refactor progress

packages/api/src/connection/tests/ConnectionCrud.test.tsx

@@ -0,0 +1,408 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {createTestAccount} from '@fluxer/api/src/auth/tests/AuthTestUtils';
+import {createUserID} from '@fluxer/api/src/BrandedTypes';
+import {
+	createBlueskyConnectionViaOAuth,
+	createBlueskyDid,
+	createBlueskyHandle,
+	deleteConnection,
+	initiateConnection,
+	listConnections,
+	reorderConnections,
+	updateConnection,
+} from '@fluxer/api/src/connection/tests/ConnectionTestUtils';
+import {type ApiTestHarness, createApiTestHarness} from '@fluxer/api/src/test/ApiTestHarness';
+import {HTTP_STATUS} from '@fluxer/api/src/test/TestConstants';
+import {createBuilder, createBuilderWithoutAuth} from '@fluxer/api/src/test/TestRequestBuilder';
+import {APIErrorCodes} from '@fluxer/constants/src/ApiErrorCodes';
+import {ConnectionTypes, ConnectionVisibilityFlags} from '@fluxer/constants/src/ConnectionConstants';
+import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
+
+describe('Connection CRUD', () => {
+	let harness: ApiTestHarness;
+
+	beforeAll(async () => {
+		harness = await createApiTestHarness();
+	});
+
+	beforeEach(async () => {
+		await harness.reset();
+	});
+
+	afterAll(async () => {
+		await harness?.shutdown();
+	});
+
+	describe('List connections', () => {
+		it('returns empty array initially', async () => {
+			const account = await createTestAccount(harness);
+			const connections = await listConnections(harness, account.token);
+			expect(connections).toEqual([]);
+		});
+
+		it('returns created connections', async () => {
+			const account = await createTestAccount(harness);
+			const handle = createBlueskyHandle('testuser');
+			const did = createBlueskyDid('testuser');
+			const userId = createUserID(BigInt(account.userId));
+
+			await createBlueskyConnectionViaOAuth(harness, account.token, handle, did, userId);
+
+			const connections = await listConnections(harness, account.token);
+			expect(connections).toHaveLength(1);
+			expect(connections[0].type).toBe(ConnectionTypes.BLUESKY);
+			expect(connections[0].name).toBe(handle);
+			expect(connections[0].verified).toBe(true);
+		});
+
+		it('requires authentication', async () => {
+			await createBuilderWithoutAuth(harness).get('/users/@me/connections').expect(HTTP_STATUS.UNAUTHORIZED).execute();
+		});
+	});
+
+	describe('Initiate connection', () => {
+		it('rejects Bluesky type from initiate endpoint', async () => {
+			const account = await createTestAccount(harness);
+
+			await createBuilder(harness, account.token)
+				.post('/users/@me/connections')
+				.body({
+					type: ConnectionTypes.BLUESKY,
+					identifier: 'test.bsky.social',
+				})
+				.expect(HTTP_STATUS.BAD_REQUEST, APIErrorCodes.BLUESKY_OAUTH_NOT_ENABLED)
+				.execute();
+		});
+
+		it('initiates valid domain connection', async () => {
+			const account = await createTestAccount(harness);
+			const domain = 'example.com';
+
+			const verification = await initiateConnection(harness, account.token, {
+				type: ConnectionTypes.DOMAIN,
+				identifier: domain,
+			});
+
+			expect(verification.type).toBe(ConnectionTypes.DOMAIN);
+			expect(verification.id).toBe(domain);
+			expect(verification.token).toBeTruthy();
+			expect(verification.token.length).toBeGreaterThan(0);
+			expect(verification.instructions).toBeTruthy();
+			expect(verification.initiation_token).toBeTruthy();
+			expect(verification.initiation_token.length).toBeGreaterThan(0);
+		});
+
+		it('does not create a DB record for domain initiation', async () => {
+			const account = await createTestAccount(harness);
+			const domain = 'example.com';
+
+			await initiateConnection(harness, account.token, {
+				type: ConnectionTypes.DOMAIN,
+				identifier: domain,
+			});
+
+			const connections = await listConnections(harness, account.token);
+			expect(connections).toHaveLength(0);
+		});
+
+		it('returns INVALID_FORM_BODY for invalid type', async () => {
+			const account = await createTestAccount(harness);
+
+			await createBuilder(harness, account.token)
