feat(api,core,infra): refactor endpoint routing and add institution account discovery

- Move login and refresh endpoints under a unified /auth route group
- Relocate institution connection logic from /accounts to /institutions
- Implement GET /institutions/{id}/available to fetch real-time Plaid
accounts
- Introduce HttpRequestBuilder utility to streamline integration testing
- Enhance PlaidService with GetAccountsAsync to support account fetching
- Clean up global usings and project structure for better domain
isolation

tests/FiscalOS.API.Tests/Integration/Accounts/AddTests.cs

@@ -1,7 +1,7 @@
 using Account = FiscalOS.Core.Accounts.Account;
 using Institution = FiscalOS.Core.Accounts.Institution;
 
-namespace FiscalOS.API.Tests.Integration;
+namespace FiscalOS.API.Tests.Integration.Accounts;
 
 public class AddTests(TestApi testApi) : IntegrationTest(testApi)
 {
@@ -18,17 +18,12 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Add_WhenCalledWithoutInstitutionIdOrAccountIdOrAccountName_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(AddUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new { })
       .Build();
 
-    using var content = new StringContent(JsonSerializer.Serialize(new { }), Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
-    {
-      Content = content
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -42,22 +37,16 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Add_WhenCalledWithoutInstitutionId_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(AddUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new
+      {
+        plaidAccountId = "accountId",
+        plaidAccountName = "Some Account",
+      })
       .Build();
 
-    var json = JsonSerializer.Serialize(new
-    {
-      plaidAccountId = "accountId",
-      plaidAccountName = "Some Account",
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
-    {
-      Content = content
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -69,22 +58,16 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Add_WhenCalledWithoutAccountId_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(AddUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new
+      {
+        plaidInstitutionId = "institutionId",
+        plaidAccountName = "Some Account",
+      })
       .Build();
 
-    var json = JsonSerializer.Serialize(new
-    {
-      plaidInstitutionId = "institutionId",
-      plaidAccountName = "Some Account",
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
-    {
-      Content = content
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -96,22 +79,16 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Add_WhenCalledWithoutAccountName_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(AddUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new
+      {
+        plaidInstitutionId = "institutionId",
+        plaidAccountId = "accountId",
+      })
       .Build();
 
-    var json = JsonSerializer.Serialize(new
-    {
-      plaidInstitutionId = "institutionId",
-      plaidAccountId = "accountId",
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
-    {
-      Content = content
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -123,23 +100,17 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Add_WhenCalledWithNonExistentUser_ItShouldReturn401WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(AddUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new
+      {
+        plaidInstitutionId = "id",
+        plaidAccountId = "id",
+        plaidAccountName = "Some Account",
+      })
       .Build();
 
-    var json = JsonSerializer.Serialize(new
-    {
-      plaidInstitutionId = "id",
-      plaidAccountId = "id",
-      plaidAccountName = "Some Account",
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
@@ -162,23 +133,17 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
       return user;
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(AddUri)
+      .WithUserId(user.Id)
+      .WithBody(new
+      {
+        plaidInstitutionId = "id",
+        plaidAccountId = "id",
+        plaidAccountName = "Some Account",
+      })
       .Build();
 
-    var json = JsonSerializer.Serialize(new
-    {
-      plaidInstitutionId = "id",
-      plaidAccountId = "id",
-      plaidAccountName = "Some Account",
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -216,23 +181,17 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, institution, account);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(AddUri)
+      .WithUserId(user.Id)
+      .WithBody(new
+      {
+        plaidInstitutionId = ((PlaidMetadata)institution.Metadata!).PlaidId,
+        plaidAccountId = ((PlaidAccountMetadata)account.Metadata!).PlaidId,
+        plaidAccountName = ((PlaidAccountMetadata)account.Metadata).PlaidName,
+      })
       .Build();
 
-    var json = JsonSerializer.Serialize(new
-    {
-      plaidInstitutionId = ((PlaidMetadata)institution.Metadata!).PlaidId,
-      plaidAccountId = ((PlaidAccountMetadata)account.Metadata!).PlaidId,
-      plaidAccountName = ((PlaidAccountMetadata)account.Metadata).PlaidName,
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.Conflict);
@@ -261,25 +220,19 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, institution);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
-      .Build();
-
     var newAccountId = "newAccountId";
     var newAccountName = "New Account";
 
