Free Trial Abuse

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  // Pass the hashed account id, never a raw email or user id.
  // The callback hands you the requestID to correlate with the score.
  mod.checkAuthenticatedUser('8a9f-hashed-account-id', (ip, requestID) => {
    document.getElementById('shield-request-id').value = requestID;
  });
</script>

<form method="POST" action="/api/start-trial">
  <input type="hidden" id="shield-request-id" name="shieldRequestId" />
  <button type="submit">Start free trial</button>
</form>

app.post('/api/start-trial', async (req, res) => {
  const { accountId, shieldRequestId } = req.body;

  // 1. Your normal eligibility checks first (not already trialed by this
  //    account, within campaign window, terms accepted).
  if (!(await trialIsAvailable(accountId))) {
    return res.status(409).json({ error: 'trial_not_available' });
  }

  // 2. Read the ShieldLabs result for this session (snake_case fields).
  const shield   = await waitForScore(shieldRequestId, 2000);
  const score    = shield?.score ?? 0;        // 0-100, default to 0 if not yet in
  const deviceId = shield?.device_id;

  // The all-zero DeviceID is "no device" (JS disabled or blocked), not a
  // new one. Route it to review and skip the device-count link.
  const NIL = '00000000-0000-0000-0000-000000000000';
  const usableDevice = deviceId && deviceId !== NIL;

  // 3. Count distinct accounts behind the durable DeviceID. A live History
  //    read by device_id reconstructs every account this machine touched.
  const trialsOnDevice = usableDevice
    ? await accountsBehindDevice(deviceId)
    : 0;

  // 4. YOUR code owns the verdict. Branch on the band and the count, never
  //    on a signal label string.
  if (trialsOnDevice >= YOUR_TRIAL_LIMIT) {
    return res.json({ requireVerification: true, reason: 'trials_on_device' });
  }
  if (score >= 60) {
    return res.json({ requireVerification: true, reason: 'anonymity' });
  }

  // Clean / Low / Medium and a fresh device: grant the trial.
  return grantTrial(req, res);
});

// Distinct hashed accounts seen on one machine, from a live History read
// against your own store of what you have already counted.
async function accountsBehindDevice(deviceId) {
  const rows = await shieldHistory('device_id', deviceId, 100);
  return new Set(rows.map((r) => r.user_hid).filter(Boolean)).size;
}

curl "https://account.shieldlabs.ai/api/v1/history/device_id/5eb7fd5c-2a1b-4c3d-9e8f-7a6b5c4d3e2f?limit=100" \
  -H "Authorization: Bearer sec_your_private_api_key"