perimeterx-js-core 0.5.1 → 0.6.0

package/lib/phase/impl/SendAsyncActivitiesOnResponsePhase.d.ts

@@ -0,0 +1,9 @@
+import { IContext } from '../../context';
+import { IActivityClient } from '../../activities';
+import { IPhase } from '../IPhase';
+import { PhaseResult } from '../PhaseResult';
+export declare class SendAsyncActivitiesOnResponsePhase<Req, Res> implements IPhase<Req, Res> {
+    protected readonly activityClient: IActivityClient<Req, Res>;
+    constructor(activityClient: IActivityClient<Req, Res>);
+    execute(context: IContext<Req, Res>): Promise<PhaseResult>;
+}

package/lib/phase/impl/SendAsyncActivitiesOnResponsePhase.js

@@ -0,0 +1,20 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export class SendAsyncActivitiesOnResponsePhase {
+    constructor(activityClient) {
+        this.activityClient = activityClient;
+    }
+    execute(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.activityClient.sendActivities(context);
+            return { done: false };
+        });
+    }
+}

package/lib/phase/impl/TelemetryPhase.d.ts

@@ -0,0 +1,10 @@
+import { IPhase } from '../IPhase';
+import { PhaseResult } from '../PhaseResult';
+import { IContext } from '../../context';
+import { ITelemetry } from '../../telemetry';
+export declare class TelemetryPhase<Req, Res> implements IPhase<Req, Res> {
+    protected readonly telemetry: ITelemetry<Req, Res>;
+    constructor(telemetry: ITelemetry<Req, Res>);
+    execute(context: IContext<Req, Res>): Promise<PhaseResult>;
+    protected sendTelemetry(context: IContext<Req, Res>): Promise<void>;
+}

package/lib/phase/impl/TelemetryPhase.js

@@ -0,0 +1,29 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+export class TelemetryPhase {
+    constructor(telemetry) {
+        this.telemetry = telemetry;
+    }
+    execute(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (yield this.telemetry.isValidTelemetryRequest(context)) {
+                yield this.sendTelemetry(context);
+                return { done: true };
+            }
+            return { done: false };
+        });
+    }
+    // Note: If await is not necessary, can be overridden
+    sendTelemetry(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.telemetry.sendTelemetry(context);
+        });
+    }
+}

package/lib/phase/impl/index.d.ts

@@ -0,0 +1,16 @@
+export * from './FirstPartyPhase';
+export * from './FilterPhase';
+export * from './PreflightPhase';
+export * from './TelemetryPhase';
+export * from './EnrichContextFromRequestPhase';
+export * from './ParseTokenPhase';
+export * from './DecideActionPhase';
+export * from './RiskApiPhase';
+export * from './CreateBlockResponsePhase';
+export * from './ModifyIncomingRequestPhase';
+export * from './EnrichContextFromResponsePhase';
+export * from './ModifyOutgoingResponsePhase';
+export * from './SendAsyncActivitiesOnRequestPhase';
+export * from './SendAsyncActivitiesOnResponsePhase';
+export * from './AdditionalActivityHandlerPhase';
+export * from './CompositePhase';

package/lib/phase/impl/index.js

@@ -0,0 +1,16 @@
+export * from './FirstPartyPhase';
+export * from './FilterPhase';
+export * from './PreflightPhase';
+export * from './TelemetryPhase';
+export * from './EnrichContextFromRequestPhase';
+export * from './ParseTokenPhase';
+export * from './DecideActionPhase';
+export * from './RiskApiPhase';
+export * from './CreateBlockResponsePhase';
+export * from './ModifyIncomingRequestPhase';
+export * from './EnrichContextFromResponsePhase';
+export * from './ModifyOutgoingResponsePhase';
+export * from './SendAsyncActivitiesOnRequestPhase';
+export * from './SendAsyncActivitiesOnResponsePhase';
+export * from './AdditionalActivityHandlerPhase';
+export * from './CompositePhase';

package/lib/phase/index.d.ts

@@ -0,0 +1,4 @@
+export * from './IPhase';
+export * from './PhaseResult';
+export * from './impl';
+export * from './flow';

package/lib/phase/index.js

@@ -0,0 +1,4 @@
+export * from './IPhase';
+export * from './PhaseResult';
+export * from './impl';
+export * from './flow';

