tests(apphost.tests): added support for end to end testing using playwright

feat(web,api): added ability to add and then display list of institutions
feat(web): finish implementing login
2026-02-23 05:53:17 -06:00 · 2026-02-22 06:53:13 -06:00 · 2026-02-21 07:32:28 -06:00 · 2026-02-21 07:32:28 -06:00 · 2026-02-21 07:32:28 -06:00 · 2026-02-21 07:32:28 -06:00
178 changed files with 62045 additions and 354 deletions
@@ -0,0 +1,3 @@
+{
+  "appHostPath": "../src/FiscalOS.AppHost/FiscalOS.AppHost.csproj"
+}
@@ -0,0 +1,11 @@
+{
+  "recommendations": [
+    "Vue.volar",
+    "vitest.explorer",
+    "ms-playwright.playwright",
+    "dbaeumer.vscode-eslint",
+    "EditorConfig.EditorConfig",
+    "oxc.oxc-vscode",
+    "esbenp.prettier-vscode"
+  ]
+}
@@ -0,0 +1,14 @@
+{
+  "dotnet.defaultSolution": "FiscalOS.slnx",
+  "explorer.fileNesting.enabled": true,
+  "explorer.fileNesting.patterns": {
+    "tsconfig.json": "tsconfig.*.json, env.d.ts, typed-router.d.ts",
+    "vite.config.*": "jsconfig*, vitest.config.*, cypress.config.*, playwright.config.*",
+    "package.json": "package-lock.json, pnpm*, .yarnrc*, yarn*, .eslint*, eslint*, .oxlint*, oxlint*, .oxfmt*, .prettier*, prettier*, .editorconfig"
+  },
+  "editor.codeActionsOnSave": {
+    "source.fixAll": "explicit"
+  },
+  "editor.formatOnSave": true,
+  "editor.defaultFormatter": "esbenp.prettier-vscode"
+}
@@ -1,116 +0,0 @@
-
-Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio Version 17
-VisualStudioVersion = 17.0.31903.59
-MinimumVisualStudioVersion = 10.0.40219.1
-Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "tests", "tests", "{0AB3BF05-4346-4AA6-1389-037BE0695223}"
-EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FiscalOS.API.Tests", "tests\FiscalOS.API.Tests\FiscalOS.API.Tests.csproj", "{1869E249-07F6-41CD-B143-AF86F022E4A6}"
-EndProject
-Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "src", "src", "{827E0CD3-B72D-47B6-A68D-7590B98EB39B}"
-EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FiscalOS.API", "src\FiscalOS.API\FiscalOS.API.csproj", "{85E0C8F3-AE69-4012-836C-759E9D297762}"
-EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FiscalOS.AdminCLI", "src\FiscalOS.AdminCLI\FiscalOS.AdminCLI.csproj", "{C46818A0-1A92-4E4F-8390-48CBA9971745}"
-EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FiscalOS.Core", "src\FiscalOS.Core\FiscalOS.Core.csproj", "{612496CD-1F25-4804-8C52-49E62D01FFDC}"
-EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FiscalOS.Infra", "src\FiscalOS.Infra\FiscalOS.Infra.csproj", "{DAB42870-02A2-4ECB-B07F-6815C52D2435}"
-EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FiscalOS.Infra.Tests", "tests\FiscalOS.Infra.Tests\FiscalOS.Infra.Tests.csproj", "{48E0737E-0200-468E-ADA7-75893935DBC0}"
-EndProject
-Global
-	GlobalSection(SolutionConfigurationPlatforms) = preSolution
-		Debug|Any CPU = Debug|Any CPU
-		Debug|x64 = Debug|x64
-		Debug|x86 = Debug|x86
-		Release|Any CPU = Release|Any CPU
-		Release|x64 = Release|x64
-		Release|x86 = Release|x86
-	EndGlobalSection
-	GlobalSection(ProjectConfigurationPlatforms) = postSolution
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Debug|x64.Build.0 = Debug|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Debug|x86.Build.0 = Debug|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Release|Any CPU.Build.0 = Release|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Release|x64.ActiveCfg = Release|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Release|x64.Build.0 = Release|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Release|x86.ActiveCfg = Release|Any CPU
-		{1869E249-07F6-41CD-B143-AF86F022E4A6}.Release|x86.Build.0 = Release|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Debug|x64.Build.0 = Debug|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Debug|x86.Build.0 = Debug|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Release|Any CPU.Build.0 = Release|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Release|x64.ActiveCfg = Release|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Release|x64.Build.0 = Release|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Release|x86.ActiveCfg = Release|Any CPU
-		{85E0C8F3-AE69-4012-836C-759E9D297762}.Release|x86.Build.0 = Release|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Debug|x64.Build.0 = Debug|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Debug|x86.Build.0 = Debug|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Release|Any CPU.Build.0 = Release|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Release|x64.ActiveCfg = Release|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Release|x64.Build.0 = Release|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Release|x86.ActiveCfg = Release|Any CPU
-		{C46818A0-1A92-4E4F-8390-48CBA9971745}.Release|x86.Build.0 = Release|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Debug|x64.Build.0 = Debug|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Debug|x86.Build.0 = Debug|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Release|Any CPU.Build.0 = Release|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Release|x64.ActiveCfg = Release|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Release|x64.Build.0 = Release|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Release|x86.ActiveCfg = Release|Any CPU
-		{612496CD-1F25-4804-8C52-49E62D01FFDC}.Release|x86.Build.0 = Release|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Debug|x64.Build.0 = Debug|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Debug|x86.Build.0 = Debug|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Release|Any CPU.Build.0 = Release|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Release|x64.ActiveCfg = Release|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Release|x64.Build.0 = Release|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Release|x86.ActiveCfg = Release|Any CPU
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435}.Release|x86.Build.0 = Release|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Debug|x64.Build.0 = Debug|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Debug|x86.Build.0 = Debug|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Release|Any CPU.Build.0 = Release|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Release|x64.ActiveCfg = Release|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Release|x64.Build.0 = Release|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Release|x86.ActiveCfg = Release|Any CPU
-		{48E0737E-0200-468E-ADA7-75893935DBC0}.Release|x86.Build.0 = Release|Any CPU
-	EndGlobalSection
-	GlobalSection(SolutionProperties) = preSolution
-		HideSolutionNode = FALSE
-	EndGlobalSection
-	GlobalSection(NestedProjects) = preSolution
-		{1869E249-07F6-41CD-B143-AF86F022E4A6} = {0AB3BF05-4346-4AA6-1389-037BE0695223}
-		{85E0C8F3-AE69-4012-836C-759E9D297762} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
-		{C46818A0-1A92-4E4F-8390-48CBA9971745} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
-		{612496CD-1F25-4804-8C52-49E62D01FFDC} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
-		{DAB42870-02A2-4ECB-B07F-6815C52D2435} = {827E0CD3-B72D-47B6-A68D-7590B98EB39B}
-		{48E0737E-0200-468E-ADA7-75893935DBC0} = {0AB3BF05-4346-4AA6-1389-037BE0695223}
-	EndGlobalSection
-EndGlobal
@@ -0,0 +1,21 @@
+<Solution>
+  <Configurations>
+    <Platform Name="Any CPU" />
+    <Platform Name="x64" />
+    <Platform Name="x86" />
+  </Configurations>
+  <Folder Name="/src/">
+    <Project Path="src/FiscalOS.AdminCLI/FiscalOS.AdminCLI.csproj" />
+    <Project Path="src/FiscalOS.API/FiscalOS.API.csproj" />
+    <Project Path="src/FiscalOS.Core/FiscalOS.Core.csproj" />
+    <Project Path="src/FiscalOS.Infra/FiscalOS.Infra.csproj" />
+  </Folder>
+  <Folder Name="/tests/">
+    <Project Path="tests/FiscalOS.API.Tests/FiscalOS.API.Tests.csproj" />
+    <Project Path="tests/FiscalOS.AppHost.Tests/FiscalOS.AppHost.Tests.csproj" />
+    <Project Path="tests/FiscalOS.Core.Tests/FiscalOS.Core.Tests.csproj" />
+    <Project Path="tests/FiscalOS.Infra.Tests/FiscalOS.Infra.Tests.csproj" />
+  </Folder>
+  <Project Path="src/FiscalOS.AppHost/FiscalOS.AppHost.csproj" />
+  <Project Path="src/FiscalOS.ServiceDefaults/FiscalOS.ServiceDefaults.csproj" />
+</Solution>
@@ -3,6 +3,8 @@
    <ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
  </PropertyGroup>
  <ItemGroup>
+    <PackageVersion Include="Aspire.Hosting.JavaScript" Version="13.1.1" />
+    <PackageVersion Include="Going.Plaid" Version="6.56.0" />
    <PackageVersion Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.2" />
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Design" Version="10.0.2">
      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
@@ -11,5 +13,13 @@
    <PackageVersion Include="Microsoft.EntityFrameworkCore.Sqlite" Version="10.0.2" />
    <PackageVersion Include="Microsoft.Extensions.Hosting" Version="10.0.2" />
    <PackageVersion Include="Spectre.Console" Version="0.54.0" />
+    <PackageVersion Include="TestableIO.System.IO.Abstractions.Wrappers" Version="22.1.0" />
+    <PackageVersion Include="Microsoft.Extensions.Http.Resilience" Version="10.1.0" />
+    <PackageVersion Include="Microsoft.Extensions.ServiceDiscovery" Version="10.1.0" />
+    <PackageVersion Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.14.0" />
+    <PackageVersion Include="OpenTelemetry.Extensions.Hosting" Version="1.14.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.14.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Http" Version="1.14.0" />
+    <PackageVersion Include="OpenTelemetry.Instrumentation.Runtime" Version="1.14.0" />
  </ItemGroup>
 </Project>
@@ -0,0 +1,16 @@
+namespace FiscalOS.API.Accounts;
+
+internal static class AccountsExtensions
+{
+  private const string RouteGroupPrefix = "/accounts";
+
+  public static RouteGroupBuilder MapAccountsEndpoints(this WebApplication app)
+  {
+    var accountsGroup = app.MapGroup(RouteGroupPrefix)
+      .RequireAuthorization();
+
+    accountsGroup.MapAddEndpoint();
+
+    return accountsGroup;
+  }
+}
@@ -0,0 +1,56 @@
+namespace FiscalOS.API.Accounts.Add;
+
+internal static class Endpoint
+{
+  private const string Route = "/";
+
+  public static RouteHandlerBuilder MapAddEndpoint(this RouteGroupBuilder groupBuilder)
+  {
+    return groupBuilder.MapPost(Route, HandleAsync);
+  }
+
+  private static async Task<IResult> HandleAsync(
+    HttpContext httpContext,
+    [FromBody] Request request,
+    [FromServices] AppDbContext appDbContext,
+    CancellationToken ct
+  )
+  {
+    var userId = httpContext.GetUserId();
+
+    var user = await appDbContext.Users
+      .Include(u => u.Institutions.Where(i => i.Metadata is PlaidMetadata && ((PlaidMetadata)i.Metadata).PlaidId == request.PlaidInstitutionId))
+      .Include(u => u.Accounts.Where(a => a.Metadata is PlaidAccountMetadata && ((PlaidAccountMetadata)a.Metadata).PlaidId == request.PlaidAccountId))
+      .ThenInclude(a => a.Metadata)
+      .SingleOrDefaultAsync(u => u.Id == userId, ct);
+
+    if (user is null)
+    {
+      return Results.Unauthorized();
+    }
+
+    if (user.Institutions.Any() is false)
+    {
+      return Results.ValidationProblem(new Dictionary<string, string[]>
+      {
+        ["PlaidInstitutionId"] = ["The PlaidInstitutionId field is invalid. No institution connected with the given PlaidInstitutionId was found for the user."],
+      });
+    }
+
+    if (user.Accounts.Any())
+    {
+      return Results.Conflict();
+    }
+
+    var accountMetadata = PlaidAccountMetadata.From(request.PlaidAccountId, request.PlaidAccountName);
+    var account = Account.From(user.Institutions.First().Id, request.PlaidAccountName, accountMetadata);
+    var balance = Balance.From(request.AccountCurrentBalance, request.AccountAvailableBalance, request.AccountCurrencyCode);
+
+    account.AddBalance(balance);
+    user.AddAccount(account);
+
+    await appDbContext.SaveChangesAsync(ct);
+
+    return Results.Ok();
+  }
+}
@@ -0,0 +1,38 @@
+namespace FiscalOS.API.Accounts.Add;
+
+public record Request : IValidatableObject
+{
+  public string PlaidInstitutionId { get; init; } = string.Empty;
+  public string PlaidAccountId { get; init; } = string.Empty;
+  public string PlaidAccountName { get; init; } = string.Empty;
+  public decimal AccountCurrentBalance { get; init; }
+  public decimal AccountAvailableBalance { get; init; }
+  public string AccountCurrencyCode { get; init; } = string.Empty;
+
+  public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
+  {
+    if (string.IsNullOrWhiteSpace(PlaidInstitutionId))
+    {
+      var fieldName = nameof(PlaidInstitutionId);
+      yield return new($"The {fieldName} field is required.", [fieldName]);
+    }
+
+    if (string.IsNullOrWhiteSpace(PlaidAccountId))
+    {
+      var fieldName = nameof(PlaidAccountId);
+      yield return new($"The {fieldName} field is required.", [fieldName]);
+    }
+
+    if (string.IsNullOrWhiteSpace(PlaidAccountName))
+    {
+      var fieldName = nameof(PlaidAccountName);
+      yield return new($"The {fieldName} field is required.", [fieldName]);
+    }
+
+    if (string.IsNullOrWhiteSpace(AccountCurrencyCode))
+    {
+      var fieldName = nameof(AccountCurrencyCode);
+      yield return new($"The {fieldName} field is required.", [fieldName]);
+    }
+  }
+}
@@ -0,0 +1,18 @@
+namespace FiscalOS.API.Auth;
+
+internal static class AuthExtensions
+{
+  private const string RouteGroupPrefix = "/auth";
+
+  public static RouteGroupBuilder MapAuthEndpoints(this WebApplication app)
+  {
+    var authGroup = app.MapGroup(RouteGroupPrefix);
+
+    authGroup.MapLoginEndpoint();
+
+    authGroup.MapRefreshEndpoint()
+      .RequireAuthorization(Schemes.AllowExpiredTokens);
+
+    return authGroup;
+  }
+}
@@ -1,17 +1,17 @@
-namespace FiscalOS.API.Login;
+namespace FiscalOS.API.Auth.Login;

 internal static class Endpoint
 {
  private const string Route = "/login";

