it will be useful, but
+  WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+  GNU General Public License for more details.
+
+  You should have received a copy of the GNU General Public
+  License along with TALER; see the file COPYING.  If not, see
+  <http://www.gnu.org/licenses/>
+*/
+/**
+ * @file testing/test_exchange_api_conflicts.c
+ * @brief testcase to test exchange's handling of coin conflicts: same private
+ *        keys but different denominations or age restrictions
+ * @author Özgür Kesim
+ */
+#include "platform.h"
+#include "taler_util.h"
+#include "taler_signatures.h"
+#include "taler_exchange_service.h"
+#include "taler_json_lib.h"
+#include <gnunet/gnunet_util_lib.h>
+#include <gnunet/gnunet_testing_lib.h>
+#include <microhttpd.h>
+#include "taler_bank_service.h"
+#include "taler_fakebank_lib.h"
+#include "taler_testing_lib.h"
+#include "taler_extensions.h"
+
+/**
+ * Configuration file we use.  One (big) configuration is used
+ * for the various components for this test.
+ */
+static char *config_file;
+
+/**
+ * Our credentials.
+ */
+static struct TALER_TESTING_Credentials cred;
+
+/**
+ * Some tests behave differently when using CS as we cannot
+ * reuse the coin private key for different denominations
+ * due to the derivation of it with the /csr values. Hence
+ * some tests behave differently in CS mode, hence this
+ * flag.
+ */
+static bool uses_cs;
+
+/**
+ * Execute the taler-exchange-wirewatch command with
+ * our configuration file.
+ *
+ * @param label label to use for the command.
+ */
+#define CMD_EXEC_WIREWATCH(label) \
+        TALER_TESTING_cmd_exec_wirewatch2 (label, config_file, \
+                                           "exchange-account-2")
+
+/**
+ * Execute the taler-exchange-aggregator, closer and transfer commands with
+ * our configuration file.
+ *
+ * @param label label to use for the command.
+ */
+#define CMD_EXEC_AGGREGATOR(label) \
+        TALER_TESTING_cmd_sleep ("sleep-before-aggregator", 2), \
+        TALER_TESTING_cmd_exec_aggregator (label "-aggregator", config_file), \
+        TALER_TESTING_cmd_exec_transfer (label "-transfer", config_file)
+
+
+/**
+ * Run wire transfer of funds from some user's account to the
+ * exchange.
+ *
+ * @param label label to use for the command.
+ * @param amount amount to transfer, i.e. "EUR:1"
+ */
+#define CMD_TRANSFER_TO_EXCHANGE(label,amount) \
+        TALER_TESTING_cmd_admin_add_incoming (label, amount, \
+                                              &cred.ba,                \
+                                              cred.user42_payto)
+
+/**
+ * Main function that will tell the interpreter what commands to
+ * run.
+ *
+ * @param cls closure
+ * @param is interpreter we use to run commands
+ */
+static void
+run (void *cls,
+     struct TALER_TESTING_Interpreter *is)
+{
+  (void) cls;
+  /**
+   * Test withdrawal with conflicting coins.
+   */
+  struct TALER_TESTING_Command withdraw_conflict_denom[] = {
+    /**
+     * Move money to the exchange's bank account.
+     */
+    CMD_TRANSFER_TO_EXCHANGE ("create-reserve-denom",
+                              "EUR:21.14"),
+    TALER_TESTING_cmd_check_bank_admin_transfer ("check-create-reserve-denom",
+                                                 "EUR:21.14",
+                                                 cred.user42_payto,
+                                                 cred.exchange_payto,
+                                                 "create-reserve-denom"),
+    /**
+     * Make a reserve exist, according to the previous
+     * transfer.
+     */
+    CMD_EXEC_WIREWATCH ("wirewatch-conflict-denom"),
+    /**
+     * Withdraw EUR:0.10, EUR:1, EUR:5, EUR:15, but using the same private key each time.
