Initial setup

import SuperTokens from "supertokens-node";
import EmailPassword from "supertokens-node/recipe/emailpassword";
import Session from "supertokens-node/recipe/session";
import axios from "axios";
import { createHash } from "crypto";

function getIpFromRequest(req: Request): string {
  let headers: { [key: string]: string } = {};
  for (let key of Object.keys(req.headers)) {
    headers[key] = (req as any).headers[key]!;
  }
  return (req as any).headers["x-forwarded-for"] || "127.0.0.1";
}

const getBruteForceConfig = (userIdentifier: string, ip: string, prefix?: string) => [
  {
    key: `${prefix ? `${prefix}-` : ""}${userIdentifier}`,
    maxRequests: [
      { limit: 5, perTimeIntervalMS: 60 * 1000 },
      { limit: 15, perTimeIntervalMS: 60 * 60 * 1000 },
    ],
  },
  {
    key: `${prefix ? `${prefix}-` : ""}${ip}`,
    maxRequests: [
      { limit: 5, perTimeIntervalMS: 60 * 1000 },
      { limit: 15, perTimeIntervalMS: 60 * 60 * 1000 },
    ],
  },
];

SuperTokens.init({
  appInfo: {
    apiDomain: "...",
    appName: "...",
    websiteDomain: "...",
  },
  supertokens: {
    connectionURI: "...",
  },
  recipeList: [
    EmailPassword.init({
      override: {
        apis: (originalImplementation) => {
          return {
            ...originalImplementation,
            signUpPOST: async function (input) {
              // We need to generate a request ID in order to detect possible bots, suspicious IP addresses, etc.
              const requestId = (await input.options.req.getJSONBody()).requestId;
              if (!requestId) {
                return {
                  status: "GENERAL_ERROR",
                  message: "The request ID is required",
                };
              }

              const actionType = "emailpassword-sign-up";
              const ip = getIpFromRequest(input.options.req.original);
              let email = input.formFields.filter((f) => f.id === "email")[0].value as string;
              let password = input.formFields.filter((f) => f.id === "password")[0].value as string;
              const bruteForceConfig = getBruteForceConfig(email, ip, actionType);

              return originalImplementation.signUpPOST!(input);
            },
            signInPOST: async function (input) {
              // We need to generate a request ID in order to detect possible bots, suspicious IP addresses, etc.
              const requestId = (await input.options.req.getJSONBody()).requestId;
              if (!requestId) {
                return {
                  status: "GENERAL_ERROR",
                  message: "The request ID is required",
                };
              }

              const actionType = "emailpassword-sign-up";
              const ip = getIpFromRequest(input.options.req.original);
              let email = input.formFields.filter((f) => f.id === "email")[0].value as string;
              let password = input.formFields.filter((f) => f.id === "password")[0].value as string;
              const bruteForceConfig = getBruteForceConfig(email, ip, actionType);

              return originalImplementation.signInPOST!(input);
            },
            generatePasswordResetTokenPOST: async function (input) {
              // We need to generate a request ID in order to detect possible bots, suspicious IP addresses, etc.
              const requestId = (await input.options.req.getJSONBody()).requestId;
              if (!requestId) {
                return {
                  status: "GENERAL_ERROR",
                  message: "The request ID is required",
                };
              }

              const actionType = "emailpassword-sign-up";
              const ip = getIpFromRequest(input.options.req.original);
              let email = input.formFields.filter((f) => f.id === "email")[0].value as string;
              let password = input.formFields.filter((f) => f.id === "password")[0].value as string;
              const bruteForceConfig = getBruteForceConfig(email, ip, actionType);

              return originalImplementation.generatePasswordResetTokenPOST!(input);
            },
          };
        },
      },
    }),
  ],
});

import (
  "fmt"
	"encoding/json"
	"net/http"
  "errors"

