Auth0 Post-Login Action

/**
 * Auth0 Post-Login Action — Incode Identity Verification (OIDC)
 * Trigger: post-login
 */

const DEFAULT_AUTH_SERVER = "https://auth.demo.incode.com";

function needsVerification(event, reverificationHours) {
  const meta = event.user.app_metadata || {};
  if (!meta.incode_idv_completed) return true;
  const lastVerified = meta.incode_idv_completed_at;
  if (!lastVerified) return true;
  if (reverificationHours === 0) return false;
  const hoursSince = (Date.now() - new Date(lastVerified).getTime()) / 36e5;
  return hoursSince >= reverificationHours;
}

async function exchangeCodeForTokens(code, redirectUri, tokenEndpoint, event) {
  const body = new URLSearchParams({
    grant_type:    "authorization_code",
    code,
    redirect_uri:  redirectUri,
    client_id:     event.secrets.INCODE_CLIENT_ID,
    client_secret: event.secrets.INCODE_CLIENT_SECRET,
  });
  const resp = await fetch(tokenEndpoint, {
    method:  "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded", "Accept": "application/json" },
    body: body.toString(),
  });
  if (!resp.ok) {
    const err = await resp.text();
    throw new Error(`Incode token exchange failed (${resp.status}): ${err}`);
  }
  return resp.json();
}

async function fetchUserInfo(accessToken, userInfoEndpoint) {
  const resp = await fetch(userInfoEndpoint, {
    headers: { Authorization: `Bearer ${accessToken}` },
  });
  if (!resp.ok) {
    const err = await resp.text();
    throw new Error(`Incode userinfo fetch failed (${resp.status}): ${err}`);
  }
  return resp.json();
}

exports.onExecutePostLogin = async (event, api) => {
  const authServer          = event.secrets.INCODE_SERVER_URL || DEFAULT_AUTH_SERVER;
  const authEndpoint        = `${authServer}/oauth2/authorize`;
  const reverificationHours = parseFloat(event.secrets.REVERIFICATION_HOURS || "720");
  const scopes              = event.secrets.SCOPES || "openid";
  const auth0Domain         = event.secrets.AUTH0_DOMAIN;
  const blockOnFailure      = (event.secrets.BLOCK_ON_FAILURE || "false").toLowerCase() === "true";

  if (!needsVerification(event, reverificationHours)) {
    const meta = event.user.app_metadata || {};
    if (meta.incode_idv) {
      api.idToken.setCustomClaim("https://incode.com/idv", meta.incode_idv);
    }
    return;
  }

  const redirectUri      = `https://${auth0Domain}/continue`;
  const storedIdentityId = (event.user.app_metadata || {}).incode_identity_id || null;
  const loginHint        = storedIdentityId || event.user.email || null;

  let sessionToken;
  try {
    sessionToken = api.redirect.encodeToken({
      secret:           event.secrets.REDIRECT_SECRET,
      expiresInSeconds: 3600,
      payload: { userId: event.user.user_id },
    });
  } catch (err) {
    console.error("[Incode IDV] encodeToken failed:", err.message);
    if (blockOnFailure) api.access.deny("identity_verification_failed");
    return;
  }

  const authParams = new URLSearchParams({
    response_type: "code",
    client_id:     event.secrets.INCODE_CLIENT_ID,
    redirect_uri:  redirectUri,
    scope:         scopes,
    state:         sessionToken,
    ...(loginHint ? { login_hint: loginHint } : {}),
  });

  api.redirect.sendUserTo(`${authEndpoint}?${authParams.toString()}`);
};

exports.onContinuePostLogin = async (event, api) => {
  const authServer       = event.secrets.INCODE_SERVER_URL || DEFAULT_AUTH_SERVER;
  const tokenEndpoint    = `${authServer}/oauth2/token`;
  const userInfoEndpoint = `${authServer}/userinfo`;
  const blockOnFailure   = (event.secrets.BLOCK_ON_FAILURE || "false").toLowerCase() === "true";
  const auth0Domain      = event.secrets.AUTH0_DOMAIN;
  const redirectUri      = `https://${auth0Domain}/continue`;

  const rawCode             = event.request?.query?.code;
  const rawError            = event.request?.query?.error;
  const rawErrorDescription = event.request?.query?.error_description;

