Wire Transfer Authorization

async function requireStepUp(transfer, user) {
  const res = await fetch('https://api.facesign.ai/sessions', {
    method: 'POST',
    headers: {
      Authorization: `Bearer ${process.env.FACESIGN_API_KEY}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      clientReferenceId: `txn-${transfer.id}-user-${user.id}`,
      metadata: {
        transferAmount: transfer.amount,
        transferCurrency: transfer.currency,
        recipientName: transfer.recipient.name,
        recipientAccount: transfer.recipient.maskedAccount,
        riskScore: transfer.riskScore,
      },
      providedData: {
        email: user.email,
      },
      flow: [
        { id: 'start', type: 'start', outcome: 'greeting' },
        {
          id: 'greeting',
          type: 'conversation',
          prompt:
            "Say: Hi! I'm verifying a wire transfer on your account. First I'll take a quick look to confirm it's really you, then we'll go over the transfer details.",
          outcomes: [{ id: 'next', targetNodeId: 'liveness', condition: '' }],
        },
        {
          id: 'liveness',
          type: 'liveness_detection',
          outcomes: {
            livenessDetected: 'confirm_transfer',
            deepfakeDetected: 'closing',
            noFace: 'closing',
          },
        },
        {
          id: 'confirm_transfer',
          type: 'conversation',
          prompt: `Say: I need to verify a wire transfer on your account. You're requesting a transfer of $${transfer.amount} ${transfer.currency} to ${transfer.recipient.name}, account ending in ${transfer.recipient.maskedAccount}. Can you confirm you're authorizing this transfer?`,
          outcomes: [
            {
              id: 'confirmed',
              targetNodeId: 'email_otp',
              condition: 'The user explicitly confirmed they authorize this transfer',
            },
            {
              id: 'denied',
              targetNodeId: 'closing',
              condition:
                'The user declined, said this is not their transfer, or disputed any of the details',
            },
            {
              id: 'stall',
              targetNodeId: 'closing',
              condition: 'Conversation reached 4 exchanges with no clear answer',
            },
          ],
        },
        {
          id: 'email_otp',
          type: 'two_factor_email',
          otpLength: 6,
          expirySeconds: 300,
          outcomes: {
            verified: 'closing',
            delivery_failed: 'closing',
            failed_unverified: 'closing',
            cancelled: 'closing',
          },
        },
        {
          id: 'closing',
          type: 'conversation',
          prompt:
            'Thank the user for completing the verification and tell them the session is now complete. Keep it to one sentence.',
          doesNotRequireReply: true,
          outcomes: [{ id: 'done', targetNodeId: 'end', condition: '' }],
        },
        { id: 'end', type: 'end' },
      ],
      videoAIAnalysisEnabled: true,
    }),
  })

  const { session, clientSecret } = await res.json()

  // Store the session ID against the pending transfer
  await db.transfers.update(transfer.id, {
    status: 'pending_verification',
    facesignSessionId: session.id,
  })

  // Hand this URL to the frontend and embed it as an iframe `src` so
  // verification runs inline on your domain. Only redirect the user to
  // it directly if an iframe is not an option.
  return clientSecret.url
}

