@nice-digital/global-nav 7.1.1187 → 7.1.1189-GN-264-load-aws-chal

package/README.md

@@ -313,6 +313,13 @@ For a full list of all the available props, see the [props section](#props) belo
   
 Optional spacing between page content and footer back-to-top link.
 
+###### Main.awsWafScriptURL
+
+- Type: `String | false`
+- Default: `undefined`
+
+See [Header.awsWafScriptURL](#headerawswafscripturl).
+
 ##### Header props
 
 ###### Header.service
@@ -663,6 +670,27 @@ If the authentication provider has been set to "idam", then an array of links mu
 
 The displayName is the user's name and must be provided if the "idam" provider is used and the user is logged in.
 
+###### Header.awsWafScriptURL
+
+- Type: `String | false`
+- Default: `undefined`
+
+Overrides how the [AWS WAF challenge](#aws-waf-challenge) script is loaded. Leave it out and Global Nav loads the script for the page's hostname, if it knows of one.
+
+Pass a URL to load that script instead, for example to test against a stand-in locally:
+
+```js
+<Header awsWafScriptURL="https://localhost:4000/mock-aws-waf-jsapi.js" />
+```
+
+Pass `false` to stop Global Nav loading the script at all, for example because your app includes it itself:
+
+```js
+<Header awsWafScriptURL={false} />
+```
+
+The `Header`, `Footer` and `Main` components all take this prop and all behave the same way, because no one of them is on every page of every service. Whichever mounts first does the work. `false` from any of them switches the challenge off for the rest of the page's life, so there's no need to pass it to all three as long as the one you pass it to mounts first - the header, usually.
+
 ##### Footer props
 
 ###### Footer.service
@@ -674,6 +702,13 @@ The displayName is the user's name and must be provided if the "idam" provider i
 The identifier of the currently active service.
 See [services.json](src/services.json) for a list of the available service identifiers.
 
+###### Footer.awsWafScriptURL
+
+- Type: `String | false`
+- Default: `undefined`
+
+See [Header.awsWafScriptURL](#headerawswafscripturl).
+
 ### CDN
 
 Reference the Global Nav bundle directly from the NICE CDN to render the Global Nav. We recommend including this before the closing `</body>` tag but before your application's scripts:
@@ -816,6 +851,69 @@ The footer renders by default, set `footer` to `false` to stop it from rendering
 Or, pass an object of key/value pairs of settings specific to the footer.
 See the [footer props](#footer-props) section for available options.
 