-  public static RouteHandlerBuilder MapLoginEndpoint(this WebApplication app)
+  public static RouteHandlerBuilder MapLoginEndpoint(this RouteGroupBuilder groupBuilder)
  {
-    return app.MapPost(Route, HandleAsync);
+    return groupBuilder.MapPost(Route, HandleAsync);
  }

  private static async Task<IResult> HandleAsync(
    HttpContext httpContext,
-    [FromBody] LoginRequest loginRequest,
+    [FromBody] Request loginRequest,
    [FromServices] AppDbContext appDbContext,
    [FromServices] IPasswordHasher passwordHasher,
    [FromServices] ITokenGenerator tokenService
@@ -1,7 +1,6 @@
+namespace FiscalOS.API.Auth.Login;

-namespace FiscalOS.API.Login;
-
-public record LoginRequest : IValidatableObject
+public record Request : IValidatableObject
 {
  public string Username { get; init; } = string.Empty;
  public string Password { get; init; } = string.Empty;
@@ -10,12 +9,14 @@ public record LoginRequest : IValidatableObject
  {
    if (string.IsNullOrWhiteSpace(Username))
    {
-      yield return new("The Username field is required.", [nameof(Username)]);
+      var fieldName = nameof(Username);
+      yield return new($"The {fieldName} field is required.", [fieldName]);
    }

    if (string.IsNullOrWhiteSpace(Password))
    {
-      yield return new("The Password field is required.", [nameof(Password)]);
+      var fieldName = nameof(Password);
+      yield return new($"The {fieldName} field is required.", [fieldName]);
    }
  }
 }
@@ -1,4 +1,4 @@
-namespace FiscalOS.API.Refresh;
+namespace FiscalOS.API.Auth.Login;

 internal sealed record Response
 {
@@ -1,12 +1,12 @@
-namespace FiscalOS.API.Refresh;
+namespace FiscalOS.API.Auth.Refresh;

 internal static class Endpoint
 {
  private const string Route = "/refresh";

-  public static RouteHandlerBuilder MapRefreshEndpoint(this WebApplication app)
+  public static RouteHandlerBuilder MapRefreshEndpoint(this RouteGroupBuilder groupBuilder)
  {
-    return app.MapPost(Route, HandleAsync);
+    return groupBuilder.MapPost(Route, HandleAsync);
  }

  private static async Task<IResult> HandleAsync(
@@ -1,4 +1,4 @@
-namespace FiscalOS.API.Login;
+namespace FiscalOS.API.Auth.Refresh;

 internal sealed record Response
 {
@@ -10,6 +10,7 @@
  <ItemGroup>
    <ProjectReference Include="..\FiscalOS.Core\FiscalOS.Core.csproj" />
    <ProjectReference Include="..\FiscalOS.Infra\FiscalOS.Infra.csproj" />
+    <ProjectReference Include="..\FiscalOS.ServiceDefaults\FiscalOS.ServiceDefaults.csproj" />
  </ItemGroup>

 </Project>
@@ -1,5 +1,3 @@
-using FiscalOS.Core.Identity;
-
 namespace FiscalOS.API.Http;

 internal static class HttpContextExtensions
@@ -0,0 +1,57 @@
+namespace FiscalOS.API.Institutions.Connect;
+
+internal static class Endpoint
+{
+  private const string Route = "/connect";
+
+  public static RouteHandlerBuilder MapConnectEndpoint(this RouteGroupBuilder groupBuilder)
+  {
+    return groupBuilder.MapPost(Route, HandleAsync);
+  }
+
+  private static async Task<IResult> HandleAsync(
+    HttpContext httpContext,
+    [FromBody] Request request,
+    [FromServices] AppDbContext appDbContext,
+    [FromServices] PlaidService plaidService,
+    [FromServices] IEncryptor encryptor,
+    CancellationToken ct
+  )
+  {
+    var userId = httpContext.GetUserId();
+
+    var user = await appDbContext.Users
+      .Include(u => u.Institutions
+        .Where(
+          i => i.Metadata is PlaidMetadata &&
+            ((PlaidMetadata)i.Metadata).PlaidId == request.PlaidInstitutionId
+        )
+      )
+      .ThenInclude(i => i.Metadata)
+      .SingleOrDefaultAsync(u => u.Id == userId, ct);
+
+    if (user is null)
+    {
+      return Results.Unauthorized();
+    }
+
+    if (user.Institutions.Any())
+    {
+      return Results.Conflict();
+    }
+
+    var (itemId, accessToken) = await plaidService.ExchangeTokenAsync(request.PublicToken);
+    var item = await plaidService.GetItemAsync(accessToken);
+
+    var encryptedAccessToken = await encryptor.EncryptAsyncFor(user, accessToken, ct);
+
+    var plaidMetadata = PlaidMetadata.From(item.InstitutionId, item.InstitutionName, encryptedAccessToken);
+    var institution = Institution.From(item.InstitutionName, plaidMetadata);
+
+    user.AddInstitution(institution);
+
+    await appDbContext.SaveChangesAsync(ct);
+
+    return Results.Ok();
+  }
+}
@@ -0,0 +1,22 @@
+namespace FiscalOS.API.Institutions.Connect;
+
+public record Request : IValidatableObject
+{
+  public string PublicToken { get; init; } = string.Empty;
+  public string PlaidInstitutionId { get; init; } = string.Empty;
+
+  public IEnumerable<ValidationResult> Validate(ValidationContext validationContext)
+  {
+    if (string.IsNullOrWhiteSpace(PublicToken))
+    {
+      var fieldName = nameof(PublicToken);
+      yield return new($"The {fieldName} field is required.", [fieldName]);
+    }
+
+    if (string.IsNullOrWhiteSpace(PlaidInstitutionId))
+    {
+      var fieldName = nameof(PlaidInstitutionId);
+      yield return new($"The {fieldName} field is required.", [fieldName]);
+    }
+  }
+}
@@ -0,0 +1,34 @@
+namespace FiscalOS.API.Institutions.Get;
+
+internal static class Endpoint
+{
+  private const string Route = "/";
+
+  public static RouteHandlerBuilder MapGetEndpoint(this RouteGroupBuilder groupBuilder)
+  {
+    return groupBuilder.MapGet(Route, HandleAsync);
+  }
+
+  private static async Task<IResult> HandleAsync(
+    HttpContext httpContext,
+    [FromServices] AppDbContext appDbContext
+  )
+  {
+    var userId = httpContext.GetUserId();
+
+    var user = await appDbContext.Users
+      .Include(u => u.Institutions)
+      .FirstOrDefaultAsync(u => u.Id == userId);
+
+    if (user is null)
+    {
+      return Results.Unauthorized();
+    }
+
+    var institutionDtos = user.Institutions
+      .Select(InstitutionDto.FromInstitution)
+      .OrderBy(dto => dto.Name);
+
+    return Results.Ok(Response.From(institutionDtos));
+  }
+}
@@ -0,0 +1,39 @@
+namespace FiscalOS.API.Institutions.Get;
+
+internal sealed record Response
+{
+  public IEnumerable<InstitutionDto> Institutions { get; init; } = [];
+
+  [JsonConstructor]
+  private Response()
+  {
+  }
+
+  public static Response From(IEnumerable<InstitutionDto> institutions)
+  {
+    return new Response
+    {
+      Institutions = institutions,
+    };
+  }
+}
+
+internal sealed record InstitutionDto
+{
+  public string Id { get; init; } = string.Empty;
+  public string Name { get; init; } = string.Empty;
+
+  [JsonConstructor]
+  private InstitutionDto()
+  {
+  }
+
+  public static InstitutionDto FromInstitution(Institution institution)
+  {
+    return new InstitutionDto
+    {
+      Id = institution.Id.ToString(),
+      Name = institution.Name,
+    };
+  }
+}
@@ -0,0 +1,51 @@
+namespace FiscalOS.API.Institutions.GetAvailable;
+
+internal static class Endpoint
+{
+  private const string Route = "/{id}/available";
+
+  public static RouteHandlerBuilder MapGetAvailableEndpoint(this RouteGroupBuilder groupBuilder)
+  {
+    return groupBuilder.MapGet(Route, HandleAsync);
+  }
+
+  private static async Task<IResult> HandleAsync(
+    HttpContext httpContext,
+    [FromRoute] Guid id,
+    [FromServices] AppDbContext appDbContext,
+    [FromServices] PlaidService plaidService,
+    [FromServices] IEncryptor encryptor,
+    CancellationToken ct
+  )
+  {
+    var userId = httpContext.GetUserId();
+
+    var user = await appDbContext.Users
+      .Include(u => u.Institutions.Where(i => i.Id == id))
+      .ThenInclude(i => i.Metadata)
+      .SingleOrDefaultAsync(u => u.Id == userId, ct);
+
+    if (user is null)
+    {
+      return Results.Unauthorized();
+    }
+
+    if (user.Institutions.Any() is false)
+    {
+      return Results.NotFound();
+    }
+
+    var institution = user.Institutions.First();
+
+    if (institution.Metadata is not PlaidMetadata plaidMetadata)
+    {
+      return Results.BadRequest();
+    }
+
+    var accessToken = await encryptor.DecryptAsyncFor(user, plaidMetadata.EncryptedAccessToken, ct);
+    var accounts = await plaidService.GetAccountsAsync(accessToken);
+    var accountsDtos = accounts.Select(AccountDto.FromPlaidAccount);
+
+    return Results.Ok(Response.From(accountsDtos));
+  }
+}
@@ -0,0 +1,45 @@
+namespace FiscalOS.API.Institutions.GetAvailable;
+
+internal sealed record Response
+{
+  public IEnumerable<AccountDto> Accounts { get; init; } = [];
+
+  [JsonConstructor]
+  private Response()
+  {
+  }
+
+  public static Response From(IEnumerable<AccountDto> accounts)
+  {
+    return new Response
+    {
+      Accounts = accounts
+    };
+  }
+}
+
+internal sealed record AccountDto
+{
+  public string ProviderId { get; init; } = string.Empty;
+  public string ProviderName { get; init; } = string.Empty;
+  public decimal CurrentBalance { get; init; }
+  public decimal AvailableBalance { get; init; }
+  public string CurrencyCode { get; init; } = string.Empty;
+
+  [JsonConstructor]
+  private AccountDto()
+  {
+  }
+
+  public static AccountDto FromPlaidAccount(Going.Plaid.Entity.Account plaidAccount)
+  {
+    return new AccountDto
+    {
+      ProviderId = plaidAccount.AccountId,
+      ProviderName = plaidAccount.Name,
+      AvailableBalance = plaidAccount.Available,
+      CurrentBalance = plaidAccount.Current,
+      CurrencyCode = plaidAccount.CurrencyCode,
+    };
+  }
+}
@@ -0,0 +1,19 @@
+namespace FiscalOS.API.Institutions;
+
+internal static class InstitutionsExtensions
+{
+  private const string RouteGroupPrefix = "/institutions";
+
+  public static RouteGroupBuilder MapInstitutionsEndpoints(this WebApplication app)
+  {
+    var institutionsGroup = app.MapGroup(RouteGroupPrefix)
+      .RequireAuthorization();
+
+    institutionsGroup.MapConnectEndpoint();
+    institutionsGroup.MapGetAvailableEndpoint();
+    institutionsGroup.MapLinkEndpoint();
+    institutionsGroup.MapGetEndpoint();
+
+    return institutionsGroup;
+  }
+}
@@ -0,0 +1,31 @@
+namespace FiscalOS.API.Institutions.Link;
+
+internal static class Endpoint
+{
+  private const string Route = "/link";
+
+  public static RouteHandlerBuilder MapLinkEndpoint(this RouteGroupBuilder groupBuilder)
+  {
+    return groupBuilder.MapPost(Route, HandleAsync);
+  }
+
+  private static async Task<IResult> HandleAsync(
+    HttpContext httpContext,
+    [FromServices] AppDbContext appDbContext,
+    [FromServices] PlaidService plaidService
+  )
+  {
+    var userId = httpContext.GetUserId();
+
+    var user = await appDbContext.Users.SingleOrDefaultAsync(u => u.Id == userId);
+
+    if (user is null)
+    {
+      return Results.Unauthorized();
+    }
+
+    var linkToken = await plaidService.CreateLinkTokenAsync(user.Id.ToString());
+
+    return Results.Ok(Response.From(linkToken));
+  }
+}
@@ -0,0 +1,19 @@
+namespace FiscalOS.API.Institutions.Link;
+
+public sealed record Response
+{
+  public string LinkToken { get; init; } = string.Empty;
+
+  [JsonConstructor]
+  private Response()
+  {
+  }
+
+  public static Response From(string linkToken)
+  {
+    return new()
+    {
+      LinkToken = linkToken,
+    };
+  }
+}
@@ -1,7 +1,9 @@
-using FiscalOS.Infra.Authentication;
+using FiscalOS.ServiceDefaults;

 var builder = WebApplication.CreateBuilder(args);

