Comprehensive comparison for Authentication technology in Software Development applications

const express = require('express');
const axios = require('axios');
const crypto = require('crypto');

const app = express();
app.use(express.json());

// IDnow Configuration
const IDNOW_API_URL = process.env.IDNOW_API_URL || 'https://gateway.test.idnow.de';
const IDNOW_COMPANY_ID = process.env.IDNOW_COMPANY_ID;
const IDNOW_API_KEY = process.env.IDNOW_API_KEY;

// Generate HMAC signature for webhook verification
function verifyWebhookSignature(payload, signature, secret) {
  const hmac = crypto.createHmac('sha256', secret);
  hmac.update(JSON.stringify(payload));
  const expectedSignature = hmac.digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(expectedSignature)
  );
}

// Initialize IDnow identification session
app.post('/api/auth/identity-verification/start', async (req, res) => {
  try {
    const { userId, email, firstName, lastName } = req.body;

    if (!userId || !email || !firstName || !lastName) {
      return res.status(400).json({ error: 'Missing required fields' });
    }

    // Create identification request
    const identificationData = {
      companyid: IDNOW_COMPANY_ID,
      transactionid: `txn_${userId}_${Date.now()}`,
      firstname: firstName,
      lastname: lastName,
      email: email,
      custom1: userId,
      successurl: `${process.env.APP_URL}/verification/success`,
      errorurl: `${process.env.APP_URL}/verification/error`,
      aborturl: `${process.env.APP_URL}/verification/abort`
    };

    const response = await axios.post(
      `${IDNOW_API_URL}/api/v1/${IDNOW_COMPANY_ID}/identifications`,
      identificationData,
      {
        headers: {
          'X-API-KEY': IDNOW_API_KEY,
          'Content-Type': 'application/json'
        },
        timeout: 10000
      }
    );

    // Store transaction ID in database for later verification
    // await db.saveVerificationSession(userId, response.data.id);

    res.status(200).json({
      success: true,
      identificationUrl: response.data.identificationurl,
      transactionId: response.data.id
    });
  } catch (error) {
    console.error('IDnow identification start error:', error.response?.data || error.message);
    res.status(500).json({
      error: 'Failed to initiate identity verification',
      details: error.response?.data?.errors || error.message
    });
  }
});

// Webhook endpoint to receive IDnow verification results
app.post('/api/webhooks/idnow', async (req, res) => {
  try {
    const signature = req.headers['x-idnow-signature'];
    const webhookSecret = process.env.IDNOW_WEBHOOK_SECRET;

    // Verify webhook authenticity
    if (!verifyWebhookSignature(req.body, signature, webhookSecret)) {
      console.warn('Invalid IDnow webhook signature');
      return res.status(401).json({ error: 'Invalid signature' });
    }

    const { identificationprocess, result, transactionid, custom1 } = req.body;
    const userId = custom1;

    // Process verification result
    switch (result) {
      case 'SUCCESS':
        // Update user verification status
        // await db.updateUserVerificationStatus(userId, 'verified', transactionid);
        console.log(`User ${userId} successfully verified`);
        break;

      case 'FRAUD_SUSPICION_CONFIRMED':
      case 'ABORTED':
        // await db.updateUserVerificationStatus(userId, 'failed', transactionid);
        console.log(`User ${userId} verification failed: ${result}`);
        break;

      default:
        console.log(`Unknown verification result: ${result}`);
    }

    res.status(200).json({ received: true });
  } catch (error) {
    console.error('IDnow webhook processing error:', error);
    res.status(500).json({ error: 'Webhook processing failed' });
  }
});

// Check verification status
app.get('/api/auth/identity-verification/status/:transactionId', async (req, res) => {
  try {
    const { transactionId } = req.params;

    const response = await axios.get(
      `${IDNOW_API_URL}/api/v1/${IDNOW_COMPANY_ID}/identifications/${transactionId}`,
      {
        headers: {
          'X-API-KEY': IDNOW_API_KEY
        },
        timeout: 10000
      }
    );

    res.status(200).json({
      status: response.data.result,
      identificationProcess: response.data.identificationprocess,
      reason: response.data.reason
    });
  } catch (error) {
    console.error('IDnow status check error:', error.response?.data || error.message);
    res.status(500).json({ error: 'Failed to check verification status' });
  }
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`IDnow authentication service running on port ${PORT}`);
});