+##### awsWafScriptURL
+
+- Type: `String | Boolean`
+- Default: `undefined`
+
+Overrides how the [AWS WAF challenge](#aws-waf-challenge) script is loaded: a URL to load that script instead of the one for the page's hostname, or `false` to not load it at all e.g. `global_nav_config = { awsWafScriptURL: false }`.
+
+This sits at the top level of the config, next to `service`, rather than under `header` or `footer`. That's deliberate: it still applies when either of those is set to `false`.
+
+### AWS WAF challenge
+
+Global Nav loads the [AWS WAF JavaScript SDK](https://docs.aws.amazon.com/waf/latest/developerguide/waf-js-challenge-api.html) on services that sit behind an AWS WAF web ACL. The SDK silently acquires an `aws-waf-token` cookie in the background. The web ACL checks requests for that token and challenges the ones without it, which is how we tell real browsers from bots.
+
+It's the web ACL that keeps the bots out, not this script. The script is there so that real users already hold a token by the time they need one, and never see the challenge interstitial.
+
+Global Nav carries this because it's the one piece of code already on every NICE service. The alternative is each service adding the script for itself.
+
+#### How it picks the script
+
+Each web ACL issues its own script URL, and the ids in that URL are generated by AWS, so it can't be worked out from the hostname. Instead there's a lookup table in [_src/aws-waf/integrations.js_](src/aws-waf/integrations.js), with one entry per web ACL listing the hostnames it protects.
+
+When Global Nav loads, it looks up `window.location.hostname` in that table. If there's an entry, it adds the script to the `<head>`. If there isn't, it does nothing, which is what we want for localhost and for any environment with no web ACL in front of it.
+
+> The table lists ops' sandbox and our live, alpha, beta, test and dev hostnames already, but every `scriptURL` is empty until ops create the web ACLs: there are no URLs to put in before then. An entry with an empty URL does nothing, so until the URLs are filled in the script only loads when `awsWafScriptURL` is passed.
+
+The script is only ever added once per page. Global Nav also does nothing if the SDK is already there, i.e. `window.AwsWafIntegration` exists or the page has its own script tag pointing at `awswaf.com`.
+
+Use [`awsWafScriptURL`](#headerawswafscripturl) to override the lookup, or to switch the whole thing off.
+
+#### Adding or filling in a web ACL
+
+Each entry in [_src/aws-waf/integrations.js_](src/aws-waf/integrations.js) looks like this:
+
+```js
+export const integrations = [
+  {
+    hosts: ['www.nice.org.uk'],
+    scriptURL: 'https://<id>.eu-west-1.sdk.awswaf.com/<id>/<id>/challenge.js',
+    cookieDomains: ['.nice.org.uk'],
+  },
+];
+```
+
+- `hosts` are exact hostnames, no wildcards. Hostnames that share a load balancer (or CloudFront distribution) share a web ACL, so list them all against the one entry. The entries we ship were grouped by which hostnames resolve to the same address, which is a best guess at that: confirm it against the web ACLs ops actually create, and merge or split entries to match.
+- `scriptURL` comes from _Application integration_ in the AWS WAF console. Ops are issuing the _Intelligent threat integration_ URL, which ends in `challenge.js`; the _CAPTCHA integration_ one ends in `jsapi.js` and works the same way. It isn't a secret: it ends up in the page source. Leave it empty for a web ACL that doesn't exist yet and the entry does nothing.
+- `cookieDomains` is optional, e.g. `['.nice.org.uk']`. It widens the token cookie from the exact hostname so that one token works across subdomains. It's only valid once the same domain is on the web ACL's token domain list, otherwise AWS rejects the tokens, so ask ops for that at the same time as the URL. The shipped entries all set it.
+
+A new or changed entry needs a Global Nav release. Services loading the unversioned CDN bundle pick that up straight away; services using the npm package pick it up when they next upgrade and deploy.
+
+#### NICE Accounts
+
+NICE Accounts sits behind a web ACL too, and the header calls it to find out whether you're signed in. That call is a script tag, which can't send the token as a header, so it relies on the `aws-waf-token` cookie instead. Global Nav waits for the SDK to have a token before it makes the call, so the cookie is there to send. With no SDK on the page it doesn't wait at all, and if the SDK hasn't got a token after 5 seconds it makes the call anyway.
+
+This only works when the cookie reaches `accounts.nice.org.uk`:
+
+- The page has to be on `nice.org.uk`. A browser won't send a cookie from one domain to another, so services on other domains, and sandbox on `sandbox1-ds.net`, call NICE Accounts without a token.
+- The cookie has to be set on `.nice.org.uk` and not on the exact hostname. The shipped entries do that with `cookieDomains`. An [`awsWafScriptURL`](#headerawswafscripturl) override doesn't, so set `window.awsWafCookieDomainList = ['.nice.org.uk']` on the page before Global Nav loads.
+- `.nice.org.uk` has to be on the token domain list of both web ACLs: the one in front of the page and the one in front of NICE Accounts.
+
+#### Content Security Policy
+
+If your service sets a Content Security Policy then `script-src` and `connect-src` need to allow `https://*.awswaf.com`.
+
 ## Deployments
 
 We create 2 deployment artifacts: one for deploying to the CDN and one test site for previewing the header and footer.