+				.post('/users/@me/connections')
+				.body({
+					type: 'invalid_type',
+					identifier: 'test',
+				})
+				.expect(HTTP_STATUS.BAD_REQUEST, APIErrorCodes.INVALID_FORM_BODY)
+				.execute();
+		});
+
+		it('returns CONNECTION_LIMIT_REACHED when limit exceeded', async () => {
+			const account = await createTestAccount(harness);
+			const userId = createUserID(BigInt(account.userId));
+
+			for (let i = 0; i < 20; i++) {
+				await createBlueskyConnectionViaOAuth(
+					harness,
+					account.token,
+					createBlueskyHandle(`user${i}`),
+					createBlueskyDid(`user${i}`),
+					userId,
+				);
+			}
+
+			harness.mockBlueskyOAuthService.configure({
+				callbackResult: {
+					userId,
+					did: createBlueskyDid('user21'),
+					handle: createBlueskyHandle('user21'),
+				},
+			});
+
+			const response = await harness.requestJson({
+				path: '/connections/bluesky/callback?code=mock&state=mock&iss=mock',
+				method: 'GET',
+				headers: {Authorization: account.token},
+			});
+
+			expect(response.status).toBe(302);
+			const location = response.headers.get('location') ?? '';
+			expect(location).toContain('status=error');
+		});
+
+		it('requires authentication', async () => {
+			await createBuilderWithoutAuth(harness)
+				.post('/users/@me/connections')
+				.body({
+					type: ConnectionTypes.DOMAIN,
+					identifier: 'example.com',
+				})
+				.expect(HTTP_STATUS.UNAUTHORIZED)
+				.execute();
+		});
+	});
+
+	describe('Verify and create connection', () => {
+		it('returns CONNECTION_INITIATION_TOKEN_INVALID for expired token', async () => {
+			const account = await createTestAccount(harness);
+
+			await createBuilder(harness, account.token)
+				.post('/users/@me/connections/verify')
+				.body({
+					initiation_token: 'expired.token.value',
+				})
+				.expect(HTTP_STATUS.BAD_REQUEST, APIErrorCodes.CONNECTION_INITIATION_TOKEN_INVALID)
+				.execute();
+		});
+
+		it('returns CONNECTION_INITIATION_TOKEN_INVALID for tampered token', async () => {
+			const account = await createTestAccount(harness);
+			const domain = 'example.com';
+
+			const verification = await initiateConnection(harness, account.token, {
+				type: ConnectionTypes.DOMAIN,
+				identifier: domain,
+			});
+
+			const tamperedToken = `${verification.initiation_token}tampered`;
+
+			await createBuilder(harness, account.token)
+				.post('/users/@me/connections/verify')
+				.body({
+					initiation_token: tamperedToken,
+				})
+				.expect(HTTP_STATUS.BAD_REQUEST, APIErrorCodes.CONNECTION_INITIATION_TOKEN_INVALID)
+				.execute();
+		});
+
+		it('requires authentication', async () => {
+			await createBuilderWithoutAuth(harness)
+				.post('/users/@me/connections/verify')
+				.body({
+					initiation_token: 'some-token',
+				})
+				.expect(HTTP_STATUS.UNAUTHORIZED)
+				.execute();
+		});
+	});
+
+	describe('Bluesky OAuth connection', () => {
+		it('creates connection via OAuth flow', async () => {
+			const account = await createTestAccount(harness);
+			const handle = createBlueskyHandle('testuser');
+			const did = createBlueskyDid('testuser');
+			const userId = createUserID(BigInt(account.userId));
+
+			const connection = await createBlueskyConnectionViaOAuth(harness, account.token, handle, did, userId);
+
+			expect(connection.type).toBe(ConnectionTypes.BLUESKY);
+			expect(connection.name).toBe(handle);
+			expect(connection.verified).toBe(true);
+		});
+
+		it('accepts visibility_flags via OAuth flow', async () => {
+			const account = await createTestAccount(harness);
+			const handle = createBlueskyHandle('testuser');
+			const did = createBlueskyDid('testuser');
+			const userId = createUserID(BigInt(account.userId));
+
+			const connection = await createBlueskyConnectionViaOAuth(harness, account.token, handle, did, userId, {
+				visibility_flags: ConnectionVisibilityFlags.FRIENDS,
+			});
+
+			expect(connection.visibility_flags).toBe(ConnectionVisibilityFlags.FRIENDS);
+		});
+
+		it('updates existing connection on re-authorisation', async () => {
