perimeterx-js-core 0.7.1 → 0.9.0

package/lib/esm/products/bot_defender/block/captcha/MobileCaptchaBlocker.js

@@ -0,0 +1,36 @@
+import { BLOCK_ACTION_TO_WORD_MAP } from '../../../../blocker';
+import { ContentType, CONTENT_TYPE_HEADER_NAME, MinimalResponseImpl } from '../../../../http';
+import { createBlockData, renderHtml } from '../utils';
+import { CAPTCHA_TEMPLATE } from '../templates';
+export class MobileCaptchaBlocker {
+    config;
+    base64Utils;
+    constructor(config, base64Utils) {
+        this.config = config;
+        this.base64Utils = base64Utils;
+    }
+    shouldBlock(context) {
+        return context.isMobile;
+    }
+    createBlockResponse(context) {
+        const status = 403;
+        const headers = {
+            [CONTENT_TYPE_HEADER_NAME]: [ContentType.APPLICATION_JSON],
+        };
+        const blockData = createBlockData(this.config, context);
+        const captchaPage = renderHtml(CAPTCHA_TEMPLATE, blockData);
+        const mobileBlockPayload = {
+            action: BLOCK_ACTION_TO_WORD_MAP.get(blockData.blockAction),
+            uuid: blockData.uuid,
+            vid: blockData.vid,
+            appId: blockData.appId,
+            page: this.base64Utils.base64Encode(captchaPage),
+            collectorHost: this.config.backendCollectorUrl,
+        };
+        return new MinimalResponseImpl({
+            body: JSON.stringify(mobileBlockPayload),
+            status: status,
+            headers: headers,
+        });
+    }
+}

package/lib/esm/products/bot_defender/block/utils.js

@@ -0,0 +1,43 @@
+import { PXVID_COOKIE_NAME } from '../../../utils';
+import { FirstPartySuffix, getMostCustomizedFirstPartyPath } from '../first_party';
+export const renderHtml = (htmlTemplate, blockData) => {
+    if (!blockData) {
+        return htmlTemplate;
+    }
+    Object.entries(blockData).forEach(([key, value]) => {
+        const replace = `{{${key}}}`;
+        const regEx = new RegExp(replace, 'g');
+        htmlTemplate = htmlTemplate.replace(regEx, `${value}`);
+    });
+    return htmlTemplate;
+};
+export const createBlockData = (config, context) => {
+    const captchaScriptSuffix = '/captcha.js';
+    const captchaParams = `?a=${context.blockAction}&u=${context.uuid}&v=${context.vid || ''}&m=${context.isMobile ? '1' : '0'}`;
+    let jsClientSrc = `${config.backendClientUrl}/${config.appId}/main.min.js`;
+    let blockScript = `${config.backendCaptchaUrl}/${config.appId}${captchaScriptSuffix}${captchaParams}`;
+    let hostUrl = config.backendCollectorUrl;
+    if (config.firstPartyEnabled && !context.isMobile) {
+        jsClientSrc = getMostCustomizedFirstPartyPath(config, FirstPartySuffix.SENSOR);
+        blockScript = `${getMostCustomizedFirstPartyPath(config, FirstPartySuffix.CAPTCHA)}${config.customFirstPartyCaptchaEndpoint ? captchaParams : `${captchaScriptSuffix}${captchaParams}`}`;
+        hostUrl = getMostCustomizedFirstPartyPath(config, FirstPartySuffix.XHR);
+    }
+    const cssRef = config.cssRef ? `<link rel="stylesheet" type="text/css" href="${config.cssRef}" />` : '';
+    const jsRef = config.jsRef ? `<script src="${config.jsRef}"></script>` : '';
+    const altBlockScript = `${config.altBackendCaptchaUrl}/${config.appId}${captchaScriptSuffix}${captchaParams}`;
+    return {
+        appId: config.appId,
+        vid: context.vid || context.requestData?.cookies?.[PXVID_COOKIE_NAME] || '',
+        uuid: context.uuid || '',
+        isMobile: context.isMobile,
+        customLogo: config.customLogo || '',
+        blockAction: context.blockAction,
+        hostUrl,
+        cssRef,
+        jsRef,
+        jsClientSrc,
+        firstPartyEnabled: config.firstPartyEnabled,
+        blockScript,
+        altBlockScript,
+    };
+};