package/lib/products/account_defender/AccountDefender.d.ts

@@ -0,0 +1,23 @@
+import { DeepReadonly } from 'ts-essentials';
+import { ReadonlyContext, RequestData } from '../../context';
+import { IConfiguration } from '../../config';
+import { IBase64Utils } from '../../utils';
+import { IAccountDefender } from './IAccountDefender';
+import { AccountDefenderData } from './AccountDefenderData';
+import { JwtData } from './JwtData';
+export declare type AccountDefenderOptions = {
+    base64Utils: IBase64Utils;
+};
+export declare class AccountDefender<Req, Res> implements IAccountDefender<Req, Res> {
+    protected readonly config: IConfiguration<Req, Res>;
+    protected readonly base64Utils: IBase64Utils;
+    constructor(config: IConfiguration<Req, Res>, options: AccountDefenderOptions);
+    enrichContextFromRequest(context: ReadonlyContext<Req, Res>): Promise<AccountDefenderData>;
+    enrichContextFromRiskApi(context: ReadonlyContext<Req, Res>): Promise<AccountDefenderData>;
+    enrichContextFromResponse(context: ReadonlyContext<Req, Res>): Promise<AccountDefenderData>;
+    modifyIncomingRequest(context: ReadonlyContext<Req, Res>): Promise<void>;
+    modifyOutgoingResponse(context: ReadonlyContext<Req, Res>): Promise<void>;
+    protected getJwtData(requestData: DeepReadonly<RequestData<Req>>): JwtData | null;
+    protected extractJwtData(jwt: string, userIdFieldName: string, additionalFieldNames: string[]): JwtData | null;
+    protected getDecodedJwt(jwt: string): any | null;
+}

package/lib/products/account_defender/AccountDefender.js

@@ -0,0 +1,98 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { getPropertyFromObject } from '../../utils';
+import { CROSS_TAB_SESSION_COOKIE_NAME } from './constants';
+export class AccountDefender {
+    constructor(config, options) {
+        this.config = config;
+        this.base64Utils = options.base64Utils;
+    }
+    enrichContextFromRequest(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const crossTabSession = context.requestData.cookies[CROSS_TAB_SESSION_COOKIE_NAME];
+            const jwtData = this.getJwtData(context.requestData);
+            return Object.assign({ crossTabSession }, jwtData);
+        });
+    }
+    enrichContextFromRiskApi(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return;
+        });
+    }
+    enrichContextFromResponse(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return;
+        });
+    }
+    modifyIncomingRequest(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return;
+        });
+    }
+    modifyOutgoingResponse(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return;
+        });
+    }
+    getJwtData(requestData) {
+        var _a;
+        let jwtToken;
+        let userIdFieldName;
+        let additionalFieldNames;
+        if (this.config.jwtCookieName) {
+            jwtToken = requestData.cookies[this.config.jwtCookieName];
+            if (jwtToken) {
+                userIdFieldName = this.config.jwtCookieUserIdFieldName;
+                additionalFieldNames = this.config.jwtCookieAdditionalFieldNames;
+            }
+        }
+        if (!jwtToken && this.config.jwtHeaderName) {
+            jwtToken = (_a = requestData.headers[this.config.jwtHeaderName]) === null || _a === void 0 ? void 0 : _a[0];
+            if (jwtToken) {
+                userIdFieldName = this.config.jwtHeaderUserIdFieldName;
+                additionalFieldNames = this.config.jwtHeaderAdditionalFieldNames;
+            }
+        }
+        return jwtToken ? this.extractJwtData(jwtToken, userIdFieldName, additionalFieldNames) : null;
+    }
+    extractJwtData(jwt, userIdFieldName, additionalFieldNames) {
+        try {
+            const decodedJwt = this.getDecodedJwt(jwt);
+            if (decodedJwt) {
+                const appUserId = getPropertyFromObject(decodedJwt, ...userIdFieldName.split('.'));
+                const additionalFields = additionalFieldNames.reduce((matchedFields, fieldName) => {
+                    const fieldNameParts = fieldName.split('.');
+                    const value = getPropertyFromObject(decodedJwt, ...fieldNameParts);
+                    if (value) {
+                        matchedFields[fieldNameParts[fieldNameParts.length - 1]] = value;
+                    }
+                    return matchedFields;
+                }, {});
+                return { additionalFields, appUserId };
+            }
+        }
+        catch (e) {
+            this.config.logger.debug(`unable to get account defender JWT data: ${e}`);
+        }
+        return null;
+    }
+    getDecodedJwt(jwt) {
+        var _a;
+        try {
+            const encodedPayload = (_a = jwt.split('.')) === null || _a === void 0 ? void 0 : _a[1];
+            const base64 = encodedPayload.replace('-', '+').replace('_', '/');
+            return JSON.parse(this.base64Utils.base64Decode(base64));
+        }
+        catch (e) {
+            this.config.logger.debug(`unable to decode account defender jwt token: ${e}`);
+            return null;
+        }
+    }
+}