-    var json = JsonSerializer.Serialize(new
-    {
-      plaidInstitutionId = ((PlaidMetadata)institution.Metadata!).PlaidId,
-      plaidAccountId = newAccountId,
-      plaidAccountName = newAccountName,
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
+    using var request = HttpRequestBuilder.New()
+      .Post(AddUri)
+      .WithUserId(user.Id)
+      .WithBody(new
+      {
+        plaidInstitutionId = ((PlaidMetadata)institution.Metadata!).PlaidId,
+        plaidAccountId = newAccountId,
+        plaidAccountName = newAccountName,
+      })
+      .Build();
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 

tests/FiscalOS.API.Tests/Integration/Auth/LoginTests.cs

@@ -1,22 +1,23 @@
-using FiscalOS.API.Tests.Common;
-
-namespace FiscalOS.API.Tests.Integration;
+namespace FiscalOS.API.Tests.Integration.Auth;
 
 public class LoginTests(TestApi testApi) : IntegrationTest(testApi)
 {
-  private static readonly Uri LoginUri = new("/login", UriKind.Relative);
+  private static readonly Uri LoginUri = new("/auth/login", UriKind.Relative);
 
   [Theory]
   [ClassData<LoginValidationTestCases>]
   public async Task Login_WhenUserSubmitsInvalidRequest_ItShouldReturn400WithProblemDetails(LoginValidationTestCase tc)
   {
-    var req = new
-    {
-      username = tc.Username,
-      password = tc.Password,
-    };
+    using var request = HttpRequestBuilder.New()
+      .Post(LoginUri)
+      .WithBody(new
+      {
+        username = tc.Username,
+        password = tc.Password,
+      })
+      .Build();
 
-    var res = await Client.PostAsJsonAsync(LoginUri, req, TestContext.Current.CancellationToken);
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await res.Should().BeValidationProblemDetails(tc.ExpectedErrors);
   }
@@ -24,13 +25,16 @@ public class LoginTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Login_WhenUserDoesNotExist_ItShouldReturn401WithProblemDetails()
   {
-    var req = new
-    {
-      username = "Test",
-      password = "@Password2",
-    };
+    using var request = HttpRequestBuilder.New()
+      .Post(LoginUri)
+      .WithBody(new
+      {
+        username = "Test",
+        password = "@Password2",
+      })
+      .Build();
 
-    var res = await Client.PostAsJsonAsync(LoginUri, req, TestContext.Current.CancellationToken);
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await res.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
   }
@@ -49,13 +53,16 @@ public class LoginTests(TestApi testApi) : IntegrationTest(testApi)
       await context.SaveChangesAsync(ct);
     }, TestContext.Current.CancellationToken);
 
-    var req = new
-    {
-      username = "Stevan",
-      password = "@Password2",
-    };
+    using var request = HttpRequestBuilder.New()
+      .Post(LoginUri)
+      .WithBody(new
+      {
+        username = "Stevan",
+        password = "@Password2",
+      })
+      .Build();
 
-    var res = await Client.PostAsJsonAsync(LoginUri, req, TestContext.Current.CancellationToken);
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await res.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
   }
@@ -74,16 +81,19 @@ public class LoginTests(TestApi testApi) : IntegrationTest(testApi)
       await context.SaveChangesAsync(ct);
     }, TestContext.Current.CancellationToken);
 
-    var req = new
-    {
-      username = "Stevan",
-      password = "@Password1",
-    };
+    using var request = HttpRequestBuilder.New()
+      .Post(LoginUri)
+      .WithBody(new
+      {
+        username = "Stevan",
+        password = "@Password1",
+      })
+      .Build();
 
-    var res = await Client.PostAsJsonAsync(LoginUri, req, TestContext.Current.CancellationToken);
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     res.Should().HaveSetCookieHeader("fiscalos_refresh_cookie");
-    await res.Should().BeJsonContentOfType<Login.Response>(HttpStatusCode.OK);
+    await res.Should().BeJsonContentOfType<API.Auth.Login.Response>(HttpStatusCode.OK);
   }
 }
 

tests/FiscalOS.API.Tests/Integration/Auth/RefreshTests.cs

@@ -1,8 +1,8 @@
-namespace FiscalOS.API.Tests.Integration;
+namespace FiscalOS.API.Tests.Integration.Auth;
 
 public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
 {
-  private static readonly Uri RefreshUri = new("/refresh", UriKind.Relative);
+  private static readonly Uri RefreshUri = new("/auth/refresh", UriKind.Relative);
 
