Acting on the Risk Score

// A baseline ladder. Tune the cut-points per action context (see scenarios below).
function defaultAction(score) {
  if (score < 10) return 'allow';        // Clean: no friction
  if (score < 30) return 'allow_log';    // Low: allow, but log it
  if (score < 60) return 'challenge';    // Medium: step-up or review
  return 'review_or_block';              // High: block, review, or verify
}

function onSignup({ Score, Details }) {
  if (Score >= 60) return 'reject_or_manual_review';
  if (Score >= 30) return 'email_verify_or_captcha';
  return 'allow'; // Clean / Low: create the account
}

function onLogin({ Score }) {
  if (Score >= 60) return 'block_require_recovery';
  if (Score >= 30) return 'require_2fa';
  return 'allow';
}

function onWithdrawal({ Score, Details }) {
  if (Score >= 60) return 'manual_review_hold';
  if (Score >= 10) return 'extra_verification'; // verify early on money out
  return 'allow';
}

function decide({ Score, Details, UserHID, action }) {
  const fired = new Set(Details.map((d) => d.Description));
  const has = (name) => fired.has(name);

  // 1. Abuse-reputation hit: high-risk even at a moderate score.
  if (has('Abuser Flag')) return 'block_or_manual_review';

  // 2. Strong anonymity on money-movement: escalate hard.
  const moneyAction = action === 'checkout' || action === 'withdrawal';
  if (moneyAction && (has('Tor') || has('Proxy'))) return 'block_or_manual_review';

  // 3. Combination at a sensitive step: VPN + timezone mismatch.
  if (has('Timezone Mismatch') && hasAnyVpn(fired) && isSensitive(action)) {
    return 'challenge';
  }

  // 4. Cross-reference YOUR own data, even on a low score.
  if (knownBadDevice(/* DeviceID from the payload */)) return 'block';

  // 5. Otherwise fall back to the per-action band ladder.
  return bandLadder(Score, action);
}

function hasAnyVpn(fired) {
  return fired.has('VPN') || fired.has('Browser VPN/Proxy') || fired.has('Privacy Relay');
}

import express from 'express';
import crypto from 'crypto';

const SECRET = process.env.SHIELDLABS_SECRET;
const app = express();

app.post('/shieldlabs/webhook', express.json(), async (req, res) => {
  const { Data, Assing } = req.body;

  // 1. Verify the HMAC over Data before trusting anything.
  const expected = crypto
    .createHmac('sha256', SECRET)
    .update(JSON.stringify(Data))
    .digest('hex');

  const ok =
    Assing.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(Assing, 'hex'), Buffer.from(expected, 'hex'));

  if (!ok) return res.status(401).end();

  // 2. Respond fast, then act.
  res.status(200).end();
  applyDecision(Data).catch(console.error);
});

async function applyDecision(data) {
  const { RequestID, Score, Details, UserHID, Phase, action } = data;

  // Upsert keyed on RequestID: initial, update, or redelivery all converge.
  await db.checks.upsert({ requestID: RequestID, score: Score, details: Details, phase: Phase });

  // Compute the decision idempotently; do not re-charge, re-email, or re-block.
  const decision = decide({ Score, Details, UserHID, action });
  await db.decisions.upsert({ requestID: RequestID, decision });

  // On the "update" Phase, you may revise an earlier "initial" decision
  // (the WebRTC pass can raise or lower the score). Revise, do not duplicate.
}

curl "https://api.shieldlabs.ai/myshop.com:YOUR_SECRET_KEY/history/request_id/13f84f05-2c4a-4d8e-9b1a-6f2e7c9d0a55?limit=1"

function bandLadder(score, action) {
  // Per-action cut-points from the scenario tables above.
  const cuts = {
    signup:     { challenge: 30, block: 60 },
    login:      { challenge: 30, block: 60 },
    checkout:   { challenge: 30, block: 60 },
    withdrawal: { challenge: 10, block: 60 }, // strictest: react early
    kyc:        { challenge: 30, block: 60 },
    content:    { challenge: 30, block: 60 },
  }[action] || { challenge: 30, block: 60 };

  if (score >= cuts.block) return 'block_or_manual_review';
  if (score >= cuts.challenge) return 'challenge';
  return 'allow';
}

function decide({ Score, Details, UserHID, action }) {
  const fired = new Set((Details || []).map((d) => d.Description));

  // Details-aware overrides first.
  if (fired.has('Abuser Flag')) return 'block_or_manual_review';
  if ((action === 'checkout' || action === 'withdrawal') &&
      (fired.has('Tor') || fired.has('Proxy'))) {
    return 'block_or_manual_review';
  }

  // Then the per-action band ladder.
  return bandLadder(Score, action);
}