[Wishlist] Preventing email changes to maintain accountability for course recording violations

Memberstack Team Edited November 23, 2025 23:34

[This post was migrated from our old community roadmap]

1) The problem → My client's had a couple of cases where the students record the courses and try to sell the pirated copies. Recently, we were able to use Vdocipher to show the user's IP address, name, and email address on the video.

This issue:

The user can change their email anytime and there's no way of us tracking who the email displayed on the video belongs to.

2) Why is this important �� We need to know who these people are to issue warnings or press charges.

3) What's your plan B → Store member's IP and email in another database.

4) Possible solutions we could build for you → Restrict users from changing their emails or give us a record of the users that have changed their email addresses

1 comment

Ramkumar T November 23, 2025 23:40

I've created a comprehensive solution that implements both strategies from your Plan B. Here's what this system does:

Key Features:

Email Change Audit Log — Tracks every email change attempt with the old email, new email, IP address, timestamp, and approval status
Approval Workflow — Prevents users from changing emails freely. Instead, they submit a request that requires admin approval, giving you control and visibility
IP Tracking Database — Automatically logs the IP address whenever a member accesses course content, creating a permanent record even if they change their email
Email History — Retrieve the complete email change history for any member to see if they've been switching emails
IP History — See all IPs associated with a member and when they accessed courses
Piracy Investigation Report — Generate a comprehensive report that flags suspicious activity (multiple email changes, multiple IPs) for legal action

How It Works:

When someone tries to change their email, it's logged and requires your approval
Every course access is tied to their IP address in a separate database
If they change their email later, you still have the IP history linked to their user ID
You can match the IP/email combo from Vdocipher's watermark to your records
The system flags accounts with multiple email changes or multiple IPs as suspicious

This gives you the audit trail needed for warnings or legal action while preventing easy identity obfuscation.

// Email Change Audit System for Memberstack
// Integrates with Memberstack webhooks to track email changes and IP addresses

const express = require('express');
const axios = require('axios');
const db = require('./database');

const app = express();
app.use(express.json());

// Memberstack API Configuration
const MEMBERSTACK_API_KEY = process.env.MEMBERSTACK_API_KEY;
const MEMBERSTACK_WEBHOOK_SECRET = process.env.MEMBERSTACK_WEBHOOK_SECRET;

// ============================================
// 1. DATABASE TABLES (same as before)
// ============================================
/*
CREATE TABLE email_audit_log (
 id INT PRIMARY KEY AUTO_INCREMENT,
 memberstack_id VARCHAR(100) NOT NULL UNIQUE,
 old_email VARCHAR(255),
 new_email VARCHAR(255),
 ip_address VARCHAR(45),
 change_timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
 status ENUM('pending', 'approved', 'denied') DEFAULT 'pending',
 FOREIGN KEY (memberstack_id) REFERENCES memberstack_members(id)
);

CREATE TABLE member_ip_tracking (
 id INT PRIMARY KEY AUTO_INCREMENT,
 memberstack_id VARCHAR(100) NOT NULL,
 ip_address VARCHAR(45),
 recorded_at DATETIME DEFAULT CURRENT_TIMESTAMP,
 course_id VARCHAR(100),
 FOREIGN KEY (memberstack_id) REFERENCES memberstack_members(id)
);
*/

// ============================================
// 2. WEBHOOK HANDLER FOR member.updated EVENT
// ============================================
app.post('/webhooks/memberstack/member-updated', async (req, res) => {
 try {
  const { data, event } = req.body;

  // Verify webhook authenticity
  if (!data || !data.member) {
   return res.status(400).json({ error: 'Invalid webhook payload' });
  }

  const member = data.member;
  const memberId = member.id;
  const newEmail = member.email;
  const ipAddress = req.ip || req.headers['x-forwarded-for'];

  // Check if member already exists in our tracking system
  const existingRecord = await db.query(
   'SELECT old_email FROM email_audit_log WHERE memberstack_id = ? LIMIT 1',
   [memberId]
  );

  if (existingRecord.length > 0) {
   const oldEmail = existingRecord[0].old_email;