	"github.com/supertokens/supertokens-golang/recipe/emailpassword"
	"github.com/supertokens/supertokens-golang/recipe/emailpassword/epmodels"
	"github.com/supertokens/supertokens-golang/supertokens"
)

type BruteForceConfig struct {
	Key         string        `json:"key"`
	MaxRequests []MaxRequests `json:"maxRequests"`
}

type MaxRequests struct {
	Limit             int `json:"limit"`
	PerTimeIntervalMS int `json:"perTimeIntervalMS"`
}

type ReqBody struct {
	RequestID *string `json:"requestId"`
}

func getIpFromRequest(req *http.Request) string {
	if forwardedFor := req.Header.Get("X-Forwarded-For"); forwardedFor != "" {
		return forwardedFor
	}
	return "127.0.0.1"
}

func getBruteForceConfig(userIdentifier string, ip string, prefix string) []BruteForceConfig {
	var key string
	if prefix != "" {
		key = prefix + "-"
	}

	return []BruteForceConfig{
		{
			Key: key + userIdentifier,
			MaxRequests: []MaxRequests{
				{Limit: 5, PerTimeIntervalMS: 60 * 1000},
				{Limit: 15, PerTimeIntervalMS: 60 * 60 * 1000},
			},
		},
		{
			Key: key + ip,
			MaxRequests: []MaxRequests{
				{Limit: 5, PerTimeIntervalMS: 60 * 1000},
				{Limit: 15, PerTimeIntervalMS: 60 * 60 * 1000},
			},
		},
	}
}

func main() {
	supertokens.Init(supertokens.TypeInput{
		RecipeList: []supertokens.Recipe{
			emailpassword.Init(&epmodels.TypeInput{
				Override: &epmodels.OverrideStruct{
					APIs: func(originalImplementation epmodels.APIInterface) epmodels.APIInterface {
						// rewrite the original implementation of SignUpPOST
						originalSignUpPOST := *originalImplementation.SignUpPOST
						(*originalImplementation.SignUpPOST) = func(formFields []epmodels.TypeFormField, tenantId string, options epmodels.APIOptions, userContext supertokens.UserContext) (epmodels.SignUpPOSTResponse, error) {
							// Generate request ID for bot and suspicious IP detection
							var reqBody ReqBody
							err := json.NewDecoder(options.Req.Body).Decode(&reqBody)
							if err != nil {
								return epmodels.SignUpPOSTResponse{}, err
							}

							if reqBody.RequestID == nil {
								return epmodels.SignUpPOSTResponse{
									GeneralError: &supertokens.GeneralErrorResponse{
										Message: "The request ID is required",
									},
								}, nil
							}
							requestId := *reqBody.RequestID
              fmt.Println(requestId)

							actionType := "emailpassword-sign-up"
							ip := getIpFromRequest(options.Req)
							email := ""
							password := ""
							for _, field := range formFields {
								if field.ID == "email" || field.ID == "password" {
									valueAsString, asStrOk := field.Value.(string)
									if !asStrOk {
										return epmodels.SignUpPOSTResponse{}, errors.New("Should never come here as we check the type during validation")
									}
									if field.ID == "email" {
										email = valueAsString
									} else {
										password = valueAsString
									}
								}
							}
              fmt.Println(password)

							bruteForceConfig := getBruteForceConfig(email, ip, actionType)
              fmt.Println(bruteForceConfig)

							// pre API logic...
							resp, err := originalSignUpPOST(formFields, tenantId, options, userContext)
							if err != nil {
								return epmodels.SignUpPOSTResponse{}, err
							}

							return resp, nil
						}

						// rewrite the original implementation of SignInPOST
						originalSignInPOST := *originalImplementation.SignInPOST
						(*originalImplementation.SignInPOST) = func(formFields []epmodels.TypeFormField, tenantId string, options epmodels.APIOptions, userContext supertokens.UserContext) (epmodels.SignInPOSTResponse, error) {
							// Generate request ID for bot and suspicious IP detection
							var reqBody ReqBody
							err := json.NewDecoder(options.Req.Body).Decode(&reqBody)
							if err != nil {
								return epmodels.SignInPOSTResponse{}, err
							}

							if reqBody.RequestID == nil {
								return epmodels.SignInPOSTResponse{
									GeneralError: &supertokens.GeneralErrorResponse{
										Message: "The request ID is required",
									},
								}, nil
							}
							requestId := *reqBody.RequestID
              fmt.Println(requestId)

							actionType := "emailpassword-sign-in"
							ip := getIpFromRequest(options.Req)
							email := ""
							password := ""
							for _, field := range formFields {
								if field.ID == "email" || field.ID == "password" {
									valueAsString, asStrOk := field.Value.(string)
									if !asStrOk {
										return epmodels.SignInPOSTResponse{}, errors.New("Should never come here as we check the type during validation")
									}
									if field.ID == "email" {
										email = valueAsString
									} else {
										password = valueAsString
									}
								}
							}
              fmt.Println(password)

							bruteForceConfig := getBruteForceConfig(email, ip, actionType)
              fmt.Println(bruteForceConfig)

