From 502f6f61c1d9130b8e8c8a0618eaa16fd9800d2a Mon Sep 17 00:00:00 2001 From: Stevan Freeborn <65925598+StevanFreeborn@users.noreply.github.com> Date: Fri, 13 Feb 2026 12:05:01 -0600 Subject: [PATCH] feat(api): validate account institution is connected and allow adding new account --- src/FiscalOS.API/Accounts/Add/Endpoint.cs | 18 +- src/FiscalOS.API/Accounts/Add/Request.cs | 7 + .../Integration/AddTests.cs | 154 +++++++++++++++++- 3 files changed, 173 insertions(+), 6 deletions(-) diff --git a/src/FiscalOS.API/Accounts/Add/Endpoint.cs b/src/FiscalOS.API/Accounts/Add/Endpoint.cs index 80d915e..e55cc09 100644 --- a/src/FiscalOS.API/Accounts/Add/Endpoint.cs +++ b/src/FiscalOS.API/Accounts/Add/Endpoint.cs @@ -1,3 +1,5 @@ +using FiscalOS.Core.Accounts; + namespace FiscalOS.API.Accounts.Add; internal static class Endpoint @@ -19,6 +21,7 @@ internal static class Endpoint var userId = httpContext.GetUserId(); var user = await appDbContext.Users + .Include(u => u.Institutions.Where(i => i.Metadata is PlaidMetadata && ((PlaidMetadata)i.Metadata).PlaidId == request.PlaidInstitutionId)) .Include(u => u.Accounts.Where(a => a.Metadata is PlaidAccountMetadata && ((PlaidAccountMetadata)a.Metadata).PlaidId == request.PlaidAccountId)) .ThenInclude(a => a.Metadata) .SingleOrDefaultAsync(u => u.Id == userId, ct); @@ -28,13 +31,24 @@ internal static class Endpoint return Results.Unauthorized(); } + if (user.Institutions.Any() is false) + { + return Results.ValidationProblem(new Dictionary + { + ["PlaidInstitutionId"] = ["The PlaidInstitutionId field is invalid. No institution connected with the given PlaidInstitutionId was found for the user."], + }); + } + if (user.Accounts.Any()) { return Results.Conflict(); } - // TODO: This is new account - // so we should add to the database + var accountMetadata = PlaidAccountMetadata.From(request.PlaidAccountId, request.PlaidAccountName); + var account = Account.From(user.Institutions.First().Id, request.PlaidAccountName, accountMetadata); + user.AddAccount(account); + + await appDbContext.SaveChangesAsync(ct); return Results.Ok(); } diff --git a/src/FiscalOS.API/Accounts/Add/Request.cs b/src/FiscalOS.API/Accounts/Add/Request.cs index 13c8f56..cb99492 100644 --- a/src/FiscalOS.API/Accounts/Add/Request.cs +++ b/src/FiscalOS.API/Accounts/Add/Request.cs @@ -5,6 +5,7 @@ public record Request : IValidatableObject { public string PlaidInstitutionId { get; init; } = string.Empty; public string PlaidAccountId { get; init; } = string.Empty; + public string PlaidAccountName { get; init; } = string.Empty; public IEnumerable Validate(ValidationContext validationContext) { @@ -19,5 +20,11 @@ public record Request : IValidatableObject var fieldName = nameof(PlaidAccountId); yield return new($"The {fieldName} field is required.", [fieldName]); } + + if (string.IsNullOrWhiteSpace(PlaidAccountName)) + { + var fieldName = nameof(PlaidAccountName); + yield return new($"The {fieldName} field is required.", [fieldName]); + } } } \ No newline at end of file diff --git a/tests/FiscalOS.API.Tests/Integration/AddTests.cs b/tests/FiscalOS.API.Tests/Integration/AddTests.cs index 81e8827..063426f 100644 --- a/tests/FiscalOS.API.Tests/Integration/AddTests.cs +++ b/tests/FiscalOS.API.Tests/Integration/AddTests.cs @@ -1,5 +1,5 @@ -using Institution = FiscalOS.Core.Accounts.Institution; using Account = FiscalOS.Core.Accounts.Account; +using Institution = FiscalOS.Core.Accounts.Institution; namespace FiscalOS.API.Tests.Integration; @@ -16,7 +16,7 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi) } [Fact] - public async Task Add_WhenCalledWithoutInstitutionIdOrAccountId_ItShouldReturn400WithProblemDetails() + public async Task Add_WhenCalledWithoutInstitutionIdOrAccountIdOrAccountName_ItShouldReturn400WithProblemDetails() { var jwt = JwtTokenBuilder.New() .