feat: age verification with an ID document (Didit), and closed registration #4

2026-11-03T12:16:26Z

dhkatz commented

2026-11-03 12:16:26 +00:00

Age verification with Didit

A new provider (apps/api/src/age/didit.ts) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date.

Webhooks are checked against Didit's signatures (the raw body or V2, with -Previous during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit.
A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes revoked. A check still in review stays pending.
Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (DIDIT_MONTHLY_LIMIT, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30).
People are only ever sent back to the hub's website.
The Account page gets an Age Verification card.
Configuration: AGE_PROVIDERS=imvu,didit, DIDIT_API_KEY, DIDIT_WORKFLOW_ID, DIDIT_WEBHOOK_SECRET. The webhook is <API_URL>/api/v1/age/webhook/didit.

Closed registration

Registration is open or closed. It's an admin's setting in the console, with its default from REGISTRATION.

When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account).
The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but /me.
The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting.
The migration adds user.approved (existing accounts stay approved) and hub_setting.

Testing

New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration.
bun run test: 35 pass. bun run check-types passes.
Checked locally: the account, waiting, sign-up and console pages render.
Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging.

🤖 Generated with Claude Code

## Age verification with Didit A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date. - Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit. - A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending. - Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30). - People are only ever sent back to the hub's website. - The Account page gets an Age Verification card. - Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`. ## Closed registration Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`. - When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account). - The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`. - The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting. - The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`. ## Testing - New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration. - `bun run test`: 35 pass. `bun run check-types` passes. - Checked locally: the account, waiting, sign-up and console pages render. - Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dhkatz added 1 commit 2026-11-03 12:16:26 +00:00

feat: age verification with an ID document (Didit), and closed registration

Pull request / title (pull_request) Successful in 1s

Details

CI / test (pull_request) Successful in 58s

Details

CI / image (apps/api/Dockerfile, t5de-hub-api) (pull_request) Skipped

Details

CI / image (apps/web/Dockerfile, t5de-hub-web) (pull_request) Skipped

Details

c75a4c9afc

Age: a Didit provider behind the vendor-neutral age interface. A person
verifies once (ID document, passive liveness, face match) and all their
linked IMVU accounts count as adult. Webhooks are checked against Didit's
signatures; only "over 18" is kept. A later answer replaces an earlier one
(an approval taken back is revoked). Checks are limited: one unfinished
check per person, 3 in 30 days, none once verified, and a monthly cap
(DIDIT_MONTHLY_LIMIT, default 30: Didit's free plan is $10 of credit a
month and a check costs $0.30). The Account page gets an Age Verification
card.

Registration: open or closed, an admin's setting in the console
(default from REGISTRATION). Closed: new accounts can only sign in until
a moderator approves them (or declines, deleting the account); the
website shows them a waiting page and the API treats them as signed out.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

All checks were successful

Pull request / title (pull_request) Successful in 1s

Required

Details

CI / test (pull_request) Successful in 58s

Required

Details

CI / image (apps/api/Dockerfile, t5de-hub-api) (pull_request) Skipped

Details

CI / image (apps/web/Dockerfile, t5de-hub-web) (pull_request) Skipped

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin feat/didit-age-verification:feat/didit-age-verification

git checkout feat/didit-age-verification

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: t5de/t5de-hub#4