DC-172/DC-226: Add enrollment checker backend with plugin integration (3/4) (#99)

* DC-172: Add documentation, ADRs, skills, and repo cleanup

- Add ADRs for locale section filtering and rich-text rendering
- Add TDD design docs, implementation plans, and Figma comparison docs
- Add Claude Code skills (figma-verify, multi-repo-git, review-prep, test)
- Remove tracked .idea/ files and update .gitignore with blanket .idea/ rule
- Update CLAUDE.md with locale generation and design system guidance

* DC-172: Extract shared design system into @sebt/design-system workspace package

- Create packages/design-system with shared UI components, layout, providers,
  i18n, design tokens, SASS theme, and content generation scripts
- Move components (Alert, Button, InputField, TextLink, Header, Footer,
  HelpSection, SkipNav, LanguageSelector) from Portal Web to design-system
- Move content CSVs, locale generation script, design token scripts, SASS,
  and state JSON configs to design-system
- Add RichText component wrapping markdown-to-jsx
- Refactor Portal Web imports from @/components to @sebt/design-system
- Configure pnpm workspace, transpilePackages, and webpack alias for shared React
- Add workspace package.json, tsconfig, vitest config, and test setup

* DC-172: Add enrollment checker backend with plugin integration

- Add EnrollmentCheckController with rate-limited POST endpoint
- Add CheckEnrollmentCommand/Handler use case with submission logging
- Add PluginLoader for deferred MEF assembly loading with IHostBuilder
- Add DefaultEnrollmentCheckService fallback when no state plugin loaded
- Add EnrollmentCheckSubmission domain model and EF Core entities/migration
- Add DesignTimePortalDbContextFactory for EF tooling support
- Extract rate-limit policy names to RateLimitPolicies constants
- Add plugin integration tests (DC, CO, Default) with PluginIntegrationWebApplicationFactory
- Add unit tests for controller, command handler, and submission logger

* fix: broken import, next version mismatch, RichText safety comment

* fix: generate fonts.ts to caller's cwd so Next.js @/ alias resolves in CI

* fix: remove duplicate react/next from design-system devDeps to prevent dual-instance hook errors

* fix: restore design-system devDeps and add Turbopack resolveAlias for React deduplication

* fix: use production build for E2E tests to avoid Turbopack dev React duplication

* fix: split design-system barrel to resolve dual React instance in E2E builds

* feat: add max children validation to enrollment check requests

* fix: use I18nProvider wrapper to initialize i18next before render

* fix: serialize integration tests and use env vars for plugin config

---------

Co-authored-by: James Blair <jblair@codeforamerica.org>
Co-authored-by: Anthony Bergen <anthonydbergen@gmail.com>
Co-authored-by: Michael Walsh <noxiousthing@gmail.com>

Author: 4 people

src/SEBT.Portal.Api/Composition/Defaults/DefaultEnrollmentCheckService.cs

@@ -0,0 +1,30 @@
+using SEBT.Portal.StatesPlugins.Interfaces;
+using SEBT.Portal.StatesPlugins.Interfaces.Models.EnrollmentCheck;
+
+namespace SEBT.Portal.Api.Composition.Defaults;
+
+/// <summary>
+/// Default implementation when no state-specific IEnrollmentCheckService plugin is loaded.
+/// Returns NonMatch for every child — a conservative fallback that avoids false positives.
+/// </summary>
+internal class DefaultEnrollmentCheckService : IEnrollmentCheckService
+{
+    public Task<EnrollmentCheckResult> CheckEnrollmentAsync(
+        EnrollmentCheckRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        return Task.FromResult(new EnrollmentCheckResult
+        {
+            Results = request.Children.Select(c => new ChildCheckResult
+            {
+                CheckId = c.CheckId,
+                FirstName = c.FirstName,
+                LastName = c.LastName,
+                DateOfBirth = c.DateOfBirth,
+                Status = EnrollmentStatus.NonMatch,
+                SchoolName = c.SchoolName
+            }).ToList(),
+            ResponseMessage = "No enrollment check service configured."
+        });
+    }
+}

src/SEBT.Portal.Api/Composition/ServiceCollectionPluginExtensions.cs

@@ -15,6 +15,7 @@ public static IServiceCollection AddPlugins(this IServiceCollection services, IC
         services.TryAddSingleton<IStateAuthenticationService, Defaults.DefaultStateAuthenticationService>();
         services.TryAddSingleton<IStateHealthCheckService, Defaults.DefaultStateHealthCheckService>();
         services.TryAddSingleton<ISummerEbtCaseService, Defaults.DefaultSummerEbtCaseService>();
+        services.TryAddSingleton<IEnrollmentCheckService, Defaults.DefaultEnrollmentCheckService>();
 
         var healthChecksBuilder = services.AddHealthChecks();
 