							// pre API logic...
							resp, err := originalSignInPOST(formFields, tenantId, options, userContext)
							if err != nil {
								return epmodels.SignInPOSTResponse{}, err
							}

							return resp, nil
						}

						// rewrite the original implementation of GeneratePasswordResetTokenPOST
						originalGeneratePasswordResetTokenPOST := *originalImplementation.GeneratePasswordResetTokenPOST
						(*originalImplementation.GeneratePasswordResetTokenPOST) = func(formFields []epmodels.TypeFormField, tenantId string, options epmodels.APIOptions, userContext supertokens.UserContext) (epmodels.GeneratePasswordResetTokenPOSTResponse, error) {
							// Generate request ID for bot and suspicious IP detection
							var reqBody ReqBody
							err := json.NewDecoder(options.Req.Body).Decode(&reqBody)
							if err != nil {
								return epmodels.GeneratePasswordResetTokenPOSTResponse{}, err
							}

							if reqBody.RequestID == nil {
								return epmodels.GeneratePasswordResetTokenPOSTResponse{
									GeneralError: &supertokens.GeneralErrorResponse{
										Message: "The request ID is required",
									},
								}, nil
							}
							requestId := *reqBody.RequestID
              fmt.Println(requestId)

							actionType := "send-password-reset-email"
							ip := getIpFromRequest(options.Req)
							email := ""
							for _, field := range formFields {
								if field.ID == "email" {
									valueAsString, asStrOk := field.Value.(string)
									if !asStrOk {
										return epmodels.GeneratePasswordResetTokenPOSTResponse{}, errors.New("Should never come here as we check the type during validation")
									}
									email = valueAsString
								}
							}

							bruteForceConfig := getBruteForceConfig(email, ip, actionType)
              fmt.Println(bruteForceConfig)

							// pre API logic...
							resp, err := originalGeneratePasswordResetTokenPOST(formFields, tenantId, options, userContext)
							if err != nil {
								return epmodels.GeneratePasswordResetTokenPOSTResponse{}, err
							}

							return resp, nil
						}

            return originalImplementation
					},
					Functions: func(originalImplementation epmodels.RecipeInterface) epmodels.RecipeInterface {
						return originalImplementation
					},
				},
			}),
		},
	})
}

from typing import Dict, Any, Union, List
from supertokens_python import init, InputAppInfo
from supertokens_python.recipe import emailpassword
from supertokens_python.recipe.emailpassword.interfaces import APIInterface, APIOptions
from supertokens_python.recipe.emailpassword.types import FormField
from supertokens_python.framework import BaseRequest
from supertokens_python.types import GeneralErrorResponse
from supertokens_python.recipe.session import SessionContainer

def get_ip_from_request(req: BaseRequest) -> str:
    forwarded_for = req.get_header("x-forwarded-for")
    if forwarded_for:
        return forwarded_for
    return "127.0.0.1"


def get_brute_force_config(
    user_identifier: Union[str, None], ip: str, prefix: Union[str, None] = None
) -> List[Dict[str, Any]]:
    return [
        {
            "key": f"{prefix}-{user_identifier}" if prefix else user_identifier,
            "maxRequests": [
                {"limit": 5, "perTimeIntervalMS": 60 * 1000},
                {"limit": 15, "perTimeIntervalMS": 60 * 60 * 1000},
            ],
        },
        {
            "key": f"{prefix}-{ip}" if prefix else ip,
            "maxRequests": [
                {"limit": 5, "perTimeIntervalMS": 60 * 1000},
                {"limit": 15, "perTimeIntervalMS": 60 * 60 * 1000},
            ],
        },
    ]


def override_email_password_apis(original_implementation: APIInterface):
    original_sign_up_post = original_implementation.sign_up_post

    async def sign_up_post(
        form_fields: List[FormField],
        tenant_id: str,
        session: Union[SessionContainer, None],
        should_try_linking_with_session_user: Union[bool, None],
        api_options: APIOptions,
        user_context: Dict[str, Any],
    ):
        request_body = await api_options.request.json()
        if not request_body:
            return GeneralErrorResponse(message="The request body is required")

