dhkatz
d5cd2be5d0
## Age verification with Didit A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date. - Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit. - A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending. - Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30). - People are only ever sent back to the hub's website. - The Account page gets an Age Verification card. - Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`. ## Closed registration Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`. - When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account). - The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`. - The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting. - The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`. ## Testing - New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration. - `bun run test`: 35 pass. `bun run check-types` passes. - Checked locally: the account, waiting, sign-up and console pages render. - Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Age verification with Didit A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date. - Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit. - A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending. - Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30). - People are only ever sent back to the hub's website. - The Account page gets an Age Verification card. - Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`. ## Closed registration Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`. - When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account). - The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`. - The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting. - The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`. ## Testing - New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration. - `bun run test`: 35 pass. `bun run check-types` passes. - Checked locally: the account, waiting, sign-up and console pages render. - Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: dhkatz <[email protected]>
78 lines
3.1 KiB
TypeScript
78 lines
3.1 KiB
TypeScript
// Accounts, sessions and proxy sign-in, by Better Auth: email and password with usernames, roles and bans (admin),
|
|
// device sign-in for T5DE's proxy (RFC 8628), bearer tokens for the proxy's requests, and JWTs with published keys
|
|
// (for catalogs later).
|
|
import { betterAuth } from "better-auth";
|
|
import { drizzleAdapter } from "better-auth/adapters/drizzle";
|
|
import { admin, bearer, deviceAuthorization, jwt, username } from "better-auth/plugins";
|
|
import { count, schema, type Database } from "@t5de/db";
|
|
import { Settings } from "./settings";
|
|
|
|
export type AuthConfig = {
|
|
/** The API's own address, e.g. https://hub-api.t5de.dev. */
|
|
apiURL: string;
|
|
/** The website's address, e.g. https://hub.t5de.dev: trusted origin, and where /device is. */
|
|
webURL: string;
|
|
/** At least 32 random characters; signs sessions. */
|
|
secret: string;
|
|
/** Rate limits on sign-up, sign-in and the rest (on unless false: tests turn them off). */
|
|
rateLimit?: boolean;
|
|
/** Whether new accounts wait for approval (default: the hub's settings, with no environment defaults). */
|
|
settings?: Settings;
|
|
};
|
|
|
|
/** The proxy's client ID in device sign-in. */
|
|
export const proxyClientID = "t5de-proxy";
|
|
|
|
export function createAuth(db: Database, config: AuthConfig) {
|
|
const settings = config.settings ?? new Settings(db);
|
|
return betterAuth({
|
|
baseURL: config.apiURL,
|
|
basePath: "/api/auth",
|
|
secret: config.secret,
|
|
trustedOrigins: [config.webURL],
|
|
database: drizzleAdapter(db, { provider: "pg", schema }),
|
|
emailAndPassword: { enabled: true, minPasswordLength: 10, maxPasswordLength: 256 },
|
|
user: {
|
|
additionalFields: {
|
|
linkCap: { type: "number", defaultValue: 10, input: false },
|
|
approved: { type: "boolean", defaultValue: true, input: false },
|
|
},
|
|
},
|
|
// Proxies stay signed in for months; a session is extended when it's used.
|
|
session: { expiresIn: 60 * 60 * 24 * 60, updateAge: 60 * 60 * 24 },
|
|
rateLimit: { enabled: config.rateLimit !== false, window: 60, max: 100 },
|
|
advanced: { ipAddress: { ipAddressHeaders: ["cf-connecting-ip", "x-forwarded-for"] } },
|
|
databaseHooks: {
|
|
user: {
|
|
create: {
|
|
// The first account runs the hub; with registration closed, the others wait for approval.
|
|
before: async (u) => {
|
|
const [row] = await db.select({ n: count() }).from(schema.user);
|
|
const first = (row?.n ?? 0) === 0;
|
|
const approved = first || (await settings.registration()) === "open";
|
|
return { data: { ...u, role: first ? "admin" : "user", approved } };
|
|
},
|
|
},
|
|
},
|
|
},
|
|
plugins: [
|
|
username({
|
|
minUsernameLength: 3,
|
|
maxUsernameLength: 32,
|
|
usernameValidator: (name) => /^[A-Za-z0-9_]+$/.test(name),
|
|
}),
|
|
admin({ defaultRole: "user", adminRoles: ["admin"] }),
|
|
deviceAuthorization({
|
|
verificationUri: `${config.webURL}/device`,
|
|
expiresIn: "10m",
|
|
interval: "3s",
|
|
validateClient: (clientId) => clientId === proxyClientID,
|
|
}),
|
|
bearer(),
|
|
jwt({ jwks: { keyPairConfig: { alg: "EdDSA", crv: "Ed25519" } } }),
|
|
],
|
|
});
|
|
}
|
|
|
|
export type Auth = ReturnType<typeof createAuth>;
|