@

backend phase 3: identity profiles, patients & nurse bank accounts

Add the role-attached identity layer on top of the b2 auth spine: nurse
seller profiles (guarded is_verified, read-only aggregates), thin customer
payer profiles, first-class patients (tenancy-scoped), and nurse payout bank
accounts hardened with an iban_hash uniqueness guard and an automated استعلام
شبا IBAN-ownership inquiry.

- Four usr tables via one migration (1:1 uniques, UNIQUE(iban_hash), filtered
  UNIQUE(nurse_id) WHERE is_primary=1, guarded is_verified, encrypted PII,
  soft-delete on nurse_profiles)
- 15 CQRS slices + 4 role-scoped controllers; reads projected + paginated,
  IBAN masked (last-4); ownership-inquiry endpoints rate-limited
- New IBankAccountOwnershipVerifier seam (mock deterministic شبا match) +
  per-domain repositories on IUnitOfWork + encrypted-PII value converters
- Activate FluentValidation repo-wide (validators were never registered)
- Handler unit tests + WebApplicationFactory integration tests (76 pass);
  contract identity-profiles.md + swagger snapshot; docs, handoff & report

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@

server/src/Infrastructure/Baya.Infrastructure.Persistence/ApplicationDbContext.cs

@@ -1,6 +1,7 @@
 using System.Reflection;
 using Baya.Application.Contracts.Common;
 using Baya.Domain.Common;
+using Baya.Domain.Entities.Identity;
 using Baya.Domain.Entities.User;
 using Baya.Infrastructure.Persistence.ValueConversion;
 using Baya.SharedKernel.Extensions;
@@ -103,5 +104,22 @@ public class ApplicationDbContext: IdentityDbContext<User, Role, int, UserClaim,
             builder.Property(u => u.NormalizedEmail).HasConversion(encrypted);
             builder.Property(u => u.NationalId).HasConversion(encrypted);
         });
+
+        // b3 PII: emergency contacts, clinical notes, IBAN and the account-holder name are encrypted at
+        // rest through the same seam. The IBAN's deterministic lookup uses the iban_hash column instead.
+        modelBuilder.Entity<CustomerProfile>(builder =>
+        {
+            builder.Property(c => c.DefaultEmergencyContactName).HasConversion(encrypted);
+            builder.Property(c => c.DefaultEmergencyContactPhone).HasConversion(encrypted);
+        });
+        modelBuilder.Entity<Patient>(builder =>
+        {
+            builder.Property(p => p.InitialMedicalNotes).HasConversion(encrypted);
+        });
+        modelBuilder.Entity<NurseBankAccount>(builder =>
+        {
+            builder.Property(a => a.AccountHolderName).HasConversion(encrypted);
+            builder.Property(a => a.Iban).HasConversion(encrypted);
+        });
     }
 }