backend phase 6: nurse verification & credentials (mocked vendors)

The trust engine. New `verif` schema (5 tables) + a data-driven verification pipeline: steps are rows (6 seeded step-types), not a code enum. - nurse_verifications.status is the single source of verification truth; nurse_profiles.is_verified is flipped ONLY inside the finalize transaction (VerificationAggregator: tracked verification + tracked profile -> one commit) and reversed on suspension/expiry — no in-between state. - is_automated snapshotted onto each step at submit; steps seeded from active required step-types; automated runs (identity-KYC, Shahkar, IBAN ownership) find their step by code. - users.national_id populated only on identity-KYC pass; Shahkar + IBAN owner compare against it (money-mule guard); shared-SIM -> shared_sim support alert. - Documents are metadata-only behind signed URLs; credential_number encrypted and never serialized; public trust badge exposes credential TYPES, not numbers; holder-name cross-checked against the verified identity before recording. - Admin-triggered credential-expiry scan reverts lapsed steps, re-gates bookability, raises a verification_expired alert + verification_expiry_prompt notification (scheduled cron deferred; config key verification_expiry_scan_cadence_hours). Three new mock vendor seams (IShahkarVerifier / IIdentityKycProvider / ICredentialVerifier) behind DI; reuses b3 IBankAccountOwnershipVerifier and b0 IObjectStorage/IFieldEncryptor. 15 endpoints across 4 controllers. Two migrations (tables + step-type seed). 154 tests pass, zero new warnings. Contract dev/contracts/domains/verification.md + swagger snapshot refreshed; handoff/report/mocks-registry updated. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-05 14:39:32 +03:30
parent 687fbfc6d9
commit 1c266523bc
105 changed files with 13938 additions and 10 deletions
@@ -0,0 +1,120 @@
+using Baya.Application.Common;
+using Baya.Domain.Entities.Identity;
+using Baya.Domain.Entities.Verification;
+using static Baya.Test.Foundation.Verification.VerificationTestSupport;
+
+namespace Baya.Test.Foundation.Verification;
+
+public class VerificationAggregatorTests
+{
+    private static readonly DateTimeOffset Now = new(2026, 7, 1, 12, 0, 0, TimeSpan.Zero);
+
+    private static (NurseVerification Verification, NurseProfile Profile) Build(params VerificationStepStatus[] statuses)
+    {
+        var verification = new NurseVerification { NurseId = 42, Status = VerificationStatus.Pending };
+        for (var i = 0; i < statuses.Length; i++)
+            verification.Steps.Add(Step(i + 1, StepType(i + 1, $"step_{i}", automated: false), statuses[i]));
+
+        return (verification, new NurseProfile());
+    }
+
+    [Fact]
+    public void Finalize_AllPassed_ApprovesAndFlipsVerified()
+    {
+        var (verification, profile) = Build(VerificationStepStatus.Passed, VerificationStepStatus.Passed);
+
+        var status = VerificationAggregator.Finalize(verification, profile, Now);
+
+        Assert.Equal(VerificationStatus.Approved, status);
+        Assert.Equal(VerificationStatus.Approved, verification.Status);
+        Assert.Equal(Now, verification.ApprovedAt);
+        Assert.True(profile.IsVerified);
+    }
+
+    [Fact]
+    public void Finalize_OneFailed_RejectsAndKeepsUnverified()
+    {
+        var (verification, profile) = Build(VerificationStepStatus.Passed, VerificationStepStatus.Failed);
+
+        VerificationAggregator.Finalize(verification, profile, Now);
+
+        Assert.Equal(VerificationStatus.Rejected, verification.Status);
+        Assert.Equal(Now, verification.RejectedAt);
+        Assert.Null(verification.ApprovedAt);
+        Assert.False(profile.IsVerified);
+    }
+
+    [Fact]
+    public void Finalize_OneInReview_SetsInReview()
+    {
+        var (verification, profile) = Build(VerificationStepStatus.Passed, VerificationStepStatus.InReview);
+
+        VerificationAggregator.Finalize(verification, profile, Now);
+
+        Assert.Equal(VerificationStatus.InReview, verification.Status);
+        Assert.False(profile.IsVerified);
+    }
+
+    [Fact]
+    public void Finalize_AllPending_StaysPending()
+    {
+        var (verification, profile) = Build(VerificationStepStatus.Pending, VerificationStepStatus.Pending);
+
+        VerificationAggregator.Finalize(verification, profile, Now);
+
+        Assert.Equal(VerificationStatus.Pending, verification.Status);
+        Assert.False(profile.IsVerified);
+    }
+
+    [Fact]
+    public void Finalize_PreviouslyApproved_ThenExpires_ReversesVerified()
+    {
+        var (verification, profile) = Build(VerificationStepStatus.Passed, VerificationStepStatus.Passed);
+        VerificationAggregator.Finalize(verification, profile, Now);
+        Assert.True(profile.IsVerified);
+
+        // A required step lapses (the expiry scan) → re-gate.
+        verification.Steps.Last().Status = VerificationStepStatus.Expired;
+        VerificationAggregator.Finalize(verification, profile, Now);
+
+        Assert.False(profile.IsVerified);
+        Assert.Equal(VerificationStatus.Pending, verification.Status);
+        Assert.Null(verification.ApprovedAt);
+    }
+
+    [Fact]
+    public void Finalize_Suspended_StaysSuspendedAndUnverified()
+    {
+        var (verification, profile) = Build(VerificationStepStatus.Passed, VerificationStepStatus.Passed);
+        profile.MarkVerified();
+        verification.Status = VerificationStatus.Suspended;
+
+        var status = VerificationAggregator.Finalize(verification, profile, Now);
+
+        Assert.Equal(VerificationStatus.Suspended, status);
+        Assert.False(profile.IsVerified);
+    }
+
+    [Fact]
+    public void Finalize_NoSteps_DoesNotApprove()
+    {
+        var verification = new NurseVerification { NurseId = 42, Status = VerificationStatus.Pending };
+        var profile = new NurseProfile();
+
+        VerificationAggregator.Finalize(verification, profile, Now);
+
+        Assert.False(profile.IsVerified);
+        Assert.Equal(VerificationStatus.Pending, verification.Status);
+    }
+
+    [Fact]
+    public void BlockingStepCodes_ReturnsCodesOfNonPassedSteps()
+    {
+        var (verification, _) = Build(VerificationStepStatus.Passed, VerificationStepStatus.Pending);
+
+        var blocking = VerificationAggregator.BlockingStepCodes(verification.Steps);
+
+        Assert.Single(blocking);
+        Assert.Equal("step_1", blocking[0]);
+    }
+}