Proof of Uniqueness Verification

[
  {
    "circuitId": "credentialAtomicQuerySigV2",
    "id": "<sessionId>",
    "query": {
      "allowedIssuers": ["<PoU issuer DID>"],
      "context": "<PoU schema context>",
      "type": "UniquenessCredential"
    }
  }
]

require('dotenv').config();
const express = require("express");
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');
const { auth, resolver } = require("@iden3/js-iden3-auth");
const { randomInt } = require('crypto');
const { v4: uuidv4 } = require('uuid');

const app = express();
const port = process.env.PORT || 8080;

app.use(helmet());
app.use(cors({ origin: '*' })); // restrict to your frontend's origin in production
app.use(rateLimit({ windowMs: 60 * 1000, max: 100 }));
app.use(express.json());

const requestMap = new Map();   // sessionId -> authRequest
const statusMap = new Map();    // requestId -> status

app.get("/api/verification-request", async (req, res) => {
  const sessionId = randomInt(10000);
  const uri = `${process.env.HOST_URL}/api/callback?sessionId=${sessionId}`;
  const nullifier = BigInt('0x' + uuidv4().replace(/-/g, '').slice(0, 16));

  const request = auth.createAuthorizationRequest(
    "Verification of Uniqueness",
    process.env.AUDIENCE_DID,
    uri,
  );

  const proofRequest = {
    circuitId: "credentialAtomicQueryV3-beta.1",
    id: sessionId,
    params: { nullifierSessionId: nullifier.toString() },
    query: {
      allowedIssuers: [process.env.ALLOWED_ISSUER],
      context: process.env.POU_SCHEMA_CONTEXT,
      type: "UniquenessCredential",
    },
  };

  request.body.scope = [proofRequest];
  requestMap.set(sessionId, request);
  statusMap.set(sessionId, "pending");

  res.status(200).json(request);
});

app.get("/api/status/:id", (req, res) => {
  const status = statusMap.get(parseInt(req.params.id)) || "not_found";
  res.status(200).json({ requestId: req.params.id, status });
});

app.listen(port, () => console.log(`Verifier backend running on port ${port}`));

const getRawBody = require("raw-body");
const { CircuitId, AtomicQueryV3PubSignals } = require('@0xpolygonid/js-sdk');
const byteEncoder = new TextEncoder();

const userVerificationMap = new Map(); // nullifier -> { sessionId, verified }

app.post("/api/callback", async (req, res) => {
  const sessionId = parseInt(req.query.sessionId);
  const authRequest = requestMap.get(sessionId);
  if (!authRequest) {
    return res.status(400).json({ error: "Invalid or expired sessionId" });
  }

  const tokenStr = (await getRawBody(req)).toString().trim();

  const resolvers = {
    ["billions:main"]: new resolver.EthStateResolver(
      process.env.BILLIONS_RPC_URL,
      process.env.BILLIONS_CONTRACT,
    ),
    ["privado:main"]: new resolver.EthStateResolver(
      process.env.PRIVADO_RPC_URL,
      process.env.PRIVADO_CONTRACT,
    ),
  };

  const verifier = await auth.Verifier.newVerifier({
    stateResolver: resolvers,
    ipfsGatewayURL: process.env.IPFS_GATEWAY || "https://ipfs.io",
  });

  try {
    const authResponse = await verifier.fullVerify(tokenStr, authRequest, {
      AcceptedStateTransitionDelay: 5 * 60 * 1000,
    });

    const proof = authResponse.body.scope.find(
      (s) => s.circuitId === CircuitId.AtomicQueryV3 && s.id === sessionId,
    );
    if (!proof) {
      return res.status(400).json({ error: "No valid proof found in response." });
    }

    const pubSignals = new AtomicQueryV3PubSignals().pubSignalsUnmarshal(
      byteEncoder.encode(JSON.stringify(proof.pub_signals)),
    );
    const { nullifier } = pubSignals;

    if (userVerificationMap.get(nullifier)?.verified) {
      return res.status(400).json({ message: "This person has already verified." });
    }

    userVerificationMap.set(nullifier, { sessionId, verified: true });
    statusMap.set(sessionId, "success");

    res.status(200).json(authResponse);
  } catch (error) {
    res.status(500).json({ error: error.message });
  }
});