Write your rules

CREATE TABLE signup_evidence (
  account_id   TEXT PRIMARY KEY,
  request_id   TEXT NOT NULL,
  client_ip    TEXT NOT NULL,
  instance_id  TEXT,
  machine_id   TEXT,
  identity_ver INTEGER NOT NULL,
  created_at   INTEGER NOT NULL
);
CREATE INDEX signup_evidence_ip       ON signup_evidence (client_ip);
CREATE INDEX signup_evidence_instance ON signup_evidence (instance_id);
CREATE INDEX signup_evidence_machine  ON signup_evidence (machine_id);

import { heretic } from '@heretic-hq/collector';

const form = document.querySelector('#signup');
const submit = form.querySelector('button[type=submit]');
submit.disabled = true;

const probe = heretic({ siteKey: 'hrtc_live_0123456789abcdef01234567' });

form.addEventListener('submit', async (event) => {
  event.preventDefault();
  const result = await probe;
  const body = Object.fromEntries(new FormData(form));
  body.heretic_request_id = result.ok ? result.requestId : null;
  const response = await fetch('/signup', {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify(body),
  });
  const next = await response.json();
  if (next.challenge_url) {
    // guard.js is loaded on the page. The ceremony opens over the form and
    // the callback fires when it reaches an outcome.
    heretic.challenge(next.challenge_url, {
      callback: (result) => { location.href = '/signup/finish?challenge=' + result.challenge_id; },
    });
  }
});

probe.then(() => { submit.disabled = false; });

import { readHereticVerdict } from './heretic.js'; // the helper on the verdict endpoint page

export async function signup(body, db) {
  if (!body.heretic_request_id) return challenge(body, db, 'no-probe');

  const verdict = await readHereticVerdict(body.heretic_request_id);
  // readHereticVerdict throws on 5xx: a probe Heretic cannot prove is not
  // uncontradicted. It returns null on 404.
  if (!verdict) return challenge(body, db, 'no-probe');

  const ip = verdict.record.client_ip;
  const instance = verdict.identity.instance ?? null;
  const machine = verdict.identity.machine ?? null;
  const version = verdict.identity.version;

  const duplicate = await db.get(
    `SELECT account_id FROM signup_evidence
      WHERE client_ip = ?
         OR (instance_id IS NOT NULL AND instance_id = ? AND identity_ver = ?)
         OR (machine_id  IS NOT NULL AND machine_id  = ? AND identity_ver = ?)
      LIMIT 1`,
    ip, instance, version, machine, version,
  );

  const reason =
    verdict.verdict !== 'uncontradicted' ? verdict.verdict
    : duplicate ? `duplicate:${duplicate.account_id}`
    : null;

  if (reason) return challenge(body, db, reason);

  const account = await createAccount(body, db);
  await db.run(
    `INSERT INTO signup_evidence VALUES (?, ?, ?, ?, ?, ?, ?)`,
    account.id, body.heretic_request_id, ip, instance, machine, version, Date.now(),
  );
  return { account_id: account.id };
}

export async function signup(body, db) {
  const check = await verifyHereticToken(body['heretic-response'], body.idempotency_key);
  if (!check.ok) return reject(check.code);           // no token, no account
  if (check.hostname !== 'casino.example') return reject('hostname');

  const verdict = await readHereticVerdict(check.requestId);
  // check.verdict says what the probe found and check.challenged whether a
  // ceremony ran. The assessment behind check.requestId carries the address
  // and the identifiers, whichever path issued the token.
  const duplicate = await findDuplicate(db, verdict);  // the query above
  if (duplicate) return reject(`duplicate:${duplicate.account_id}`);
  return createAccountWithEvidence(body, verdict, db);
}