@@ -84,6 +85,11 @@ private static ContainerConfiguration CreateContainerConfiguration(string[] asse
             .Export<IStateHealthCheckService>()
             .Shared();
 
+        conventions
+            .ForTypesDerivedFrom<IEnrollmentCheckService>()
+            .Export<IEnrollmentCheckService>()
+            .Shared();
+
         return new ContainerConfiguration()
             .WithExport(configuration)
             .WithAssembliesInPath(assemblyPaths, conventions);

src/SEBT.Portal.Api/Controllers/Auth/OtpController.cs

@@ -26,7 +26,7 @@ public class OtpController(ILogger<OtpController> logger) : ControllerBase
     /// <response code="400">Invalid request.</response>
     /// <response code="429">Rate limit exceeded. Maximum 5 OTP requests per minute allowed.</response>
     [HttpPost("request")]
-    [EnableRateLimiting("otp-policy")]
+    [EnableRateLimiting(RateLimitPolicies.Otp)]
     [ProducesResponseType(StatusCodes.Status201Created)]
     [ProducesResponseType(StatusCodes.Status400BadRequest)]
     [ProducesResponseType(StatusCodes.Status429TooManyRequests)]

src/SEBT.Portal.Api/Controllers/EnrollmentCheck/EnrollmentCheckController.cs

@@ -0,0 +1,101 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
+using SEBT.Portal.Api.Models;
+using SEBT.Portal.Api.Models.EnrollmentCheck;
+using SEBT.Portal.Kernel;
+using SEBT.Portal.Kernel.AspNetCore;
+using SEBT.Portal.Kernel.Results;
+using SEBT.Portal.StatesPlugins.Interfaces.Models.EnrollmentCheck;
+using SEBT.Portal.UseCases.EnrollmentCheck;
+
+namespace SEBT.Portal.Api.Controllers.EnrollmentCheck;
+
+/// <summary>
+/// Controller for checking child enrollment in Summer EBT benefits.
+/// This is a public, unauthenticated endpoint with rate limiting.
+/// </summary>
+[ApiController]
+[Route("api/enrollment")]
+public class EnrollmentCheckController : ControllerBase
+{
+    /// <summary>
+    /// Checks enrollment status for one or more children.
+    /// This is a public, unauthenticated endpoint.
+    /// </summary>
+    [HttpPost("check")]
+    [AllowAnonymous]
+    [EnableRateLimiting(RateLimitPolicies.EnrollmentCheck)]
+    [ProducesResponseType(typeof(EnrollmentCheckApiResponse), StatusCodes.Status200OK)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status400BadRequest)]
+    [ProducesResponseType(StatusCodes.Status429TooManyRequests)]
+    [ProducesResponseType(typeof(ProblemDetails), StatusCodes.Status503ServiceUnavailable)]
+    public async Task<IActionResult> CheckEnrollment(
+        [FromServices] ICommandHandler<CheckEnrollmentCommand, EnrollmentCheckResult> handler,
+        [FromBody] EnrollmentCheckApiRequest request,
+        CancellationToken cancellationToken = default)
+    {
+        // Parse and validate date formats
+        var children = new List<CheckEnrollmentCommand.ChildInput>();
+        foreach (var child in request.Children)
+        {
+            if (!DateOnly.TryParse(child.DateOfBirth, out var dob))
+            {
+                return BadRequest(new ErrorResponse(
+                    $"Invalid date format for child '{child.FirstName} {child.LastName}': '{child.DateOfBirth}'"));
+            }
+
+            children.Add(new CheckEnrollmentCommand.ChildInput
+            {
+                FirstName = child.FirstName,
+                LastName = child.LastName,
+                DateOfBirth = dob,
+                SchoolName = child.SchoolName,
+                SchoolCode = child.SchoolCode,
+                AdditionalFields = child.AdditionalFields
+            });
+        }
+
+        var command = new CheckEnrollmentCommand
+        {
+            Children = children,
+            IpAddress = HttpContext.Connection.RemoteIpAddress?.ToString()
+        };
+
+        var result = await handler.Handle(command, cancellationToken);
+
+        return result.ToActionResult(
+            successMap: data => Ok(MapToApiResponse(data)),
+            failureMap: r => r switch
+            {
+                DependencyFailedResult<EnrollmentCheckResult> =>
+                    StatusCode(StatusCodes.Status503ServiceUnavailable,
+                        new ProblemDetails
+                        {
+                            Title = "Enrollment check service is temporarily unavailable.",
+                            Status = StatusCodes.Status503ServiceUnavailable
+                        }),
+                _ => result.ToActionResult()
+            });
+    }
+
+    private static EnrollmentCheckApiResponse MapToApiResponse(EnrollmentCheckResult result)
+    {
+        return new EnrollmentCheckApiResponse
+        {
+            Results = result.Results.Select(r => new ChildCheckApiResponse
+            {
+                CheckId = r.CheckId.ToString(),
+                FirstName = r.FirstName,
+                LastName = r.LastName,
+                DateOfBirth = r.DateOfBirth.ToString("yyyy-MM-dd"),
+                Status = r.Status.ToString(),
+                MatchConfidence = r.MatchConfidence,
+                EligibilityType = r.EligibilityType?.ToString(),
+                SchoolName = r.SchoolName,
+                StatusMessage = r.StatusMessage
+            }).ToList(),
+            Message = result.ResponseMessage
+        };
+    }
+}