package/lib/Footer/Footer.js

@@ -14,10 +14,14 @@ var _Pages = _interopRequireDefault(require("./Pages"));
 var _FooterModule = _interopRequireDefault(require("./Footer.module.scss"));
 var _TrackedLink = _interopRequireDefault(require("../TrackedLink"));
 var _tracker = require("../tracker");
+var _propTypes2 = require("../aws-waf/propTypes");
+var _useAwsWafChallenge = require("../hooks/useAwsWafChallenge");
 var _jsxRuntime = require("react/jsx-runtime");
 //TODO add string type for service prop
 const Footer = _ref => {
-  let service = _ref.service;
+  let service = _ref.service,
+    awsWafScriptURL = _ref.awsWafScriptURL;
+  (0, _useAwsWafChallenge.useAwsWafChallenge)(awsWafScriptURL);
   return /*#__PURE__*/(0, _jsxRuntime.jsxs)("footer", {
     className: _FooterModule.default.footer,
     "data-tracking": "Global footer",
@@ -39,6 +43,7 @@ const Footer = _ref => {
   });
 };
 Footer.propTypes = {
-  service: _propTypes.default.string
+  service: _propTypes.default.string,
+  awsWafScriptURL: _propTypes2.awsWafScriptURLPropType
 };
 var _default = exports.default = Footer;

package/lib/Header/Account/nice-accounts.js

@@ -4,11 +4,20 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.getDomainBaseUrl = exports.checkIsLoggedIn = void 0;
+var _awsWaf = require("../../aws-waf");
 // Checks if you are logged in via NICE Accounts
 // Returns a promise that resolves with the data from NICE Accounts.
 // Returns a promise that rejects if the data could not be loaded.
 
 const checkIsLoggedIn = function (environment) {
+  // NICE Accounts sits behind an AWS WAF web ACL. A script tag can't send the token as a header,
+  // so wait for the SDK to set the token cookie, which the browser then sends along by itself
+  return (0, _awsWaf.whenAwsWafTokenReady)().then(function () {
+    return loadAccountsData(environment);
+  });
+};
+exports.checkIsLoggedIn = checkIsLoggedIn;
+const loadAccountsData = function (environment) {
   return new Promise(function (resolve, reject) {
     const url = getDomainBaseUrl(environment) + "tophat";
     var body = document.body;
@@ -30,7 +39,6 @@ const checkIsLoggedIn = function (environment) {
     body.insertBefore(script, body.firstChild);
   });
 };
-exports.checkIsLoggedIn = checkIsLoggedIn;
 const getDomainBaseUrl = function (environment) {
   return "https://".concat(environment !== "live" ? environment + "-" : "", "accounts.nice.org.uk/");
 };

package/lib/Header/Header.js

@@ -17,6 +17,8 @@ var _Search = _interopRequireDefault(require("./Search"));
 var _Account = _interopRequireDefault(require("./Account"));
 var _SkipLink = _interopRequireDefault(require("./SkipLink"));
 var _utils = require("../utils");
+var _propTypes2 = require("../aws-waf/propTypes");
+var _useAwsWafChallenge = require("../hooks/useAwsWafChallenge");
 var _HeaderModule = _interopRequireDefault(require("./Header.module.scss"));
 var _HeaderContext = require("./context/HeaderContext");
 var _jsxRuntime = require("react/jsx-runtime");
@@ -38,7 +40,8 @@ const Header = _ref => {
     _ref$additionalSubMen = _ref.additionalSubMenuItems,
     additionalSubMenuItems = _ref$additionalSubMen === void 0 ? [] : _ref$additionalSubMen,
     onDropdownOpen = _ref.onDropdownOpen,
-    onDropdownClose = _ref.onDropdownClose;
+    onDropdownClose = _ref.onDropdownClose,
+    awsWafScriptURL = _ref.awsWafScriptURL;
   const _useState = (0, _react.useState)(false),
     _useState2 = (0, _slicedToArray2.default)(_useState, 2),
     isExpanded = _useState2[0],
@@ -51,6 +54,7 @@ const Header = _ref => {
     _useState6 = (0, _slicedToArray2.default)(_useState5, 2),
     accountsData = _useState6[0],
     setAccountsData = _useState6[1];
+  (0, _useAwsWafChallenge.useAwsWafChallenge)(awsWafScriptURL);
   (0, _react.useEffect)(() => {
     if (!document.getElementById(skipLinkId)) {
       const firstH1OnPage = document.getElementsByTagName("h1")[0];
@@ -356,7 +360,8 @@ Header.propTypes = {
   onDropdownClose: _propTypes.default.oneOfType([_propTypes.default.func, _propTypes.default.string]),
   onRendered: _propTypes.default.func,
   additionalSubMenuItems: _propTypes.default.arrayOf(_propTypes.default.object),
-  renderSearchOnly: _propTypes.default.bool
+  renderSearchOnly: _propTypes.default.bool,
+  awsWafScriptURL: _propTypes2.awsWafScriptURLPropType
 };
 OldHeader.propTypes = {
   service: _propTypes.default.string,

