feat(api): support passing and persistenting currency code for balances

- Replace raw Plaid entity response with a dedicated Response wrapper
- Map Plaid accounts to AccountDto to decouple API from external SDK
models
- Update integration tests to assert against the new response structure
- Add JsonConstructors to DTO records for reliable deserialization

src/FiscalOS.API/Accounts/AccountsExtensions.cs

@@ -10,7 +10,6 @@ internal static class AccountsExtensions
       .RequireAuthorization();
 
     accountsGroup.MapAddEndpoint();
-    accountsGroup.MapConnectEndpoint();
 
     return accountsGroup;
   }

src/FiscalOS.API/Accounts/Add/Endpoint.cs

@@ -1,5 +1,3 @@
-using FiscalOS.Core.Accounts;
-
 namespace FiscalOS.API.Accounts.Add;
 
 internal static class Endpoint
@@ -46,6 +44,9 @@ internal static class Endpoint
 
     var accountMetadata = PlaidAccountMetadata.From(request.PlaidAccountId, request.PlaidAccountName);
     var account = Account.From(user.Institutions.First().Id, request.PlaidAccountName, accountMetadata);
+    var balance = Balance.From(request.AccountCurrentBalance, request.AccountAvailableBalance, request.AccountCurrencyCode);
+
+    account.AddBalance(balance);
     user.AddAccount(account);
 
     await appDbContext.SaveChangesAsync(ct);

src/FiscalOS.API/Accounts/Add/Request.cs

@@ -1,4 +1,3 @@
-
 namespace FiscalOS.API.Accounts.Add;
 
 public record Request : IValidatableObject
@@ -6,6 +5,9 @@ public record Request : IValidatableObject
   public string PlaidInstitutionId { get; init; } = string.Empty;
   public string PlaidAccountId { get; init; } = string.Empty;
   public string PlaidAccountName { get; init; } = string.Empty;
+  public decimal AccountCurrentBalance { get; init; }
+  public decimal AccountAvailableBalance { get; init; }
+  public string AccountCurrencyCode { get; init; } = string.Empty;
 
   public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
   {
@@ -26,5 +28,11 @@ public record Request : IValidatableObject
       var fieldName = nameof(PlaidAccountName);
       yield return new($"The {fieldName} field is required.", [fieldName]);
     }
+
+    if (string.IsNullOrWhiteSpace(AccountCurrencyCode))
+    {
+      var fieldName = nameof(AccountCurrencyCode);
+      yield return new($"The {fieldName} field is required.", [fieldName]);
+    }
   }
 }

src/FiscalOS.API/Auth/AuthExtensions.cs

@@ -0,0 +1,18 @@
+namespace FiscalOS.API.Auth;
+
+internal static class AuthExtensions
+{
+  private const string RouteGroupPrefix = "/auth";
+
+  public static RouteGroupBuilder MapAuthEndpoints(this WebApplication app)
+  {
+    var authGroup = app.MapGroup(RouteGroupPrefix);
+
+    authGroup.MapLoginEndpoint();
+
+    authGroup.MapRefreshEndpoint()
+      .RequireAuthorization(Schemes.AllowExpiredTokens);
+
+    return authGroup;
+  }
+}

src/FiscalOS.API/Auth/Login/Endpoint.cs

@@ -1,12 +1,12 @@
-namespace FiscalOS.API.Login;
+namespace FiscalOS.API.Auth.Login;
 
 internal static class Endpoint
 {
   private const string Route = "/login";
 
-  public static RouteHandlerBuilder MapLoginEndpoint(this WebApplication app)
+  public static RouteHandlerBuilder MapLoginEndpoint(this RouteGroupBuilder groupBuilder)
   {
-    return app.MapPost(Route, HandleAsync);
+    return groupBuilder.MapPost(Route, HandleAsync);
   }
 
   private static async Task<IResult> HandleAsync(

src/FiscalOS.API/Auth/Login/Request.cs

@@ -1,4 +1,4 @@
-namespace FiscalOS.API.Login;
+namespace FiscalOS.API.Auth.Login;
 
 public record Request : IValidatableObject
 {

src/FiscalOS.API/Auth/Login/Response.cs

@@ -1,4 +1,4 @@
-namespace FiscalOS.API.Login;
+namespace FiscalOS.API.Auth.Login;
 
 internal sealed record Response
 {

src/FiscalOS.API/Auth/Refresh/Endpoint.cs

@@ -1,12 +1,12 @@
-namespace FiscalOS.API.Refresh;
+namespace FiscalOS.API.Auth.Refresh;
 
 internal static class Endpoint
 {
   private const string Route = "/refresh";
 
-  public static RouteHandlerBuilder MapRefreshEndpoint(this WebApplication app)
+  public static RouteHandlerBuilder MapRefreshEndpoint(this RouteGroupBuilder groupBuilder)
   {
-    return app.MapPost(Route, HandleAsync);
+    return groupBuilder.MapPost(Route, HandleAsync);
   }
 
   private static async Task<IResult> HandleAsync(

src/FiscalOS.API/Auth/Refresh/Response.cs

@@ -1,4 +1,4 @@
-namespace FiscalOS.API.Refresh;
+namespace FiscalOS.API.Auth.Refresh;
 
 internal sealed record Response
 {

src/FiscalOS.API/Http/HttpContextExtensions.cs

@@ -1,5 +1,3 @@
-using FiscalOS.Core.Identity;
-
 namespace FiscalOS.API.Http;
 
 internal static class HttpContextExtensions

src/FiscalOS.API/Institutions/Connect/Endpoint.cs

@@ -1,6 +1,4 @@
-using FiscalOS.Core.Accounts;
+namespace FiscalOS.API.Institutions.Connect;
-
-namespace FiscalOS.API.Accounts.Connect;
 