package/lib/esm/products/bot_defender/filter/DefaultBotDefenderFilter.js

@@ -0,0 +1,57 @@
+import { HttpMethod } from '../../../http';
+import { FilterReason } from '../../../filter';
+import { getExtension, isRouteInPatterns } from '../../../utils';
+export class DefaultBotDefenderFilter {
+    config;
+    ipRangeChecker;
+    constructor(config, ipRangeChecker) {
+        this.config = config;
+        this.ipRangeChecker = ipRangeChecker;
+    }
+    shouldFilter(context) {
+        const { requestData } = context;
+        const filterReason = this.getFilterReason(requestData);
+        if (filterReason !== FilterReason.NONE) {
+            this.config.logger.debug(`filter request due to ${filterReason}`);
+            return true;
+        }
+        return false;
+    }
+    getFilterReason(request) {
+        if (this.shouldFilterByExtension(request)) {
+            return FilterReason.EXTENSION;
+        }
+        if (this.shouldFilterByRoute(request.url.pathname)) {
+            return FilterReason.ROUTE;
+        }
+        if (this.shouldFilterByHttpMethod(request.method)) {
+            return FilterReason.HTTP_METHOD;
+        }
+        if (this.shouldFilterByUserAgent(request.userAgent)) {
+            return FilterReason.USER_AGENT;
+        }
+        if (this.shouldFilterByIp(request.ip)) {
+            return FilterReason.IP;
+        }
+        return FilterReason.NONE;
+    }
+    shouldFilterByExtension(requestData) {
+        if (requestData.method !== HttpMethod.GET && requestData.method !== HttpMethod.HEAD) {
+            return false;
+        }
+        const ext = getExtension(requestData.url.href);
+        return !!ext && this.config.filteredExtensions.includes(ext);
+    }
+    shouldFilterByHttpMethod(method) {
+        return this.config.filteredHttpMethods.some((filteredMethod) => filteredMethod.toUpperCase() === method);
+    }
+    shouldFilterByIp(ip) {
+        return this.config.filteredIps.some((range) => this.ipRangeChecker.isIpInRange(ip, range));
+    }
+    shouldFilterByRoute(route) {
+        return isRouteInPatterns(route, this.config.filteredRoutes);
+    }
+    shouldFilterByUserAgent(userAgent) {
+        return this.config.filteredUserAgents.includes(userAgent);
+    }
+}

package/lib/esm/products/bot_defender/first_party/DefaultBotDefenderFirstParty.js

