Auth.js (NextAuth) Suspicious Login Detection

// Install: npm install loginllama
// auth.ts
import NextAuth, { CredentialsSignin } from 'next-auth';
import Credentials from 'next-auth/providers/credentials';
import { LoginLlama } from 'loginllama';
import { verifyPassword } from './users'; // your own user lookup

const loginllama = new LoginLlama({
  apiKey: process.env.LOGINLLAMA_API_KEY!
});

class RiskySignIn extends CredentialsSignin {
  code = 'risky_sign_in';
}

export const { handlers, auth, signIn, signOut } = NextAuth({
  providers: [
    Credentials({
      credentials: { email: {}, password: {} },
      async authorize(credentials, request) {
        const email = String(credentials.email);
        const user = await verifyPassword(email, String(credentials.password));
        if (!user) return null;

        // Auth.js hands over the original request, so the IP and
        // User-Agent come from its headers.
        // Fail open: an outage lets the sign-in through.
        const result = await loginllama
          .check(email, { request })
          .catch(() => null);
        if (result && result.risk_score > 7) throw new RiskySignIn();

        return user;
      }
    })
  ]
});