Payment fraud

import { load } from '@fingerly/web-js'

const fingerly = await load({ apiKey: 'fly_pk_us_production_…' })

async function submit() {
  let requestId: string | undefined
  try {
    ({ requestId } = await fingerly.identify({ tag: 'checkout:' + orderId }))
  } catch {
    // Carry on: your server treats a missing request ID as missing evidence.
  }
  await fetch('/api/checkout', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ orderId, requestId }) })
}

// fingerly.server.ts
import { load, FingerlyAPIError } from '@fingerly/node'

const fingerly = load({ secretKey: process.env.FINGERLY_SECRET_KEY! })
const sleep = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms))

async function readEvent(requestId: string) {
  for (let attempt = 1; ; attempt++) {
    try {
      return await fingerly.events.get(requestId)
    } catch (error) {
      const status = error instanceof FingerlyAPIError ? error.status : undefined
      if (status === 404 && attempt < 4) await sleep(attempt * 250)   // not readable yet
      else if (status === 404 || status === 422) return null
      else throw error
    }
  }
}

/**
 * The stored event behind a request ID, or null when there is nothing to
 * trust: no ID, an unknown ID, another action's tag, too old, or used before.
 */
export async function verifiedEvent(requestId: unknown, tag: string, maxAgeMs = 2 * 60 * 1000) {
  if (typeof requestId !== 'string' || requestId === '') return null

  const event = await readEvent(requestId)
  if (!event || event.tag !== tag) return null
  if (Date.now() - Date.parse(event.occurred_at) > maxAgeMs) return null
  if (!(await usedRequestIds.add(event.request_id))) return null   // your store: true only the first time

  return event
}

/** Whether any of these signal groups fired. */
export const fired = (event: { triggers: Array<{ signal: string }> }, ...groups: string[]) =>
  event.triggers.some((trigger) => groups.includes(trigger.signal))

import { verifiedEvent } from './fingerly.server'

export async function checkoutDecision(order: Order, requestId: unknown) {
  const event = await verifiedEvent(requestId, 'checkout:' + order.id)
  if (!event) return 'authenticate'   // 3-D Secure or your equivalent

  // Evidence for a dispute, kept with the order for as long as you keep orders.
  await orders.saveEvidence(order.id, {
    requestId: event.request_id,
    visitorId: event.visitor_id,
    ipAddress: event.ip_address,
    countryCode: event.country_code,
    suspectLevel: event.suspect_level,
  })

  const cards = await payments.distinctCardsByVisitor(event.visitor_id, { hours: 24 })
  if (cards >= 4) return 'refuse'                                  // card testing

  if (event.suspect_level === 'high') return 'review'
  if (event.suspect_level !== 'low') return 'authenticate'         // medium, or not scored
  if (event.anonymity_network || event.country_code !== order.billingCountry) return 'authenticate'
  return 'capture'
}