Block fake signups in Firebase Authentication

Firebase blocking functions run before a user is created. Throwing an error from beforeUserCreated stops the signup. Blocking functions need Firebase Authentication with Identity Platform.

// functions/src/index.ts
import { beforeUserCreated, HttpsError } from "firebase-functions/v2/identity";
import { defineSecret } from "firebase-functions/params";

const VEQEN_API_KEY = defineSecret("VEQEN_API_KEY");

export const screenSignup = beforeUserCreated({ secrets: [VEQEN_API_KEY] }, async (event) => {
  const email = event.data?.email;
  if (!email) return;

  let result: any = null;
  try {
    const response = await fetch("https://veqen-app.com/v1/signup/check", {
      method: "POST",
      headers: {
        Authorization: `Bearer ${VEQEN_API_KEY.value()}`,
        "Content-Type": "application/json",
      },
      body: JSON.stringify({ email, ip: event.ipAddress }),
      signal: AbortSignal.timeout(4000),
    });
    if (response.ok) result = await response.json();
  } catch {
    return; // fail open
  }

  if (result?.risk.verdict === "refuse") {
    throw new HttpsError("invalid-argument", "Please sign up with a permanent email address.");
  }
  return { customClaims: { veqen: result?.risk.verdict ?? "review" } };
});

firebase functions:secrets:set VEQEN_API_KEY
firebase deploy --only functions

Then register the function under Authentication → Settings → Blocking functions if it isn't picked up automatically. Read the veqen custom claim in your app to require email verification for review.