   [Fact]
   public async Task Refresh_WhenCalledWithNoAccessToken_ItShouldReturn401WithProblemDetails()
@@ -15,14 +15,12 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Refresh_WhenCalledWithNonExistentRefreshToken_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(RefreshUri)
+      .WithUserId(Guid.NewGuid())
+      .WithRefreshCookie("nonexistenttoken")
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", "fiscalos_refresh_cookie=nonexistenttoken");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.BadRequest);
@@ -53,14 +51,12 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
       return (new User[] { user1, user2 }, refreshToken1);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, users[0].Id.ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(RefreshUri)
+      .WithUserId(users[0].Id)
+      .WithRefreshCookie(refreshToken.Token)
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", $"fiscalos_refresh_cookie={refreshToken.Token}");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.Forbidden);
@@ -98,14 +94,12 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, refreshToken);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(RefreshUri)
+      .WithUserId(user.Id)
+      .WithRefreshCookie(refreshToken.Token)
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", $"fiscalos_refresh_cookie={refreshToken.Token}");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.BadRequest);
@@ -132,14 +126,12 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, refreshToken);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(RefreshUri)
+      .WithUserId(user.Id)
+      .WithRefreshCookie(refreshToken.Token)
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", $"fiscalos_refresh_cookie={refreshToken.Token}");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.BadRequest);
@@ -168,19 +160,19 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, refreshToken);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
-      .WithExpiresAt(DateTime.UtcNow.AddMinutes(accessTokenExpiresAtOffset))
+    using var request = HttpRequestBuilder.New()
+      .Post(RefreshUri)
+      .WithBearerToken(JwtTokenBuilder.New()
+        .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+        .WithExpiresAt(DateTime.UtcNow.AddMinutes(accessTokenExpiresAtOffset))
+        .Build())
+      .WithRefreshCookie(refreshToken.Token)
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", $"fiscalos_refresh_cookie={refreshToken.Token}");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     response.Should().HaveSetCookieHeader("fiscalos_refresh_cookie");
-    await response.Should().BeJsonContentOfType<Refresh.Response>(HttpStatusCode.OK);
+    await response.Should().BeJsonContentOfType<API.Auth.Refresh.Response>(HttpStatusCode.OK);
 
     var oldRefreshTokenInDb = await ExecuteAsync(
       async (context, ct) => await context.Set<RefreshToken>()

tests/FiscalOS.API.Tests/Integration/Institutions/ConnectTests.cs

@@ -1,15 +1,20 @@
 using Institution = FiscalOS.Core.Accounts.Institution;
 
-namespace FiscalOS.API.Tests.Integration;
+namespace FiscalOS.API.Tests.Integration.Institutions;
 
 public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
 {
-  private static readonly Uri ConnectUri = new("/accounts/connect", UriKind.Relative);
+  private static readonly Uri ConnectUri = new("/institutions/connect", UriKind.Relative);
 
   [Fact]
   public async Task Connect_WhenCalledWithoutValidToken_ItShouldReturn401WithProblemDetails()
   {
-    var res = await Client.PostAsJsonAsync(ConnectUri, new { }, TestContext.Current.CancellationToken);
+    using var request = HttpRequestBuilder.New()
+      .Post(ConnectUri)
+      .WithBody(new { })
+      .Build();
+
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await res.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
   }
@@ -17,17 +22,12 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Connect_WhenCalledWithoutPublicTokenOrPlaidInstitutionId_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(ConnectUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new { })
       .Build();
 
-    using var content = new StringContent(JsonSerializer.Serialize(new { }), Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -40,18 +40,12 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Connect_WhenCalledWithoutPublicToken_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(ConnectUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new { plaidInstitutionId = "id" })
       .Build();
 
-    var json = JsonSerializer.Serialize(new { plaidInstitutionId = "id" });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -63,18 +57,12 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Connect_WhenCalledWithoutPlaidInstitutionId_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(ConnectUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new { publicToken = "token" })
       .Build();
 
-    var json = JsonSerializer.Serialize(new { publicToken = "token" });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -86,22 +74,16 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Connect_WhenCalledWithNonExistentUser_ItShouldReturn401WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(ConnectUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new
+      {
+        publicToken = "token",
+        plaidInstitutionId = "id",
+      })
       .Build();
 
-    var json = JsonSerializer.Serialize(new
-    {
-      publicToken = "token",
-      plaidInstitutionId = "id",
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
@@ -129,22 +111,16 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, institution);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(ConnectUri)
+      .WithUserId(user.Id)
+      .WithBody(new
+      {
+        publicToken = "token",
+        plaidInstitutionId = ((PlaidMetadata)institution.Metadata!).PlaidId,
+      })
       .Build();
 
-    var json = JsonSerializer.Serialize(new
-    {
-      publicToken = "token",
-      plaidInstitutionId = ((PlaidMetadata)institution.Metadata!).PlaidId,
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.Conflict);
@@ -176,22 +152,16 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, publicTokenResponse.PublicToken);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+    using var request = HttpRequestBuilder.New()
+      .Post(ConnectUri)
+      .WithUserId(user.Id)
+      .WithBody(new
+      {
+        publicToken,
+        plaidInstitutionId,
+      })
       .Build();
 
