在后端验证

import express from "express";

const app = express();
app.use(express.json());

const CHECKIFY_API_KEY = process.env.CHECKIFY_API_KEY;
const CHECKIFY_BASE_URL = process.env.CHECKIFY_BASE_URL || "https://checkify.me";

async function verifyCheckifyResult(requestId, requiredClaims = ["human_verified"]) {
  const controller = new AbortController();
  const timeout = setTimeout(() => controller.abort(), 10000);

  try {
    const res = await fetch(`${CHECKIFY_BASE_URL}/v1/qr/results/verify`, {
      method: "POST",
      headers: {
        Authorization: `Bearer ${CHECKIFY_API_KEY}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({
        request_id: requestId,
        required_claims: requiredClaims,
        consume: true,
      }),
      signal: controller.signal,
    });

    let body = null;
    try {
      body = await res.json();
    } catch {
      body = null;
    }

    if (!res.ok) {
      const details = body?.error?.details || {};
      console.warn("Checkify verification failed", {
        requestId,
        code: body?.error?.code,
        missingClaims: details.missing_claims,
        missingFields: details.missing_fields,
        reason: details.reason,
      });

      return {
        allow: false,
        reason: body?.error?.code || "verification_failed",
        userMessage: "Verification could not be completed for this action.",
      };
    }

    if (!body || body.status === "pending" || body.success === false) {
      return {
        allow: false,
        reason: body?.status || "pending",
        userMessage: "Verification could not be completed for this action.",
      };
    }

    const approved = requiredClaims.every(
      (claim) => body.approved_claims?.[claim] === true
    );

    return {
      allow: approved,
      reason: approved ? "approved" : "verification_failed",
      userMessage: approved
        ? null
        : "Verification could not be completed for this action.",
      result: body,
    };
  } finally {
    clearTimeout(timeout);
  }
}

app.post("/signup", async (req, res) => {
  const requestId = (req.body.checkify_token || "").trim();
  if (!requestId) {
    return res.status(403).json({ error: "Verification required" });
  }

  try {
    const verdict = await verifyCheckifyResult(requestId);
    if (!verdict.allow) {
      return res.status(403).json({ error: verdict.userMessage });
    }
    return res.json({ ok: true });
  } catch (err) {
    console.error("Checkify verification unavailable", err);
    return res.status(403).json({
      error: "Verification is temporarily unavailable. Please try again.",
    });
  }
});

import { Checkify } from "@checkify/server";

const checkify = new Checkify({
  apiKey: process.env.CHECKIFY_SITE_API_KEY,
});

app.post("/signup", async (req, res) => {
  const requestId = String(req.body.checkify_token || "").trim();
  if (!requestId) {
    return res.status(403).json({ error: "Verification required" });
  }

  try {
    const result = await checkify.verifyHuman({ requestId, consume: true });
    if (!result.success || !result.approved) {
      return res.status(403).json({
        error: "Verification could not be completed for this action.",
      });
    }
    return res.json({ ok: true });
  } catch (err) {
    console.error("Checkify verification failed", err);
    return res.status(403).json({
      error: "Verification is temporarily unavailable. Please try again.",
    });
  }
});

import os
import httpx
from fastapi import FastAPI, HTTPException

app = FastAPI()
CHECKIFY_API_KEY = os.environ["CHECKIFY_API_KEY"]
CHECKIFY_BASE_URL = os.getenv("CHECKIFY_BASE_URL", "https://checkify.me")
USER_MESSAGE = "Verification could not be completed for this action."
UNAVAILABLE = "Verification is temporarily unavailable. Please try again."


def verify_checkify_result(request_id: str, required_claims=None) -> dict:
    required_claims = required_claims or ["human_verified"]
    try:
        response = httpx.post(
            f"{CHECKIFY_BASE_URL}/v1/qr/results/verify",
            headers={
                "Authorization": f"Bearer {CHECKIFY_API_KEY}",
                "Content-Type": "application/json",
            },
            json={
                "request_id": request_id,
                "required_claims": required_claims,
                "consume": True,
            },
            timeout=10.0,
        )
    except httpx.RequestError as exc:
        print("Checkify verification unavailable", exc)
        return {"allow": False, "reason": "unavailable", "user_message": UNAVAILABLE}

    try:
        body = response.json()
    except ValueError:
        body = None

    if response.status_code >= 400:
        error = (body or {}).get("error") if isinstance(body, dict) else None
        details = (error or {}).get("details", {})
        print(
            "Checkify verification failed",
            {
                "request_id": request_id,
                "code": (error or {}).get("code"),
                "missing_claims": details.get("missing_claims"),
                "missing_fields": details.get("missing_fields"),
                "reason": details.get("reason"),
            },
        )
        return {
            "allow": False,
            "reason": (error or {}).get("code", "verification_failed"),
            "user_message": USER_MESSAGE,
        }

    if not isinstance(body, dict) or body.get("status") == "pending" or body.get("success") is False:
        return {"allow": False, "reason": "pending", "user_message": USER_MESSAGE}

    approved = all((body.get("approved_claims") or {}).get(claim) is True for claim in required_claims)
    return {
        "allow": approved,
        "reason": "approved" if approved else "verification_failed",
        "user_message": None if approved else USER_MESSAGE,
        "result": body,
    }