package/lib/Main/Main.js

@@ -12,8 +12,10 @@ var _BackToTop = require("./BackToTop/BackToTop");
 var _propTypes = _interopRequireDefault(require("prop-types"));
 var _classnames = _interopRequireDefault(require("classnames"));
 var _MainModule = _interopRequireDefault(require("./Main.module.scss"));
+var _propTypes2 = require("../aws-waf/propTypes");
+var _useAwsWafChallenge = require("../hooks/useAwsWafChallenge");
 var _jsxRuntime = require("react/jsx-runtime");
-const _excluded = ["children", "className", "withPadding"];
+const _excluded = ["children", "className", "withPadding", "awsWafScriptURL"];
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { (0, _defineProperty2.default)(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function Main(props) {
@@ -21,7 +23,9 @@ function Main(props) {
     className = props.className,
     _props$withPadding = props.withPadding,
     withPadding = _props$withPadding === void 0 ? true : _props$withPadding,
+    awsWafScriptURL = props.awsWafScriptURL,
     rest = (0, _objectWithoutProperties2.default)(props, _excluded);
+  (0, _useAwsWafChallenge.useAwsWafChallenge)(awsWafScriptURL);
   return /*#__PURE__*/(0, _jsxRuntime.jsxs)("main", _objectSpread(_objectSpread({
     className: (0, _classnames.default)([_MainModule.default.main, className], withPadding && _MainModule.default.withPadding)
   }, rest), {}, {
@@ -31,6 +35,7 @@ function Main(props) {
 Main.propTypes = {
   children: _propTypes.default.oneOfType([_propTypes.default.arrayOf(_propTypes.default.node), _propTypes.default.node]).isRequired,
   className: _propTypes.default.string,
-  withPadding: _propTypes.default.bool
+  withPadding: _propTypes.default.bool,
+  awsWafScriptURL: _propTypes2.awsWafScriptURLPropType
 };
 var _default = exports.default = Main;

