edit documentation for the js package to add session proofs vs request documentation - #320
edit documentation for the js package to add session proofs vs request documentation#320kchaw2005 wants to merge 21 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
kchaw2005
changed the title
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7c0e5e00b8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| }); | ||
|
|
||
| // Return to client | ||
| // Return to client — this is your rp_context payload |
There was a problem hiding this comment.
rp_context payload
When readers follow any of the new /* from your backend */ examples and pass this response directly, the request is malformed: RpContext requires rp_id and a signature property, while this response omits rp_id and exposes the signature as sig. The previous client example performed that mapping, but this commit removes it while labeling this response as the complete payload; return rp_id and signature: sig.sig, or restore the client-side mapping.
Useful? React with 👍 / 👎.
|
|
||
| const { success } = await response.json(); | ||
| ``` | ||
| If `allow_legacy_proofs` is `false`, available v4.0 presets are: `proofOfHuman`, `passport`, `mnc`, `identityCheck` |
There was a problem hiding this comment.
These four presets are not v4-only when allow_legacy_proofs is false: their implementations in rust/core/src/preset.rs all set allow_legacy_proofs_override to Some(true), and the builder applies that override instead of the caller's value. An application following this advice may accept v3 proofs while believing it only needs to track v4 nullifiers, permitting duplicate claims across proof versions; document .constraints(...) as the v4-only path or explicitly state that these presets enable legacy fallback.
Useful? React with 👍 / 👎.
| const sig = signRequest({ | ||
| action: "my-action", | ||
| action: "my-action", // omit for session flows | ||
| signingKeyHex: process.env.RP_SIGNING_KEY!, |
There was a problem hiding this comment.
For the newly added action quickstart, the request uses claim-airdrop-2026, but this backend snippet signs my-action. The action is included in the RP signature message for non-session proofs, so combining the sections as instructed produces an invalid RP signature. Pass the requested action to the signing route or use the same action value in both examples.
Useful? React with 👍 / 👎.
| // environment: string, | ||
| // ... | ||
| // } | ||
| // save result.result.session_id in your DB |
There was a problem hiding this comment.
When the user rejects, the request times out, or polling otherwise fails, pollUntilCompletion() returns the documented { success: false, error } branch and has no result. Following this instruction then dereferences result.result.session_id, causing a runtime error; check result.success before reading or persisting the session, and only store it after backend verification succeeds.
Useful? React with 👍 / 👎.
|
@codex review |
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
What
edited the readme in js/packages/core
IDKit.createSessionand how that's different than requests created viaIDKit.requestWhy
the js core package is our most used entrypoint into world ID. The migration documentation from v3.0 to v4.0 is a little unfinished / messy, as parallel documentation exists for legacy proof creation flows and v4.0 in the docs but not necessarily in this github
Note
Low Risk
Documentation-only changes to js/packages/core README with no runtime or API code modifications.
Overview
Expands
@worldcoin/idkit-coreREADME with a Quickstart that contrasts session-scoped verification (IDKit.createSession/IDKit.proveSession, persistsession_id, no action key) versus action-scoped verification (IDKit.request, persist nullifier after backend verify).Examples now consistently use
rp_contextpassthrough from/api/rp-signatureinstead of hand-assembling signature fields. Backend signing docs note omittingactionfor session flows and returning a fullrp_contextpayload (rp_id,signature, etc.).Verification guidance is consolidated under “Handling the result” (POST to
/api/v4/verify/{rp_id}). Preset/legacy sections are trimmed and reordered—sessions called out as not supporting presets; v4 helpers vs legacy presets listed briefly. Tagline drops “WASM-powered” wording.Reviewed by Cursor Bugbot for commit 1542d8b. Bugbot is set up for automated code reviews on this repo. Configure here.