Plan: CAPS Eligibility (canopy-caps)

threshold = smi_for_family_size * pct / 100

For Georgia HH=3, initial:
  threshold = $60,218 / 12 * 50 / 100 = $5,018.17 * 0.50 = $2,509.08/month

For Georgia HH=3, continued:
  threshold = $60,218 / 12 * 85 / 100 = $5,018.17 * 0.85 = $4,265.44/month

-- SPDX-License-Identifier: AGPL-3.0-or-later
-- Per ADR-001: canopy-caps owns this schema; no other service queries it directly

CREATE TABLE caps_applications (
    id UUID PRIMARY KEY,
    application_id UUID NOT NULL,          -- FK to canopy-applications (logical, not enforced)
    household_id UUID NOT NULL,
    child_person_id UUID NOT NULL,
    child_age_years INTEGER NOT NULL,
    child_has_special_needs BOOLEAN NOT NULL DEFAULT FALSE,
    household_size INTEGER NOT NULL,
    provider_id TEXT,
    eligibility_type TEXT NOT NULL DEFAULT 'initial' CHECK (eligibility_type IN ('initial', 'continued')),
    jurisdiction TEXT NOT NULL,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE TABLE caps_determinations (
    id UUID PRIMARY KEY,
    application_id UUID NOT NULL,
    household_id UUID NOT NULL,
    child_person_id UUID NOT NULL,
    determination_status TEXT NOT NULL,
    income_eligible BOOLEAN NOT NULL,
    activity_eligible BOOLEAN NOT NULL,
    age_eligible BOOLEAN NOT NULL,
    copayment_weekly_cents INTEGER,
    authorized_weekly_hours INTEGER,
    effective_date DATE NOT NULL,
    end_date DATE,
    denial_reasons TEXT[],
    ruleset_version TEXT NOT NULL,
    jws_token TEXT,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE TABLE caps_authorizations (
    id UUID PRIMARY KEY,
    determination_id UUID NOT NULL REFERENCES caps_determinations(id),
    child_person_id UUID NOT NULL,
    provider_id TEXT NOT NULL,
    authorization_status TEXT NOT NULL CHECK (authorization_status IN (
        'active', 'suspended', 'terminated', 'expired'
    )),
    weekly_hours INTEGER NOT NULL,
    rate_cents_per_hour INTEGER NOT NULL,
    copayment_weekly_cents INTEGER NOT NULL,
    effective_date DATE NOT NULL,
    end_date DATE,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

# In jurisdiction.toml under [caps]
copayment_tiers = [
    [0, 25, 0],         # 0-25% SMI: $0/week
    [26, 50, 2700],     # 26-50% SMI: $27/week
    [51, 65, 4500],     # 51-65% SMI: $45/week
    [66, 75, 6500],     # 66-75% SMI: $65/week
    [76, 85, 8500],     # 76-85% SMI: $85/week
]

-- SPDX-License-Identifier: AGPL-3.0-or-later
-- Per ADR-001: canopy-caps owns this schema; no other service queries it directly

-- Tables (see Design > Database Schema for full CREATE TABLE statements)

CREATE INDEX idx_caps_applications_app ON caps_applications(application_id);
CREATE INDEX idx_caps_applications_household ON caps_applications(household_id);
CREATE INDEX idx_caps_applications_child ON caps_applications(child_person_id);

CREATE INDEX idx_caps_determinations_application ON caps_determinations(application_id);
CREATE INDEX idx_caps_determinations_household ON caps_determinations(household_id);
CREATE INDEX idx_caps_determinations_child ON caps_determinations(child_person_id);
CREATE INDEX idx_caps_determinations_status ON caps_determinations(determination_status);
CREATE INDEX idx_caps_determinations_effective ON caps_determinations(effective_date);

CREATE INDEX idx_caps_authorizations_determination ON caps_authorizations(determination_id);
CREATE INDEX idx_caps_authorizations_child ON caps_authorizations(child_person_id);
CREATE INDEX idx_caps_authorizations_provider ON caps_authorizations(provider_id);
CREATE INDEX idx_caps_authorizations_status ON caps_authorizations(authorization_status);