package/lib/products/account_defender/AccountDefenderData.d.ts

@@ -0,0 +1,6 @@
+import { ActionData } from '../../action';
+export declare type AccountDefenderData = Partial<ActionData> & {
+    appUserId?: string;
+    additionalFields?: Record<string, any>;
+    crossTabSession?: string;
+};

package/lib/products/account_defender/AccountDefenderData.js

@@ -0,0 +1 @@
+export {};

package/lib/products/account_defender/IAccountDefender.d.ts

@@ -0,0 +1,4 @@
+import { IProduct } from '../interfaces';
+import { ProductName } from '../utils';
+export interface IAccountDefender<Req, Res> extends IProduct<ProductName.ACCOUNT_DEFENDER, Req, Res> {
+}

package/lib/products/account_defender/IAccountDefender.js

@@ -0,0 +1 @@
+export {};

package/lib/products/account_defender/JwtData.d.ts

@@ -0,0 +1,4 @@
+export declare type JwtData = {
+    appUserId?: string;
+    additionalFields?: Record<string, any>;
+};

package/lib/products/account_defender/JwtData.js

@@ -0,0 +1 @@
+export {};

package/lib/products/account_defender/constants.d.ts

@@ -0,0 +1 @@
+export declare const CROSS_TAB_SESSION_COOKIE_NAME = "pxcts";

package/lib/products/account_defender/constants.js

@@ -0,0 +1 @@
+export const CROSS_TAB_SESSION_COOKIE_NAME = 'pxcts';

package/lib/products/account_defender/index.d.ts

@@ -0,0 +1,5 @@
+export * from './IAccountDefender';
+export * from './AccountDefender';
+export * from './AccountDefenderData';
+export * from './constants';
+export * from './JwtData';

package/lib/products/account_defender/index.js

@@ -0,0 +1,5 @@
+export * from './IAccountDefender';
+export * from './AccountDefender';
+export * from './AccountDefenderData';
+export * from './constants';
+export * from './JwtData';