import os
import requests

def require_step_up(transfer, user):
    res = requests.post(
        "https://api.facesign.ai/sessions",
        headers={
            "Authorization": f"Bearer {os.environ['FACESIGN_API_KEY']}",
            "Content-Type": "application/json",
        },
        json={
            "clientReferenceId": f"txn-{transfer['id']}-user-{user['id']}",
            "metadata": {
                "transferAmount": transfer["amount"],
                "transferCurrency": transfer["currency"],
                "recipientName": transfer["recipient"]["name"],
                "recipientAccount": transfer["recipient"]["masked_account"],
                "riskScore": transfer["risk_score"],
            },
            "providedData": {
                "email": user["email"],
            },
            "flow": [
                {"id": "start", "type": "start", "outcome": "greeting"},
                {
                    "id": "greeting",
                    "type": "conversation",
                    "prompt": (
                        "Say: Hi! I'm verifying a wire transfer on your account. "
                        "First I'll take a quick look to confirm it's really you, "
                        "then we'll go over the transfer details."
                    ),
                    "outcomes": [
                        {"id": "next", "targetNodeId": "liveness", "condition": ""}
                    ],
                },
                {
                    "id": "liveness",
                    "type": "liveness_detection",
                    "outcomes": {
                        "livenessDetected": "confirm_transfer",
                        "deepfakeDetected": "closing",
                        "noFace": "closing",
                    },
                },
                {
                    "id": "confirm_transfer",
                    "type": "conversation",
                    "prompt": (
                        f"Say: I need to verify a wire transfer on your account. "
                        f"You're requesting a transfer of ${transfer['amount']} "
                        f"{transfer['currency']} to {transfer['recipient']['name']}, "
                        f"account ending in {transfer['recipient']['masked_account']}. "
                        f"Can you confirm you're authorizing this transfer?"
                    ),
                    "outcomes": [
                        {
                            "id": "confirmed",
                            "targetNodeId": "email_otp",
                            "condition": "The user explicitly confirmed they authorize this transfer",
                        },
                        {
                            "id": "denied",
                            "targetNodeId": "closing",
                            "condition": "The user declined, said this is not their transfer, or disputed any of the details",
                        },
                        {
                            "id": "stall",
                            "targetNodeId": "closing",
                            "condition": "Conversation reached 4 exchanges with no clear answer",
                        },
                    ],
                },
                {
                    "id": "email_otp",
                    "type": "two_factor_email",
                    "otpLength": 6,
                    "expirySeconds": 300,
                    "outcomes": {
                        "verified": "closing",
                        "delivery_failed": "closing",
                        "failed_unverified": "closing",
                        "cancelled": "closing",
                    },
                },
                {
                    "id": "closing",
                    "type": "conversation",
                    "prompt": (
                        "Thank the user for completing the verification and "
                        "tell them the session is now complete. Keep it to one sentence."
                    ),
                    "doesNotRequireReply": True,
                    "outcomes": [
                        {"id": "done", "targetNodeId": "end", "condition": ""}
                    ],
                },
                {"id": "end", "type": "end"},
            ],
            "videoAIAnalysisEnabled": True,
        },
    )

    data = res.json()
    session = data["session"]
    client_secret = data["clientSecret"]

    # Store the session ID against the pending transfer
    db.transfers.update(
        transfer["id"],
        status="pending_verification",
        facesign_session_id=session["id"],
    )

    # Hand this URL to the frontend and embed it as an iframe `src` so
    # verification runs inline on your domain. Only redirect the user to
    # it directly if an iframe is not an option.
    return client_secret["url"]

import crypto from 'node:crypto'

// Verify an HMAC-SHA256 signature of the form `t=<timestamp>,v1=<hex>`
// over `${timestamp}.${rawBody}`, using the webhook secret from the
// FaceSign dashboard. Reject any request whose signature doesn't match.
function verifyFacesignSignature(rawBody, signatureHeader, secret) {
  if (!signatureHeader) return false
  const parts = Object.fromEntries(
    signatureHeader.split(',').map((p) => p.split('='))
  )
  if (!parts.t || !parts.v1) return false
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${parts.t}.${rawBody}`, 'utf8')
    .digest('hex')
  try {
    return crypto.timingSafeEqual(
      Buffer.from(parts.v1, 'hex'),
      Buffer.from(expected, 'hex')
    )
  } catch {
    return false
  }
}

export async function POST(req) {
  // Read the raw body before parsing — signature is computed over the
  // exact bytes we received.
  const rawBody = await req.text()
  const signature = req.headers.get('x-facesign-signature')

  if (!verifyFacesignSignature(rawBody, signature, process.env.FACESIGN_WEBHOOK_SECRET)) {
    return new Response('Invalid signature', { status: 401 })
  }

  const event = JSON.parse(rawBody)

  if (event.type !== 'session.status') {
    return Response.json({ received: true })
  }

