perimeterx-js-core 0.5.1 → 0.6.0

package/lib/risk_token/token/TokenBase.js

@@ -0,0 +1,50 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { TokenParseResult } from '../TokenParseResult';
+export class TokenBase {
+    constructor(config, cookieString) {
+        this.logger = config.logger;
+        this.cookieSecret = config.cookieSecret;
+        this.cookieMaxLength = config.riskCookieMaxLength;
+        this.cookieString = cookieString;
+        this.isValidated = false;
+    }
+    verify(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.cookieString) {
+                return TokenParseResult.NONE;
+            }
+            if (this.isValid()) {
+                return TokenParseResult.SUCCESSFUL;
+            }
+            if (this.cookieString.length > this.cookieMaxLength) {
+                return TokenParseResult.DECRYPTION_FAILED;
+            }
+            this.payload = this.payload || (yield this.decrypt(context));
+            if (!this.payload) {
+                return TokenParseResult.DECRYPTION_FAILED;
+            }
+            if (!(yield this.validate(context))) {
+                return TokenParseResult.VALIDATION_FAILED;
+            }
+            this.isValidated = true;
+            return TokenParseResult.SUCCESSFUL;
+        });
+    }
+    isValid() {
+        return this.isValidated;
+    }
+    getTokenString() {
+        return this.cookieString;
+    }
+    getPayloadString() {
+        return this.payload ? JSON.stringify(this.payload) : '';
+    }
+}

package/lib/risk_token/token/TokenPayloadType.d.ts

@@ -0,0 +1,4 @@
+import { TokenVersion } from '../TokenVersion';
+import { TokenV3Payload } from './v3/TokenV3Payload';
+import { TokenV2Payload } from './v2/TokenV2Payload';
+export declare type TokenPayloadType<TokenV extends TokenVersion> = TokenV extends TokenVersion.V3 ? TokenV3Payload : TokenV extends TokenVersion.V2 ? TokenV2Payload : never;

package/lib/risk_token/token/TokenPayloadType.js

@@ -0,0 +1 @@
+export {};

package/lib/risk_token/token/index.d.ts

@@ -1,7 +1,7 @@
-export { IBotDefenderToken } from './IBotDefenderToken';
-export { BotDefenderTokenBase } from './BotDefenderTokenBase';
-export { BotDefenderTokenV2Payload } from './v2/BotDefenderTokenV2Payload';
-export { DefaultBotDefenderTokenV2 } from './v2/DefaultBotDefenderTokenV2';
-export { BotDefenderTokenV3Payload } from './v3/BotDefenderTokenV3Payload';
-export { DefaultBotDefenderTokenV3 } from './v3/DefaultBotDefenderTokenV3';
+export { IToken } from './IToken';
+export { TokenBase } from './TokenBase';
+export { TokenV2Payload } from './v2/TokenV2Payload';
+export { DefaultTokenV2 } from './v2/DefaultTokenV2';
+export { TokenV3Payload } from './v3/TokenV3Payload';
+export { DefaultTokenV3 } from './v3/DefaultTokenV3';
 export { TokenSignField } from './v3/TokenSignField';

package/lib/risk_token/token/index.js

@@ -1,11 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenSignField = exports.DefaultBotDefenderTokenV3 = exports.DefaultBotDefenderTokenV2 = exports.BotDefenderTokenBase = void 0;
-var BotDefenderTokenBase_1 = require("./BotDefenderTokenBase");
-Object.defineProperty(exports, "BotDefenderTokenBase", { enumerable: true, get: function () { return BotDefenderTokenBase_1.BotDefenderTokenBase; } });
-var DefaultBotDefenderTokenV2_1 = require("./v2/DefaultBotDefenderTokenV2");
-Object.defineProperty(exports, "DefaultBotDefenderTokenV2", { enumerable: true, get: function () { return DefaultBotDefenderTokenV2_1.DefaultBotDefenderTokenV2; } });
-var DefaultBotDefenderTokenV3_1 = require("./v3/DefaultBotDefenderTokenV3");
-Object.defineProperty(exports, "DefaultBotDefenderTokenV3", { enumerable: true, get: function () { return DefaultBotDefenderTokenV3_1.DefaultBotDefenderTokenV3; } });
-var TokenSignField_1 = require("./v3/TokenSignField");
-Object.defineProperty(exports, "TokenSignField", { enumerable: true, get: function () { return TokenSignField_1.TokenSignField; } });
+export { TokenBase } from './TokenBase';
+export { DefaultTokenV2 } from './v2/DefaultTokenV2';
+export { DefaultTokenV3 } from './v3/DefaultTokenV3';
+export { TokenSignField } from './v3/TokenSignField';

