Prevent account takeover

// ========== CLIENT INTEGRATION (Web SDK) ==========
// Install SDK: see Before you start in the guide.

import { drs, initialize } from '@transmitsecurity/platform-web-sdk';

// Initialize the SDK as early as possible (e.g. app entry point) to start telemetry collection.
// If SDK was loaded via script tag, use: window.tsPlatform.initialize({...})
initialize({
  clientId: 'YOUR_CLIENT_ID',
  drs: {
    enableSessionToken: true,
    serverPath: 'https://api.transmitsecurity.io/risk-collect/', // US
    // For EU: 'https://api.eu.transmitsecurity.io/risk-collect/'
    // For Canada: 'https://api.ca.transmitsecurity.io/risk-collect/'
    // For Australia: 'https://api.au.transmitsecurity.io/risk-collect/'
  },
});

// When the user attempts a sensitive action (e.g. login), get session token and send to your backend with claimed user id.
async function onLoginClick(username) {
  const sessionToken = await drs.getSessionToken();

  const response = await fetch('https://your-backend.com/api/login', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      sessionToken: sessionToken,
      username: username,
    }),
  });

  const result = await response.json();

  if (result.recommendation === 'DENY') {
    showError('Login denied');
  } else if (result.recommendation === 'CHALLENGE') {
    presentChallenge(result.challengeType); // e.g. trigger SMS OTP
  } else {
    // TRUST or ALLOW — proceed with login (user is set via reportActionResult on backend)
    completeLogin(result);
  }
}

// On logout (or session expiry), clear the user so the device is not tied to that user for future actions.
async function onLogoutClick() {
  await drs.clearUser();
  performLogout();
}

// ========== BACKEND INTEGRATION ==========
// BASE_URL, CLIENT_ID, CLIENT_SECRET: see Before you start in the guide.

// Obtain an OAuth access token with client credentials before calling Risk APIs.
async function getAccessToken() {
  const response = await fetch(`${BASE_URL}/oidc/token`, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams({
      grant_type: 'client_credentials',
      client_id: CLIENT_ID,
      client_secret: CLIENT_SECRET,
    }),
  });
  const data = await response.json();
  return data.access_token;
}

// Trigger the action and get the risk recommendation in one call (session_token, action_type, claimed_user_id).
async function triggerLogin(accessToken, sessionToken, claimedUserId, correlationId) {
  const response = await fetch(
    `${BASE_URL}/risk/v1/action/trigger-action?get_recommendation=true`,
    {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        Authorization: `Bearer ${accessToken}`,
      },
      body: JSON.stringify({
        session_token: sessionToken,
        action_type: 'login',
        claimed_user_id: claimedUserId, // use hashed value in production
        claimed_user_id_type: 'email',
        correlation_id: correlationId,
      }),
    }
  );
  return await response.json();
}

// Handle DENY / CHALLENGE / ALLOW|TRUST and report the action result; set user_id on success.
async function handleLoginRequest(sessionToken, username) {
  const accessToken = await getAccessToken();
  const correlationId = crypto.randomUUID();

  const { action_token, recommendation } = await triggerLogin(
    accessToken,
    sessionToken,
    username,
    correlationId
  );

  const recommendationType = recommendation.recommendation.type;

  if (recommendationType === 'DENY') {
    await reportActionResult(accessToken, action_token, 'failure', undefined, undefined);
    return { recommendation: 'DENY' };
  }

  if (recommendationType === 'CHALLENGE') {
    const challengeResult = await performChallenge('sms_otp');
    await reportActionResult(
      accessToken,
      action_token,
      challengeResult.success ? 'success' : 'failure',
      challengeResult.success ? 'opaque-internal-user-id' : undefined,
      'sms_otp'
    );
    return {
      recommendation: 'CHALLENGE',
      challengeType: 'sms_otp',
      success: challengeResult.success,
    };
  }

  // ALLOW or TRUST — report success and set user (user_id must be opaque, not PII)
  await reportActionResult(accessToken, action_token, 'success', 'opaque-internal-user-id', undefined);
  return { recommendation: recommendationType };
}

// Report action result to Mosaic; include user_id on success to associate the device session with the user.
async function reportActionResult(accessToken, actionToken, result, userId, challengeType) {
  const body = {
    action_token: actionToken,
    result: result, // 'success', 'failure', or 'incomplete'
  };
  if (result === 'success' && userId) {
    body.user_id = userId;
  }
  if (challengeType) {
    body.challenge_type = challengeType;
  }

  await fetch(`${BASE_URL}/risk/v1/action/result`, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      Authorization: `Bearer ${accessToken}`,
    },
    body: JSON.stringify(body),
  });
}