dhkatz
d5cd2be5d0
## Age verification with Didit A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date. - Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit. - A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending. - Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30). - People are only ever sent back to the hub's website. - The Account page gets an Age Verification card. - Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`. ## Closed registration Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`. - When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account). - The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`. - The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting. - The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`. ## Testing - New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration. - `bun run test`: 35 pass. `bun run check-types` passes. - Checked locally: the account, waiting, sign-up and console pages render. - Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Age verification with Didit A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date. - Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit. - A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending. - Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30). - People are only ever sent back to the hub's website. - The Account page gets an Age Verification card. - Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`. ## Closed registration Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`. - When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account). - The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`. - The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting. - The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`. ## Testing - New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration. - `bun run test`: 35 pass. `bun run check-types` passes. - Checked locally: the account, waiting, sign-up and console pages render. - Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: dhkatz <[email protected]>
45 lines
1.6 KiB
YAML
45 lines
1.6 KiB
YAML
# Runs the whole hub: Postgres, the API (port 4101) and the website (port 4100). Set AUTH_SECRET, and the public
|
|
# addresses when they aren't localhost (API_PUBLIC_URL, WEB_PUBLIC_URL):
|
|
# AUTH_SECRET=$(openssl rand -base64 32) docker compose up -d
|
|
services:
|
|
postgres:
|
|
image: postgres:17
|
|
environment:
|
|
POSTGRES_USER: t5de
|
|
POSTGRES_PASSWORD: t5de
|
|
POSTGRES_DB: t5de_hub
|
|
volumes: [postgres:/var/lib/postgresql/data]
|
|
healthcheck:
|
|
test: ["CMD", "pg_isready", "-U", "t5de"]
|
|
interval: 2s
|
|
retries: 30
|
|
|
|
api:
|
|
build: { context: ., dockerfile: apps/api/Dockerfile }
|
|
environment:
|
|
DATABASE_URL: postgres://t5de:t5de@postgres:5432/t5de_hub
|
|
AUTH_SECRET: ${AUTH_SECRET:?set AUTH_SECRET}
|
|
# T5DE's proxies reach the API directly (sign-in and the WebSocket); the website reaches it through its own /api.
|
|
API_URL: ${API_PUBLIC_URL:-http://localhost:4101}
|
|
WEB_URL: ${WEB_PUBLIC_URL:-http://localhost:4100}
|
|
# open, or closed (new accounts wait for a moderator's approval) until an admin changes it in the console.
|
|
REGISTRATION: ${REGISTRATION:-open}
|
|
# Ways to verify age (apps/api/src/index.ts): imvu, and didit with its keys.
|
|
AGE_PROVIDERS: ${AGE_PROVIDERS:-imvu}
|
|
DIDIT_API_KEY: ${DIDIT_API_KEY:-}
|
|
DIDIT_WORKFLOW_ID: ${DIDIT_WORKFLOW_ID:-}
|
|
DIDIT_WEBHOOK_SECRET: ${DIDIT_WEBHOOK_SECRET:-}
|
|
ports: ["4101:4101"]
|
|
depends_on:
|
|
postgres: { condition: service_healthy }
|
|
|
|
web:
|
|
build: { context: ., dockerfile: apps/web/Dockerfile }
|
|
environment:
|
|
API_URL: http://api:4101
|
|
ports: ["4100:4100"]
|
|
depends_on: [api]
|
|
|
|
volumes:
|
|
postgres:
|