@@ -0,0 +1,114 @@
+import { removeSensitiveHeaders } from '../../../utils';
+import { COOKIE_HEADER_NAME, HOST_HEADER_NAME, X_FORWARDED_FOR_HEADER_NAME, OutgoingRequestImpl, MinimalResponseImpl, toMutableHeaders, URLUtils, } from '../../../http';
+import { getFirstPartyCaptchaScriptPathPrefixes, getFirstPartySensorScriptPaths, getFirstPartyXhrPathPrefixes, } from './utils';
+import { DEFAULT_CLIENT_RESPONSE_OPTIONS, DEFAULT_GIF_RESPONSE, DEFAULT_XHR_RESPONSE, FIRST_PARTY_HEADER_NAME, FIRST_PARTY_HEADER_VALUE, X_PX_ENFORCER_TRUE_IP_HEADER_NAME, } from './constants';
+import { FirstPartySuffix } from './FirstPartySuffix';
+export class DefaultBotDefenderFirstParty {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    async handleFirstPartyRequest(context) {
+        const { pathname } = context.requestData.url;
+        if (getFirstPartySensorScriptPaths(this.config).includes(pathname)) {
+            return await this.proxySensorScriptRequest(context);
+        }
+        const xhrPrefix = getFirstPartyXhrPathPrefixes(this.config).find((prefix) => pathname.startsWith(prefix));
+        if (xhrPrefix) {
+            return await this.proxyXhrRequest(context, xhrPrefix);
+        }
+        const captchaPrefix = getFirstPartyCaptchaScriptPathPrefixes(this.config).find((prefix) => pathname.startsWith(prefix));
+        if (captchaPrefix) {
+            return await this.proxyCaptchaScriptRequest(context);
+        }
+        return null;
+    }
+    async proxySensorScriptRequest(context) {
+        const defaultResponse = new MinimalResponseImpl(DEFAULT_CLIENT_RESPONSE_OPTIONS);
+        if (!this.config.firstPartyEnabled) {
+            return { defaultResponse };
+        }
+        const url = this.getThirdPartySensorScriptUrl();
+        const request = await this.getOutgoingRequest(url, context);
+        this.config.logger.debug(`proxying first party sensor script ${context.requestData.url.pathname} to ${url}`);
+        return { request, defaultResponse };
+    }
+    async proxyXhrRequest(context, prefix) {
+        const defaultResponse = DefaultBotDefenderFirstParty.getDefaultXhrResponse(context.requestData.url.pathname);
+        if (!this.config.firstPartyEnabled) {
+            return { defaultResponse };
+        }
+        const url = this.getThirdPartyXhrUrl(context, prefix);
+        const request = await this.getOutgoingRequest(url, context);
+        this.config.logger.debug(`proxying first party XHR request ${context.requestData.url.pathname} to ${url}`);
+        return { request, defaultResponse };
+    }
+    static getDefaultXhrResponse(path) {
+        const { content, options } = path.endsWith('.gif') ? DEFAULT_GIF_RESPONSE : DEFAULT_XHR_RESPONSE;
+        return new MinimalResponseImpl({
+            body: content,
+            status: options.status,
+            headers: options.headers,
+        });
+    }
+    async proxyCaptchaScriptRequest(context) {
+        const defaultResponse = new MinimalResponseImpl(DEFAULT_CLIENT_RESPONSE_OPTIONS);
+        if (!this.config.firstPartyEnabled) {
+            return { defaultResponse };
+        }
+        const url = this.getThirdPartyCaptchaScriptUrl(context);
+        const request = await this.getOutgoingRequest(url, context);
+        this.config.logger.debug(`proxying first party captcha script ${context.requestData.url.pathname} to ${url}`);
+        return { request, defaultResponse };
+    }
+    async getOutgoingRequest(url, { requestData, vid }) {
+        return new OutgoingRequestImpl({
+            url: url,
+            method: requestData.method,
+            headers: this.prepareFirstPartyHeaders(url, requestData, vid),
+            body: requestData.request.body,
+        });
+    }
+    prepareFirstPartyHeaders(url, requestData, vid) {
+        let headers = toMutableHeaders(requestData.headers);
+        try {
+            headers = removeSensitiveHeaders(headers, this.config.sensitiveHeaders);
+            this.setHostHeader(headers, url);
+            this.setXffHeader(headers, requestData.ip);
+            this.addFirstPartyHeaders(headers, requestData.ip);
+            if (vid) {
+                const newCookies = (headers[COOKIE_HEADER_NAME] || []).concat([`pxvid=${vid}`]);
+                headers[COOKIE_HEADER_NAME] = [newCookies.join('; ')];
+            }
+        }
+        catch (e) {
+            this.config.logger.error(`Caught error preparing first party headers: ${e}`);
+        }
+        return headers;
+    }
+    setHostHeader(headers, url) {
+        const { host } = URLUtils.parseURL(url);
+        headers[HOST_HEADER_NAME] = [host];
+    }
+    setXffHeader(headers, ip) {
+        const xffValue = headers[X_FORWARDED_FOR_HEADER_NAME] || [];
+        headers[X_FORWARDED_FOR_HEADER_NAME] = xffValue.concat([ip]);
+    }
+    addFirstPartyHeaders(headers, ip) {
+        headers[FIRST_PARTY_HEADER_NAME] = [FIRST_PARTY_HEADER_VALUE];
+        headers[X_PX_ENFORCER_TRUE_IP_HEADER_NAME] = [ip];
+    }
+    getThirdPartySensorScriptUrl() {
+        return `${this.config.backendClientUrl}/${this.config.appId}/main.min.js`;
+    }
+    getThirdPartyCaptchaScriptUrl(context) {
+        const originalUrl = context.requestData.url;
+        const { appId, backendCaptchaUrl } = this.config;
+        return `${backendCaptchaUrl}/${appId}${FirstPartySuffix.CAPTCHA}.js${originalUrl.search}`;
+    }
+    getThirdPartyXhrUrl(context, prefix) {
+        const originalUrl = context.requestData.url;
+        const { backendCollectorUrl } = this.config;
+        return `${backendCollectorUrl}${originalUrl.pathname.replace(prefix, '')}${originalUrl.search}`;
+    }
+}