// services/canopy-caps/src/eligibility.rs (income evaluation portion)
// SPDX-License-Identifier: AGPL-3.0-or-later

use rust_decimal::Decimal;
use serde::{Deserialize, Serialize};
use uuid::Uuid;

use crate::errors::ApiError;
use crate::rules_client::CapsRulesClient;

/// Application context received from canopy-eligibility.
#[derive(Debug, Clone, Deserialize)]
pub struct CapsApplicationContext {
    pub application_id: Uuid,
    pub household_id: Uuid,
    pub child_person_id: Uuid,
    pub child_age_years: u32,
    pub child_has_special_needs: bool,
    pub household_size: u32,
    pub income: Vec<IncomeRecord>,
    pub activity: ActivityContext,
    pub provider_id: String,
    pub jurisdiction: String,
    pub eligibility_type: String, // "initial" or "continued"
}

#[derive(Debug, Clone, Deserialize)]
pub struct IncomeRecord {
    pub source: String,
    pub amount: Decimal,
    pub frequency: String, // monthly, biweekly, weekly, annual
}

impl IncomeRecord {
    pub fn monthly_amount(&self) -> Decimal {
        match self.frequency.as_str() {
            "monthly" => self.amount,
            "biweekly" => self.amount * Decimal::from(26) / Decimal::from(12),
            "weekly" => self.amount * Decimal::from(52) / Decimal::from(12),
            "annual" => self.amount / Decimal::from(12),
            _ => self.amount,
        }
    }
}

/// Income eligibility result returned by canopy-rules.
#[derive(Debug, Clone, Deserialize)]
pub struct IncomeEligibilityResult {
    pub eligible: bool,
    pub smi_threshold_monthly_cents: i64,
    pub household_income_monthly_cents: i64,
    pub eligibility_type: String,
    pub basis: String,
}

{
  "rule_set_name": "georgia-caps-eligibility",
  "context_type": "application",
  "context_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "input": {
    "gross_monthly_income": 2400.00,
    "household_size": 4,
    "eligibility_type": "initial"
  }
}

{
  "rule_set_name": "georgia-caps-eligibility",
  "output": {
    "eligible": true,
    "smi_threshold_monthly_cents": 298375,
    "household_income_monthly_cents": 240000,
    "eligibility_type": "initial",
    "basis": "Household income $2,400/mo is below 50% SMI threshold of $2,983.75/mo for household size 4."
  },
  "evaluated_at": "2026-04-01T14:00:00Z"
}

// services/canopy-caps/src/activity.rs
// SPDX-License-Identifier: AGPL-3.0-or-later

use serde::{Deserialize, Serialize};

/// Activity context from the application intake.
/// The activity_verified flag is set by the caseworker -- not rules-computed.
#[derive(Debug, Clone, Deserialize)]
pub struct ActivityContext {
    pub activities: Vec<Activity>,
}

#[derive(Debug, Clone, Deserialize, Serialize, PartialEq)]
#[serde(rename_all = "snake_case")]
pub enum ActivityType {
    Employment,
    Education,
    JobTraining,
    CommunityService,
    JobSearch,
}

#[derive(Debug, Clone, Deserialize)]
pub struct Activity {
    pub activity_type: ActivityType,
    pub weekly_hours: u32,
    pub verified: bool,
    pub verification_source: Option<String>,
}

/// Result of activity requirement evaluation.
#[derive(Debug, Clone, Serialize)]
pub struct ActivityEligibilityResult {
    pub eligible: bool,
    pub total_weekly_hours: u32,
    pub required_weekly_hours: u32,
    pub basis: String,
}

/// Evaluate whether the parent/caretaker meets the CAPS activity requirement.
/// Employment, education, and job training hours are summed and compared
/// against the minimum threshold from jurisdiction.toml (default: 24 hrs/week).
///
/// This is a pure function -- no I/O, no rules engine call.
pub fn evaluate_activity_eligibility(
    activity_ctx: &ActivityContext,
    min_weekly_hours: u32,
) -> ActivityEligibilityResult {
    let total: u32 = activity_ctx.activities.iter()
        .map(|a| a.weekly_hours)
        .sum();

    let eligible = total >= min_weekly_hours;
    let basis = if eligible {
        format!("Activity requirement met: {total} hours/week meets minimum {min_weekly_hours} hours/week.")
    } else {
        format!("Activity requirement not met: {total} hours/week below minimum {min_weekly_hours} hours/week.")
    };

