@affiliateo/web 2.4.0 → 3.1.0

package/dist/bot-detect.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Client-side bot detection. Mirrors Datafast / PostHog / Plausible's
+ * approach: catch the obvious automation tools at SDK init so they
+ * never fire a single network request.
+ *
+ * Defense in depth:
+ *   1. This check       — catches Selenium / Puppeteer / curl / etc
+ *                         BEFORE anything hits the wire. Saves bandwidth.
+ *                         Can be bypassed by a determined attacker who
+ *                         edits the bundled SDK.
+ *   2. Server UA regex  — catches the same patterns plus legit crawlers
+ *                         (Googlebot, FB crawler, etc). Server is
+ *                         authoritative. Can't be bypassed.
+ *   3. Cloudflare       — invisible browser-attestation challenge. Real
+ *      Turnstile           browsers pass in 50-200ms; scripts that don't
+ *                         run real JS can't pass it. Catches sophisticated
+ *                         attackers who spoofed their UA past layer 2.
+ *
+ * This file implements layer 1 only. Order: layer 1 first (cheap), then
+ * layer 3 (kicks in on the request), then layer 2 (server checks before
+ * writing). If any one layer rejects, the event drops.
+ *
+ * Patterns sourced from the Datafast script tag + npm SDK (publicly
+ * inspectable). We include their full list because it represents years
+ * of accumulated bot-shape knowledge that's expensive to reproduce.
+ */
+/**
+ * Returns true if the current browser context looks like a bot or
+ * automation tool. Safe to call in SSR (returns true since there's no
+ * real visitor in that context anyway — a server-rendered page
+ * shouldn't be firing analytics).
+ *
+ * Wraps every check in try/catch so a hostile environment (frozen
+ * navigator, locked-down iframe) can't crash the SDK init. Any throw
+ * == "not a bot, let them through" so we err on the side of measuring.
+ */
+export declare function isLikelyBot(): boolean;

