Phoenix

defp deps do
  [
    # …your Phoenix dependencies (includes :jason)
    {:req, "~> 0.5"}
  ]
end

mix deps.get

config :my_app,
  constaia_api_key: System.get_env("CONSTAIA_API_KEY"),
  constaia_webhook_secret: System.get_env("CONSTAIA_WEBHOOK_SECRET")

CONSTAIA_API_KEY=ck_test_...
CONSTAIA_WEBHOOK_SECRET=whsec_...

defmodule MyApp.Constaia do
  @base_url "https://api.constaia.com"

  defmodule Error do
    defexception [:status, :type, :code, :message, :param, :request_id]
  end

  # {:ok, analysis}: analysis["status"] is "completed" (HTTP 200) or "queued"/"processing" (HTTP 202).
  def analyze(%Plug.Upload{} = upload, options) do
    content = File.read!(upload.path)

    client()
    |> Req.post(
      url: "/v1/analyze",
      headers: %{"idempotency-key" => Ecto.UUID.generate()},
      form_multipart: [
        file: {content, filename: upload.filename, content_type: upload.content_type || "application/octet-stream"},
        options: Jason.encode!(options)
      ]
    )
    |> handle()
  end

  def get_analysis(id) do
    client() |> Req.get(url: "/v1/analyses/#{id}") |> handle()
  end

  defp client do
    Req.new(
      base_url: @base_url,
      auth: {:bearer, Application.fetch_env!(:my_app, :constaia_api_key)},
      # A synchronous analysis can take up to 30 s before returning 202.
      receive_timeout: 60_000,
      retry: &retry_rate_limited?/2,
      max_retries: 2
    )
  end

  defp retry_rate_limited?(_request, %Req.Response{status: 429}), do: true
  defp retry_rate_limited?(_request, _response_or_exception), do: false

  defp handle({:ok, %Req.Response{status: status, body: body}}) when status in 200..299, do: {:ok, body}

  defp handle({:ok, %Req.Response{status: status, body: body} = response}) do
    error = if is_map(body), do: body["error"] || %{}, else: %{}

    {:error,
     %Error{
       status: status,
       type: error["type"],
       code: error["code"],
       message: error["message"] || "HTTP #{status}",
       param: error["param"],
       request_id: error["request_id"] || List.first(Req.Response.get_header(response, "x-request-id"))
     }}
  end

  defp handle({:error, exception}), do: {:error, exception}
end

defmodule MyAppWeb.DocumentVerificationController do
  use MyAppWeb, :controller
  require Logger
  alias MyApp.Constaia

  @max_bytes 20 * 1024 * 1024

  # Add your authentication here: every analysis spends credits.
  def create(conn, %{"file" => %Plug.Upload{} = upload} = params) do
    %{size: size} = File.stat!(upload.path)

    cond do
      size == 0 -> render_error(conn, 400, "The document is missing.")
      size > @max_bytes -> render_error(conn, 413, "Max 20 MB.")
      true -> analyze(conn, upload, params["full_name"])
    end
  end

  def create(conn, _params), do: render_error(conn, 400, "The document is missing.")

  defp analyze(conn, upload, full_name) do
    options = %{
      expect: "es_dni",
      checks: put_holder(%{not_expired: true}, full_name),
      storage: "none",
      language: "en"
    }

    case Constaia.analyze(upload, options) do
      {:ok, %{"status" => "completed"} = analysis} ->
        json(conn, %{
          id: analysis["id"],
          status: get_in(analysis, ["verdict", "status"]),
          reasons: analysis |> get_in(["verdict", "reasons"]) |> List.wrap() |> Enum.map(& &1["message"]),
          warnings: analysis["warnings"]
        })

      {:ok, analysis} ->
        # 202: the result will arrive by webhook (or call get_analysis/1).
        conn |> put_status(202) |> json(%{id: analysis["id"], status: analysis["status"]})

      {:error, %Constaia.Error{} = e} ->
        Logger.warning("Constaia #{e.status} #{e.code} request_id=#{e.request_id}")

        if e.type == "invalid_request",
          do: render_error(conn, 422, e.message),
          else: render_error(conn, 502, "The document could not be verified. Please try again.")