    ActivityEligibilityResult {
        eligible,
        total_weekly_hours: total,
        required_weekly_hours: min_weekly_hours,
        basis,
    }
}

// services/canopy-caps/src/copayment.rs
// SPDX-License-Identifier: AGPL-3.0-or-later

use rust_decimal::Decimal;

use crate::params::CapsParameterTable;

/// Copayment determination result.
#[derive(Debug, Clone)]
pub struct CopaymentResult {
    pub weekly_copayment_cents: i32,
    pub income_pct_smi: u32,
    pub basis: String,
}

/// Determine the family copayment from the jurisdiction.toml tier table.
///
/// 1. Compute income as a percentage of SMI for the household size
/// 2. Find the tier row where min_pct <= income_pct <= max_pct
/// 3. Return the weekly_copay_cents from that row
///
/// If no tier matches (income above all tiers), return the highest tier's copayment.
/// Zero copayment is a valid result for the lowest income tier.
pub fn determine_copayment(
    params: &CapsParameterTable,
    household_size: u32,
    gross_monthly_income: Decimal,
) -> CopaymentResult {
    let monthly_smi = params.monthly_smi(household_size);
    let income_pct = if monthly_smi > Decimal::ZERO {
        (gross_monthly_income * Decimal::from(100) / monthly_smi)
            .round()
            .to_string()
            .parse::<u32>()
            .unwrap_or(0)
    } else {
        0
    };

    let mut copay = 0i32;
    let mut matched_tier = false;
    for &(min_pct, max_pct, weekly_cents) in &params.copayment_tiers {
        if income_pct >= min_pct && income_pct <= max_pct {
            copay = weekly_cents;
            matched_tier = true;
            break;
        }
        copay = weekly_cents; // track last tier as fallback
    }

    let basis = if matched_tier {
        format!("Income at {income_pct}% SMI falls in copayment tier. Weekly copayment: ${}.{:02}.",
            copay / 100, copay % 100)
    } else {
        format!("Income at {income_pct}% SMI above all tiers. Maximum copayment: ${}.{:02}.",
            copay / 100, copay % 100)
    };

    CopaymentResult {
        weekly_copayment_cents: copay,
        income_pct_smi: income_pct,
        basis,
    }
}

/// Build and persist a CAPS authorization for an eligible determination.
/// Authorization period from CapsParameterTable.authorization_period_months.
pub async fn create_caps_authorization(
    db: &PgPool,
    rules: &CapsRulesClient,
    params: &CapsParameterTable,
    determination: &CapsDetermination,
    context: &CapsApplicationContext,
    copayment_weekly_cents: i32,
) -> Result<CapsAuthorization, ApiError> {
    // 1. Look up provider rate via canopy-rules
    let rate_output = rules.evaluate(
        &format!("{}-caps-provider-rates", context.jurisdiction),
        "authorization",
        determination.id,
        serde_json::json!({
            "provider_id": context.provider_id,
            "child_age_years": context.child_age_years,
            "care_type": if determination.authorized_weekly_hours.unwrap_or(0) >= 30 {
                "full_time"
            } else {
                "part_time"
            },
            "provider_type": "center",
        }),
    ).await?;

    let rate_cents = rate_output.get("rate_cents_per_hour")
        .and_then(|v| v.as_i64())
        .ok_or_else(|| ApiError::RulesEngine(
            "missing rate_cents_per_hour in provider rate response".to_string()
        ))? as i32;

    // 2. Build authorization
    let effective = determination.effective_date;
    let end = effective + chrono::Months::new(params.authorization_period_months);

    let auth = CapsAuthorization {
        id: Uuid::new_v4(),
        determination_id: determination.id,
        child_person_id: determination.child_person_id,
        provider_id: context.provider_id.clone(),
        authorization_status: "active".to_string(),
        weekly_hours: determination.authorized_weekly_hours.unwrap_or(0),
        rate_cents_per_hour: rate_cents,
        copayment_weekly_cents,
        effective_date: effective,
        end_date: Some(end),
        created_at: Utc::now(),
        updated_at: Utc::now(),
    };

