|
| 1 | +"use client"; |
| 2 | + |
| 3 | +import { useEffect } from "react"; |
| 4 | + |
| 5 | +/** |
| 6 | + * sessionStorage key under which we stash the MaxMind device-tracking token |
| 7 | + * captured by device.js. The register form reads it just before submitting so |
| 8 | + * the value can be forwarded to Zitadel as session metadata. |
| 9 | + */ |
| 10 | +export const MAXMIND_TOKEN_STORAGE_KEY = "datum.maxmind.trackingToken"; |
| 11 | + |
| 12 | +/** |
| 13 | + * Cookie set by MaxMind's device.js after a successful fingerprint exchange. |
| 14 | + * The cookie value is the tracking token; we mirror it into sessionStorage so |
| 15 | + * we don't have to parse document.cookie at submit time. |
| 16 | + */ |
| 17 | +const MAXMIND_COOKIE_NAME = "__mmapiwsid"; |
| 18 | + |
| 19 | +function readMaxMindCookie(): string { |
| 20 | + if (typeof document === "undefined") return ""; |
| 21 | + const prefix = `${MAXMIND_COOKIE_NAME}=`; |
| 22 | + for (const part of document.cookie.split(";")) { |
| 23 | + const trimmed = part.trim(); |
| 24 | + if (trimmed.startsWith(prefix)) { |
| 25 | + return decodeURIComponent(trimmed.slice(prefix.length)); |
| 26 | + } |
| 27 | + } |
| 28 | + return ""; |
| 29 | +} |
| 30 | + |
| 31 | +/** |
| 32 | + * MaxMindTracker loads the MaxMind minFraud device.js snippet on mount and |
| 33 | + * polls for the resulting __mmapiwsid cookie, mirroring it into |
| 34 | + * sessionStorage. Rendering is gated by NEXT_PUBLIC_MAXMIND_ACCOUNT_ID — if |
| 35 | + * unset the component is a no-op, so dev and preview deployments never |
| 36 | + * contact MaxMind. |
| 37 | + */ |
| 38 | +export function MaxMindTracker({ accountId }: { accountId: string }) { |
| 39 | + useEffect(() => { |
| 40 | + if (!accountId) return; |
| 41 | + if (typeof window === "undefined") return; |
| 42 | + |
| 43 | + const w = window as unknown as { |
| 44 | + __mmapiws?: { accountId?: string }; |
| 45 | + }; |
| 46 | + w.__mmapiws = w.__mmapiws || {}; |
| 47 | + w.__mmapiws.accountId = accountId; |
| 48 | + |
| 49 | + // Load device.js (idempotent — guard against StrictMode double-mount). |
| 50 | + if (!document.querySelector('script[data-maxmind="device"]')) { |
| 51 | + const script = document.createElement("script"); |
| 52 | + script.src = "https://device.maxmind.com/js/device.js"; |
| 53 | + script.async = true; |
| 54 | + script.dataset.maxmind = "device"; |
| 55 | + document.body.appendChild(script); |
| 56 | + } |
| 57 | + |
| 58 | + // Poll briefly for the tracking-token cookie. device.js sets it after |
| 59 | + // an async fingerprint exchange, typically within a few hundred ms. |
| 60 | + let attempts = 0; |
| 61 | + const maxAttempts = 30; // ~6 seconds at 200ms cadence |
| 62 | + const handle = window.setInterval(() => { |
| 63 | + attempts++; |
| 64 | + const token = readMaxMindCookie(); |
| 65 | + if (token) { |
| 66 | + try { |
| 67 | + window.sessionStorage.setItem(MAXMIND_TOKEN_STORAGE_KEY, token); |
| 68 | + } catch { |
| 69 | + // sessionStorage may be disabled (private mode). Best-effort only. |
| 70 | + } |
| 71 | + window.clearInterval(handle); |
| 72 | + return; |
| 73 | + } |
| 74 | + if (attempts >= maxAttempts) { |
| 75 | + window.clearInterval(handle); |
| 76 | + } |
| 77 | + }, 200); |
| 78 | + |
| 79 | + return () => window.clearInterval(handle); |
| 80 | + }, [accountId]); |
| 81 | + |
| 82 | + return null; |
| 83 | +} |
| 84 | + |
| 85 | +/** |
| 86 | + * Returns the MaxMind device-tracking token captured during the session, or |
| 87 | + * undefined when none is available (sessionStorage blocked, MaxMind script |
| 88 | + * not yet finished, or NEXT_PUBLIC_MAXMIND_ACCOUNT_ID unset). |
| 89 | + */ |
| 90 | +export function readMaxMindTrackingToken(): string | undefined { |
| 91 | + if (typeof window === "undefined") return undefined; |
| 92 | + try { |
| 93 | + const value = window.sessionStorage.getItem(MAXMIND_TOKEN_STORAGE_KEY); |
| 94 | + return value || undefined; |
| 95 | + } catch { |
| 96 | + return undefined; |
| 97 | + } |
| 98 | +} |
0 commit comments