      {:error, exception} ->
        Logger.warning("Constaia: #{Exception.message(exception)}")
        render_error(conn, 502, "The document could not be verified. Please try again.")
    end
  end

  defp put_holder(checks, name) when is_binary(name) and name != "",
    do: Map.put(checks, :holder, %{full_name: name})

  defp put_holder(checks, _name), do: checks

  defp render_error(conn, status, message) do
    conn |> put_status(status) |> json(%{error: %{message: message}})
  end
end

defmodule MyAppWeb.CacheBodyReader do
  def read_body(%Plug.Conn{request_path: "/webhooks/constaia"} = conn, opts) do
    case Plug.Conn.read_body(conn, opts) do
      {:ok, body, conn} -> {:ok, body, cache(conn, body)}
      {:more, body, conn} -> {:more, body, cache(conn, body)}
      other -> other
    end
  end

  def read_body(conn, opts), do: Plug.Conn.read_body(conn, opts)

  defp cache(conn, body), do: update_in(conn.assigns[:raw_body], &[body | (&1 || [])])
end

plug Plug.Parsers,
  parsers: [:urlencoded, {:multipart, length: 21_000_000}, :json],
  pass: ["*/*"],
  body_reader: {MyAppWeb.CacheBodyReader, :read_body, []},
  json_decoder: Phoenix.json_library()

defmodule MyApp.ConstaiaWebhook do
  @tolerance 300

  def verify(raw, id, timestamp, signatures, secret)
      when is_binary(id) and is_binary(timestamp) and is_binary(signatures) do
    with {ts, ""} <- Integer.parse(timestamp),
         true <- abs(System.system_time(:second) - ts) <= @tolerance,
         {:ok, key} <- secret |> String.replace_prefix("whsec_", "") |> Base.decode64(),
         expected = :crypto.mac(:hmac, :sha256, key, "#{id}.#{timestamp}.#{raw}") |> Base.encode64(),
         true <- signatures |> String.split(" ", trim: true) |> Enum.any?(&valid_signature?(&1, expected)) do
      Jason.decode(raw)
    else
      _ -> {:error, :invalid_signature}
    end
  end

  def verify(_raw, _id, _timestamp, _signatures, _secret), do: {:error, :missing_headers}

  defp valid_signature?("v1," <> sig, expected), do: Plug.Crypto.secure_compare(sig, expected)
  defp valid_signature?(_part, _expected), do: false
end

defmodule MyAppWeb.ConstaiaWebhookController do
  use MyAppWeb, :controller
  require Logger
  alias MyApp.ConstaiaWebhook

  @analysis_events ["analysis.completed", "analysis.review_required", "analysis.failed"]

  def create(conn, _params) do
    raw = conn.assigns |> Map.get(:raw_body, []) |> Enum.reverse() |> IO.iodata_to_binary()
    msg_id = header(conn, "webhook-id")
    secret = Application.fetch_env!(:my_app, :constaia_webhook_secret)

    case ConstaiaWebhook.verify(raw, msg_id, header(conn, "webhook-timestamp"), header(conn, "webhook-signature"), secret) do
      {:ok, event} ->
        handle_event(msg_id, event)
        send_resp(conn, 204, "")

      {:error, _reason} ->
        send_resp(conn, 400, "invalid signature")
    end
  end

  # webhook-id is stable across retries: dedupe on it in your database.
  defp handle_event(msg_id, %{"type" => type, "data" => analysis}) when type in @analysis_events do
    Logger.info("#{msg_id} #{type} #{analysis["id"]} #{get_in(analysis, ["verdict", "status"])}")
    # Queue heavy work (for example, with Oban) and answer within 15 s.
  end

  defp handle_event(_msg_id, _event), do: :ok

  defp header(conn, name), do: conn |> get_req_header(name) |> List.first()
end

scope "/", MyAppWeb do
  pipe_through :api

  post "/api/verify", DocumentVerificationController, :create
  post "/webhooks/constaia", ConstaiaWebhookController, :create
end

curl -F "file=@dni_valid.jpg" -F "full_name=María García López" http://localhost:4000/api/verify
curl -F "file=@dni_expired.jpg" http://localhost:4000/api/verify
curl -F "file=@blurry.jpg" http://localhost:4000/api/verify
curl -F "file=@dni_valid.jpg" -F "full_name=Juan Pérez" http://localhost:4000/api/verify