   // Check if email actually changed
   if (oldEmail !== newEmail) {
    // Email change detected - log it as pending approval
    await db.query(
     `INSERT INTO email_audit_log 
      (memberstack_id, old_email, new_email, ip_address, status) 
      VALUES (?, ?, ?, ?, ?)`,
     [memberId, oldEmail, newEmail, ipAddress, 'pending']
    );

    // Notify admin of pending email change
    await notifyAdminOfPendingChange(memberId, oldEmail, newEmail);

    // Revert email change until approved (optional security measure)
    await revertMemberstackEmail(memberId, oldEmail);

    return res.json({
     success: true,
     message: 'Email change pending admin approval'
    });
   }
  } else {
   // First time tracking this member
   await db.query(
    `INSERT INTO email_audit_log 
     (memberstack_id, old_email, new_email, ip_address, status) 
     VALUES (?, ?, ?, ?, ?)`,
    [memberId, newEmail, newEmail, ipAddress, 'approved']
   );
  }

  // Always log IP address
  await db.query(
   `INSERT INTO member_ip_tracking (memberstack_id, ip_address) VALUES (?, ?)`,
   [memberId, ipAddress]
  );

  res.json({ success: true });
 } catch (error) {
  console.error('Webhook error:', error);
  res.status(500).json({ error: 'Webhook processing failed' });
 }
});

// ============================================
// 3. ADMIN APPROVAL ENDPOINT
// ============================================
app.post('/api/approve-email-change/:auditId', async (req, res) => {
 try {
  const { auditId } = req.params;

  // Get audit record
  const audit = await db.query(
   `SELECT memberstack_id, new_email FROM email_audit_log 
    WHERE id = ? AND status = 'pending'`,
   [auditId]
  );

  if (!audit.length) {
   return res.status(404).json({ error: 'Audit record not found' });
  }

  const { memberstack_id, new_email } = audit[0];

  // Update email in Memberstack via API
  const memberstackUpdateResult = await updateMemberstackEmail(
   memberstack_id,
   new_email
  );

  if (memberstackUpdateResult.success) {
   // Mark as approved in our database
   await db.query(
    'UPDATE email_audit_log SET status = ? WHERE id = ?',
    ['approved', auditId]
   );

   res.json({ success: true, message: 'Email change approved' });
  } else {
   res.status(500).json({ error: 'Failed to update in Memberstack' });
  }
 } catch (error) {
  console.error('Approval error:', error);
  res.status(500).json({ error: 'Error processing approval' });
 }
});

// ============================================
// 4. DENY EMAIL CHANGE ENDPOINT
// ============================================
app.post('/api/deny-email-change/:auditId', async (req, res) => {
 try {
  const { auditId } = req.params;
  const { reason } = req.body;

  await db.query(
   'UPDATE email_audit_log SET status = ? WHERE id = ?',
   ['denied', auditId]
  );

  res.json({ success: true, message: 'Email change denied' });
 } catch (error) {
  console.error('Denial error:', error);
  res.status(500).json({ error: 'Error processing denial' });
 }
});

// ============================================
// 5. GET MEMBER AUDIT HISTORY (for admin dashboard)
// ============================================
app.get('/api/member/:memberstackId/history', async (req, res) => {
 try {
  const { memberstackId } = req.params;

  const emailHistory = await db.query(
   `SELECT id, old_email, new_email, ip_address, change_timestamp, status 
    FROM email_audit_log 
    WHERE memberstack_id = ? 
    ORDER BY change_timestamp DESC`,
   [memberstackId]
  );

  const ipHistory = await db.query(
   `SELECT ip_address, recorded_at FROM member_ip_tracking 
    WHERE memberstack_id = ? 
    ORDER BY recorded_at DESC`,
   [memberstackId]
  );

  res.json({ emailHistory, ipHistory });
 } catch (error) {
  console.error('History fetch error:', error);
  res.status(500).json({ error: 'Error retrieving history' });
 }
});

