verify click limit before universal link return

Author: SikoraKam

packages/react-native-detour/src/expo-router/nativeIntent.ts

@@ -1,5 +1,6 @@
 import { OPENED_VIA_UNIVERSAL_LINK } from "../analytics/const/definedEvents";
 import { analyticsEmitter } from "../analytics/utils/analyticsEmitter";
+import { checkClickLimit } from "../links/api/checkClickLimit";
 import { resolveShortLink } from "../links/api/resolveShortLink";
 import type { Config } from "../links/types";
 import { getRouteFromDeepLink } from "../links/utils/urlHelpers";
@@ -297,6 +298,23 @@ export const createDetourNativeIntentHandler = (
       return fallbackPath;
     }
 
+    const clickLimitStatus = await checkClickLimit({
+      apiKey: options.config.apiKey,
+      appID: options.config.appID,
+    });
+
+    if (!clickLimitStatus.allowed) {
+      console.error("🔗[Detour:CLICK_LIMIT_ERROR] Native-intent routing blocked:", {
+        path,
+        status: clickLimitStatus.status,
+        error: clickLimitStatus.error,
+        code: clickLimitStatus.code,
+        clicksInPeriod: clickLimitStatus.clicksInPeriod,
+        effectiveLimit: clickLimitStatus.effectiveLimit,
+      });
+      return fallbackPath;
+    }
+
     let resolvedUrl = url;
 
     if (isShortLinkCandidate(url)) {

packages/react-native-detour/src/links/api/checkClickLimit.ts

@@ -0,0 +1,78 @@
+import { SDK_HEADER_VALUE } from "../../version";
+import type { RequiredConfig } from "../types";
+
+const API_URL = "https://godetour.dev/api/link/click-limit";
+
+type ClickLimitResponseBody = {
+  allowed?: boolean;
+  error?: string;
+  code?: string;
+  clicksInPeriod?: number;
+  effectiveLimit?: number;
+};
+
+export type ClickLimitCheckResult =
+  | {
+      allowed: true;
+    }
+  | {
+      allowed: false;
+      status: number;
+      error: string;
+      code?: string;
+      clicksInPeriod?: number;
+      effectiveLimit?: number;
+    };
+
+const getFallbackErrorMessage = (status: number) => {
+  if (status === 402) {
+    return "Click limit exceeded";
+  }
+  return "Click limit check failed";
+};
+
+export const checkClickLimit = async ({
+  apiKey: API_KEY,
+  appID,
+}: Pick<RequiredConfig, "apiKey" | "appID">): Promise<ClickLimitCheckResult> => {
+  try {
+    const response = await fetch(API_URL, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${API_KEY}`,
+        "X-App-ID": appID,
+        "X-SDK": SDK_HEADER_VALUE,
+      },
+    });
+
+    let body: ClickLimitResponseBody | null = null;
+    try {
+      body = (await response.json()) as ClickLimitResponseBody;
+    } catch {
+      body = null;
+    }
+
+    const isExplicitDeny = body?.allowed === false || response.status === 402;
+    if (isExplicitDeny) {
+      return {
+        allowed: false,
+        status: response.status,
+        error: body?.error || getFallbackErrorMessage(response.status),
+        code: body?.code,
+        clicksInPeriod: body?.clicksInPeriod,
+        effectiveLimit: body?.effectiveLimit,
+      };
+    }
+
+    if (!response.ok) {
+      // Fail-open for temporary backend/network issues so apps keep working.
+      return { allowed: true };
+    }
+
+    return { allowed: true };
+  } catch {
+    // Fail-open on transport errors; limit enforcement only happens on explicit deny.
+    return { allowed: true };
+  }
+};

packages/react-native-detour/src/links/hooks/useDetour.ts

@@ -4,6 +4,7 @@ import { Linking } from "react-native";
 
 import { OPENED_VIA_UNIVERSAL_LINK } from "../../analytics/const/definedEvents";
 import { analyticsEmitter } from "../../analytics/utils/analyticsEmitter";
+import { checkClickLimit } from "../api/checkClickLimit";
 import { getDeferredLink } from "../api/getDeferredLink";
 import { resolveShortLink } from "../api/resolveShortLink";
 import type { DetourContextType, DetourLink, LinkType, RequiredConfig } from "../types";
@@ -76,6 +77,21 @@ export const useDetour = ({
         const detectedType: LinkType = isWeb ? "verified" : "scheme";
         const type = typeOverride ?? detectedType;
 
+        if (isWeb && type !== "deferred") {
+          const clickLimitStatus = await checkClickLimit({ apiKey, appID });
+          if (!clickLimitStatus.allowed) {
+            console.error("🔗[Detour:CLICK_LIMIT_ERROR] Universal/App link blocked:", {
+              url: rawLink,
+              status: clickLimitStatus.status,
+              error: clickLimitStatus.error,
+              code: clickLimitStatus.code,
+              clicksInPeriod: clickLimitStatus.clicksInPeriod,
+              effectiveLimit: clickLimitStatus.effectiveLimit,
+            });
+            return null;
+          }
+        }
+
         if (isWeb) {
           const pathSegments = urlObj.pathname.split("/").filter(Boolean);
           const isSingleSegmentPath =