Age Verification

// 1. Generate and store a CSRF state token
$state = bin2hex(random_bytes(16)); // 32 hex characters

setcookie('age_verification_state', $state, [
    'expires'  => time() + 900, // 15 minutes
    'path'     => '/',
    'secure'   => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

// 2. Call verification-start
$curl = curl_init('https://uxvq4ew6td.execute-api.us-east-1.amazonaws.com/production/verification-start');
curl_setopt($curl, CURLOPT_POST,           true);
curl_setopt($curl, CURLOPT_POSTFIELDS,    json_encode([
    'client_reference' => $userId,
    'state'            => $state,
]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HTTPHEADER,    [
    'Content-Type: application/json',
    'x-api-key: '      . $_ENV['PRONTOID_API_KEY'],
    'x-platform-id: ' . $_ENV['PRONTOID_PLATFORM_ID'],
]);

try {
    $response = curl_exec($curl);

    if (curl_errno($curl)) {
        throw new Exception(curl_error($curl));
    }

    $http_status   = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    $response_data = json_decode($response, true);

    if ($http_status >= 200 && $http_status < 300
        && isset($response_data['verification_token'])) {

        $verificationToken = $response_data['verification_token'];

        // 3. Save the token against the user before redirecting
        saveAgeVerificationToken($userId, $verificationToken, 'prontoid');

        // 4. Build the redirect URL
        $redirectUrl = 'https://verify.prontoid.com/api/open_platform_session.php'
                     . '?verification_token=' . urlencode($verificationToken);
    } else {
        $errorMessage = $response_data['message'] ?? 'Unknown error occurred.';
        throw new Exception('API Gateway Error: ' . $errorMessage);
    }
} catch (Exception $e) {
    $hasError     = true;
    $errorDetails = $e->getMessage();
} finally {
    curl_close($curl);
}

curl -X POST \
  https://uxvq4ew6td.execute-api.us-east-1.amazonaws.com/production/verification-start \
  -H 'Content-Type: application/json' \
  -H 'x-api-key: YOUR_API_KEY' \
  -H 'x-platform-id: YOUR_PLATFORM_ID' \
  -d '{
    "client_reference": "user_abc123",
    "state":            "a3f8c2d1e4b7"
  }'

{
  "success":            true,
  "verification_token": "vt_…",
  "expires_at":         1735430400,
  "client_reference":   "user_abc123"
}

// On your authorized_user_redirect_uri page:
$returned_state = $_GET['state']                          ?? null;
$stored_state   = $_COOKIE['age_verification_state'] ?? null;

if (!$returned_state || !hash_equals($stored_state, $returned_state)) {
    // State mismatch — abort
    http_response_code(403);
    exit('Invalid state.');
}

// Clear the state cookie
setcookie('age_verification_state', '', time() - 3600, '/');

// Do NOT grant access here — wait for the webhook

$redirectUrl = 'https://verify.prontoid.com/api/open_platform_session.php?verification_token='
             . urlencode($verificationToken);

header('Location: ' . $redirectUrl);
exit;

// age-verification-webhook.php
$payload = json_decode(file_get_contents('php://input'), true);

if ($payload['status'] === 'approved') {
    $userId = $payload['client_reference'];  // your internal user ID
    // Grant access in your database
    markUserAgeVerified($userId);
} elseif ($payload['status'] === 'rejected') {
    $userId = $payload['client_reference'];
    // User failed the age check — restrict or notify
    restrictUserAccess($userId);
}

// Always respond 200 to acknowledge receipt
http_response_code(200);
echo json_encode(['received' => true]);

// --- Authenticate the user ---
$accessToken = $YourApp->checkInput($_COOKIE['accessToken']);

if (empty($accessToken)) {
    header('Location: /signin.php?error=session_expired');
    exit;
}

$userId = $YourApp->getUserIdByAccessToken($accessToken);

if (empty($userId)) {
    header('Location: /signin.php?error=user_not_found');
    exit;
}

