@prosopo/provider 4.15.13 → 4.15.15

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasksUtils.cjs

@@ -1,7 +1,10 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const validatePuzzleSolution = (finalX, finalY, targetX, targetY, tolerance) => {
-  const distance = Math.sqrt((finalX - targetX) ** 2 + (finalY - targetY) ** 2);
-  return distance <= tolerance;
+//#region src/tasks/puzzleCaptcha/puzzleTasksUtils.ts
+/**
+* Validate that the puzzle solution is within tolerance of the target.
+* Uses Euclidean distance.
+*/
+var validatePuzzleSolution = (finalX, finalY, targetX, targetY, tolerance) => {
+	return Math.sqrt((finalX - targetX) ** 2 + (finalY - targetY) ** 2) <= tolerance;
 };
+//#endregion
 exports.validatePuzzleSolution = validatePuzzleSolution;

package/dist/cjs/tasks/spam/checkSpamEmail.cjs

@@ -1,146 +1,138 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const util = require("@prosopo/util");
-const dns = require("../../utils/dns.cjs");
+const require_dns = require("../../utils/dns.cjs");
+let _prosopo_util = require("@prosopo/util");
+//#region src/tasks/spam/checkSpamEmail.ts
+/**
+* Extracts the domain from a URL or returns the input if it's already a domain
+*/
 function extractDomain(urlOrDomain) {
-  try {
-    const url = new URL(
-      urlOrDomain.startsWith("http") ? urlOrDomain : `https://${urlOrDomain}`
-    );
-    return url.hostname;
-  } catch {
-    return urlOrDomain;
-  }
+	try {
+		return new URL(urlOrDomain.startsWith("http") ? urlOrDomain : `https://${urlOrDomain}`).hostname;
+	} catch {
+		return urlOrDomain;
+	}
 }
+/**
+* Checks if an email domain is spam by checking against a spam list,
+* performing DNS/redirect/TLS-related checks.
+*/
 async function checkSpamEmail(email, db, config, logger) {
-  const normalizedDomain = util.extractDomainFromEmail(email);
-  if (!normalizedDomain) {
-    return true;
-  }
-  try {
-    const record = await db.getSpamEmailDomain(normalizedDomain);
-    if (record !== null && record !== void 0) {
-      return true;
-    }
-  } catch (error) {
-    logger.warn(() => ({
-      msg: "Failed to check spam email domain",
-      error
-    }));
-    return false;
-  }
-  const domainValidation = util.validateDomainForOutboundRequest(normalizedDomain);
-  if (!domainValidation.isValid) {
-    logger.warn(() => ({
-      msg: "Email domain failed SSRF validation, rejecting",
-      domain: normalizedDomain,
-      reason: domainValidation.reason
-    }));
-    return true;
-  }
-  let dnsCheckResult = null;
-  try {
-    dnsCheckResult = await dns.runDnsChecks(normalizedDomain, {
-      dnsServers: config?.dnsServers
-    });
-  } catch (error) {
-    logger.warn(() => ({
-      msg: "Failed to run DNS checks",
-      error,
-      domain: normalizedDomain
-    }));
-    return false;
-  }
-  if (dnsCheckResult.redirectResult.tlsError) {
-    logger.info(() => ({
-      msg: "Email domain apex has TLS error — observed, not treated as spam",
-      domain: normalizedDomain
-    }));
-  }
-  if (dnsCheckResult.redirectResult.redirectUrl) {
-    const redirectUrl = dnsCheckResult.redirectResult.redirectUrl;
-    const redirectDomain = extractDomain(redirectUrl).toLowerCase().trim();
-    logger.info(() => ({
-      msg: "Email domain has HTTP redirect",
-      domain: normalizedDomain,
-      redirectDomain
-    }));
-    try {
-      const record = await db.getSpamEmailDomain(redirectDomain);
-      if (record !== null && record !== void 0) {
-        return true;
-      }
-    } catch (error) {
-      logger.warn(() => ({
-        msg: "Failed to check spam email domain for redirect",
-        error,
-        redirectDomain
-      }));
-      return false;
-    }
