bot protection

apps/backend/prisma/migrations/20260308000000_add_signup_risk_scores/migration.sql

@@ -0,0 +1,5 @@
+-- AlterTable: add columns with a temporary default for existing rows, then drop the default
+ALTER TABLE "ProjectUser" ADD COLUMN "signUpRiskScoreBot" SMALLINT NOT NULL DEFAULT 0;
+ALTER TABLE "ProjectUser" ADD COLUMN "signUpRiskScoreFreeTrialAbuse" SMALLINT NOT NULL DEFAULT 0;
+ALTER TABLE "ProjectUser" ALTER COLUMN "signUpRiskScoreBot" DROP DEFAULT;
+ALTER TABLE "ProjectUser" ALTER COLUMN "signUpRiskScoreFreeTrialAbuse" DROP DEFAULT;

apps/backend/prisma/schema.prisma

@@ -273,6 +273,10 @@ model ProjectUser {
   restrictedByAdminReason         String? // Publicly viewable reason (shown to user)
   restrictedByAdminPrivateDetails String? // Private details (server access only)
 
+  // Sign-up risk scores (0-100, set at sign-up time)
+  signUpRiskScoreBot              Int @db.SmallInt
+  signUpRiskScoreFreeTrialAbuse   Int @db.SmallInt
+
   projectUserOAuthAccounts ProjectUserOAuthAccount[]
   teamMembers              TeamMember[]
   contactChannels          ContactChannel[]

apps/backend/prisma/seed.ts

@@ -14,7 +14,7 @@ import {
 import { ensurePermissionDefinition, grantTeamPermission } from '@/lib/permissions';
 import { createOrUpdateProjectWithLegacyConfig, getProject } from '@/lib/projects';
 import { DEFAULT_BRANCH_ID, getSoleTenancyFromProjectBranch, type Tenancy } from '@/lib/tenancies';
-import { getPrismaClientForTenancy, globalPrismaClient, PrismaClientTransaction } from '@/prisma-client';
+import { PrismaClientTransaction, getPrismaClientForTenancy, globalPrismaClient } from '@/prisma-client';
 import { ALL_APPS } from '@stackframe/stack-shared/dist/apps/apps-config';
 import { DEFAULT_EMAIL_THEME_ID } from '@stackframe/stack-shared/dist/helpers/emails';
 import { AdminUserProjectsCrud, ProjectsCrud } from '@stackframe/stack-shared/dist/interface/crud/projects';
@@ -318,6 +318,8 @@ export async function seed() {
           tenancyId: internalTenancy.id,
           mirroredProjectId: 'internal',
           mirroredBranchId: DEFAULT_BRANCH_ID,
+          signUpRiskScoreBot: 0,
+          signUpRiskScoreFreeTrialAbuse: 0,
         }
       });
 
@@ -447,6 +449,8 @@ export async function seed() {
           tenancyId: internalTenancy.id,
           mirroredProjectId: 'internal',
           mirroredBranchId: DEFAULT_BRANCH_ID,
+          signUpRiskScoreBot: 0,
+          signUpRiskScoreFreeTrialAbuse: 0,
         }
       });
 

apps/backend/src/app/api/latest/internal/sign-up-rules-test/route.tsx

@@ -21,6 +21,10 @@ export const POST = createSmartRouteHandler({
       email: yupString().optional(),
       auth_method: yupString().oneOf(AUTH_METHODS).defined(),
       oauth_provider: yupString().optional(),
+      risk_scores: yupObject({
+        bot: yupNumber().min(0).max(100).integer().defined(),
+        free_trial_abuse: yupNumber().min(0).max(100).integer().defined(),
+      }).defined(),
     }).defined(),
   }),
   response: yupObject({
@@ -32,6 +36,10 @@ export const POST = createSmartRouteHandler({
         email_domain: yupString().defined(),
         auth_method: yupString().oneOf(AUTH_METHODS).defined(),
         oauth_provider: yupString().defined(),
+        risk_scores: yupObject({
+          bot: yupNumber().min(0).max(100).integer().defined(),
+          free_trial_abuse: yupNumber().min(0).max(100).integer().defined(),
+        }).defined(),
       }).defined(),
       evaluations: yupArray(yupObject({
         rule_id: yupString().defined(),
@@ -58,6 +66,10 @@ export const POST = createSmartRouteHandler({
       email: req.body.email,
       authMethod: req.body.auth_method,
       oauthProvider: req.body.oauth_provider,
+      riskScores: {
+        bot: req.body.risk_scores.bot,
+        freeTrialAbuse: req.body.risk_scores.free_trial_abuse,
+      },
     });
     const trace = evaluateSignUpRulesWithTrace(req.auth.tenancy, context);
 