  if (!rawCode) {
    console.error("[Incode IDV] No code returned. Error:", rawError, rawErrorDescription);
    api.user.setAppMetadata("incode_idv_completed", false);
    api.user.setAppMetadata("incode_idv_error", rawError
      ? `${rawError}: ${rawErrorDescription}`
      : "no_code_returned"
    );
    if (blockOnFailure) api.access.deny("identity_verification_failed");
    return;
  }

  let tokenResponse;
  try {
    tokenResponse = await exchangeCodeForTokens(rawCode, redirectUri, tokenEndpoint, event);
  } catch (err) {
    console.error("[Incode IDV] Token exchange error:", err.message);
    api.user.setAppMetadata("incode_idv_completed", false);
    api.user.setAppMetadata("incode_idv_error", err.message);
    if (blockOnFailure) api.access.deny("identity_verification_failed");
    return;
  }

  let userInfo = {};
  try {
    userInfo = await fetchUserInfo(tokenResponse.access_token, userInfoEndpoint);
  } catch (err) {
    console.warn("[Incode IDV] UserInfo fetch failed (non-fatal):", err.message);
  }

  let idTokenClaims = {};
  try {
    const idTokenPayload = tokenResponse.id_token.split(".")[1];
    idTokenClaims = JSON.parse(Buffer.from(idTokenPayload, "base64url").toString("utf8"));
  } catch (err) {
    console.warn("[Incode IDV] ID token parse failed (non-fatal):", err.message);
  }

  const now         = new Date().toISOString();
  const interviewId = idTokenClaims.interview_id || userInfo.interview_id || null;
  const identityId  = idTokenClaims.identity_id  || userInfo.identity_id  || userInfo.sub || null;

  const pii = {
    ...(userInfo.name         ? { name:         userInfo.name }         : {}),
    ...(userInfo.given_name   ? { given_name:   userInfo.given_name }   : {}),
    ...(userInfo.family_name  ? { family_name:  userInfo.family_name }  : {}),
    ...(userInfo.birthdate    ? { birthdate:    userInfo.birthdate }    : {}),
    ...(userInfo.email        ? { email:        userInfo.email }        : {}),
    ...(userInfo.phone_number ? { phone_number: userInfo.phone_number } : {}),
    ...(userInfo.address      ? { address:      userInfo.address }      : {}),
  };

  api.user.setAppMetadata("incode_idv", {
    id_token:            tokenResponse.id_token     || null,
    access_token:        tokenResponse.access_token || null,
    token_type:          tokenResponse.token_type   || null,
    expires_in:          tokenResponse.expires_in   || null,
    interview_id:        interviewId,
    identity_id:         identityId,
    auth_overall_score:  idTokenClaims.auth_overall_score  || null,
    auth_overall_status: idTokenClaims.auth_overall_status || null,
    pii,
    userinfo:            userInfo,
  });

  api.user.setAppMetadata("incode_idv_completed",    true);
  api.user.setAppMetadata("incode_idv_completed_at", now);
  api.user.setAppMetadata("incode_idv_error",        null);

  if (interviewId) api.user.setAppMetadata("incode_interview_id", interviewId);
  if (identityId)  api.user.setAppMetadata("incode_identity_id",  identityId);

  api.idToken.setCustomClaim("https://incode.com/idv", {
    completed:           true,
    completed_at:        now,
    interview_id:        interviewId,
    identity_id:         identityId,
    auth_overall_score:  idTokenClaims.auth_overall_score  || null,
    auth_overall_status: idTokenClaims.auth_overall_status || null,
    pii,
  });
};

crypto.getRandomValues(new Uint8Array(32)).reduce((a,b) => a + b.toString(16).padStart(2,'0'), '')

{
  "incode_idv_completed": true,
  "incode_idv_completed_at": "2026-04-07T17:28:25.150Z",
  "incode_interview_id": "69d53e7a...",
  "incode_identity_id": "69d52eca...",
  "incode_idv": {
    "interview_id": "69d53e7a...",
    "identity_id": "69d52eca...",
    "auth_overall_score": "100.0",
    "auth_overall_status": "OK",
    "pii": {},
    "userinfo": { "sub": "69d53e7a..." }
  }
}

{
  "completed": true,
  "completed_at": "2026-04-07T17:28:25.150Z",
  "interview_id": "69d53e7a...",
  "identity_id": "69d52eca...",
  "auth_overall_score": "100.0",
  "auth_overall_status": "OK"
}