-  } else if (dnsCheckResult.cnameResult && dnsCheckResult.cnameResult.length > 0) {
-    const firstCname = dnsCheckResult.cnameResult[0];
-    if (!firstCname) {
-      logger.warn(() => ({
-        msg: "CNAME result array has undefined element",
-        domain: normalizedDomain
-      }));
-      return false;
-    }
-    const cnameDomain = firstCname.replace(/\.$/, "").toLowerCase().trim();
-    logger.info(() => ({
-      msg: "Email domain has CNAME",
-      domain: normalizedDomain,
-      cnameDomain
-    }));
-    try {
-      const record = await db.getSpamEmailDomain(cnameDomain);
-      if (record !== null && record !== void 0) {
-        return true;
-      }
-    } catch (error) {
-      logger.warn(() => ({
-        msg: "Failed to check spam email domain for CNAME",
-        error,
-        cnameDomain
-      }));
-      return false;
-    }
-  } else if (dnsCheckResult.mxRecordResult && dnsCheckResult.mxRecordResult.length > 0) {
-    const firstMxRecord = dnsCheckResult.mxRecordResult[0];
-    if (!firstMxRecord || !firstMxRecord.exchange) {
-      logger.warn(() => ({
-        msg: "MX record result array has undefined element or exchange",
-        domain: normalizedDomain
-      }));
-      return false;
-    }
-    const mxDomain = firstMxRecord.exchange.replace(/\.$/, "").toLowerCase().trim();
-    logger.info(() => ({
-      msg: "Email domain has MX record",
-      domain: normalizedDomain,
-      mxDomain,
-      priority: firstMxRecord.priority
-    }));
-    try {
-      const record = await db.getSpamEmailDomain(mxDomain);
-      if (record !== null && record !== void 0) {
-        logger.warn(() => ({
-          msg: "Email domain MX record points to spam domain",
-          domain: normalizedDomain,
-          mxDomain
-        }));
-        return true;
-      }
-    } catch (error) {
-      logger.warn(() => ({
-        msg: "Failed to check spam email domain for MX record",
-        error,
-        mxDomain
-      }));
-      return false;
-    }
-  }
-  return false;
+	const normalizedDomain = (0, _prosopo_util.extractDomainFromEmail)(email);
+	if (!normalizedDomain) return true;
+	try {
+		const record = await db.getSpamEmailDomain(normalizedDomain);
+		if (record !== null && record !== void 0) return true;
+	} catch (error) {
+		logger.warn(() => ({
+			msg: "Failed to check spam email domain",
+			error
+		}));
+		return false;
+	}
+	const domainValidation = (0, _prosopo_util.validateDomainForOutboundRequest)(normalizedDomain);
+	if (!domainValidation.isValid) {
+		logger.warn(() => ({
+			msg: "Email domain failed SSRF validation, rejecting",
+			domain: normalizedDomain,
+			reason: domainValidation.reason
+		}));
+		return true;
+	}
+	let dnsCheckResult = null;
+	try {
+		dnsCheckResult = await require_dns.runDnsChecks(normalizedDomain, { dnsServers: config?.dnsServers });
+	} catch (error) {
+		logger.warn(() => ({
+			msg: "Failed to run DNS checks",
+			error,
+			domain: normalizedDomain
+		}));
+		return false;
+	}
+	if (dnsCheckResult.redirectResult.tlsError) logger.info(() => ({
+		msg: "Email domain apex has TLS error — observed, not treated as spam",
+		domain: normalizedDomain
+	}));
+	if (dnsCheckResult.redirectResult.redirectUrl) {
+		const redirectUrl = dnsCheckResult.redirectResult.redirectUrl;
+		const redirectDomain = extractDomain(redirectUrl).toLowerCase().trim();
+		logger.info(() => ({
+			msg: "Email domain has HTTP redirect",
+			domain: normalizedDomain,
+			redirectDomain
+		}));
+		try {
+			const record = await db.getSpamEmailDomain(redirectDomain);
+			if (record !== null && record !== void 0) return true;
+		} catch (error) {
+			logger.warn(() => ({
+				msg: "Failed to check spam email domain for redirect",