    // 3. Persist
    crate::store::authorizations::create_authorization(db, &auth)
        .await
        .map_err(|e| ApiError::Internal(format!("failed to persist authorization: {e}")))
}

/// Trait for signing CAPS determinations per ADR-002.
pub trait DeterminationSigner: Send + Sync {
    fn sign(&self, payload: &[u8]) -> Result<String, anyhow::Error>;
}

/// Orchestrate the full CAPS determination:
/// 1. Evaluate income eligibility (Step 4): rules engine call
/// 2. Evaluate activity requirements (Step 5): local pure function
/// 3. Check age gate: child_age < 13 (or < 19 with special needs)
/// 4. If all pass: determine copayment (Step 6)
/// 5. Build CapsDetermination struct with denial_reasons if denied
/// 6. Sign the determination (JWS per ADR-002)
/// 7. Persist to caps_determinations (append-only, never UPDATE)
/// 8. Return persisted signed determination
pub async fn evaluate_and_determine(
    db: &PgPool,
    rules: &CapsRulesClient,
    signer: &dyn DeterminationSigner,
    params: &CapsParameterTable,
    context: CapsApplicationContext,
) -> Result<CapsDetermination, ApiError> {
    // 1. Income eligibility
    let income_result = evaluate_income_eligibility(
        rules, &context, &context.eligibility_type,
    ).await?;

    // 2. Activity eligibility
    let activity_result = evaluate_activity_eligibility(
        &context.activity, params.min_work_hours_per_week,
    );

    // 3. Age gate
    let age_limit = if context.child_has_special_needs { 19 } else { 13 };
    let age_eligible = context.child_age_years < age_limit;

    // Collect denial reasons
    let mut denial_reasons = Vec::new();
    if !income_result.eligible {
        denial_reasons.push(income_result.basis.clone());
    }
    if !activity_result.eligible {
        denial_reasons.push(activity_result.basis.clone());
    }
    if !age_eligible {
        denial_reasons.push(format!(
            "Child age {} exceeds limit of {} years.",
            context.child_age_years, age_limit
        ));
    }

    let all_eligible = income_result.eligible && activity_result.eligible && age_eligible;
    let status = if all_eligible { "approved" } else { "denied" };

    // 4. Copayment (only if eligible)
    let gross_monthly: Decimal = context.income.iter()
        .map(|i| i.monthly_amount())
        .sum();
    let copayment = if all_eligible {
        Some(determine_copayment(params, context.household_size, gross_monthly))
    } else {
        None
    };

    // 5. Build determination
    let now = Utc::now();
    let effective = now.date_naive();
    let end = if all_eligible {
        Some(effective + chrono::Months::new(params.authorization_period_months))
    } else {
        None
    };

    let mut determination = CapsDetermination {
        id: Uuid::new_v4(),
        application_id: context.application_id,
        household_id: context.household_id,
        child_person_id: context.child_person_id,
        determination_status: status.to_string(),
        income_eligible: income_result.eligible,
        activity_eligible: activity_result.eligible,
        age_eligible,
        copayment_weekly_cents: copayment.as_ref().map(|c| c.weekly_copayment_cents),
        authorized_weekly_hours: if all_eligible {
            Some(activity_result.total_weekly_hours as i32)
        } else { None },
        effective_date: effective,
        end_date: end,
        denial_reasons: if denial_reasons.is_empty() { None } else { Some(denial_reasons) },
        ruleset_version: format!("{}-caps-eligibility", context.jurisdiction),
        jws_token: None,
        created_at: now,
        updated_at: now,
    };

    // 6. Sign -- unsigned determinations must never exist in the database
    let canonical = serde_json::to_vec(&determination)
        .map_err(|e| ApiError::Internal(format!("serialization failed: {e}")))?;
    let jws = signer.sign(&canonical)
        .map_err(|e| ApiError::Internal(format!("signing failed: {e}")))?;
    determination.jws_token = Some(jws);

    // 7. Persist (append-only)
    let persisted = crate::store::determinations::create_determination(db, &determination)
        .await
        .map_err(|e| ApiError::Internal(format!("failed to persist determination: {e}")))?;