package/lib/esm/products/bot_defender/first_party/constants.js

@@ -0,0 +1,29 @@
+import { ContentType, CONTENT_TYPE_HEADER_NAME } from '../../../http';
+export const X_PX_ENFORCER_TRUE_IP_HEADER_NAME = 'x-px-enforcer-true-ip';
+export const FIRST_PARTY_HEADER_NAME = 'x-px-first-party';
+export const FIRST_PARTY_HEADER_VALUE = '1';
+export const DEFAULT_CLIENT_RESPONSE_OPTIONS = {
+    body: '',
+    status: 200,
+    headers: {
+        [CONTENT_TYPE_HEADER_NAME]: [ContentType.APPLICATION_JAVASCRIPT],
+    },
+};
+export const DEFAULT_XHR_RESPONSE = {
+    content: '{}',
+    options: {
+        status: 200,
+        headers: {
+            [CONTENT_TYPE_HEADER_NAME]: [ContentType.APPLICATION_JAVASCRIPT],
+        },
+    },
+};
+export const DEFAULT_GIF_RESPONSE = {
+    content: 'GIF89a\x01\x00\x01\x00\x80\x00\x00ÿÿÿ\x00\x00\x00,\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02D\x01\x00;',
+    options: {
+        status: 200,
+        headers: {
+            [CONTENT_TYPE_HEADER_NAME]: [ContentType.IMAGE_GIF],
+        },
+    },
+};

