World ID 4.0 Migration

import { signRequest } from '@worldcoin/idkit-core'

const rpSignature = signRequest(
  'verify-human',             // action
  process.env.RP_SIGNING_KEY, // your private key
  // ttlSeconds optional, defaults to 300
)

// Send to frontend
return {
  rp_id: 'rp_123456789abcdef0',       // your registered RP ID
  nonce: rpSignature.nonce,           // auto-generated
  created_at: rpSignature.createdAt,  // auto-generated by SDK
  expires_at: rpSignature.expiresAt,  // auto-generated by SDK
  signature: rpSignature.sig,         // auto-generated
}

import { orbLegacy } from '@worldcoin/idkit-core'

// 1. Create verification request (builder pattern)
const request = await IDKit.request({
  app_id: 'app_staging_xxxxx',
  action: 'verify-human',
  allow_legacy_proofs: true,         // true: accept v3 + v4 | false: v4 only
  rp_context: rpContextFromBackend,  // object returned from backend
}).preset(orbLegacy({ signal: 'user-123' }))

// 3. Display QR code
console.log('Scan with World App:', request.connectorURI)
// Or render as QR: <QRCode value={request.connectorURI} />

// 4. Wait for proof
const completion = await request.pollUntilCompletion({
  pollInterval: 1000,                    // ms between polls (default: 1000)
  timeout: 300000,                       // max wait time in ms (default: 300000 = 5 min)
  signal: abortController.signal,        // optional AbortSignal for cancellation
})

if (!completion.success) {
  console.error('Verification failed:', completion.error)
  return
}

// 5. Send proof to your backend for verification
console.log(completion.result)

mapping(uint256 => bool) internal oldNullifierHashes;
mapping(address => bool) public oldHasMinted;

function mint(){
  // Existing logic for checking World ID uniqueness
  if (hasMinted[msg.sender]) revert AlreadyMinted();
  if (nullifierHashes[nullifierHash]) revert DuplicateNullifier(nullifierHash);
}

mapping(uint256 => bool) internal nullifierHashes;
mapping(address => bool) public hasMinted;

// This function is used to verify a 4.0 proof
function mint({..., nullifier}){
  // Check old contracts and new mapping
  if (OldContract.hasMinted[msg.sender] || hasMinted[msg.sender]) revert AlreadyMinted();
  if (OldContract.oldNullifierHashes[nullifier] || nullifierHashes[nullifier]) revert DuplicateNullifier(nullifier);

  // Verify 4.0 Proof
  Verifier.verify(...)
}

// Needed to support v3 proofs during migration
function mintLegacy({..., nullifierHash}){
  // Check old contracts and new ones
  if (OldContract.hasMinted[msg.sender] || hasMinted[msg.sender]) revert AlreadyMinted();
  if (OldContract.oldNullifierHashes[nullifierHash] || nullifierHashes[nullifierHash]) revert DuplicateNullifier(nullifierHash);

  // Verify Legacy Proof
  WorldIDRouter.verify(...)
}

export async function createSession() {
  const rpContext = await fetch("/api/worldid/rp-context").then((r) => r.json());

  const request = await IDKit.createSession({
    app_id: APP_ID,
    rp_context: rpContext,
  }).constraints(any(CredentialRequest("orb")));

  // Web only: render this QR URL
  const qrUrl = request.connectorURI;

  const completion = await request.pollUntilCompletion({ timeout: 120000 });
  if (!completion.success) throw new Error(completion.error);

  const verify = await fetch("/api/worldid/verify", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(completion.result),
  }).then((r) => r.json());

  if (!verify.success) throw new Error("Verification failed");

  // IMPORTANT: Save this in order to prove future sessions for the same user
  return completion.result.session_id;
}

// sessionId should have been saved when you created the session
export async function proveSession(sessionId) {
  const rpContext = await fetch("/api/worldid/rp-context").then((r) => r.json());

  const request = await IDKit.proveSession(sessionId, {
    app_id: APP_ID,
    rp_context: rpContext,
  }).constraints(any(CredentialRequest("orb")));

  const completion = await request.pollUntilCompletion({ timeout: 120000 });
  if (!completion.success) throw new Error(completion.error);

  const verify = await fetch("/api/worldid/verify", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify(completion.result),
  }).then((r) => r.json());

  if (!verify.success) throw new Error("Verification failed");

  return verify;
}