Comprehensive comparison for Authentication technology in Software Development applications

const express = require('express');
const { Onfido, Region } = require('@onfido/api');
const jwt = require('jsonwebtoken');

const app = express();
app.use(express.json());

// Initialize Onfido client
const onfido = new Onfido({
  apiToken: process.env.ONFIDO_API_TOKEN,
  region: Region.EU
});

// Middleware to verify JWT token
const authenticateToken = (req, res, next) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ error: 'Access token required' });
  }
  
  jwt.verify(token, process.env.JWT_SECRET, (err, user) => {
    if (err) return res.status(403).json({ error: 'Invalid token' });
    req.user = user;
    next();
  });
};

// Create applicant and generate SDK token for identity verification
app.post('/api/v1/identity/verification/initiate', authenticateToken, async (req, res) => {
  try {
    const { firstName, lastName, email } = req.body;
    
    // Validate required fields
    if (!firstName || !lastName || !email) {
      return res.status(400).json({ 
        error: 'Missing required fields: firstName, lastName, email' 
      });
    }
    
    // Create applicant in Onfido
    const applicant = await onfido.applicant.create({
      firstName,
      lastName,
      email
    });
    
    // Generate SDK token for frontend integration
    const sdkToken = await onfido.sdkToken.generate({
      applicantId: applicant.id,
      referrer: process.env.ALLOWED_REFERRER || '*://localhost:*'
    });
    
    // Store applicant ID with user record (pseudo-code)
    // await database.users.update(req.user.id, { onfidoApplicantId: applicant.id });
    
    res.status(201).json({
      applicantId: applicant.id,
      sdkToken: sdkToken.token,
      expiresAt: new Date(Date.now() + 90 * 60 * 1000).toISOString()
    });
    
  } catch (error) {
    console.error('Onfido applicant creation error:', error);
    
    if (error.response?.status === 422) {
      return res.status(422).json({ 
        error: 'Validation error', 
        details: error.response.data 
      });
    }
    
    res.status(500).json({ 
      error: 'Failed to initiate identity verification',
      message: error.message 
    });
  }
});

// Create check after document upload
app.post('/api/v1/identity/verification/check', authenticateToken, async (req, res) => {
  try {
    const { applicantId } = req.body;
    
    if (!applicantId) {
      return res.status(400).json({ error: 'applicantId is required' });
    }
    
    // Create identity verification check
    const check = await onfido.check.create({
      applicantId,
      reportNames: ['document', 'facial_similarity_photo'],
      asynchronous: true,
      suppressFormEmails: false
    });
    
    res.status(201).json({
      checkId: check.id,
      status: check.status,
      result: check.result,
      reportIds: check.reportIds
    });
    
  } catch (error) {
    console.error('Onfido check creation error:', error);
    res.status(500).json({ 
      error: 'Failed to create verification check',
      message: error.message 
    });
  }
});

// Webhook endpoint to receive verification results
app.post('/webhooks/onfido', express.raw({ type: 'application/json' }), async (req, res) => {
  try {
    const signature = req.headers['x-sha2-signature'];
    
    // Verify webhook signature (production best practice)
    // const isValid = verifyWebhookSignature(req.body, signature, process.env.ONFIDO_WEBHOOK_TOKEN);
    // if (!isValid) return res.status(401).json({ error: 'Invalid signature' });
    
    const payload = JSON.parse(req.body.toString());
    const { resource_type, action, object } = payload;
    
    if (resource_type === 'check' && action === 'check.completed') {
      const checkId = object.id;
      const check = await onfido.check.find(checkId);
      
      // Update user verification status based on check result
      if (check.result === 'clear') {
        // await database.users.update({ onfidoCheckId: checkId }, { verified: true });
        console.log(`User verification successful for check ${checkId}`);
      } else {
        console.log(`User verification failed for check ${checkId}: ${check.result}`);
      }
    }
    
    res.status(200).json({ received: true });
    
  } catch (error) {
    console.error('Webhook processing error:', error);
    res.status(500).json({ error: 'Webhook processing failed' });
  }
});

const PORT = process.env.PORT || 3000;
app.listen(PORT, () => {
  console.log(`Server running on port ${PORT}`);
});