package/lib/risk_token/token/v2/DefaultTokenV2.d.ts

@@ -0,0 +1,27 @@
+import { IConfiguration } from '../../../config';
+import { ReadonlyContext } from '../../../context';
+import { BlockAction } from '../../../blocker';
+import { IBase64Utils, IHmacUtils } from '../../../utils';
+import { TokenVersion } from '../../TokenVersion';
+import { TokenV2Payload } from './TokenV2Payload';
+import { TokenBase } from '../TokenBase';
+export declare class DefaultTokenV2<Req, Res> extends TokenBase<TokenVersion.V2, Req, Res> {
+    protected readonly base64Utils: IBase64Utils;
+    protected readonly hmacUtils: IHmacUtils;
+    protected isHighRisk: boolean;
+    constructor(config: IConfiguration<Req, Res>, cookieString: string, base64Utils: IBase64Utils, hmacUtils: IHmacUtils);
+    protected decrypt(context: ReadonlyContext<Req, Res>): TokenV2Payload;
+    protected validate(context: ReadonlyContext<Req, Res>): Promise<boolean>;
+    private decode;
+    private getSigningFields;
+    private getHashParam;
+    private calculateHmac;
+    isExpired(): boolean;
+    isHighScore(): boolean;
+    get hmac(): string;
+    get timestamp(): number;
+    get uuid(): string;
+    get vid(): string;
+    get score(): number;
+    get action(): BlockAction;
+}

package/lib/risk_token/token/v2/DefaultTokenV2.js

@@ -0,0 +1,112 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { BlockAction } from '../../../blocker';
+import { Algorithm, isValidUuid } from '../../../utils';
+import { TokenBase } from '../TokenBase';
+export class DefaultTokenV2 extends TokenBase {
+    constructor(config, cookieString, base64Utils, hmacUtils) {
+        super(config, cookieString);
+        this.base64Utils = base64Utils;
+        this.hmacUtils = hmacUtils;
+        this.isHighRisk = undefined;
+    }
+    decrypt(context) {
+        try {
+            const payload = this.decode(this.cookieString);
+            if ((payload === null || payload === void 0 ? void 0 : payload.t) == null || (payload === null || payload === void 0 ? void 0 : payload.h) == null || (payload === null || payload === void 0 ? void 0 : payload.u) == null || (payload === null || payload === void 0 ? void 0 : payload.v) == null) {
+                return null;
+            }
+            return payload;
+        }
+        catch (e) {
+            this.logger.debug(`cookie v2 decryption failed: ${e}`);
+        }
+        return null;
+    }
+    validate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (typeof this.payload.t !== 'number' ||
+                !isValidUuid(this.payload.v) ||
+                !isValidUuid(this.payload.u) ||
+                !this.payload.h) {
+                return false;
+            }
+            try {
+                const signingFields = this.getSigningFields(context);
+                const passHmac = yield this.calculateHmac(this.getHashParam('0', signingFields));
+                if (passHmac === this.payload.h) {
+                    this.isHighRisk = false;
+                    return true;
+                }
+                const blockHmac = yield this.calculateHmac(this.getHashParam('1', signingFields));
+                if (blockHmac === this.payload.h) {
+                    this.isHighRisk = true;
+                    return true;
+                }
+            }
+            catch (e) {
+                this.logger.debug(`cookie v2 validation caught error: ${e}`);
+            }
+            return false;
+        });
+    }
+    decode(cookieString) {
+        const decodedCookie = this.base64Utils.base64Decode(cookieString);
+        return JSON.parse(decodedCookie);
+    }
+    getSigningFields(context) {
+        return context.isMobile ? '' : context.requestData.userAgent;
+    }
+    getHashParam(startingValue, signingFields) {
+        let hashParam = startingValue;
+        if (signingFields) {
+            hashParam += signingFields;
+        }
+        return hashParam;
+    }
+    calculateHmac(param) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const payload = `${this.payload.t}${this.payload.u}${this.payload.v}${param}`;
+            return this.hmacUtils.createHmac(Algorithm.SHA256, payload, this.cookieSecret);
+        });
+    }
+    isExpired() {
+        var _a;
+        return Date.now() > ((_a = this.payload) === null || _a === void 0 ? void 0 : _a.t);
+    }
+    isHighScore() {
+        return this.isHighRisk;
+    }
+    get hmac() {
+        var _a;
+        return (_a = this.payload) === null || _a === void 0 ? void 0 : _a.h;
+    }
+    get timestamp() {
+        var _a;
+        return (_a = this.payload) === null || _a === void 0 ? void 0 : _a.t;
+    }
+    get uuid() {
+        var _a;
+        return (_a = this.payload) === null || _a === void 0 ? void 0 : _a.u;
+    }
+    get vid() {
+        var _a;
+        return (_a = this.payload) === null || _a === void 0 ? void 0 : _a.v;
+    }
+    get score() {
+        if (this.isValid()) {
+            return this.isHighScore() ? 100 : 0;
+        }
+        return undefined;
+    }
+    get action() {
+        return BlockAction.CAPTCHA;
+    }
+}

