Detect impossible travel

async function checkImpossibleTravel(identityId: string, newIp: string) {
  const latest = await db`
    SELECT ip, country, city, created_at
    FROM locations
    WHERE identity_id = ${identityId}
    ORDER BY created_at DESC
    LIMIT 1
  `.first();

  if (!latest) return; // First login, no comparison.

  const newGeo = await geoLookup(newIp); // MaxMind, ipdata.co, etc.
  const oldGeo = await geoLookup(latest.ip);

  const distanceKm = haversine(
    newGeo.latitude, newGeo.longitude,
    oldGeo.latitude, oldGeo.longitude
  );
  const minutesSince = (Date.now() - new Date(latest.created_at).getTime()) / 60_000;

  // Threshold: 600 km in 30 minutes
  const maxKmPerMinute = 600 / 30; // ~20 km/min (faster than commercial flight)
  if (distanceKm > maxKmPerMinute * minutesSince) {
    return { suspicious: true, oldGeo, newGeo, distanceKm, minutesSince };
  }

  return { suspicious: false };
}

const check = await checkImpossibleTravel(identity.id, sourceIp);
if (check?.suspicious) {
  // Option 1: Force step-up MFA
  return { redirect: "/self-service/login/browser?aal=aal2&refresh=true&reason=impossible_travel" };

  // Option 2: Email the user
  await sendSecurityAlert(identity.email, {
    type: "impossible_travel",
    oldLocation: `${check.oldGeo.city}, ${check.oldGeo.country}`,
    newLocation: `${check.newGeo.city}, ${check.newGeo.country}`,
  });

  // Option 3: Block outright (aggressive)
  return { error: "Login from unusual location blocked" };
}