+				error,
+				redirectDomain
+			}));
+			return false;
+		}
+	} else if (dnsCheckResult.cnameResult && dnsCheckResult.cnameResult.length > 0) {
+		const firstCname = dnsCheckResult.cnameResult[0];
+		if (!firstCname) {
+			logger.warn(() => ({
+				msg: "CNAME result array has undefined element",
+				domain: normalizedDomain
+			}));
+			return false;
+		}
+		const cnameDomain = firstCname.replace(/\.$/, "").toLowerCase().trim();
+		logger.info(() => ({
+			msg: "Email domain has CNAME",
+			domain: normalizedDomain,
+			cnameDomain
+		}));
+		try {
+			const record = await db.getSpamEmailDomain(cnameDomain);
+			if (record !== null && record !== void 0) return true;
+		} catch (error) {
+			logger.warn(() => ({
+				msg: "Failed to check spam email domain for CNAME",
+				error,
+				cnameDomain
+			}));
+			return false;
+		}
+	} else if (dnsCheckResult.mxRecordResult && dnsCheckResult.mxRecordResult.length > 0) {
+		const firstMxRecord = dnsCheckResult.mxRecordResult[0];
+		if (!firstMxRecord || !firstMxRecord.exchange) {
+			logger.warn(() => ({
+				msg: "MX record result array has undefined element or exchange",
+				domain: normalizedDomain
+			}));
+			return false;
+		}
+		const mxDomain = firstMxRecord.exchange.replace(/\.$/, "").toLowerCase().trim();
+		logger.info(() => ({
+			msg: "Email domain has MX record",
+			domain: normalizedDomain,
+			mxDomain,
+			priority: firstMxRecord.priority
+		}));
+		try {
+			const record = await db.getSpamEmailDomain(mxDomain);
+			if (record !== null && record !== void 0) {
+				logger.warn(() => ({
+					msg: "Email domain MX record points to spam domain",
+					domain: normalizedDomain,
+					mxDomain
+				}));
+				return true;
+			}
+		} catch (error) {
+			logger.warn(() => ({
+				msg: "Failed to check spam email domain for MX record",
+				error,
+				mxDomain
+			}));
+			return false;
+		}
+	}
+	return false;
 }
+//#endregion
 exports.checkSpamEmail = checkSpamEmail;

package/dist/cjs/tasks/spam/checkTrafficFilter.cjs

@@ -1,81 +1,123 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const types = require("@prosopo/types");
-const isDatacenterAllowlisted = (ipInfo, allowlist) => {
-  if (!allowlist || allowlist.length === 0) {
-    return false;
-  }
-  const candidates = [];
-  for (const value of [
-    ipInfo.datacenterName,
-    ipInfo.providerName,
-    ipInfo.asnOrganization
-  ]) {
-    if (typeof value !== "string") continue;
-    const trimmed = value.trim().toLowerCase();
-    if (trimmed) candidates.push(trimmed);
-  }
-  if (candidates.length === 0) {
-    return false;
-  }
-  const normalisedAllowlist = allowlist.map(
-    (entry) => entry.trim().toLowerCase()
-  );
-  return candidates.some((c) => normalisedAllowlist.includes(c));
+let _prosopo_types = require("@prosopo/types");
+//#region src/tasks/spam/checkTrafficFilter.ts
+var matchesDatacenterNameList = (ipInfo, list) => {
+	if (!list || list.length === 0) return false;
+	const candidates = [];
+	for (const value of [
+		ipInfo.datacenterName,
+		ipInfo.providerName,
+		ipInfo.asnOrganization
+	]) {
+		if (typeof value !== "string") continue;
+		const trimmed = value.trim().toLowerCase();
+		if (trimmed) candidates.push(trimmed);
+	}
+	if (candidates.length === 0) return false;
+	const normalisedList = list.map((entry) => entry.trim().toLowerCase());
+	return candidates.some((c) => normalisedList.includes(c));
 };
-const evaluateIpInfo = (ipInfo, trafficFilter, isDnsExtra = false) => {
-  if (!ipInfo || !ipInfo.isValid) {
-    return { isBlocked: false };
-  }
-  if (trafficFilter.blockVpn && ipInfo.isVPN) {
-    return { isBlocked: true, reason: types.ResultReason.VPN_BLOCKED };
-  }
