Plan: SNAP IEVS Verification

CREATE TABLE ievs_match_results (
    id UUID PRIMARY KEY,
    application_id UUID NOT NULL,
    household_id UUID NOT NULL,
    person_id UUID NOT NULL,
    match_source TEXT NOT NULL,
    -- 'georgia_dol_swr', 'georgia_dol_ui', 'ssa_sdx', 'ssa_bendex'
    match_requested_at TIMESTAMPTZ NOT NULL DEFAULT now(),
    match_completed_at TIMESTAMPTZ,
    request_correlation_id TEXT,  -- adapter-provided request ID for audit
    -- Response data (never leave this database)
    verified_monthly_income NUMERIC(10,2),
    verified_income_type TEXT,   -- IncomeType enum value
    verified_frequency TEXT,     -- 'weekly', 'biweekly', 'monthly', 'quarterly', 'annual'
    match_status TEXT NOT NULL DEFAULT 'pending',
    -- 'pending', 'matched', 'no_match', 'error', 'timeout'
    error_detail TEXT,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
    -- NOTE: raw_response is intentionally not stored in this table.
    -- The response summary fields above are sufficient for compliance and auditing.
    -- If raw response storage is required by IRS, add encrypted_raw_response BYTEA field.
);

CREATE INDEX ievs_results_application ON ievs_match_results (application_id);
CREATE INDEX ievs_results_person ON ievs_match_results (person_id);

CREATE TABLE ievs_discrepancies (
    id UUID PRIMARY KEY,
    application_id UUID NOT NULL,
    person_id UUID NOT NULL,
    match_result_id UUID NOT NULL REFERENCES ievs_match_results(id),
    income_type TEXT NOT NULL,
    self_reported_monthly_income NUMERIC(10,2),
    verified_monthly_income NUMERIC(10,2),
    variance_monthly NUMERIC(10,2) GENERATED ALWAYS AS
        (verified_monthly_income - COALESCE(self_reported_monthly_income, 0)) STORED,
    resolution_status TEXT NOT NULL DEFAULT 'pending',
    -- 'pending', 'confirmed_additional_income', 'corrected_ievs_error',
    -- 'resolved_household_explanation', 'aged_out'
    resolution_notes TEXT,
    resolved_by UUID,  -- worker person_id
    resolved_at TIMESTAMPTZ,
    created_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

// SPDX-License-Identifier: AGPL-3.0-or-later

use chrono::NaiveDate;
use rust_decimal::Decimal;
use uuid::Uuid;
use anyhow::Result;

pub struct IevsMatchRequest {
    pub ssn: String,  // never logged, never published to event bus
    pub first_name: String,
    pub last_name: String,
    pub date_of_birth: NaiveDate,
    pub quarters: u8,  // how many prior quarters to query for SWR
}

pub struct WageRecord {
    pub employer_name: Option<String>,
    pub quarter: NaiveDate,
    pub wages: Decimal,
}

pub struct UiRecord {
    pub claim_status: UiClaimStatus,
    pub weekly_benefit_amount: Option<Decimal>,
    pub benefit_year_start: Option<NaiveDate>,
}

pub enum UiClaimStatus {
    ActiveClaim,
    NoClaim,
    ClaimExpired,
}

pub struct SsaSdxRecord {
    pub ssi_eligible: bool,
    pub monthly_ssi_amount: Option<Decimal>,
}

pub struct SsaBendexRecord {
    pub receives_social_security: bool,
    pub monthly_benefit_amount: Option<Decimal>,
    pub benefit_type: Option<String>,  // OASDI, disability, survivor
}

pub trait IevsAdapter: Send + Sync {
    /// Query state wage records (Georgia DOL quarterly wage data)
    async fn query_state_wage_records(
        &self,
        req: &IevsMatchRequest,
    ) -> Result<Vec<WageRecord>>;

    /// Query unemployment insurance claim status (Georgia DOL)
    async fn query_unemployment_insurance(
        &self,
        req: &IevsMatchRequest,
    ) -> Result<Option<UiRecord>>;

    /// Query SSI payment data (SSA State Data Exchange)
    async fn query_ssa_sdx(
        &self,
        req: &IevsMatchRequest,
    ) -> Result<Option<SsaSdxRecord>>;

    /// Query Social Security benefit data (SSA Benefit Exchange)
    async fn query_ssa_bendex(
        &self,
        req: &IevsMatchRequest,
    ) -> Result<Option<SsaBendexRecord>>;
}

CREATE INDEX ievs_results_application ON ievs_match_results (application_id);
CREATE INDEX ievs_results_person ON ievs_match_results (person_id);
CREATE INDEX ievs_discrepancies_application ON ievs_discrepancies (application_id);
CREATE INDEX ievs_discrepancies_person ON ievs_discrepancies (person_id);
CREATE INDEX ievs_discrepancies_status ON ievs_discrepancies (resolution_status)
    WHERE resolution_status = 'pending';

