Plan: FFE/SBM Account Transfer (canopy-exchange)

-- SPDX-License-Identifier: AGPL-3.0-or-later

-- Account transfer tracking table
-- Records all inbound and outbound transfers with the health insurance exchange
-- Per ADR-001: canopy-exchange owns this table; no other service queries it directly
CREATE TABLE account_transfers (
    id UUID PRIMARY KEY,
    direction TEXT NOT NULL CHECK (direction IN ('inbound', 'outbound')),
    transfer_status TEXT NOT NULL CHECK (transfer_status IN (
        'pending', 'sent', 'received', 'accepted', 'rejected', 'error', 'timed_out'
    )),
    source_system TEXT NOT NULL,       -- e.g., 'georgia_access', 'canopy'
    target_system TEXT NOT NULL,       -- e.g., 'canopy', 'georgia_access'
    application_id UUID NOT NULL,      -- FK concept to canopy-applications (not enforced cross-service per ADR-001)
    transfer_payload_hash TEXT NOT NULL,  -- SHA-256 of the ACPT XML payload for integrity verification
    sent_at TIMESTAMPTZ,
    received_at TIMESTAMPTZ,
    response_due_date TIMESTAMPTZ,     -- received_at + 30 days for inbound transfers (42 CFR 435.1200(d))
    response_sent_at TIMESTAMPTZ,
    error_detail TEXT,                 -- NULL unless transfer_status = 'error'
    created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
);

CREATE INDEX account_transfers_application_id ON account_transfers (application_id);
CREATE INDEX account_transfers_status ON account_transfers (transfer_status) WHERE transfer_status IN ('pending', 'received');
CREATE INDEX account_transfers_response_due ON account_transfers (response_due_date) WHERE response_due_date IS NOT NULL AND response_sent_at IS NULL;

// SPDX-License-Identifier: AGPL-3.0-or-later

use uuid::Uuid;

/// Adapter trait for health insurance exchange account transfers.
///
/// Implementations handle serialization to/from ACPT XML and
/// communication with the exchange endpoint (Georgia Access SBM-FP
/// or HealthCare.gov federal hub).
///
/// Per ADR-001, this adapter communicates with canopy-persons and
/// canopy-applications via internal HTTP APIs, never direct DB access.
///
/// Per ADR-004, transfer payloads contain MAGI-based income data only —
/// no FTI, IEVS, or HIPAA-scoped clinical data. Income figures in
/// account transfers are applicant-attested or MAGI-calculated, not
/// sourced from restricted federal data matches.
pub trait FfeAccountTransferAdapter: Send + Sync {
    /// Send an outbound account transfer to the exchange.
    ///
    /// Called when canopy-medicaid determines an applicant ineligible
    /// and the applicant may qualify for QHP/APTC at the exchange.
    async fn send_transfer(
        &self,
        application_id: Uuid,
        determination_id: Uuid,
    ) -> Result<Uuid, TransferError>;

    /// Receive and process an inbound account transfer from the exchange.
    ///
    /// Called when the exchange determines an applicant may be
    /// Medicaid/CHIP-eligible and transfers the account.
    /// Returns the newly created application ID in canopy-applications.
    async fn receive_transfer(
        &self,
        payload: &[u8],
    ) -> Result<InboundTransferResult, TransferError>;

    /// Check for inbound transfers approaching the 30-day response deadline.
    ///
    /// Called by a scheduled task to identify transfers that need
    /// expedited processing to meet the 42 CFR 435.1200(d) timeline.
    async fn check_pending_deadlines(&self) -> Result<Vec<PendingDeadline>, TransferError>;
}

pub struct InboundTransferResult {
    pub transfer_id: Uuid,
    pub application_id: Uuid,
    pub person_ids: Vec<Uuid>,
}

pub struct PendingDeadline {
    pub transfer_id: Uuid,
    pub application_id: Uuid,
    pub response_due_date: time::OffsetDateTime,
    pub days_remaining: i32,
}