+builder.AddServiceDefaults();
+
 builder.Services.AddValidation();
 builder.Services.AddProblemDetails();

@@ -34,9 +36,10 @@ app.UseAuthentication();
 app.UseAuthorization();
 app.UseStatusCodePages();

-app.MapLoginEndpoint();
+app.MapDefaultEndpoints();

-app.MapRefreshEndpoint()
-  .RequireAuthorization(Schemes.AllowExpiredTokens);
+app.MapAuthEndpoints();
+app.MapAccountsEndpoints();
+app.MapInstitutionsEndpoints();

 app.Run();
@@ -18,6 +18,6 @@
      "environmentVariables": {
        "ASPNETCORE_ENVIRONMENT": "Development"
      }
-    },
+    }
  }
 }
@@ -2,12 +2,25 @@ global using System.ComponentModel.DataAnnotations;
 global using System.Security.Claims;
 global using System.Text.Json.Serialization;

+global using FiscalOS.API.Institutions.Get;
+global using FiscalOS.API.Accounts;
+global using FiscalOS.API.Accounts.Add;
+global using FiscalOS.API.Auth;
+global using FiscalOS.API.Auth.Login;
+global using FiscalOS.API.Auth.Refresh;
 global using FiscalOS.API.Http;
-global using FiscalOS.API.Login;
-global using FiscalOS.API.Refresh;
+global using FiscalOS.API.Institutions;
+global using FiscalOS.API.Institutions.Connect;
+global using FiscalOS.API.Institutions.GetAvailable;
+global using FiscalOS.API.Institutions.Link;
+global using FiscalOS.Core.Accounts;
 global using FiscalOS.Core.Authentication;
+global using FiscalOS.Core.Identity;
+global using FiscalOS.Core.Security;
+global using FiscalOS.Infra.Accounts.Plaid;
+global using FiscalOS.Infra.Authentication;
 global using FiscalOS.Infra.Data;
 global using FiscalOS.Infra.DependencyInjection;

 global using Microsoft.AspNetCore.Mvc;
-global using Microsoft.EntityFrameworkCore;
+global using Microsoft.EntityFrameworkCore;
@@ -14,5 +14,13 @@
    "Issuer": "Issuer",
    "Secret": "Secret",
    "ExpiryInMinutes": "ExpiryInMinutes"
+  },
+  "FileKeyRingOptions": {
+    "KeysDirectoryPath": "KeysDirectoryPath",
+    "PrimaryKeyId": "PrimaryKeyId"
+  },
+  "PlaidClientOptions": {
+    "ClientId": "ClientId",
+    "Secret": "Secret"
  }
 }
@@ -3,7 +3,9 @@ namespace FiscalOS.AdminCLI;
 internal sealed class App(
  IAnsiConsole console,
  IPasswordHasher passwordHasher,
-  IServiceScopeFactory serviceScopeFactory
+  IServiceScopeFactory serviceScopeFactory,
+  IEncryptor encryptor,
+  IKeyRing keyRing
 ) : IHostedService
 {
  private readonly IAnsiConsole _console = console;
@@ -32,13 +34,19 @@ internal sealed class App(
        );

        var hashedPassword = passwordHasher.Hash(password);
-        var user = User.From(username, hashedPassword);
+        var userEncryptionKey = await encryptor.GenerateEncryptedKeyAsync(cancellationToken);
+        var user = User.From(username, hashedPassword, userEncryptionKey);

        await appDbContext.Users.AddAsync(user, cancellationToken);
        await appDbContext.SaveChangesAsync(cancellationToken);

        _console.MarkupLine($"User [green]{username}[/] created successfully.");
        break;
+      case Commands.GenerateKey:
+        var key = encryptor.GenerateKey();
+        var keyRingEntry = await keyRing.SaveKeyAsync(key);
+        _console.MarkupLine($"Key generated with id [green]{keyRingEntry.KeyId}[/] generated successfully.");
+        break;
      case Commands.Exit:
      default:
        break;
@@ -3,7 +3,12 @@ namespace FiscalOS.AdminCLI;
 internal static class Commands
 {
  public const string CreateUser = "Create User";
+  public const string GenerateKey = "Generate Key";
  public const string Exit = "Exit";

-  public static readonly string[] All = [CreateUser, Exit];
+  public static readonly string[] All = [
+    CreateUser,
+    GenerateKey,
+    Exit
+  ];
 }
@@ -1,6 +1,7 @@
 global using FiscalOS.AdminCLI;
 global using FiscalOS.Core.Authentication;
 global using FiscalOS.Core.Identity;
+global using FiscalOS.Core.Security;
 global using FiscalOS.Infra.Data;
 global using FiscalOS.Infra.DependencyInjection;

@@ -1,5 +1,9 @@
 {
  "AppDbContextOptions": {
    "DatabaseFilePath": "DatabaseFilePath"
+  },
+  "FileKeyRingOptions": {
+    "KeysDirectoryPath": "KeysDirectoryPath",
+    "PrimaryKeyId": "PrimaryKeyId"
  }
 }
@@ -0,0 +1,12 @@
+using FiscalOS.AppHost;
+
+var builder = DistributedApplication.CreateBuilder(args);
+
+var api = builder.AddProject<Projects.FiscalOS_API>(ProjectNames.API)
+  .WithHttpHealthCheck("/health");
+
+builder.AddViteApp(ProjectNames.Web, "../FiscalOS.Web")
+  .WithReference(api)
+  .WithHttpsEndpoint(port: 7061, env: "PORT");
+
+builder.Build().Run();
@@ -0,0 +1,19 @@
+<Project Sdk="Aspire.AppHost.Sdk/13.1.1">
+
+  <ItemGroup>
+    <ProjectReference Include="..\FiscalOS.API\FiscalOS.API.csproj" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Aspire.Hosting.JavaScript" />
+  </ItemGroup>
+
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <UserSecretsId>80a27726-36cc-4a4d-a55d-11af527158bc</UserSecretsId>
+  </PropertyGroup>
+
+</Project>
@@ -0,0 +1,7 @@
+namespace FiscalOS.AppHost;
+
+public static class ProjectNames
+{
+  public const string API = "api";
+  public const string Web = "web";
+}
@@ -0,0 +1,31 @@
+{
+  "$schema": "https://json.schemastore.org/launchsettings.json",
+  "profiles": {
+    "https": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "https://localhost:17104;http://localhost:15068",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development",
+        "DOTNET_ENVIRONMENT": "Development",
+        "ASPIRE_DASHBOARD_OTLP_ENDPOINT_URL": "https://localhost:21226",
+        "ASPIRE_DASHBOARD_MCP_ENDPOINT_URL": "https://localhost:23228",
+        "ASPIRE_RESOURCE_SERVICE_ENDPOINT_URL": "https://localhost:22081"
+      }
+    },
+    "http": {
+      "commandName": "Project",
+      "dotnetRunMessages": true,
+      "launchBrowser": true,
+      "applicationUrl": "http://localhost:15068",
+      "environmentVariables": {
+        "ASPNETCORE_ENVIRONMENT": "Development",
+        "DOTNET_ENVIRONMENT": "Development",
+        "ASPIRE_DASHBOARD_OTLP_ENDPOINT_URL": "http://localhost:19221",
+        "ASPIRE_DASHBOARD_MCP_ENDPOINT_URL": "http://localhost:18206",
+        "ASPIRE_RESOURCE_SERVICE_ENDPOINT_URL": "http://localhost:20097"
+      }
+    }
+  }
+}
@@ -0,0 +1,30 @@
+namespace FiscalOS.Core.Accounts;
+
+public sealed class Account : Entity
+{
+  public Guid UserId { get; init; }
+  public Guid InstitutionId { get; init; }
+  public Institution? Institution { get; init; }
+  public string Name { get; init; } = string.Empty;
+  public AccountMetadata? Metadata { get; init; }
+
+  private readonly List<Balance> _balances = [];
+  public IEnumerable<Balance> Balances => _balances;
+
+  public static Account From(Guid institutionId, string name, AccountMetadata accountMetadata)
+  {
+    return new()
+    {
+      InstitutionId = institutionId,
+      Name = name,
+      Metadata = accountMetadata,
+    };
+  }
+
+  public void AddBalance(Balance balance)
+  {
+    ArgumentNullException.ThrowIfNull(balance);
+
+    _balances.Add(balance);
+  }
+}
@@ -0,0 +1,15 @@
+namespace FiscalOS.Core.Accounts;
+
+public abstract class AccountMetadata : Entity
+{
+  private readonly string _type;
+
+  public string Type => _type;
+
+  public Guid AccountId { get; init; }
+
+  protected AccountMetadata(string type)
+  {
+    _type = type;
+  }
+}
@@ -0,0 +1,27 @@
+namespace FiscalOS.Core.Accounts;
+
+public sealed class Balance : Entity
+{
+  public Guid AccountId { get; init; }
+  public decimal Current { get; init; }
+  public decimal Available { get; init; }
+  public string CurrencyCode { get; init; } = string.Empty;
+
+  private Balance()
+  {
+  }
+
+  public static Balance From(
+    decimal current,
+    decimal available,
+    string currencyCode
+  )
+  {
+    return new()
+    {
+      Current = current,
+      Available = available,
+      CurrencyCode = currencyCode,
+    };
+  }
+}
@@ -0,0 +1,24 @@
+namespace FiscalOS.Core.Accounts;
+
+public sealed class Institution : Entity
+{
+  public Guid UserId { get; init; }
+  public string Name { get; init; } = string.Empty;
+  public InstitutionMetadata? Metadata { get; init; }
+
+  private Institution()
+  {
+  }
+
+  public static Institution From(string? name, InstitutionMetadata metadata)
+  {
+    ArgumentNullException.ThrowIfNull(name, nameof(name));
+    ArgumentNullException.ThrowIfNull(metadata, nameof(metadata));
+
+    return new Institution()
+    {
+      Name = name,
+      Metadata = metadata
+    };
+  }
+}
@@ -0,0 +1,15 @@
+namespace FiscalOS.Core.Accounts;
+
+public abstract class InstitutionMetadata : Entity
+{
+  private readonly string _type;
+
+  public string Type => _type;
+
+  public Guid InstitutionId { get; init; }
+
+  protected InstitutionMetadata(string type)
+  {
+    _type = type;
+  }
+}
@@ -24,7 +24,7 @@ public sealed class RefreshToken : Entity

  public static RefreshToken From(User user, string token, DateTimeOffset expiresAt)
  {
-    ArgumentNullException.ThrowIfNull(user);
+    ArgumentNullException.ThrowIfNull(user, nameof(user));

    return new()
    {
@@ -2,13 +2,20 @@ namespace FiscalOS.Core.Identity;

 public sealed class User : Entity
 {
-  private readonly List<RefreshToken> _refreshTokens = [];
-
  public string Username { get; init; } = string.Empty;
  public string HashedPassword { get; init; } = string.Empty;
+  public string EncryptionKeyId { get; init; } = string.Empty;
+  public string EncryptedDataKey { get; init; } = string.Empty;

+  private readonly List<RefreshToken> _refreshTokens = [];
  public IEnumerable<RefreshToken> RefreshTokens => _refreshTokens;

+  private readonly List<Institution> _institutions = [];
+  public IEnumerable<Institution> Institutions => _institutions;
+
+  private readonly List<Account> _accounts = [];
+  public IEnumerable<Account> Accounts => _accounts;
+
  private User()
  {
  }
@@ -18,19 +25,39 @@ public sealed class User : Entity
    return new();
  }

