The CAPTCHA that sees
the whole attack.

import express from "express";
import { Client } from "@signalgate/node";

const app = express();
app.use(express.json());

const client = new Client({ apiKey: "pk_live_..." });

/** Build an event from one of THIS request's sealed envelopes. */
function sgEvent(req, method, envelope = "signalgate", custom) {
  return {
    userId: req.body.email,
    ip: req.headers["x-forwarded-for"] ?? req.socket.remoteAddress,
    method,
    timestamp: new Date().toISOString(),
    payload: req.body[envelope],      // the browser envelope, verbatim
    ...(custom ? { custom } : {}),    // omit custom when unused
  };
}

// --- your existing app logic (stubs for this example) ---
async function authenticate(email, password) {
  // your credential check; returns a user or null
}

async function issueSession(user) {
  // your session issuance
}

app.post("/api/login", async (req, res) => {
  // The gated request body carries TWO sealed envelopes from the browser SDK:
  // "signalgate" (for the check) and "signalgate_log" (a second fresh
  // capture, for the post-success log)

  // 1. check() BEFORE the protected action — gate on "block"
  const verdict = await client.check(sgEvent(req, "login"));
  if (verdict.action === "block") {
    return res.status(403).json({ error: "request rejected" });
  }

  // 2. The protected action itself
  const user = await authenticate(req.body.email, req.body.password);
  if (!user) return res.status(401).json({ error: "invalid credentials" });

  // 3. log() AFTER the action succeeded — a SECOND event from
  // "signalgate_log": each API call consumes its payload's single-use
  // nonce — never reuse the checked payload for the log
  client.log(sgEvent(req, "login", "signalgate_log"));
  res.json({ ok: true, session: await issueSession(user) });
});

app.listen(3000);

package main

import (
	"encoding/json"
	"log"
	"net/http"
	"time"

	signalgate "github.com/SignalGate/signalgate-go"
)

var client *signalgate.Client

// The browser envelope, forwarded verbatim by your frontend.
type sgPayload struct {
	Encrypted string `json:"encrypted"`
	Timestamp int64  `json:"timestamp"`
	Nonce     string `json:"nonce"`
	V         *int   `json:"v"`
}

type loginRequest struct {
	Email    string    `json:"email"`
	Password string    `json:"password"`
	// The gated request carries TWO sealed envelopes from the browser SDK:
	// "signalgate" for the Check, "signalgate_log" (a second fresh capture)
	// for the post-success Log.
	SignalGate    sgPayload `json:"signalgate"`
	SignalGateLog sgPayload `json:"signalgate_log"`
}

// sgEvent builds an Event from one of THIS request's sealed envelopes.
func sgEvent(r *http.Request, email, method string, p sgPayload,
	custom map[string]any) signalgate.Event {
	ip := r.Header.Get("X-Forwarded-For")
	if ip == "" {
		ip = r.RemoteAddr
	}
	return signalgate.Event{
		UserID:    email,
		IP:        ip,
		Method:    method,
		Timestamp: time.Now().UTC().Format(time.RFC3339),
		Payload: signalgate.EncryptedPayload{
			Encrypted: p.Encrypted,
			Timestamp: p.Timestamp,
			Nonce:     p.Nonce,
			V:         p.V,
		},
		Custom: custom,
	}
}

// --- your existing app logic (stubs for this example) ---

func authenticate(email, password string) bool {
	return true // your credential check
}

func issueSession(email string) string {
	return "session-token" // your session issuance
}

func handleLogin(w http.ResponseWriter, r *http.Request) {
	var req loginRequest
	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
		http.Error(w, "bad request", http.StatusBadRequest)
		return
	}

	// 1. Check BEFORE the protected action — gate on "block"
	verdict, err := client.Check(sgEvent(r, req.Email, "login", req.SignalGate, nil))
	if err != nil {
		// With fail-open on (the default) this is a 4xx *ServerError — a bug
		// in the request. Surface it loudly; it is not a fraud signal.
		log.Printf("signalgate check failed: %v", err)
	} else if verdict.Action == "block" {
		http.Error(w, "request rejected", http.StatusForbidden)
		return
	}

