Account Sharing

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  // Pass the hashed account id, never a raw email or user id.
  mod.checkAuthenticatedUser('8a9f-hashed-account-id', (ip, requestID) => {
    document.getElementById('shield-request-id').value = requestID;
  });
</script>

app.post('/api/session-check', async (req, res) => {
  const { accountId, shieldRequestId } = req.body;

  // Pull the ShieldLabs result for this session (snake_case, as the
  // webhook and account History API deliver it).
  const shield = await waitForScore(shieldRequestId, 2000);
  const deviceId = shield?.device_id;
  const country  = shield?.public_ip?.country;

  // A blocked or JS-disabled session can return an all-zero DeviceID.
  // That is "device unknown", not a new device: weigh it with IP + account
  // context instead of treating it as one more device or auto-allowing.
  const ZERO_DEVICE = '00000000-0000-0000-0000-000000000000';
  if (!deviceId || deviceId === ZERO_DEVICE) {
    return res.json({ action: 'review', reason: 'device_unknown' });
  }

  // Compare against what you already know about this account.
  const known = await knownDevicesFor(accountId);   // your own store

  if (!known.devices.has(deviceId)) {
    // A device this account has never used. Your call: re-auth, notify, or log.
    if (known.devices.size >= YOUR_DEVICE_LIMIT) {
      return res.json({ action: 'reauth_required', reason: 'new_device_over_limit' });
    }
    await rememberDevice(accountId, deviceId, country);
    return res.json({ action: 'notify_new_device' });
  }

  return res.json({ action: 'allow' });
});

async function accountSpread(userHid) {
  const rows = await shieldHistory('user_hid', userHid, 100);
  const devices   = new Set(rows.map((r) => r.device_id).filter(Boolean));
  const countries = new Set(rows.map((r) => r.country).filter(Boolean));

  // The device count is the durable signal. The country count is read from
  // the public IP, which a VPN can fake, so treat it as the softer signal.
  // For a live verdict, the webhook's detection_flags.ip_mismatch boolean
  // tells you a session's public country is masked, no label parsing needed.
  return { devices: devices.size, countries: countries.size };
}

const { devices, countries } = await accountSpread('8a9f-hashed-account-id');
if (devices >= YOUR_DEVICE_LIMIT || countries >= YOUR_COUNTRY_LIMIT) {
  flagForReview(accountId, { devices, countries });
}