@@ -70,6 +82,10 @@ export const POST = createSmartRouteHandler({
           email_domain: context.emailDomain,
           auth_method: context.authMethod,
           oauth_provider: context.oauthProvider,
+          risk_scores: {
+            bot: context.riskScores.bot,
+            free_trial_abuse: context.riskScores.freeTrialAbuse,
+          },
         },
         evaluations: trace.evaluations.map((evaluation) => ({
           rule_id: evaluation.ruleId,

apps/backend/src/app/api/latest/users/crud.tsx

@@ -16,8 +16,8 @@ import { runAsynchronouslyAndWaitUntil } from "@/utils/vercel";
 import { KnownErrors } from "@stackframe/stack-shared";
 import { currentUserCrud } from "@stackframe/stack-shared/dist/interface/crud/current-user";
 import { UsersCrud, usersCrud } from "@stackframe/stack-shared/dist/interface/crud/users";
-import { userIdOrMeSchema, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import type { RestrictedReason } from "@stackframe/stack-shared/dist/schema-fields";
+import { userIdOrMeSchema, yupNumber, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { validateBase64Image } from "@stackframe/stack-shared/dist/utils/base64";
 import { decodeBase64 } from "@stackframe/stack-shared/dist/utils/bytes";
 import { StackAssertionError, StatusError, captureError, throwErr } from "@stackframe/stack-shared/dist/utils/errors";
@@ -184,6 +184,12 @@ export const userPrismaToCrud = (
     restricted_by_admin: prisma.restrictedByAdmin,
     restricted_by_admin_reason: prisma.restrictedByAdminReason,
     restricted_by_admin_private_details: prisma.restrictedByAdminPrivateDetails,
+    risk_scores: {
+      sign_up: {
+        bot: prisma.signUpRiskScoreBot,
+        free_trial_abuse: prisma.signUpRiskScoreFreeTrialAbuse,
+      },
+    },
   };
   return result;
 };
@@ -402,6 +408,12 @@ export function getUserQuery(projectId: string, branchId: string, userId: string
         restricted_by_admin: row.restrictedByAdmin,
         restricted_by_admin_reason: row.restrictedByAdminReason,
         restricted_by_admin_private_details: row.restrictedByAdminPrivateDetails,
+        risk_scores: {
+          sign_up: {
+            bot: row.signUpRiskScoreBot,
+            free_trial_abuse: row.signUpRiskScoreFreeTrialAbuse,
+          },
+        },
       };
     },
   };
@@ -642,6 +654,8 @@ export const usersCrudHandlers = createLazyProxy(() => createCrudHandlers(usersC
           restrictedByAdmin,
           restrictedByAdminReason,
           restrictedByAdminPrivateDetails,
+          signUpRiskScoreBot: data.risk_scores?.sign_up.bot ?? 0,
+          signUpRiskScoreFreeTrialAbuse: data.risk_scores?.sign_up.free_trial_abuse ?? 0,
         },
         include: userFullInclude,
       });
@@ -1144,6 +1158,8 @@ export const usersCrudHandlers = createLazyProxy(() => createCrudHandlers(usersC
           restrictedByAdmin: data.restricted_by_admin ?? undefined,
           restrictedByAdminReason: restrictedByAdminReason,
           restrictedByAdminPrivateDetails: restrictedByAdminPrivateDetails,
+          signUpRiskScoreBot: data.risk_scores?.sign_up.bot,
+          signUpRiskScoreFreeTrialAbuse: data.risk_scores?.sign_up.free_trial_abuse,
         }),
         include: userFullInclude,
       });

apps/backend/src/lib/cel-evaluator.ts

@@ -1,5 +1,6 @@
 import { evaluate } from "cel-js";
 import { normalizeEmail } from "./emails";
+import { SignUpRiskScores } from "./risk-scores";
 