package/dist/bot-detect.js

@@ -0,0 +1,138 @@
+/**
+ * Client-side bot detection. Mirrors Datafast / PostHog / Plausible's
+ * approach: catch the obvious automation tools at SDK init so they
+ * never fire a single network request.
+ *
+ * Defense in depth:
+ *   1. This check       — catches Selenium / Puppeteer / curl / etc
+ *                         BEFORE anything hits the wire. Saves bandwidth.
+ *                         Can be bypassed by a determined attacker who
+ *                         edits the bundled SDK.
+ *   2. Server UA regex  — catches the same patterns plus legit crawlers
+ *                         (Googlebot, FB crawler, etc). Server is
+ *                         authoritative. Can't be bypassed.
+ *   3. Cloudflare       — invisible browser-attestation challenge. Real
+ *      Turnstile           browsers pass in 50-200ms; scripts that don't
+ *                         run real JS can't pass it. Catches sophisticated
+ *                         attackers who spoofed their UA past layer 2.
+ *
+ * This file implements layer 1 only. Order: layer 1 first (cheap), then
+ * layer 3 (kicks in on the request), then layer 2 (server checks before
+ * writing). If any one layer rejects, the event drops.
+ *
+ * Patterns sourced from the Datafast script tag + npm SDK (publicly
+ * inspectable). We include their full list because it represents years
+ * of accumulated bot-shape knowledge that's expensive to reproduce.
+ */
+// Selenium/WebDriver/headless flags set on window or navigator. Modern
+// automation frameworks try to hide these but the defaults still leak.
+const AUTOMATION_GLOBALS = [
+    '__webdriver_evaluate',
+    '__selenium_evaluate',
+    '__webdriver_script_function',
+    '__webdriver_unwrapped',
+    '__fxdriver_evaluate',
+    '__driver_evaluate',
+    '_Selenium_IDE_Recorder',
+    '_selenium',
+    'calledSelenium',
+    // ChromeDriver's signature global. The dollar-sign-cdc prefix is
+    // a known fingerprint that vanilla undetected-chromedriver tries to
+    // strip but base ChromeDriver still includes.
+    '$cdc_asdjflasutopfhvcZLmcfl_',
+];
+// User-agent substrings (lowercased before match). These cover both the
+// headless browser families AND the tool families (curl/python/etc).
+// Real human UAs do contain things like "Mobile/15E148" so we match on
+// distinctive automation tokens only.
+const BOT_UA_PATTERNS = [
+    'headlesschrome',
+    'phantomjs',
+    'selenium',
+    'webdriver',
+    'puppeteer',
+    'playwright',
+    'python',
+    'curl',
+    'wget',
+    'java/',
+    'go-http',
+    'node.js',
+    'axios',
+    'postman',
+];
+// documentElement attributes some Selenium variants set. Cheap to check.
+const BOT_DOC_ATTRS = ['webdriver', 'selenium', 'driver'];
+/**
+ * Returns true if the current browser context looks like a bot or
+ * automation tool. Safe to call in SSR (returns true since there's no
+ * real visitor in that context anyway — a server-rendered page
+ * shouldn't be firing analytics).
+ *
+ * Wraps every check in try/catch so a hostile environment (frozen
+ * navigator, locked-down iframe) can't crash the SDK init. Any throw
+ * == "not a bot, let them through" so we err on the side of measuring.
+ */
+export function isLikelyBot() {
+    // SSR or non-browser context. We can't run analytics here anyway
+    // because there's no localStorage / sendBeacon / DOM events.
+    if (typeof window === 'undefined' || typeof navigator === 'undefined')
+        return true;
+    try {
+        const nav = window.navigator;
+        const win = window;
+        // Selenium / Puppeteer / Playwright signature on navigator.
+        // Modern stealth plugins try to override this but the override
+        // is detectable too (the property descriptor looks wrong) — we
+        // catch the easy case here and let Turnstile catch the rest.
+        if (nav.webdriver === true)
+            return true;
+        // Legacy headless flags (PhantomJS / Nightmare). Still present in
+        // some old scraper toolchains; cheap to check.
+        if (win.callPhantom !== undefined)
+            return true;
+        if (win._phantom !== undefined)
+            return true;
+        if (win.__nightmare !== undefined)
+            return true;
+        // Missing / suspicious UA. Real browsers always set a useful UA
+        // string; a missing or stub UA strongly implies a HTTP client
+        // (curl --user-agent "" / a python script that forgot to set one).
+        if (!nav.userAgent
+            || nav.userAgent === ''
+            || nav.userAgent === 'undefined'
+            || nav.userAgent.length < 5) {
+            return true;
+        }
+        const ua = nav.userAgent.toLowerCase();
+        // Substring match on the known automation tokens. We split into a
+        // single loop instead of one giant regex for readability — the cost
+        // difference at <20 patterns is microseconds either way.
+        for (const pattern of BOT_UA_PATTERNS) {
+            if (ua.includes(pattern))
+                return true;
+        }
+        // Selenium globals on window. Some frameworks reset navigator but
+        // forget about these.
+        for (const key of AUTOMATION_GLOBALS) {
+            if (win[key] !== undefined)
+                return true;
+        }
+        // documentElement attributes. Cheap belt-and-suspenders check; some
+        // Selenium variants annotate the HTML root for their own bookkeeping.
+        const docEl = document.documentElement;
+        if (docEl) {
+            for (const attr of BOT_DOC_ATTRS) {
+                if (docEl.getAttribute(attr))
+                    return true;
+            }
+        }
+        return false;
+    }
+    catch {
+        // Defensive: if any of the checks throw (locked-down iframe,
+        // proxy-wrapped navigator, etc.), don't block the visitor. Server
+        // regex + Turnstile are still in place to catch whatever this is.
+        return false;
+    }
+}

package/dist/provider.d.ts

@@ -18,6 +18,6 @@ export declare function useAffiliateRef(): AffiliateoContextValue;
  * ```
  */
 export declare function getAttribution(): Record<string, string>;
-export declare function AffiliateoProvider({ campaignId, apiUrl, children, }: AffiliateoConfig & {
+export declare function AffiliateoProvider({ campaignId, apiUrl, allowedHostnames, children, }: AffiliateoConfig & {
     children: React.ReactNode;
 }): import("react/jsx-runtime").JSX.Element;