@app.post("/signup")
def signup(email: str, checkify_token: str):
    request_id = (checkify_token or "").strip()
    if not request_id:
        raise HTTPException(status_code=403, detail="Verification required")
    verdict = verify_checkify_result(request_id)
    if not verdict["allow"]:
        raise HTTPException(status_code=403, detail=verdict["user_message"])
    return {"ok": True}

<?php

$checkifyApiKey = getenv('CHECKIFY_API_KEY');
$baseUrl = getenv('CHECKIFY_BASE_URL') ?: 'https://checkify.me';

function verify_checkify_result(string $requestId, array $requiredClaims = ['human_verified']): array {
    global $checkifyApiKey, $baseUrl;

    $payload = json_encode([
        'request_id' => $requestId,
        'required_claims' => $requiredClaims,
        'consume' => true,
    ]);

    $ch = curl_init($baseUrl . '/v1/qr/results/verify');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => [
            'Authorization: Bearer ' . $checkifyApiKey,
            'Content-Type: application/json',
        ],
        CURLOPT_POSTFIELDS => $payload,
        CURLOPT_TIMEOUT => 10,
    ]);

    $raw = curl_exec($ch);
    $status = (int) curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);

    if ($raw === false) {
        error_log('Checkify verification unavailable');
        return ['allow' => false, 'user_message' => 'Verification is temporarily unavailable. Please try again.'];
    }

    $body = json_decode($raw ?: 'null', true);

    if ($status >= 400) {
        $error = is_array($body) ? ($body['error'] ?? null) : null;
        $details = is_array($error) ? ($error['details'] ?? []) : [];
        error_log('Checkify verification failed: ' . json_encode([
            'code' => is_array($error) ? ($error['code'] ?? null) : null,
            'missing_claims' => $details['missing_claims'] ?? null,
        ]));
        return ['allow' => false, 'user_message' => 'Verification could not be completed for this action.'];
    }

    if (!is_array($body) || ($body['status'] ?? '') === 'pending' || ($body['success'] ?? true) === false) {
        return ['allow' => false, 'user_message' => 'Verification could not be completed for this action.'];
    }

    foreach ($requiredClaims as $claim) {
        if (($body['approved_claims'][$claim] ?? false) !== true) {
            return ['allow' => false, 'user_message' => 'Verification could not be completed for this action.'];
        }
    }

    return ['allow' => true, 'result' => $body];
}

$requestId = trim($_POST['checkify_token'] ?? '');
if ($requestId === '') {
    http_response_code(403);
    echo json_encode(['error' => 'Verification required']);
    exit;
}

$verdict = verify_checkify_result($requestId);
if (!$verdict['allow']) {
    http_response_code(403);
    echo json_encode(['error' => $verdict['user_message']]);
    exit;
}
// continue protected action...

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
	"strings"
	"time"
)

type verifyResponse struct {
	Success        bool            `json:"success"`
	Status         string          `json:"status"`
	Message        string          `json:"message"`
	ApprovedClaims map[string]bool `json:"approved_claims"`
}

type errorResponse struct {
	Error struct {
		Code    string                 `json:"code"`
		Message string                 `json:"message"`
		Details map[string]interface{} `json:"details"`
	} `json:"error"`
}

func verifyCheckifyResult(requestID string, requiredClaims []string) (bool, string, error) {
	apiKey := os.Getenv("CHECKIFY_API_KEY")
	baseURL := os.Getenv("CHECKIFY_BASE_URL")
	if baseURL == "" {
		baseURL = "https://checkify.me"
	}

	payload, _ := json.Marshal(map[string]interface{}{
		"request_id":      requestID,
		"required_claims": requiredClaims,
		"consume":         true,
	})

	req, err := http.NewRequest(http.MethodPost, baseURL+"/v1/qr/results/verify", bytes.NewReader(payload))
	if err != nil {
		return false, "", err
	}
	req.Header.Set("Authorization", "Bearer "+apiKey)
	req.Header.Set("Content-Type", "application/json")

	client := &http.Client{Timeout: 10 * time.Second}
	res, err := client.Do(req)
	if err != nil {
		return false, "", err
	}
	defer res.Body.Close()

	if res.StatusCode >= 400 {
		var errBody errorResponse
		_ = json.NewDecoder(res.Body).Decode(&errBody)
		fmt.Printf("Checkify verification failed code=%s details=%v\n", errBody.Error.Code, errBody.Error.Details)
		return false, "Verification could not be completed for this action.", nil
	}

	var body verifyResponse
	if err := json.NewDecoder(res.Body).Decode(&body); err != nil {
		return false, "Verification could not be completed for this action.", nil
	}