package/lib/aws-waf/index.js

@@ -0,0 +1,117 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.whenAwsWafTokenReady = exports.scriptId = exports.loadAwsWafChallenge = exports.getIntegration = void 0;
+var _integrations = require("./integrations");
+/** The id of the script tag we add, so we can tell whether we've already added it */
+const scriptId = exports.scriptId = "global-nav-aws-waf";
+
+// Passing `false` switches the integration off for the rest of the page's life, whichever of the
+// header, footer or main asks next
+let isDisabled = false;
+
+/**
+ * Finds the web ACL integration for the given hostname, if we know of one
+ *
+ * @param {string} hostname
+ * @returns {object | undefined}
+ */
+const getIntegration = function (hostname) {
+  return _integrations.integrations.find(_ref => {
+    let hosts = _ref.hosts;
+    return hosts.indexOf(hostname) > -1;
+  });
+};
+
+// How long a caller of `whenAwsWafTokenReady` is held up before it goes ahead without a token
+exports.getIntegration = getIntegration;
+const tokenTimeout = 5000;
+
+// The SDK's script tag, whether we added it or the host page loads it for itself
+const findSdkScript = function () {
+  return document.getElementById(scriptId) || document.querySelector("script[src*='.awswaf.com/']");
+};
+
+// Either the SDK has already run, we've already added it, or the host page loads it for itself
+const isAlreadyOnPage = function () {
+  return !!(window.AwsWafIntegration || findSdkScript());
+};
+const getToken = function () {
+  const sdk = window.AwsWafIntegration;
+  return sdk && typeof sdk.getToken === "function" ? sdk.getToken() : undefined;
+};
+
+/**
+ * Loads the AWS WAF JavaScript SDK, which silently acquires an `aws-waf-token` cookie in the
+ * background. The web ACL in front of a service checks for that token, so real users with a token
+ * never meet a challenge interstitial. It's the web ACL that keeps bots out, not this script.
+ *
+ * Safe to call as many times as you like: the script is only ever added once. It's called from the
+ * CDN entry point and from the header, footer and main, because no single one of those is on every
+ * page of every service.
+ *
+ * @param {string | false} [scriptURL] An integration URL to use instead of looking one up from the
+ * 	hostname, or `false` to not load the SDK at all
+ * @returns {boolean} Whether the script was added by this call
+ */
+const loadAwsWafChallenge = function (scriptURL) {
+  if (scriptURL === false) isDisabled = true;
+  if (isDisabled || isAlreadyOnPage()) return false;
+  const integration = scriptURL ? {
+    scriptURL
+  } : getIntegration(window.location.hostname);
+
+  // A listed hostname whose web ACL doesn't exist yet has an empty URL: nothing to load
+  if (!integration || !integration.scriptURL) return false;
+
+  // The SDK reads this as it loads, so it has to be in place first. Leave it be if the host
+  // page has already set its own
+  if (integration.cookieDomains && !window.awsWafCookieDomainList) {
+    window.awsWafCookieDomainList = integration.cookieDomains;
+  }
+  const script = document.createElement("script");
+  script.id = scriptId;
+  script.src = integration.scriptURL;
+  script.async = true;
+  document.head.appendChild(script);
+  return true;
+};
+
+/**
+ * Waits for the SDK to hold a token, so that a request made straight afterwards carries the
+ * `aws-waf-token` cookie. For requests to another service behind a web ACL that can't go through
+ * the SDK's own `fetch`, e.g. the NICE Accounts script tag.
+ *
+ * The promise always resolves and never rejects: straight away when there's no SDK on the page, and
+ * after the timeout if the SDK can't get a token. The caller's request goes ahead either way, and
+ * it's for the web ACL to decide what to do with one that has no token.
+ *
+ * @param {number} [timeout] The longest to wait, in milliseconds
+ * @returns {Promise<void>}
+ */
+exports.loadAwsWafChallenge = loadAwsWafChallenge;
+const whenAwsWafTokenReady = function () {
+  let timeout = arguments.length > 0 && arguments[0] !== undefined ? arguments[0] : tokenTimeout;
+  return new Promise(function (resolve) {
+    const timer = setTimeout(resolve, timeout),
+      done = function () {
+        clearTimeout(timer);
+        resolve();
+      };
+
+    // Look for the SDK on the next tick, not now. A child's effects run before its parent's, so
+    // when the account menu asks, the header hasn't added the script yet
+    Promise.resolve().then(function () {
+      if (window.AwsWafIntegration) return getToken();
+      const script = findSdkScript();
+      if (!script) return;
+      return new Promise(function (loaded) {
+        script.addEventListener("load", loaded);
+        script.addEventListener("error", loaded);
+      }).then(getToken);
+    }).then(done, done);
+  });
+};
+exports.whenAwsWafTokenReady = whenAwsWafTokenReady;

