AI token fraud_ AI token fraud_

async function grantFreeCredits(req, res) {
  const { eventId, userId } = req.body;

  const event = await client.getEvent(eventId);
  const visitorId = event.identification?.visitor_id;

  const isBadBot = event.bot === 'bad';
  const isVirtualMachine = event.virtual_machine;
  const isTampered = event.tampering;
  // Needs linkedId (the account ID) sent from the client
  const accounts = event.velocity?.distinct_linked_id?.['24_hours'];
  const priorGrants = await countGrantsForVisitor(visitorId);

  if (isBadBot || isVirtualMachine || isTampered ||
      accounts > 1 || priorGrants > 0) {
    return res.status(403).json({ error: 'Free credits unavailable' });
  }

  await addCredits(userId, FREE_TIER_TOKENS);
  res.json({ status: 'granted' });
}

async function handleCompletion(req, res) {
  const { eventId, accountId, prompt } = req.body;

  const event = await client.getEvent(eventId);
  const visitorId = event.identification?.visitor_id;

  const spoofedAgent = event.bot_info?.identity === 'spoofed';
  const suspectScore = event.suspect_score;
  const highActivity = event.high_activity_device;
  const knownDevice = await isKnownDevice(accountId, visitorId);

  if (spoofedAgent || suspectScore > 20 ||
      (highActivity && !knownDevice)) {
    return res.status(429).json({ error: 'Request throttled' });
  }

  res.json(await runModel(prompt));
}

async function handleLogin(req, res) {
  const { eventId, email } = req.body;

  const event = await client.getEvent(eventId);
  const visitorId = event.identification?.visitor_id;

  // Needs linkedId (the account ID) sent from the client
  const ips = event.velocity?.distinct_ip_by_linked_id?.['24_hours'];
  const usingVpn = event.vpn;
  const usingProxy = event.proxy;
  const devices = await countDevicesForAccount(email, visitorId);

  if (devices > PLAN_DEVICE_LIMIT ||
      (ips > 3 && (usingVpn || usingProxy))) {
    return res.status(403).json({ error: 'Plan device limit reached' });
  }

  await completeLogin(email);
  res.json({ status: 'authenticated' });
}