-  public static User From(string username, string hashedPassword)
+  public static User From(string username, string hashedPassword, EncryptedDataKey encryptedDataKey)
  {
+    ArgumentNullException.ThrowIfNull(username, nameof(username));
+    ArgumentNullException.ThrowIfNull(hashedPassword, nameof(hashedPassword));
+    ArgumentNullException.ThrowIfNull(encryptedDataKey, nameof(encryptedDataKey));
+
    return new()
    {
      Username = username,
      HashedPassword = hashedPassword,
+      EncryptedDataKey = encryptedDataKey.EncryptedKey,
+      EncryptionKeyId = encryptedDataKey.KeyIdUsed,
    };
  }

  public void AddRefreshToken(RefreshToken refreshToken)
  {
-    ArgumentNullException.ThrowIfNull(refreshToken);
+    ArgumentNullException.ThrowIfNull(refreshToken, nameof(refreshToken));

    _refreshTokens.Add(refreshToken);
  }
+
+  public void AddInstitution(Institution institution)
+  {
+    ArgumentNullException.ThrowIfNull(institution, nameof(institution));
+
+    _institutions.Add(institution);
+  }
+
+  public void AddAccount(Account account)
+  {
+    ArgumentNullException.ThrowIfNull(account, nameof(account));
+
+    _accounts.Add(account);
+  }
 }
@@ -0,0 +1,21 @@
+namespace FiscalOS.Core.Security;
+
+public sealed record EncryptedDataKey
+{
+  public string KeyIdUsed { get; init; }
+  public string EncryptedKey { get; init; }
+
+  private EncryptedDataKey(string keyIdUsed, string encryptedKey)
+  {
+    KeyIdUsed = keyIdUsed;
+    EncryptedKey = encryptedKey;
+  }
+
+  public static EncryptedDataKey From(string keyIdUsed, string encryptedKey)
+  {
+    ArgumentNullException.ThrowIfNull(keyIdUsed, nameof(keyIdUsed));
+    ArgumentNullException.ThrowIfNull(encryptedKey, nameof(encryptedKey));
+
+    return new(keyIdUsed, encryptedKey);
+  }
+}
@@ -0,0 +1,11 @@
+namespace FiscalOS.Core.Security;
+
+public interface IEncryptor
+{
+  string GenerateKey();
+  Task<EncryptedDataKey> GenerateEncryptedKeyAsync(CancellationToken ct);
+  Task<string> EncryptAsync(string plainText, CancellationToken ct);
+  Task<string> EncryptAsyncFor(User user, string plainText, CancellationToken ct);
+  Task<string> DecryptAsync(string cipherText, CancellationToken ct);
+  Task<string> DecryptAsyncFor(User user, string plainText, CancellationToken ct);
+}
@@ -0,0 +1,8 @@
+namespace FiscalOS.Core.Security;
+
+public interface IKeyRing
+{
+  KeyRingEntry GetKey(string keyId);
+  KeyRingEntry GetPrimaryKey();
+  Task<KeyRingEntry> SaveKeyAsync(string key);
+}
@@ -0,0 +1,21 @@
+namespace FiscalOS.Core.Security;
+
+public sealed record KeyRingEntry
+{
+  public string KeyId { get; init; }
+  public string Key { get; init; }
+
+  private KeyRingEntry(string keyId, string key)
+  {
+    KeyId = keyId;
+    Key = key;
+  }
+
+  public static KeyRingEntry From(string keyId, string key)
+  {
+    ArgumentNullException.ThrowIfNull(keyId, nameof(keyId));
+    ArgumentNullException.ThrowIfNull(key, nameof(key));
+
+    return new(keyId, key);
+  }
+}
@@ -1,3 +1,4 @@
+global using FiscalOS.Core.Accounts;
 global using FiscalOS.Core.Data;
-
-global using FiscalOS.Core.Identity;
+global using FiscalOS.Core.Identity;
+global using FiscalOS.Core.Security;
@@ -0,0 +1,21 @@
+namespace FiscalOS.Infra.Accounts.Plaid;
+
+public sealed class PlaidAccountMetadata : AccountMetadata
+{
+  public const string TypeValue = Providers.Plaid;
+  public string PlaidId { get; init; } = string.Empty;
+  public string PlaidName { get; init; } = string.Empty;
+
+  private PlaidAccountMetadata() : base(TypeValue)
+  {
+  }
+
+  public static PlaidAccountMetadata From(string plaidId, string plaidName)
+  {
+    return new()
+    {
+      PlaidId = plaidId,
+      PlaidName = plaidName,
+    };
+  }
+}
@@ -0,0 +1,32 @@
+namespace FiscalOS.Infra.Accounts.Plaid;
+
+public sealed record PlaidClientOptions
+{
+  public string ClientId { get; init; } = string.Empty;
+  public string Secret { get; init; } = string.Empty;
+
+  public IOptions<PlaidOptions> ToPlaidOptions()
+  {
+    return Options.Create<PlaidOptions>(new()
+    {
+      ClientId = ClientId,
+      Secret = Secret
+    });
+  }
+}
+
+public sealed record PlaidClientOptionsSetup : IConfigureOptions<PlaidClientOptions>
+{
+  private const string SectionName = nameof(PlaidClientOptions);
+  private readonly IConfiguration _configuration;
+
+  public PlaidClientOptionsSetup(IConfiguration configuration)
+  {
+    _configuration = configuration;
+  }
+
+  public void Configure(PlaidClientOptions options)
+  {
+    _configuration.GetSection(SectionName).Bind(options);
+  }
+}
@@ -0,0 +1,16 @@
+namespace FiscalOS.Infra.Accounts.Plaid;
+
+public class PlaidException : Exception
+{
+  public PlaidException()
+  {
+  }
+
+  public PlaidException(string message) : base(message)
+  {
+  }
+
+  public PlaidException(string message, Exception innerException) : base(message, innerException)
+  {
+  }
+}
@@ -0,0 +1,15 @@
+namespace FiscalOS.Infra.Accounts.Plaid;
+
+public static class PlaidExtensions
+{
+#pragma warning disable CA1034
+  extension(Going.Plaid.Entity.Account act)
+  {
+    public string CurrencyCode => act.Balances.IsoCurrencyCode
+      ?? act.Balances.UnofficialCurrencyCode
+      ?? "Unknown";
+
+    public decimal Available => act.Balances.Available.GetValueOrDefault();
+    public decimal Current => act.Balances.Current.GetValueOrDefault();
+  }
+}
@@ -0,0 +1,31 @@
+namespace FiscalOS.Infra.Accounts.Plaid;
+
+public sealed class PlaidMetadata : InstitutionMetadata
+{
+  public const string TypeValue = Providers.Plaid;
+  public string PlaidId { get; init; } = string.Empty;
+  public string PlaidName { get; init; } = string.Empty;
+  public string EncryptedAccessToken { get; init; } = string.Empty;
+
+  private PlaidMetadata() : base(TypeValue)
+  {
+  }
+
+  public static PlaidMetadata From(
+    string? plaidId,
+    string? plaidName,
+    string encryptedAccessToken
+  )
+  {
+    ArgumentNullException.ThrowIfNull(plaidId, nameof(plaidId));
+    ArgumentNullException.ThrowIfNull(plaidName, nameof(plaidName));
+    ArgumentNullException.ThrowIfNull(encryptedAccessToken, nameof(encryptedAccessToken));
+
+    return new PlaidMetadata
+    {
+      PlaidId = plaidId,
+      PlaidName = plaidName,
+      EncryptedAccessToken = encryptedAccessToken
+    };
+  }
+}
@@ -0,0 +1,91 @@
+
+
+using System.Reflection;
+
+namespace FiscalOS.Infra.Accounts.Plaid;
+
+public sealed class PlaidService
+{
+  private readonly PlaidClient _client;
+
+  private PlaidService(PlaidClient client)
+  {
+    _client = client;
+  }
+
+  public static PlaidService From(IServiceProvider sp)
+  {
+    var client = sp.GetRequiredService<PlaidClient>();
+    return new(client);
+  }
+
+  public async Task<string> CreateLinkTokenAsync(string id)
+  {
+    var assemblyName = Assembly.GetExecutingAssembly().GetName().FullName;
+    var environmentName = System.Environment.GetEnvironmentVariable("ASPNETCORE_ENVIRONMENT");
+
+    var ltr = await _client.LinkTokenCreateAsync(new()
+    {
+      ClientName = $"{assemblyName}_{environmentName}",
+      Products = [Products.Transactions],
+      CountryCodes = [CountryCode.Us],
+      Language = Language.English,
+      User = new()
+      {
+        ClientUserId = id,
+      },
+    }).ConfigureAwait(false);
+
+    if (ltr.IsSuccessStatusCode is false)
+    {
+      throw new PlaidException("Unable to create link token");
+    }
+
+    return ltr.LinkToken;
+  }
+
+  public async Task<(string ItemId, string AccessToken)> ExchangeTokenAsync(string publicToken)
+  {
+    var ptr = await _client.ItemPublicTokenExchangeAsync(new()
+    {
+      PublicToken = publicToken,
+    }).ConfigureAwait(false);
+
+    if (ptr.IsSuccessStatusCode is false)
+    {
+      throw new PlaidException("Unable to exchange public token for access token");
+    }
+
+    return (ptr.ItemId, ptr.AccessToken);
+  }
+
+  public async Task<List<Going.Plaid.Entity.Account>> GetAccountsAsync(string accessToken)
+  {
+    var ar = await _client.AccountsGetAsync(new()
+    {
+      AccessToken = accessToken,
+    }).ConfigureAwait(false);
+
+    if (ar.IsSuccessStatusCode is false)
+    {
+      throw new PlaidException("Unable to retrieve accounts");
+    }
+
+    return [.. ar.Accounts];
+  }
+
+  public async Task<ItemWithConsentFields> GetItemAsync(string accessToken)
+  {
+    var ar = await _client.ItemGetAsync(new()
+    {
+      AccessToken = accessToken,
+    }).ConfigureAwait(false);
+
+    if (ar.IsSuccessStatusCode is false)
+    {
+      throw new PlaidException("Unable to retrieve item");
+    }
+
+    return ar.Item;
+  }
+}
@@ -0,0 +1,6 @@
+namespace FiscalOS.Infra.Accounts;
+
+public static class Providers
+{
+  public const string Plaid = nameof(Plaid);
+}
@@ -1,5 +1,3 @@
-using Microsoft.AspNetCore.Authentication.JwtBearer;
-
 namespace FiscalOS.Infra.Authentication;

 public sealed record JwtOptions
@@ -1,5 +1,3 @@
-using Microsoft.AspNetCore.Authentication.JwtBearer;
-
 namespace FiscalOS.Infra.Authentication;

 public static class Schemes
@@ -1,21 +1,28 @@
+using Account = FiscalOS.Core.Accounts.Account;
+using Institution = FiscalOS.Core.Accounts.Institution;
+
 namespace FiscalOS.Infra.Data;

-public sealed class AppDbContext(IOptions<AppDbContextOptions> ctxOptions) : DbContext
+public sealed class AppDbContext(
+  IOptions<AppDbContextOptions> ctxOptions,
+  IFileSystem fileSystem
+) : DbContext
 {
  private const string DataSourceKey = "Data Source=";
  private readonly AppDbContextOptions _ctxOptions = ctxOptions.Value;
+  private readonly IFileSystem _fileSystem = fileSystem;

  public DbSet<User> Users => Set<User>();
  public DbSet<RefreshToken> RefreshTokens => Set<RefreshToken>();

  protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
  {
-    var dbPath = _ctxOptions.GetFullyQualifiedDatabasePath();
-    var dbDirectory = Path.GetDirectoryName(dbPath) ?? throw new InvalidOperationException("Database directory path could not be determined.");
+    var dbPath = _fileSystem.Path.GetFullPath(_ctxOptions.DatabaseFilePath, AppContext.BaseDirectory);
+    var dbDirectory = _fileSystem.Path.GetDirectoryName(dbPath) ?? throw new InvalidOperationException("Database directory path could not be determined.");

-    if (Directory.Exists(dbDirectory) is false)
+    if (_fileSystem.Directory.Exists(dbDirectory) is false)
    {
-      Directory.CreateDirectory(dbDirectory);
+      _fileSystem.Directory.CreateDirectory(dbDirectory);
    }

    var connectionString = $"{DataSourceKey}{dbPath}";
@@ -45,15 +52,25 @@ public sealed class AppDbContext(IOptions<AppDbContextOptions> ctxOptions) : DbC

    modelBuilder.Entity<User>(static eb =>
    {
+      eb.Property(static u => u.Username);
+      eb.HasIndex(static u => u.Username).IsUnique();
+
+      eb.Property(static u => u.HashedPassword);
+
      eb.HasMany(static u => u.RefreshTokens)
        .WithOne(static t => t.User)
        .HasForeignKey(static t => t.UserId)
        .OnDelete(DeleteBehavior.Cascade);

