## Age verification with Didit A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date. - Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit. - A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending. - Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30). - People are only ever sent back to the hub's website. - The Account page gets an Age Verification card. - Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`. ## Closed registration Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`. - When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account). - The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`. - The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting. - The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`. ## Testing - New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration. - `bun run test`: 35 pass. `bun run check-types` passes. - Checked locally: the account, waiting, sign-up and console pages render. - Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging. 🤖 Generated with [Claude Code](https://claude.com/claude-code) ## Age verification with Didit A new provider (`apps/api/src/age/didit.ts`) behind the existing vendor-neutral age interface. A person verifies once with an ID document, a passive liveness check and a face match; after that, all their linked IMVU accounts count as adult. The hub keeps only "over 18": never the document, photo or birth date. - Webhooks are checked against Didit's signatures (the raw body or V2, with `-Previous` during secret rotation), and old ones are rejected. If the webhook has no decision, the hub fetches it from Didit. - A later answer replaces an earlier one. An approval that's taken back (say, after a manual review) becomes `revoked`. A check still in review stays pending. - Limits, for every provider: one unfinished check per person (starting again resumes it), at most 3 checks in 30 days, none once verified, and a monthly cap (`DIDIT_MONTHLY_LIMIT`, default 30: since 2026-11-01, Didit's free plan is $10 of credit a month, and a check costs $0.30). - People are only ever sent back to the hub's website. - The Account page gets an Age Verification card. - Configuration: `AGE_PROVIDERS=imvu,didit`, `DIDIT_API_KEY`, `DIDIT_WORKFLOW_ID`, `DIDIT_WEBHOOK_SECRET`. The webhook is `<API_URL>/api/v1/age/webhook/didit`. ## Closed registration Registration is open or closed. It's an admin's setting in the console, with its default from `REGISTRATION`. - When it's closed, new accounts can only sign in until a moderator approves them, or declines them (which deletes the account). - The website shows people who are waiting a waiting page, and the API treats them as signed out everywhere but `/me`. - The console gets a Waiting count, a Waiting for approval filter, Approve and Decline on a person's page, and a Registration setting. - The migration adds `user.approved` (existing accounts stay approved) and `hub_setting`. ## Testing - New tests cover Didit (with a fake Didit server), the limits, revocation, return addresses and registration. - `bun run test`: 35 pass. `bun run check-types` passes. - Checked locally: the account, waiting, sign-up and console pages render. - Not run against Didit itself yet. The sandbox workflow "T5DE Age Check" is published, and the next step is a real webhook once this is on staging. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: dhkatz <[email protected]>
74 lines
2.5 KiB
TypeScript
74 lines
2.5 KiB
TypeScript
"use server";
|
|
import { revalidatePath } from "next/cache";
|
|
import { redirect } from "next/navigation";
|
|
import { api, unwrap } from "@/lib/api";
|
|
import { attempt, field, type ActionState } from "@/lib/actions";
|
|
|
|
const done = () => revalidatePath("/account");
|
|
|
|
/** Starts linking an IMVU account: the API makes a code to put in its tagline. */
|
|
export async function linkAccount(_: ActionState, form: FormData): Promise<ActionState> {
|
|
return attempt(async () => {
|
|
unwrap(await api.account.links.post({ username: field(form, "username") }));
|
|
done();
|
|
});
|
|
}
|
|
|
|
/** A pending link: check the tagline for the code, or cancel. */
|
|
export async function challengeAction(_: ActionState, form: FormData): Promise<ActionState> {
|
|
const imvu = field(form, "imvu");
|
|
return attempt(async () => {
|
|
if (field(form, "intent") === "cancel") {
|
|
unwrap(await api.account.challenges({ imvu }).delete());
|
|
} else {
|
|
unwrap(await api.account.links({ imvu }).check.post());
|
|
}
|
|
done();
|
|
});
|
|
}
|
|
|
|
/** A linked account: check its age status with IMVU again, or unlink it. */
|
|
export async function linkAction(_: ActionState, form: FormData): Promise<ActionState> {
|
|
const imvu = field(form, "imvu");
|
|
return attempt(async () => {
|
|
if (field(form, "intent") === "unlink") {
|
|
unwrap(await api.account.links({ imvu }).delete());
|
|
done();
|
|
return;
|
|
}
|
|
unwrap(await api.account.links({ imvu }).recheck.post());
|
|
done();
|
|
return "Checked with IMVU just now.";
|
|
});
|
|
}
|
|
|
|
export async function saveSettings(
|
|
imvu: number,
|
|
settings: { showBadge?: boolean; showPresence?: boolean; listRooms?: boolean },
|
|
): Promise<ActionState> {
|
|
return attempt(async () => {
|
|
unwrap(await api.account.links({ imvu }).patch(settings));
|
|
done();
|
|
});
|
|
}
|
|
|
|
export async function signOutComputers(_: ActionState, _form: FormData): Promise<ActionState> {
|
|
return attempt(async () => {
|
|
unwrap(await api.account["signout-computers"].post());
|
|
done();
|
|
return "Signed out everywhere.";
|
|
});
|
|
}
|
|
|
|
/** Starts an age check with a provider that checks the person, and sends them to its page. */
|
|
export async function startAgeCheck(_: ActionState, form: FormData): Promise<ActionState> {
|
|
let url: string | undefined;
|
|
const state = await attempt(async () => {
|
|
const started = unwrap(await api.age({ provider: field(form, "provider") }).start.post({ returnURL: "/account?age=back" }));
|
|
if (started.kind === "redirect") url = started.url;
|
|
done();
|
|
});
|
|
if (url) redirect(url);
|
|
return state;
|
|
}
|