package/lib/products/bot_defender/BotDefender.d.ts

@@ -0,0 +1,47 @@
+import { DeepReadonly } from 'ts-essentials';
+import { IConfiguration } from '../../config';
+import { ReadonlyContext } from '../../context';
+import { ActionData } from '../../action';
+import { IMinimalResponse } from '../../http';
+import { IRiskResponse } from '../../risk_api';
+import { FirstPartyData, IFirstParty } from '../../first_party';
+import { IFilter } from '../../filter';
+import { IConditionalBlocker } from '../../blocker';
+import { IBase64Utils, IIpRangeChecker } from '../../utils';
+import { IBotDefender } from '../';
+import { BotDefenderData } from './BotDefenderData';
+import { BotDefenderS2SCallReason } from './reasons';
+export declare type BotDefenderOptions<Req, Res> = {
+    base64Utils: IBase64Utils;
+    firstParty?: IFirstParty<Req, Res>;
+    blocker?: IConditionalBlocker<Req, Res>;
+} & ({
+    ipRangeChecker?: IIpRangeChecker;
+    filter: IFilter<Req, Res>;
+} | {
+    ipRangeChecker: IIpRangeChecker;
+    filter?: IFilter<Req, Res>;
+});
+export declare class BotDefender<Req, Res> implements IBotDefender<Req, Res> {
+    protected readonly config: IConfiguration<Req, Res>;
+    protected readonly firstParty: IFirstParty<Req, Res>;
+    protected readonly filter: IFilter<Req, Res>;
+    protected readonly blocker: IConditionalBlocker<Req, Res>;
+    constructor(config: IConfiguration<Req, Res>, options: BotDefenderOptions<Req, Res>);
+    handleFirstPartyRequest(context: ReadonlyContext<Req, Res>): Promise<FirstPartyData | null>;
+    shouldFilter(context: ReadonlyContext<Req, Res>): boolean;
+    enrichContextFromRequest(context: ReadonlyContext<Req, Res>): Promise<BotDefenderData>;
+    protected isMonitoredRoute(context: ReadonlyContext<Req, Res>): boolean;
+    protected isSensitiveRequest({ requestData: { url } }: ReadonlyContext<Req, Res>): boolean;
+    enrichContextFromResponse(context: ReadonlyContext<Req, Res>): Promise<Partial<BotDefenderData>>;
+    getTokenAction(context: ReadonlyContext<Req, Res>, isMonitoredRequest: boolean, isSensitiveRequest: boolean): Promise<ActionData>;
+    protected getNoTokenS2SCallReason({ pxhd, isMobile, tokenData, }: ReadonlyContext<Req, Res>): BotDefenderS2SCallReason;
+    protected getActionForSuccessfulTokenParse({ tokenData: { token } }: ReadonlyContext<Req, Res>, isMonitoredRequest: boolean, isSensitiveRequest: boolean): ActionData;
+    enrichContextFromRiskApi(context: ReadonlyContext<Req, Res>): Promise<Partial<BotDefenderData>>;
+    protected getRiskApiActionData({ riskApiData, productData: { bd }, }: ReadonlyContext<Req, Res>): Promise<ActionData>;
+    protected getSuccessfulRiskApiAction(riskResponse: DeepReadonly<IRiskResponse>, isMonitored: boolean): ActionData;
+    shouldBlock(context: ReadonlyContext<Req, Res>): boolean;
+    createBlockResponse(context: ReadonlyContext<Req, Res>): IMinimalResponse;
+    modifyIncomingRequest(context: ReadonlyContext<Req, Res>): Promise<void>;
+    modifyOutgoingResponse(context: ReadonlyContext<Req, Res>): Promise<void>;
+}