 internal static class Endpoint
 {

src/FiscalOS.API/Institutions/Connect/Request.cs

@@ -1,4 +1,4 @@
-namespace FiscalOS.API.Accounts.Connect;
+namespace FiscalOS.API.Institutions.Connect;
 
 public record Request : IValidatableObject
 {

src/FiscalOS.API/Institutions/GetAvailable/Endpoint.cs

@@ -0,0 +1,51 @@
+namespace FiscalOS.API.Institutions.GetAvailable;
+
+internal static class Endpoint
+{
+  private const string Route = "/{id}/available";
+
+  public static RouteHandlerBuilder MapGetAvailableEndpoint(this RouteGroupBuilder groupBuilder)
+  {
+    return groupBuilder.MapGet(Route, HandleAsync);
+  }
+
+  private static async Task<IResult> HandleAsync(
+    HttpContext httpContext,
+    [FromRoute] Guid id,
+    [FromServices] AppDbContext appDbContext,
+    [FromServices] PlaidService plaidService,
+    [FromServices] IEncryptor encryptor,
+    CancellationToken ct
+  )
+  {
+    var userId = httpContext.GetUserId();
+
+    var user = await appDbContext.Users
+      .Include(u => u.Institutions.Where(i => i.Id == id))
+      .ThenInclude(i => i.Metadata)
+      .SingleOrDefaultAsync(u => u.Id == userId, ct);
+
+    if (user is null)
+    {
+      return Results.Unauthorized();
+    }
+
+    if (user.Institutions.Any() is false)
+    {
+      return Results.NotFound();
+    }
+
+    var institution = user.Institutions.First();
+
+    if (institution.Metadata is not PlaidMetadata plaidMetadata)
+    {
+      return Results.BadRequest();
+    }
+
+    var accessToken = await encryptor.DecryptAsyncFor(user, plaidMetadata.EncryptedAccessToken, ct);
+    var accounts = await plaidService.GetAccountsAsync(accessToken);
+    var accountsDtos = accounts.Select(AccountDto.FromPlaidAccount);
+
+    return Results.Ok(Response.From(accountsDtos));
+  }
+}

src/FiscalOS.API/Institutions/GetAvailable/Response.cs

@@ -0,0 +1,45 @@
+namespace FiscalOS.API.Institutions.GetAvailable;
+
+internal sealed record Response
+{
+  public IEnumerable<AccountDto> Accounts { get; init; } = [];
+
+  [JsonConstructor]
+  private Response()
+  {
+  }
+
+  public static Response From(IEnumerable<AccountDto> accounts)
+  {
+    return new Response
+    {
+      Accounts = accounts
+    };
+  }
+}
+
+internal sealed record AccountDto
+{
+  public string ProviderId { get; init; } = string.Empty;
+  public string ProviderName { get; init; } = string.Empty;
+  public decimal CurrentBalance { get; init; }
+  public decimal AvailableBalance { get; init; }
+  public string CurrencyCode { get; init; } = string.Empty;
+
+  [JsonConstructor]
+  private AccountDto()
+  {
+  }
+
+  public static AccountDto FromPlaidAccount(Going.Plaid.Entity.Account plaidAccount)
+  {
+    return new AccountDto
+    {
+      ProviderId = plaidAccount.AccountId,
+      ProviderName = plaidAccount.Name,
+      AvailableBalance = plaidAccount.Available,
+      CurrentBalance = plaidAccount.Current,
+      CurrencyCode = plaidAccount.CurrencyCode,
+    };
+  }
+}

src/FiscalOS.API/Institutions/InstitutionsExtensions.cs

@@ -0,0 +1,17 @@
+namespace FiscalOS.API.Institutions;
+
+internal static class InstitutionsExtensions
+{
+  private const string RouteGroupPrefix = "/institutions";
+
+  public static RouteGroupBuilder MapInstitutionsEndpoints(this WebApplication app)
+  {
+    var institutionsGroup = app.MapGroup(RouteGroupPrefix)
+      .RequireAuthorization();
+
+    institutionsGroup.MapConnectEndpoint();
+    institutionsGroup.MapGetAvailableEndpoint();
+
+    return institutionsGroup;
+  }
+}

src/FiscalOS.API/Program.cs

@@ -32,11 +32,8 @@ app.UseAuthentication();
 app.UseAuthorization();
 app.UseStatusCodePages();
 
-app.MapLoginEndpoint();
+app.MapAuthEndpoints();
-
-app.MapRefreshEndpoint()
-  .RequireAuthorization(Schemes.AllowExpiredTokens);
-
 app.MapAccountsEndpoints();
+app.MapInstitutionsEndpoints();
 
 app.Run();

src/FiscalOS.API/Usings.cs

@@ -2,12 +2,17 @@ global using System.ComponentModel.DataAnnotations;
 global using System.Security.Claims;
 global using System.Text.Json.Serialization;
 
+global using FiscalOS.Core.Identity;
 global using FiscalOS.API.Accounts;
 global using FiscalOS.API.Accounts.Add;
-global using FiscalOS.API.Accounts.Connect;
+global using FiscalOS.API.Auth;
+global using FiscalOS.API.Auth.Login;
+global using FiscalOS.API.Auth.Refresh;
 global using FiscalOS.API.Http;
-global using FiscalOS.API.Login;
+global using FiscalOS.API.Institutions;
-global using FiscalOS.API.Refresh;
+global using FiscalOS.API.Institutions.Connect;
+global using FiscalOS.API.Institutions.GetAvailable;
+global using FiscalOS.Core.Accounts;
 global using FiscalOS.Core.Authentication;
 global using FiscalOS.Core.Security;
 global using FiscalOS.Infra.Accounts.Plaid;

src/FiscalOS.Core/Accounts/Account.cs

@@ -8,6 +8,9 @@ public sealed class Account : Entity
   public string Name { get; init; } = string.Empty;
   public AccountMetadata? Metadata { get; init; }
 