        request_id = request_body.get("requestId")
        if not request_id:
            return GeneralErrorResponse(message="The request ID is required")

        action_type = "emailpassword-sign-in"
        ip = get_ip_from_request(api_options.request)
        email = None
        for field in form_fields:
            if field.id == "email":
                email = field.value
        brute_force_config = get_brute_force_config(email, ip, action_type)
        print(brute_force_config)

        response = await original_sign_up_post(
            form_fields,
            tenant_id,
            session,
            should_try_linking_with_session_user,
            api_options,
            user_context,
        )

        return response

    original_implementation.sign_up_post = sign_up_post

    original_sign_in_post = original_implementation.sign_in_post

    async def sign_in_post(
        form_fields: List[FormField],
        tenant_id: str,
        session: Union[SessionContainer, None],
        should_try_linking_with_session_user: Union[bool, None],
        api_options: APIOptions,
        user_context: Dict[str, Any],
    ):
        request_body = await api_options.request.json()
        if not request_body:
            return GeneralErrorResponse(message="The request body is required")

        request_id = request_body.get("requestId")
        if not request_id:
            return GeneralErrorResponse(message="The request ID is required")

        action_type = "emailpassword-sign-in"
        ip = get_ip_from_request(api_options.request)
        email = None
        for field in form_fields:
            if field.id == "email":
                email = field.value
        brute_force_config = get_brute_force_config(email, ip, action_type)
        print(brute_force_config)

        response = await original_sign_in_post(
            form_fields,
            tenant_id,
            session,
            should_try_linking_with_session_user,
            api_options,
            user_context,
        )

        return response

    original_implementation.sign_in_post = sign_in_post

    original_generate_password_reset_token_post = (
        original_implementation.generate_password_reset_token_post
    )

    async def generate_password_reset_token_post(
        form_fields: List[FormField],
        tenant_id: str,
        api_options: APIOptions,
        user_context: Dict[str, Any],
    ):
        request_body = await api_options.request.json()
        if not request_body:
            return GeneralErrorResponse(message="The request body is required")

        request_id = request_body.get("requestId")
        if not request_id:
            return GeneralErrorResponse(message="The request ID is required")

        action_type = "send-password-reset-email"
        ip = get_ip_from_request(api_options.request)
        email = None
        for field in form_fields:
            if field.id == "email":
                email = field.value
        brute_force_config = get_brute_force_config(email, ip, action_type)
        print(brute_force_config)

        response = await original_generate_password_reset_token_post(
            form_fields, tenant_id, api_options, user_context
        )

        return response

    original_implementation.generate_password_reset_token_post = (
        generate_password_reset_token_post
    )

    return original_implementation


init(
    app_info=InputAppInfo(api_domain="...", app_name="...", website_domain="..."),
    framework="...",  
    recipe_list=[
        emailpassword.init(
            override=emailpassword.InputOverrideConfig(
                apis=override_email_password_apis
            )
        )
    ],
)

import SuperTokens from "supertokens-node";
import Passwordless from "supertokens-node/recipe/passwordless";
import axios from "axios";

function getIpFromRequest(req: Request): string {
  let headers: { [key: string]: string } = {};
  for (let key of Object.keys(req.headers)) {
    headers[key] = (req as any).headers[key]!;
  }
  return (req as any).headers["x-forwarded-for"] || "127.0.0.1";
}

const getBruteForceConfig = (userIdentifier: string, ip: string, prefix?: string) => [
  {
    key: `${prefix ? `${prefix}-` : ""}${userIdentifier}`,
    maxRequests: [
      { limit: 5, perTimeIntervalMS: 60 * 1000 },
      { limit: 15, perTimeIntervalMS: 60 * 60 * 1000 },
    ],
  },
  {
    key: `${prefix ? `${prefix}-` : ""}${ip}`,
    maxRequests: [
      { limit: 5, perTimeIntervalMS: 60 * 1000 },
      { limit: 15, perTimeIntervalMS: 60 * 60 * 1000 },
    ],
  },
];