+     */
+    TALER_TESTING_cmd_batch_withdraw_with_conflict ("withdraw-coin-denom-1",
+                                                    "create-reserve-denom",
+                                                    true,
+                                                    0, /* age */
+                                                    MHD_HTTP_OK,
+                                                    "EUR:1",
+                                                    "EUR:5",
+                                                    "EUR:10",
+                                                    "EUR:0.10",
+                                                    NULL),
+
+    TALER_TESTING_cmd_end ()
+  };
+
+  struct TALER_TESTING_Command spend_conflict_denom[] = {
+    /**
+     * Spend the coin.
+     */
+    TALER_TESTING_cmd_deposit ("deposit-denom",
+                               "withdraw-coin-denom-1",
+                               0,
+                               cred.user42_payto,
+                               "{\"items\":[{\"name\":\"ice cream\",\"value\":1}]}",
+                               GNUNET_TIME_UNIT_ZERO,
+                               "EUR:0.99",
+                               MHD_HTTP_OK),
+    TALER_TESTING_cmd_deposit ("deposit-denom-conflict",
+                               "withdraw-coin-denom-1",
+                               1,
+                               cred.user42_payto,
+                               "{\"items\":[{\"name\":\"ice cream\",\"value\":1}]}",
+                               GNUNET_TIME_UNIT_ZERO,
+                               "EUR:4.99",
+                               /* Note: For CS, even though the master secret is the
+                                * same for each coin, their private keys differ due
+                                * to the random choice of the nonce by the exchange. */
+                               uses_cs ? MHD_HTTP_OK : MHD_HTTP_CONFLICT),
+    TALER_TESTING_cmd_deposit ("deposit-denom-conflict-2",
+                               "withdraw-coin-denom-1",
+                               2,
+                               cred.user42_payto,
+                               "{\"items\":[{\"name\":\"ice cream\",\"value\":1}]}",
+                               GNUNET_TIME_UNIT_ZERO,
+                               "EUR:9.99",
+                               /* Note: For CS, even though the master secret is the
+                                * same for each coin, their private keys differ due
+                                * to the random choice of the nonce by the exchange. */
+                               uses_cs ? MHD_HTTP_OK : MHD_HTTP_CONFLICT),
+    TALER_TESTING_cmd_deposit ("deposit-denom-conflict-3",
+                               "withdraw-coin-denom-1",
+                               3,
+                               cred.user42_payto,
+                               "{\"items\":[{\"name\":\"ice cream\",\"value\":1}]}",
+                               GNUNET_TIME_UNIT_ZERO,
+                               "EUR:0.09",
+                               /* Note: For CS, even though the master secret is the
+                                * same for each coin, their private keys differ due
+                                * to the random choice of the nonce by the exchange. */
+                               uses_cs ? MHD_HTTP_OK : MHD_HTTP_CONFLICT),
+    TALER_TESTING_cmd_end ()
+  };
+
+  struct TALER_TESTING_Command withdraw_conflict_age[] = {
+    /**
+     * Move money to the exchange's bank account.
+     */
+    CMD_TRANSFER_TO_EXCHANGE ("create-reserve-age",
+                              "EUR:3.03"),
+    TALER_TESTING_cmd_check_bank_admin_transfer ("check-create-reserve-age",
+                                                 "EUR:3.03",
+                                                 cred.user42_payto,
+                                                 cred.exchange_payto,
+                                                 "create-reserve-age"),
+    /**
+     * Make a reserve exist, according to the previous
+     * transfer.
+     */
+    CMD_EXEC_WIREWATCH ("wirewatch-conflict-age"),
+    /**
+     * Withdraw EUR:1, EUR:5, EUR:15, but using the same private key each time.
+     */
+    TALER_TESTING_cmd_batch_withdraw_with_conflict ("withdraw-coin-age-1",
+                                                    "create-reserve-age",
+                                                    true,
+                                                    10, /* age */
+                                                    MHD_HTTP_OK,
+                                                    "EUR:1",
+                                                    "EUR:1",
+                                                    "EUR:1",
+                                                    NULL),
+
+    TALER_TESTING_cmd_end ()
+  };
+
+  struct TALER_TESTING_Command spend_conflict_age[] = {
+    /**
+     * Spend the coin.
