Stevan/fiscalos
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(api): validate account institution is connected and allow adding new account

Browse Source
This commit is contained in:
Stevan Freeborn
2026-02-13 12:38:18 -06:00
parent 6ca90ed25a
commit 502f6f61c1
3 changed files with 173 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/FiscalOS.API.Tests/Integration/AddTests.cs
+150 -4
View File
@@ -1,5 +1,5 @@
using Institution = FiscalOS.Core.Accounts.Institution;
using Account = FiscalOS.Core.Accounts.Account;
using Institution = FiscalOS.Core.Accounts.Institution;
namespace FiscalOS.API.Tests.Integration;
@@ -16,7 +16,7 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
}
[Fact]
public async Task Add_WhenCalledWithoutInstitutionIdOrAccountId_ItShouldReturn400WithProblemDetails()
public async Task Add_WhenCalledWithoutInstitutionIdOrAccountIdOrAccountName_ItShouldReturn400WithProblemDetails()
{
var jwt = JwtTokenBuilder.New()
.WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
@@ -35,6 +35,7 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
{
["PlaidInstitutionId"] = ["The PlaidInstitutionId field is required."],
["PlaidAccountId"] = ["The PlaidAccountId field is required."],
["PlaidAccountName"] = ["The PlaidAccountName field is required."],
});
}
@@ -45,7 +46,12 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
.WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
.Build();
using var content = new StringContent(JsonSerializer.Serialize(new { plaidAccountId = "accountId" }), Encoding.UTF8, "application/json");
var json = JsonSerializer.Serialize(new
{
plaidAccountId = "accountId",
plaidAccountName = "Some Account",
});
using var content = new StringContent(json, Encoding.UTF8, "application/json");
using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
{
Content = content
@@ -67,7 +73,12 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
.WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
.Build();
using var content = new StringContent(JsonSerializer.Serialize(new { plaidInstitutionId = "institutionId" }), Encoding.UTF8, "application/json");
var json = JsonSerializer.Serialize(new
{
plaidInstitutionId = "institutionId",
plaidAccountName = "Some Account",
});
using var content = new StringContent(json, Encoding.UTF8, "application/json");
using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
{
Content = content
@@ -82,6 +93,33 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
});
}
[Fact]
public async Task Add_WhenCalledWithoutAccountName_ItShouldReturn400WithProblemDetails()
{
var jwt = JwtTokenBuilder.New()
.WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
.Build();
var json = JsonSerializer.Serialize(new
{
plaidInstitutionId = "institutionId",
plaidAccountId = "accountId",
});
using var content = new StringContent(json, Encoding.UTF8, "application/json");
using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
{
Content = content
};
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
{
["PlaidAccountName"] = ["The PlaidAccountName field is required."],
});
}
[Fact]
public async Task Add_WhenCalledWithNonExistentUser_ItShouldReturn401WithProblemDetails()
{
@@ -93,6 +131,7 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
{
plaidInstitutionId = "id",
plaidAccountId = "id",
plaidAccountName = "Some Account",
});
using var content = new StringContent(json, Encoding.UTF8, "application/json");
using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
@@ -106,6 +145,48 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
await response.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
}
[Fact]
public async Task Add_WhenCalledWithPlaidInstitutionIdThatHasNotBeenAdded_ItShouldReturn400WithProblemDetails()
{
var user = await ExecuteAsync(static async (context, ct, sp) =>
{
var passwordHasher = sp.GetRequiredService<IPasswordHasher>();
var encryptor = sp.GetRequiredService<IEncryptor>();
var userEncryptionKey = await encryptor.GenerateEncryptedKeyAsync(ct);
var user = User.From("User1", passwordHasher.Hash("@Password1"), userEncryptionKey);
await context.AddAsync(user, ct);
await context.SaveChangesAsync(ct);
return user;
}, TestContext.Current.CancellationToken);
var jwt = JwtTokenBuilder.New()
.WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
.Build();
var json = JsonSerializer.Serialize(new
{
plaidInstitutionId = "id",
plaidAccountId = "id",
plaidAccountName = "Some Account",
});
using var content = new StringContent(json, Encoding.UTF8, "application/json");
using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
{
Content = content,
};
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
{
["PlaidInstitutionId"] = ["The PlaidInstitutionId field is invalid. No institution connected with the given PlaidInstitutionId was found for the user."],
});
}
[Fact]
public async Task Add_WhenCalledWithPlaidAccountIdThatHasAlreadyBeenAdded_ItShouldReturn409WithProblemDetails()
{
@@ -143,6 +224,7 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
{
plaidInstitutionId = ((PlaidMetadata)institution.Metadata).PlaidId,
plaidAccountId = ((PlaidAccountMetadata)account.Metadata).PlaidId,
plaidAccountName = ((PlaidAccountMetadata)account.Metadata).PlaidName,
});
using var content = new StringContent(json, Encoding.UTF8, "application/json");
using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
@@ -155,4 +237,68 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
await response.Should().BeProblemDetails(HttpStatusCode.Conflict);
}
[Fact]
public async Task Add_WhenCalledWithNewAccount_ItShouldReturn200()
{
var (user, institution) = await ExecuteAsync(async (context, ct, sp) =>
{
var passwordHasher = sp.GetRequiredService<IPasswordHasher>();
var encryptor = sp.GetRequiredService<IEncryptor>();
var plaidClient = sp.GetRequiredService<PlaidClient>();
var userEncryptionKey = await encryptor.GenerateEncryptedKeyAsync(ct);
var user = User.From("User1", passwordHasher.Hash("@Password1"), userEncryptionKey);
var encryptedAccessToken = await encryptor.EncryptAsyncFor(user, "accessToken", ct);
var plaidMetadata = PlaidMetadata.From("id", "Some Bank", encryptedAccessToken);
var institution = Institution.From("Some Bank", plaidMetadata);
user.AddInstitution(institution);
await context.AddAsync(user, ct);
await context.SaveChangesAsync(ct);
return (user, institution);
}, TestContext.Current.CancellationToken);
var jwt = JwtTokenBuilder.New()
.WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
.Build();
var newAccountId = "newAccountId";
var newAccountName = "New Account";
var json = JsonSerializer.Serialize(new
{
plaidInstitutionId = ((PlaidMetadata)institution.Metadata).PlaidId,
plaidAccountId = newAccountId,
plaidAccountName = newAccountName,
});
using var content = new StringContent(json, Encoding.UTF8, "application/json");
using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
{
Content = content,
};
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
response.StatusCode.Should().Be(HttpStatusCode.OK);
var updatedUser = await ExecuteAsync(
async (context, ct) => await context.Set<User>()
.Include(u => u.Accounts)
.ThenInclude(a => a.Metadata)
.FirstAsync(u => u.Id == user.Id, ct),
TestContext.Current.CancellationToken
);
updatedUser.Accounts.Should().ContainSingle(
a => a.Name == newAccountName &&
a.InstitutionId == institution.Id &&
a.Metadata is PlaidAccountMetadata &&
((PlaidAccountMetadata)a.Metadata).PlaidId == newAccountId &&
((PlaidAccountMetadata)a.Metadata).PlaidName == newAccountName
);
}
}