feat(api): prevent user from connecting to same institution twice

src/FiscalOS.API/Accounts/Connect/Endpoint.cs

@@ -10,9 +10,41 @@ internal static class Endpoint
   }
 
   private static async Task<IResult> HandleAsync(
-    [FromBody] Request request
+    HttpContext httpContext,
+    [FromBody] Request request,
+    [FromServices] AppDbContext appDbContext
   )
   {
+    var userId = httpContext.GetUserId();
+
+    var user = await appDbContext.Users
+      .Include(u => u.Institutions
+        .Where(
+          i => i.Metadata is PlaidMetadata &&
+            ((PlaidMetadata)i.Metadata).PlaidId == request.PlaidInstitutionId
+        )
+      )
+      .ThenInclude(i => i.Metadata)
+      .SingleOrDefaultAsync(u => u.Id == userId);
+
+    if (user is null)
+    {
+      return Results.Problem(
+        statusCode: StatusCodes.Status401Unauthorized,
+        title: "Unauthorized",
+        detail: "You are not authorized to connect an institution. Please log in and try again."
+      );
+    }
+
+    if (user.Institutions.Any())
+    {
+      return Results.Problem(
+        statusCode: StatusCodes.Status409Conflict,
+        title: "Institution already connected",
+        detail: "The user has already connected an institution with the provided Plaid Institution ID."
+      );
+    }
+
     return Results.Ok();
   }
 }

src/FiscalOS.API/Usings.cs

@@ -8,6 +8,7 @@ global using FiscalOS.API.Http;
 global using FiscalOS.API.Login;
 global using FiscalOS.API.Refresh;
 global using FiscalOS.Core.Authentication;
+global using FiscalOS.Infra.Accounts.Plaid;
 global using FiscalOS.Infra.Authentication;
 global using FiscalOS.Infra.Data;
 global using FiscalOS.Infra.DependencyInjection;