+			const account = await createTestAccount(harness);
+			const handle = createBlueskyHandle('testuser');
+			const newHandle = 'newalias.bsky.social';
+			const did = createBlueskyDid('testuser');
+			const userId = createUserID(BigInt(account.userId));
+
+			await createBlueskyConnectionViaOAuth(harness, account.token, handle, did, userId);
+
+			harness.mockBlueskyOAuthService.configure({
+				callbackResult: {userId, did, handle: newHandle},
+			});
+
+			await harness.requestJson({
+				path: '/connections/bluesky/callback?code=mock&state=mock&iss=mock',
+				method: 'GET',
+				headers: {Authorization: account.token},
+			});
+
+			const connections = await listConnections(harness, account.token);
+			expect(connections).toHaveLength(1);
+			expect(connections[0].name).toBe(newHandle);
+			expect(connections[0].verified).toBe(true);
+		});
+	});
+
+	describe('Update connection', () => {
+		it('updates visibility_flags', async () => {
+			const account = await createTestAccount(harness);
+			const handle = createBlueskyHandle('testuser');
+			const did = createBlueskyDid('testuser');
+			const userId = createUserID(BigInt(account.userId));
+
+			await createBlueskyConnectionViaOAuth(harness, account.token, handle, did, userId);
+
+			const connections = await listConnections(harness, account.token);
+			const connectionId = connections[0].id;
+
+			await updateConnection(harness, account.token, ConnectionTypes.BLUESKY, connectionId, {
+				visibility_flags: ConnectionVisibilityFlags.MUTUAL_GUILDS,
+			});
+
+			const updatedConnections = await listConnections(harness, account.token);
+			expect(updatedConnections[0].visibility_flags).toBe(ConnectionVisibilityFlags.MUTUAL_GUILDS);
+		});
+
+		it('updates sort_order', async () => {
+			const account = await createTestAccount(harness);
+			const handle = createBlueskyHandle('testuser');
+			const did = createBlueskyDid('testuser');
+			const userId = createUserID(BigInt(account.userId));
+
+			await createBlueskyConnectionViaOAuth(harness, account.token, handle, did, userId);
+
+			const connections = await listConnections(harness, account.token);
+			const connectionId = connections[0].id;
+
+			await updateConnection(harness, account.token, ConnectionTypes.BLUESKY, connectionId, {
+				sort_order: 5,
+			});
+
+			const updatedConnections = await listConnections(harness, account.token);
+			expect(updatedConnections[0].sort_order).toBe(5);
+		});
+
+		it('returns CONNECTION_NOT_FOUND for non-existent connection', async () => {
+			const account = await createTestAccount(harness);
+
+			await createBuilder(harness, account.token)
+				.patch(`/users/@me/connections/${ConnectionTypes.BLUESKY}/nonexistent`)
+				.body({visibility_flags: ConnectionVisibilityFlags.EVERYONE})
+				.expect(HTTP_STATUS.NOT_FOUND, APIErrorCodes.CONNECTION_NOT_FOUND)
+				.execute();
+		});
+
+		it('requires authentication', async () => {
+			await createBuilderWithoutAuth(harness)
+				.patch(`/users/@me/connections/${ConnectionTypes.BLUESKY}/test`)
+				.body({visibility_flags: ConnectionVisibilityFlags.EVERYONE})
+				.expect(HTTP_STATUS.UNAUTHORIZED)
+				.execute();
+		});
+	});
+
+	describe('Delete connection', () => {
+		it('deletes existing connection', async () => {
+			const account = await createTestAccount(harness);
+			const handle = createBlueskyHandle('testuser');
+			const did = createBlueskyDid('testuser');
+			const userId = createUserID(BigInt(account.userId));
+
+			await createBlueskyConnectionViaOAuth(harness, account.token, handle, did, userId);
+
+			const connections = await listConnections(harness, account.token);
+			const connectionId = connections[0].id;
+
+			await deleteConnection(harness, account.token, ConnectionTypes.BLUESKY, connectionId);
+
+			const updatedConnections = await listConnections(harness, account.token);
+			expect(updatedConnections).toHaveLength(0);
+		});
+
+		it('returns CONNECTION_NOT_FOUND for non-existent connection', async () => {
+			const account = await createTestAccount(harness);
+
+			await createBuilder(harness, account.token)
