Regional Pricing Abuse

<script type="module">
  const mod = await import(
    'https://cdn.shieldlabs.ai/snippet.js?publicKey=YOUR_PUBLIC_KEY'
  );
  // The browser does NOT compute the Risk Score or resolve the country.
  // result.requestID joins the webhook.
  const identify = (region) =>
    mod.forceCheckAuthenticatedUser('a1b2c3d4hasheduserid', {
      onInitialized: (result) => {
        if (result.status !== 'initialized') return;
        document.getElementById('shieldlabs-request-id').value = result.requestID;
        document.getElementById('claimed-region').value = region; // e.g. "BR"
      },
    });

  const select = document.getElementById('region-select');
  // Identify when the buyer picks a region, and once for the preselected one.
  select.addEventListener('change', (e) => identify(e.target.value));
  identify(select.value);
</script>

<form id="checkout-form" method="POST" action="/api/price">
  <select id="region-select" name="region">
    <option value="US">United States</option>
    <option value="BR">Brazil</option>
  </select>
  <input type="hidden" id="shieldlabs-request-id" name="shieldlabsRequestId" />
  <input type="hidden" id="claimed-region" name="claimedRegion" />
  <button type="submit">Continue</button>
</form>

app.post('/api/price', async (req, res) => {
  const { shieldlabsRequestId, claimedRegion, userId } = req.body;
  // The same hashing you apply before passing the id to the snippet; null for a guest.
  const userHid = userId ? hashAccountId(userId) : null;
  const standard = (reason, extra = {}) =>
    res.json({ price: standardPrice(userId), region: 'standard', reason, ...extra });

  // Wait up to ~2s for the webhook; falls back to the History API.
  const risk = await waitForScore(shieldlabsRequestId, 2000);

  // No identification is not "verified": default to the standard price
  // rather than handing out a discount on missing data.
  if (!risk) return standard('verifying');
  // The identification must belong to the buyer who claims the price.
  if (userHid && risk.user_hid !== userHid) return standard('identification_mismatch');
  // The 999 rate-limit marker.
  if (risk.risk_score > 100) return standard('region_unverified');
  // A History fallback row has no local_ip and no browser_vpn_proxy flag.
  if (risk.source === 'history') return standard('region_unverified');

  const flags = risk.detection_flags ?? {}; // detection_flags booleans, the stable contract

  // Network-level masking that makes the exit country untrustworthy: verify before any discount.
  const masked =
    flags.vpn || flags.proxy || flags.tor || flags.privacy_relay ||
    flags.datacenter_ip || flags.browser_vpn_proxy;
  if (masked) return standard('region_unverified_masked', { verify: true });

  // Compare the claimed region to the Local IP country when captured;
  // otherwise fall back to the public IP country.
  const publicCountry = risk.public_ip?.country;
  const localCountry = risk.local_ip?.country;
  const networkCountry = localCountry || publicCountry;
  const countriesDisagree = Boolean(localCountry && publicCountry && localCountry !== publicCountry);

  // The public IP countries of the account's earlier sessions, from its newest 100
  // identifications. This session's own identifications (this page and the signed-in
  // pages before it) exit where the buyer sits now, so they cannot vouch for the claim.
  // Empty for a guest or a new account. A failed History read is unverified.
  let earlierCountries = new Set();
  if (userHid) {
    try {
      ({ countries: earlierCountries } = await accountView(userHid, {
        excludeSessionId: risk.session_id,
      }));
    } catch {
      return standard('region_unverified', { verify: true });
    }
  }
  const newToAccount = earlierCountries.size > 0 && !earlierCountries.has(claimedRegion);

  if (countriesDisagree || networkCountry !== claimedRegion || newToAccount) {
    return standard(countriesDisagree ? 'region_countries_disagree' : 'region_mismatch', {
      verify: true,
    });
  }

  // Countries line up, the session is not masked, and the account used the region in an
  // earlier session (or has no earlier session yet).
  return res.json({ price: regionalPrice(claimedRegion), region: claimedRegion });
});