SuperTokens.init({
  framework: "express",
  appInfo: {
    appName: "...",
    apiDomain: "...",
  },
  recipeList: [
    Passwordless.init({
      // ... other customisations ...
      contactMethod: "EMAIL_OR_PHONE",
      flowType: "USER_INPUT_CODE_AND_MAGIC_LINK",
      override: {
        apis: (originalImplementation) => {
          return {
            ...originalImplementation,
            createCodePOST: async function (input) {
              const actionType = "passwordless-send-sms";
              const ip = getIpFromRequest(input.options.req.original);
              const emailOrPhoneNumber = "email" in input ? input.email : input.phoneNumber;
              const bruteForceConfig = getBruteForceConfig(emailOrPhoneNumber, ip, actionType);

              return originalImplementation.createCodePOST!(input);
            },
            resendCodePOST: async function (input) {
              const actionType = "passwordless-send-sms";
              const ip = getIpFromRequest(input.options.req.original);
              let codesInfo = await Passwordless.listCodesByPreAuthSessionId({
                tenantId: input.tenantId,
                preAuthSessionId: input.preAuthSessionId,
              });
              const phoneNumber = codesInfo && "phoneNumber" in codesInfo ? codesInfo.phoneNumber : undefined;
              const email = codesInfo && "email" in codesInfo ? codesInfo.email : undefined;
              const userIdentifier = email || phoneNumber || input.deviceId;

              const bruteForceConfig = getBruteForceConfig(userIdentifier, ip, actionType);

              return originalImplementation.resendCodePOST!(input);
            },
          };
        },
      },
    }),
  ],
});

import (
	"net/http"
  "fmt"

	"github.com/supertokens/supertokens-golang/recipe/passwordless"
	"github.com/supertokens/supertokens-golang/recipe/passwordless/plessmodels"
	"github.com/supertokens/supertokens-golang/supertokens"
)

type BruteForceConfig struct {
	Key         string        `json:"key"`
	MaxRequests []MaxRequests `json:"maxRequests"`
}

type MaxRequests struct {
	Limit             int `json:"limit"`
	PerTimeIntervalMS int `json:"perTimeIntervalMS"`
}

func getIpFromRequest(req *http.Request) string {
	if forwardedFor := req.Header.Get("X-Forwarded-For"); forwardedFor != "" {
		return forwardedFor
	}
	return "127.0.0.1"
}

func getBruteForceConfig(userIdentifier string, ip string, prefix string) []BruteForceConfig {
	var key string
	if prefix != "" {
		key = prefix + "-"
	}

	return []BruteForceConfig{
		{
			Key: key + userIdentifier,
			MaxRequests: []MaxRequests{
				{Limit: 5, PerTimeIntervalMS: 60 * 1000},
				{Limit: 15, PerTimeIntervalMS: 60 * 60 * 1000},
			},
		},
		{
			Key: key + ip,
			MaxRequests: []MaxRequests{
				{Limit: 5, PerTimeIntervalMS: 60 * 1000},
				{Limit: 15, PerTimeIntervalMS: 60 * 60 * 1000},
			},
		},
	}
}


func main() {
	supertokens.Init(supertokens.TypeInput{
		RecipeList: []supertokens.Recipe{
			passwordless.Init(plessmodels.TypeInput{
				FlowType: "USER_INPUT_CODE",
				ContactMethodPhone: plessmodels.ContactMethodPhoneConfig{
					Enabled: true,
				},
				Override: &plessmodels.OverrideStruct{
					APIs: func(originalImplementation plessmodels.APIInterface) plessmodels.APIInterface {
						originalCreateCodePOST := *originalImplementation.CreateCodePOST
						(*originalImplementation.CreateCodePOST) = func(email *string, phoneNumber *string, tenantId string, options plessmodels.APIOptions, userContext supertokens.UserContext) (plessmodels.CreateCodePOSTResponse, error) {
                            actionType := "passwordless-send-sms"
							ip := getIpFromRequest(options.Req)
							var key string
							if email != nil {
								key = *email
							} else {
								key = *phoneNumber
							}

							bruteForceConfig := getBruteForceConfig(key, ip, actionType)
              fmt.Println(bruteForceConfig)

							return originalCreateCodePOST(email, phoneNumber, tenantId, options, userContext)
						}

