test: cover the API end to end with Testcontainers integration tests

Boot the real Program.cs through WebApplicationFactory against a SQL Server
started by Testcontainers, so requests exercise the actual middleware pipeline,
DI graph, EF Core SQL Server provider and migrations instead of substitutes.
Respawn truncates the schema between tests while a single container is shared
by the whole suite.

The 48 tests cover JWT issuing and validation (wrong signing key, expired and
tampered tokens), [Authorize] and role policies, per-user data isolation on
transactions, the HTTP error contract, and the database constraints the
InMemory provider cannot enforce: the unique index on category slugs, the
transaction foreign keys, ON DELETE CASCADE and decimal(18,2) round-tripping.

Running them exposed four defects that the service-level unit tests could not
see, fixed here:

- [ApiController] rejects invalid models before the action runs, so every
  `if (!ModelState.IsValid)` block was dead code and validation failures came
  back as RFC 7807 ProblemDetails while every other error used the
  ResultViewModel envelope. Shape them centrally through
  InvalidModelStateResponseFactory and drop the unreachable branches.
- Registering a duplicate email returned 500: the controller caught only
  DbUpdateException while the service throws InvalidOperationException.
- Updating a category to a slug owned by another category returned 500 when the
  unique index rejected it; validate the slug and answer 400.
- Creating or updating a transaction with an unknown CategoryId returned 500 on
  the foreign key; check the category up front and answer 400.

Also make Program public so the test host can reference it, and drop the unused
MSTest.TestFramework reference from the API project.

Author: louzoshi

README.md

@@ -21,7 +21,8 @@ business-management system (sales, products, payment methods).
 - Password hashing via ASP.NET Core `PasswordHasher` (PBKDF2)
 - FluentValidation-style data annotations
 - Swagger / OpenAPI
-- xUnit + FluentAssertions + EF Core InMemory (unit tests)
+- xUnit + FluentAssertions — unit tests on EF Core InMemory, integration tests
+  against a real SQL Server started by Testcontainers
 - Docker Compose for the database
 
 **Frontend** (`Trust-Finance.Web/`)
@@ -46,6 +47,9 @@ Trust-Finance.Api/     ASP.NET Core Web API
   Extensions/          ModelState + ClaimsPrincipal helpers
   Migrations/          EF Core migrations
 Trust-Finance.Tests/   xUnit unit tests for the service layer
+Trust-Finance.IntegrationTests/
+  Infrastructure/      Testcontainers + WebApplicationFactory harness
+  Api/                 HTTP-level tests per endpoint group
 Trust-Finance.Web/     React + TypeScript SPA (see its own README)
 ```
 
@@ -120,13 +124,37 @@ so no CORS configuration is required locally.
 ## Tests
 