+  private readonly List<Balance> _balances = [];
+  public IEnumerable<Balance> Balances => _balances;
+
   public static Account From(Guid institutionId, string name, AccountMetadata accountMetadata)
   {
     return new()
@@ -17,4 +20,11 @@ public sealed class Account : Entity
       Metadata = accountMetadata,
     };
   }
+
+  public void AddBalance(Balance balance)
+  {
+    ArgumentNullException.ThrowIfNull(balance);
+
+    _balances.Add(balance);
+  }
 }

src/FiscalOS.Core/Accounts/Balance.cs

@@ -0,0 +1,27 @@
+namespace FiscalOS.Core.Accounts;
+
+public sealed class Balance : Entity
+{
+  public Guid AccountId { get; init; }
+  public decimal Current { get; init; }
+  public decimal Available { get; init; }
+  public string CurrencyCode { get; init; } = string.Empty;
+
+  private Balance()
+  {
+  }
+
+  public static Balance From(
+    decimal current,
+    decimal available,
+    string currencyCode
+  )
+  {
+    return new()
+    {
+      Current = current,
+      Available = available,
+      CurrencyCode = currencyCode,
+    };
+  }
+}

src/FiscalOS.Infra/Accounts/Plaid/PlaidExtensions.cs

@@ -0,0 +1,15 @@
+namespace FiscalOS.Infra.Accounts.Plaid;
+
+public static class PlaidExtensions
+{
+#pragma warning disable CA1034
+  extension(Going.Plaid.Entity.Account act)
+  {
+    public string CurrencyCode => act.Balances.IsoCurrencyCode
+      ?? act.Balances.UnofficialCurrencyCode
+      ?? "Unknown";
+
+    public decimal Available => act.Balances.Available.GetValueOrDefault();
+    public decimal Current => act.Balances.Current.GetValueOrDefault();
+  }
+}

src/FiscalOS.Infra/Accounts/Plaid/PlaidService.cs

@@ -1,3 +1,4 @@
+
 namespace FiscalOS.Infra.Accounts.Plaid;
 
 public sealed class PlaidService
@@ -30,6 +31,21 @@ public sealed class PlaidService
     return (ptr.ItemId, ptr.AccessToken);
   }
 
+  public async Task<List<Going.Plaid.Entity.Account>> GetAccountsAsync(string accessToken)
+  {
+    var ar = await _client.AccountsGetAsync(new()
+    {
+      AccessToken = accessToken,
+    }).ConfigureAwait(false);
+
+    if (ar.IsSuccessStatusCode is false)
+    {
+      throw new PlaidException("Unable to retrieve accounts");
+    }
+
+    return [.. ar.Accounts];
+  }
+
   public async Task<ItemWithConsentFields> GetItemAsync(string accessToken)
   {
     var ar = await _client.ItemGetAsync(new()

src/FiscalOS.Infra/Data/AppDbContext.cs

@@ -124,6 +124,11 @@ public sealed class AppDbContext(
         .WithOne()
         .HasForeignKey<AccountMetadata>(static m => m.AccountId)
         .OnDelete(DeleteBehavior.Cascade);
+
+      eb.HasMany(static a => a.Balances)
+        .WithOne()
+        .HasForeignKey(static b => b.AccountId)
+        .OnDelete(DeleteBehavior.Cascade);
     });
 
     modelBuilder.Entity<AccountMetadata>(static eb =>
@@ -142,5 +147,13 @@ public sealed class AppDbContext(
       eb.Property(static m => m.PlaidId);
       eb.Property(static m => m.PlaidName);
     });
+
+    modelBuilder.Entity<Balance>(static eb =>
+    {
+      eb.Property(static b => b.AccountId);
+      eb.Property(static b => b.Current);
+      eb.Property(static b => b.Available);
+      eb.Property(static b => b.CurrencyCode);
+    });
   }
 }

src/FiscalOS.Infra/Migrations/20260214112234_AddBalancesWithConnectionToAccounts.Designer.cs

@@ -0,0 +1,364 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260214112234_AddBalancesWithConnectionToAccounts")]
+    partial class AddBalancesWithConnectionToAccounts
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Account");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId")
+                        .IsUnique();
+
+                    b.ToTable("AccountMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("AccountMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Available")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Current")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId");
+
+                    b.ToTable("Balance");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId")
+                        .IsUnique();
+
+                    b.ToTable("InstitutionMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("InstitutionMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptionKeyId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidAccountMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.AccountMetadata");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.InstitutionMetadata");
+
+                    b.Property<string>("EncryptedAccessToken")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", "Institution")
+                        .WithMany()
+                        .HasForeignKey("InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Accounts")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.AccountMetadata", "AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithMany("Balances")
+                        .HasForeignKey("AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Institutions")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.InstitutionMetadata", "InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Navigation("Balances");
+
+                    b.Navigation("Metadata");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Navigation("Metadata");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("Accounts");
+
+                    b.Navigation("Institutions");
+
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/FiscalOS.Infra/Migrations/20260214112234_AddBalancesWithConnectionToAccounts.cs

@@ -0,0 +1,49 @@
+using System;
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddBalancesWithConnectionToAccounts : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.CreateTable(
+                name: "Balance",
+                columns: table => new
+                {
+                    Id = table.Column<Guid>(type: "TEXT", nullable: false),
+                    AccountId = table.Column<Guid>(type: "TEXT", nullable: false),
+                    Current = table.Column<decimal>(type: "TEXT", nullable: false),
+                    Available = table.Column<decimal>(type: "TEXT", nullable: false),
+                    CreatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false),
+                    UpdatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false)
+                },
+                constraints: table =>
+                {
+                    table.PrimaryKey("PK_Balance", x => x.Id);
+                    table.ForeignKey(
+                        name: "FK_Balance_Account_AccountId",
+                        column: x => x.AccountId,
+                        principalTable: "Account",
+                        principalColumn: "Id",
+                        onDelete: ReferentialAction.Cascade);
+                });
+
+            migrationBuilder.CreateIndex(
+                name: "IX_Balance_AccountId",
+                table: "Balance",
+                column: "AccountId");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropTable(
+                name: "Balance");
+        }
+    }
+}

src/FiscalOS.Infra/Migrations/20260214122622_AddCurrencyCodeToBalanceModel.Designer.cs