// --- Generate and store the CSRF state token ---
$state = bin2hex(random_bytes(16));

setcookie('age_verification_state', $state, [
    'expires'  => time() + 900,
    'path'     => '/',
    'secure'   => true,
    'httponly' => true,
    'samesite' => 'Lax',
]);

// --- Call the ProntoID API gateway ---
$API_ENDPOINT = 'https://uxvq4ew6td.execute-api.us-east-1.amazonaws.com/production/verification-start';
$API_KEY      = '••••••••••••••••••••••••••'; // load from env / secrets manager
$PLATFORM_ID  = 'yourplatform_xxxxxxxxxxxx';

$curl = curl_init($API_ENDPOINT);
curl_setopt($curl, CURLOPT_POST,           true);
curl_setopt($curl, CURLOPT_POSTFIELDS,    json_encode([
    'client_reference' => $userId,
    'state'            => $state,
]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'x-api-key: '      . $API_KEY,
    'x-platform-id: ' . $PLATFORM_ID,
]);

try {
    $response = curl_exec($curl);

    if (curl_errno($curl)) {
        throw new Exception(curl_error($curl));
    }

    $http_status   = curl_getinfo($curl, CURLINFO_HTTP_CODE);
    $response_data = json_decode($response, true);

    if ($http_status >= 200 && $http_status < 300
        && isset($response_data['verification_token'])) {

        $verificationToken = $response_data['verification_token'];
        $platform          = 'yourplatform';

        // Persist the token — match it to the user when the webhook arrives
        $YourApp->saveAgeVerificationToken($userId, $verificationToken, $platform);

        // Build the ProntoID redirect URL
        $redirectUrl = 'https://verify.prontoid.com/api/open_platform_session.php'
                     . '?verification_token=' . urlencode($verificationToken);
    } else {
        $errorMessage = $response_data['message'] ?? 'Unknown error occurred.';
        throw new Exception('API Gateway Error: ' . $errorMessage);
    }
} catch (Exception $e) {
    $hasError     = true;
    $errorDetails = $e->getMessage();
} finally {
    curl_close($curl);
}

<?php if (isset($hasError) && $hasError): ?>

    <!-- ── Error state ── -->
    <h1>Verification Error</h1>
    <p>We encountered an issue while initiating your age verification.</p>
    <div class="error-container">
        <div class="error-heading">Error Details:</div>
        <div class="error-text"><?= htmlspecialchars($errorDetails) ?></div>
    </div>
    <a href="<?= htmlspecialchars($_SERVER['PHP_SELF']) ?>">Try Again</a>

<?php else: ?>

    <!-- ── Success state: spinner + manual fallback ── -->
    <div class="spinner"></div>
    <h1>Redirecting to ProntoID...</h1>
    <p>Please wait while we securely redirect you to complete your age verification.</p>

    <ul>
        <li>You'll be taken to ProntoID's secure platform</li>
        <li>Complete a quick identity verification</li>
        <li>Return to your platform automatically when done</li>
    </ul>

    <p>Not redirecting automatically?</p>
    <a href="<?= htmlspecialchars($redirectUrl) ?>">Click Here to Continue</a>

<?php endif; ?>

<!-- Auto-redirect after 2 s, with click-anywhere fallback -->
<?php if (!isset($hasError)): ?>
<script>
    setTimeout(function() {
        window.location.href = <?= json_encode($redirectUrl) ?>;
    }, 2000);

    // Clicking anywhere also triggers the redirect immediately
    document.addEventListener('click', function() {
        window.location.href = <?= json_encode($redirectUrl) ?>;
    });
</script>
<?php endif; ?>

{
  "event":            "age_verification.completed",
  "verification_token": "vt_…",
  "client_reference": "user_abc123",
  "status":           "approved",  // "approved" | "rejected" | "pending_review"
  "state":            "a3f8c2d1e4b7",
  "age_confirmed":    true,         // true = met minimum age threshold
  "completed_at":     1735430400,
  "checks": {
    "id_document": "passed",
    "liveness":    "passed",
    "face_match":  "passed"
  }
}