-  if (trafficFilter.blockProxy && ipInfo.isProxy) {
-    return { isBlocked: true, reason: types.ResultReason.PROXY_BLOCKED };
-  }
-  if (trafficFilter.blockTor && ipInfo.isTor) {
-    return { isBlocked: true, reason: types.ResultReason.TOR_BLOCKED };
-  }
-  if ((trafficFilter.blockAbuser ?? true) && ipInfo.isAbuser) {
-    const threshold = trafficFilter.abuserScoreThreshold ?? types.trafficFilterAbuserScoreThresholdDefault;
-    const maxScore = Math.max(
-      ipInfo.abuserScore ?? 0,
-      ipInfo.companyAbuserScore ?? 0
-    );
-    if (maxScore >= threshold) {
-      return { isBlocked: true, reason: types.ResultReason.ABUSER_BLOCKED };
-    }
-  }
-  const datacenterSuppressedByCategory = ipInfo.isVPN && !trafficFilter.blockVpn || ipInfo.isProxy && !trafficFilter.blockProxy || ipInfo.isTor && !trafficFilter.blockTor || ipInfo.isCrawler && !trafficFilter.blockCrawler;
-  if (trafficFilter.blockDatacenter && ipInfo.isDatacenter && ipInfo.providerType !== "isp" && !datacenterSuppressedByCategory && !isDatacenterAllowlisted(ipInfo, trafficFilter.datacenterNameAllowlist)) {
-    return { isBlocked: true, reason: types.ResultReason.DATACENTER_BLOCKED };
-  }
-  if (trafficFilter.blockMobile && ipInfo.isMobile) {
-    return { isBlocked: true, reason: types.ResultReason.MOBILE_BLOCKED };
-  }
-  if (trafficFilter.blockSatellite && ipInfo.isSatellite) {
-    return { isBlocked: true, reason: types.ResultReason.SATELLITE_BLOCKED };
-  }
-  if (!isDnsExtra && trafficFilter.blockCrawler && ipInfo.isCrawler) {
-    return { isBlocked: true, reason: types.ResultReason.CRAWLER_BLOCKED };
-  }
-  return { isBlocked: false };
+var isDatacenterAllowlisted = (ipInfo, allowlist) => matchesDatacenterNameList(ipInfo, allowlist);
+var isDatacenterDenylisted = (ipInfo, denylist) => matchesDatacenterNameList(ipInfo, denylist);
+var evaluateIpInfo = (ipInfo, trafficFilter, isDnsExtra = false) => {
+	if (!ipInfo || !ipInfo.isValid) return { isBlocked: false };
+	if (trafficFilter.blockVpn && ipInfo.isVPN) return {
+		isBlocked: true,
+		reason: _prosopo_types.ResultReason.VPN_BLOCKED
+	};
+	if (trafficFilter.blockProxy && ipInfo.isProxy) return {
+		isBlocked: true,
+		reason: _prosopo_types.ResultReason.PROXY_BLOCKED
+	};
+	if (trafficFilter.blockTor && ipInfo.isTor) return {
+		isBlocked: true,
+		reason: _prosopo_types.ResultReason.TOR_BLOCKED
+	};
+	if ((trafficFilter.blockAbuser ?? true) && ipInfo.isAbuser) {
+		const threshold = trafficFilter.abuserScoreThreshold ?? _prosopo_types.trafficFilterAbuserScoreThresholdDefault;
+		if (Math.max(ipInfo.abuserScore ?? 0, ipInfo.companyAbuserScore ?? 0) >= threshold) return {
+			isBlocked: true,
+			reason: _prosopo_types.ResultReason.ABUSER_BLOCKED
+		};
+	}
+	const datacenterSuppressedByCategory = ipInfo.isVPN && !trafficFilter.blockVpn || ipInfo.isProxy && !trafficFilter.blockProxy || ipInfo.isTor && !trafficFilter.blockTor || ipInfo.isCrawler && !trafficFilter.blockCrawler;
+	if (trafficFilter.blockDatacenter && ipInfo.isDatacenter) {
+		if (isDatacenterDenylisted(ipInfo, trafficFilter.datacenterNameDenylist)) return {
+			isBlocked: true,
+			reason: _prosopo_types.ResultReason.DATACENTER_BLOCKED
+		};
+		if (ipInfo.providerType !== "isp" && !datacenterSuppressedByCategory && !isDatacenterAllowlisted(ipInfo, trafficFilter.datacenterNameAllowlist)) return {
+			isBlocked: true,
+			reason: _prosopo_types.ResultReason.DATACENTER_BLOCKED
+		};
+	}
+	if (trafficFilter.blockMobile && ipInfo.isMobile) return {
+		isBlocked: true,
+		reason: _prosopo_types.ResultReason.MOBILE_BLOCKED
+	};
+	if (trafficFilter.blockSatellite && ipInfo.isSatellite) return {
+		isBlocked: true,
+		reason: _prosopo_types.ResultReason.SATELLITE_BLOCKED
+	};
