Silent sign-ins

import { createTouchqueWeb, browserKey } from '@touchque/web';

// Guarded requests and the classic 2FA login carry X-Touchque-Browser
const tq = createTouchqueWeb({ baseUrl: '/touchque', browserKey: true });

const result = await tq.classic2fa.login({ onStep });
if (result.assurance?.method === 'silent') {
  // a known browser: no push was sent
}

// Shared computer / sign out everywhere: delete this browser's key
await tq.browserKey.forget();

// Without createTouchqueWeb: the header value, or null when unavailable
const proof = await browserKey.proof();

app.post('/login/2fa',
  requireTouchque('LOGIN', {
    user: (req) => req.session.passwordVerifiedUser,
    silentSignIn: true, // or your own limit: { maxAgeSeconds: 8 * 3600 }
  }),
  (req, res) => {
    // req.touchque.assurance.method === 'silent' → no push was sent
    // req.touchque.reasons → [{ code: 'known_browser', text: '…' }, …]
    res.json({ ok: true });
  });

// touchqueRouter(tq, { …, silentSignIn: true }) → onAuthenticated: via === 'silent'

# Flask  (Django: require_touchque, FastAPI: RequireTouchque take the same option)
@app.post('/login/2fa')
@require_touchque('LOGIN', user=lambda: session.get('password_ok'),
                  silent_sign_in=True)  # or {'max_age_seconds': 8 * 3600}
def login_2fa():
    # g.touchque['assurance']['method'] == 'silent' → no push was sent
    return jsonify(ok=True)

# touchque_relay_blueprint(tq, ..., silent_sign_in=True) → on_authenticated: via == 'silent'

// Laravel — a service provider
$this->app->bind(\Touchque\Laravel\TouchqueMiddleware::class, fn ($app) => new \Touchque\Laravel\TouchqueMiddleware(
    $app->make(\Touchque\Touchque::class),
    ['silentSignIn' => true] // or ['maxAgeSeconds' => 8 * 3600]
));

// $request->attributes->get('touchque')['assurance']['method'] === 'silent'
// TouchqueRelay: ['silentSignIn' => true] → onAuthenticated: $info['via'] === 'silent'

mux.Handle("/login/2fa", touchque.Require(tq, "LOGIN", http.HandlerFunc(signIn), touchque.RequireOptions{
    User:         func(r *http.Request) string { return passwordVerifiedUser(r) },
    SilentSignIn: true, // your own limit: SilentSignInMaxAgeSeconds (*int)
}))

func signIn(w http.ResponseWriter, r *http.Request) {
    approval, _ := touchque.ApprovalFromContext(r.Context())
    if approval.Assurance != nil && approval.Assurance.Method == "silent" {
        // no push was sent; approval.Reasons say why
    }
}

// RelayOptions{..., SilentSignIn: true} → OnAuthenticated: info.Via == touchque.ViaSilent

app.MapPost("/login/2fa", SignIn)
    .RequireTouchque("LOGIN", o =>
    {
        o.User = c => c.HttpContext.Session.GetString("password_verified_user");
        o.SilentSignIn = new(); // or your own limit: new() { MaxAgeSeconds = 8 * 3600 }
    });

// http.GetTouchqueApproval()!.Assurance?.Method == "silent" → no push was sent
// MapTouchqueRelay(..., new RelayOptions<HttpContext> { ..., SilentSignIn = new() }) → OnAuthenticated: info.Via == "silent"

@PostMapping("/login/2fa")
@RequireTouchque("LOGIN")
ResponseEntity<Void> signIn(Approval approval) {
    // approval.assurance().method().equals("silent") → no push was sent
    return ResponseEntity.ok().build();
}

@Bean
TouchqueGuardOptions login() {
    return TouchqueGuardOptions.forAction("LOGIN")
        .user(c -> (String) c.request().getSession().getAttribute("password_verified_user"))
        .silentSignIn(Guard.SilentSignIn.on()); // or your own limit: new Guard.SilentSignIn(8 * 3600)
}

// RelayOptions<HttpServletRequest>(...).silentSignIn(Guard.SilentSignIn.on()) → onAuthenticated: info.via().equals("silent")

class TwoFactorController < ApplicationController
  include Touchque::Rails::Guard
  require_touchque "LOGIN", only: :create, user: -> { session[:password_verified_user] },
                   silent_sign_in: true  # or { max_age_seconds: 8 * 3600 }

  def create
    # touchque_approval["assurance"]["method"] == "silent" → no push was sent
    head :ok
  end
end

# Touchque::Rack::Relay.new(..., silent_sign_in: true) → on_authenticated: info["via"] == "silent"

const browserProof = req.get('x-touchque-browser');
const risk = await tq.risk.check({
  externalUsername: user, type: 'LOGIN', clientIp: req.ip, userAgent: req.get('user-agent'), browserProof,
});
if (risk.prompt === false) return openSession(user); // risk.reasons say why