package/lib/products/bot_defender/BotDefender.js

@@ -0,0 +1,135 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Action } from '../../action';
+import { TokenParseResult } from '../../risk_token';
+import { RiskApiCallResult } from '../../risk_api';
+import { EnforcerError, isRouteInPatterns } from '../../utils';
+import { BotDefenderActionData, isMonitoredRequest } from '../';
+import { DefaultBotDefenderFirstParty } from './first_party';
+import { DefaultBotDefenderFilter } from './filter';
+import { BotDefenderBlockReason, BotDefenderPassReason, BotDefenderS2SCallReason } from './reasons';
+import { BotDefenderUtils } from './BotDefenderUtils';
+import { DefaultBotDefenderBlocker } from './block';
+export class BotDefender {
+    constructor(config, options) {
+        var _a, _b, _c;
+        this.config = config;
+        this.firstParty = (_a = options.firstParty) !== null && _a !== void 0 ? _a : new DefaultBotDefenderFirstParty(config);
+        this.filter = (_b = options.filter) !== null && _b !== void 0 ? _b : new DefaultBotDefenderFilter(config, options.ipRangeChecker);
+        this.blocker = (_c = options.blocker) !== null && _c !== void 0 ? _c : new DefaultBotDefenderBlocker(config, options.base64Utils);
+    }
+    handleFirstPartyRequest(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.firstParty.handleFirstPartyRequest(context);
+        });
+    }
+    shouldFilter(context) {
+        return this.filter.shouldFilter(context);
+    }
+    enrichContextFromRequest(context) {
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const isMonitoredRequest = this.isMonitoredRoute(context);
+            const isSensitiveRequest = this.isSensitiveRequest(context) || ((_a = context.graphqlData) === null || _a === void 0 ? void 0 : _a.some((operation) => operation.sensitive));
+            const actionData = yield this.getTokenAction(context, isMonitoredRequest, isSensitiveRequest);
+            return Object.assign(Object.assign({}, actionData), { isMonitoredRequest,
+                isSensitiveRequest });
+        });
+    }
+    isMonitoredRoute(context) {
+        return isMonitoredRequest(this.config, context);
+    }
+    isSensitiveRequest({ requestData: { url } }) {
+        // TODO: Include custom sensitive request function
+        return isRouteInPatterns(url.pathname, this.config.sensitiveRoutes);
+    }
+    enrichContextFromResponse(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return;
+        });
+    }
+    getTokenAction(context, isMonitoredRequest, isSensitiveRequest) {
+        return __awaiter(this, void 0, void 0, function* () {
+            switch (context.tokenData.tokenParseResult) {
+                case TokenParseResult.NONE:
+                    return new BotDefenderActionData(Action.TRIGGER_RISK_API, this.getNoTokenS2SCallReason(context));
+                case TokenParseResult.DECRYPTION_FAILED:
+                    return new BotDefenderActionData(Action.TRIGGER_RISK_API, BotDefenderS2SCallReason.COOKIE_DECRYPTION_FAILED);
+                case TokenParseResult.VALIDATION_FAILED:
+                    return new BotDefenderActionData(Action.TRIGGER_RISK_API, BotDefenderS2SCallReason.COOKIE_VALIDATION_FAILED);
+                case TokenParseResult.SUCCESSFUL:
+                    return this.getActionForSuccessfulTokenParse(context, isMonitoredRequest, isSensitiveRequest);
+            }
+        });
+    }
+    getNoTokenS2SCallReason({ pxhd, isMobile, tokenData, }) {
+        var _a;
+        if (isMobile && ((_a = tokenData.mobileData) === null || _a === void 0 ? void 0 : _a.mobileError)) {
+            return BotDefenderUtils.getS2SCallReasonFromMobileError(tokenData.mobileData.mobileError);
+        }
+        if (pxhd) {
+            return BotDefenderS2SCallReason.NO_COOKIE_WITH_VID;
+        }
+        return BotDefenderS2SCallReason.NO_COOKIE;
+    }
+    getActionForSuccessfulTokenParse({ tokenData: { token } }, isMonitoredRequest, isSensitiveRequest) {
+        if (token.isExpired()) {
+            return new BotDefenderActionData(Action.TRIGGER_RISK_API, BotDefenderS2SCallReason.COOKIE_EXPIRED);
+        }
+        if (token.isHighScore()) {
+            return new BotDefenderActionData(isMonitoredRequest ? Action.SIMULATED_BLOCK : Action.BLOCK, BotDefenderBlockReason.COOKIE_HIGH_SCORE);
+        }
+        if (isSensitiveRequest) {
+            return new BotDefenderActionData(Action.TRIGGER_RISK_API, BotDefenderS2SCallReason.SENSITIVE_ROUTE);
+        }
+        return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.COOKIE);
+    }
+    enrichContextFromRiskApi(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return yield this.getRiskApiActionData(context);
+        });
+    }
+    getRiskApiActionData({ riskApiData, productData: { bd }, }) {
+        return __awaiter(this, void 0, void 0, function* () {
+            switch (riskApiData.riskApiCallResult) {
+                case RiskApiCallResult.NONE:
+                    throw new EnforcerError('risk api call result should not be none!');
+                case RiskApiCallResult.ERROR:
+                    return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.S2S_ERROR);
+                case RiskApiCallResult.TIMEOUT:
+                    return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.S2S_TIMEOUT);
+                case RiskApiCallResult.SUCCESSFUL:
+                    return this.getSuccessfulRiskApiAction(riskApiData.riskResponse, bd.isMonitoredRequest);
+            }
+        });
+    }
+    getSuccessfulRiskApiAction(riskResponse, isMonitored) {
+        if (riskResponse.score >= this.config.blockingScore) {
+            return new BotDefenderActionData(isMonitored ? Action.SIMULATED_BLOCK : Action.BLOCK, BotDefenderBlockReason.S2S_HIGH_SCORE);
+        }
+        return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.S2S);
+    }
+    shouldBlock(context) {
+        return this.blocker.shouldBlock(context);
+    }
+    createBlockResponse(context) {
+        return this.blocker.createBlockResponse(context);
+    }
+    modifyIncomingRequest(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // intentionally left blank
+        });
+    }
+    modifyOutgoingResponse(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            // intentionally left blank
+        });
+    }
+}

