@

backend phase 3: identity profiles, patients & nurse bank accounts

Add the role-attached identity layer on top of the b2 auth spine: nurse
seller profiles (guarded is_verified, read-only aggregates), thin customer
payer profiles, first-class patients (tenancy-scoped), and nurse payout bank
accounts hardened with an iban_hash uniqueness guard and an automated استعلام
شبا IBAN-ownership inquiry.

- Four usr tables via one migration (1:1 uniques, UNIQUE(iban_hash), filtered
  UNIQUE(nurse_id) WHERE is_primary=1, guarded is_verified, encrypted PII,
  soft-delete on nurse_profiles)
- 15 CQRS slices + 4 role-scoped controllers; reads projected + paginated,
  IBAN masked (last-4); ownership-inquiry endpoints rate-limited
- New IBankAccountOwnershipVerifier seam (mock deterministic شبا match) +
  per-domain repositories on IUnitOfWork + encrypted-PII value converters
- Activate FluentValidation repo-wide (validators were never registered)
- Handler unit tests + WebApplicationFactory integration tests (76 pass);
  contract identity-profiles.md + swagger snapshot; docs, handoff & report

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Seams/MockBankAccountOwnershipVerifier.cs

@@ -0,0 +1,38 @@
+#nullable enable
+using System.Security.Cryptography;
+using System.Text;
+using Baya.Application.Contracts.Common;
+using Microsoft.Extensions.Options;
+
+namespace Baya.Infrastructure.CrossCutting.Seams;
+
+/// <summary>
+/// Mock <see cref="IBankAccountOwnershipVerifier"/>: a deterministic fake استعلام شبا inquiry — no real
+/// bank/KYC call and no money moves. Every IBAN returns a match except the configured
+/// <see cref="BankOwnershipOptions.MismatchIban"/>, which returns <c>MatchedNationalId = false</c> so the
+/// ownership-mismatch path is testable. The vendor ref is derived from the IBAN, so re-running the same
+/// inquiry is idempotent. The real implementation (Finnotech/banking-bridge) swaps in via a registration
+/// change — callers are unchanged.
+/// </summary>
+public sealed class MockBankAccountOwnershipVerifier(IOptions<SeamOptions> options) : IBankAccountOwnershipVerifier
+{
+    private readonly BankOwnershipOptions _options = options.Value.BankOwnership;
+
+    // nurseNationalId is part of the real vendor contract (owner ↔ national-id match); the mock decides
+    // the outcome from the IBAN alone so both paths are deterministically testable.
+    public Task<OwnershipInquiryResult> VerifyOwnershipAsync(string iban, string? nurseNationalId, CancellationToken cancellationToken = default)
+    {
+        var normalized = Normalize(iban);
+        var matched = !string.Equals(normalized, Normalize(_options.MismatchIban), StringComparison.OrdinalIgnoreCase);
+        var holder = matched ? _options.MatchedHolderName : _options.MismatchHolderName;
+        var vendorRef = $"MOCK-SHEBA-{Token(normalized)}";
+
+        return Task.FromResult(new OwnershipInquiryResult(matched, holder, vendorRef));
+    }
+
+    private static string Normalize(string iban)
+        => string.IsNullOrEmpty(iban) ? string.Empty : iban.Replace(" ", string.Empty).ToUpperInvariant();
+
+    private static string Token(string value)
+        => Convert.ToHexString(SHA256.HashData(Encoding.UTF8.GetBytes(value)))[..12];
+}

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/Seams/SeamOptions.cs

@@ -10,6 +10,24 @@ public sealed class SeamOptions
 
     public FieldEncryptionOptions FieldEncryption { get; set; } = new();
     public ObjectStorageOptions ObjectStorage { get; set; } = new();
+    public BankOwnershipOptions BankOwnership { get; set; } = new();
+}
+
+/// <summary>
+/// Tunes the mock <c>IBankAccountOwnershipVerifier</c> (استعلام شبا). A submitted IBAN equal to
+/// <see cref="MismatchIban"/> returns an ownership mismatch so the payout-gating path is testable; every
+/// other IBAN returns a match. The real vendor implementation ignores these.
+/// </summary>
+public sealed class BankOwnershipOptions
+{
+    /// <summary>The designated test IBAN that returns <c>matched_national_id = false</c>.</summary>
+    public string MismatchIban { get; set; } = "IR000000000000000000000000";
+
+    /// <summary>The account-holder name the mock echoes back for a matching inquiry.</summary>
+    public string MatchedHolderName { get; set; } = "Verified Account Holder";
+
+    /// <summary>The account-holder name the mock returns for the mismatch IBAN.</summary>
+    public string MismatchHolderName { get; set; } = "Unmatched Account Holder";
 }
 
 public sealed class FieldEncryptionOptions

server/src/Infrastructure/Baya.Infrastructure.CrossCutting/ServiceConfiguration/ServiceCollectionExtension.cs

@@ -28,6 +28,10 @@ public static class ServiceCollectionExtension
         // (Kavenegar/Ghasedak/SMS.ir) replaces this registration only.
         services.AddSingleton<ISmsSender, LoggingSmsSender>();
 
+        // استعلام شبا IBAN-owner ↔ national-id inquiry (backend-phase-3). The mock returns a deterministic
+        // fake match; a real Finnotech/banking-bridge client replaces this registration only.
+        services.AddSingleton<IBankAccountOwnershipVerifier, MockBankAccountOwnershipVerifier>();
+
         return services;
     }
 }