+     */
+    TALER_TESTING_cmd_deposit ("deposit-age",
+                               "withdraw-coin-age-1",
+                               0,
+                               cred.user42_payto,
+                               "{\"items\":[{\"name\":\"ice cream\",\"value\":1}]}",
+                               GNUNET_TIME_UNIT_ZERO,
+                               "EUR:0.99",
+                               MHD_HTTP_OK),
+    TALER_TESTING_cmd_deposit ("deposit-age-conflict",
+                               "withdraw-coin-age-1",
+                               1,
+                               cred.user42_payto,
+                               "{\"items\":[{\"name\":\"ice cream\",\"value\":1}]}",
+                               GNUNET_TIME_UNIT_ZERO,
+                               "EUR:0.99",
+                               MHD_HTTP_CONFLICT),
+    TALER_TESTING_cmd_deposit ("deposit-age-conflict-2",
+                               "withdraw-coin-age-1",
+                               2,
+                               cred.user42_payto,
+                               "{\"items\":[{\"name\":\"ice cream\",\"value\":1}]}",
+                               GNUNET_TIME_UNIT_ZERO,
+                               "EUR:0.99",
+                               MHD_HTTP_CONFLICT),
+    TALER_TESTING_cmd_end ()
+  };
+
+
+  {
+    struct TALER_TESTING_Command commands[] = {
+      TALER_TESTING_cmd_run_fakebank ("run-fakebank",
+                                      cred.cfg,
+                                      "exchange-account-2"),
+      TALER_TESTING_cmd_system_start ("start-taler",
+                                      config_file,
+                                      "-e",
+                                      NULL),
+      TALER_TESTING_cmd_get_exchange ("get-exchange",
+                                      cred.cfg,
+                                      NULL,
+                                      true,
+                                      true),
+      TALER_TESTING_cmd_batch ("withdraw-conflict-denom",
+                               withdraw_conflict_denom),
+      TALER_TESTING_cmd_batch ("spend-conflict-denom",
+                               spend_conflict_denom),
+      TALER_TESTING_cmd_batch ("withdraw-conflict-age",
+                               withdraw_conflict_age),
+      TALER_TESTING_cmd_batch ("spend-conflict-age",
+                               spend_conflict_age),
+      /* End the suite. */
+      TALER_TESTING_cmd_end ()
+    };
+
+    TALER_TESTING_run (is,
+                       commands);
+  }
+}
+
+
+int
+main (int argc,
+      char *const *argv)
+{
+  (void) argc;
+  {
+    char *cipher;
+
+    cipher = GNUNET_STRINGS_get_suffix_from_binary_name (argv[0]);
+    GNUNET_assert (NULL != cipher);
+    uses_cs = (0 == strcmp (cipher,
+                            "cs"));
+    GNUNET_asprintf (&config_file,
+                     "test_exchange_api_conflicts-%s.conf",
+                     cipher);
+    GNUNET_free (cipher);
+  }
+  return TALER_TESTING_main (argv,
+                             "INFO",
+                             config_file,
+                             "exchange-account-2",
+                             TALER_TESTING_BS_FAKEBANK,
+                             &cred,
+                             &run,
+                             NULL);
+}
+
+
+/* end of test_exchange_api_conflicts.c */
diff --git a/src/testing/test_exchange_api_conflicts.conf b/src/testing/test_exchange_api_conflicts.conf
new file mode 100644
index 000000000..d04379f05
--- /dev/null
+++ b/src/testing/test_exchange_api_conflicts.conf
@@ -0,0 +1,81 @@
+# This file is in the public domain.
