private AccountProtection.SignUp CreateSignupAPEvent(RegisterViewModel model)
{
var signupUser = new AccountProtection.User()
{
Username = model.User.Email,
FirstName = model.User.FirstName,
LastName = model.User.LastName,
CountryRegion = model.Address.CountryRegion,
ZipCode = model.Address.ZipCode,
TimeZone = new TimeSpan(0, 0, -model.DeviceFingerPrinting.ClientTimeZone, 0).ToString(),
Language = "EN-US",
UserType = AccountProtection.UserType.Consumer,
};
var customerEmail = new AccountProtection.CustomerEmail()
{
EmailType = AccountProtection.EmailType.Primary,
EmailValue = model.User.Email,
IsEmailValidated = false,
IsEmailUsername = true
};
var customerPhone = new AccountProtection.CustomerPhone()
{
PhoneType = AccountProtection.PhoneType.Primary,
PhoneNumber = model.User.Phone,
IsPhoneNumberValidated = false,
IsPhoneUsername = false
};
var address = new AccountProtection.Address()
{
AddressType = AccountProtection.AddressType.Primary,
FirstName = model.User.FirstName,
LastName = model.User.LastName,
PhoneNumber = model.User.Phone,
Street1 = model.Address.Address1,
Street2 = model.Address.Address2,
City = model.Address.City,
State = model.Address.State,
ZipCode = model.Address.ZipCode,
CountryRegion = model.Address.CountryRegion
};
var device = new AccountProtection.DeviceContext()
{
DeviceContextId = model.DeviceFingerPrinting.SessionId,
IpAddress = _contextAccessor.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(),
Provider = DeviceContextProvider.DFPFingerPrinting.ToString()
};
var metadata = new AccountProtection.EventMetadataAccountCreate()
{
TrackingId = Guid.NewGuid().ToString(),
SignUpId = Guid.NewGuid().ToString(),
CustomerLocalDate = DateTime.Now,
MerchantTimeStamp = DateTime.Now,
AssessmentType = AssessmentType.Evaluate
};
AccountProtection.SignUp signupEvent = new AccountProtection.SignUp()
{
Name = "AP.AccountCreation",
Version = "0.5",
User = signupUser,
Email = new List <AccountProtection.CustomerEmail>()
{
customerEmail
},
Phone = new List <AccountProtection.CustomerPhone>()
{
customerPhone
},
Address = new List <AccountProtection.Address>()
{
address
},
Device = device,
Metadata = metadata
};
return(signupEvent);
}
private async Task <IActionResult> SignInUser(LoginViewModel model, string returnUrl, bool useAP)
{
var applicationUser = new ApplicationUser
{
UserName = model.Email
};
string hashedPassword = _userManager.PasswordHasher.HashPassword(applicationUser, model.Password);
bool rejectSignIn = false;
if (useAP)
{
var user = new AccountProtection.User()
{
UserType = AccountProtection.UserType.Consumer,
Username = model.Email,
UserId = model.Email
};
var device = new AccountProtection.DeviceContext()
{
DeviceContextId = model.DeviceFingerPrinting.SessionId,
IpAddress = _contextAccessor.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(),
Provider = DeviceContextProvider.DFPFingerPrinting.ToString()
};
var metadata = new AccountProtection.EventMetadataAccountLogin()
{
TrackingId = Guid.NewGuid().ToString(),
LoginId = Guid.NewGuid().ToString(),
CustomerLocalDate = DateTime.Now,
MerchantTimeStamp = DateTime.Now
};
var signIn = new AccountProtection.SignIn()
{
Name = "AP.AccountLogin",
Version = "0.5",
Device = device,
User = user,
Metadata = metadata
};
var correlationId = _fraudProtectionService.NewCorrelationId;
var signInResponse = await _fraudProtectionService.PostSignInAP(signIn, correlationId);
var fraudProtectionIO = new FraudProtectionIOModel(correlationId, signIn, signInResponse, "SignIn");
TempData.Put(FraudProtectionIOModel.TempDataKey, fraudProtectionIO);
if (signInResponse is AccountProtection.ResponseSuccess response)
{
rejectSignIn = response.ResultDetails.FirstOrDefault()?.Decision != AccountProtection.DecisionName.Approve;
}
}
else
{
var signIn = new SignIn
{
SignInId = Guid.NewGuid().ToString(),
PasswordHash = hashedPassword,
MerchantLocalDate = DateTimeOffset.Now,
CustomerLocalDate = model.DeviceFingerPrinting.ClientDate,
UserId = model.Email,
DeviceContextId = model.DeviceFingerPrinting.SessionId,
AssessmentType = AssessmentType.Protect.ToString(),
CurrentIpAddress = _contextAccessor.HttpContext.Connection.RemoteIpAddress.ToString()
};
var correlationId = _fraudProtectionService.NewCorrelationId;
var signInResponse = await _fraudProtectionService.PostSignIn(signIn, correlationId);
var fraudProtectionIO = new FraudProtectionIOModel(correlationId, signIn, signInResponse, "SignIn");
TempData.Put(FraudProtectionIOModel.TempDataKey, fraudProtectionIO);
//2 out of 3 signIn will be successful
rejectSignIn = new Random().Next(0, 3) != 0;
}
if (!rejectSignIn)
{
var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure : false);
if (!result.Succeeded)
{
ModelState.AddModelError(string.Empty, "Invalid login attempt.");
return(View("SignIn", model));
}
// redirect if signIn is not rejected and password sign-in is success
await TransferBasketToEmailAsync(model.Email);
return(RedirectToLocal(returnUrl));
}
else
{
ModelState.AddModelError("", "Signin rejected by Fraud Protection. You can try again as it has a random likelihood of happening in this sample site.");
return(View("SignIn", model));
}
}