  // Fetch the full session to get node reports. GET /sessions/:id
  // returns `{ session, clientSecret }`.
  const sessionRes = await fetch(
    `https://api.facesign.ai/sessions/${event.sessionId}`,
    {
      headers: {
        Authorization: `Bearer ${process.env.FACESIGN_API_KEY}`,
      },
    }
  )
  const { session } = await sessionRes.json()

  // Find the pending transfer
  const transfer = await db.transfers.findBy({
    facesignSessionId: event.sessionId,
  })

  if (!transfer) {
    return Response.json({ received: true })
  }

  // Decide: authorize or block
  const livenessReport = session.report?.nodeReports
    ?.find((r) => r.nodeId === 'liveness')
  const otpReport = session.report?.nodeReports
    ?.find((r) => r.nodeId === 'email_otp')

  const livenessPass = livenessReport?.outcome === 'livenessDetected'
  const otpPass = otpReport?.outcome === 'verified'
  const sessionComplete = session.status === 'complete'

  if (sessionComplete && livenessPass && otpPass) {
    await db.transfers.update(transfer.id, { status: 'authorized' })
    await transferService.execute(transfer.id)
  } else {
    await db.transfers.update(transfer.id, { status: 'blocked' })
    await alerting.notify('wire_blocked', {
      transferId: transfer.id,
      reason: !livenessPass ? 'liveness_failed' : 'otp_failed',
    })
  }

  return Response.json({ received: true })
}

import hmac, hashlib, json, os
from flask import Flask, request, jsonify, abort
import requests

app = Flask(__name__)


def verify_facesign_signature(raw_body: bytes, signature_header: str, secret: str) -> bool:
    """HMAC-SHA256 of ``{timestamp}.{raw_body}`` must match ``v1`` in the header."""
    if not signature_header:
        return False
    try:
        parts = dict(p.split("=", 1) for p in signature_header.split(","))
    except ValueError:
        return False
    if "t" not in parts or "v1" not in parts:
        return False
    expected = hmac.new(
        secret.encode("utf-8"),
        f"{parts['t']}.".encode("utf-8") + raw_body,
        hashlib.sha256,
    ).hexdigest()
    return hmac.compare_digest(parts["v1"], expected)


@app.route("/webhooks/facesign", methods=["POST"])
def handle_webhook():
    # Read the raw body before parsing — signature is computed over the
    # exact bytes we received.
    raw_body = request.get_data()
    signature = request.headers.get("X-FaceSign-Signature")

    if not verify_facesign_signature(
        raw_body, signature, os.environ["FACESIGN_WEBHOOK_SECRET"]
    ):
        abort(401, description="Invalid signature")

    event = json.loads(raw_body)

    if event["type"] != "session.status":
        return jsonify({"received": True}), 200

    # Fetch the full session to get node reports. GET /sessions/:id
    # returns {"session": ..., "clientSecret": ...}.
    session_res = requests.get(
        f"https://api.facesign.ai/sessions/{event['sessionId']}",
        headers={
            "Authorization": f"Bearer {os.environ['FACESIGN_API_KEY']}",
        },
    )
    session = session_res.json()["session"]

    # Find the pending transfer
    transfer = db.transfers.find_by(
        facesign_session_id=event["sessionId"]
    )

    if not transfer:
        return jsonify({"received": True}), 200

    # Decide: authorize or block
    node_reports = (session.get("report") or {}).get("nodeReports") or []
    liveness_report = next(
        (r for r in node_reports if r["nodeId"] == "liveness"), None
    )
    otp_report = next(
        (r for r in node_reports if r["nodeId"] == "email_otp"), None
    )

    liveness_pass = liveness_report and liveness_report.get("outcome") == "livenessDetected"
    otp_pass = otp_report and otp_report.get("outcome") == "verified"
    session_complete = session["status"] == "complete"

    if session_complete and liveness_pass and otp_pass:
        db.transfers.update(transfer["id"], status="authorized")
        transfer_service.execute(transfer["id"])
    else:
        db.transfers.update(transfer["id"], status="blocked")
        alerting.notify(
            "wire_blocked",
            transfer_id=transfer["id"],
            reason="liveness_failed" if not liveness_pass else "otp_failed",
        )

    return jsonify({"received": True}), 200