Ruby on Rails

gem 'authsignal-ruby'

require 'authsignal'

Authsignal.setup do |config|
    config.api_secret_key = ENV["AUTHSIGNAL_SECRET_KEY"]
    config.api_url = "YOUR_REGION_API_URL" # Ensure this is set to the appropriate region for your tenant. See https://docs.authsignal.com/sdks/server/overview#initialization.
    config.retry = true
    # config.debug = ENV['RAILS_ENV'] == 'development'
end

window.authsignal = new Authsignal({ tenantId: "YOUR_TENANT_ID", baseUrl: "YOUR_REGION_BASE_URL" });

class MfaController < ApplicationController

    def index
        result = Authsignal.track(
          user_id: user.id,
          action: "enrollment",
          attributes: {
            redirect_url: root_url,
            email: user.email,
            device_id: authsignal_cookie,
            user_agent: auth.request.user_agent,
            ip_address: auth.request.ip,
            redirect_to_settings: true })

        redirect_to result[:url], allow_other_host: true
    end
end

Warden::Manager.after_authentication do |user,auth,opts|
		# Using this cookie will help with rules that require device tracking
    # This cookie uses the authsignal-browser SDK to instantiate
    authsignal_cookie = auth.request.cookies["__as_aid"]

    begin
    result = Authsignal.track(
      user_id: user.id,
      action: "signIn",
      attributes: {
        redirect_url: Rails.application.routes.url_helpers.complete_mfa_url,
        email: user.email,
        device_id: authsignal_cookie,
        user_agent: auth.request.user_agent,
        ip_address: auth.request.ip
      }
    )
    rescue => e
      auth.logout
    end

    case result[:state]
    when "BLOCK"
        # If Authsignal rules give back a BLOCK decision, then do
        # not log the user in and log out
        auth.logout
        throw(:warden, :message => "Your account is blocked")
    when "CHALLENGE_REQUIRED"
        auth.env["authsignal_devise.response"] = result
    end
end

class Users::SessionsController < Devise::SessionsController
    def create
        super do |resource|
            if request.env["authsignal_devise.response"]
                @authsignal_challenge_initiated = true
                session[:authsignal_user_id] = resource.id
                sign_out(resource)
                redirect_to request.env["authsignal_devise.response"][:url], allow_other_host: true
                return
            end
        end
    end

    def complete_mfa
        token =  params[:token]
        user_id = session[:authsignal_user_id]
        user = User.find(user_id)
        session[:authsignal_user_id] = nil
        validate_challenge(token, user)
    end

    private

    def validate_challenge(token, user)
        result = Authsignal.validate_challenge(
                      token:  token,
                      user_id: user.id,
                      action: "signIn"
                  )

        if result[:is_valid]
            sign_in user
            redirect_to after_sign_in_path_for(user)
            return
        end

        flash[:alert] = "Failed Step Up Authentication"
        redirect_to root_path
    end

    def authsignal_challenge_initiated?
        @authsignal_challenge_initiated == true
    end
end

devise_for :users, :controllers => {:registrations => "users/registrations", :sessions => "users/sessions"}

devise_scope :user do
  get 'users/complete_mfa', to: 'users/sessions#complete_mfa', as: :complete_mfa
end

class WithdrawalController < ApplicationController
    before_action :authenticate_user!
    skip_before_action :verify_authenticity_token, only:[:create, :complete]

    def create
        # Using this cookie will help with rules that require device tracking
        authsignal_cookie = auth.request.cookies["__as_aid"]

        result = Authsignal.track(
          user_id: current_user.id,
          action: "withdrawal",
          attributes: {
            email: current_user.email,
            device_id: authsignal_cookie,
            user_agent: request.user_agent,
            ip_address: request.ip
            custom: {
                withdrawal_amount: params[:amount]
            }
          }
        )

        case result[:state]
        when "BLOCK"
            render :json => { error: "Withdrawal has been blocked" }, :status => :forbidden
            return
        when "CHALLENGE_REQUIRED"
            render :json => { url: result[:url],
                              idempotency_key: result[:idempotency_key],
                              error: "Challenge Required" }, :status => :unprocessable_entity
            return
        when "ALLOW"
            complete_withdrawal
            render :json => { success: true }
            return
        end
    end

    def complete
        token =  params[:token]
        # This call fetches the action that was previously created
        # The response specifies whether the user has completed the challenge successfully

          result = Authsignal.validate_challenge(
              token: token,
              user_id: current_user.id,
              action: "withdrawal"
          )

        # Complete your action if the challenge was successful
        if ["CHALLENGE_SUCCEEDED", "ALLOW"].include?(result[:state])
            complete_withdrawal
            render :json => { success: true }
            return
        else
            render :json => { error: "Challenge has not been completed" }, :status => :forbidden
            return
        end
    end

    private
    def complete_withdrawal
        # Business logic to complete your withdrawal step
    end
end

<div data-controller="withdrawal">
  <input data-withdrawal-target="amount" type="text" />
  <button type="button" data-action="click->withdrawal#withdraw">Withdraw</button>
  <div></div>
</div>

// withdrawal_controller.js
import { Controller } from "@hotwired/stimulus";

export default class extends Controller {
  static targets = ["amount"];

  async withdraw() {
    const amount = { amount: this.amountTarget.value };
    const response = await fetch("/withdrawal", {
      method: "POST",
      headers: {
        Accept: "application/json",
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ amount }),
    });

    const result = await response.json();

    // If the url is returned then we need to trigger
    // the authsignal challenge flow
    if (result.url) {
      const { idempotency_key } = result;

      // This step brings up the challenge pop up
      // When the challenge flow completes the pop up will close and the promise
      // will resolve
      const challengeFlow = await window.authsignal.launch(result.url, {
        mode: "popup",
      });

      // Return the idempotency key from the initial result,
      // as part of the complete request
      if (challengeFlow) {
        const complete_step_response = await fetch("/withdrawal/complete", {
          method: "POST",
          headers: {
            Accept: "application/json",
            "Content-Type": "application/json",
          },
          body: JSON.stringify({ amount, idempotency_key }),
        });
        const complete_step_result = await complete_step_response.json();

        const { success } = complete_step_result;

        success
          ? alert("Great your user has successfully completed the action")
          : alert("Great your user has  not successfully completed the action");
      }
    }
  }
}