+#
+
+[PATHS]
+TALER_TEST_HOME = test_exchange_api_home/
+
+[taler]
+CURRENCY = EUR
+CURRENCY_ROUND_UNIT = EUR:0.01
+
+[auditor]
+BASE_URL = "http://localhost:8083/"
+PORT = 8083
+PUBLIC_KEY = T0XJ9QZ59YDN7QG3RE40SB2HY7W0ASR1EKF4WZDGZ1G159RSQC80
+TINY_AMOUNT = EUR:0.01
+
+[auditordb-postgres]
+CONFIG = "postgres:///talercheck"
+
+[bank]
+HTTP_PORT = 8082
+
+[exchange]
+TERMS_ETAG = tos
+PRIVACY_ETAG = 0
+PORT = 8081
+AML_THRESHOLD = "EUR:99999999"
+MASTER_PUBLIC_KEY = 98NJW3CQHZQGQXTY3K85K531XKPAPAVV4Q5V8PYYRR00NJGZWNVG
+DB = postgres
+BASE_URL = "http://localhost:8081/"
+EXPIRE_SHARD_SIZE ="300 ms"
+EXPIRE_IDLE_SLEEP_INTERVAL ="1 s"
+
+[exchangedb-postgres]
+CONFIG = "postgres:///talercheck"
+
+[taler-exchange-secmod-cs]
+LOOKAHEAD_SIGN = "24 days"
+
+[taler-exchange-secmod-rsa]
+LOOKAHEAD_SIGN = "24 days"
+
+[taler-exchange-secmod-eddsa]
+LOOKAHEAD_SIGN = "24 days"
+DURATION = "14 days"
+
+
+[exchange-account-1]
+PAYTO_URI = "payto://x-taler-bank/localhost/42?receiver-name=42"
+ENABLE_DEBIT = YES
+ENABLE_CREDIT = YES
+
+[exchange-accountcredentials-1]
+WIRE_GATEWAY_AUTH_METHOD = none
+WIRE_GATEWAY_URL = "http://localhost:8082/accounts/42/taler-wire-gateway/"
+
+[admin-accountcredentials-1]
+WIRE_GATEWAY_AUTH_METHOD = none
+WIRE_GATEWAY_URL = "http://localhost:8082/accounts/42/taler-wire-gateway/"
+
+[exchange-account-2]
+PAYTO_URI = "payto://x-taler-bank/localhost/2?receiver-name=2"
+ENABLE_DEBIT = YES
+ENABLE_CREDIT = YES
+
+[exchange-accountcredentials-2]
+WIRE_GATEWAY_AUTH_METHOD = basic
+USERNAME = Exchange
+PASSWORD = x
+WIRE_GATEWAY_URL = "http://localhost:8082/accounts/2/taler-wire-gateway/"
+
+[admin-accountcredentials-2]
+WIRE_GATEWAY_AUTH_METHOD = basic
+USERNAME = Exchange
+PASSWORD = x
+WIRE_GATEWAY_URL = "http://localhost:8082/accounts/2/taler-wire-gateway/"
+
+
+[exchange-extension-age_restriction]
+ENABLED = YES
+#AGE_GROUPS = "8:10:12:14:16:18:21"
diff --git a/src/testing/testing_api_cmd_batch_withdraw.c b/src/testing/testing_api_cmd_batch_withdraw.c
index a106b8150..98bbb7e26 100644
--- a/src/testing/testing_api_cmd_batch_withdraw.c
+++ b/src/testing/testing_api_cmd_batch_withdraw.c
@@ -173,6 +173,11 @@ struct BatchWithdrawState
    * Same for all coins in the batch.