@@ -0,0 +1,368 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260214122622_AddCurrencyCodeToBalanceModel")]
+    partial class AddCurrencyCodeToBalanceModel
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Account");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId")
+                        .IsUnique();
+
+                    b.ToTable("AccountMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("AccountMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Available")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("CurrencyCode")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Current")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId");
+
+                    b.ToTable("Balance");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId")
+                        .IsUnique();
+
+                    b.ToTable("InstitutionMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("InstitutionMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptionKeyId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidAccountMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.AccountMetadata");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.InstitutionMetadata");
+
+                    b.Property<string>("EncryptedAccessToken")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", "Institution")
+                        .WithMany()
+                        .HasForeignKey("InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Accounts")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.AccountMetadata", "AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithMany("Balances")
+                        .HasForeignKey("AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Institutions")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.InstitutionMetadata", "InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Navigation("Balances");
+
+                    b.Navigation("Metadata");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Navigation("Metadata");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("Accounts");
+
+                    b.Navigation("Institutions");
+
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}

src/FiscalOS.Infra/Migrations/20260214122622_AddCurrencyCodeToBalanceModel.cs

@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    /// <inheritdoc />
+    public partial class AddCurrencyCodeToBalanceModel : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<string>(
+                name: "CurrencyCode",
+                table: "Balance",
+                type: "TEXT",
+                nullable: false,
+                defaultValue: "");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "CurrencyCode",
+                table: "Balance");
+        }
+    }
+}

src/FiscalOS.Infra/Migrations/AppDbContextModelSnapshot.cs

@@ -80,6 +80,38 @@ namespace FiscalOS.Infra.Migrations
                     b.UseTphMappingStrategy();
                 });
 
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Available")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("CurrencyCode")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Current")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId");
+
+                    b.ToTable("Balance");
+                });
+
             modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
                 {
                     b.Property<Guid>("Id")
@@ -269,6 +301,15 @@ namespace FiscalOS.Infra.Migrations
                         .IsRequired();
                 });
 
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithMany("Balances")
+                        .HasForeignKey("AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
             modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
                 {
                     b.HasOne("FiscalOS.Core.Identity.User", null)
@@ -300,14 +341,14 @@ namespace FiscalOS.Infra.Migrations
 
             modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
                 {
-                    b.Navigation("Metadata")
+                    b.Navigation("Balances");
-                        .IsRequired();
+
+                    b.Navigation("Metadata");
                 });
 
             modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
                 {
-                    b.Navigation("Metadata")
+                    b.Navigation("Metadata");
-                        .IsRequired();
                 });
 
             modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>

tests/FiscalOS.API.Tests/Assertions/HttpResponseMessageAssertions.cs

@@ -21,12 +21,6 @@ internal sealed class HttpResponseMessageAssertions(
     HttpStatusCode expectedStatusCode
   )
   {
-    _chain.ForCondition(Subject.Content.Headers.ContentType?.MediaType is "application/json")
-      .FailWith(
-        "Expected response to be application/json, but found {0}",
-        Subject.Content.Headers.ContentType?.MediaType
-      );
-
     _chain.ForCondition(Subject.StatusCode == expectedStatusCode)
       .FailWith(
         "Expected response status code to be {0}, but found {1}",
@@ -34,6 +28,13 @@ internal sealed class HttpResponseMessageAssertions(
         Subject.StatusCode
       );
 
+    _chain.ForCondition(Subject.Content.Headers.ContentType?.MediaType is "application/json")
+      .FailWith(
+        "Expected response to be application/json, but found {0}",
+        Subject.Content.Headers.ContentType?.MediaType
+      );
+
+
     var content = await Subject.Content.ReadFromJsonAsync<T>();
 
     _chain.ForCondition(content is not null)