// Anything else: the usual push, proof attached (the approval makes the browser known)
await tq.login.request({ externalUsername: user, type: 'LOGIN', clientIp: req.ip, browserProof });

const { browsers } = await tq.risk.browsers({ externalUsername: user });
await tq.risk.forgetBrowsers({ externalUsername: user }); // all; or { thumbprint } for one

browser_proof = request.headers.get('X-Touchque-Browser')
risk = tq.risk.check(user, type='LOGIN', client_ip=ip, browser_proof=browser_proof)
if risk['prompt'] is False:
    return open_session(user)  # risk['reasons'] say why

step = tq.start('LOGIN', user, ip=ip, browser_proof=browser_proof)

browsers = tq.risk.browsers(user)['browsers']
tq.risk.forget_browsers(user)  # all; or thumbprint=... for one

$browserProof = $request->header('X-Touchque-Browser');
$risk = $tq->risk->check([
    'externalUsername' => $user, 'type' => 'LOGIN', 'clientIp' => $request->ip(), 'browserProof' => $browserProof,
]);
if ($risk['prompt'] === false) {
    return openSession($user); // $risk['reasons'] say why
}
$step = $tq->start('LOGIN', $user, null, null, $request->ip(), $request->userAgent(), $browserProof);

$browsers = $tq->risk->browsers(['externalUsername' => $user])['browsers'];
$tq->risk->forgetBrowsers(['externalUsername' => $user]); // all; add 'thumbprint' for one

proof := r.Header.Get(touchque.GuardBrowserHeader)
risk, err := tq.Risk.Check(r.Context(), touchque.RiskCheckOptions{
    ExternalUsername: user, Type: "LOGIN", ClientIP: ip, UserAgent: r.UserAgent(), BrowserProof: proof,
})
if err == nil && !risk.Prompt {
    return openSession(user) // risk.Reasons say why
}
step, err := tq.Start("LOGIN", user, touchque.StartOptions{IP: ip, BrowserProof: proof})

list, err := tq.Risk.Browsers(ctx, touchque.RiskBrowsersOptions{ExternalUsername: user})
_, err = tq.Risk.ForgetBrowsers(ctx, touchque.ForgetBrowsersOptions{ExternalUsername: user}) // all; or Thumbprint for one

var browserProof = http.Request.Headers["X-Touchque-Browser"].ToString();
var risk = await tq.Risk.CheckAsync(new RiskCheckOptions
{
    ExternalUsername = user, Type = "LOGIN", ClientIp = http.TouchqueClientIp(),
    UserAgent = http.Request.Headers.UserAgent.ToString(), BrowserProof = browserProof,
});
if (!risk.Prompt) return OpenSession(user); // risk.Reasons say why

var step = await tq.StartAsync("LOGIN", new StartOptions { User = user, Ip = http.TouchqueClientIp(), BrowserProof = browserProof });

var browsers = await tq.Risk.BrowsersAsync(user);
await tq.Risk.ForgetBrowsersAsync(user); // all; or a thumbprint for one

String browserProof = request.getHeader("X-Touchque-Browser");
Risk.CheckResult risk = tq.risk().check(new Risk.CheckOptions(user).type("LOGIN")
    .clientIp(TouchqueSpring.clientIp(request)).userAgent(request.getHeader("User-Agent")).browserProof(browserProof));
if (!risk.prompt()) return openSession(user); // risk.reasons() say why

Step step = tq.start("LOGIN", new StartOptions(user).ip(TouchqueSpring.clientIp(request)).browserProof(browserProof));

JsonNode browsers = tq.risk().browsers(user);
tq.risk().forgetBrowsers(user, null); // all; or a thumbprint for one

browser_proof = request.headers["X-Touchque-Browser"]
risk = tq.risk.check(user, type: "LOGIN", client_ip: request.remote_ip, user_agent: request.user_agent, browser_proof: browser_proof)
return open_session(user) if risk["prompt"] == false  # risk["reasons"] say why

step = tq.start("LOGIN", user, ip: request.remote_ip, browser_proof: browser_proof)

browsers = tq.risk.browsers(user)["browsers"]
tq.risk.forget_browsers(user)  # all; or thumbprint: for one

curl -X POST https://api.touchque.com/risk/check \
  -H "x-api-key: tq_abc123" -H "x-timestamp: $TS" -H "x-nonce: $NONCE" -H "x-signature: $SIG" \
  -H "Content-Type: application/json" \
  -d '{"externalUsername":"user@company.com","type":"LOGIN","clientIp":"203.0.113.7","browserProof":"'"$PROOF"'"}'