 /**
  * Custom error class for CEL evaluation failures.
@@ -32,6 +33,7 @@ export type SignUpRuleContext = {
   authMethod: 'password' | 'otp' | 'oauth' | 'passkey',
   /** OAuth provider ID if authMethod is "oauth", empty string otherwise */
   oauthProvider: string,
+  riskScores: SignUpRiskScores,
 };
 
 /**
@@ -160,6 +162,7 @@ export function createSignUpRuleContext(params: {
   email?: string,
   authMethod: 'password' | 'otp' | 'oauth' | 'passkey',
   oauthProvider?: string,
+  riskScores: SignUpRiskScores,
 }): SignUpRuleContext {
   // Handle missing email (e.g., OAuth providers that don't return email)
   // Use empty string so email-based rules don't match
@@ -178,6 +181,7 @@ export function createSignUpRuleContext(params: {
     emailDomain,
     authMethod: params.authMethod,
     oauthProvider: params.oauthProvider ?? '',
+    riskScores: params.riskScores,
   };
 }
 
@@ -187,47 +191,79 @@ import.meta.vitest?.test('createSignUpRuleContext(...)', async ({ expect }) => {
   expect(createSignUpRuleContext({
     email: 'Test.User@Example.COM',
     authMethod: 'password',
+    riskScores: {
+      bot: 17,
+      freeTrialAbuse: 23,
+    },
   })).toEqual({
     email: 'test.user@example.com',
     emailDomain: 'example.com',
     authMethod: 'password',
     oauthProvider: '',
+    riskScores: {
+      bot: 17,
+      freeTrialAbuse: 23,
+    },
   });
 
   // Should handle missing email (OAuth providers without email)
   expect(createSignUpRuleContext({
     email: undefined,
     authMethod: 'oauth',
     oauthProvider: 'discord',
+    riskScores: {
+      bot: 1,
+      freeTrialAbuse: 2,
+    },
   })).toEqual({
     email: '',
     emailDomain: '',
     authMethod: 'oauth',
     oauthProvider: 'discord',
+    riskScores: {
+      bot: 1,
+      freeTrialAbuse: 2,
+    },
   });
 
   // Should handle empty string email
   expect(createSignUpRuleContext({
     email: '',
     authMethod: 'oauth',
     oauthProvider: 'twitter',
+    riskScores: {
+      bot: 10,
+      freeTrialAbuse: 20,
+    },
   })).toEqual({
     email: '',
     emailDomain: '',
     authMethod: 'oauth',
     oauthProvider: 'twitter',
+    riskScores: {
+      bot: 10,
+      freeTrialAbuse: 20,
+    },
   });
 
   // Should handle OAuth with email
   expect(createSignUpRuleContext({
     email: 'oauth.user@gmail.com',
     authMethod: 'oauth',
     oauthProvider: 'google',
+    riskScores: {
+      bot: 8,
+      freeTrialAbuse: 9,
+    },
   })).toEqual({
     email: 'oauth.user@gmail.com',
     emailDomain: 'gmail.com',
     authMethod: 'oauth',
     oauthProvider: 'google',
+    riskScores: {
+      bot: 8,
+      freeTrialAbuse: 9,
+    },
   });
 });
 
@@ -237,6 +273,10 @@ import.meta.vitest?.test('evaluateCelExpression with missing email', async ({ ex
     email: undefined,
     authMethod: 'oauth',
     oauthProvider: 'discord',
+    riskScores: {
+      bot: 33,
+      freeTrialAbuse: 44,
+    },
   });
 
   // Email-based conditions should fail when email is empty
@@ -247,6 +287,9 @@ import.meta.vitest?.test('evaluateCelExpression with missing email', async ({ ex
   // But authMethod-based conditions should still work
   expect(evaluateCelExpression('authMethod == "oauth"', context)).toBe(true);
   expect(evaluateCelExpression('oauthProvider == "discord"', context)).toBe(true);
+  expect(evaluateCelExpression('riskScores.bot == 33', context)).toBe(true);
+  expect(evaluateCelExpression('riskScores.freeTrialAbuse == 44', context)).toBe(true);
+  expect(evaluateCelExpression('riskScores.bot > 10 && riskScores.freeTrialAbuse < 90', context)).toBe(true);
 