tests/FiscalOS.API.Tests/Infra/HttpRequestBuilder.cs

@@ -0,0 +1,128 @@
+namespace FiscalOS.API.Tests.Infra;
+
+internal sealed class HttpRequestBuilder
+{
+  private HttpMethod _method = HttpMethod.Get;
+  private Uri? _uri;
+  private object? _body;
+  private string? _bearerToken;
+  private readonly Dictionary<string, string> _cookies = [];
+  private readonly Dictionary<string, string> _headers = [];
+
+  private HttpRequestBuilder()
+  {
+  }
+
+  public static HttpRequestBuilder New() => new();
+
+  public HttpRequestBuilder WithMethod(HttpMethod method)
+  {
+    _method = method;
+    return this;
+  }
+
+  public HttpRequestBuilder WithUri(Uri uri)
+  {
+    _uri = uri;
+    return this;
+  }
+
+  public HttpRequestBuilder WithBody<T>(T body)
+  {
+    _body = body;
+    return this;
+  }
+
+  public HttpRequestBuilder WithBearerToken(string token)
+  {
+    _bearerToken = token;
+    return this;
+  }
+
+  public HttpRequestBuilder WithUserId(Guid userId)
+  {
+    _bearerToken = JwtTokenBuilder.New()
+      .WithClaim(JwtRegisteredClaimNames.Sub, userId.ToString())
+      .Build();
+
+    return this;
+  }
+
+  public HttpRequestBuilder WithCookie(string name, string value)
+  {
+    _cookies[name] = value;
+    return this;
+  }
+
+  public HttpRequestBuilder WithRefreshCookie(string token)
+  {
+    return WithCookie("fiscalos_refresh_cookie", token);
+  }
+
+  public HttpRequestBuilder WithHeader(string name, string value)
+  {
+    _headers[name] = value;
+    return this;
+  }
+
+  public HttpRequestBuilder Post(Uri uri)
+  {
+    _method = HttpMethod.Post;
+    _uri = uri;
+    return this;
+  }
+
+  public HttpRequestBuilder Get(Uri uri)
+  {
+    _method = HttpMethod.Get;
+    _uri = uri;
+    return this;
+  }
+
+  public HttpRequestBuilder Put(Uri uri)
+  {
+    _method = HttpMethod.Put;
+    _uri = uri;
+    return this;
+  }
+
+  public HttpRequestBuilder Delete(Uri uri)
+  {
+    _method = HttpMethod.Delete;
+    _uri = uri;
+    return this;
+  }
+
+  public HttpRequestMessage Build()
+  {
+    if (_uri is null)
+    {
+      throw new InvalidOperationException("URI must be set before building the request.");
+    }
+
+    var request = new HttpRequestMessage(_method, _uri);
+
+    if (_body is not null)
+    {
+      var json = JsonSerializer.Serialize(_body);
+      request.Content = new StringContent(json, Encoding.UTF8, "application/json");
+    }
+
+    if (_bearerToken is not null)
+    {
+      request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", _bearerToken);
+    }
+
+    foreach (var (key, value) in _cookies)
+    {
+      request.Headers.Add("Cookie", $"{key}={value}");
+    }
+
+    foreach (var (key, value) in _headers)
+    {
+      request.Headers.Add(key, value);
+    }
+
+    return request;
+  }
+}

tests/FiscalOS.API.Tests/Infra/SerializableDictionary.cs

@@ -1,4 +1,4 @@
-namespace FiscalOS.API.Tests.Common;
+namespace FiscalOS.API.Tests.Infra;
 
 public interface ISerializableDictionary<TKey, TValue> : IDictionary<TKey, TValue>, IXunitSerializable
 {

tests/FiscalOS.API.Tests/Infra/TestApi.cs

@@ -1,5 +1,3 @@
-using Microsoft.Extensions.Configuration;
-
 namespace FiscalOS.API.Tests.Infra;
 
 public class TestApi : WebApplicationFactory<Program>

tests/FiscalOS.API.Tests/Integration/Accounts/AddTests.cs

@@ -1,7 +1,7 @@
 using Account = FiscalOS.Core.Accounts.Account;
 using Institution = FiscalOS.Core.Accounts.Institution;
 
-namespace FiscalOS.API.Tests.Integration;
+namespace FiscalOS.API.Tests.Integration.Accounts;
 
 public class AddTests(TestApi testApi) : IntegrationTest(testApi)
 {
@@ -16,19 +16,14 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
   }
 
   [Fact]
-  public async Task Add_WhenCalledWithoutInstitutionIdOrAccountIdOrAccountName_ItShouldReturn400WithProblemDetails()
+  public async Task Add_WhenCalledWithoutRequiredInformation_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(AddUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new { })
       .Build();
 
-    using var content = new StringContent(JsonSerializer.Serialize(new { }), Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
-    {
-      Content = content
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -36,27 +31,23 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
       ["PlaidInstitutionId"] = ["The PlaidInstitutionId field is required."],
       ["PlaidAccountId"] = ["The PlaidAccountId field is required."],
       ["PlaidAccountName"] = ["The PlaidAccountName field is required."],
+      ["AccountCurrencyCode"] = ["The AccountCurrencyCode field is required."],
     });
   }
 
   [Fact]
   public async Task Add_WhenCalledWithoutInstitutionId_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(AddUri)
-      .Build();
+      .WithUserId(Guid.NewGuid())
-
+      .WithBody(new
-    var json = JsonSerializer.Serialize(new
       {
         plaidAccountId = "accountId",
         plaidAccountName = "Some Account",
-    });
+        accountCurrencyCode = "USD",
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+      })
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
+      .Build();
-    {
-      Content = content
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
@@ -69,21 +60,16 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Add_WhenCalledWithoutAccountId_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(AddUri)
-      .Build();
+      .WithUserId(Guid.NewGuid())
-
+      .WithBody(new
-    var json = JsonSerializer.Serialize(new
       {
         plaidInstitutionId = "institutionId",
         plaidAccountName = "Some Account",
-    });
+        accountCurrencyCode = "USD",
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+      })
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
+      .Build();
-    {
-      Content = content
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
@@ -96,21 +82,16 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Add_WhenCalledWithoutAccountName_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(AddUri)
-      .Build();
+      .WithUserId(Guid.NewGuid())
-
+      .WithBody(new
-    var json = JsonSerializer.Serialize(new
       {
         plaidInstitutionId = "institutionId",
         plaidAccountId = "accountId",
-    });
+        accountCurrencyCode = "USD",
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+      })
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
+      .Build();
-    {
-      Content = content
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
@@ -123,22 +104,17 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Add_WhenCalledWithNonExistentUser_ItShouldReturn401WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(AddUri)
-      .Build();
+      .WithUserId(Guid.NewGuid())
-
+      .WithBody(new
-    var json = JsonSerializer.Serialize(new
       {
         plaidInstitutionId = "id",
         plaidAccountId = "id",
         plaidAccountName = "Some Account",
-    });
+        accountCurrencyCode = "USD",
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+      })
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
+      .Build();
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
@@ -162,22 +138,17 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
       return user;
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+      .Post(AddUri)
-      .Build();
+      .WithUserId(user.Id)
-
+      .WithBody(new
-    var json = JsonSerializer.Serialize(new
       {
         plaidInstitutionId = "id",
         plaidAccountId = "id",
         plaidAccountName = "Some Account",
-    });
+        accountCurrencyCode = "USD",
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+      })
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
+      .Build();
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
@@ -216,22 +187,17 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, institution, account);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+      .Post(AddUri)
-      .Build();
+      .WithUserId(user.Id)
-
+      .WithBody(new
-    var json = JsonSerializer.Serialize(new
       {
         plaidInstitutionId = ((PlaidMetadata)institution.Metadata!).PlaidId,
         plaidAccountId = ((PlaidAccountMetadata)account.Metadata!).PlaidId,
         plaidAccountName = ((PlaidAccountMetadata)account.Metadata).PlaidName,
-    });
+        accountCurrencyCode = "USD",
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+      })
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
+      .Build();
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
@@ -261,25 +227,24 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, institution);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
-      .Build();
-
     var newAccountId = "newAccountId";
     var newAccountName = "New Account";
+    var expectedBalance = 100;
+    var expectedCurrencyCode = "USD";
 