	// 2. The protected action itself
	if !authenticate(req.Email, req.Password) {
		http.Error(w, "invalid credentials", http.StatusUnauthorized)
		return
	}

	// 3. Log AFTER the action succeeded — a SECOND event from
	// "signalgate_log": each API call consumes its payload's single-use
	// nonce — never reuse the checked payload for the Log
	client.Log(sgEvent(r, req.Email, "login", req.SignalGateLog, nil))
	json.NewEncoder(w).Encode(map[string]any{
		"ok": true, "session": issueSession(req.Email),
	})
}

func main() {
	var err error
	client, err = signalgate.New("pk_live_...")
	if err != nil {
		log.Fatal(err)
	}
	defer client.Close(5 * time.Second)

	http.HandleFunc("POST /api/login", handleLogin)
	log.Fatal(http.ListenAndServe(":8080", nil))
}

use SignalGate\Client;

/** Build an event from one of THIS request's sealed envelopes. */
function sgEvent(
    array $body,
    string $method,
    string $envelope = 'signalgate',
    ?array $custom = null,
): array {
    $event = [
        'user_id' => $body['email'],
        'ip' => $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'],
        'method' => $method,
        'timestamp' => date('c'),
        'payload' => $body[$envelope],      // the browser envelope, verbatim
    ];
    if ($custom !== null) {
        $event['custom'] = $custom;         // omit custom when unused
    }

    return $event;
}

// ── Action handler (login.php) ──
$client = new Client(['api_key' => 'pk_live_...']);
$body = json_decode(file_get_contents('php://input'), true);

// The gated request body carries TWO sealed envelopes from the browser SDK:
// "signalgate" (for the check) and "signalgate_log" (a second fresh
// capture, for the post-success log)

// 1. check() BEFORE the protected action — gate on "block"
$verdict = $client->check(sgEvent($body, 'login'));
if ($verdict->action === 'block') {
    http_response_code(403);
    exit(json_encode(['error' => 'request rejected']));
}

// 2. The protected action itself
$user = authenticate($body['email'], $body['password']);
if ($user === null) {
    http_response_code(401);
    exit(json_encode(['error' => 'invalid credentials']));
}

// 3. log() AFTER the action succeeded — a SECOND event from
// "signalgate_log": each API call consumes its payload's single-use
// nonce — never reuse the checked payload for the log
$client->log(sgEvent($body, 'login', 'signalgate_log'));
echo json_encode(['ok' => true, 'session' => issueSession($user)]);

# 1. check() BEFORE the protected action — gate on "block"
curl -s -X POST https://api.signalgate.ai/v0/check \
  -H "Authorization: Bearer pk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": "u_123",
    "ip": "203.0.113.42",
    "method": "login",
    "timestamp": "2026-04-01T13:08:50+00:00",
    "payload": {
      "encrypted": "<base64 blob from the frontend SDK>",
      "timestamp": 1748102400000,
      "nonce": "aZ19bCde3fGhI4jK",
      "v": 2
    }
  }' | jq -r '.data.action'
# -> "allow" | "dry_run_block" | "block"
# On "block": reject the request. Otherwise:

# 2. Run the protected action (your login) ...

# 3. log() AFTER the action succeeds — with the SECOND sealed envelope the
#    frontend captured for this request: each API call consumes its payload's
#    single-use nonce — never reuse the checked payload for the log
curl -X POST https://api.signalgate.ai/v0/log \
  -H "Authorization: Bearer pk_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "user_id": "u_123",
    "ip": "203.0.113.42",
    "method": "login",
    "timestamp": "2026-04-01T13:08:52+00:00",
    "payload": {
      "encrypted": "<a second, fresh base64 blob from the frontend SDK>",
      "timestamp": 1748102402000,
      "nonce": "qX42mNp7rEwT9kLa",
      "v": 2
    }
  }'