Documentation

import { LoginLlama } from 'loginllama';

const loginllama = new LoginLlama({
  apiKey: process.env.LOGINLLAMA_API_KEY
});

// Use middleware for automatic IP/User-Agent detection
app.use(loginllama.middleware());

// Pre + Post Auth Pattern - Most complete protection
app.post('/login', async (req, res) => {
  const { email, password } = req.body;

  try {
    // Step 1: Pre-auth check (before verifying credentials)
    const preCheck = await loginllama.check(email, {
      authenticationOutcome: 'pending'  // Mark as pre-auth check
    });

    // Block high-risk attempts before authentication
    if (preCheck.risk_score > 7) {
      return res.status(403).json({ error: 'Login blocked' });
    }

    // Step 2: Authenticate with your system
    const authResult = await authenticate(email, password);

    // Step 3: Report outcome to LoginLlama
    if (authResult.success) {
      await loginllama.reportSuccess(authResult.user.id);
      return res.json({ success: true });
    } else {
      // Report failed auth - helps detect brute force attacks
      await loginllama.reportFailure(email);
      return res.status(401).json({ error: 'Invalid credentials' });
    }
  } catch (error) {
    console.error('LoginLlama error:', error);
    return res.json({ success: true }); // Fail open on errors
  }
});

// Install: npm install loginllama@^3.1.0
import { LoginLlama } from 'loginllama';
import { NextRequest } from 'next/server';

const loginllama = new LoginLlama({
  apiKey: process.env.LOGINLLAMA_API_KEY!
});

export async function POST(req: NextRequest) {
  const { email } = await req.json();

  try {
    const result = await loginllama.check(email, {
      request: req
    });

    if (result.status === 'error' || result.risk_score > 5) {
      return Response.json(
        { error: 'Suspicious login detected', codes: result.codes },
        { status: 403 }
      );
    }

    return Response.json({ success: true });
  } catch (error) {
    console.error('LoginLlama error:', error);
    return Response.json({ success: true }); // Fail open
    }
}

// supabase/functions/check-login/index.ts
import { serve } from 'https://deno.land/[email protected]/http/server.ts'
import { createClient } from 'https://esm.sh/@supabase/supabase-js@2'

serve(async (req) => {
  const supabase = createClient(
    Deno.env.get('SUPABASE_URL') ?? '',
    Deno.env.get('SUPABASE_ANON_KEY') ?? ''
  )

  // Get user from auth header
  const authHeader = req.headers.get('Authorization')!
  const token = authHeader.replace('Bearer ', '')
  const { data: { user } } = await supabase.auth.getUser(token)

  if (!user) {
    return new Response(JSON.stringify({ error: 'Unauthorized' }), {
      status: 401,
      headers: { 'Content-Type': 'application/json' }
    })
  }

  // Get IP and user agent from request
  const ip = req.headers.get('x-forwarded-for') || 'unknown'
  const userAgent = req.headers.get('user-agent') || ''

  // Check with LoginLlama
  const loginLlamaResponse = await fetch(
    'https://loginllama.app/api/v1/login/check',
    {
      method: 'POST',
      headers: {
        'X-API-KEY': Deno.env.get('LOGINLLAMA_API_KEY')!,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        identity_key: user.email,
        ip_address: ip,
        user_agent: userAgent,
        email_address: user.email
      })
    }
  )

  const result = await loginLlamaResponse.json()

  // If high risk, you could:
  // 1. Sign out the user
  // 2. Require email verification
  // 3. Log to audit table
  // 4. Send alert to security team

  if (result.risk_score >= 8) {
    // Log suspicious login
    await supabase.from('audit_logs').insert({
      user_id: user.id,
      event: 'suspicious_login_blocked',
      risk_score: result.risk_score,
      risk_codes: result.codes,
      ip_address: ip
    })

    return new Response(
      JSON.stringify({
        error: 'Login blocked due to suspicious activity',
        risk_score: result.risk_score,
        codes: result.codes
      }),
      { status: 403, headers: { 'Content-Type': 'application/json' } }
    )
  }

  return new Response(
    JSON.stringify({ success: true, risk_score: result.risk_score }),
    { headers: { 'Content-Type': 'application/json' } }
  )
})

/**
* Handler that will be called during the execution of a PostLogin flow.
*
* @param {Event} event - Details about the user and the context in which they are logging in.
* @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.
*/
exports.onExecutePostLogin = async (event, api) => {
  // Only check logins for specific applications (optional)
  // if (event.client.name !== 'My Web App') return;

  try {
    const axios = require('axios');

    // Call LoginLlama API
    const response = await axios.post(
      'https://loginllama.app/api/v1/login/check',
      {
        identity_key: event.user.email,
        ip_address: event.request.ip,
        user_agent: event.request.user_agent,
        geo_country: event.request.geoip?.countryName,
        geo_city: event.request.geoip?.cityName,
        email_address: event.user.email
      },
      {
        headers: {
          'X-API-KEY': event.secrets.LOGINLLAMA_API_KEY,
          'Content-Type': 'application/json'
        },
        timeout: 5000 // 5 second timeout
      }
    );

    const apiResponse = response.data;
    const attrs = apiResponse?.data?.attributes || {};
    const meta = apiResponse?.meta || {};
    const result = {
      status: attrs.status === 'pass' ? 'success' : 'error',
      risk_score: attrs.risk_score || 0,
      codes: attrs.risk_codes || [],
      environment: meta.environment,
      unrecognized_device: attrs.unrecognized_device
    };

    // Store risk score in user metadata for later use
    api.user.setAppMetadata('last_login_risk_score', result.risk_score);
    api.user.setAppMetadata('last_login_codes', result.codes);

    // Add custom claim to token for your application to use
    api.idToken.setCustomClaim('login_risk_score', result.risk_score);
    api.accessToken.setCustomClaim('login_risk_score', result.risk_score);

    // Handle high-risk logins
    if (result.status === 'error' || result.risk_score >= 8) {
      // Block the login
      api.access.deny(
        `Login blocked: Suspicious activity detected (${result.codes.join(', ')})`
      );
      return;
    }

    // Require MFA for medium-risk logins
    if (result.risk_score >= 5) {
      api.multifactor.enable('any', {
        allowRememberBrowser: false
      });

      // Optionally, add a custom claim to show why MFA was required
      api.idToken.setCustomClaim('mfa_reason', 'elevated_risk_score');
    }

    // For new device logins with moderate risk, you could:
    if (result.unrecognized_device && result.risk_score >= 3) {
      // Send a custom email notification (via Auth0 email template)
      // or trigger a webhook to your backend
      console.log('New device login detected for user:', event.user.email);
    }

  } catch (error) {
    // IMPORTANT: Fail open - don't block logins if LoginLlama is down
    console.error('LoginLlama check failed:', error.message);

    // Optionally log to your monitoring service
    // api.redirect.sendUserTo('https://your-app.com/login-error');

    // Allow login to proceed
    return;
  }
};

/**
* Handler that will be invoked when this action is resuming after an external redirect.
* If your onExecutePostLogin function does not perform a redirect, this function can be safely ignored.
*
* @param {Event} event - Details about the user and the context in which they are logging in.
* @param {PostLoginAPI} api - Interface whose methods can be used to change the behavior of the login.
*/
// exports.onContinuePostLogin = async (event, api) => {
// };