Lucia Auth Suspicious Login Detection

// Install: npm install loginllama
// A login handler built the way the Lucia guide describes
import { LoginLlama } from 'loginllama';
import { createSession, generateSessionToken } from './session';
import { verifyPassword } from './users'; // your own user lookup

const loginllama = new LoginLlama({
  apiKey: process.env.LOGINLLAMA_API_KEY!
});

export async function POST(request: Request) {
  const form = await request.formData();
  const email = String(form.get('email'));
  const user = await verifyPassword(email, String(form.get('password')));
  if (!user) return new Response('Invalid credentials', { status: 401 });

  // Score the login before the session row exists. Fail open: an
  // outage lets the sign-in through.
  const result = await loginllama
    .check(email, { request })
    .catch(() => null);
  if (result && result.risk_score > 7) {
    return new Response('Sign-in blocked', { status: 403 });
  }

  const token = generateSessionToken();
  await createSession(token, user.id);
  // Set the session cookie with the token, as in the Lucia guide.
  return new Response(null, { status: 302, headers: { Location: '/' } });
}