	if body.Status == "pending" || !body.Success {
		return false, "Verification could not be completed for this action.", nil
	}

	for _, claim := range requiredClaims {
		if !body.ApprovedClaims[claim] {
			return false, "Verification could not be completed for this action.", nil
		}
	}

	return true, "", nil
}

func signupHandler(w http.ResponseWriter, r *http.Request) {
	if r.Method != http.MethodPost {
		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
		return
	}

	if err := r.ParseForm(); err != nil {
		http.Error(w, "invalid form", http.StatusBadRequest)
		return
	}

	requestID := strings.TrimSpace(r.FormValue("checkify_token"))
	if requestID == "" {
		http.Error(w, "Verification required", http.StatusForbidden)
		return
	}

	allowed, message, err := verifyCheckifyResult(requestID, []string{"human_verified"})
	if err != nil {
		fmt.Println("Checkify verification unavailable", err)
		http.Error(w, "Verification is temporarily unavailable. Please try again.", http.StatusForbidden)
		return
	}

	if !allowed {
		http.Error(w, message, http.StatusForbidden)
		return
	}

	w.Header().Set("Content-Type", "application/json")
	w.WriteHeader(http.StatusOK)
	_, _ = w.Write([]byte(`{"ok":true}`))
}

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

var apiKey = Environment.GetEnvironmentVariable("CHECKIFY_API_KEY");
var baseUrl = Environment.GetEnvironmentVariable("CHECKIFY_BASE_URL") ?? "https://checkify.me";

async Task<(bool Allow, string UserMessage)> VerifyCheckifyAsync(string requestId)
{
    using var client = new HttpClient { Timeout = TimeSpan.FromSeconds(10) };
    using var req = new HttpRequestMessage(HttpMethod.Post, $"{baseUrl}/v1/qr/results/verify");
    req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", apiKey);
    req.Content = new StringContent(JsonSerializer.Serialize(new
    {
        request_id = requestId,
        required_claims = new[] { "human_verified" },
        consume = true,
    }), Encoding.UTF8, "application/json");

    HttpResponseMessage res;
    try
    {
        res = await client.SendAsync(req);
    }
    catch (Exception ex)
    {
        Console.Error.WriteLine($"Checkify verification unavailable: {ex.Message}");
        return (false, "Verification is temporarily unavailable. Please try again.");
    }

    var raw = await res.Content.ReadAsStringAsync();
    using var doc = JsonDocument.Parse(string.IsNullOrWhiteSpace(raw) ? "{}" : raw);
    var root = doc.RootElement;

    if (!res.IsSuccessStatusCode)
    {
        if (root.TryGetProperty("error", out var err) && err.TryGetProperty("details", out var details))
        {
            Console.WriteLine($"Checkify verification failed details={details}");
        }
        return (false, "Verification could not be completed for this action.");
    }

    if (root.TryGetProperty("status", out var status) && status.GetString() == "pending")
    {
        return (false, "Verification could not be completed for this action.");
    }

    if (root.TryGetProperty("approved_claims", out var claims)
        && claims.TryGetProperty("human_verified", out var human)
        && human.GetBoolean())
    {
        return (true, string.Empty);
    }

    return (false, "Verification could not be completed for this action.");
}

// In your signup endpoint:
// var requestId = form["checkify_token"];
// var (allow, message) = await VerifyCheckifyAsync(requestId);
// if (!allow) return Results.Forbid();

import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.ObjectMapper;
import java.net.URI;
import java.net.http.*;
import java.time.Duration;

public class CheckifyVerify {
  private static final String API_KEY = System.getenv("CHECKIFY_API_KEY");
  private static final String BASE_URL =
      System.getenv().getOrDefault("CHECKIFY_BASE_URL", "https://checkify.me");
  private static final ObjectMapper MAPPER = new ObjectMapper();

  static boolean verifyCheckifyResult(String requestId) {
    String payload = "{\"request_id\":\"" + requestId + "\","
        + "\"required_claims\":[\"human_verified\"],\"consume\":true}";

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create(BASE_URL + "/v1/qr/results/verify"))
        .timeout(Duration.ofSeconds(10))
        .header("Authorization", "Bearer " + API_KEY)
        .header("Content-Type", "application/json")
        .POST(HttpRequest.BodyPublishers.ofString(payload))
        .build();

    try {
      HttpResponse<String> response = HttpClient.newHttpClient()
          .send(request, HttpResponse.BodyHandlers.ofString());

      JsonNode root = MAPPER.readTree(response.body() == null ? "{}" : response.body());

      if (response.statusCode() >= 400) {
        System.err.println("Checkify verification failed: " + root);
        return false;
      }

      if ("pending".equals(root.path("status").asText()) || !root.path("success").asBoolean(false)) {
        return false;
      }

      return root.path("approved_claims").path("human_verified").asBoolean(false);
    } catch (Exception ex) {
      System.err.println("Checkify verification unavailable: " + ex.getMessage());
      return false;
    }
  }
}