feat: add BCBS MA eligibility check with OTP flow

- New Selenium worker (fresh Chrome per run, no persistent session)
  login → OTP modal → eTools → ConnectCenter → Verification →
  New Eligibility Request → fill form (NPI, member ID, DOB) →
  Expand All → CDP PDF back to app
- Backend route fetches BCBS_MA credentials + provider NPI from settings
- Frontend OTP modal with 6-digit code entry
- BCBS MA added to insurance credentials dropdown in settings

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/Backend/src/routes/index.ts

@@ -40,6 +40,7 @@ import commissionsRoutes from "./commissions";
 import shoppingVendorsRoutes from "./shopping-vendors";
 import feeScheduleRoutes from "./feeSchedule";
 import licenseRoutes from "./license";
+import insuranceStatusBcbsMaRoutes from "./insuranceStatusBcbsMa";
 
 const router = Router();
 
@@ -60,6 +61,7 @@ router.use("/insurance-status-deltains", insuranceStatusDeltaInsRoutes);
 router.use("/insurance-status-unitedsco", insuranceStatusUnitedSCORoutes);
 router.use("/insurance-status-tuftssco", insuranceStatusTuftsSCORoutes);
 router.use("/insurance-status-cca", insuranceStatusCCARoutes);
+router.use("/insurance-status-bcbs-ma", insuranceStatusBcbsMaRoutes);
 router.use("/claims", insuranceStatusCCAClaimRoutes);
 router.use("/claims", insuranceStatusCCAPreAuthRoutes);
 router.use("/claims", insuranceStatusDDMAClaimRoutes);

apps/Backend/src/routes/insuranceStatusBcbsMa.ts

@@ -0,0 +1,108 @@
+import { Router, Request, Response } from "express";
+import { storage } from "../storage";
+import { forwardOtpToSeleniumBcbsMaAgent } from "../services/seleniumBcbsMaInsuranceEligibilityClient";
+import { io } from "../socket";
+import { enqueueSeleniumJob } from "../queue/jobRunner";
+
+const router = Router();
+
+function log(tag: string, msg: string, ctx?: any) {
+  console.log(`${new Date().toISOString()} [${tag}] ${msg}`, ctx ?? "");
+}
+
+function emitSafe(socketId: string | undefined, event: string, payload: any) {
+  if (!socketId || !io) return;
+  try {
+    const socket = io.sockets.sockets.get(socketId);
+    if (socket) socket.emit(event, payload);
+  } catch (err: any) {
+    log("bcbs-ma-route", "emit failed", { socketId, event, err: err?.message });
+  }
+}
+
+/**
+ * POST /bcbs-ma-eligibility
+ * Enqueues a BCBS MA eligibility check.
+ * Body: { data: { memberId, dateOfBirth, firstName, lastName, insuranceSiteKey }, socketId }
+ */
+router.post("/bcbs-ma-eligibility", async (req: Request, res: Response): Promise<any> => {
+  if (!req.body.data) {
+    return res.status(400).json({ error: "Missing data for BCBS MA eligibility check" });
+  }
+  if (!req.user?.id) {
+    return res.status(401).json({ error: "Unauthorized: user info missing" });
+  }
+
+  try {
+    const rawData =
+      typeof req.body.data === "string" ? JSON.parse(req.body.data) : req.body.data;
+
+    const credentials = await storage.getInsuranceCredentialByUserAndSiteKey(req.user.id, "BCBS_MA");
+    if (!credentials) {
+      return res.status(404).json({
+        error: "No BCBS MA credentials found. Please add them in Settings → Insurance Credentials.",
+      });
+    }
+
+    // Fetch provider NPI — use the first one on file for this user
+    const npiProviders = await storage.getNpiProvidersByUser(req.user.id);
+    const npiNumber = npiProviders?.[0]?.npiNumber ?? "";
+    if (!npiNumber) {
+      return res.status(404).json({
+        error: "No NPI provider found. Please add one in Settings → NPI Providers.",
+      });
+    }
+
+    const enrichedData = {
+      ...rawData,
+      bcbsMaUsername: credentials.username,
+      bcbsMaPassword: credentials.password,
+      providerNpi: npiNumber,
+    };
+
+    const socketId: string | undefined = req.body.socketId;
+
+    const jobId = enqueueSeleniumJob({
+      jobType: "bcbs-ma-eligibility-check",
+      userId: req.user.id,
+      socketId,
+      enrichedPayload: enrichedData,
+      insuranceId: String(rawData.memberId ?? "").trim(),
+      formFirstName: rawData.firstName,
+      formLastName: rawData.lastName,
+      formDob: rawData.dateOfBirth,
+    });
+
+    log("bcbs-ma-route", "job enqueued", { jobId, insuranceId: rawData.memberId });
+    return res.json({ status: "queued", jobId });
+  } catch (err: any) {
+    console.error("[bcbs-ma-route] enqueue failed:", err);
+    return res.status(500).json({ error: err.message || "Failed to enqueue BCBS MA selenium job" });
+  }
+});
+
+/**
+ * POST /selenium/submit-otp
+ * Forwards the OTP to the Python agent (side-channel, bypasses queue).
+ * Body: { session_id, otp, socketId? }
+ */
+router.post("/selenium/submit-otp", async (req: Request, res: Response): Promise<any> => {
+  const { session_id: sessionId, otp, socketId } = req.body;
+  if (!sessionId || !otp) {
+    return res.status(400).json({ error: "session_id and otp are required" });
+  }
+
+  try {
+    const r = await forwardOtpToSeleniumBcbsMaAgent(sessionId, otp);
+    emitSafe(socketId, "selenium:otp_submitted", { session_id: sessionId, result: r });
+    return res.json(r);
+  } catch (err: any) {
+    console.error("[bcbs-ma-route] submit-otp failed:", err?.message || err);
+    return res.status(500).json({
+      error: "Failed to forward OTP to selenium agent",
+      detail: err?.message || err,
+    });
+  }
+});
+
+export default router;