Account Sharing

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  // Right after login: a fresh identification for the new session.
  // On other signed-in pages, checkAuthenticatedUser with the same hashed id.
  mod.forceCheckAuthenticatedUser('8a9f-hashed-account-id', {
    onInitialized: (result) => {
      fetch('/api/session-check', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({ shieldlabsRequestId: result.requestID ?? '' }),
      });
    },
  });
</script>

app.post('/api/session-check', async (req, res) => {
  const { shieldlabsRequestId } = req.body;
  const userHid = req.user.hashedId; // the hashed id you pass to the snippet

  // Pull the ShieldLabs result for this session: the webhook `data` object
  // (the shared helper maps a History fallback to the same field names).
  const risk = await waitForScore(shieldlabsRequestId, 2000);
  if (!risk || risk.user_hid !== userHid || risk.risk_score > 100) {
    // No identification, someone else's, or the 999 rate-limit marker.
    return res.json({ action: 'review', reason: 'unverified_session' });
  }
  const deviceId = risk.device_id;
  const country  = risk.public_ip?.country;

  // An all-zero Device ID means no usable device signals reached ShieldLabs:
  // "device unknown", not a new device. Route it to review.
  if (deviceId === NIL_DEVICE) {
    return res.json({ action: 'review', reason: 'device_unknown' });
  }

  // Compare against what you already know about this account.
  const known = await knownDevicesFor(userHid);   // your own store

  if (!known.devices.has(deviceId)) {
    // A device this account has never used. Choose the action: re-auth, notify, or log.
    if (known.devices.size >= YOUR_DEVICE_LIMIT) {
      return res.json({ action: 'reauth_required', reason: 'new_device_over_limit' });
    }
    await rememberDevice(userHid, deviceId, country);
    return res.json({ action: 'notify_new_device' });
  }

  return res.json({ action: 'allow' });
});

const account = await accountView(userHid);

// The device count is the durable signal. The country count is read from
// the public IP, which a VPN can put anywhere, so treat it as the softer signal.
// For a single identification, detection_flags.ip_mismatch marks a public IP
// that differs from local_ip. It is informational: weigh it, do not gate on it.
if (account.devices.size >= YOUR_DEVICE_LIMIT || account.countries.size >= YOUR_COUNTRY_LIMIT) {
  flagForReview(userHid, {
    devices: account.devices.size,
    countries: account.countries.size,
  });
}