-      eb.Property(static u => u.Username);
-      eb.HasIndex(static u => u.Username).IsUnique();
+      eb.HasMany(static u => u.Institutions)
+        .WithOne()
+        .HasForeignKey(static i => i.UserId)
+        .OnDelete(DeleteBehavior.Cascade);

-      eb.Property(static u => u.HashedPassword);
+      eb.HasMany(static u => u.Accounts)
+        .WithOne()
+        .HasForeignKey(static a => a.UserId)
+        .OnDelete(DeleteBehavior.Cascade);
    });

    modelBuilder.Entity<RefreshToken>(static eb =>
@@ -65,5 +82,78 @@ public sealed class AppDbContext(IOptions<AppDbContextOptions> ctxOptions) : DbC
      eb.Property(static t => t.Token);
      eb.HasIndex(static t => t.Token).IsUnique();
    });
+
+    modelBuilder.Entity<Institution>(static eb =>
+    {
+      eb.Property(static i => i.Name);
+
+      eb.HasOne(static i => i.Metadata)
+        .WithOne()
+        .HasForeignKey<InstitutionMetadata>(static m => m.InstitutionId)
+        .OnDelete(DeleteBehavior.Cascade);
+    });
+
+    modelBuilder.Entity<InstitutionMetadata>(static eb =>
+    {
+      eb.HasDiscriminator(static m => m.Type)
+        .HasValue<PlaidMetadata>(PlaidMetadata.TypeValue);
+
+      eb.Property(static m => m.InstitutionId);
+      eb.Property(static m => m.Type);
+    });
+
+    modelBuilder.Entity<PlaidMetadata>(static eb =>
+    {
+      eb.HasBaseType<InstitutionMetadata>();
+
+      eb.Property(static m => m.PlaidId);
+      eb.Property(static m => m.PlaidName);
+      eb.Property(static m => m.EncryptedAccessToken);
+    });
+
+    modelBuilder.Entity<Account>(static eb =>
+    {
+      eb.Property(static a => a.Name);
+
+      eb.HasOne(static a => a.Institution)
+        .WithMany()
+        .HasForeignKey(static a => a.InstitutionId)
+        .OnDelete(DeleteBehavior.Cascade);
+
+      eb.HasOne(static a => a.Metadata)
+        .WithOne()
+        .HasForeignKey<AccountMetadata>(static m => m.AccountId)
+        .OnDelete(DeleteBehavior.Cascade);
+
+      eb.HasMany(static a => a.Balances)
+        .WithOne()
+        .HasForeignKey(static b => b.AccountId)
+        .OnDelete(DeleteBehavior.Cascade);
+    });
+
+    modelBuilder.Entity<AccountMetadata>(static eb =>
+    {
+      eb.HasDiscriminator(static m => m.Type)
+        .HasValue<PlaidAccountMetadata>(PlaidAccountMetadata.TypeValue);
+
+      eb.Property(static m => m.AccountId);
+      eb.Property(static m => m.Type);
+    });
+
+    modelBuilder.Entity<PlaidAccountMetadata>(static eb =>
+    {
+      eb.HasBaseType<AccountMetadata>();
+
+      eb.Property(static m => m.PlaidId);
+      eb.Property(static m => m.PlaidName);
+    });
+
+    modelBuilder.Entity<Balance>(static eb =>
+    {
+      eb.Property(static b => b.AccountId);
+      eb.Property(static b => b.Current);
+      eb.Property(static b => b.Available);
+      eb.Property(static b => b.CurrencyCode);
+    });
  }
 }
@@ -3,11 +3,6 @@ namespace FiscalOS.Infra.Data;
 public sealed record AppDbContextOptions
 {
  public string DatabaseFilePath { get; init; } = string.Empty;
-
-  public string GetFullyQualifiedDatabasePath()
-  {
-    return Path.GetFullPath(DatabaseFilePath, AppContext.BaseDirectory);
-  }
 }

 public sealed record AppDbContextOptionsSetup : IConfigureOptions<AppDbContextOptions>
@@ -1,5 +1,3 @@
-using FiscalOS.Core.Data;
-
 namespace FiscalOS.Infra.Data;

 internal sealed class TimestampInterceptor : SaveChangesInterceptor
@@ -6,18 +6,35 @@ public static class ServiceCollectionExtensions
  {
    services.AddSingleton<IAuthorizationMiddlewareResultHandler, ProblemDetailsAuthResultHandler>();

+    services.AddHttpClient();
    services.AddSingleton(TimeProvider.System);
+    services.AddSingleton<IFileSystem, FileSystem>();

    services.ConfigureOptions<JwtOptionsSetup>();
    services.ConfigureOptions<JwtBearerOptionsSetup>();

-    services.AddSingleton<ITokenGenerator, TokenGenerator>(TokenGenerator.From);
-    services.AddSingleton<IPasswordHasher, PasswordHasher>(PasswordHasher.From);
+    services.AddSingleton<ITokenGenerator>(TokenGenerator.From);
+    services.AddSingleton<IPasswordHasher>(PasswordHasher.From);
+
+    services.ConfigureOptions<FileKeyRingOptionsSetup>();
+    services.AddSingleton<IKeyRing>(FileKeyRing.From);
+    services.AddSingleton<IEncryptor>(Encryptor.From);

    services.ConfigureOptions<AppDbContextOptionsSetup>();
    services.AddDbContext<AppDbContext>();
    services.AddHostedService<MigrationService>();

+    services.ConfigureOptions<PlaidClientOptionsSetup>();
+    services.AddSingleton(static sp =>
+    {
+      var factory = sp.GetRequiredService<IHttpClientFactory>();
+      var logger = sp.GetRequiredService<ILogger<PlaidClient>>();
+      var clientOptions = sp.GetRequiredService<IOptions<PlaidClientOptions>>();
+      var options = clientOptions.Value.ToPlaidOptions();
+      return new PlaidClient(options, factory, logger);
+    });
+    services.AddSingleton(PlaidService.From);
+
    return services;
  }
 }
@@ -1,9 +1,11 @@
 <Project Sdk="Microsoft.NET.Sdk">

  <ItemGroup>
+    <PackageReference Include="Going.Plaid" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" />
    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" />
    <PackageReference Include="Microsoft.Extensions.Hosting" />
+    <PackageReference Include="TestableIO.System.IO.Abstractions.Wrappers" />
  </ItemGroup>

  <ItemGroup>
@@ -1,6 +1,4 @@
-using System;
-
-using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Migrations;

 #nullable disable

@@ -1,6 +1,4 @@
-using System;
-
-using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Migrations;

 #nullable disable

@@ -1,6 +1,4 @@
-using System;
-
-using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Migrations;

 #nullable disable

@@ -1,6 +1,4 @@
-using System;
-
-using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Migrations;

 #nullable disable

@@ -4,19 +4,19 @@

 namespace FiscalOS.Infra.Migrations
 {
+  /// <inheritdoc />
+  public partial class AddUserIdPropToRefreshToken : Migration
+  {
    /// <inheritdoc />
-    public partial class AddUserIdPropToRefreshToken : Migration
+    protected override void Up(MigrationBuilder migrationBuilder)
    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {

-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-
-        }
    }
-}
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+
+    }
+  }
+}
@@ -4,26 +4,26 @@