						originalResendCodePOST := *originalImplementation.ResendCodePOST
						(*originalImplementation.ResendCodePOST) = func(deviceID string, preAuthSessionID string, tenantId string, options plessmodels.APIOptions, userContext supertokens.UserContext) (plessmodels.ResendCodePOSTResponse, error) {
							// retreive user details
							codesInfo, err := passwordless.ListCodesByDeviceID(tenantId, deviceID, userContext)
							if err != nil {
								return plessmodels.ResendCodePOSTResponse{}, err
							}
							var email *string
							var phoneNumber *string
							if codesInfo.Email != nil {
								email = codesInfo.Email
							}
							if codesInfo.PhoneNumber != nil {
								phoneNumber = codesInfo.PhoneNumber
							}

							actionType := "passwordless-send-sms"
							ip := getIpFromRequest(options.Req)
							key := ""
							if email != nil {
								key = *email
							} else {
								key = *phoneNumber
							}

							bruteForceConfig := getBruteForceConfig(key, ip, actionType)
              fmt.Println(bruteForceConfig)

							return originalResendCodePOST(deviceID, preAuthSessionID, tenantId, options, userContext)
						}

						return originalImplementation
					},
				},
			}),
		},
	})
}

from typing import Dict, Any, Union, List
from supertokens_python import init, InputAppInfo
from supertokens_python.recipe import passwordless
from supertokens_python.recipe.passwordless.interfaces import APIInterface, APIOptions
from supertokens_python.recipe.passwordless.asyncio import list_codes_by_device_id
from supertokens_python.framework import BaseRequest
from supertokens_python.recipe.session import SessionContainer


def get_ip_from_request(req: BaseRequest) -> str:
    forwarded_for = req.get_header("x-forwarded-for")
    if forwarded_for:
        return forwarded_for
    return "127.0.0.1"


def get_brute_force_config(
    user_identifier: Union[str, None], ip: str, prefix: Union[str, None] = None
) -> List[Dict[str, Any]]:
    return [
        {
            "key": f"{prefix}-{user_identifier}" if prefix else user_identifier,
            "maxRequests": [
                {"limit": 5, "perTimeIntervalMS": 60 * 1000},
                {"limit": 15, "perTimeIntervalMS": 60 * 60 * 1000},
            ],
        },
        {
            "key": f"{prefix}-{ip}" if prefix else ip,
            "maxRequests": [
                {"limit": 5, "perTimeIntervalMS": 60 * 1000},
                {"limit": 15, "perTimeIntervalMS": 60 * 60 * 1000},
            ],
        },
    ]


def override_passwordless_apis(original_implementation: APIInterface):
    original_create_code_post = original_implementation.create_code_post

    async def create_code_post(
        email: Union[str, None],
        phone_number: Union[str, None],
        session: Union[SessionContainer, None],
        should_try_linking_with_session_user: Union[bool, None],
        tenant_id: str,
        api_options: APIOptions,
        user_context: Dict[str, Any],
    ):
        action_type = "passwordless-send-sms"
        ip = get_ip_from_request(api_options.request)
        identifier = None
        if email is not None:
            identifier = email
        elif phone_number is not None:
            identifier = phone_number
        brute_force_config = get_brute_force_config(identifier, ip, action_type)
        print(brute_force_config)

        # We need to call the original implementation of create_code_post.
        response = await original_create_code_post(
            email,
            phone_number,
            session,
            should_try_linking_with_session_user,
            tenant_id,
            api_options,
            user_context,
        )

        return response

    original_implementation.create_code_post = create_code_post

    original_resend_code_post = original_implementation.resend_code_post

    async def resend_code_post(
        device_id: str,
        pre_auth_session_id: str,
        session: Union[SessionContainer, None],
        should_try_linking_with_session_user: Union[bool, None],
        tenant_id: str,
        api_options: APIOptions,
        user_context: Dict[str, Any],
    ):
        action_type = "passwordless-send-sms"
        ip = get_ip_from_request(api_options.request)
        email = None
        phone_number = None
        codes = await list_codes_by_device_id(
            tenant_id=tenant_id, device_id=device_id, user_context=user_context
        )
        if codes is not None:
            email = codes.email
            phone_number = codes.phone_number
        identifier = None
        if email is not None:
            identifier = email
        elif phone_number is not None:
            identifier = phone_number
        brute_force_config = get_brute_force_config(identifier, ip, action_type)
        print(brute_force_config)


