Vendor-neutral age verification, with IMVU as the first provider

Age checks are recorded in one table (age_check) by provider, method and result, never with documents or birth dates; one rule decides whether an IMVU account counts as adult (its person's check, or its own). Providers implement a small interface (start, webhook or browser completion, re-check) and are chosen by configuration, so phone wallets and Didit can be added, or swapped, as adapters. IMVU's answer per account is re-checked when it expires (about daily). Existing links' results move into the new table. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-29 05:44:36 -07:00
1 parent 339ba8e2d6
commit 7db9fc0370
@@ -0,0 +1,136 @@
+// Age verification: the one rule, providers that check a person (here a fake document-check vendor with signed
+// webhooks), and IMVU's answers changing.
+import { afterAll, beforeAll, expect, test } from "bun:test";
+import { openDatabase, schema, type Database } from "@t5de/db";
+import { AgeService, type Provider } from "../src/age";
+import { imvuAgeProvider } from "../src/age/imvu";
+import { createApp } from "../src/app";
+import { createAuth } from "../src/auth";
+import { ImvuClient, type ImvuUser } from "../src/imvu";
+
+const webURL = "http://web.test";
+const accounts = new Map<number, ImvuUser>();
+const fakeIMVU: typeof fetch = (async (input: RequestInfo | URL) => {
+  const url = new URL(String(input));
+  const u = [...accounts.values()].find(
+    (u) => url.pathname === `/user/user-${u.id}` || url.searchParams.get("username")?.toLowerCase() === u.username.toLowerCase(),
+  );
+  return Response.json({
+    denormalized: u
+      ? { [`https://api.imvu.com/user/user-${u.id}`]: { data: { legacy_cid: u.id, username: u.username, tagline: u.tagline, is_ageverified: u.ageVerified, is_ap: u.accessPass } } }
+      : {},
+  });
+}) as typeof fetch;
+
+// A document-check vendor: sends the person to its page, then reports by a webhook signed with a shared secret.
+const webhookSecret = "vendor-secret";
+const fakeVendor: Provider = {
+  id: "vendor",
+  label: "ID document",
+  scope: "person",
+  start: async () => {
+    const ref = `session-${crypto.randomUUID()}`;
+    return { kind: "redirect", url: `https://vendor.test/check/${ref}`, ref };
+  },
+  webhook: async (request) => {
+    if (request.headers.get("x-signature") !== webhookSecret) throw new Error("bad signature");
+    const body = (await request.json()) as { session: string; approved: boolean; over18: boolean };
+    return { ref: body.session, result: body.approved ? { overEighteen: body.over18, method: "id_document" } : "failed" };
+  },
+};
+
+let db: Database;
+let close: () => Promise<void>;
+let base: string;
+let age: AgeService;
+let stop: () => void;
+
+beforeAll(async () => {
+  ({ db, close } = await openDatabase("memory"));
+  const auth = createAuth(db, { apiURL: "http://api.test", webURL, secret: "test-secret-test-secret-test-secret-1234", rateLimit: false });
+  const imvu = new ImvuClient("http://imvu.test", fakeIMVU);
+  age = new AgeService(db, [imvuAgeProvider(imvu), fakeVendor]);
+  const hub = createApp({ db, auth, imvu, age });
+  hub.app.listen({ port: 0, hostname: "127.0.0.1" });
+  const server = hub.app.server as unknown as { port: number; stop: () => void };
+  stop = () => server.stop();
+  base = `http://127.0.0.1:${server.port}`;
+});
+
+afterAll(async () => {
+  stop();
+  await close();
+});
+
+async function call(cookie: { v: string }, method: string, path: string, body?: unknown, headers: Record<string, string> = {}) {
+  const res = await fetch(base + path, {
+    method,
+    headers: { Origin: webURL, ...(body !== undefined ? { "Content-Type": "application/json" } : {}), ...(cookie.v ? { Cookie: cookie.v } : {}), ...headers },
+    body: body !== undefined ? JSON.stringify(body) : undefined,
+  });
+  const set = res.headers.getSetCookie();