package/lib/aws-waf/integrations.js

@@ -0,0 +1,128 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.integrations = void 0;
+/**
+ * The AWS WAF web ACLs that protect NICE services, and the hostnames each one sits in front of.
+ *
+ * A web ACL issues its own integration URL for the AWS WAF JavaScript SDK, and that URL can't be
+ * worked out from the hostname: the ids in it are generated by AWS. So this is a lookup table, with
+ * one entry per web ACL rather than one per hostname. Hostnames that share a load balancer (or
+ * CloudFront distribution) share a web ACL, and so share an entry.
+ *
+ * Each entry is:
+ * - `hosts` - the exact hostnames served from behind the web ACL, e.g. `["www.nice.org.uk"]`. No
+ *   wildcards, so list every hostname.
+ * - `scriptURL` - the integration URL from 'Application integration' in the AWS WAF console. Ops are
+ *   issuing the 'Intelligent threat integration' one, which ends in `challenge.js`, e.g.
+ *   `https://<id>.eu-west-1.sdk.awswaf.com/<id>/<id>/challenge.js`. The 'CAPTCHA integration' one
+ *   ends in `jsapi.js` and would work just the same; both put `AwsWafIntegration` on `window`.
+ *   Leave it empty and the entry does nothing, so hostnames can be listed before their web ACL exists.
+ * - `cookieDomains` - optional, e.g. `[".nice.org.uk"]`. Widens the `aws-waf-token` cookie from the
+ *   exact host so one token works across subdomains. Only set this once the same domain is on the
+ *   web ACL's token domain list, otherwise AWS rejects every token we ask it for.
+ *
+ * A hostname that isn't listed gets no script, which is what we want for localhost and for any
+ * environment with no web ACL in front of it.
+ *
+ * ! The hostnames below were grouped by which ones resolved to the same address in DNS on
+ * ! 2026-10-01, on the basis that a shared address means a shared load balancer. That's a starting
+ * ! point, not the truth: confirm the grouping with ops when they hand over each script URL, and
+ * ! merge or split entries to match the web ACLs they actually create. Every URL is empty until then.
+ *
+ * @see https://docs.aws.amazon.com/waf/latest/developerguide/waf-js-challenge-api.html
+ */
+
+const cookieDomains = [".nice.org.uk"];
+const integrations = exports.integrations = [
+// web ACL sandbox (nextweb-sandbox1).
+{
+  hosts: ["nextweb.sandbox1-ds.net"],
+  scriptURL: "https://e92f72f6da93.eu-west-1.sdk.awswaf.com/e92f72f6da93/6169085d0d0b/challenge.js",
+  cookieDomains: [".sandbox1-ds.net"]
+},
+// Live. Main site's load balancer fronts next-web, guidance-web, consultations and the
+// niceorg backend, so they're all covered by this one entry. The bare nice.org.uk redirects to
+// www and is served from a different address, so it's left out: no page ever renders there.
+{
+  hosts: ["www.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["bnf.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["bnfc.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["cks.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["indev.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+},
+// Alpha
+{
+  hosts: ["alpha.nice.org.uk", "alpha-indev.nice.org.uk", "alpha-monitoring.nice.org.uk", "alpha-publications.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+},
+// Beta
+{
+  hosts: ["beta.nice.org.uk", "beta-monitoring.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["beta-indev.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["beta-publications.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["beta-bnf.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["beta-bnfc.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["beta-cks.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+},
+// Test and dev. The main site, indev and publications on test resolve to the same address as
+// the main site and indev on dev, so they look to share one load balancer
+{
+  hosts: ["test.nice.org.uk", "test-indev.nice.org.uk", "test-publications.nice.org.uk", "dev.nice.org.uk", "dev-indev.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["test-monitoring.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["dev-monitoring.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["test-bnf.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["test-bnfc.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}, {
+  hosts: ["test-cks.nice.org.uk"],
+  scriptURL: "",
+  cookieDomains
+}];

package/lib/aws-waf/propTypes.js

@@ -0,0 +1,20 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.awsWafScriptURLPropType = void 0;
+/**
+ * PropTypes validator for `awsWafScriptURL`: a script URL, `false` to switch the challenge off, or
+ * left out. Not `PropTypes.bool`, because `true` has no meaning and would be loaded as the URL `/true`
+ *
+ * @see loadAwsWafChallenge
+ */
+const awsWafScriptURLPropType = function (props, propName, componentName) {
+  const value = props[propName];
+  if (value === undefined || value === false || typeof value === "string") {
+    return null;
+  }
+  return new Error("Invalid prop `".concat(propName, "` of value `").concat(value, "` supplied to `").concat(componentName, "`, expected a string, `false` or `undefined`."));
+};
+exports.awsWafScriptURLPropType = awsWafScriptURLPropType;