-    var json = JsonSerializer.Serialize(new
-    {
-      publicToken,
-      plaidInstitutionId,
-    });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     response.StatusCode.Should().Be(HttpStatusCode.OK);

tests/FiscalOS.API.Tests/Integration/Institutions/GetAvailableTests.cs

@@ -0,0 +1,114 @@
+using Institution = FiscalOS.Core.Accounts.Institution;
+
+namespace FiscalOS.API.Tests.Integration.Institutions;
+
+public class GetAvailableTests(TestApi testApi) : IntegrationTest(testApi)
+{
+  private static Uri GetAvailableUri(Guid id) => new($"/institutions/{id}/available", UriKind.Relative);
+
+  [Fact]
+  public async Task GetAvailable_WhenCalledAndUnauthenticated_ItShouldReturn401WithProblemDetails()
+  {
+    using var request = HttpRequestBuilder.New()
+      .WithUri(GetAvailableUri(Guid.NewGuid()))
+      .Build();
+
+    var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
+
+    await response.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
+  }
+
+  [Fact]
+  public async Task GetAvailable_WhenCalledByNonExistentUser_ItShouldReturn401WithProblemDetails()
+  {
+    using var request = HttpRequestBuilder.New()
+      .WithUri(GetAvailableUri(Guid.NewGuid()))
+      .WithUserId(Guid.NewGuid())
+      .Build();
+
+    var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
+
+    await response.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
+  }
+
+  [Fact]
+  public async Task GetAvailable_WhenCalledWithNonExistentInstitutionId_ItShouldReturn404WithProblemDetails()
+  {
+    var user = await ExecuteAsync(static async (context, ct, sp) =>
+    {
+      var passwordHasher = sp.GetRequiredService<IPasswordHasher>();
+      var encryptor = sp.GetRequiredService<IEncryptor>();
+
+      var userEncryptionKey = await encryptor.GenerateEncryptedKeyAsync(ct);
+      var user = User.From("Stevan", passwordHasher.Hash("@Password1"), userEncryptionKey);
+
+      context.Add(user);
+      await context.SaveChangesAsync(ct);
+      
+      return user;
+    }, TestContext.Current.CancellationToken);
+
+    using var request = HttpRequestBuilder.New()
+      .WithUri(GetAvailableUri(Guid.NewGuid()))
+      .WithUserId(user.Id)
+      .Build();
+
+    var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
+
+    await response.Should().BeProblemDetails(HttpStatusCode.NotFound);
+  }
+
+  [Fact]
+  public async Task GetAvailable_WhenCalledWithConnectedInstitution_ItShouldReturn200WithAvailableAccounts()
+  {
+    var (user, institution, expectedAccounts) = await ExecuteAsync(static async (context, ct, sp) =>
+    {
+      var passwordHasher = sp.GetRequiredService<IPasswordHasher>();
+      var encryptor = sp.GetRequiredService<IEncryptor>();
+      var plaidClient = sp.GetRequiredService<PlaidClient>();
+
+      var userEncryptionKey = await encryptor.GenerateEncryptedKeyAsync(ct);
+      var user = User.From("Stevan", passwordHasher.Hash("@Password1"), userEncryptionKey);
+
+      var institutionId = "ins_109508";
+
+      var publicTokenResponse = await plaidClient.SandboxPublicTokenCreateAsync(new()
+      {
+        InstitutionId = institutionId,
+        InitialProducts = [Products.Transactions],
+      });
+
+      var exchangeTokenResponse = await plaidClient.ItemPublicTokenExchangeAsync(new()
+      {
+        PublicToken = publicTokenResponse.PublicToken,
+      });
+
+      var accountsResponse = await plaidClient.AccountsGetAsync(new()
+      {
+        AccessToken = exchangeTokenResponse.AccessToken,
+      });
+      
+      var encryptedAccessToken = await encryptor.EncryptAsyncFor(user, exchangeTokenResponse.AccessToken, ct);
+      var institutionMetadata = PlaidMetadata.From(institutionId, "Some Bank", encryptedAccessToken);
+      var institution = Institution.From("Some Bank", institutionMetadata);
+
+      user.AddInstitution(institution);
+
+      context.Add(user);
+      context.Add(institution);
+      await context.SaveChangesAsync(ct);
+      
+      return (user, institution, accountsResponse.Accounts);
+    }, TestContext.Current.CancellationToken);
+
+    using var request = HttpRequestBuilder.New()
+      .WithUri(GetAvailableUri(institution.Id))
+      .WithUserId(user.Id)
+      .Build();
+
+    var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
+
+    (await response.Should().BeJsonContentOfType<List<Account>>(HttpStatusCode.OK))
+      .Which.Should().BeEquivalentTo(expectedAccounts);
+  }
+}