// SPDX-License-Identifier: AGPL-3.0-or-later

use crate::ievs::*;
use anyhow::Result;
use rust_decimal::Decimal;

pub struct NoopIevsAdapter;

impl IevsAdapter for NoopIevsAdapter {
    async fn query_state_wage_records(&self, req: &IevsMatchRequest) -> Result<Vec<WageRecord>> {
        let suffix = ssn_suffix(req);
        match suffix {
            0..=9 => Ok(vec![]),
            10..=29 => Ok(vec![wage_record(Decimal::new(1200_00, 2))]),
            30..=49 => Ok(vec![wage_record(Decimal::new(1800_00, 2))]),
            90..=99 => Ok(vec![wage_record(Decimal::new(1500_00, 2))]),
            _ => Ok(vec![]),
        }
    }
    // ... remaining methods follow the same SSN-suffix-based pattern from Design
}

fn ssn_suffix(req: &IevsMatchRequest) -> u8 {
    req.ssn[req.ssn.len()-2..].parse::<u8>().unwrap_or(0)
}

// SPDX-License-Identifier: AGPL-3.0-or-later

use axum::{Router, routing::post, extract::State, Json};
use canopy_verification::ievs::{IevsAdapter, IevsMatchRequest};

#[derive(Debug, Deserialize)]
pub struct IevsMatchHttpRequest {
    pub application_id: Uuid,
    pub person_id: Uuid,
    pub match_request: IevsMatchRequest,
    pub sources: Vec<String>,  // ["georgia_dol_swr", "georgia_dol_ui", "ssa_sdx", "ssa_bendex"]
}

#[derive(Debug, Serialize)]
pub struct IevsMatchHttpResponse {
    pub application_id: Uuid,
    pub person_id: Uuid,
    pub wage_records: Vec<WageRecord>,
    pub ui_record: Option<UiRecord>,
    pub sdx_record: Option<SsaSdxRecord>,
    pub bendex_record: Option<SsaBendexRecord>,
    pub match_status: String,
}

pub fn internal_routes<A: IevsAdapter + 'static>(adapter: A) -> Router {
    Router::new()
        .route("/internal/v1/ievs/match", post(handle_ievs_match::<A>))
        .with_state(Arc::new(adapter))
}

// SPDX-License-Identifier: AGPL-3.0-or-later

use axum::{Router, routing::{get, put}, extract::{Path, Query, State}, Json};
use canopy_api::AppState;
use uuid::Uuid;

pub fn routes() -> Router<AppState> {
    Router::new()
        .route("/v1/verification/discrepancies", get(list_discrepancies))
        .route("/v1/verification/discrepancies/:id/resolve", put(resolve_discrepancy))
        .route("/v1/verification/ievs-matches", get(list_ievs_matches))
}

#[derive(Debug, Deserialize)]
pub struct DiscrepancyQuery {
    pub application_id: Uuid,
}

#[derive(Debug, Deserialize)]
pub struct ResolveDiscrepancyRequest {
    pub resolution_status: String,  // "confirmed_additional_income", "corrected_ievs_error", "resolved_household_explanation"
    pub resolution_notes: String,
}

// SPDX-License-Identifier: AGPL-3.0-or-later

use canopy_verification::ievs::*;
use canopy_verification::noop::NoopIevsAdapter;

#[tokio::test]
async fn test_noop_ssn_suffix_10_wages_only() {
    // SSN ending "10" -> wages $1,200/month, no UI, no SSI, no BENDEX
}

#[tokio::test]
async fn test_noop_ssn_suffix_30_high_wages() {
    // SSN ending "30" -> wages $1,800/month (creates discrepancy for $1,200 self-reported)
}

#[tokio::test]
async fn test_noop_ssn_suffix_00_no_match() {
    // SSN ending "00" -> no income records returned
}

// SPDX-License-Identifier: AGPL-3.0-or-later

use canopy_test_lib::setup_test_db;

#[tokio::test]
async fn test_clean_match_no_discrepancy() {
    // Setup: application with self-reported income $1,200/month
    // SSN suffix "10" -> NoopAdapter returns $1,200/month wages
    // Assert: no discrepancy created, determination status != PendingVerification
}

#[tokio::test]
async fn test_discrepancy_detected_pending_verification() {
    // Setup: application with self-reported income $1,200/month
    // SSN suffix "30" -> NoopAdapter returns $1,800/month wages
    // Assert: ievs_discrepancy record created with variance = $600
    // Assert: determination status = PendingVerification
    // Assert: verification_items_required includes GrossIncome
}

#[tokio::test]
async fn test_worker_resolves_discrepancy() {
    // Setup: existing discrepancy, status = pending
    // PUT /v1/verification/discrepancies/{id}/resolve with confirmed_additional_income
    // Assert: discrepancy resolved_by set, resolution_status updated
    // Assert: determination re-evaluated with corrected income
}

#[tokio::test]
async fn test_expedited_approved_despite_discrepancy() {
    // Setup: expedited household, SSN suffix "30" -> discrepancy
    // Assert: determination status = Approved (not PendingVerification)
    // Assert: verification_items_required still populated for 45-day follow-up
}

#[tokio::test]
async fn test_ievs_data_not_in_events() {
    // Verify that published events contain only IDs (application_id, person_id)
    // and never SSN, income amounts, or raw IEVS response data (ADR-004)
}