+	if (!isDnsExtra && trafficFilter.blockCrawler && ipInfo.isCrawler) return {
+		isBlocked: true,
+		reason: _prosopo_types.ResultReason.CRAWLER_BLOCKED
+	};
+	return { isBlocked: false };
 };
-const checkTrafficFilter = (ipInfo, trafficFilter, extraIpInfos, dnsPathValid) => {
-  const primary = evaluateIpInfo(ipInfo, trafficFilter);
-  if (primary.isBlocked) {
-    return primary;
-  }
-  if (trafficFilter.skipExtrasOnValidDnsPath && dnsPathValid === true) {
-    return { isBlocked: false };
-  }
-  for (const extra of extraIpInfos ?? []) {
-    const result = evaluateIpInfo(extra, trafficFilter, true);
-    if (result.isBlocked) {
-      return result;
-    }
-  }
-  return { isBlocked: false };
+/**
+* Checks whether a request should be blocked based on traffic filter
+* settings and the request's already-resolved IP info (attached to
+* `req.ipInfo` by `ipInfoMiddleware`). Each filter (VPN, proxy, Tor,
+* abuser, etc.) is evaluated independently. A missing or invalid
+* `ipInfo` falls back to "not blocked" so an outage in the upstream
+* service can't block all traffic.
+*
+* Cross-filter rule: the datacenter rule is suppressed when the IP
+* carries a more specific category the operator has left unblocked —
+* VPN, proxy, Tor, or crawler. All four legitimately sit on datacenter
+* infrastructure, so "block datacenters" (a scraping rule) shouldn't
+* catch them out the back door. Applies to primary and DNS extras.
+*
+* Extras-only rule: the crawler check is skipped on DNS extras. Public
+* DNS resolvers share IP space with search crawlers.
+*
+* The datacenter rule also honours `datacenterNameAllowlist`: consumer
+* relays route through datacenter ranges and are reported as
+* `is_datacenter=true` by upstream but the exiting users are real humans.
+* Operators can list the datacenter, provider, or ASN organisation names
+* they want to allow through — see `isDatacenterAllowlisted`.
+*
+* The datacenter rule also short-circuits when upstream classifies the
+* provider as an ISP (`providerType === "isp"`). Consumer ISPs like
+* Afrihost, Comcast, or BT are sometimes flagged `is_datacenter=true` by
+* upstream heuristics — usually because part of the ASN hosts B2B or
+* hosting services — but the eyeball ranges behind those ASNs carry
+* ordinary end-users. The ISP categorisation is stronger evidence of
+* consumer traffic than the datacenter boolean.
+*
+* The ISP short-circuit and the allowlist are both overridden by
+* `datacenterNameDenylist`: if the IP's `datacenterName`, `providerName`,
+* or `asnOrganization` matches a denylist entry, the block fires. This
+* lets operators opt named providers (for example IP-leasing platforms
+* whose ranges are announced from carrier ASNs but exit as proxy pools)
+* back into the datacenter rule.
+*
+* When `trafficFilter.skipExtrasOnValidDnsPath` is on and the catcher
+* confirmed the DNS path matched the connection path (`pathValid: true`),
+* the extras evaluation is skipped. This stops public-DoH resolver IPs
+* from tripping the datacenter rule for ordinary users.
+*/
+var checkTrafficFilter = (ipInfo, trafficFilter, extraIpInfos, dnsPathValid) => {
+	const primary = evaluateIpInfo(ipInfo, trafficFilter);
+	if (primary.isBlocked) return primary;
+	if (trafficFilter.skipExtrasOnValidDnsPath && dnsPathValid === true) return { isBlocked: false };
+	for (const extra of extraIpInfos ?? []) {
+		const result = evaluateIpInfo(extra, trafficFilter, true);
+		if (result.isBlocked) return result;
+	}
+	return { isBlocked: false };
 };
+//#endregion
 exports.checkTrafficFilter = checkTrafficFilter;
 exports.isDatacenterAllowlisted = isDatacenterAllowlisted;
+exports.isDatacenterDenylisted = isDatacenterDenylisted;