package/lib/hooks/useAwsWafChallenge.js

@@ -0,0 +1,19 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.useAwsWafChallenge = void 0;
+var _react = require("react");
+var _awsWaf = require("../aws-waf");
+/**
+ * Loads the AWS WAF JavaScript SDK once the component has mounted, so never on the server.
+ *
+ * @param {string | false} [scriptURL] See `loadAwsWafChallenge`
+ */
+const useAwsWafChallenge = scriptURL => {
+  (0, _react.useEffect)(() => {
+    (0, _awsWaf.loadAwsWafChallenge)(scriptURL);
+  }, [scriptURL]);
+};
+exports.useAwsWafChallenge = useAwsWafChallenge;

package/lib/renderer.js

@@ -4,11 +4,12 @@ var _interopRequireDefault = require("@babel/runtime/helpers/interopRequireDefau
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.renderHeader = exports.renderFooter = exports.headerId = exports.footerId = void 0;
+exports.renderHeader = exports.renderFooter = exports.loadAwsWaf = exports.headerId = exports.footerId = void 0;
 var _defineProperty2 = _interopRequireDefault(require("@babel/runtime/helpers/defineProperty"));
 var _client = require("react-dom/client");
 var _Header = _interopRequireDefault(require("./Header"));
 var _Footer = _interopRequireDefault(require("./Footer"));
+var _awsWaf = require("./aws-waf");
 var _jsxRuntime = require("react/jsx-runtime");
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { (0, _defineProperty2.default)(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
@@ -31,6 +32,13 @@ const ensureCallback = function (callback) {
   }
   return null;
 };
+
+// Load here, because header and footer can be switched off in config and the challenge would not then happen
+const loadAwsWaf = function () {
+  const config = window.global_nav_config || {};
+  return (0, _awsWaf.loadAwsWafChallenge)(config.awsWafScriptURL);
+};
+exports.loadAwsWaf = loadAwsWaf;
 const renderHeader = function () {
   const config = window.global_nav_config || {};
   if (config.header !== false) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nice-digital/global-nav",
-  "version": "7.1.1187",
+  "version": "7.1.1189-GN-264-load-aws-chal",
   "description": "Global header and footer components for NICE digital services",
   "main": "lib/index.js",
   "types": "./types.d.ts",

package/types.d.ts

@@ -66,8 +66,16 @@ declare module "@nice-digital/global-nav" {
 		links: Array<Link>;
 	};
 
+	/**
+	 * The header, footer and main each load the AWS WAF JavaScript SDK if the page's hostname is
+	 * behind a web ACL that Global Nav knows about. Pass an integration URL to use that instead,
+	 * or `false` to not load the SDK at all e.g. because your app loads it for itself.
+	 */
+	export type AwsWafScriptURL = string | false;
+
 	export type HeaderProps = {
 		service?: Service;
+		awsWafScriptURL?: AwsWafScriptURL;
 		skipLinkId?: string;
 		search?: false | SearchProps;
 		auth?: NiceAccountsProviderProps | IdamProviderProps | false;
@@ -80,6 +88,7 @@ declare module "@nice-digital/global-nav" {
 
 	export type FooterProps = {
 		service?: Service;
+		awsWafScriptURL?: AwsWafScriptURL;
 	};
 
 	export interface MainProps {
@@ -90,6 +99,7 @@ declare module "@nice-digital/global-nav" {
 		/** Additional classnames for the main element. */
 		className?: string;
 		withPadding?: boolean;
+		awsWafScriptURL?: AwsWafScriptURL;
 	}
 
 	const Header: React.FC<HeaderProps>;