        # We need to call the original implementation of resend_code_post.
        response = await original_resend_code_post(
            device_id,
            pre_auth_session_id,
            session,
            should_try_linking_with_session_user,
            tenant_id,
            api_options,
            user_context,
        )

        return response

    original_implementation.resend_code_post = resend_code_post

    return original_implementation


init(
    app_info=InputAppInfo(api_domain="...", app_name="...", website_domain="..."),
    framework="...",  
    recipe_list=[
        passwordless.init(
            flow_type="USER_INPUT_CODE_AND_MAGIC_LINK",
            contact_config=passwordless.ContactEmailOrPhoneConfig(),
            override=passwordless.InputOverrideConfig(apis=override_passwordless_apis),
        )
    ],
)

import SuperTokens from "supertokens-node";
import EmailPassword from "supertokens-node/recipe/emailpassword";
import Session from "supertokens-node/recipe/session";
import axios from "axios";
import { createHash } from "crypto";

const SECRET_API_KEY = "<secret-api-key>"; // Your secret API key that you received from the SuperTokens team
// The full URL with the correct region will be provided by the SuperTokens team
const ANOMALY_DETECTION_API_URL = "https://security-<region>.aws.supertokens.io/v1/security";

async function handleSecurityChecks(input: {
  actionType?: string;
  email?: string;
  phoneNumber?: string;
  password?: string;
  requestId?: string;
  bruteForceConfig?: {
    key: string;
    maxRequests: {
      limit: number;
      perTimeIntervalMS: number;
    }[];
  }[];
}): Promise<
  | {
      status: "GENERAL_ERROR";
      message: string;
    }
  | undefined
> {
  let requestBody: {
    email?: string;
    phoneNumber?: string;
    actionType?: string;
    requestId?: string;
    passwordHashPrefix?: string;
    bruteForce?: {
      key: string;
      maxRequests: {
        limit: number;
        perTimeIntervalMS: number;
      }[];
    }[];
  } = {};

  if (input.requestId !== undefined) {
    requestBody.requestId = input.requestId;
  }

  let passwordHash: string | undefined;
  if (input.password !== undefined) {
    let shasum = createHash("sha1");
    shasum.update(input.password);
    passwordHash = shasum.digest("hex");
    requestBody.passwordHashPrefix = passwordHash.slice(0, 5);
  }
  requestBody.bruteForce = input.bruteForceConfig;
  requestBody.email = input.email;
  requestBody.phoneNumber = input.phoneNumber;
  requestBody.actionType = input.actionType;

  let response;
  try {
    response = await axios.post(ANOMALY_DETECTION_API_URL, requestBody, {
      headers: {
        Authorization: `Bearer ${SECRET_API_KEY}`,
        "Content-Type": "application/json",
      },
    });
  } catch (err) {
    // silently fail in order to not break the auth flow
    console.error(err);
    return;
  }

  let responseData = response.data;

  if (responseData.bruteForce.detected) {
    return {
      status: "GENERAL_ERROR",
      message: "Too many requests. Please try again later.",
    };
  }

  if (responseData.requestIdInfo?.isUsingTor) {
    return {
      status: "GENERAL_ERROR",
      message: "Tor activity detected. Please use a regular browser.",
    };
  }

  if (responseData.requestIdInfo?.vpn?.result) {
    return {
      status: "GENERAL_ERROR",
      message: "VPN activity detected. Please use a regular network.",
    };
  }

  if (responseData.requestIdInfo?.botDetected) {
    return {
      status: "GENERAL_ERROR",
      message: "Bot activity detected.",
    };
  }

  if (responseData?.passwordBreaches && passwordHash) {
    const suffix = passwordHash.slice(5).toUpperCase();
    const foundPasswordHash = responseData?.passwordBreaches[suffix];

    if (foundPasswordHash) {
      return {
        status: "GENERAL_ERROR",
        message: "This password has been detected in a breach. Please set a different password.",
      };
    }
  }

  return undefined;
}

function getIpFromRequest(req: Request): string {
  let headers: { [key: string]: string } = {};
  for (let key of Object.keys(req.headers)) {
    headers[key] = (req as any).headers[key]!;
  }
  return (req as any).headers["x-forwarded-for"] || "127.0.0.1";
}