 namespace FiscalOS.Infra.Migrations
 {
+  /// <inheritdoc />
+  public partial class AddRevokedPropertyToRefreshToken : Migration
+  {
    /// <inheritdoc />
-    public partial class AddRevokedPropertyToRefreshToken : Migration
+    protected override void Up(MigrationBuilder migrationBuilder)
    {
-        /// <inheritdoc />
-        protected override void Up(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.AddColumn<bool>(
-                name: "Revoked",
-                table: "RefreshTokens",
-                type: "INTEGER",
-                nullable: false,
-                defaultValue: false);
-        }
-
-        /// <inheritdoc />
-        protected override void Down(MigrationBuilder migrationBuilder)
-        {
-            migrationBuilder.DropColumn(
-                name: "Revoked",
-                table: "RefreshTokens");
-        }
+      migrationBuilder.AddColumn<bool>(
+          name: "Revoked",
+          table: "RefreshTokens",
+          type: "INTEGER",
+          nullable: false,
+          defaultValue: false);
    }
-}
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.DropColumn(
+          name: "Revoked",
+          table: "RefreshTokens");
+    }
+  }
+}
@@ -0,0 +1,108 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260205192220_AddEncryptionKeyToUserModel")]
+    partial class AddEncryptionKeyToUserModel
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+  /// <inheritdoc />
+  public partial class AddEncryptionKeyToUserModel : Migration
+  {
+    /// <inheritdoc />
+    protected override void Up(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.AddColumn<string>(
+          name: "EncryptedDataKey",
+          table: "Users",
+          type: "TEXT",
+          nullable: false,
+          defaultValue: "");
+    }
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.DropColumn(
+          name: "EncryptedDataKey",
+          table: "Users");
+    }
+  }
+}
@@ -0,0 +1,112 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260205222656_AddEncryptionKeyIdToUserModel")]
+    partial class AddEncryptionKeyIdToUserModel
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptionKeyId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+  /// <inheritdoc />
+  public partial class AddEncryptionKeyIdToUserModel : Migration
+  {
+    /// <inheritdoc />
+    protected override void Up(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.AddColumn<string>(
+          name: "EncryptionKeyId",
+          table: "Users",
+          type: "TEXT",
+          nullable: false,
+          defaultValue: "");
+    }
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.DropColumn(
+          name: "EncryptionKeyId",
+          table: "Users");
+    }
+  }
+}
@@ -0,0 +1,215 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260212215015_InstitutionAndMetadata")]
+    partial class InstitutionAndMetadata
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId")
+                        .IsUnique();
+
+                    b.ToTable("InstitutionMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("InstitutionMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptionKeyId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.InstitutionMetadata");
+
+                    b.Property<string>("EncryptedAccessToken")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Institutions")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.InstitutionMetadata", "InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Navigation("Metadata")
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("Institutions");
+
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
@@ -0,0 +1,82 @@
+using System;
+
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+  /// <inheritdoc />
+  public partial class InstitutionAndMetadata : Migration
+  {
+    /// <inheritdoc />
+    protected override void Up(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.CreateTable(
+          name: "Institution",
+          columns: table => new
+          {
+            Id = table.Column<Guid>(type: "TEXT", nullable: false),
+            UserId = table.Column<Guid>(type: "TEXT", nullable: false),
+            Name = table.Column<string>(type: "TEXT", nullable: false),
+            CreatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false),
+            UpdatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false)
+          },
+          constraints: table =>
+          {
+            table.PrimaryKey("PK_Institution", x => x.Id);
+            table.ForeignKey(
+                      name: "FK_Institution_Users_UserId",
+                      column: x => x.UserId,
+                      principalTable: "Users",
+                      principalColumn: "Id",
+                      onDelete: ReferentialAction.Cascade);
+          });
+
+      migrationBuilder.CreateTable(
+          name: "InstitutionMetadata",
+          columns: table => new
+          {
+            Id = table.Column<Guid>(type: "TEXT", nullable: false),
+            Type = table.Column<string>(type: "TEXT", maxLength: 21, nullable: false),
+            InstitutionId = table.Column<Guid>(type: "TEXT", nullable: false),
+            PlaidId = table.Column<string>(type: "TEXT", nullable: true),
+            PlaidName = table.Column<string>(type: "TEXT", nullable: true),
+            EncryptedAccessToken = table.Column<string>(type: "TEXT", nullable: true),
+            CreatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false),
+            UpdatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false)
+          },
+          constraints: table =>
+          {
+            table.PrimaryKey("PK_InstitutionMetadata", x => x.Id);
+            table.ForeignKey(
+                      name: "FK_InstitutionMetadata_Institution_InstitutionId",
+                      column: x => x.InstitutionId,
+                      principalTable: "Institution",
+                      principalColumn: "Id",
+                      onDelete: ReferentialAction.Cascade);
+          });
+
+      migrationBuilder.CreateIndex(
+          name: "IX_Institution_UserId",
+          table: "Institution",
+          column: "UserId");
+
+      migrationBuilder.CreateIndex(
+          name: "IX_InstitutionMetadata_InstitutionId",
+          table: "InstitutionMetadata",
+          column: "InstitutionId",
+          unique: true);
+    }
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.DropTable(
+          name: "InstitutionMetadata");
+
+      migrationBuilder.DropTable(
+          name: "Institution");
+    }
+  }
+}
@@ -0,0 +1,327 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260213130218_AccountAndMetadata")]
+    partial class AccountAndMetadata
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstituionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstituionId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Account");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId")
+                        .IsUnique();
+
+                    b.ToTable("AccountMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("AccountMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId")
+                        .IsUnique();
+
+                    b.ToTable("InstitutionMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("InstitutionMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptionKeyId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidAccountMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.AccountMetadata");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.InstitutionMetadata");
+
+                    b.Property<string>("EncryptedAccessToken")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", "Institution")
+                        .WithMany()
+                        .HasForeignKey("InstituionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Accounts")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.AccountMetadata", "AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Institutions")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.InstitutionMetadata", "InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Navigation("Metadata")
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Navigation("Metadata")
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("Accounts");
+
+                    b.Navigation("Institutions");
+
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
@@ -0,0 +1,93 @@
+using System;
+
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+  /// <inheritdoc />
+  public partial class AccountAndMetadata : Migration
+  {
+    /// <inheritdoc />
+    protected override void Up(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.CreateTable(
+          name: "Account",
+          columns: table => new
+          {
+            Id = table.Column<Guid>(type: "TEXT", nullable: false),
+            UserId = table.Column<Guid>(type: "TEXT", nullable: false),
+            InstituionId = table.Column<Guid>(type: "TEXT", nullable: false),
+            Name = table.Column<string>(type: "TEXT", nullable: false),
+            CreatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false),
+            UpdatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false)
+          },
+          constraints: table =>
+          {
+            table.PrimaryKey("PK_Account", x => x.Id);
+            table.ForeignKey(
+                      name: "FK_Account_Institution_InstituionId",
+                      column: x => x.InstituionId,
+                      principalTable: "Institution",
+                      principalColumn: "Id",
+                      onDelete: ReferentialAction.Cascade);
+            table.ForeignKey(
+                      name: "FK_Account_Users_UserId",
+                      column: x => x.UserId,
+                      principalTable: "Users",
+                      principalColumn: "Id",
+                      onDelete: ReferentialAction.Cascade);
+          });
+
+      migrationBuilder.CreateTable(
+          name: "AccountMetadata",
+          columns: table => new
+          {
+            Id = table.Column<Guid>(type: "TEXT", nullable: false),
+            Type = table.Column<string>(type: "TEXT", maxLength: 21, nullable: false),
+            AccountId = table.Column<Guid>(type: "TEXT", nullable: false),
+            PlaidId = table.Column<string>(type: "TEXT", nullable: true),
+            PlaidName = table.Column<string>(type: "TEXT", nullable: true),
+            CreatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false),
+            UpdatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false)
+          },
+          constraints: table =>
+          {
+            table.PrimaryKey("PK_AccountMetadata", x => x.Id);
+            table.ForeignKey(
+                      name: "FK_AccountMetadata_Account_AccountId",
+                      column: x => x.AccountId,
+                      principalTable: "Account",
+                      principalColumn: "Id",
+                      onDelete: ReferentialAction.Cascade);
+          });
+
+      migrationBuilder.CreateIndex(
+          name: "IX_Account_InstituionId",
+          table: "Account",
+          column: "InstituionId");
+
+      migrationBuilder.CreateIndex(
+          name: "IX_Account_UserId",
+          table: "Account",
+          column: "UserId");
+
+      migrationBuilder.CreateIndex(
+          name: "IX_AccountMetadata_AccountId",
+          table: "AccountMetadata",
+          column: "AccountId",
+          unique: true);
+    }
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.DropTable(
+          name: "AccountMetadata");
+
+      migrationBuilder.DropTable(
+          name: "Account");
+    }
+  }
+}
@@ -0,0 +1,327 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260213180002_FixAccountInstitutionColumnName")]
+    partial class FixAccountInstitutionColumnName
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Account");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId")
+                        .IsUnique();
+
+                    b.ToTable("AccountMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("AccountMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId")
+                        .IsUnique();
+
+                    b.ToTable("InstitutionMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("InstitutionMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptionKeyId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidAccountMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.AccountMetadata");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.InstitutionMetadata");
+
+                    b.Property<string>("EncryptedAccessToken")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", "Institution")
+                        .WithMany()
+                        .HasForeignKey("InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Accounts")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.AccountMetadata", "AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Institutions")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.InstitutionMetadata", "InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Navigation("Metadata")
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Navigation("Metadata")
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("Accounts");
+
+                    b.Navigation("Institutions");
+
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
@@ -0,0 +1,62 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+  /// <inheritdoc />
+  public partial class FixAccountInstitutionColumnName : Migration
+  {
+    /// <inheritdoc />
+    protected override void Up(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.DropForeignKey(
+          name: "FK_Account_Institution_InstituionId",
+          table: "Account");
+
+      migrationBuilder.RenameColumn(
+          name: "InstituionId",
+          table: "Account",
+          newName: "InstitutionId");
+
+      migrationBuilder.RenameIndex(
+          name: "IX_Account_InstituionId",
+          table: "Account",
+          newName: "IX_Account_InstitutionId");
+
+      migrationBuilder.AddForeignKey(
+          name: "FK_Account_Institution_InstitutionId",
+          table: "Account",
+          column: "InstitutionId",
+          principalTable: "Institution",
+          principalColumn: "Id",
+          onDelete: ReferentialAction.Cascade);
+    }
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.DropForeignKey(
+          name: "FK_Account_Institution_InstitutionId",
+          table: "Account");
+
+      migrationBuilder.RenameColumn(
+          name: "InstitutionId",
+          table: "Account",
+          newName: "InstituionId");
+
+      migrationBuilder.RenameIndex(
+          name: "IX_Account_InstitutionId",
+          table: "Account",
+          newName: "IX_Account_InstituionId");
+
+      migrationBuilder.AddForeignKey(
+          name: "FK_Account_Institution_InstituionId",
+          table: "Account",
+          column: "InstituionId",
+          principalTable: "Institution",
+          principalColumn: "Id",
+          onDelete: ReferentialAction.Cascade);
+    }
+  }
+}
@@ -0,0 +1,364 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260214112234_AddBalancesWithConnectionToAccounts")]
+    partial class AddBalancesWithConnectionToAccounts
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Account");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId")
+                        .IsUnique();
+
+                    b.ToTable("AccountMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("AccountMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Available")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Current")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId");
+
+                    b.ToTable("Balance");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId")
+                        .IsUnique();
+
+                    b.ToTable("InstitutionMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("InstitutionMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptionKeyId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidAccountMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.AccountMetadata");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.InstitutionMetadata");
+
+                    b.Property<string>("EncryptedAccessToken")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", "Institution")
+                        .WithMany()
+                        .HasForeignKey("InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Accounts")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.AccountMetadata", "AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithMany("Balances")
+                        .HasForeignKey("AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Institutions")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.InstitutionMetadata", "InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Navigation("Balances");
+
+                    b.Navigation("Metadata");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Navigation("Metadata");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("Accounts");
+
+                    b.Navigation("Institutions");
+
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
@@ -0,0 +1,50 @@
+using System;
+
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+  /// <inheritdoc />
+  public partial class AddBalancesWithConnectionToAccounts : Migration
+  {
+    /// <inheritdoc />
+    protected override void Up(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.CreateTable(
+          name: "Balance",
+          columns: table => new
+          {
+            Id = table.Column<Guid>(type: "TEXT", nullable: false),
+            AccountId = table.Column<Guid>(type: "TEXT", nullable: false),
+            Current = table.Column<decimal>(type: "TEXT", nullable: false),
+            Available = table.Column<decimal>(type: "TEXT", nullable: false),
+            CreatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false),
+            UpdatedAt = table.Column<DateTimeOffset>(type: "TEXT", nullable: false)
+          },
+          constraints: table =>
+          {
+            table.PrimaryKey("PK_Balance", x => x.Id);
+            table.ForeignKey(
+                      name: "FK_Balance_Account_AccountId",
+                      column: x => x.AccountId,
+                      principalTable: "Account",
+                      principalColumn: "Id",
+                      onDelete: ReferentialAction.Cascade);
+          });
+
+      migrationBuilder.CreateIndex(
+          name: "IX_Balance_AccountId",
+          table: "Balance",
+          column: "AccountId");
+    }
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.DropTable(
+          name: "Balance");
+    }
+  }
+}
@@ -0,0 +1,368 @@
+// <auto-generated />
+using System;
+using FiscalOS.Infra.Data;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.EntityFrameworkCore.Infrastructure;
+using Microsoft.EntityFrameworkCore.Migrations;
+using Microsoft.EntityFrameworkCore.Storage.ValueConversion;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+    [DbContext(typeof(AppDbContext))]
+    [Migration("20260214122622_AddCurrencyCodeToBalanceModel")]
+    partial class AddCurrencyCodeToBalanceModel
+    {
+        /// <inheritdoc />
+        protected override void BuildTargetModel(ModelBuilder modelBuilder)
+        {
+#pragma warning disable 612, 618
+            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Account");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId")
+                        .IsUnique();
+
+                    b.ToTable("AccountMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("AccountMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Available")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("CurrencyCode")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Current")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId");
+
+                    b.ToTable("Balance");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId")
+                        .IsUnique();
+
+                    b.ToTable("InstitutionMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("InstitutionMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("ExpiresAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<bool>("Revoked")
+                        .HasColumnType("INTEGER");
+
+                    b.Property<string>("Token")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Token")
+                        .IsUnique();
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("RefreshTokens");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptionKeyId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("HashedPassword")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Username")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("Username")
+                        .IsUnique();
+
+                    b.ToTable("Users");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidAccountMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.AccountMetadata");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.InstitutionMetadata");
+
+                    b.Property<string>("EncryptedAccessToken")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", "Institution")
+                        .WithMany()
+                        .HasForeignKey("InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Accounts")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.AccountMetadata", "AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithMany("Balances")
+                        .HasForeignKey("AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Institutions")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.InstitutionMetadata", "InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", "User")
+                        .WithMany("RefreshTokens")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("User");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Navigation("Balances");
+
+                    b.Navigation("Metadata");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Navigation("Metadata");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
+                {
+                    b.Navigation("Accounts");
+
+                    b.Navigation("Institutions");
+
+                    b.Navigation("RefreshTokens");
+                });
+#pragma warning restore 612, 618
+        }
+    }
+}
@@ -0,0 +1,29 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace FiscalOS.Infra.Migrations
+{
+  /// <inheritdoc />
+  public partial class AddCurrencyCodeToBalanceModel : Migration
+  {
+    /// <inheritdoc />
+    protected override void Up(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.AddColumn<string>(
+          name: "CurrencyCode",
+          table: "Balance",
+          type: "TEXT",
+          nullable: false,
+          defaultValue: "");
+    }
+
+    /// <inheritdoc />
+    protected override void Down(MigrationBuilder migrationBuilder)
+    {
+      migrationBuilder.DropColumn(
+          name: "CurrencyCode",
+          table: "Balance");
+    }
+  }
+}
@@ -17,6 +17,159 @@ namespace FiscalOS.Infra.Migrations
 #pragma warning disable 612, 618
            modelBuilder.HasAnnotation("ProductVersion", "10.0.2");

+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Account");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId")
+                        .IsUnique();
+
+                    b.ToTable("AccountMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("AccountMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("AccountId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Available")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("CurrencyCode")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<decimal>("Current")
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("AccountId");
+
+                    b.ToTable("Balance");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Name")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("UserId")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("UserId");
+
+                    b.ToTable("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.Property<Guid>("Id")
+                        .ValueGeneratedOnAdd()
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("CreatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.Property<Guid>("InstitutionId")
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("Type")
+                        .IsRequired()
+                        .HasMaxLength(21)
+                        .HasColumnType("TEXT");
+
+                    b.Property<DateTimeOffset>("UpdatedAt")
+                        .HasColumnType("TEXT");
+
+                    b.HasKey("Id");
+
+                    b.HasIndex("InstitutionId")
+                        .IsUnique();
+
+                    b.ToTable("InstitutionMetadata");
+
+                    b.HasDiscriminator<string>("Type").HasValue("InstitutionMetadata");
+
+                    b.UseTphMappingStrategy();
+                });
+
            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
                {
                    b.Property<Guid>("Id")
@@ -61,6 +214,14 @@ namespace FiscalOS.Infra.Migrations
                    b.Property<DateTimeOffset>("CreatedAt")
                        .HasColumnType("TEXT");

+                    b.Property<string>("EncryptedDataKey")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("EncryptionKeyId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
                    b.Property<string>("HashedPassword")
                        .IsRequired()
                        .HasColumnType("TEXT");
@@ -80,6 +241,93 @@ namespace FiscalOS.Infra.Migrations
                    b.ToTable("Users");
                });

+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidAccountMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.AccountMetadata");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Infra.Accounts.Plaid.PlaidMetadata", b =>
+                {
+                    b.HasBaseType("FiscalOS.Core.Accounts.InstitutionMetadata");
+
+                    b.Property<string>("EncryptedAccessToken")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidId")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.Property<string>("PlaidName")
+                        .IsRequired()
+                        .HasColumnType("TEXT");
+
+                    b.HasDiscriminator().HasValue("Plaid");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", "Institution")
+                        .WithMany()
+                        .HasForeignKey("InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Accounts")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+
+                    b.Navigation("Institution");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.AccountMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.AccountMetadata", "AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Balance", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Account", null)
+                        .WithMany("Balances")
+                        .HasForeignKey("AccountId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Identity.User", null)
+                        .WithMany("Institutions")
+                        .HasForeignKey("UserId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.InstitutionMetadata", b =>
+                {
+                    b.HasOne("FiscalOS.Core.Accounts.Institution", null)
+                        .WithOne("Metadata")
+                        .HasForeignKey("FiscalOS.Core.Accounts.InstitutionMetadata", "InstitutionId")
+                        .OnDelete(DeleteBehavior.Cascade)
+                        .IsRequired();
+                });
+
            modelBuilder.Entity("FiscalOS.Core.Identity.RefreshToken", b =>
                {
                    b.HasOne("FiscalOS.Core.Identity.User", "User")
@@ -91,8 +339,24 @@ namespace FiscalOS.Infra.Migrations
                    b.Navigation("User");
                });