+				.delete(`/users/@me/connections/${ConnectionTypes.BLUESKY}/nonexistent`)
+				.expect(HTTP_STATUS.NOT_FOUND, APIErrorCodes.CONNECTION_NOT_FOUND)
+				.execute();
+		});
+
+		it('requires authentication', async () => {
+			await createBuilderWithoutAuth(harness)
+				.delete(`/users/@me/connections/${ConnectionTypes.BLUESKY}/test`)
+				.expect(HTTP_STATUS.UNAUTHORIZED)
+				.execute();
+		});
+	});
+
+	describe('Reorder connections', () => {
+		it('reorders multiple connections', async () => {
+			const account = await createTestAccount(harness);
+			const handle1 = createBlueskyHandle('user1');
+			const handle2 = createBlueskyHandle('user2');
+			const did1 = createBlueskyDid('user1');
+			const did2 = createBlueskyDid('user2');
+			const userId = createUserID(BigInt(account.userId));
+
+			await createBlueskyConnectionViaOAuth(harness, account.token, handle1, did1, userId);
+			await createBlueskyConnectionViaOAuth(harness, account.token, handle2, did2, userId);
+
+			const connections = await listConnections(harness, account.token);
+			const id1 = connections[0].id;
+			const id2 = connections[1].id;
+
+			await reorderConnections(harness, account.token, [id2, id1]);
+
+			const reordered = await listConnections(harness, account.token);
+			const conn1 = reordered.find((c) => c.id === id1);
+			const conn2 = reordered.find((c) => c.id === id2);
+
+			expect(conn2?.sort_order).toBe(0);
+			expect(conn1?.sort_order).toBe(1);
+		});
+
+		it('requires authentication', async () => {
+			await createBuilderWithoutAuth(harness)
+				.patch('/users/@me/connections/reorder')
+				.body({connection_ids: ['id1', 'id2']})
+				.expect(HTTP_STATUS.UNAUTHORIZED)
+				.execute();
+		});
+	});
+});

packages/api/src/connection/tests/ConnectionTestUtils.tsx

@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import type {UserID} from '@fluxer/api/src/BrandedTypes';
+import type {ApiTestHarness} from '@fluxer/api/src/test/ApiTestHarness';
+import {createBuilder} from '@fluxer/api/src/test/TestRequestBuilder';
+import type {BlueskyAuthorizeResponse} from '@fluxer/schema/src/domains/connection/BlueskyOAuthSchemas';
+import type {
+	ConnectionListResponse,
+	ConnectionResponse,
+	ConnectionVerificationResponse,
+	CreateConnectionRequest,
+	VerifyAndCreateConnectionRequest,
+} from '@fluxer/schema/src/domains/connection/ConnectionSchemas';
+
+export async function initiateConnection(
+	harness: ApiTestHarness,
+	token: string,
+	request: CreateConnectionRequest,
+): Promise<ConnectionVerificationResponse> {
+	return await createBuilder<ConnectionVerificationResponse>(harness, token)
+		.post('/users/@me/connections')
+		.body(request)
+		.expect(201)
+		.execute();
+}
+
+export async function verifyAndCreateConnection(
+	harness: ApiTestHarness,
+	token: string,
+	request: VerifyAndCreateConnectionRequest,
+): Promise<ConnectionResponse> {
+	return await createBuilder<ConnectionResponse>(harness, token)
+		.post('/users/@me/connections/verify')
+		.body(request)
+		.expect(201)
+		.execute();
+}
+
+export async function listConnections(harness: ApiTestHarness, token: string): Promise<ConnectionListResponse> {
+	return await createBuilder<ConnectionListResponse>(harness, token)
+		.get('/users/@me/connections')
+		.expect(200)
+		.execute();
+}
+
+export async function verifyConnection(
+	harness: ApiTestHarness,
+	token: string,
+	type: string,
+	connectionId: string,
+): Promise<ConnectionResponse> {
+	return await createBuilder<ConnectionResponse>(harness, token)
+		.post(`/users/@me/connections/${type}/${connectionId}/verify`)
+		.expect(200)
+		.execute();
+}
+
+export async function deleteConnection(
+	harness: ApiTestHarness,
+	token: string,
+	type: string,
+	connectionId: string,
+): Promise<void> {
+	await createBuilder(harness, token).delete(`/users/@me/connections/${type}/${connectionId}`).expect(204).execute();
+}
+
+export async function updateConnection(
+	harness: ApiTestHarness,
+	token: string,
+	type: string,
+	connectionId: string,