-    var json = JsonSerializer.Serialize(new
+    using var request = HttpRequestBuilder.New()
+      .Post(AddUri)
+      .WithUserId(user.Id)
+      .WithBody(new
       {
         plaidInstitutionId = ((PlaidMetadata)institution.Metadata!).PlaidId,
         plaidAccountId = newAccountId,
         plaidAccountName = newAccountName,
-    });
+        accountCurrentBalance = expectedBalance,
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+        accountAvailableBalance = expectedBalance,
-    using var request = new HttpRequestMessage(HttpMethod.Post, AddUri)
+        accountCurrencyCode = expectedCurrencyCode,
-    {
+      })
-      Content = content,
+      .Build();
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
@@ -289,6 +254,9 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
       async (context, ct) => await context.Set<User>()
         .Include(u => u.Accounts)
         .ThenInclude(a => a.Metadata)
+        .Include(u => u.Accounts)
+        .ThenInclude(a => a.Balances)
+        .AsSplitQuery()
         .FirstAsync(u => u.Id == user.Id, ct),
       TestContext.Current.CancellationToken
     );
@@ -300,5 +268,13 @@ public class AddTests(TestApi testApi) : IntegrationTest(testApi)
         ((PlaidAccountMetadata)a.Metadata).PlaidId == newAccountId &&
         ((PlaidAccountMetadata)a.Metadata).PlaidName == newAccountName
     );
+
+    updatedUser.Accounts.First()
+      .Balances.Should().ContainSingle(
+        b => b.AccountId == updatedUser.Accounts.First().Id &&
+          b.Current == expectedBalance &&
+          b.Available == expectedBalance &&
+          b.CurrencyCode == expectedCurrencyCode
+      );
   }
 }

tests/FiscalOS.API.Tests/Integration/Auth/LoginTests.cs

@@ -1,22 +1,23 @@
-using FiscalOS.API.Tests.Common;
+namespace FiscalOS.API.Tests.Integration.Auth;
-
-namespace FiscalOS.API.Tests.Integration;
 
 public class LoginTests(TestApi testApi) : IntegrationTest(testApi)
 {
-  private static readonly Uri LoginUri = new("/login", UriKind.Relative);
+  private static readonly Uri LoginUri = new("/auth/login", UriKind.Relative);
 
   [Theory]
   [ClassData<LoginValidationTestCases>]
   public async Task Login_WhenUserSubmitsInvalidRequest_ItShouldReturn400WithProblemDetails(LoginValidationTestCase tc)
   {
-    var req = new
+    using var request = HttpRequestBuilder.New()
+      .Post(LoginUri)
+      .WithBody(new
       {
         username = tc.Username,
         password = tc.Password,
-    };
+      })
+      .Build();
 
-    var res = await Client.PostAsJsonAsync(LoginUri, req, TestContext.Current.CancellationToken);
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await res.Should().BeValidationProblemDetails(tc.ExpectedErrors);
   }
@@ -24,13 +25,16 @@ public class LoginTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Login_WhenUserDoesNotExist_ItShouldReturn401WithProblemDetails()
   {
-    var req = new
+    using var request = HttpRequestBuilder.New()
+      .Post(LoginUri)
+      .WithBody(new
       {
         username = "Test",
         password = "@Password2",
-    };
+      })
+      .Build();
 
-    var res = await Client.PostAsJsonAsync(LoginUri, req, TestContext.Current.CancellationToken);
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await res.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
   }
@@ -49,13 +53,16 @@ public class LoginTests(TestApi testApi) : IntegrationTest(testApi)
       await context.SaveChangesAsync(ct);
     }, TestContext.Current.CancellationToken);
 
-    var req = new
+    using var request = HttpRequestBuilder.New()
+      .Post(LoginUri)
+      .WithBody(new
       {
         username = "Stevan",
         password = "@Password2",
-    };
+      })
+      .Build();
 
-    var res = await Client.PostAsJsonAsync(LoginUri, req, TestContext.Current.CancellationToken);
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await res.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
   }
@@ -74,16 +81,19 @@ public class LoginTests(TestApi testApi) : IntegrationTest(testApi)
       await context.SaveChangesAsync(ct);
     }, TestContext.Current.CancellationToken);
 
-    var req = new
+    using var request = HttpRequestBuilder.New()
+      .Post(LoginUri)
+      .WithBody(new
       {
         username = "Stevan",
         password = "@Password1",
-    };
+      })
+      .Build();
 
-    var res = await Client.PostAsJsonAsync(LoginUri, req, TestContext.Current.CancellationToken);
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     res.Should().HaveSetCookieHeader("fiscalos_refresh_cookie");
-    await res.Should().BeJsonContentOfType<Login.Response>(HttpStatusCode.OK);
+    await res.Should().BeJsonContentOfType<API.Auth.Login.Response>(HttpStatusCode.OK);
   }
 }
 

tests/FiscalOS.API.Tests/Integration/Auth/RefreshTests.cs

@@ -1,8 +1,8 @@
-namespace FiscalOS.API.Tests.Integration;
+namespace FiscalOS.API.Tests.Integration.Auth;
 
 public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
 {
-  private static readonly Uri RefreshUri = new("/refresh", UriKind.Relative);
+  private static readonly Uri RefreshUri = new("/auth/refresh", UriKind.Relative);
 
