feat: age verification with an ID document (Didit), and closed registration (#4)

## Age verification with Didit

A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date.

- Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit.
- A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending.
- Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30).
- People are only ever sent back to the hub's website.
- The Account page gets an Age Verification card.
- Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`.

## Closed registration

Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`.

- When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account).
- The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`.
- The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting.
- The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`.

## Testing

- New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration.
- `bun run test`: 35 pass. `bun run check-types` passes.
- Checked locally: the account, waiting, sign-up and console pages render.
- Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Age verification with Didit

A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date.

- Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit.
- A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending.
- Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30).
- People are only ever sent back to the hub's website.
- The Account page gets an Age Verification card.
- Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`.

## Closed registration

Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`.

- When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account).
- The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`.
- The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting.
- The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`.

## Testing

- New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration.
- `bun run test`: 35 pass. `bun run check-types` passes.
- Checked locally: the account, waiting, sign-up and console pages render.
- Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: dhkatz <[email protected]>

apps/web/app/console/people/[id]/page.tsx

@@ -8,7 +8,7 @@ import { Input } from "@/components/ui/input";
 import { NativeSelect, NativeSelectOption } from "@/components/ui/native-select";
 import { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from "@/components/ui/table";
 import { api, ApiError, unwrap } from "@/lib/api";
-import { ban, setLinkCap, setRole, unban } from "../../actions";
+import { ban, decideAccount, setLinkCap, setRole, unban } from "../../actions";
 import { ConsoleNav, requireModerator } from "../../console-nav";
 
 export const metadata: Metadata = { title: "Person" };
@@ -35,11 +35,41 @@ export default async function PersonPage({ params }: { params: Promise<{ id: str
             joined <DateTime iso={person.createdAt} dateOnly />
           </span>
           {person.banned && <Tag tone="danger">banned: {person.banReason}</Tag>}
+          {!person.approved && <Tag tone="strong">waiting for approval</Tag>}
         </span>
       </PageHeader>
       <ConsoleNav />
 
       <div className="space-y-6">
+        {!person.approved && (
+          <Card>
+            <CardHeader>
+              <CardTitle>Waiting for Approval</CardTitle>
+              <CardDescription>
+                {person.email}. Until approved, they can only sign in. Declining deletes the account.
+              </CardDescription>
+            </CardHeader>
+            <CardContent>
+              <ActionForm action={decideAccount} fields={{ id: person.id }}>
+                <div className="flex gap-2">
+                  <SubmitButton name="decision" value="approve" pendingLabel="Approving…">
+                    Approve
+                  </SubmitButton>
+                  <SubmitButton
+                    name="decision"
+                    value="decline"
+                    variant="outline"
+                    pendingLabel="Declining…"
+                    confirm={`Decline ${person.username}? Their account is deleted.`}
+                  >
+                    Decline
+                  </SubmitButton>
+                </div>
+              </ActionForm>
+            </CardContent>
+          </Card>
+        )}
+
         <Card>
           <CardHeader>
             <CardTitle>IMVU accounts</CardTitle>

apps/web/app/console/people/page.tsx

@@ -11,11 +11,17 @@ import { ConsoleNav, requireModerator } from "../console-nav";
 
 export const metadata: Metadata = { title: "People" };
 
-export default async function People({ searchParams }: { searchParams: Promise<{ q?: string | string[] }> }) {
-  const raw = (await searchParams).q;
-  const q = typeof raw === "string" ? raw.slice(0, 64) : "";
-  await requireModerator(q ? `/console/people?q=${encodeURIComponent(q)}` : "/console/people");
-  const { people } = unwrap(await api.console.people.get({ query: q ? { q } : {} }));
+export default async function People({
+  searchParams,
+}: {
+  searchParams: Promise<{ q?: string | string[]; waiting?: string | string[] }>;
+}) {
+  const params = await searchParams;
+  const q = typeof params.q === "string" ? params.q.slice(0, 64) : "";
+  const waiting = params.waiting === "true";
+  const query = new URLSearchParams({ ...(q ? { q } : {}), ...(waiting ? { waiting: "true" } : {}) }).toString();
+  await requireModerator(`/console/people${query ? `?${query}` : ""}`);
+  const { people } = unwrap(await api.console.people.get({ query: { ...(q ? { q } : {}), ...(waiting ? { waiting: true } : {}) } }));
 
   return (
     <>
@@ -23,14 +29,23 @@ export default async function People({ searchParams }: { searchParams: Promise<{
       <ConsoleNav />
       <Card>
         <CardContent className="space-y-6">
-          <form action="/console/people" className="flex max-w-md gap-2">
-            <Input type="search" name="q" defaultValue={q} placeholder="T5DE or IMVU username" aria-label="Search" />
-            <Button type="submit" variant="outline">
-              Search
-            </Button>
-          </form>
+          <div className="flex flex-wrap items-center gap-4">
+            <form action="/console/people" className="flex max-w-md flex-1 gap-2">
+              <Input type="search" name="q" defaultValue={q} placeholder="T5DE or IMVU username" aria-label="Search" />
+              {waiting && <input type="hidden" name="waiting" value="true" />}
+              <Button type="submit" variant="outline">
+                Search
+              </Button>
+            </form>
+            <Link
+              href={waiting ? "/console/people" : "/console/people?waiting=true"}
+              className="text-sm text-muted-foreground underline-offset-4 hover:underline"
+            >
+              {waiting ? "Show everyone" : "Waiting for approval"}
+            </Link>
+          </div>
           {people.length === 0 ? (
-            <p className="text-sm text-muted-foreground">Nobody found.</p>
+            <p className="text-sm text-muted-foreground">{waiting ? "Nobody is waiting." : "Nobody found."}</p>
           ) : (
             <Table>
               <TableHeader>
@@ -55,7 +70,9 @@ export default async function People({ searchParams }: { searchParams: Promise<{
                     <TableCell className="text-muted-foreground">
                       <DateTime iso={p.createdAt} dateOnly />
                     </TableCell>
-                    <TableCell className="text-right">{p.banned && <Tag tone="danger">banned</Tag>}</TableCell>
+                    <TableCell className="text-right">
+                      {p.banned ? <Tag tone="danger">banned</Tag> : !p.approved && <Tag tone="strong">waiting</Tag>}
+                    </TableCell>
                   </TableRow>
                 ))}
               </TableBody>