[nsommer]

References

Upstreamed from payment-service IX-3421 (payment-service#4898)

Problem

The iOS app sends IBANs with a space every four characters. In payment-service nothing between the controller and the PSP normalised them, so the stored value differed from the same IBAN typed without spaces — last4 was derived from the spaced string, and exact-string comparisons against the ban list silently missed those rows.

The normalisation itself is generic. Every service that stores an IBAN wants the same five lines, so it belongs in the gem rather than in one app.

Solution

NxtSupport::Iban.normalize(iban) upcases and strips all whitespace:

NxtSupport::Iban.normalize('de89 3704 0044 0532 0130 00') # => "DE89370400440532013000"

It does not validate — callers keep using their own IBAN validator (payment-service uses SEPA::IBANValidator). Non-strings are returned unchanged, and the input is not mutated.

#to_s, #country_code, #last4 and #redacted_s all read from the normalized form, so they answer the same for an IBAN typed with spaces as for one typed without:

iban = NxtSupport::Iban.new(iban: 'de89 3704 0044 0532 0130 00')

iban.to_s          # => "DE89370400440532013000"
iban.country_code  # => "DE"
iban.last4         # => "3000"
iban.redacted_s    # => "DE****3000"

#redacted_s is for anywhere an IBAN would otherwise reach a log line, an error message or a support tool. It keeps the country code and the last four characters — enough to tell two accounts apart — and masks everything between. On an IBAN of six characters or fewer, the last four would give the rest away, so only the country code survives.

#to_s and #redacted_s return '' for a missing IBAN; #country_code and #last4 return nil rather than '', so a blank value cannot silently reach a field that shows the last four digits.

Changes

• NxtSupport::Iban under NxtSupport/Util, next to BirthDate
• #to_s, #country_code, #last4 and #redacted_s derived from the normalized form
• Specs ported from payment-service's IbanNormalizer spec, plus coverage for the four readers
• README section, VERSION → 0.7.0, CHANGELOG entry

Once this is released, payment-service drops its own IbanNormalizer and points its 13 call sites here.

🤖 Generated with Claude Code