+  if (set.length) cookie.v = set.map((c) => c.split(";")[0]).join("; ");
+  const text = await res.text();
+  return { status: res.status, json: text ? JSON.parse(text) : undefined };
+}
+
+async function personWithAccounts(name: string, ids: { id: number; ageVerified?: boolean; accessPass?: boolean }[]) {
+  const cookie = { v: "" };
+  await call(cookie, "POST", "/api/auth/sign-up/email", { email: `${name}@example.test`, password: "a long password", name, username: name });
+  for (const a of ids) {
+    accounts.set(a.id, { id: a.id, username: `${name}${a.id}`, tagline: "", ageVerified: !!a.ageVerified, accessPass: !!a.accessPass });
+    const started = await call(cookie, "POST", "/api/v1/account/links", { username: `${name}${a.id}` });
+    accounts.get(a.id)!.tagline = started.json.challenge.code;
+    expect((await call(cookie, "POST", `/api/v1/account/links/${a.id}/check`)).status).toBe(200);
+  }
+  return cookie;
+}
+
+const adultOf = async (cookie: { v: string }) =>
+  Object.fromEntries(((await call(cookie, "GET", "/api/v1/account")).json.links as any[]).map((l) => [l.imvuId, l.adult]));
+
+test("IMVU's answer is per account, and re-checked when it expires", async () => {
+  const a = await personWithAccounts("ann", [{ id: 1, ageVerified: true }, { id: 2 }, { id: 3, accessPass: true }]);
+  expect(await adultOf(a)).toEqual({ 1: true, 2: false, 3: true });
+
+  // IMVU revokes account 1's verification; once its answer expires, the re-check sees it.
+  accounts.get(1)!.ageVerified = false;
+  await db.update(schema.ageCheck).set({ expiresAt: new Date(Date.now() - 1000) });
+  expect(await age.recheckDue()).toBeGreaterThanOrEqual(3);
+  expect(await adultOf(a)).toEqual({ 1: false, 2: false, 3: true });
+});
+
+test("a person's check covers all their accounts; webhooks must be signed", async () => {
+  const b = await personWithAccounts("ben", [{ id: 10 }, { id: 11 }]);
+  expect((await call(b, "GET", "/api/v1/age")).json.providers.map((p: any) => p.id)).toEqual(["imvu", "vendor"]);
+  // IMVU checks accounts, not people: it can't be started this way.
+  expect((await call(b, "POST", "/api/v1/age/imvu/start", { returnURL: `${webURL}/account` })).status).toBe(400);
+
+  const started = (await call(b, "POST", "/api/v1/age/vendor/start", { returnURL: `${webURL}/account` })).json;
+  expect(started.kind).toBe("redirect");
+  expect((await call(b, "GET", "/api/v1/age")).json.checks[0]).toMatchObject({ provider: "vendor", status: "pending" });
+
+  const hook = (signature: string, approved: boolean) =>
+    call({ v: "" }, "POST", "/api/v1/age/webhook/vendor", { session: started.ref, approved, over18: true }, { "x-signature": signature });
+  expect((await hook("forged", true)).status).toBe(401);
+  expect(await adultOf(b)).toEqual({ 10: false, 11: false });
+  expect((await hook(webhookSecret, true)).status).toBe(204);
+  expect(await adultOf(b)).toEqual({ 10: true, 11: true });
+  // A repeated webhook is harmless.
+  expect((await hook(webhookSecret, true)).status).toBe(204);
+});
+
+test("a moved account takes nobody's age with it", async () => {
+  const c = await personWithAccounts("cal", [{ id: 20, ageVerified: true }]);
+  expect(await adultOf(c)).toEqual({ 20: true });
+  // Dee proves the account is hers; IMVU now says it isn't verified (say, the verification was the old owner's).
+  accounts.get(20)!.ageVerified = false;
+  const d = { v: "" };
+  await call(d, "POST", "/api/auth/sign-up/email", { email: "[email protected]", password: "a long password", name: "dee", username: "dee" });
+  const started = await call(d, "POST", "/api/v1/account/links", { username: "cal20" });
+  accounts.get(20)!.tagline = started.json.challenge.code;
+  expect((await call(d, "POST", "/api/v1/account/links/20/check")).json.moved).toBe(true);
+  expect(await adultOf(d)).toEqual({ 20: false });
+  const leftovers = await db.select().from(schema.ageCheck);
+  expect(leftovers.filter((c) => c.imvuId === 20)).toHaveLength(1);
+});