package/lib/risk_token/token/v2/{BotDefenderTokenV2Payload.d.ts → TokenV2Payload.d.ts}

@@ -1,4 +1,4 @@
-export declare type BotDefenderTokenV2Payload = {
+export declare type TokenV2Payload = {
     h: string;
     u: string;
     t: number;

package/lib/risk_token/token/v2/TokenV2Payload.js

@@ -0,0 +1 @@
+export {};

package/lib/risk_token/token/v3/DefaultTokenV3.d.ts

@@ -0,0 +1,30 @@
+import { IConfiguration } from '../../../config';
+import { ReadonlyContext } from '../../../context';
+import { ICipherUtils, IHmacUtils } from '../../../utils';
+import { BlockAction } from '../../../blocker';
+import { TokenVersion } from '../../TokenVersion';
+import { TokenV3Payload } from './TokenV3Payload';
+import { TokenSignField } from './TokenSignField';
+import { TokenBase } from '../TokenBase';
+export declare class DefaultTokenV3<Req, Res> extends TokenBase<TokenVersion.V3, Req, Res> {
+    protected readonly maxIterations: number;
+    protected readonly minIterations: number;
+    protected readonly blockingScore: number;
+    protected readonly cipherUtils: ICipherUtils;
+    protected readonly hmacUtils: IHmacUtils;
+    protected hash: string;
+    constructor(config: IConfiguration<Req, Res>, cookieString: string, cipherUtils: ICipherUtils, hmacUtils: IHmacUtils);
+    protected decrypt(context: ReadonlyContext<Req, Res>): Promise<TokenV3Payload>;
+    protected decryptPayload(encryptedCookie: string, salt: string, iterations: number): Promise<TokenV3Payload>;
+    protected validate(context: ReadonlyContext<Req, Res>): Promise<boolean>;
+    protected getSignedWithFields(context: ReadonlyContext<Req, Res>): string[];
+    protected getSignedWithField(char: TokenSignField, { requestData }: ReadonlyContext<Req, Res>): string;
+    isExpired(): boolean;
+    isHighScore(): boolean;
+    get timestamp(): number;
+    get uuid(): string;
+    get vid(): string;
+    get score(): number;
+    get action(): BlockAction;
+    get hmac(): string;
+}