src/SEBT.Portal.Api/Models/EnrollmentCheck/EnrollmentCheckApiRequest.cs

@@ -0,0 +1,56 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace SEBT.Portal.Api.Models.EnrollmentCheck;
+
+/// <summary>
+/// Request model for checking enrollment status of one or more children.
+/// </summary>
+public class EnrollmentCheckApiRequest
+{
+    /// <summary>
+    /// Maximum number of children that can be checked in a single request.
+    /// </summary>
+    public const int MaxChildren = 20;
+
+    /// <summary>
+    /// The children to check enrollment for.
+    /// </summary>
+    [MaxLength(MaxChildren)]
+    public IList<ChildCheckApiRequest> Children { get; set; } = new List<ChildCheckApiRequest>();
+}
+
+/// <summary>
+/// Individual child data for an enrollment check request.
+/// </summary>
+public class ChildCheckApiRequest
+{
+    /// <summary>
+    /// Child's first name.
+    /// </summary>
+    public string FirstName { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Child's last name.
+    /// </summary>
+    public string LastName { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Child's date of birth in yyyy-MM-dd format.
+    /// </summary>
+    public string DateOfBirth { get; set; } = string.Empty;
+
+    /// <summary>
+    /// Name of the child's school (optional).
+    /// </summary>
+    public string? SchoolName { get; set; }
+
+    /// <summary>
+    /// Code identifying the child's school (optional).
+    /// </summary>
+    public string? SchoolCode { get; set; }
+
+    /// <summary>
+    /// State-specific additional fields (optional).
+    /// </summary>
+    public IDictionary<string, string> AdditionalFields { get; set; } = new Dictionary<string, string>();
+}

src/SEBT.Portal.Api/Models/EnrollmentCheck/EnrollmentCheckApiResponse.cs

@@ -0,0 +1,68 @@
+namespace SEBT.Portal.Api.Models.EnrollmentCheck;
+
+/// <summary>
+/// Response model for enrollment check results.
+/// </summary>
+public class EnrollmentCheckApiResponse
+{
+    /// <summary>
+    /// Results for each child checked.
+    /// </summary>
+    public IList<ChildCheckApiResponse> Results { get; init; } = new List<ChildCheckApiResponse>();
+
+    /// <summary>
+    /// Optional message from the enrollment check service.
+    /// </summary>
+    public string? Message { get; init; }
+}
+
+/// <summary>
+/// Individual child enrollment check result.
+/// </summary>
+public class ChildCheckApiResponse
+{
+    /// <summary>
+    /// Unique identifier for this check result.
+    /// </summary>
+    public string CheckId { get; init; } = string.Empty;
+
+    /// <summary>
+    /// Child's first name.
+    /// </summary>
+    public string FirstName { get; init; } = string.Empty;
+
+    /// <summary>
+    /// Child's last name.
+    /// </summary>
+    public string LastName { get; init; } = string.Empty;
+
+    /// <summary>
+    /// Child's date of birth in yyyy-MM-dd format.
+    /// </summary>
+    public string DateOfBirth { get; init; } = string.Empty;
+
+    /// <summary>
+    /// Enrollment status (Match, PossibleMatch, NonMatch, Error).
+    /// </summary>
+    public string Status { get; init; } = string.Empty;
+
+    /// <summary>
+    /// Confidence score for the match, if applicable.
+    /// </summary>
+    public double? MatchConfidence { get; init; }
+
+    /// <summary>
+    /// Type of eligibility (Snap, Tanf, Frp, DirectCert), if matched.
+    /// </summary>
+    public string? EligibilityType { get; init; }
+
+    /// <summary>
+    /// Name of the school associated with the enrollment record.
+    /// </summary>
+    public string? SchoolName { get; init; }
+
+    /// <summary>
+    /// Human-readable status message with additional details.
+    /// </summary>
+    public string? StatusMessage { get; init; }
+}