private AccountProtection.SignUp CreateSignupAPEvent(RegisterViewModel model) { var signupUser = new AccountProtection.User() { Username = model.User.Email, FirstName = model.User.FirstName, LastName = model.User.LastName, CountryRegion = model.Address.CountryRegion, ZipCode = model.Address.ZipCode, TimeZone = new TimeSpan(0, 0, -model.DeviceFingerPrinting.ClientTimeZone, 0).ToString(), Language = "EN-US", UserType = AccountProtection.UserType.Consumer, }; var customerEmail = new AccountProtection.CustomerEmail() { EmailType = AccountProtection.EmailType.Primary, EmailValue = model.User.Email, IsEmailValidated = false, IsEmailUsername = true }; var customerPhone = new AccountProtection.CustomerPhone() { PhoneType = AccountProtection.PhoneType.Primary, PhoneNumber = model.User.Phone, IsPhoneNumberValidated = false, IsPhoneUsername = false }; var address = new AccountProtection.Address() { AddressType = AccountProtection.AddressType.Primary, FirstName = model.User.FirstName, LastName = model.User.LastName, PhoneNumber = model.User.Phone, Street1 = model.Address.Address1, Street2 = model.Address.Address2, City = model.Address.City, State = model.Address.State, ZipCode = model.Address.ZipCode, CountryRegion = model.Address.CountryRegion }; var device = new AccountProtection.DeviceContext() { DeviceContextId = model.DeviceFingerPrinting.SessionId, IpAddress = _contextAccessor.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), Provider = DeviceContextProvider.DFPFingerPrinting.ToString() }; var metadata = new AccountProtection.EventMetadataAccountCreate() { TrackingId = Guid.NewGuid().ToString(), SignUpId = Guid.NewGuid().ToString(), CustomerLocalDate = DateTime.Now, MerchantTimeStamp = DateTime.Now, AssessmentType = AssessmentType.Evaluate }; AccountProtection.SignUp signupEvent = new AccountProtection.SignUp() { Name = "AP.AccountCreation", Version = "0.5", User = signupUser, Email = new List <AccountProtection.CustomerEmail>() { customerEmail }, Phone = new List <AccountProtection.CustomerPhone>() { customerPhone }, Address = new List <AccountProtection.Address>() { address }, Device = device, Metadata = metadata }; return(signupEvent); }
private async Task <IActionResult> SignInUser(LoginViewModel model, string returnUrl, bool useAP) { var applicationUser = new ApplicationUser { UserName = model.Email }; string hashedPassword = _userManager.PasswordHasher.HashPassword(applicationUser, model.Password); bool rejectSignIn = false; if (useAP) { var user = new AccountProtection.User() { UserType = AccountProtection.UserType.Consumer, Username = model.Email, UserId = model.Email }; var device = new AccountProtection.DeviceContext() { DeviceContextId = model.DeviceFingerPrinting.SessionId, IpAddress = _contextAccessor.HttpContext.Connection.RemoteIpAddress.MapToIPv4().ToString(), Provider = DeviceContextProvider.DFPFingerPrinting.ToString() }; var metadata = new AccountProtection.EventMetadataAccountLogin() { TrackingId = Guid.NewGuid().ToString(), LoginId = Guid.NewGuid().ToString(), CustomerLocalDate = DateTime.Now, MerchantTimeStamp = DateTime.Now }; var signIn = new AccountProtection.SignIn() { Name = "AP.AccountLogin", Version = "0.5", Device = device, User = user, Metadata = metadata }; var correlationId = _fraudProtectionService.NewCorrelationId; var signInResponse = await _fraudProtectionService.PostSignInAP(signIn, correlationId); var fraudProtectionIO = new FraudProtectionIOModel(correlationId, signIn, signInResponse, "SignIn"); TempData.Put(FraudProtectionIOModel.TempDataKey, fraudProtectionIO); if (signInResponse is AccountProtection.ResponseSuccess response) { rejectSignIn = response.ResultDetails.FirstOrDefault()?.Decision != AccountProtection.DecisionName.Approve; } } else { var signIn = new SignIn { SignInId = Guid.NewGuid().ToString(), PasswordHash = hashedPassword, MerchantLocalDate = DateTimeOffset.Now, CustomerLocalDate = model.DeviceFingerPrinting.ClientDate, UserId = model.Email, DeviceContextId = model.DeviceFingerPrinting.SessionId, AssessmentType = AssessmentType.Protect.ToString(), CurrentIpAddress = _contextAccessor.HttpContext.Connection.RemoteIpAddress.ToString() }; var correlationId = _fraudProtectionService.NewCorrelationId; var signInResponse = await _fraudProtectionService.PostSignIn(signIn, correlationId); var fraudProtectionIO = new FraudProtectionIOModel(correlationId, signIn, signInResponse, "SignIn"); TempData.Put(FraudProtectionIOModel.TempDataKey, fraudProtectionIO); //2 out of 3 signIn will be successful rejectSignIn = new Random().Next(0, 3) != 0; } if (!rejectSignIn) { var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure : false); if (!result.Succeeded) { ModelState.AddModelError(string.Empty, "Invalid login attempt."); return(View("SignIn", model)); } // redirect if signIn is not rejected and password sign-in is success await TransferBasketToEmailAsync(model.Email); return(RedirectToLocal(returnUrl)); } else { ModelState.AddModelError("", "Signin rejected by Fraud Protection. You can try again as it has a random likelihood of happening in this sample site."); return(View("SignIn", model)); } }