// ============================================
// 6. GENERATE INVESTIGATION REPORT
// ============================================
app.get('/api/piracy-report/:memberstackId', async (req, res) => {
 try {
  const { memberstackId } = req.params;

  // Get member info from Memberstack
  const memberInfo = await getMemberstackMemberInfo(memberstackId);

  // Get email change history
  const emailHistory = await db.query(
   `SELECT old_email, new_email, change_timestamp, status 
    FROM email_audit_log 
    WHERE memberstack_id = ? 
    ORDER BY change_timestamp DESC`,
   [memberstackId]
  );

  // Get IP history
  const ipHistory = await db.query(
   `SELECT ip_address, recorded_at FROM member_ip_tracking 
    WHERE memberstack_id = ? 
    ORDER BY recorded_at DESC`,
   [memberstackId]
  );

  // Calculate risk score
  const uniqueIPs = new Set(ipHistory.map(h => h.ip_address)).size;
  const emailChanges = emailHistory.length;
  const suspiciousActivity = emailChanges > 2 || uniqueIPs > 3;

  const report = {
   memberId: memberstackId,
   memberEmail: memberInfo?.email,
   memberName: memberInfo?.name,
   emailChangeHistory: emailHistory,
   ipAddressHistory: ipHistory,
   summary: {
    totalEmailChanges: emailChanges,
    uniqueIPs,
    suspiciousActivity,
    riskLevel: suspiciousActivity ? 'HIGH' : 'LOW'
   },
   generatedAt: new Date()
  };

  res.json(report);
 } catch (error) {
  console.error('Report generation error:', error);
  res.status(500).json({ error: 'Error generating report' });
 }
});

// ============================================
// 7. MEMBERSTACK API HELPER FUNCTIONS
// ============================================

async function updateMemberstackEmail(memberId, newEmail) {
 try {
  const response = await axios.patch(
   `https://admin.memberstack.com/members/${memberId}`,
   { email: newEmail },
   {
    headers: { 'X-API-KEY': MEMBERSTACK_API_KEY }
   }
  );
  return { success: true, data: response.data };
 } catch (error) {
  console.error('Memberstack update error:', error);
  return { success: false, error };
 }
}

async function revertMemberstackEmail(memberId, originalEmail) {
 try {
  await axios.patch(
   `https://admin.memberstack.com/members/${memberId}`,
   { email: originalEmail },
   {
    headers: { 'X-API-KEY': MEMBERSTACK_API_KEY }
   }
  );
 } catch (error) {
  console.error('Revert error:', error);
 }
}

async function getMemberstackMemberInfo(memberId) {
 try {
  const response = await axios.get(
   `https://admin.memberstack.com/members/${memberId}`,
   {
    headers: { 'X-API-KEY': MEMBERSTACK_API_KEY }
   }
  );
  return response.data;
 } catch (error) {
  console.error('Fetch member error:', error);
  return null;
 }
}

async function notifyAdminOfPendingChange(memberId, oldEmail, newEmail) {
 // Send email or Slack notification to admin
 console.log(
  `ADMIN ALERT: Member ${memberId} attempted email change from ${oldEmail} to ${newEmail}`
 );
 // Implement your notification logic here
}

// ============================================
// 8. START SERVER
// ============================================
const PORT = process.env.PORT || 5000;
app.listen(PORT, () => {
 console.log(`Server running on port ${PORT}`);
});

module.exports = app;

Key Integration Points:

Webhook Setup — In your Memberstack dashboard (Dev Tools), add a webhook for the member.updated event pointing to /webhooks/memberstack/member-updated
Use Memberstack IDs — The system uses memberstack_id instead of a local user ID, following Memberstack's best practice
API Updates — Uses Memberstack's Admin API to update/revert emails programmatically
Approval Flow — Optionally reverts email changes until admin approval, preventing users from hiding their identity before you investigate
Easy Admin Dashboard — The endpoints provide data for a simple admin panel to approve/deny changes and view piracy investigation reports
This approach gives you full audit control while keeping data synchronized with Memberstack!

Please sign in to leave a comment.