docs(world-id): fix audit findings across IDKit, credentials, sandbox, and technical reference - #197
Open
soamdesai-tfh wants to merge 8 commits into
Open
soamdesai-tfh wants to merge 8 commits into
soamdesai-tfh wants to merge 8 commits into
Conversation
…box, and technical reference - world-id/idkit/integrate.mdx: note Kotlin's GitHub Packages install requirement, sandbox environment value, sandbox testing cross-link, and advanced constraints() finalizer - world-id/idkit/error-codes.mdx: add missing feature_unavailable code, scope the JS/Kotlin/Swift parity claim to its two real exceptions - world-id/idkit/javascript.mdx: document constraints()/CredentialRequest/any/all as an alternative to preset(), and the sandbox environment value - world-id/sandbox/sandbox-access.mdx: fix Sandbox Support email domain (.org -> .com) - world-id/from-idkit-standalone.mdx: frame legacy presets as compatibility-only and point migrators to v4-native proofOfHuman/passport presets - world-id/credentials/9303.mdx: correct MNC to be its own credential (schema id 9310), not "the same credential" as the NFC/passport credential (9303) - world-id/reference/contracts.mdx: clarify additional on-chain groups are not RP-facing, fix ethers.js import path, fix nullifierHash row (was copy-pasted from root), reconcile Supported Chains testnet column with onchain-verification.mdx - world-id/reference/authenticator.mdx: rename requests -> proof_requests wire key, add required oprf_key_id and expires_at_min fields, replace placeholder signature with a valid r||s||v hex format - world-id/reference/poh-issuer.mdx: fix claims cap (15, not 16) and rename associated_data_hash -> associated_data_commitment, add issuer_version field - world-id/idkit/credentials.mdx: document the mnc preset alongside proofOfHuman/passport - world-id/idkit/react.mdx: document isOpen/isInWorldApp hook result fields and constraints as a preset alternative - world-id/idkit/signatures.mdx: document computeRpSignatureMessage and getSessionCommitment exports - world-id/credentials/1.mdx: rename associated_data_hash -> associated_data_commitment to match the real Credential struct - world-id/sandbox/testing-selfie-check.mdx: stop citing verification-flows.mdx for a "Warm" flow it doesn't define - world-id/4-0-migration.mdx: fix Solidity code fences mislabeled as jsx/ts
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Automations to automatically generate PRs for you. |
Contributor
Author
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a5903d0b65
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Style pass on the earlier audit commit: cut redundant clauses, self-explanatory asides, and repeated phrasing across the World ID docs it touched, tightening sentences to the surrounding terse Mintlify style without changing any technical content.
Contributor
Author
|
Style pass on the 9 prose-heavy files from the audit commit: tightened sentences to match the surrounding docs' terse Mintlify style (cut redundant clauses, repeated phrasing, and self-explanatory asides). No technical content, values, or warnings changed — cspell spot-check on all touched files passes clean. |
soamdesai-tfh
force-pushed
the
docs-audit/world-id-content-fixes
branch
from
September 21, 2026 17:27
afadf0e to
676e559
Compare
# Conflicts: # world-id/idkit/credentials.mdx
Addresses a Codex review comment on PR #197: the note only listed proofOfHuman/passport as the v4 migration target, which would leave standalone document-level (MNC) users without a documented preset to migrate to, even though v4 exposes mnc as its own preset distinct from passport.
- integrate: constraints example is Proof of Human AND (Passport OR MNC), scoped to JS/React; passport and MNC are alternatives (any, never all) - error-codes: feature_unavailable is JS/React only until the next Kotlin and Swift releases; fix its remedy - 9303: MNC has its own schema (9310) but counts as the user's one NFC credential; drop my-number-card; name the IDKit credential types - from-idkit-standalone: keep all document users with any(proof_of_human, passport, mnc); note v4 presets always keep 3.0 fallback, so dropping 3.0 needs constraints + allow_legacy_proofs: false - contracts: only groupId 1 is supported for RPs; IDKit 4.x v3 responses use nullifier - authenticator: examples parse with world-id-primitives 0.14.1 (numeric timestamps, 0x-hex signals, canonical proof/nullifiers, session_id) - javascript/react/poh-issuer: add mnc and session entry points, missing invite-code hook fields, uint8, claims slot wording - integrate/javascript: sandbox build of World ID; Maven Central comment
- credentials: proofOfHuman, passport, mnc and identityCheck always accept World ID 3.0 fallback and selfieCheck never does, whatever allow_legacy_proofs says (idkit preset.rs allow_legacy_proofs_override), so the options table matches the migration note
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix World ID docs.
idkit/integrate.mdx: note Kotlin's GitHub Packages requirement; document thesandboxenvironment and.constraints()(JS/React; passport and MNC combine withany, neverall).idkit/error-codes.mdx: add the missingfeature_unavailablecode; scope the cross-SDK parity claim.idkit/javascript.mdx: document.constraints()and all 3environmentvalues; include the requiredallow_legacy_proofsflag and keep Passport/MNC as alternatives.idkit/session-proofs.mdx,idkit/credentials.mdx,idkit/mini-apps.mdx, andworld-id/SKILL.md: use constraints for session requests and update React session guidance. These pre-existing session-example defects are addressed in a separate commit.sandbox/sandbox-access.mdx: fix the Sandbox Support email domain.from-idkit-standalone.mdx: reframe legacy presets as a compatibility step, not the end state; keep alldocumentusers withany(proof_of_human, passport, mnc).credentials/9303.mdx: correct — My Number Card has its own schema (9310) but still counts as the user's one NFC credential, so request it as an alternative to passport/eID.reference/contracts.mdx: fix the wrong@ethers/utilsimport, the copy-pastednullifierHashdescription, the Testnet column, and the "only groupId 1" claim.reference/authenticator.mdx: fix therequests→proof_requestswire key, add missingoprf_key_id/expires_at_minfields, fix malformed example signatures.reference/poh-issuer.mdx: correct the claim commitment count (15, not 16); renameassociated_data_hash→associated_data_commitment; addissuer_version.idkit/credentials.mdx: document the missingmncpreset and which presets overrideallow_legacy_proofs.idkit/react.mdx: add missing hook fields (isOpen,isInWorldApp); documentconstraints.sandbox/testing-selfie-check.mdx: remove a reference to a "Warm" flow that doesn't exist.credentials/1.mdx: renameassociated_data_hash→associated_data_commitment.idkit/signatures.mdx: documentcomputeRpSignatureMessageandgetSessionCommitment.4-0-migration.mdx: fix 2 mislabeled Solidity code fences.Skipped 3 findings that point at live remote OpenAPI content or facts not in evidence.