   [Fact]
   public async Task Refresh_WhenCalledWithNoAccessToken_ItShouldReturn401WithProblemDetails()
@@ -15,14 +15,12 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Refresh_WhenCalledWithNonExistentRefreshToken_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(RefreshUri)
+      .WithUserId(Guid.NewGuid())
+      .WithRefreshCookie("nonexistenttoken")
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", "fiscalos_refresh_cookie=nonexistenttoken");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.BadRequest);
@@ -53,14 +51,12 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
       return (new User[] { user1, user2 }, refreshToken1);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, users[0].Id.ToString())
+      .Post(RefreshUri)
+      .WithUserId(users[0].Id)
+      .WithRefreshCookie(refreshToken.Token)
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", $"fiscalos_refresh_cookie={refreshToken.Token}");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.Forbidden);
@@ -98,14 +94,12 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, refreshToken);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+      .Post(RefreshUri)
+      .WithUserId(user.Id)
+      .WithRefreshCookie(refreshToken.Token)
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", $"fiscalos_refresh_cookie={refreshToken.Token}");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.BadRequest);
@@ -132,14 +126,12 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, refreshToken);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+      .Post(RefreshUri)
+      .WithUserId(user.Id)
+      .WithRefreshCookie(refreshToken.Token)
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", $"fiscalos_refresh_cookie={refreshToken.Token}");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeProblemDetails(HttpStatusCode.BadRequest);
@@ -168,19 +160,19 @@ public class RefreshTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, refreshToken);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
+      .Post(RefreshUri)
+      .WithBearerToken(JwtTokenBuilder.New()
         .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
         .WithExpiresAt(DateTime.UtcNow.AddMinutes(accessTokenExpiresAtOffset))
+        .Build())
+      .WithRefreshCookie(refreshToken.Token)
       .Build();
 
-    using var request = new HttpRequestMessage(HttpMethod.Post, RefreshUri);
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-    request.Headers.Add("Cookie", $"fiscalos_refresh_cookie={refreshToken.Token}");
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     response.Should().HaveSetCookieHeader("fiscalos_refresh_cookie");
-    await response.Should().BeJsonContentOfType<Refresh.Response>(HttpStatusCode.OK);
+    await response.Should().BeJsonContentOfType<API.Auth.Refresh.Response>(HttpStatusCode.OK);
 
     var oldRefreshTokenInDb = await ExecuteAsync(
       async (context, ct) => await context.Set<RefreshToken>()

tests/FiscalOS.API.Tests/Integration/Institutions/ConnectTests.cs

@@ -1,15 +1,20 @@
 using Institution = FiscalOS.Core.Accounts.Institution;
 
-namespace FiscalOS.API.Tests.Integration;
+namespace FiscalOS.API.Tests.Integration.Institutions;
 
 public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
 {
-  private static readonly Uri ConnectUri = new("/accounts/connect", UriKind.Relative);
+  private static readonly Uri ConnectUri = new("/institutions/connect", UriKind.Relative);
 
   [Fact]
   public async Task Connect_WhenCalledWithoutValidToken_ItShouldReturn401WithProblemDetails()
   {
-    var res = await Client.PostAsJsonAsync(ConnectUri, new { }, TestContext.Current.CancellationToken);
+    using var request = HttpRequestBuilder.New()
+      .Post(ConnectUri)
+      .WithBody(new { })
+      .Build();
+
+    var res = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await res.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
   }
@@ -17,17 +22,12 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Connect_WhenCalledWithoutPublicTokenOrPlaidInstitutionId_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(ConnectUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new { })
       .Build();
 
-    using var content = new StringContent(JsonSerializer.Serialize(new { }), Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -40,18 +40,12 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Connect_WhenCalledWithoutPublicToken_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(ConnectUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new { plaidInstitutionId = "id" })
       .Build();
 
-    var json = JsonSerializer.Serialize(new { plaidInstitutionId = "id" });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -63,18 +57,12 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Connect_WhenCalledWithoutPlaidInstitutionId_ItShouldReturn400WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(ConnectUri)
+      .WithUserId(Guid.NewGuid())
+      .WithBody(new { publicToken = "token" })
       .Build();
 
-    var json = JsonSerializer.Serialize(new { publicToken = "token" });
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
-
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
     await response.Should().BeValidationProblemDetails(new Dictionary<string, string[]>()
@@ -86,21 +74,15 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
   [Fact]
   public async Task Connect_WhenCalledWithNonExistentUser_ItShouldReturn401WithProblemDetails()
   {
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, Guid.NewGuid().ToString())
+      .Post(ConnectUri)
-      .Build();
+      .WithUserId(Guid.NewGuid())
-
+      .WithBody(new
-    var json = JsonSerializer.Serialize(new
       {
         publicToken = "token",
         plaidInstitutionId = "id",
-    });
+      })
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+      .Build();
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
@@ -129,21 +111,15 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, institution);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+      .Post(ConnectUri)
-      .Build();
+      .WithUserId(user.Id)
-
+      .WithBody(new
-    var json = JsonSerializer.Serialize(new
       {
         publicToken = "token",
         plaidInstitutionId = ((PlaidMetadata)institution.Metadata!).PlaidId,
-    });
+      })
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+      .Build();
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 
@@ -176,21 +152,15 @@ public class ConnectTests(TestApi testApi) : IntegrationTest(testApi)
       return (user, publicTokenResponse.PublicToken);
     }, TestContext.Current.CancellationToken);
 