package/lib/products/bot_defender/BotDefenderActionData.d.ts

@@ -0,0 +1,7 @@
+import { Action, ActionData } from '../../action';
+import { BotDefenderReasonType } from './reasons';
+export declare class BotDefenderActionData<A extends Action> implements ActionData {
+    readonly action: A;
+    readonly reason: BotDefenderReasonType<A>;
+    constructor(action: A, reason: BotDefenderReasonType<A>);
+}

package/lib/products/bot_defender/BotDefenderActionData.js

@@ -0,0 +1,6 @@
+export class BotDefenderActionData {
+    constructor(action, reason) {
+        this.action = action;
+        this.reason = reason;
+    }
+}

package/lib/products/bot_defender/BotDefenderData.d.ts

@@ -0,0 +1,13 @@
+import { ActionData } from '../../action';
+export declare type BotDefenderData = ActionData & {
+    /**
+     * Whether the request should go through the enforcement flow in monitor mode.
+     * This depends on various configurations including the module mode, monitored routes, enforced
+     * routes, and the bypass monitor header.
+     */
+    isMonitoredRequest: boolean;
+    /**
+     * Whether the request should trigger a Risk API call regardless of the risk cookie it carries.
+     */
+    isSensitiveRequest: boolean;
+};

package/lib/products/bot_defender/BotDefenderData.js

@@ -0,0 +1 @@
+export {};

package/lib/products/bot_defender/BotDefenderUtils.d.ts

@@ -0,0 +1,5 @@
+import { MobileError } from '../../risk_token';
+import { BotDefenderS2SCallReason } from './reasons';
+export declare namespace BotDefenderUtils {
+    const getS2SCallReasonFromMobileError: (mobileError: MobileError) => BotDefenderS2SCallReason;
+}

package/lib/products/bot_defender/BotDefenderUtils.js

@@ -0,0 +1,19 @@
+import { MobileError } from '../../risk_token';
+import { BotDefenderS2SCallReason } from './reasons';
+export var BotDefenderUtils;
+(function (BotDefenderUtils) {
+    BotDefenderUtils.getS2SCallReasonFromMobileError = (mobileError) => {
+        switch (mobileError) {
+            case MobileError.NO_COOKIE:
+                return BotDefenderS2SCallReason.MOBILE_ERROR_NO_COOKIE;
+            case MobileError.CONNECTION_ERROR:
+                return BotDefenderS2SCallReason.MOBILE_ERROR_CONNECTION_ERROR;
+            case MobileError.CERTIFICATE_PINNING_ERROR:
+                return BotDefenderS2SCallReason.MOBILE_ERROR_CERTIFICATE_PINNING_ERROR;
+            case MobileError.BYPASS:
+                return BotDefenderS2SCallReason.MOBILE_ERROR_BYPASS;
+            default:
+                return `mobile_error_${mobileError}`;
+        }
+    };
+})(BotDefenderUtils || (BotDefenderUtils = {}));

package/lib/products/bot_defender/IBotDefender.d.ts

@@ -0,0 +1,7 @@
+import { IFilter } from '../../filter';
+import { IFirstParty } from '../../first_party';
+import { IConditionalBlocker } from '../../blocker';
+import { IProduct } from '../interfaces';
+import { ProductName } from '../utils';
+export interface IBotDefender<Req, Res> extends IProduct<ProductName.BOT_DEFENDER, Req, Res>, IFirstParty<Req, Res>, IFilter<Req, Res>, IConditionalBlocker<Req, Res> {
+}

package/lib/products/bot_defender/IBotDefender.js

@@ -0,0 +1 @@
+export {};

