Sessions

graph LR
    A[Create Session] --> B[requiresInput]
    B --> C[User Starts Flow]
    C --> D[processing]
    D --> E{Verification}
    E -->|Success| F[complete]
    E -->|Failure| G[complete]
    E -->|User Exits| H[canceled]

app.post('/webhooks/facesign', async (req, res) => {
  const { type, data } = req.body;
  
  if (type === 'session.completed') {
    const session = data.session;
    
    // Update your database
    await db.verifications.update({
      where: { sessionId: session.id },
      data: {
        status: session.status,
        finishedAt: new Date(session.finishedAt * 1000),
        isVerified: session.report?.isVerified || false,
        extractedData: session.report?.extractedData || {}
      }
    });
    
    // Trigger your business logic
    if (session.report?.isVerified) {
      await approveUserAccount(session.settings.clientReferenceId);
      await sendWelcomeEmail(session.settings.clientReferenceId);
    } else {
      await flagUserForReview(session.settings.clientReferenceId);
    }
  }
  
  res.status(200).send('OK');
});

// Create session and store in your DB
const { session, clientSecret } = await client.sessions.create(config);

await db.verifications.create({
  id: generateId(),
  sessionId: session.id,
  userId: userId,
  status: session.status,
  clientReferenceId: session.settings.clientReferenceId,
  createdAt: new Date(session.createdAt * 1000),
  metadata: session.settings.metadata
});

// Return client secret to frontend
return { clientSecret: clientSecret.secret };

// ❌ Don't do this - polling is slow and inefficient
setInterval(async () => {
  const { session } = await client.sessions.retrieve(sessionId);
  updateDatabase(session);
}, 5000);

// ✅ Do this - use webhooks for real-time updates
app.post('/webhooks/facesign', handleWebhook);

async function getValidClientSecret(sessionId: string) {
  const session = await db.verifications.findUnique({
    where: { sessionId }
  });
  
  if (!session.clientSecret || isExpired(session.clientSecretExpiry)) {
    const { clientSecret } = await client.sessions.refreshSecret(sessionId);
    
    await db.verifications.update({
      where: { sessionId },
      data: {
        clientSecret: clientSecret.secret,
        clientSecretExpiry: new Date(clientSecret.expireAt * 1000)
      }
    });
    
    return clientSecret.secret;
  }
  
  return session.clientSecret;
}

const { session, clientSecret } = await client.sessions.create({
  clientReferenceId: user.id, // Your internal user ID
  metadata: {
    email: user.email,
    signupDate: user.createdAt.toISOString(),
    source: 'web_signup'
  },
  modules: [{ type: 'identityVerification' }]
});

// ✅ Query your database
async function getUserVerificationStatus(userId: string) {
  return await db.verifications.findFirst({
    where: { 
      userId,
      status: 'complete'
    },
    orderBy: { createdAt: 'desc' }
  });
}

// Use in your application logic
const verification = await getUserVerificationStatus(userId);
if (verification?.isVerified) {
  // Allow access to premium features
}