@

backend phase 3: identity profiles, patients & nurse bank accounts

Add the role-attached identity layer on top of the b2 auth spine: nurse
seller profiles (guarded is_verified, read-only aggregates), thin customer
payer profiles, first-class patients (tenancy-scoped), and nurse payout bank
accounts hardened with an iban_hash uniqueness guard and an automated استعلام
شبا IBAN-ownership inquiry.

- Four usr tables via one migration (1:1 uniques, UNIQUE(iban_hash), filtered
  UNIQUE(nurse_id) WHERE is_primary=1, guarded is_verified, encrypted PII,
  soft-delete on nurse_profiles)
- 15 CQRS slices + 4 role-scoped controllers; reads projected + paginated,
  IBAN masked (last-4); ownership-inquiry endpoints rate-limited
- New IBankAccountOwnershipVerifier seam (mock deterministic شبا match) +
  per-domain repositories on IUnitOfWork + encrypted-PII value converters
- Activate FluentValidation repo-wide (validators were never registered)
- Handler unit tests + WebApplicationFactory integration tests (76 pass);
  contract identity-profiles.md + swagger snapshot; docs, handoff & report

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@

dev/shared-working-context/backend/STATUS.md

@@ -12,6 +12,28 @@ One block per completed backend phase. Newest at the top. Backend lane writes he
 - **Notes for frontend:** <anything load-bearing>
 -->
 
+## backend-phase-3 — Identity: profiles, patients & nurse bank accounts — 2026-07-02
+- **Shipped:** four `usr` tables via one migration (`IdentityProfilesPatientsBankAccounts`) —
+  `NurseProfiles` (1:1 `Users`; guarded `is_verified` **no public setter**; read-only aggregates;
+  soft-delete), `CustomerProfiles` (thin payer; enc emergency contact), `Patients` (care recipient,
+  tenancy-scoped; `is_active` archive; enc `initial_medical_notes`), `NurseBankAccounts` (enc `iban` +
+  `UNIQUE(iban_hash)` + filtered `UNIQUE(nurse_id) WHERE is_primary=1`; استعلام شبا inquiry fields);
+  15 CQRS slices across 4 controllers (`nurse_profiles`, `customer_profiles`, `patients`,
+  `nurse_bank_accounts`); new **`IBankAccountOwnershipVerifier`** seam (mock = deterministic شبا match);
+  per-domain repositories on `IUnitOfWork`; enc value converters for the new PII columns. Also
+  **activated FluentValidation** repo-wide (`AddApplicationServices` now registers every
+  `AbstractValidator<T>` — the `ValidateCommandBehavior`/model-state filter were previously starved).
+- **Contracts:** dev/contracts/domains/identity-profiles.md + openapi snapshot refreshed (yes — new
+  nurse/customer/patient/bank paths).
+- **Mocked:** `IBankAccountOwnershipVerifier` → 🟡 (see reports/mocks-registry.md).
+- **Gate:** build clean (0 new code warnings) / tests green (75 pass: +13 `Baya.Test.Api` integration,
+  +15 handler unit tests). Migration applied to the dev DB on startup; swagger exposes all b3 paths.
+- **Handoff:** backend/handoff/after-backend-phase-3.md
+- **Notes for frontend:** role scoping needs the **role claim in the token** — refresh after
+  `select_role` before calling these. IBAN comes back **masked** (last-4). `isVerified`/aggregates are
+  read-only. Patient `get/update` of another customer's id → **404**. Addresses/service-areas are
+  **deferred to b4**.
+
 ## backend-phase-2 — Identity: phone-OTP auth, sessions & roles (REST) — 2026-07-02
 - **Shipped:** the six-endpoint REST auth surface (`auth/request_otp`, `auth/verify_otp`,
   `auth/refresh`, `auth/logout`, `me`, `me/select_role`) wrapping the existing JWE/TOTP/RBAC engine;