 ```bash
-dotnet test
+dotnet test                                             # everything
+dotnet test Trust-Finance.Tests                         # unit tests only
+dotnet test Trust-Finance.IntegrationTests              # integration tests only
 ```
 
-Unit tests cover the service layer (business rules such as rejecting duplicate
+**Unit tests** cover the service layer (business rules such as rejecting duplicate
 emails and duplicate category slugs) and run against EF Core InMemory, so they
 do not need SQL Server.
 
+**Integration tests** boot the API through `WebApplicationFactory<Program>` — the
+same `Program.cs` that runs in production — against a throwaway SQL Server that
+[Testcontainers](https://testcontainers.com/) starts for the test run. Nothing is
+mocked or substituted: requests go through the real middleware pipeline, the real
+DI graph, the real EF Core SQL Server provider and the real migrations. A single
+container is shared across the suite and [Respawn](https://github.com/jbogard/Respawn)
+truncates every table between tests.
+
+They cover what only shows up once the whole stack is wired together:
+
+- JWT issuing and validation — wrong signing key, expired and tampered tokens
+- `[Authorize]` and role policies — 401 for anonymous callers, 403 for a
+  non-admin reaching the admin area
+- Per-user data isolation — one user cannot read, update or delete another
+  user's transactions
+- Database constraints the InMemory provider does not enforce — the unique index
+  on category slugs, the transaction foreign keys, `ON DELETE CASCADE`, and
+  `decimal(18,2)` round-tripping
+- The HTTP error contract — status codes and the `ResultViewModel` envelope
+
+The only requirement is a running Docker daemon.
+
 ---
 
 ## Roadmap
@@ -135,4 +163,5 @@ do not need SQL Server.
 - Multi-tenancy (organizations, per-org roles, EF Core global query filters)
 - Sales module (products, sale items with frozen prices, payment methods)
 - Server-side reporting endpoints with pagination and date filtering
-- Integration tests with Testcontainers, global error handling, CI/CD to Azure
+- Global exception-handling middleware to replace the per-controller try/catch
+- CI/CD to Azure

Trust-Finance.Api/Controllers/AccountController.cs

@@ -1,6 +1,5 @@
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
-using TF.Extensions;
 using TF.Models;
 using TF.Services;
 using TF.ViewModels;
@@ -16,14 +15,16 @@ public async Task<IActionResult> Register(
         [FromBody] RegisterUserViewModel model,
         [FromServices] AccountService service)
     {
-        if (!ModelState.IsValid)
-            return BadRequest(new ResultViewModel<User>(ModelState.GetErrors()));
-
         try
         {
             var user = await service.RegisterAsync(model);
             return Created($"api/users/{user.Id}", new ResultViewModel<User>(user));
         }
+        catch (InvalidOperationException e)
+        {
+            // Broken business rule (e.g. the email is already taken).
+            return BadRequest(new ResultViewModel<User>(e.Message));
+        }
         catch (DbUpdateException e)
         {
             return BadRequest(new ResultViewModel<User>(e.Message));
@@ -36,9 +37,6 @@ public async Task<IActionResult> Login(
        [FromServices] AccountService service,
        [FromServices] TokenService tokenService)
     {
-        if (!ModelState.IsValid)
-            return BadRequest(new ResultViewModel<string>(ModelState.GetErrors()));
-
         try
         {
             var token = await service.LoginAsync(model, tokenService);

Trust-Finance.Api/Controllers/CategoryController.cs

@@ -1,6 +1,5 @@
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
-using TF.Extensions;
 using TF.Models;
 using TF.ViewModels;
 using Trust_Finance.Services;
@@ -33,9 +32,6 @@ public async Task<IActionResult> Post(
         [FromBody] EditorCategoryViewModel model,
         [FromServices] CategoryService service)
     {
-        if (!ModelState.IsValid)
-            return BadRequest(new ResultViewModel<Category>(ModelState.GetErrors()));
-
         try
         {
             var category = await service.CreateAsync(model.Name, model.Slug);
@@ -55,9 +51,6 @@ public async Task<IActionResult> Put(
         [FromBody] EditorCategoryViewModel model,
         [FromServices] CategoryService service)
     {
-        if (!ModelState.IsValid)
-            return BadRequest(new ResultViewModel<Category>(ModelState.GetErrors()));
-
         try
         {
             var category = await service.UpdateAsync(id, model.Name, model.Slug);
@@ -67,6 +60,10 @@ public async Task<IActionResult> Put(
         {
             return NotFound(new ResultViewModel<Category>("Category not found"));
         }
+        catch (InvalidOperationException ex)
+        {
+            return BadRequest(new ResultViewModel<Category>(ex.Message));
+        }
     }
 
     [HttpDelete("{id:int}")]

Trust-Finance.Api/Controllers/TransactionController.cs

@@ -40,21 +40,25 @@ public async Task<IActionResult> Post(
         [FromBody] EditorTransactionViewModel model,
         [FromServices] TransactionService service)
     {
-        if (!ModelState.IsValid)
-            return BadRequest(new ResultViewModel<Transaction>(ModelState.GetErrors()));
-
         var userId = User.GetUserId();
 
-        var transaction = await service.CreateAsync(
-            model.Description,
-            model.Amount,
-            model.Date,
-            model.CategoryId,
-            userId);
+        try
+        {
+            var transaction = await service.CreateAsync(