package/lib/risk_token/token/v3/DefaultTokenV3.js

@@ -0,0 +1,137 @@
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { Algorithm } from '../../../utils';
+import { COOKIE_SPLIT_DELIMITER, COOKIE_V3_HMAC_INDEX, COOKIE_V3_ITERATIONS_INDEX, COOKIE_V3_MAXIMUM_SALT_LENGTH, COOKIE_V3_PARTS_COUNT, COOKIE_V3_PAYLOAD_INDEX, COOKIE_V3_SALT_INDEX, } from '../../constants';
+import { TokenSignField } from './TokenSignField';
+import { TokenBase } from '../TokenBase';
+export class DefaultTokenV3 extends TokenBase {
+    constructor(config, cookieString, cipherUtils, hmacUtils) {
+        super(config, cookieString);
+        this.maxIterations = config.riskCookieMaxIterations;
+        this.minIterations = config.riskCookieMinIterations;
+        this.blockingScore = config.blockingScore;
+        this.cookieString = cookieString;
+        this.cipherUtils = cipherUtils;
+        this.hmacUtils = hmacUtils;
+    }
+    decrypt(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const data = this.cookieString.split(COOKIE_SPLIT_DELIMITER);
+                if (data.length !== COOKIE_V3_PARTS_COUNT) {
+                    return null;
+                }
+                this.hash = data[COOKIE_V3_HMAC_INDEX];
+                const salt = data[COOKIE_V3_SALT_INDEX];
+                const iterations = parseInt
+                    ? parseInt(data[COOKIE_V3_ITERATIONS_INDEX])
+                    : Number(data[COOKIE_V3_ITERATIONS_INDEX]);
+                const encryptedCookie = data[COOKIE_V3_PAYLOAD_INDEX];
+                if (!iterations || iterations > this.maxIterations || iterations < this.minIterations) {
+                    return null;
+                }
+                if (!salt || typeof salt !== 'string' || salt.length > COOKIE_V3_MAXIMUM_SALT_LENGTH) {
+                    return null;
+                }
+                if (!encryptedCookie || typeof encryptedCookie !== 'string') {
+                    return null;
+                }
+                return yield this.decryptPayload(encryptedCookie, salt, iterations);
+            }
+            catch (e) {
+                this.logger.debug(`cookie v3 decryption failed: ${e}`);
+            }
+            return null;
+        });
+    }
+    decryptPayload(encryptedCookie, salt, iterations) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const decryptedCookie = yield this.cipherUtils.pbkdf2Decrypt(this.cookieSecret, encryptedCookie, iterations, salt);
+                if (!decryptedCookie) {
+                    return null;
+                }
+                return JSON.parse(decryptedCookie);
+            }
+            catch (e) {
+                this.logger.debug(`error decrypting cookie v3: ${e}`);
+                return null;
+            }
+        });
+    }
+    validate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const signedFields = this.getSignedWithFields(context);
+                const hmacStrBase = this.cookieString.substring(this.cookieString.indexOf(COOKIE_SPLIT_DELIMITER) + 1);
+                const payload = `${hmacStrBase}${signedFields.join('')}`;
+                const hash = this.hmacUtils.createHmac(Algorithm.SHA256, payload, this.cookieSecret);
+                return hash === this.hmac;
+            }
+            catch (e) {
+                this.logger.debug(`error validating cookie v3: ${e}`);
+                return false;
+            }
+        });
+    }
+    getSignedWithFields(context) {
+        var _a;
+        if (context.isMobile) {
+            return [];
+        }
+        else if ((_a = this.payload) === null || _a === void 0 ? void 0 : _a.x) {
+            return this.payload.x.split('').map((char) => this.getSignedWithField(char, context));
+        }
+        else {
+            return [context.requestData.userAgent];
+        }
+    }
+    getSignedWithField(char, { requestData }) {
+        switch (char) {
+            case TokenSignField.SOCKET_IP:
+                return requestData.ip;
+            case TokenSignField.USER_AGENT:
+                return requestData.userAgent;
+            default:
+                return '';
+        }
+    }
+    isExpired() {
+        var _a;
+        return Date.now() > ((_a = this.payload) === null || _a === void 0 ? void 0 : _a.t);
+    }
+    isHighScore() {
+        var _a;
+        return ((_a = this.payload) === null || _a === void 0 ? void 0 : _a.s) >= this.blockingScore;
+    }
+    get timestamp() {
+        var _a;
+        return (_a = this.payload) === null || _a === void 0 ? void 0 : _a.t;
+    }
+    get uuid() {
+        var _a;
+        return (_a = this.payload) === null || _a === void 0 ? void 0 : _a.u;
+    }
+    get vid() {
+        var _a;
+        return (_a = this.payload) === null || _a === void 0 ? void 0 : _a.v;
+    }
+    get score() {
+        var _a;
+        return (_a = this.payload) === null || _a === void 0 ? void 0 : _a.s;
+    }
+    get action() {
+        var _a;
+        return (_a = this.payload) === null || _a === void 0 ? void 0 : _a.a;
+    }
+    get hmac() {
+        return this.hash;
+    }
+}

