Verify a user, end to end

curl -X POST "$TF_BASE_URL/v3/session/" \
  -H "x-api-key: $TF_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: kyc-user-42" \
  -d '{
    "workflow_id": "9c2f1c4e-9a2b-4f2f-8f0f-0f1f3f4f5f6f",
    "vendor_data": "user-42",
    "callback_url": "https://app.example.com/kyc/done",
    "contact_email": "[email protected]",
    "expires_in_hours": 24,
    "prefill": { "full_name": "Aarav Sharma", "nationality": "NP" }
  }'

import { NextResponse } from "next/server";

export async function POST(req: Request) {
  const user = await requireUser(req);                    // your auth

  const res = await fetch(`${process.env.TF_BASE_URL}/v3/session/`, {
    method: "POST",
    headers: {
      "x-api-key": process.env.TF_API_KEY!,               // secret — server only
      "content-type": "application/json",
      "idempotency-key": `kyc-${user.id}`,                // retries are free
    },
    body: JSON.stringify({
      workflow_id: process.env.TF_WORKFLOW_ID,            // pin it explicitly
      vendor_data: user.id,                               // → identity.external_user_id
      callback_url: `${process.env.APP_URL}/kyc/done`,
      contact_email: user.email,
      expires_in_hours: 24,
      prefill: { full_name: user.fullName, nationality: user.nationality },
    }),
  });

  if (res.status === 402) {
    // insufficient_credits — degrade gracefully, don't 500 at the user
    return NextResponse.json({ error: "verification_unavailable" }, { status: 503 });
  }
  if (!res.ok) throw new Error(`obsidian ${res.status}: ${await res.text()}`);

  const session = await res.json();
  await db.kycSessions.upsert({ userId: user.id, sessionId: session.id, status: "pending" });

  return NextResponse.json({ url: session.url, id: session.id });
}

import os, requests
from flask import Blueprint, jsonify, g

bp = Blueprint("kyc", __name__)

@bp.post("/api/kyc/start")
def start_kyc():
    user = g.current_user  # your auth

    resp = requests.post(
        f"{os.environ['TF_BASE_URL']}/v3/session/",
        headers={
            "x-api-key": os.environ["TF_API_KEY"],
            "Idempotency-Key": f"kyc-{user.id}",
        },
        json={
            "workflow_id": os.environ["TF_WORKFLOW_ID"],
            "vendor_data": str(user.id),
            "callback_url": f"{os.environ['APP_URL']}/kyc/done",
            "contact_email": user.email,
            "expires_in_hours": 24,
            "prefill": {"full_name": user.full_name, "nationality": user.nationality},
        },
        timeout=15,
    )

    if resp.status_code == 402:
        return jsonify({"error": "verification_unavailable"}), 503
    resp.raise_for_status()

    session = resp.json()
    db.kyc_sessions.upsert(user_id=user.id, session_id=session["id"], status="pending")
    return jsonify({"url": session["url"], "id": session["id"]})

app.post("/webhooks/obsidian", express.raw({ type: "application/json" }), async (req, res) => {
  const sig = req.header("X-Webhook-Signature") ?? "";
  if (!verify(process.env.TF_WEBHOOK_SECRET!, sig, req.body)) {
    return res.status(400).send("bad signature");         // verify before parsing
  }

  const event = JSON.parse(req.body.toString("utf8"));
  res.status(200).end();                                  // ack fast

  if (await seen(event.idempotency_key)) return;          // dedupe: retries happen

  switch (event.event_type) {
    case "identity.kyc.session.approved":
      await activateUser(event.vendor_data);              // ← the real gate
      break;
    case "identity.kyc.session.declined":
      await rejectUser(event.vendor_data, event.session_id);
      break;
    case "identity.kyc.session.review":
      await markPending(event.vendor_data);               // expect a later terminal event
      break;
    case "identity.kyc.session.expired":
      await inviteRetry(event.vendor_data);
      break;
    default:
      await markPending(event.vendor_data);                // unknown → treat as review
  }
});

@bp.post("/webhooks/obsidian")
def handle_webhook():
    sig = request.headers.get("X-Webhook-Signature", "")
    raw = request.get_data()                                # raw bytes, before parsing
    if not verify(os.environ["TF_WEBHOOK_SECRET"], sig, raw):
        return "bad signature", 400

    event = request.get_json()
    if seen(event["idempotency_key"]):
        return "", 200                                       # ack, already processed

    match event["event_type"]:
        case "identity.kyc.session.approved":
            activate_user(event["vendor_data"])
        case "identity.kyc.session.declined":
            reject_user(event["vendor_data"], event["session_id"])
        case "identity.kyc.session.review":
            mark_pending(event["vendor_data"])
        case "identity.kyc.session.expired":
            invite_retry(event["vendor_data"])
        case _:
            mark_pending(event["vendor_data"])               # unknown → treat as review

    return "", 200