    Ok(persisted)
}

// services/canopy-caps/src/events.rs
// SPDX-License-Identifier: AGPL-3.0-or-later

use chrono::{DateTime, Utc};
use lapin::Channel;
use serde::Serialize;
use uuid::Uuid;

use crate::errors::ApiError;

const EXCHANGE: &str = "canopy.events";

#[derive(Debug, Serialize)]
pub struct DeterminationCompletedEvent {
    pub determination_id: Uuid,
    pub application_id: Uuid,
    pub determination_status: String,
    pub completed_at: DateTime<Utc>,
}

#[derive(Debug, Serialize)]
pub struct AuthorizationCreatedEvent {
    pub authorization_id: Uuid,
    pub determination_id: Uuid,
    pub child_person_id: Uuid,
    pub created_at: DateTime<Utc>,
}

pub async fn publish_determination_completed(
    channel: &Channel,
    event: &DeterminationCompletedEvent,
) -> Result<(), ApiError> {
    let payload = serde_json::to_vec(event)
        .map_err(|e| ApiError::Internal(format!("event serialization failed: {e}")))?;
    channel
        .basic_publish(
            EXCHANGE,
            "caps.determined",
            lapin::options::BasicPublishOptions::default(),
            &payload,
            lapin::BasicProperties::default()
                .with_content_type("application/json".into())
                .with_delivery_mode(2), // persistent
        )
        .await
        .map_err(|e| ApiError::Internal(format!("failed to publish determination event: {e}")))?
        .await
        .map_err(|e| ApiError::Internal(format!("publisher confirm failed: {e}")))?;
    Ok(())
}

pub async fn publish_authorization_created(
    channel: &Channel,
    event: &AuthorizationCreatedEvent,
) -> Result<(), ApiError> {
    let payload = serde_json::to_vec(event)
        .map_err(|e| ApiError::Internal(format!("event serialization failed: {e}")))?;
    channel
        .basic_publish(
            EXCHANGE,
            "caps.authorization_created",
            lapin::options::BasicPublishOptions::default(),
            &payload,
            lapin::BasicProperties::default()
                .with_content_type("application/json".into())
                .with_delivery_mode(2),
        )
        .await
        .map_err(|e| ApiError::Internal(format!("failed to publish authorization event: {e}")))?
        .await
        .map_err(|e| ApiError::Internal(format!("publisher confirm failed: {e}")))?;
    Ok(())
}

// services/canopy-caps/tests/caps_tests.rs
// SPDX-License-Identifier: AGPL-3.0-or-later

/// 1. Happy path: family income below 50% SMI, 30 hrs/week employment,
///    child age 4 -- approved with copayment and authorization.
#[tokio::test]
async fn caps_determination_approved_initial_eligibility() { /* ... */ }

/// 2. Denial: family income exceeds 50% SMI for initial eligibility.
#[tokio::test]
async fn caps_determination_denied_over_income() { /* ... */ }

/// 3. Denial: parent has only 16 hrs/week (below 24-hour minimum).
#[tokio::test]
async fn caps_determination_denied_insufficient_activity() { /* ... */ }

/// 4. Denial: child is 14 years old without special needs (age limit 13).
#[tokio::test]
async fn caps_determination_denied_child_over_age() { /* ... */ }

/// 5. Approved: child is 16 with special needs (age limit 19).
#[tokio::test]
async fn caps_determination_approved_special_needs_child() { /* ... */ }

/// 6. Continued eligibility: income between 50% and 85% SMI approved
///    for continued but would be denied for initial.
#[tokio::test]
async fn caps_continued_eligibility_higher_smi_threshold() { /* ... */ }

/// 7. Copayment is zero for families at the lowest income tier.
#[tokio::test]
async fn caps_zero_copayment_lowest_tier() { /* ... */ }

/// 8. Authorization created with 12-month period and correct rate.
#[tokio::test]
async fn caps_authorization_created_with_correct_period() { /* ... */ }

/// 9. JWS signature on determination can be verified.
#[tokio::test]
async fn caps_determination_signature_verifies() { /* ... */ }

/// 10. Events contain only IDs and timestamps -- no PHI (ADR-004).
#[tokio::test]
async fn caps_events_contain_no_phi() { /* ... */ }