   // Empty email should match empty string
   expect(evaluateCelExpression('email == ""', context)).toBe(true);

apps/backend/src/lib/risk-scores.tsx

@@ -0,0 +1,29 @@
+import { Tenancy } from "./tenancies";
+
+export type SignUpRiskScores = {
+  bot: number,
+  freeTrialAbuse: number,
+};
+
+export type SignUpRiskScoreContext = {
+  primaryEmail: string | null,
+  primaryEmailVerified: boolean,
+  authMethod: 'password' | 'otp' | 'oauth' | 'passkey',
+  oauthProvider?: string,
+  ipAddress: string | null,
+};
+
+export async function calculateSignUpRiskScores(tenancy: Tenancy, context: SignUpRiskScoreContext): Promise<SignUpRiskScores> {
+  // TODO
+  if (context.primaryEmail === "test@example.com") {
+    return {
+      bot: 100,
+      freeTrialAbuse: 100,
+    };
+  } else {
+    return {
+      bot: 0,
+      freeTrialAbuse: 0,
+    };
+  }
+}

apps/backend/src/lib/users.tsx

@@ -3,6 +3,7 @@ import { KnownErrors } from "@stackframe/stack-shared";
 import { UsersCrud } from "@stackframe/stack-shared/dist/interface/crud/users";
 import { KeyIntersect } from "@stackframe/stack-shared/dist/utils/types";
 import { createSignUpRuleContext } from "./cel-evaluator";
+import { calculateSignUpRiskScores } from "./risk-scores";
 import { evaluateSignUpRules } from "./sign-up-rules";
 import { Tenancy } from "./tenancies";
 
@@ -12,6 +13,7 @@ import { Tenancy } from "./tenancies";
 export type SignUpRuleOptions = {
   authMethod: 'password' | 'otp' | 'oauth' | 'passkey',
   oauthProvider?: string,
+  ipAddress: string | null,
 };
 
 /**
@@ -43,10 +45,21 @@ export async function createOrUpgradeAnonymousUserWithRules(
   signUpRuleOptions: SignUpRuleOptions,
 ): Promise<UsersCrud["Admin"]["Read"]> {
   const email = createOrUpdate.primary_email ?? currentUser?.primary_email ?? undefined;
+  const primaryEmailVerified = createOrUpdate.primary_email_verified ?? currentUser?.primary_email_verified ?? false;
+
+  const riskScores = await calculateSignUpRiskScores(tenancy, {
+    primaryEmail: email ?? null,
+    primaryEmailVerified,
+    authMethod: signUpRuleOptions.authMethod,
+    oauthProvider: signUpRuleOptions.oauthProvider,
+    ipAddress: signUpRuleOptions.ipAddress,
+  });
+
   const ruleResult = await evaluateSignUpRules(tenancy, createSignUpRuleContext({
     email,
     authMethod: signUpRuleOptions.authMethod,
     oauthProvider: signUpRuleOptions.oauthProvider,
+    riskScores,
   }));
 
   if (!ruleResult.shouldAllow) {
@@ -68,17 +81,21 @@ export async function createOrUpgradeAnonymousUserWithRules(
       restricted_by_admin: true,
       restricted_by_admin_private_details: existingRestrictionPrivateDetails ? `${existingRestrictionPrivateDetails}\n\n${restrictionPrivateDetails}` : restrictionPrivateDetails,
     } : {},
+    risk_scores: {
+      sign_up: {
+        bot: riskScores.bot,
+        free_trial_abuse: riskScores.freeTrialAbuse,
+      },
+    },
   };
 
   // Proceed with user creation/upgrade
-  const user = await createOrUpgradeAnonymousUserWithoutRules(
+  return await createOrUpgradeAnonymousUserWithoutRules(
     tenancy,
     currentUser,
     enrichedCreateOrUpdate as KeyIntersect<UsersCrud["Admin"]["Create"], UsersCrud["Admin"]["Update"]>,
     allowedErrorTypes,
   );
-
-  return user;
 }
 
 /**
@@ -109,9 +126,11 @@ export async function createOrUpgradeAnonymousUserWithoutRules(
     });
   } else {
     // Create new user (normal flow)
+    // Cast needed: createOrUpdate may contain create-only fields (like risk scores) that
+    // KeyIntersect<Create, Update> strips from the type since they're absent on Update
     return await usersCrudHandlers.adminCreate({
       tenancy,
-      data: createOrUpdate,
+      data: createOrUpdate as UsersCrud["Admin"]["Create"],
       allowedErrorTypes,
     });
   }