package/lib/esm/products/credential_intelligence/CredentialIntelligence.js

@@ -0,0 +1,75 @@
+import { Action } from '../../action';
+import { ActivityType, createAsyncActivity, ACTIVITIES_ENDPOINT } from '../../activities';
+import { CredentialEndpoint, CredentialEndpointManager, CredentialExtractorFactory, CredentialIntelligenceEndpointMatcherFactory, CredentialIntelligenceHashProtocolFactory, LoginSuccessfulParserFactory, } from './endpoint';
+import { ADDITIONAL_S2S_ACTIVITY_HEADER_NAME, ADDITIONAL_S2S_URL_HEADER_NAME, COMPROMISED_CREDENTIALS_HEADER_VALUE, } from './constants';
+export class CredentialIntelligence {
+    config;
+    endpointManager;
+    constructor(config, hashUtils) {
+        this.config = config;
+        this.endpointManager = new CredentialEndpointManager(this.initializeCredentialIntelligenceEndpoints(config, hashUtils));
+    }
+    async enrichContextFromRequest(context) {
+        const endpointIndex = this.endpointManager.getEndpointIndex(context);
+        if (endpointIndex === -1) {
+            return null;
+        }
+        const data = await this.endpointManager.getCredentialsData(endpointIndex, context);
+        if (!data) {
+            return null;
+        }
+        return { ...data, endpointIndex, action: Action.TRIGGER_RISK_API, reason: 'sensitive_route' };
+    }
+    async enrichContextFromRiskApi(context) {
+        if (!context.productData.ci) {
+            return;
+        }
+        const isCompromised = !!context.riskApiData.riskResponse?.dataEnrichment?.breached_account;
+        return { action: undefined, reason: undefined, isCompromised };
+    }
+    async modifyIncomingRequest(context) {
+        if (!context.productData.ci) {
+            return;
+        }
+        const { productData: { ci: { isCompromised }, }, requestData: { request }, } = context;
+        if (isCompromised) {
+            this.setCompromisedCredentialHeader(request);
+        }
+        if (this.shouldSetAdditionalS2SActivityHeaders()) {
+            this.setAdditionalS2SActivityHeaders(request, context);
+        }
+    }
+    async enrichContextFromResponse(context) {
+        if (!context.productData.ci) {
+            return;
+        }
+        return { isLoginSuccessful: await this.isLoginSuccessful(context) };
+    }
+    async modifyOutgoingResponse(context) {
+        // intentionally left blank
+    }
+    async isLoginSuccessful(context) {
+        const { endpointIndex } = context.productData.ci;
+        return await this.endpointManager.isLoginSuccessful(endpointIndex, context);
+    }
+    setCompromisedCredentialHeader(request) {
+        request.headers.set(this.config.ciCompromisedCredentialsHeaderName, COMPROMISED_CREDENTIALS_HEADER_VALUE);
+    }
+    shouldSetAdditionalS2SActivityHeaders() {
+        return !this.config.ciAutomaticAdditionalS2SEnabled && this.config.ciAdditionalS2SHeaderEnabled;
+    }
+    setAdditionalS2SActivityHeaders(request, context) {
+        const activity = createAsyncActivity(ActivityType.ADDITIONAL_S2S, this.config, context);
+        request.headers.set(ADDITIONAL_S2S_ACTIVITY_HEADER_NAME, JSON.stringify(activity));
+        request.headers.set(ADDITIONAL_S2S_URL_HEADER_NAME, `${this.config.backendCollectorUrl}${ACTIVITIES_ENDPOINT}`);
+    }
+    initializeCredentialIntelligenceEndpoints(config, hashUtils) {
+        return config.ciEndpoints.map((endpointConfig) => {
+            const matcher = CredentialIntelligenceEndpointMatcherFactory.create(endpointConfig);
+            const extractor = CredentialExtractorFactory.create(endpointConfig);
+            const protocol = CredentialIntelligenceHashProtocolFactory.create((endpointConfig.protocol ?? config.ciDefaultVersion), hashUtils);
+            const loginSuccessfulParser = LoginSuccessfulParserFactory.create(config, endpointConfig);
+            return new CredentialEndpoint(config, matcher, extractor, protocol, loginSuccessfulParser);
+        });
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/CredentialEndpoint.js

@@ -0,0 +1,29 @@
+export class CredentialEndpoint {
+    config;
+    matcher;
+    extractor;
+    protocol;
+    loginSuccessfulParser;
+    constructor(config, matcher, extractor, protocol, loginSuccessfulParser) {
+        this.config = config;
+        this.matcher = matcher;
+        this.extractor = extractor;
+        this.protocol = protocol;
+        this.loginSuccessfulParser = loginSuccessfulParser;
+    }
+    matches(requestData) {
+        return this.matcher.matches(requestData);
+    }
+    async getCredentialData(request) {
+        const credentials = await this.extractor.extractCredentials(request);
+        if (!credentials?.user && !credentials?.pass) {
+            this.config.logger.debug('unable to extract credentials');
+            return null;
+        }
+        this.config.logger.debug(`successfully extracted credentials`);
+        return await this.protocol.hashCredentials(credentials);
+    }
+    async isLoginSuccessful(response) {
+        return this.loginSuccessfulParser.isLoginSuccessful(response);
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/CredentialEndpointManager.js

@@ -0,0 +1,19 @@
+export class CredentialEndpointManager {
+    config;
+    endpoints;
+    constructor(endpoints) {
+        this.endpoints = endpoints;
+    }
+    getEndpointIndex({ requestData }) {
+        return this.endpoints.findIndex((endpoint) => endpoint.matches(requestData));
+    }
+    async getCredentialsData(endpointIndex, { requestData }) {
+        return await this.endpoints[endpointIndex]?.getCredentialData(requestData.request);
+    }
+    async isLoginSuccessful(endpointIndex, { response }) {
+        if (!response) {
+            return undefined;
+        }
+        return await this.endpoints[endpointIndex]?.isLoginSuccessful(response);
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/extractor/BodyCredentialExtractor.js