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString()) @@ -35,6 +35,7 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi) { ["PlaidInstitutionId"] = ["The PlaidInstitutionId field is required."], ["PlaidAccountId"] = ["The PlaidAccountId field is required."], + ["PlaidAccountName"] = ["The PlaidAccountName field is required."], }); } @@ -45,7 +46,12 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi) .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString()) .Build(); - using var content = new StringContent(JsonSerializer.Serialize(new { plaidAccountId = "accountId" }), Encoding.UTF8, "application/json"); + var json = JsonSerializer.Serialize(new + { + plaidAccountId = "accountId", + plaidAccountName = "Some Account", + }); + using var content = new StringContent(json, Encoding.UTF8, "application/json"); using var request = new HttpRequestMessage(HttpMethod.Post, AddUri) { Content = content @@ -67,7 +73,12 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi) .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString()) .Build(); - using var content = new StringContent(JsonSerializer.Serialize(new { plaidInstitutionId = "institutionId" }), Encoding.UTF8, "application/json"); + var json = JsonSerializer.Serialize(new + { + plaidInstitutionId = "institutionId", + plaidAccountName = "Some Account", + }); + using var content = new StringContent(json, Encoding.UTF8, "application/json"); using var request = new HttpRequestMessage(HttpMethod.Post, AddUri) { Content = content @@ -82,6 +93,33 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi) }); } + [Fact] + public async Task Add_WhenCalledWithoutAccountName_ItShouldReturn400WithProblemDetails() + { + var jwt = JwtTokenBuilder.New() + .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString()) + .Build(); + + var json = JsonSerializer.Serialize(new + { + plaidInstitutionId = "institutionId", + plaidAccountId = "accountId", + }); + using var content = new StringContent(json, Encoding.UTF8, "application/json"); + using var request = new HttpRequestMessage(HttpMethod.Post, AddUri) + { + Content = content + }; + request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt); + + var response = await Client.SendAsync(request, TestContext.Current.CancellationToken); + + await response.Should().BeValidationProblemDetails(new Dictionary() + { + ["PlaidAccountName"] = ["The PlaidAccountName field is required."], + }); + } + [Fact] public async Task Add_WhenCalledWithNonExistentUser_ItShouldReturn401WithProblemDetails() { @@ -93,6 +131,7 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi) { plaidInstitutionId = "id", plaidAccountId = "id", + plaidAccountName = "Some Account", }); using var content = new StringContent(json, Encoding.UTF8, "application/json"); using var request = new HttpRequestMessage(HttpMethod.Post, AddUri) @@ -106,6 +145,48 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi) await response.Should().BeProblemDetails(HttpStatusCode.Unauthorized); } + [Fact] + public async Task Add_WhenCalledWithPlaidInstitutionIdThatHasNotBeenAdded_ItShouldReturn400WithProblemDetails() + { + var user = await ExecuteAsync(static async (context, ct, sp) => + { + var passwordHasher = sp.GetRequiredService(); + var encryptor = sp.GetRequiredService(); + + var userEncryptionKey = await encryptor.GenerateEncryptedKeyAsync(ct); + var user = User.From("User1", passwordHasher.Hash("@Password1"), userEncryptionKey); + + + await context.AddAsync(user, ct); + await context.SaveChangesAsync(ct); + return user; + }, TestContext.Current.CancellationToken); + + var jwt = JwtTokenBuilder.New() + .