Use Case Tutorials

import crypto from 'crypto';
import express from 'express';

const scoreCache = new Map(); // use a shared store or your datastore in production
const SECRET = process.env.SHIELDLABS_WEBHOOK_SECRET; // whsec_… for this endpoint

// Keep the raw body so the bytes you hash match the bytes that were signed.
const app = express();
app.use(express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }));

// Webhook handler: verify, respond fast, then store keyed by request_id.
app.post('/shieldlabs/webhook', (req, res) => {
  const received = req.get('X-Shield-Signature') ?? '';
  const expected =
    'sha256=' +
    crypto.createHmac('sha256', SECRET).update(req.rawBody).digest('hex');

  const a = Buffer.from(expected);
  const b = Buffer.from(received);
  if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
    return res.status(401).end();
  }

  const payload = req.body; // the webhook body, after signature verify
  // Idempotent on request_id: a redelivery can repeat it, so storing is safe
  // but do not double-apply business effects.
  res.status(200).end();
  // Cache the raw payload, so every tutorial reads the same shape the webhook
  // delivers: risk_score, signals, device_id, user_hid, public_ip, local_ip,
  // detection_flags, and the rest.
  scoreCache.set(payload.request_id, payload);
  setTimeout(() => scoreCache.delete(payload.request_id), 5 * 60 * 1000);
});

const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));

// Read path: poll the cache briefly, then fall back to a History API read.
async function waitForScore(requestId, timeoutMs) {
  const deadline = Date.now() + timeoutMs;
  while (Date.now() < deadline) {
    if (scoreCache.has(requestId)) return scoreCache.get(requestId);
    await sleep(100);
  }
  // Webhook never arrived in time: read the stored snapshot from the History API.
  const [snapshot] = await shieldHistory('request_id', requestId, 1);
  return snapshot ?? null;
}

const HISTORY_BASE = process.env.SHIELDLABS_API_URL ?? 'https://account.shieldlabs.ai/api';
const API_KEY = process.env.SHIELDLABS_API_KEY; // sec_… from dashboard API tab

/** Read snapshots by identifier. Returns the `data` array from the History API. */
async function shieldHistory(searchType, value, limit = 20) {
  const url = new URL(`${HISTORY_BASE}/v1/history/${searchType}/${encodeURIComponent(value)}`);
  url.searchParams.set('limit', String(limit));
  const res = await fetch(url, {
    headers: { Authorization: `Bearer ${API_KEY}` },
  });
  if (!res.ok) throw new Error(`history lookup failed: ${res.status}`);
  const body = await res.json();
  return body.data ?? [];
}