+            modelBuilder.Entity("FiscalOS.Core.Accounts.Account", b =>
+                {
+                    b.Navigation("Balances");
+
+                    b.Navigation("Metadata");
+                });
+
+            modelBuilder.Entity("FiscalOS.Core.Accounts.Institution", b =>
+                {
+                    b.Navigation("Metadata");
+                });
+
            modelBuilder.Entity("FiscalOS.Core.Identity.User", b =>
                {
+                    b.Navigation("Accounts");
+
+                    b.Navigation("Institutions");
+
                    b.Navigation("RefreshTokens");
                });
 #pragma warning restore 612, 618
@@ -0,0 +1,105 @@
+
+namespace FiscalOS.Infra.Security;
+
+public sealed class Encryptor : IEncryptor
+{
+  private readonly IKeyRing _keyRing;
+
+  private Encryptor(IKeyRing keyRing)
+  {
+    _keyRing = keyRing;
+  }
+
+  public static Encryptor From(IServiceProvider serviceProvider)
+  {
+    var keyRing = serviceProvider.GetRequiredService<IKeyRing>();
+    return new Encryptor(keyRing);
+  }
+
+  public static Encryptor From(IKeyRing keyRing)
+  {
+    return new Encryptor(keyRing);
+  }
+
+  private KeyRingEntry PrimaryKey => _keyRing.GetPrimaryKey();
+
+  private static async Task<string> DecryptCoreAsync(string key, string cipherText, CancellationToken ct)
+  {
+    var cipherTextBytes = Convert.FromBase64String(cipherText);
+
+    using var aes = Aes.Create();
+    aes.Key = Convert.FromBase64String(key);
+
+    var iv = new byte[16];
+    Array.Copy(cipherTextBytes, 0, iv, 0, 16);
+    aes.IV = iv;
+
+    var decryptor = aes.CreateDecryptor();
+
+    using var memoryStream = new MemoryStream(cipherTextBytes, 16, cipherTextBytes.Length - 16);
+    using var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read);
+    using var streamReader = new StreamReader(cryptoStream);
+
+    return await streamReader.ReadToEndAsync(ct).ConfigureAwait(false);
+  }
+
+  public async Task<string> DecryptAsync(string cipherText, CancellationToken ct)
+  {
+    return await DecryptCoreAsync(PrimaryKey.Key, cipherText, ct).ConfigureAwait(false);
+  }
+
+  public async Task<string> DecryptAsyncFor(User user, string plainText, CancellationToken ct)
+  {
+    var decryptedKey = await DecryptCoreAsync(PrimaryKey.Key, user.EncryptedDataKey, ct).ConfigureAwait(false);
+    return await DecryptCoreAsync(decryptedKey, plainText, ct).ConfigureAwait(false);
+  }
+
+  private static async Task<string> EncryptCoreAsync(string key, string plainText, CancellationToken ct)
+  {
+    using var aes = Aes.Create();
+    aes.Key = Convert.FromBase64String(key);
+
+    using var memoryStream = new MemoryStream();
+    aes.GenerateIV();
+    await memoryStream.WriteAsync(aes.IV, ct).ConfigureAwait(false);
+
+    var encryptor = aes.CreateEncryptor();
+
+    using var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write);
+    using var streamWriter = new StreamWriter(cryptoStream);
+
+    await streamWriter.WriteAsync(plainText.ToCharArray(), ct).ConfigureAwait(false);
+    await streamWriter.FlushAsync(ct).ConfigureAwait(false);
+    streamWriter.Close();
+
+    return Convert.ToBase64String(memoryStream.ToArray());
+  }
+
+  public async Task<string> EncryptAsync(string plainText, CancellationToken ct)
+  {
+    return await EncryptCoreAsync(PrimaryKey.Key, plainText, ct).ConfigureAwait(false);
+  }
+
+  public async Task<string> EncryptAsyncFor(User user, string plainText, CancellationToken ct)
+  {
+    var decryptedKey = await DecryptCoreAsync(PrimaryKey.Key, user.EncryptedDataKey, ct).ConfigureAwait(false);
+    return await EncryptCoreAsync(decryptedKey, plainText, ct).ConfigureAwait(false);
+  }
+
+  public string GenerateKey()
+  {
+    using var aes = Aes.Create();
+    aes.GenerateKey();
+
+    return Convert.ToBase64String(aes.Key);
+  }
+
+  public async Task<EncryptedDataKey> GenerateEncryptedKeyAsync(CancellationToken ct)
+  {
+    var key = GenerateKey();
+    var keyUsed = PrimaryKey;
+    var encryptedKey = await EncryptCoreAsync(keyUsed.Key, key, ct).ConfigureAwait(false);
+    return EncryptedDataKey.From(keyUsed.KeyId, encryptedKey);
+  }
+
+}
@@ -0,0 +1,90 @@
+
+namespace FiscalOS.Infra.Security;
+
+public sealed class FileKeyRing : IKeyRing, IDisposable
+{
+  private const string KeyFileExtension = ".key";
+  private FileKeyRingOptions _options;
+  private readonly IFileSystem _fileSystem;
+  private readonly IDisposable? _optionsChangeHandler;
+  private readonly Dictionary<string, KeyRingEntry> _keys = [];
+  private string KeyRingPath => _fileSystem.Path.GetFullPath(_options.KeysDirectoryPath, AppContext.BaseDirectory);
+
+  private FileKeyRing(IOptionsMonitor<FileKeyRingOptions> options, IFileSystem fileSystem)
+  {
+    _fileSystem = fileSystem;
+    _options = options.CurrentValue;
+
+    LoadKeys();
+
+    _optionsChangeHandler = options.OnChange(options =>
+    {
+      _options = options;
+      LoadKeys();
+    });
+  }
+
+  public static FileKeyRing From(IServiceProvider serviceProvider)
+  {
+    var options = serviceProvider.GetRequiredService<IOptionsMonitor<FileKeyRingOptions>>();
+    var fileSystem = serviceProvider.GetRequiredService<IFileSystem>();
+
+    return new(options, fileSystem);
+  }
+
+  public static FileKeyRing From(IOptionsMonitor<FileKeyRingOptions> options, IFileSystem fileSystem)
+  {
+    return new(options, fileSystem);
+  }
+
+  public KeyRingEntry GetKey(string keyId)
+  {
+    if (_keys.TryGetValue(keyId, out var key))
+    {
+      return key;
+    }
+
+    throw new KeyNotFoundException($"Key with ID '{keyId}' not found in the key ring.");
+  }
+
+  public KeyRingEntry GetPrimaryKey()
+  {
+    return GetKey(_options.PrimaryKeyId);
+  }
+
+  private void LoadKeys()
+  {
+    _keys.Clear();
+
+    if (_fileSystem.Directory.Exists(KeyRingPath))
+    {
+      var keyFiles = _fileSystem.Directory.GetFiles(KeyRingPath, $"*{KeyFileExtension}");
+
+      foreach (var keyFile in keyFiles)
+      {
+        var keyId = _fileSystem.Path.GetFileNameWithoutExtension(keyFile);
+        var key = _fileSystem.File.ReadAllText(keyFile).Trim();
+
+        if (string.IsNullOrEmpty(key) is false)
+        {
+          _keys[keyId] = KeyRingEntry.From(keyId, key);
+        }
+      }
+    }
+  }
+
+  public void Dispose()
+  {
+    _optionsChangeHandler?.Dispose();
+  }
+
+  public async Task<KeyRingEntry> SaveKeyAsync(string key)
+  {
+    var id = Guid.NewGuid().ToString();
+    var entry = KeyRingEntry.From(id, key);
+    var filename = id + KeyFileExtension;
+    var entryPath = _fileSystem.Path.Combine(KeyRingPath, filename);
+    await _fileSystem.File.WriteAllTextAsync(entryPath, key).ConfigureAwait(false);
+    return entry;
+  }
+}
@@ -0,0 +1,23 @@
+namespace FiscalOS.Infra.Security;
+
+public sealed record FileKeyRingOptions
+{
+  public string KeysDirectoryPath { get; init; } = string.Empty;
+  public string PrimaryKeyId { get; init; } = string.Empty;
+}
+
+public sealed record class FileKeyRingOptionsSetup : IConfigureOptions<FileKeyRingOptions>
+{
+  private const string SectionName = nameof(FileKeyRingOptions);
+  private readonly IConfiguration _configuration;
+
+  public FileKeyRingOptionsSetup(IConfiguration configuration)
+  {
+    _configuration = configuration;
+  }
+
+  public void Configure(FileKeyRingOptions options)
+  {
+    _configuration.GetSection(SectionName).Bind(options);
+  }
+}
@@ -1,16 +1,25 @@
 global using System.IdentityModel.Tokens.Jwt;
+global using System.IO.Abstractions;
 global using System.Security.Claims;
 global using System.Security.Cryptography;
 global using System.Text;
 global using System.Text.Json;

+global using FiscalOS.Core.Accounts;
 global using FiscalOS.Core.Authentication;
 global using FiscalOS.Core.Data;
 global using FiscalOS.Core.Identity;
+global using FiscalOS.Core.Security;
+global using FiscalOS.Infra.Accounts.Plaid;
 global using FiscalOS.Infra.Authentication;
 global using FiscalOS.Infra.Authorization;
 global using FiscalOS.Infra.Data;
+global using FiscalOS.Infra.Security;