package/lib/risk_token/token/v3/TokenSignField.js

@@ -1,8 +1,5 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.TokenSignField = void 0;
-var TokenSignField;
+export var TokenSignField;
 (function (TokenSignField) {
     TokenSignField["SOCKET_IP"] = "s";
     TokenSignField["USER_AGENT"] = "u";
-})(TokenSignField = exports.TokenSignField || (exports.TokenSignField = {}));
+})(TokenSignField || (TokenSignField = {}));

package/lib/risk_token/token/v3/TokenV3Payload.d.ts

@@ -0,0 +1,9 @@
+import { BlockAction } from '../../../blocker';
+export declare type TokenV3Payload = {
+    a: BlockAction;
+    s: number;
+    t: number;
+    u: string;
+    v: string;
+    x?: string;
+};

package/lib/risk_token/token/v3/TokenV3Payload.js

@@ -0,0 +1 @@
+export {};

package/lib/risk_token/utils.js

@@ -1,16 +1,12 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.convertMobileTokenVersionToCookieName = void 0;
-var constants_1 = require("./constants");
-var TokenVersion_1 = require("./TokenVersion");
-var convertMobileTokenVersionToCookieName = function (tokenVersion) {
+import { COOKIE_V2_NAME, COOKIE_V3_NAME } from './constants';
+import { TokenVersion } from './TokenVersion';
+export const convertMobileTokenVersionToCookieName = (tokenVersion) => {
     switch (tokenVersion) {
-        case TokenVersion_1.TokenVersion.V2:
-            return constants_1.COOKIE_V2_NAME;
-        case TokenVersion_1.TokenVersion.V3:
-            return constants_1.COOKIE_V3_NAME;
+        case TokenVersion.V2:
+            return COOKIE_V2_NAME;
+        case TokenVersion.V3:
+            return COOKIE_V3_NAME;
         default:
             return '';
     }
 };
-exports.convertMobileTokenVersionToCookieName = convertMobileTokenVersionToCookieName;

package/lib/telemetry/DefaultTelemetry.d.ts

@@ -1,16 +1,16 @@
 import { IConfiguration } from '../config';
-import { IContext } from '../context';
-import { IBase64Utils, IHashUtils } from '../utils';
+import { ReadonlyContext } from '../context';
+import { IHttpClient } from '../http';
+import { IBase64Utils, IHmacUtils } from '../utils';
 import { ITelemetry } from './ITelemetry';
-import { IHttpClient } from '..';
-export declare class DefaultTelemetry implements ITelemetry {
+export declare class DefaultTelemetry<Req, Res> implements ITelemetry<Req, Res> {
     private readonly config;
     private readonly httpClient;
     private readonly base64Utils;
-    private readonly hashUtils;
-    constructor(config: IConfiguration, httpClient: IHttpClient, base64Utils: IBase64Utils, hashUtils: IHashUtils);
-    isValidTelemetryRequest(context: IContext): Promise<boolean>;
-    sendTelemetry(context: IContext): Promise<void>;
+    private readonly hmacUtils;
+    constructor(config: IConfiguration<Req, Res>, httpClient: IHttpClient, base64Utils: IBase64Utils, hmacUtils: IHmacUtils);
+    isValidTelemetryRequest(context: ReadonlyContext<Req, Res>): Promise<boolean>;
+    sendTelemetry(context: ReadonlyContext<Req, Res>): Promise<void>;
     private getTelemetryHeader;
     private isTelemetryHeaderValid;
     private isTelemetryHmacValid;