Auth0 Identity Verification — Identity Verification and Proofing

// Email verification configuration
const connection = await auth0.connections.update(
  { id: 'con_username_password' },
  {
    options: {
      passwordPolicy: 'good',
      requires_username: false,
      validation: {
        email: {
          enabled: true,
          verification: {
            enabled: true,
            time: 86400  // 24 hours to verify
          }
        }
      }
    }
  }
);

// Trigger email verification via Action
exports.onExecutePostLogin = async (event, api) => {
  if (!event.user.email_verified && event.user.identities[0].provider === 'auth0') {
    api.authentication.redirect({
      url: `https://{tenant}.auth0.com/lo/resend?email=${event.user.email}`
    });
  }
};

// Verify identity level before sensitive operations
async function requireVerifiedIdentity(req, res, next) {
  const token = req.headers.authorization.split(' ')[1];
  const decoded = jwt.decode(token);

  if (!decoded.email_verified) {
    return res.status(403).json({
      error: 'identity_verification_required',
      message: 'Please verify your email before running sensitive scans'
    });
  }

  if (decoded.phone_verified !== true && req.body.scan_type === 'deep') {
    return res.status(403).json({
      error: 'phone_verification_required',
      message: 'Deep scans require phone verification'
    });
  }

  next();
}