Clientes dentro, bots fora

# Ask before the protected action
curl -X POST https://korzen.dev/v1/decide \
  -H "Authorization: Bearer $KORZEN_API_KEY" \
  -d '{
    "ip": "203.0.113.10",
    "user_agent": "Mozilla/5.0 …",
    "token": "<_kz cookie>",
    "path": "/checkout"
  }'

// Ask before the protected action; let through on any error
const d = await fetch(API + "/v1/decide", {
  method: "POST",
  headers: { Authorization: `Bearer ${KEY}` },
  body: JSON.stringify({ ip, user_agent, token, path }),
  signal: AbortSignal.timeout(200),
}).then((r) => r.json()).catch(() => null);

if (d?.action === "block") return res.status(403).end();

# Ask before the protected action; let through on any error
try:
    d = requests.post(API + "/v1/decide",
        headers={"Authorization": f"Bearer {KEY}"},
        json={"ip": ip, "user_agent": ua, "token": token},
        timeout=0.2).json()
except requests.RequestException:
    d = {}
if d.get("action") == "block":
    abort(403)

// Ask before the protected action; let through on any error
c := &http.Client{Timeout: 200 * time.Millisecond}
r, _ := http.NewRequest("POST", api+"/v1/decide", body)
r.Header.Set("Authorization", "Bearer "+key)
var d struct{ Action string }
if res, err := c.Do(r); err == nil {
    json.NewDecoder(res.Body).Decode(&d)
    res.Body.Close()
}
if d.Action == "block" {
    http.Error(w, "try again later", 403)
    return
}

// Ask before the protected action; let through on any error
var req = HttpRequest
    .newBuilder(URI.create(API + "/v1/decide"))
    .header("Authorization", "Bearer " + KEY)
    .timeout(Duration.ofMillis(200))
    .POST(BodyPublishers.ofString(json)).build();
String act = "";
try {
    var res = http.send(req, BodyHandlers.ofString());
    act = mapper.readTree(res.body())
        .path("action").asText();
} catch (Exception e) { /* let through */ }
if (act.equals("block")) {
    response.sendError(403);
    return;
}

// Ask before the protected action; let through on any error
$ch = curl_init(API . '/v1/decide');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($visitor),
    CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . KEY],
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT_MS => 200,
]);
$d = json_decode(curl_exec($ch) ?: '{}', true);
if (($d['action'] ?? '') === 'block') {
    http_response_code(403);
    exit;
}

// Ask before the protected action; let through on any error
// http: an HttpClient with "Authorization: Bearer KEY"
var act = "";
try {
    using var cts = new CancellationTokenSource(200);
    var res = await http.PostAsJsonAsync(
        Api + "/v1/decide", visitor, cts.Token);
    var d = await res.Content
        .ReadFromJsonAsync<JsonElement>(cts.Token);
    act = d.GetProperty("action").GetString();
} catch { /* let through */ }
if (act == "block") return Results.StatusCode(403);