+global using Going.Plaid;
+global using Going.Plaid.Entity;
+
+global using Microsoft.AspNetCore.Authentication.JwtBearer;
 global using Microsoft.AspNetCore.Authorization;
 global using Microsoft.AspNetCore.Authorization.Policy;
 global using Microsoft.AspNetCore.Http;
@@ -0,0 +1,22 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsAspireSharedProject>true</IsAspireSharedProject>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <FrameworkReference Include="Microsoft.AspNetCore.App" />
+
+    <PackageReference Include="Microsoft.Extensions.Http.Resilience" />
+    <PackageReference Include="Microsoft.Extensions.ServiceDiscovery" />
+    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" />
+    <PackageReference Include="OpenTelemetry.Extensions.Hosting" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Http" />
+    <PackageReference Include="OpenTelemetry.Instrumentation.Runtime" />
+  </ItemGroup>
+
+</Project>
@@ -0,0 +1,89 @@
+namespace FiscalOS.ServiceDefaults;
+
+public static class ServiceDefaultsExtensions
+{
+  private const string HealthEndpointPath = "/health";
+  private const string AlivenessEndpointPath = "/alive";
+
+  public static TBuilder AddServiceDefaults<TBuilder>(this TBuilder builder) where TBuilder : IHostApplicationBuilder
+  {
+    builder.ConfigureOpenTelemetry();
+
+    builder.AddDefaultHealthChecks();
+
+    builder.Services.AddServiceDiscovery();
+
+    builder.Services.ConfigureHttpClientDefaults(static http =>
+    {
+      http.AddStandardResilienceHandler();
+      http.AddServiceDiscovery();
+    });
+
+    return builder;
+  }
+
+  public static TBuilder ConfigureOpenTelemetry<TBuilder>(this TBuilder builder) where TBuilder : IHostApplicationBuilder
+  {
+    builder.Logging.AddOpenTelemetry(logging =>
+    {
+      logging.IncludeFormattedMessage = true;
+      logging.IncludeScopes = true;
+    });
+
+    builder.Services.AddOpenTelemetry()
+      .WithMetrics(metrics => metrics.AddAspNetCoreInstrumentation()
+        .AddHttpClientInstrumentation()
+        .AddRuntimeInstrumentation()
+      )
+      .WithTracing(tracing => tracing.AddSource(builder.Environment.ApplicationName)
+        .AddAspNetCoreInstrumentation(tracing =>
+          tracing.Filter = context =>
+            context.Request.Path.StartsWithSegments(HealthEndpointPath, StringComparison.InvariantCultureIgnoreCase) is false &&
+            context.Request.Path.StartsWithSegments(AlivenessEndpointPath, StringComparison.InvariantCultureIgnoreCase) is false
+        )
+        .AddHttpClientInstrumentation()
+      );
+
+    builder.AddOpenTelemetryExporters();
+
+    return builder;
+  }
+
+  public static TBuilder AddDefaultHealthChecks<TBuilder>(this TBuilder builder) where TBuilder : IHostApplicationBuilder
+  {
+    builder.Services.AddHealthChecks()
+      .AddCheck("self", static () => HealthCheckResult.Healthy(), ["live"]);
+
+    return builder;
+  }
+
+  public static WebApplication MapDefaultEndpoints(this WebApplication app)
+  {
+    ArgumentNullException.ThrowIfNull(app);
+
+    if (app.Environment.IsDevelopment())
+    {
+      app.MapHealthChecks(HealthEndpointPath);
+
+      app.MapHealthChecks(AlivenessEndpointPath, new HealthCheckOptions
+      {
+        Predicate = static r => r.Tags.Contains("live")
+      });
+    }
+
+    return app;
+  }
+
+  private static TBuilder AddOpenTelemetryExporters<TBuilder>(this TBuilder builder) where TBuilder : IHostApplicationBuilder
+  {
+    var useOtlpExporter = !string.IsNullOrWhiteSpace(builder.Configuration["OTEL_EXPORTER_OTLP_ENDPOINT"]);
+
+    if (useOtlpExporter)
+    {
+      builder.Services.AddOpenTelemetry().UseOtlpExporter();
+    }
+
+    return builder;
+  }
+
+}
@@ -0,0 +1,10 @@
+global using Microsoft.AspNetCore.Builder;
+global using Microsoft.AspNetCore.Diagnostics.HealthChecks;
+global using Microsoft.Extensions.DependencyInjection;
+global using Microsoft.Extensions.Diagnostics.HealthChecks;
+global using Microsoft.Extensions.Hosting;
+global using Microsoft.Extensions.Logging;
+
+global using OpenTelemetry;
+global using OpenTelemetry.Metrics;
+global using OpenTelemetry.Trace;
@@ -0,0 +1,8 @@
+[*.{js,jsx,mjs,cjs,ts,tsx,mts,cts,vue,css,scss,sass,less,styl}]
+charset = utf-8
+indent_size = 2
+indent_style = space
+insert_final_newline = true
+trim_trailing_whitespace = true
+end_of_line = lf
+max_line_length = 100
@@ -0,0 +1 @@
+* text=auto eol=lf
@@ -0,0 +1,42 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+.DS_Store
+dist
+dist-ssr
+coverage
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?
+
+*.tsbuildinfo
+
+.eslintcache
+
+# Cypress
+/cypress/videos/
+/cypress/screenshots/
+
+# Vitest
+__screenshots__/
+
+# Vite
+*.timestamp-*-*.mjs
+
+test-results/
+playwright-report/
@@ -0,0 +1,10 @@
+{
+  "$schema": "./node_modules/oxlint/configuration_schema.json",
+  "plugins": ["eslint", "typescript", "unicorn", "oxc", "vue", "vitest"],
+  "env": {
+    "browser": true
+  },
+  "categories": {
+    "correctness": "error"
+  }
+}
@@ -0,0 +1,15 @@
+{
+  "$schema": "https://json.schemastore.org/prettierrc",
+  "semi": true,
+  "tabWidth": 2,
+  "singleQuote": true,
+  "printWidth": 100,
+  "trailingComma": "es5",
+  "arrowParens": "avoid",
+  "bracketSameLine": false,
+  "jsxSingleQuote": true,
+  "embeddedLanguageFormatting": "auto",
+  "endOfLine": "auto",
+  "vueIndentScriptAndStyle": true,
+  "singleAttributePerLine": true
+}
@@ -0,0 +1,4 @@
+{
+  "extends": "@tsconfig/node24/tsconfig.json",
+  "include": ["./**/*"]
+}
@@ -0,0 +1,6 @@
+import { test, expect } from '@playwright/test'
+
+test('visits the app root url', async ({ page }) => {
+  await page.goto('/')
+  await expect(page.locator('h1')).toHaveText('You did it!')
+})
@@ -0,0 +1 @@
+/// <reference types="vite/client" />
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Stevan Freeborn	b45463e56b	tests(apphost.tests): added support for end to end testing using playwright	2026-02-23 05:53:17 -06:00
Stevan Freeborn	fd2cd68d73	feat(web,api): added ability to add and then display list of institutions	2026-02-22 06:53:13 -06:00
Stevan Freeborn	b4fbf16869	feat(web): finish implementing login	2026-02-21 07:32:28 -06:00
Stevan Freeborn	d9130e75a4	feat(web): make things work - setup basic login form - setup basic add institution functionality	2026-02-21 07:32:28 -06:00
Stevan Freeborn	e2537d77c4	feat(web): working on login style	2026-02-21 07:32:28 -06:00
Stevan Freeborn	fcbc9e78c2	style(web): add fonts	2026-02-21 07:32:28 -06:00
Stevan Freeborn	9042cd4ead	feat(web): use user store and auth service to handle logging in and persistenting user state	2026-02-21 07:32:28 -06:00
Stevan Freeborn	1c3de212ff	chore(web): configure prettier to my preferences	2026-02-21 07:32:28 -06:00
Stevan Freeborn	72a534a8e0	feat(web): add composable for creating auth service	2026-02-21 07:32:28 -06:00
Stevan Freeborn	74e55b2f48	feat(web): implement user store	2026-02-21 07:32:28 -06:00
Stevan Freeborn	a3dc58d19b	feat(web): implement auth service	2026-02-21 07:32:28 -06:00
Stevan Freeborn	5a878bf4b3	feat(web): add small http client implementation around fetch	2026-02-21 07:32:28 -06:00
Stevan Freeborn	dee331fb0d	feat(web): implement initial logic to handle protected vs public routing	2026-02-21 07:32:28 -06:00
Stevan Freeborn	df859b91b0	feat: add frontend with aspire integration	2026-02-17 06:19:05 -06:00
Stevan Freeborn	d77e5d45f6	feat: aspirify the solution	2026-02-15 08:16:47 -06:00
Stevan Freeborn	2cca5c15a0	chore: run dotnet format	2026-02-15 08:16:47 -06:00
Stevan Freeborn	ab88656c1e	feat(api): implement endpoint for creating link tokens	2026-02-15 07:02:01 -06:00
Stevan Freeborn	6b2b19cb5b	feat(infra): add create link token to plaid service	2026-02-15 07:02:01 -06:00
Stevan Freeborn	9c0f642f90	feat(api): support passing and persistenting currency code for balances	2026-02-14 06:46:05 -06:00
Stevan Freeborn	701b89d704	feat(infra): added modeling and migrations for currency code prop	2026-02-14 06:46:05 -06:00
Stevan Freeborn	49e4288eba	feat(core): extend balance model to store currency code	2026-02-14 06:46:05 -06:00
Stevan Freeborn	497dedf6ac	feat(api): return balance info to frontend	2026-02-14 06:46:05 -06:00
Stevan Freeborn	29d8758ede	feat(infra): add extensions members for plaid accounts	2026-02-14 06:46:05 -06:00
Stevan Freeborn	6190470fe2	feat(api): initialize account with starting balance	2026-02-14 06:46:05 -06:00
Stevan Freeborn	ed7e25961c	feat(infra): add modeling to dbcontext for balance model with migrations	2026-02-14 06:46:05 -06:00
Stevan Freeborn	e331030bb0	feat(core): add balance model	2026-02-14 06:46:05 -06:00
Stevan Freeborn	3b7830b1bc	refactor(api): introduce DTOs for institutional account discovery - Replace raw Plaid entity response with a dedicated Response wrapper - Map Plaid accounts to AccountDto to decouple API from external SDK models - Update integration tests to assert against the new response structure - Add JsonConstructors to DTO records for reliable deserialization	2026-02-14 06:46:05 -06:00
Stevan Freeborn	dad2ceb450	feat(api,core,infra): refactor endpoint routing and add institution account discovery - Move login and refresh endpoints under a unified /auth route group - Relocate institution connection logic from /accounts to /institutions - Implement GET /institutions/{id}/available to fetch real-time Plaid accounts - Introduce HttpRequestBuilder utility to streamline integration testing - Enhance PlaidService with GetAccountsAsync to support account fetching - Clean up global usings and project structure for better domain isolation	2026-02-14 06:46:05 -06:00
Stevan Freeborn	32cf48bf36	refactor(infra,api.tests): fix my null lies	2026-02-13 12:38:18 -06:00
Stevan Freeborn	502f6f61c1	feat(api): validate account institution is connected and allow adding new account	2026-02-13 12:38:18 -06:00
Stevan Freeborn	6ca90ed25a	refactor(api.tests): rename variable	2026-02-13 12:38:18 -06:00
Stevan Freeborn	5192c06627	refactor(api): use convenience methods	2026-02-13 12:38:18 -06:00
Stevan Freeborn	2fd55a55cd	fix(infra): update db model to address property name correction	2026-02-13 12:38:18 -06:00
Stevan Freeborn	a2e9fc3f30	fix(core): fix incorrectly named property	2026-02-13 12:38:18 -06:00
Stevan Freeborn	a83dbbcc54	feat(api): add validation to prevent duplicate accounts from being added	2026-02-13 12:38:18 -06:00
Stevan Freeborn	a07fd24ee9	feat(infra): added plaid specific metadata and updated context to model account	2026-02-13 12:38:18 -06:00
Stevan Freeborn	2fdb849142	feat(core): add models for account	2026-02-13 12:38:18 -06:00
Stevan Freeborn	1a41c3c0b6	feat(api): implement storing connected insitution in db	2026-02-13 04:37:47 -06:00
Stevan Freeborn	c4a8aada6b	feat(infra): implement plaid service	2026-02-13 04:37:47 -06:00
Stevan Freeborn	dd08eee5a3	refactor(infra): remove unneeded qualifiers	2026-02-13 04:37:47 -06:00
Stevan Freeborn	7cdf87b860	tests(api.tests): pass cancellation token through delegate	2026-02-13 04:37:47 -06:00
Stevan Freeborn	8663daabae	chore(api.tests): add example test settings file	2026-02-13 04:37:47 -06:00
Stevan Freeborn	0b7c33a024	fix(core): pass name of null param	2026-02-13 04:37:47 -06:00
Stevan Freeborn	823ba4dc5a	chore: update example appsettings file	2026-02-13 04:37:47 -06:00
Stevan Freeborn	1d661ac409	feat(api): prevent user from connecting to same institution twice	2026-02-13 04:37:47 -06:00
Stevan Freeborn	069d019d80	feat(infra): update db context with modeling for institution and relationships	2026-02-13 04:37:47 -06:00
Stevan Freeborn	3f62a246ee	feat(core): add models for institution	2026-02-13 04:37:47 -06:00
Stevan Freeborn	5da1f1decf	refactor(api.tests): check for correct status code first in assertion	2026-02-13 04:37:47 -06:00
Stevan Freeborn	1f5e4a319a	fix(api.tests): use a serializable dictionary for xunit test case data	2026-02-13 04:37:47 -06:00
Stevan Freeborn	683ca3fac4	feat(api): add validation for connect account request	2026-02-13 04:37:47 -06:00
Stevan Freeborn	e88adfd2a7	refactor(api): derive field name from property being validated	2026-02-13 04:37:47 -06:00
Stevan Freeborn	6fc8bd0366	refactor(api): rename type	2026-02-13 04:37:47 -06:00
Stevan Freeborn	ab23593359	refactor(api): remove whitespace	2026-02-13 04:37:47 -06:00
Stevan Freeborn	87a68669cf	feat(api): add protected connect account endpoint	2026-02-13 04:37:47 -06:00
Stevan Freeborn	b4744076b7	tests: update test ring implementation	2026-02-06 06:53:20 -06:00
Stevan Freeborn	5b1a5f003e	tests: add mucho tests	2026-02-06 06:53:20 -06:00
Stevan Freeborn	b2086d8185	feat(admincli): add generate key command	2026-02-06 06:53:20 -06:00
Stevan Freeborn	9b4f0c6b9e	refactor(api): clean up usings	2026-02-06 06:53:20 -06:00
Stevan Freeborn	259daf1e5b	chore: update example settings file	2026-02-06 06:53:20 -06:00
Stevan Freeborn	e02a18df00	chore: added filesystem abstraction package	2026-02-06 06:53:20 -06:00
Stevan Freeborn	c1932246f3	feat(infra): create initial encryption implementations	2026-02-06 06:53:20 -06:00
Stevan Freeborn	4eb833d2c8	chore: add services registrations	2026-02-06 06:53:20 -06:00
Stevan Freeborn	af29df5d19	refactor(infra): move database path logic into app context	2026-02-06 06:53:20 -06:00
Stevan Freeborn	04e0a31b27	chore: remove unnecessary using	2026-02-06 06:53:20 -06:00
Stevan Freeborn	97c7847a89	chore: removed unnecessary usings	2026-02-06 06:53:20 -06:00
Stevan Freeborn	f34fb5ce41	feat(core): define primary models and services for encryption	2026-02-06 06:53:20 -06:00
Stevan Freeborn	38c311bdd1	feat(core): extend user model with encryption related properties	2026-02-06 06:53:20 -06:00
Stevan Freeborn	e9b1bd11bb	feat(infra): added migrations for adding properties to user model	2026-02-06 06:53:20 -06:00