package/lib/products/bot_defender/block/DefaultBotDefenderBlocker.d.ts

@@ -0,0 +1,14 @@
+import { ReadonlyContext } from '../../../context';
+import { IConfiguration } from '../../../config';
+import { IBase64Utils } from '../../../utils';
+import { IConditionalBlocker } from '../../../blocker';
+import { IMinimalResponse } from '../../../http';
+export declare class DefaultBotDefenderBlocker<Req, Res> implements IConditionalBlocker<Req, Res> {
+    private readonly config;
+    private readonly captchaResponseGenerator;
+    constructor(config: IConfiguration<Req, Res>, base64Utils: IBase64Utils);
+    shouldBlock({ action, reasons, productData }: ReadonlyContext<Req, Res>): boolean;
+    createBlockResponse(context: ReadonlyContext<Req, Res>): IMinimalResponse;
+    private createRateLimitResponse;
+    private createCaptchaResponse;
+}

package/lib/products/bot_defender/block/DefaultBotDefenderBlocker.js

@@ -0,0 +1,39 @@
+import { Action } from '../../../action';
+import { BlockAction } from '../../../blocker';
+import { ContentType, CONTENT_TYPE_HEADER_NAME, MinimalResponseImpl } from '../../../http';
+import { ProductName } from '../../utils';
+import { CaptchaBlocker } from './captcha';
+import { RATE_LIMIT_TEMPLATE } from './templates';
+export class DefaultBotDefenderBlocker {
+    constructor(config, base64Utils) {
+        this.config = config;
+        this.captchaResponseGenerator = new CaptchaBlocker(config, base64Utils);
+    }
+    shouldBlock({ action, reasons, productData }) {
+        return action === Action.BLOCK && !!(reasons === null || reasons === void 0 ? void 0 : reasons[ProductName.BOT_DEFENDER]);
+    }
+    createBlockResponse(context) {
+        switch (context.blockAction) {
+            case BlockAction.RATE_LIMIT:
+                return this.createRateLimitResponse();
+            case BlockAction.CHALLENGE:
+            case BlockAction.CAPTCHA:
+            default:
+                return this.createCaptchaResponse(context);
+        }
+    }
+    createRateLimitResponse() {
+        const status = 429;
+        const headers = {
+            [CONTENT_TYPE_HEADER_NAME]: [ContentType.TEXT_HTML],
+        };
+        return new MinimalResponseImpl({
+            body: RATE_LIMIT_TEMPLATE,
+            status: status,
+            headers: headers,
+        });
+    }
+    createCaptchaResponse(context) {
+        return this.captchaResponseGenerator.createBlockResponse(context);
+    }
+}

package/lib/products/bot_defender/block/captcha/CaptchaBlocker.d.ts

@@ -0,0 +1,13 @@
+import { IConfiguration } from '../../../../config';
+import { ReadonlyContext } from '../../../../context';
+import { IBase64Utils } from '../../../../utils';
+import { IBlocker } from '../../../../blocker';
+import { IMinimalResponse } from '../../../../http';
+export declare class CaptchaBlocker<Req, Res> implements IBlocker<Req, Res> {
+    private readonly config;
+    private readonly jsonCaptchaGenerator;
+    private readonly mobileCaptchaGenerator;
+    private readonly htmlCaptchaGenerator;
+    constructor(config: IConfiguration<Req, Res>, base64Utils: IBase64Utils);
+    createBlockResponse(context: ReadonlyContext<Req, Res>): IMinimalResponse;
+}

package/lib/products/bot_defender/block/captcha/CaptchaBlocker.js

@@ -0,0 +1,20 @@
+import { JsonCaptchaBlocker } from './JsonCaptchaBlocker';
+import { MobileCaptchaBlocker } from './MobileCaptchaBlocker';
+import { HtmlCaptchaBlocker } from './HtmlCaptchaBlocker';
+export class CaptchaBlocker {
+    constructor(config, base64Utils) {
+        this.config = config;
+        this.jsonCaptchaGenerator = new JsonCaptchaBlocker(config);
+        this.mobileCaptchaGenerator = new MobileCaptchaBlocker(config, base64Utils);
+        this.htmlCaptchaGenerator = new HtmlCaptchaBlocker(config);
+    }
+    createBlockResponse(context) {
+        if (this.mobileCaptchaGenerator.shouldBlock(context)) {
+            return this.mobileCaptchaGenerator.createBlockResponse(context);
+        }
+        if (this.jsonCaptchaGenerator.shouldBlock(context)) {
+            return this.jsonCaptchaGenerator.createBlockResponse(context);
+        }
+        return this.htmlCaptchaGenerator.createBlockResponse(context);
+    }
+}