Less typing.More to work with.

import { isIP } from 'node:net';

const text = value => typeof value === 'string' && value.trim() ? value : null;
const flag = value => typeof value === 'boolean' ? value : null;
const record = value => value && typeof value === 'object' && !Array.isArray(value) ? value : {};

async function lookup(url, apiKey, fetchImpl) {
  const controller = new AbortController();
  let timer;
  try {
    return await Promise.race([
      (async () => {
        const response = await fetchImpl(url, {
          headers: { 'X-API-Key': apiKey, Accept: 'application/json' },
          signal: controller.signal, redirect: 'error',
        });
        if (!response.ok || !response.body) return null;
        const reader = response.body.getReader();
        const chunks = [];
        let size = 0;
        try {
          while (true) {
            const { done, value } = await reader.read();
            if (done) break;
            size += value.byteLength;
            if (size > 32768) { controller.abort(); return null; }
            chunks.push(value);
          }
        } finally {
          reader.releaseLock();
        }
        return record(JSON.parse(Buffer.concat(chunks).toString('utf8')));
      })(),
      // The deadline covers the request and its response body. No retries.
      new Promise(resolve => { timer = setTimeout(() => { controller.abort(); resolve(null); }, 5000); }),
    ]);
  } catch {
    return null;
  } finally {
    controller.abort();
    clearTimeout(timer);
  }
}

/**
 * Call after receiving a form, with values from the incoming HTTP request.
 * visitorIp must come from your host's configured, trusted request/proxy integration.
 * Never use the submitted hidden ip or blindly read X-Forwarded-For.
 * userAgent is the incoming User-Agent header; clients can change that header too.
 * Keep PARSEAPI_KEY on your server. Paid plans include these deep fields.
 * @param {{ visitorIp?: string | null, userAgent?: string | null }} request
 * @param {{ apiKey?: string, fetchImpl?: typeof fetch }} options
 */
export async function getFormContext(
  { visitorIp, userAgent },
  { apiKey = process.env.PARSEAPI_KEY, fetchImpl = fetch } = {},
) {
  apiKey = typeof apiKey === 'string' ? apiKey.trim() : '';
  if (!apiKey || apiKey.startsWith('parse_public_')) {
    throw new Error('Set PARSEAPI_KEY to your secret ParseAPI key on the server.');
  }
  const ip = typeof visitorIp === 'string' ? visitorIp.trim() : '';
  const ua = typeof userAgent === 'string' ? userAgent.trim() : '';
  const ipUrl = isIP(ip) && !ip.includes('%')
    ? new URL(`/ip/${encodeURIComponent(ip)}?deep=true`, 'https://api.parseapi.com') : null;
  const uaUrl = ua && ua.length <= 8192 && !/[\r\n]/.test(ua)
    ? new URL('/useragent', 'https://api.parseapi.com') : null;
  if (uaUrl) uaUrl.search = new URLSearchParams({ ua, deep: 'true' }).toString();

  const [ipAnswer, uaAnswer] = await Promise.all([
    ipUrl ? lookup(ipUrl, apiKey, fetchImpl) : null,
    uaUrl ? lookup(uaUrl, apiKey, fetchImpl) : null,
  ]);
  const location = record(ipAnswer);
  const network = record(location.deep);
  const agent = record(uaAnswer);
  const detail = record(agent.deep);

  // Allowlisted facts for your own rules. Unknown or plan-locked fields stay null.
  // false means not detected. Neither an IP location nor a User-Agent proves identity.
  return {
    ip: ipUrl ? ip : null,
    ip_country: text(location.country),
    ip_state: text(network.state),
    ip_city: text(network.city),
    ip_asn: text(location.asn),
    ip_vpn: flag(network.vpn),
    ip_tor: flag(network.tor),
    ip_relay: flag(network.relay),
    ip_datacenter: flag(network.datacenter),
    device: text(agent.device),
    os: text(agent.os),
    browser: text(agent.browser),
    bot: flag(agent.bot),
    bot_name: text(record(detail.bot).name),
  };
}