+	body: {visibility_flags?: number; sort_order?: number},
+): Promise<void> {
+	await createBuilder(harness, token)
+		.patch(`/users/@me/connections/${type}/${connectionId}`)
+		.body(body)
+		.expect(204)
+		.execute();
+}
+
+export async function reorderConnections(
+	harness: ApiTestHarness,
+	token: string,
+	connectionIds: Array<string>,
+): Promise<void> {
+	await createBuilder(harness, token)
+		.patch('/users/@me/connections/reorder')
+		.body({connection_ids: connectionIds})
+		.expect(204)
+		.execute();
+}
+
+export async function createVerifiedConnection(
+	harness: ApiTestHarness,
+	token: string,
+	request: CreateConnectionRequest,
+	initiationToken: string,
+): Promise<ConnectionResponse> {
+	return verifyAndCreateConnection(harness, token, {
+		initiation_token: initiationToken,
+		visibility_flags: request.visibility_flags,
+	});
+}
+
+export async function authorizeBlueskyConnection(
+	harness: ApiTestHarness,
+	token: string,
+	handle: string,
+): Promise<BlueskyAuthorizeResponse> {
+	return await createBuilder<BlueskyAuthorizeResponse>(harness, token)
+		.post('/users/@me/connections/bluesky/authorize')
+		.body({handle})
+		.expect(200)
+		.execute();
+}
+
+export async function createBlueskyConnectionViaOAuth(
+	harness: ApiTestHarness,
+	token: string,
+	handle: string,
+	did: string,
+	userId: UserID,
+	options?: {visibility_flags?: number},
+): Promise<ConnectionResponse> {
+	harness.mockBlueskyOAuthService.configure({
+		callbackResult: {userId, did, handle},
+	});
+
+	await authorizeBlueskyConnection(harness, token, handle);
+
+	await harness.requestJson({
+		path: `/connections/bluesky/callback?code=mock_code&state=mock_state&iss=mock_iss`,
+		method: 'GET',
+		headers: {Authorization: token},
+	});
+
+	const connections = await listConnections(harness, token);
+	const connection = connections.find((c) => c.name === handle);
+	if (!connection) {
+		throw new Error(`Bluesky connection for handle '${handle}' was not created`);
+	}
+
+	if (options?.visibility_flags !== undefined) {
+		await updateConnection(harness, token, connection.type, connection.id, {
+			visibility_flags: options.visibility_flags,
+		});
+		const updatedConnections = await listConnections(harness, token);
+		return updatedConnections.find((c) => c.id === connection.id)!;
+	}
+
+	return connection;
+}
+
+export function createBlueskyHandle(username: string): string {
+	return `${username}.bsky.social`;
+}
+
+export function createBlueskyDid(username: string): string {
+	return `did:plc:${username}123`;
+}

packages/api/src/connection/tests/ConnectionVerification.test.tsx

@@ -0,0 +1,265 @@
+/*
+ * Copyright (C) 2026 Fluxer Contributors
+ *
+ * This file is part of Fluxer.
+ *
+ * Fluxer is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Fluxer is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with Fluxer. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+import {createTestAccount} from '@fluxer/api/src/auth/tests/AuthTestUtils';
+import {createUserID} from '@fluxer/api/src/BrandedTypes';
+import {
+	createBlueskyConnectionViaOAuth,
+	initiateConnection,
+	listConnections,
+	verifyAndCreateConnection,
+	verifyConnection,
+} from '@fluxer/api/src/connection/tests/ConnectionTestUtils';
+import {type ApiTestHarness, createApiTestHarness} from '@fluxer/api/src/test/ApiTestHarness';
+import {server} from '@fluxer/api/src/test/msw/server';
+import {HTTP_STATUS} from '@fluxer/api/src/test/TestConstants';
+import {createBuilder} from '@fluxer/api/src/test/TestRequestBuilder';
+import {APIErrorCodes} from '@fluxer/constants/src/ApiErrorCodes';
+import {ConnectionTypes} from '@fluxer/constants/src/ConnectionConstants';
+import {HttpResponse, http} from 'msw';
+import {afterAll, beforeAll, beforeEach, describe, expect, it} from 'vitest';
+
+async function createDomainConnectionViaFlow(
+	harness: ApiTestHarness,
+	accountToken: string,
+	domain: string,
+): Promise<{connectionId: string; verificationToken: string}> {
+	const verification = await initiateConnection(harness, accountToken, {
+		type: ConnectionTypes.DOMAIN,