-    var jwt = JwtTokenBuilder.New()
+    using var request = HttpRequestBuilder.New()
-      .WithClaim(JwtRegisteredClaimNames.Sub, user.Id.ToString())
+      .Post(ConnectUri)
-      .Build();
+      .WithUserId(user.Id)
-
+      .WithBody(new
-    var json = JsonSerializer.Serialize(new
       {
         publicToken,
         plaidInstitutionId,
-    });
+      })
-    using var content = new StringContent(json, Encoding.UTF8, "application/json");
+      .Build();
-    using var request = new HttpRequestMessage(HttpMethod.Post, ConnectUri)
-    {
-      Content = content,
-    };
-    request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", jwt);
 
     var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
 

tests/FiscalOS.API.Tests/Integration/Institutions/GetAvailableTests.cs

@@ -0,0 +1,116 @@
+using FiscalOS.API.Institutions.GetAvailable;
+
+using Institution = FiscalOS.Core.Accounts.Institution;
+
+namespace FiscalOS.API.Tests.Integration.Institutions;
+
+public class GetAvailableTests(TestApi testApi) : IntegrationTest(testApi)
+{
+  private static Uri GetAvailableUri(Guid id)
+  {
+    return new($"/institutions/{id}/available", UriKind.Relative);
+  }
+
+  [Fact]
+  public async Task GetAvailable_WhenCalledAndUnauthenticated_ItShouldReturn401WithProblemDetails()
+  {
+    using var request = HttpRequestBuilder.New()
+      .WithUri(GetAvailableUri(Guid.NewGuid()))
+      .Build();
+
+    var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
+
+    await response.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
+  }
+
+  [Fact]
+  public async Task GetAvailable_WhenCalledByNonExistentUser_ItShouldReturn401WithProblemDetails()
+  {
+    using var request = HttpRequestBuilder.New()
+      .WithUri(GetAvailableUri(Guid.NewGuid()))
+      .WithUserId(Guid.NewGuid())
+      .Build();
+
+    var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
+
+    await response.Should().BeProblemDetails(HttpStatusCode.Unauthorized);
+  }
+
+  [Fact]
+  public async Task GetAvailable_WhenCalledWithNonExistentInstitutionId_ItShouldReturn404WithProblemDetails()
+  {
+    var user = await ExecuteAsync(static async (context, ct, sp) =>
+    {
+      var passwordHasher = sp.GetRequiredService<IPasswordHasher>();
+      var encryptor = sp.GetRequiredService<IEncryptor>();
+
+      var userEncryptionKey = await encryptor.GenerateEncryptedKeyAsync(ct);
+      var user = User.From("Stevan", passwordHasher.Hash("@Password1"), userEncryptionKey);
+
+      context.Add(user);
+      await context.SaveChangesAsync(ct);
+      return user;
+    }, TestContext.Current.CancellationToken);
+
+    using var request = HttpRequestBuilder.New()
+      .WithUri(GetAvailableUri(Guid.NewGuid()))
+      .WithUserId(user.Id)
+      .Build();
+
+    var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
+
+    await response.Should().BeProblemDetails(HttpStatusCode.NotFound);
+  }
+
+  [Fact]
+  public async Task GetAvailable_WhenCalledWithConnectedInstitution_ItShouldReturn200WithAvailableAccounts()
+  {
+    var (user, institution, expectedAccounts) = await ExecuteAsync(static async (context, ct, sp) =>
+    {
+      var passwordHasher = sp.GetRequiredService<IPasswordHasher>();
+      var encryptor = sp.GetRequiredService<IEncryptor>();
+      var plaidClient = sp.GetRequiredService<PlaidClient>();
+
+      var userEncryptionKey = await encryptor.GenerateEncryptedKeyAsync(ct);
+      var user = User.From("Stevan", passwordHasher.Hash("@Password1"), userEncryptionKey);
+
+      var institutionId = "ins_109508";
+
+      var publicTokenResponse = await plaidClient.SandboxPublicTokenCreateAsync(new()
+      {
+        InstitutionId = institutionId,
+        InitialProducts = [Products.Transactions],
+      });
+
+      var exchangeTokenResponse = await plaidClient.ItemPublicTokenExchangeAsync(new()
+      {
+        PublicToken = publicTokenResponse.PublicToken,
+      });
+
+      var accountsResponse = await plaidClient.AccountsGetAsync(new()
+      {
+        AccessToken = exchangeTokenResponse.AccessToken,
+      });
+      var encryptedAccessToken = await encryptor.EncryptAsyncFor(user, exchangeTokenResponse.AccessToken, ct);
+      var institutionMetadata = PlaidMetadata.From(institutionId, "Some Bank", encryptedAccessToken);
+      var institution = Institution.From("Some Bank", institutionMetadata);
+
+      user.AddInstitution(institution);
+
+      context.Add(user);
+      context.Add(institution);
+      await context.SaveChangesAsync(ct);
+      return (user, institution, accountsResponse.Accounts);
+    }, TestContext.Current.CancellationToken);
+
+    using var request = HttpRequestBuilder.New()
+      .WithUri(GetAvailableUri(institution.Id))
+      .WithUserId(user.Id)
+      .Build();
+
+    var response = await Client.SendAsync(request, TestContext.Current.CancellationToken);
+
+    (await response.Should().BeJsonContentOfType<Response>(HttpStatusCode.OK))
+      .Which.Accounts.Should().BeEquivalentTo(expectedAccounts.Select(AccountDto.FromPlaidAccount));
+  }
+}

tests/FiscalOS.API.Tests/Usings.cs

@@ -27,6 +27,7 @@ global using Microsoft.AspNetCore.Mvc;
 global using Microsoft.AspNetCore.Mvc.Testing;
 global using Microsoft.AspNetCore.TestHost;
 global using Microsoft.EntityFrameworkCore;
+global using Microsoft.Extensions.Configuration;
 global using Microsoft.Extensions.DependencyInjection;
 global using Microsoft.Extensions.Logging;
 global using Microsoft.Extensions.Options;