const getBruteForceConfig = (userIdentifier: string, ip: string, prefix?: string) => [
  {
    key: `${prefix ? `${prefix}-` : ""}${userIdentifier}`,
    maxRequests: [
      { limit: 5, perTimeIntervalMS: 60 * 1000 },
      { limit: 15, perTimeIntervalMS: 60 * 60 * 1000 },
    ],
  },
  {
    key: `${prefix ? `${prefix}-` : ""}${ip}`,
    maxRequests: [
      { limit: 5, perTimeIntervalMS: 60 * 1000 },
      { limit: 15, perTimeIntervalMS: 60 * 60 * 1000 },
    ],
  },
];

// backend
SuperTokens.init({
  appInfo: {
    apiDomain: "...",
    appName: "...",
    websiteDomain: "...",
  },
  supertokens: {
    connectionURI: "...",
  },
  recipeList: [
    EmailPassword.init({
      override: {
        apis: (originalImplementation) => {
          return {
            ...originalImplementation,
            signUpPOST: async function (input) {
              // We need to generate a request ID in order to detect possible bots, suspicious IP addresses, etc.
              const requestId = (await input.options.req.getJSONBody()).requestId;
              if (!requestId) {
                return {
                  status: "GENERAL_ERROR",
                  message: "The request ID is required",
                };
              }

              const actionType = "emailpassword-sign-up";
              const ip = getIpFromRequest(input.options.req.original);
              let email = input.formFields.filter((f) => f.id === "email")[0].value as string;
              let password = input.formFields.filter((f) => f.id === "password")[0].value as string;
              const bruteForceConfig = getBruteForceConfig(email, ip, actionType);

              // we check the anomaly detection service before calling the original implementation of signUp
              let securityCheckResponse = await handleSecurityChecks({
                requestId,
                email,
                password,
                bruteForceConfig,
                actionType,
              });
              if (securityCheckResponse !== undefined) {
                return securityCheckResponse;
              }

              return originalImplementation.signUpPOST!(input);
            },
            signInPOST: async function (input) {
              // We need to generate a request ID in order to detect possible bots, suspicious IP addresses, etc.
              const requestId = (await input.options.req.getJSONBody()).requestId;
              if (!requestId) {
                return {
                  status: "GENERAL_ERROR",
                  message: "The request ID is required",
                };
              }

              const actionType = "emailpassword-sign-in";
              const ip = getIpFromRequest(input.options.req.original);
              let email = input.formFields.filter((f) => f.id === "email")[0].value as string;
              const bruteForceConfig = getBruteForceConfig(email, ip, actionType);

              // we check the anomaly detection service before calling the original implementation of signIn
              let securityCheckResponse = await handleSecurityChecks({
                requestId,
                email,
                bruteForceConfig,
                actionType,
              });
              if (securityCheckResponse !== undefined) {
                return securityCheckResponse;
              }

              return originalImplementation.signInPOST!(input);
            },
            generatePasswordResetTokenPOST: async function (input) {
              // We need to generate a request ID in order to detect possible bots, suspicious IP addresses, etc.
              const requestId = (await input.options.req.getJSONBody()).requestId;
              if (!requestId) {
                return {
                  status: "GENERAL_ERROR",
                  message: "The request ID is required",
                };
              }

              const actionType = "send-password-reset-email";
              const ip = getIpFromRequest(input.options.req.original);
              let email = input.formFields.filter((f) => f.id === "email")[0].value as string;
              const bruteForceConfig = getBruteForceConfig(email, ip, actionType);

              // we check the anomaly detection service before calling the original implementation of generatePasswordResetToken
              let securityCheckResponse = await handleSecurityChecks({
                requestId,
                email,
                bruteForceConfig,
                actionType,
              });
              if (securityCheckResponse !== undefined) {
                return securityCheckResponse;
              }

              return originalImplementation.generatePasswordResetTokenPOST!(input);
            },
            passwordResetPOST: async function (input) {
              let password = input.formFields.filter((f) => f.id === "password")[0].value as string;
              let securityCheckResponse = await handleSecurityChecks({
                password,
              });
              if (securityCheckResponse !== undefined) {
                return securityCheckResponse;
              }
              return originalImplementation.passwordResetPOST!(input);
            },
          };
        },
      },
    }),
  ],
});