    */
   uint8_t age;
+
+  /**
+   * Force a conflict:
+   */
+  bool force_conflict;
 };
 
 
@@ -195,9 +200,10 @@ reserve_batch_withdraw_cb (void *cls,
   ws->wsh = NULL;
   if (ws->expected_response_code != wr->hr.http_status)
   {
-    TALER_TESTING_unexpected_status (is,
-                                     wr->hr.http_status,
-                                     ws->expected_response_code);
+    TALER_TESTING_unexpected_status_with_body (is,
+                                               wr->hr.http_status,
+                                               ws->expected_response_code,
+                                               wr->hr.reply);
     return;
   }
   switch (wr->hr.http_status)
@@ -265,6 +271,8 @@ batch_withdraw_run (void *cls,
   const struct TALER_TESTING_Command *create_reserve;
   const struct TALER_EXCHANGE_DenomPublicKey *dpk;
   struct TALER_EXCHANGE_WithdrawCoinInput wcis[ws->num_coins];
+  struct TALER_PlanchetMasterSecretP conflict_ps = {0};
+  struct TALER_AgeMask mask = {0};
 
   (void) cmd;
   ws->is = is;
@@ -297,12 +305,37 @@ batch_withdraw_run (void *cls,
     = TALER_reserve_make_payto (ws->exchange_url,
                                 &ws->reserve_pub);
 
+  if (0 < ws->age)
+    mask = TALER_extensions_get_age_restriction_mask ();
+
+  if (ws->force_conflict)
+    TALER_planchet_master_setup_random (&conflict_ps);
+
   for (unsigned int i = 0; i<ws->num_coins; i++)
   {
     struct CoinState *cs = &ws->coins[i];
     struct TALER_EXCHANGE_WithdrawCoinInput *wci = &wcis[i];
 
-    TALER_planchet_master_setup_random (&cs->ps);
+    if (ws->force_conflict)
+      cs->ps = conflict_ps;
+    else
+      TALER_planchet_master_setup_random (&cs->ps);
+
+    if (0 < ws->age)
+    {
+      struct GNUNET_HashCode seed = {0};
+      GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
+                                  &seed,
+                                  sizeof(seed));
+      TALER_age_restriction_commit (&mask,
+                                    ws->age,
+                                    &seed,
+                                    &cs->age_commitment_proof);
+      TALER_age_commitment_hash (&cs->age_commitment_proof.commitment,
+                                 &cs->h_age_commitment);
+    }
+
+
     dpk = TALER_TESTING_find_pk (keys,
                                  &cs->amount,
                                  ws->age > 0);
@@ -455,12 +488,14 @@ batch_withdraw_traits (void *cls,
 
 
 struct TALER_TESTING_Command
-TALER_TESTING_cmd_batch_withdraw (const char *label,
-                                  const char *reserve_reference,
-                                  uint8_t age,
-                                  unsigned int expected_response_code,
-                                  const char *amount,
-                                  ...)
+TALER_TESTING_cmd_batch_withdraw_with_conflict (
+  const char *label,
+  const char *reserve_reference,
+  bool conflict,
+  uint8_t age,
+  unsigned int expected_response_code,
+  const char *amount,
+  ...)
 {
   struct BatchWithdrawState *ws;
   unsigned int cnt;
@@ -470,6 +505,7 @@ TALER_TESTING_cmd_batch_withdraw (const char *label,
   ws->age = age;
   ws->reserve_reference = reserve_reference;
   ws->expected_response_code = expected_response_code;
+  ws->force_conflict = conflict;
 
   cnt = 1;
   va_start (ap,
@@ -487,23 +523,6 @@ TALER_TESTING_cmd_batch_withdraw (const char *label,
   {
     struct CoinState *cs = &ws->coins[i];
 
-    if (0 < age)
-    {
-      struct GNUNET_HashCode seed;
-      struct TALER_AgeMask mask;
-
-      mask = TALER_extensions_get_age_restriction_mask ();
-      GNUNET_CRYPTO_random_block (GNUNET_CRYPTO_QUALITY_WEAK,
-                                  &seed,
-                                  sizeof(seed));
-      TALER_age_restriction_commit (&mask,
-                                    age,
-                                    &seed,
-                                    &cs->age_commitment_proof);
-      TALER_age_commitment_hash (&cs->age_commitment_proof.commitment,
-                                 &cs->h_age_commitment);
-    }
-
     if (GNUNET_OK !=
         TALER_string_to_amount (amount,
                                 &cs->amount))