// Modules/Finance/BankDataProvider.swift
protocol BankDataProvider {
    var providerType: BankProviderType { get }

    func fetchInstitutions(countryCode: String) async throws -> [BankInstitution]
    func createAuthorizationLink(institutionId: String, institutionName: String?, country: String?) async throws -> BankAuthorizationResult
    func exchangeCallback(params: [String: String]) async throws -> BankSessionResult
    func fetchAccountDetails(accountId: String, sessionId: String) async throws -> ProviderAccount
    func fetchAccountBalances(accountId: String, sessionId: String) async throws -> [ProviderBalance]
    func fetchAccountTransactions(accountId: String, sessionId: String, dateFrom: Date?) async throws -> [ProviderTransaction]
}

enum BankProviderType: String, Codable {
    case goCardless = "goCardless"      // deprecated, нет доступа к API
    case enableBanking = "enableBanking" // primary
    case tink = "tink"                   // secondary
}

// Modules/Finance/BankProviderManager.swift
@MainActor
final class BankProviderManager: ObservableObject {
    static let shared = BankProviderManager()

    // Переключение провайдера — одна строка:
    @Published var activeProviderType: BankProviderType = .enableBanking

    var activeProvider: any BankDataProvider {
        provider(for: activeProviderType)
    }
}

Base URL: https://api.enablebanking.com/

Endpoints:
- GET  /aspsps?country={code}           # Список банков
- POST /sessions                         # Создание сессии (авторизация)
- GET  /sessions/{id}                    # Статус сессии
- GET  /accounts/{id}                    # Информация о счёте
- GET  /accounts/{id}/balances           # Балансы
- GET  /accounts/{id}/transactions       # Транзакции

1. JWT подписывается PEM ключом (RS256)
2. POST /sessions → redirect URL для банка
3. Пользователь авторизуется в банке через SFSafariViewController
4. Callback: thrust://oauth_callback?code=AUTH_CODE
5. GET /sessions/{code} → список счетов
6. GET /accounts/{id}/transactions → транзакции

Base URL: https://api.tink.com/

OAuth:
- POST /api/v1/oauth/token               # Client & User tokens
- POST /api/v1/user/create                # Создание пользователя
- POST /api/v1/oauth/authorization-grant  # Authorization grant

Data:
- GET  /api/v1/providers?market={code}    # Список банков
- GET  /data/v2/accounts                  # Счета
- GET  /data/v2/transactions              # Транзакции (с пагинацией)

1. POST /api/v1/oauth/token (client_credentials) → client_access_token (30 мин)
2. POST /api/v1/user/create → user_id
3. POST /api/v1/oauth/authorization-grant → authorization_code
4. Open Tink Link URL → SFSafariViewController
   https://link.tink.com/1.0/transactions/connect-accounts
     ?client_id=...&redirect_uri=thrust://oauth_callback
     &authorization_code=...&market=PL
5. Callback: thrust://oauth_callback?code=USER_AUTH_CODE
6. POST /api/v1/oauth/token (authorization_code) → user_access_token + refresh_token
7. GET /data/v2/accounts → список счетов
8. GET /data/v2/transactions → транзакции с bookedDateTime

{
  "currencyCode": "EUR",
  "value": {
    "scale": "2",
    "unscaledValue": "-2500"
  }
}

// BankProviderManager.swift
func detectProvider(from url: URL) -> BankProviderType? {
    let params = URLComponents(url: url, resolvingAgainstBaseURL: false)?
        .queryItems?.reduce(into: [:]) { $0[$1.name] = $1.value } ?? [:]

    // GoCardless — уникальные параметры
    if params["ref"] != nil || params["reference"] != nil {
        return .goCardless
    }

    // code= → проверяем pendingProvider (EnableBanking или Tink)
    if params["code"] != nil {
        if let pending = UserDefaults.standard.string(forKey: "bank_pending_provider"),
           let type = BankProviderType(rawValue: pending) {
            return type
        }
    }

    return activeProviderType // fallback
}

Modules/Finance/
├── BankDataProvider.swift          # Протокол
├── BankProviderManager.swift       # Фабрика/роутер
├── GoCardlessProvider.swift        # GoCardless (deprecated)
├── EnableBanking/
│   ├── EnableBankingAPIClient.swift # HTTP клиент
│   ├── EnableBankingModels.swift    # Codable модели
│   └── EnableBankingProvider.swift  # BankDataProvider adapter
└── Tink/
    ├── TinkAPIClient.swift         # HTTP клиент (OAuth2)
    ├── TinkModels.swift            # Codable модели
    └── TinkProvider.swift          # BankDataProvider adapter

let institutions = try await BankProviderManager.shared
    .activeProvider
    .fetchInstitutions(countryCode: "PL")

let result = try await BankProviderManager.shared
    .activeProvider
    .createAuthorizationLink(
        institutionId: selectedBank.id,
        institutionName: selectedBank.name,
        country: "PL"
    )

// result.authURL — URL для SFSafariViewController

// AppDelegate / onOpenURL
func handleBankCallback(_ url: URL) {
    let provider = BankProviderManager.shared.detectProvider(from: url)
    let params = extractParams(from: url)

    let session = try await BankProviderManager.shared
        .provider(for: provider)
        .exchangeCallback(params: params)
}

for accountId in session.accountIds {
    let transactions = try await provider
        .fetchAccountTransactions(
            accountId: accountId,
            sessionId: session.sessionId,
            dateFrom: Calendar.current.date(byAdding: .day, value: -90, to: Date())
        )

    await saveTransactions(transactions, for: accountId)
}

// Services/TransactionDeduplicator.swift
class TransactionDeduplicator {
    func findDuplicates(for transaction: Transaction) async -> [Transaction] {
        let hash = generateHash(transaction)
        let candidates = try? modelContext.fetch(
            FetchDescriptor<Transaction>(
                predicate: #Predicate { $0.contentHash == hash }
            )
        )
        return candidates?.filter {
            calculateConfidence($0, transaction) > 0.8
        } ?? []
    }
}

// Security/CertificatePinningManager.swift
// Все HTTP запросы проходят через pinned URLSession
let session = CertificatePinningManager.shared.createPinnedSession()

guard !PrivacyManager.shared.isGhostModeActive else {
    throw APIError.custom("Network access is disabled in Ghost Mode")
}

// BankProviderManager.swift:13
@Published var activeProviderType: BankProviderType = .enableBanking
// Меняем на:
@Published var activeProviderType: BankProviderType = .tink