+		identifier: domain,
+	});
+
+	const verificationToken = verification.token;
+
+	server.use(
+		http.get(`https://${domain}/.well-known/fluxer-verification`, () => {
+			return HttpResponse.text(verificationToken);
+		}),
+	);
+
+	const connection = await verifyAndCreateConnection(harness, accountToken, {
+		initiation_token: verification.initiation_token,
+	});
+
+	return {connectionId: connection.id, verificationToken};
+}
+
+const testHandle = 'testuser.bsky.social';
+const testDid = 'did:plc:testuser123';
+
+describe('Connection verification', () => {
+	let harness: ApiTestHarness;
+
+	beforeAll(async () => {
+		harness = await createApiTestHarness();
+	});
+
+	beforeEach(async () => {
+		await harness.reset();
+	});
+
+	afterAll(async () => {
+		await harness?.shutdown();
+	});
+
+	describe('Bluesky verification', () => {
+		it('verifies successfully when OAuth session is valid', async () => {
+			const account = await createTestAccount(harness);
+			const userId = createUserID(BigInt(account.userId));
+
+			const connection = await createBlueskyConnectionViaOAuth(harness, account.token, testHandle, testDid, userId);
+
+			harness.mockBlueskyOAuthService.configure({
+				restoreAndVerifyResult: {handle: testHandle},
+			});
+
+			const result = await verifyConnection(harness, account.token, ConnectionTypes.BLUESKY, connection.id);
+
+			expect(result.verified).toBe(true);
+			expect(result.type).toBe(ConnectionTypes.BLUESKY);
+			expect(result.name).toBe(testHandle);
+
+			const updatedConnections = await listConnections(harness, account.token);
+			expect(updatedConnections[0].verified).toBe(true);
+		});
+
+		it('fails verification when OAuth session is expired', async () => {
+			const account = await createTestAccount(harness);
+			const userId = createUserID(BigInt(account.userId));
+
+			const connection = await createBlueskyConnectionViaOAuth(harness, account.token, testHandle, testDid, userId);
+
+			const connectionsBefore = await listConnections(harness, account.token);
+			expect(connectionsBefore[0].verified).toBe(true);
+
+			harness.mockBlueskyOAuthService.configure({
+				restoreAndVerifyResult: null,
+			});
+
+			await createBuilder(harness, account.token)
+				.post(`/users/@me/connections/${ConnectionTypes.BLUESKY}/${connection.id}/verify`)
+				.expect(HTTP_STATUS.FORBIDDEN, APIErrorCodes.CONNECTION_VERIFICATION_FAILED)
+				.execute();
+
+			const updatedConnections = await listConnections(harness, account.token);
+			expect(updatedConnections[0].verified).toBe(false);
+		});
+
+		it('fails verification when OAuth session cannot be restored', async () => {
+			const account = await createTestAccount(harness);
+			const userId = createUserID(BigInt(account.userId));
+
+			const connection = await createBlueskyConnectionViaOAuth(harness, account.token, testHandle, testDid, userId);
+
+			harness.mockBlueskyOAuthService.configure({
+				restoreAndVerifyResult: null,
+			});
+
+			await createBuilder(harness, account.token)
+				.post(`/users/@me/connections/${ConnectionTypes.BLUESKY}/${connection.id}/verify`)
+				.expect(HTTP_STATUS.FORBIDDEN, APIErrorCodes.CONNECTION_VERIFICATION_FAILED)
+				.execute();
+		});
+
+		it('fails verification when OAuth restore throws', async () => {
+			const account = await createTestAccount(harness);
+			const userId = createUserID(BigInt(account.userId));
+
+			const connection = await createBlueskyConnectionViaOAuth(harness, account.token, testHandle, testDid, userId);
+
+			harness.mockBlueskyOAuthService.restoreAndVerifySpy.mockRejectedValue(new Error('OAuth restore failure'));
+
+			await createBuilder(harness, account.token)
+				.post(`/users/@me/connections/${ConnectionTypes.BLUESKY}/${connection.id}/verify`)
+				.expect(HTTP_STATUS.FORBIDDEN, APIErrorCodes.CONNECTION_VERIFICATION_FAILED)
+				.execute();
+		});
+	});
+
+	describe('Domain verification', () => {
+		it('verifies successfully via well-known endpoint', async () => {
+			const account = await createTestAccount(harness);
+			const domain = 'example.com';