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString()) + .Build(); + + var json = JsonSerializer.Serialize(new + { + plaidInstitutionId = "id", + plaidAccountId = "id", + plaidAccountName = "Some Account", + }); + using var content = new StringContent(json, Encoding.UTF8, "application/json"); + using var request = new HttpRequestMessage(HttpMethod.Post, AddUri) + { + Content = content, + }; + request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt); + + var response = await Client.SendAsync(request, TestContext.Current.CancellationToken); + + await response.Should().BeValidationProblemDetails(new Dictionary() + { + ["PlaidInstitutionId"] = ["The PlaidInstitutionId field is invalid. No institution connected with the given PlaidInstitutionId was found for the user."], + }); + } + [Fact] public async Task Add_WhenCalledWithPlaidAccountIdThatHasAlreadyBeenAdded_ItShouldReturn409WithProblemDetails() { @@ -143,6 +224,7 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi) { plaidInstitutionId = ((PlaidMetadata)institution.Metadata).PlaidId, plaidAccountId = ((PlaidAccountMetadata)account.Metadata).PlaidId, + plaidAccountName = ((PlaidAccountMetadata)account.Metadata).PlaidName, }); using var content = new StringContent(json, Encoding.UTF8, "application/json"); using var request = new HttpRequestMessage(HttpMethod.Post, AddUri) @@ -155,4 +237,68 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi) await response.Should().BeProblemDetails(HttpStatusCode.Conflict); } + + [Fact] + public async Task Add_WhenCalledWithNewAccount_ItShouldReturn200() + { + var (user, institution) = await ExecuteAsync(async (context, ct, sp) => + { + var passwordHasher = sp.GetRequiredService(); + var encryptor = sp.GetRequiredService(); + var plaidClient = sp.GetRequiredService(); + + var userEncryptionKey = await encryptor.GenerateEncryptedKeyAsync(ct); + var user = User.From("User1", passwordHasher.Hash("@Password1"), userEncryptionKey); + + var encryptedAccessToken = await encryptor.EncryptAsyncFor(user, "accessToken", ct); + var plaidMetadata = PlaidMetadata.From("id", "Some Bank", encryptedAccessToken); + var institution = Institution.From("Some Bank", plaidMetadata); + + user.AddInstitution(institution); + + await context.AddAsync(user, ct); + await context.SaveChangesAsync(ct); + return (user, institution); + }, TestContext.Current.CancellationToken); + + var jwt = JwtTokenBuilder.New() + .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString()) + .Build(); + + var newAccountId = "newAccountId"; + var newAccountName = "New Account"; + + var json = JsonSerializer.Serialize(new + { + plaidInstitutionId = ((PlaidMetadata)institution.Metadata).PlaidId, + plaidAccountId = newAccountId, + plaidAccountName = newAccountName, + }); + using var content = new StringContent(json, Encoding.UTF8, "application/json"); + using var request = new HttpRequestMessage(HttpMethod.Post, AddUri) + { + Content = content, + }; + request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt); + + var response = await Client.SendAsync(request, TestContext.Current.CancellationToken); + + response.StatusCode.Should().Be(HttpStatusCode.OK); + + var updatedUser = await ExecuteAsync( + async (context, ct) => await context.Set() + .Include(u => u.Accounts) + .ThenInclude(a => a.Metadata) + .FirstAsync(u => u.Id == user.Id, ct), + TestContext.Current.CancellationToken + ); + + updatedUser.Accounts.Should().ContainSingle( + a => a.Name == newAccountName && + a.InstitutionId == institution.Id && + a.Metadata is PlaidAccountMetadata && + ((PlaidAccountMetadata)a.Metadata).PlaidId == newAccountId && + ((PlaidAccountMetadata)a.Metadata).PlaidName == newAccountName + ); + } } \ No newline at end of file