Bonus Abuse

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  const form = document.getElementById('claim-form');

  // forceCheckAuthenticatedUser runs an identification for this claim, even
  // inside the five-minute window, started when the form comes into use.
  // onInitialized fires when the check starts, before the snippet sends it, so
  // it only stores the request ID and the form submits normally. With no
  // request ID, your backend holds the claim. Pass the hashed account id, never
  // a raw email. The Risk Score reaches your server, not the browser.
  const identify = () => {
    mod.forceCheckAuthenticatedUser('8a9f-hashed-account-id', {
      onInitialized: (result) => {
        if (result.status === 'initialized') {
          document.getElementById('shieldlabs-request-id').value = result.requestID;
        }
      },
    });
  };
  if (form.contains(document.activeElement)) identify(); // already focused (autofocus)
  else form.addEventListener('focusin', identify, { once: true });
</script>

<form id="claim-form" method="POST" action="/api/claim-bonus">
  <input type="hidden" id="shieldlabs-request-id" name="shieldlabsRequestId" />
  <input type="text" name="bonusCode" placeholder="Bonus code" />
  <button type="submit">Claim bonus</button>
</form>

{
  "request_id": "13f84f05-7c2a-4e9b-9f1d-2a6b8c0e4d11",
  "device_id": "5eb7fd5c-2a1b-4c3d-9e8f-7a6b5c4d3e2f",
  "visitor_id": "161dfbad-8e7f-4a6b-9c5d-0e1f2a3b4c5d",
  "user_hid": "a1b2c3d4hasheduserid",
  "public_ip": { "ip": "203.0.113.42", "country": "NL" },
  "local_ip": { "ip": "198.51.100.23", "country": "PL" },
  "risk_score": 20,
  "signals": [
    { "name": "datacenter_ip", "weight": 10 },
    { "name": "abuser", "weight": 10 }
  ],
  "detection_flags": { "ip_mismatch": true, "datacenter_ip": true, "abuser": true },
  "observed_at": "2026-06-16T18:00:45Z"
}

import { app, waitForScore, band, accountView, accountsBehindDevice, NIL_DEVICE } from '../shieldlabs-helpers.js';

app.post('/api/claim-bonus', async (req, res) => {
  const { bonusCode, shieldlabsRequestId } = req.body;
  const accountId = req.user.id;
  const userHid = req.user.hashedId; // the hashed id you pass to the snippet

  // 1. Your normal bonus checks first (code valid, not already claimed by this
  //    account, within the campaign window).
  if (!(await bonusIsClaimable(bonusCode, accountId))) {
    return res.status(409).json({ error: 'bonus_not_claimable' });
  }

  // 2. The guard: read this claim's identification (webhook cache, then History
  //    fallback). No identification is unverified, never clean.
  const risk = await waitForScore(shieldlabsRequestId, 2000);
  if (!risk) {
    return res.status(200).json({ requireVerification: true, reason: 'no_identification' });
  }
  if (risk.user_hid !== userHid) {
    return res.status(200).json({ requireVerification: true, reason: 'identification_mismatch' });
  }
  if (risk.risk_score > 100) {
    // The 999 rate-limit marker.
    return res.status(200).json({ requireVerification: true, reason: 'rate_limit_marker' });
  }
  const flags = risk.detection_flags ?? {};

  // 3. The claim itself: Dangerous, or automated, waits for verification.
  if (band(risk.risk_score) === 'Dangerous' || flags.browser_automation || flags.javascript_disabled) {
    return res.status(200).json({ requireVerification: true, reason: 'risk_signals' });
  }

  // 4. The account: your Multi-accounting mark ('medium' or 'high', your own
  //    store), then its earlier identifications without this one.
  const marked = await markedAccounts.get(userHid);
  if (marked === 'high') {
    return res.status(403).json({ error: 'bonus_denied', reason: 'held_for_review' });
  }
  // A failed History read is unverified: hold the claim.
  let account;
  try {
    account = await accountView(userHid, { excludeRequestId: risk.request_id });
  } catch {
    return res.status(200).json({ requireVerification: true, reason: 'history_unavailable' });
  }
  if (marked || account.worstBand === 'Dangerous') {
    return res.status(200).json({ requireVerification: true, reason: 'risky_account' });
  }

  // 5. An all-zero Device ID means no usable device signals reached ShieldLabs:
  //    there is no device to count accounts on, so hold the claim.
  if (risk.device_id === NIL_DEVICE) {
    return res.status(200).json({ requireVerification: true, reason: 'no_device' });
  }

  // 6. How many distinct accounts has this one device already used to claim?
  let accountsOnDevice;
  try {
    accountsOnDevice = await accountsBehindDevice(risk.device_id);
  } catch {
    return res.status(200).json({ requireVerification: true, reason: 'history_unavailable' });
  }
  if (accountsOnDevice >= YOUR_ACCOUNT_LIMIT) {
    return res.status(200).json({ requireVerification: true, reason: 'bonus_already_claimed_on_device' });
  }

  // A clean claim, a clean account and a fresh device: credit the bonus.
  return grantBonus(req, res);
});

curl "https://account.shieldlabs.ai/api/v1/history/device_id/5eb7fd5c-2a1b-4c3d-9e8f-7a6b5c4d3e2f?limit=100" \
  -H "Authorization: Bearer sec_your_private_api_key"