+                model.Description,
+                model.Amount,
+                model.Date,
+                model.CategoryId,
+                userId);
 
-        return Created(
-            $"api/transactions/{transaction.Id}",
-            new ResultViewModel<Transaction>(transaction));
+            return Created(
+                $"api/transactions/{transaction.Id}",
+                new ResultViewModel<Transaction>(transaction));
+        }
+        catch (InvalidOperationException ex)
+        {
+            return BadRequest(new ResultViewModel<Transaction>(ex.Message));
+        }
     }
 
     [HttpPut("{id:int}")]
@@ -63,9 +67,6 @@ public async Task<IActionResult> Put(
         [FromBody] EditorTransactionViewModel model,
         [FromServices] TransactionService service)
     {
-        if (!ModelState.IsValid)
-            return BadRequest(new ResultViewModel<Transaction>(ModelState.GetErrors()));
-
         try
         {
             var userId = User.GetUserId();
@@ -84,6 +85,10 @@ public async Task<IActionResult> Put(
         {
             return NotFound(new ResultViewModel<Transaction>("Transaction not found"));
         }
+        catch (InvalidOperationException ex)
+        {
+            return BadRequest(new ResultViewModel<Transaction>(ex.Message));
+        }
     }
 
     [HttpDelete("{id:int}")]

Trust-Finance.Api/Controllers/UserController.cs

@@ -5,7 +5,6 @@ namespace TF.Controllers
     using TF.Models;
     using TF.Data;
     using TF.ViewModels;
-    using TF.Extensions;
     using Microsoft.AspNetCore.Authorization;
 
     [Route("api/[controller]")]
@@ -58,9 +57,6 @@ public async Task<IActionResult> PutAsync(
             [FromBody] RegisterUserViewModel model,
             [FromServices] TFDataContext context)
         {
-            if (!ModelState.IsValid)
-                return BadRequest(new ResultViewModel<User>(ModelState.GetErrors()));
-
             try
             {
                 var user = await context.Users.FirstOrDefaultAsync(x => x.Id == id);

Trust-Finance.Api/Program.cs

@@ -1,7 +1,10 @@
 using TF.Data;
 using Microsoft.EntityFrameworkCore;
 using TF.Services;
+using TF.Extensions;
+using TF.ViewModels;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.IdentityModel.Tokens;
 using System.Text;
 
@@ -36,6 +39,15 @@
 builder.Services.AddControllers();
 builder.Services.AddEndpointsApiExplorer();
 
+// [ApiController] rejects invalid models before the action ever runs, so validation
+// failures have to be shaped here. Without this they come back as RFC 7807
+// ProblemDetails while every other error uses the ResultViewModel envelope.
+builder.Services.Configure<ApiBehaviorOptions>(options =>
+{
+    options.InvalidModelStateResponseFactory = context =>
+        new BadRequestObjectResult(new ResultViewModel<string>(context.ModelState.GetErrors()));
+});
+
 // Swagger
 builder.Services.AddSwaggerGen(c =>
 {
@@ -102,3 +114,7 @@
 app.UseAuthorization();
 app.MapControllers();
 app.Run();
+
+// Top-level statements compile into an internal Program class. Making it public
+// lets WebApplicationFactory<Program> boot this exact pipeline in integration tests.
+public partial class Program { }

Trust-Finance.Api/Services/CategoryService.cs

@@ -46,6 +46,16 @@ public async Task<Category> UpdateAsync(int id, string name, string slug)
         var category = await GetByIdAsync(id)
             ?? throw new KeyNotFoundException("Category not found");
 
+        // Slug is backed by a unique index; without this check the update surfaces as an
+        // unhandled DbUpdateException instead of a 400.
+        var slugTaken = await _context
+            .Categories
+            .AsNoTracking()
+            .AnyAsync(x => x.Slug == slug && x.Id != id);
+
+        if (slugTaken)
+            throw new InvalidOperationException("Slug already exists");
+
         category.Name = name;
         category.Slug = slug;
 

Trust-Finance.Api/Services/TransactionService.cs

@@ -35,6 +35,8 @@ public async Task<Transaction> CreateAsync(
         int categoryId,
         int userId)
     {
+        await EnsureCategoryExistsAsync(categoryId);
+
         var transaction = new Transaction
         {
             Description = description,
@@ -61,6 +63,8 @@ public async Task<Transaction> UpdateAsync(
         var transaction = await GetByIdAsync(id, userId)
             ?? throw new KeyNotFoundException("Transaction not found");
 
+        await EnsureCategoryExistsAsync(categoryId);
+
         transaction.Description = description;
         transaction.Amount = amount;
         transaction.Date = date;
@@ -80,4 +84,19 @@ public async Task<Transaction> DeleteAsync(int id, int userId)
 
         return transaction;
     }
+
+    /// <summary>
+    /// CategoryId is a foreign key: an unknown value fails at SaveChanges with a database
+    /// error rather than a readable rejection, so it is validated up front.
+    /// </summary>
+    private async Task EnsureCategoryExistsAsync(int categoryId)
+    {
+        var exists = await _context
+            .Categories
+            .AsNoTracking()
+            .AnyAsync(c => c.Id == categoryId);
+
+        if (!exists)
+            throw new InvalidOperationException("Category not found");
+    }
 }

Trust-Finance.Api/Trust-Finance.csproj

@@ -22,7 +22,6 @@
       <PrivateAssets>all</PrivateAssets>
     </PackageReference>
     <PackageReference Include="Microsoft.EntityFrameworkCore.SqlServer" Version="8.0.4" />
-    <PackageReference Include="MSTest.TestFramework" Version="3.6.1" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="8.1.1" />
   </ItemGroup>