Verify Verified Human credential

POVH: {
  name: "Verified Human Credential",
  verification_description: "Verify you are a verified human",
  circuitId: CircuitId.AtomicQueryV3Stable,
  query: {
    allowedIssuers: [
      "did:iden3:billions:test:2VxnoiNqdMPxzqp7X6MV7GfoPkDZ7ij499mDZAo72y",
      "did:iden3:billions:test:2VxnoiNqdMPyMXmEKpP8wGqrY6Vb7mgeQQUywyVeWe"
    ],
    context: "ipfs://QmZbsTnRwtCmbdg3r9o7Txid37LmvPcvmzVi1Abvqu1WKL",
    type: "BasicPerson"
  }
}

require('dotenv').config();
const express = require("express");
const helmet = require('helmet');
const cors = require('cors');
const rateLimit = require('express-rate-limit');
const { auth, resolver } = require("@iden3/js-iden3-auth");
const { CircuitId } = require('@0xpolygonid/js-sdk');
const { randomInt } = require('crypto');

const app = express();
const port = process.env.PORT || 8080;

app.use(helmet());
app.use(cors({ origin: '*' })); // restrict to your frontend's origin in production
app.use(rateLimit({ windowMs: 60 * 1000, max: 100 }));
app.use(express.json());

const requestMap = new Map();   // sessionId -> authRequest
const statusMap = new Map();    // requestId -> status

app.get("/api/verification-request", async (req, res) => {
  const sessionId = randomInt(10000);
  const uri = `${process.env.HOST_URL}/api/callback?sessionId=${sessionId}`;

  const request = auth.createAuthorizationRequest(
    "Verify you are a verified human",
    process.env.AUDIENCE_DID,
    uri,
  );

  const proofRequest = {
    circuitId: CircuitId.AtomicQueryV3Stable,
    id: sessionId,
    params: { nullifierSessionId: process.env.NULLIFIER_SESSION_ID }, // fixed per campaign
    query: {
      allowedIssuers: [
        "did:iden3:billions:test:2VxnoiNqdMPxzqp7X6MV7GfoPkDZ7ij499mDZAo72y",
        "did:iden3:billions:test:2VxnoiNqdMPyMXmEKpP8wGqrY6Vb7mgeQQUywyVeWe",
      ],
      context: "ipfs://QmZbsTnRwtCmbdg3r9o7Txid37LmvPcvmzVi1Abvqu1WKL",
      type: "BasicPerson",
    },
  };

  request.body.scope = [proofRequest];
  requestMap.set(sessionId, request);
  statusMap.set(sessionId, "pending");

  res.status(200).json(request);
});

app.get("/api/status/:id", (req, res) => {
  const status = statusMap.get(parseInt(req.params.id)) || "not_found";
  res.status(200).json({ requestId: req.params.id, status });
});

app.listen(port, () => console.log(`Verifier backend running on port ${port}`));

const getRawBody = require("raw-body");
const { CircuitId, AtomicQueryV3PubSignals, getGroupedCircuitIdsWithSubVersions } = require('@0xpolygonid/js-sdk');
const byteEncoder = new TextEncoder();

const userVerificationMap = new Map(); // nullifier -> { sessionId, verified }

app.post("/api/callback", async (req, res) => {
  const sessionId = parseInt(req.query.sessionId);
  const authRequest = requestMap.get(sessionId);
  if (!authRequest) {
    return res.status(400).json({ error: "Invalid or expired sessionId" });
  }

  const tokenStr = (await getRawBody(req)).toString().trim();

  const resolvers = {
    ["billions:main"]: new resolver.EthStateResolver(
      process.env.BILLIONS_RPC_URL,
      process.env.BILLIONS_CONTRACT,
    ),
  };

  const verifier = await auth.Verifier.newVerifier({
    stateResolver: resolvers,
    ipfsGatewayURL: process.env.IPFS_GATEWAY || "https://ipfs.io",
  });

  try {
    const authResponse = await verifier.fullVerify(tokenStr, authRequest, {
      AcceptedStateTransitionDelay: 5 * 60 * 1000,
    });

    const atomicQueryV3Family = getGroupedCircuitIdsWithSubVersions(CircuitId.AtomicQueryV3Stable);
    const nullifierProof = authResponse.body.scope.find(
      (s) => atomicQueryV3Family.includes(s.circuitId) && s.id === sessionId
    );
    if (!nullifierProof) {
      return res.status(400).json({ message: "No valid nullifier proof found in response." });
    }

    const pubSignals = new AtomicQueryV3PubSignals().pubSignalsUnmarshal(
      byteEncoder.encode(JSON.stringify(proof.pub_signals)),
    );
    const { nullifier } = pubSignals;

    if (userVerificationMap.get(nullifier)?.verified) {
      return res.status(400).json({ message: "This person has already verified." });
    }

    userVerificationMap.set(nullifier, { sessionId, verified: true });
    statusMap.set(sessionId, "success");

    res.status(200).json(authResponse);
  } catch (error) {
    res.status(500).json({ error: error.message });
  }
});