+
+			const {connectionId, verificationToken} = await createDomainConnectionViaFlow(harness, account.token, domain);
+
+			server.use(
+				http.get(`https://${domain}/.well-known/fluxer-verification`, () => {
+					return HttpResponse.text(verificationToken);
+				}),
+			);
+
+			const result = await verifyConnection(harness, account.token, ConnectionTypes.DOMAIN, connectionId);
+
+			expect(result.verified).toBe(true);
+			expect(result.type).toBe(ConnectionTypes.DOMAIN);
+			expect(result.name).toBe(domain);
+
+			const updatedConnections = await listConnections(harness, account.token);
+			expect(updatedConnections[0].verified).toBe(true);
+		});
+
+		it('fails verification when well-known endpoint returns wrong token', async () => {
+			const account = await createTestAccount(harness);
+			const domain = 'example.com';
+
+			const {connectionId} = await createDomainConnectionViaFlow(harness, account.token, domain);
+
+			const connectionsBefore = await listConnections(harness, account.token);
+			expect(connectionsBefore[0].verified).toBe(true);
+
+			server.use(
+				http.get(`https://${domain}/.well-known/fluxer-verification`, () => {
+					return HttpResponse.text('wrong-token');
+				}),
+			);
+
+			await createBuilder(harness, account.token)
+				.post(`/users/@me/connections/${ConnectionTypes.DOMAIN}/${connectionId}/verify`)
+				.expect(HTTP_STATUS.FORBIDDEN, APIErrorCodes.CONNECTION_VERIFICATION_FAILED)
+				.execute();
+
+			const updatedConnections = await listConnections(harness, account.token);
+			expect(updatedConnections[0].verified).toBe(false);
+		});
+
+		it('fails verification when well-known endpoint is not found', async () => {
+			const account = await createTestAccount(harness);
+			const domain = 'example.com';
+
+			const {connectionId} = await createDomainConnectionViaFlow(harness, account.token, domain);
+
+			server.use(
+				http.get(`https://${domain}/.well-known/fluxer-verification`, () => {
+					return HttpResponse.text('Not found', {status: 404});
+				}),
+			);
+
+			await createBuilder(harness, account.token)
+				.post(`/users/@me/connections/${ConnectionTypes.DOMAIN}/${connectionId}/verify`)
+				.expect(HTTP_STATUS.FORBIDDEN, APIErrorCodes.CONNECTION_VERIFICATION_FAILED)
+				.execute();
+		});
+
+		it('fails verification when well-known endpoint returns 500', async () => {
+			const account = await createTestAccount(harness);
+			const domain = 'example.com';
+
+			const {connectionId} = await createDomainConnectionViaFlow(harness, account.token, domain);
+
+			server.use(
+				http.get(`https://${domain}/.well-known/fluxer-verification`, () => {
+					return HttpResponse.text('Internal server error', {status: 500});
+				}),
+			);
+
+			await createBuilder(harness, account.token)
+				.post(`/users/@me/connections/${ConnectionTypes.DOMAIN}/${connectionId}/verify`)
+				.expect(HTTP_STATUS.FORBIDDEN, APIErrorCodes.CONNECTION_VERIFICATION_FAILED)
+				.execute();
+		});
+	});
+
+	describe('Verification errors', () => {
+		it('returns CONNECTION_NOT_FOUND for non-existent connection', async () => {
+			const account = await createTestAccount(harness);
+
+			await createBuilder(harness, account.token)
+				.post(`/users/@me/connections/${ConnectionTypes.BLUESKY}/nonexistent/verify`)
+				.expect(HTTP_STATUS.NOT_FOUND, APIErrorCodes.CONNECTION_NOT_FOUND)
+				.execute();
+		});
+
+		it('allows re-verification of already verified connection', async () => {
+			const account = await createTestAccount(harness);
+			const userId = createUserID(BigInt(account.userId));
+
+			const connection = await createBlueskyConnectionViaOAuth(harness, account.token, testHandle, testDid, userId);
+
+			harness.mockBlueskyOAuthService.configure({
+				restoreAndVerifyResult: {handle: testHandle},
+			});
+
+			await verifyConnection(harness, account.token, ConnectionTypes.BLUESKY, connection.id);
+
+			const result = await verifyConnection(harness, account.token, ConnectionTypes.BLUESKY, connection.id);
+			expect(result.verified).toBe(true);
+		});
+	});
+});