@@ -0,0 +1,53 @@
+import { CONTENT_TYPE_HEADER_NAME, ContentType } from '../../../../http';
+import { getPropertyFromObject } from '../../../../utils';
+export class BodyCredentialExtractor {
+    userField;
+    passField;
+    constructor(userField, passField) {
+        this.userField = userField;
+        this.passField = passField;
+    }
+    async extractCredentials(request) {
+        try {
+            const contentType = request.headers.get(CONTENT_TYPE_HEADER_NAME);
+            const credentials = await this.extractFromBody(contentType, request);
+            return typeof credentials?.user === 'string' || typeof credentials?.pass === 'string' ? credentials : null;
+        }
+        catch (e) {
+            return null;
+        }
+    }
+    async extractFromBody(contentType, request) {
+        if (contentType.includes('json')) {
+            return this.extractFromJson(await request.json());
+        }
+        else if (contentType.includes(ContentType.APPLICATION_X_WWW_FORM_URL_ENCODED)) {
+            return this.extractFromUrlEncoded(await request.formUrlEncoded());
+        }
+        else if (contentType.includes(ContentType.MULTIPART_FORM_DATA)) {
+            return this.extractFromMultipart(await request.formData());
+        }
+        return null;
+    }
+    extractFromJson(json) {
+        if (!json) {
+            return null;
+        }
+        const user = getPropertyFromObject(json, ...this.userField.split('.'));
+        const pass = getPropertyFromObject(json, ...this.passField.split('.'));
+        return { user, pass };
+    }
+    extractFromUrlEncoded(params) {
+        const user = params.get(this.userField);
+        const pass = params.get(this.passField);
+        return { user, pass };
+    }
+    extractFromMultipart(formData) {
+        const user = this.formDataEntryValueToString(formData.get(this.userField));
+        const pass = this.formDataEntryValueToString(formData.get(this.passField));
+        return { user, pass };
+    }
+    formDataEntryValueToString(entry) {
+        return typeof entry === 'string' ? entry : null;
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/extractor/CustomCredentialExtractor.js

@@ -0,0 +1,14 @@
+export class CustomCredentialExtractor {
+    callback;
+    constructor(callback) {
+        this.callback = callback;
+    }
+    async extractCredentials(request) {
+        try {
+            return await this.callback(request.getUnderlyingRequest());
+        }
+        catch (e) {
+            return null;
+        }
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/extractor/HeaderCredentialExtractor.js

@@ -0,0 +1,13 @@
+export class HeaderCredentialExtractor {
+    userField;
+    passField;
+    constructor(userField, passField) {
+        this.userField = userField;
+        this.passField = passField;
+    }
+    extractCredentials(request) {
+        const user = request.headers.get(this.userField);
+        const pass = request.headers.get(this.passField);
+        return typeof user === 'string' || typeof pass === 'string' ? { user, pass } : null;
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/extractor/QueryParamCredentialExtractor.js

@@ -0,0 +1,18 @@
+import { URLUtils } from '../../../../http';
+export class QueryParamCredentialExtractor {
+    userField;
+    passField;
+    constructor(userField, passField) {
+        this.userField = userField;
+        this.passField = passField;
+    }
+    async extractCredentials(request) {
+        const { searchParams } = URLUtils.parseURL(request.url);
+        if (!searchParams) {
+            return null;
+        }
+        const user = searchParams.get(this.userField);
+        const pass = searchParams.get(this.passField);
+        return typeof user === 'string' || typeof pass === 'string' ? { user, pass } : null;
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/hash_protocol/MultistepHashProtocol.js

@@ -0,0 +1,20 @@
+import { Algorithm } from '../../../../utils';
+import { SsoStep } from './SsoStep';
+import { CredentialIntelligenceVersion } from './CredentialIntelligenceVersion';
+export class MultistepHashProtocol {
+    hashUtils;
+    constructor(hashUtils) {
+        this.hashUtils = hashUtils;
+    }
+    async hashCredentials({ user, pass }) {
+        const rawUsername = user ?? null;
+        const hashedPassword = typeof pass === 'string' ? await this.hashUtils.hashString(pass, Algorithm.SHA256) : null;
+        return {
+            rawUsername,
+            hashedUsername: rawUsername,
+            hashedPassword,
+            ciVersion: CredentialIntelligenceVersion.MULTI_STEP,
+            ssoStep: user ? SsoStep.USER : SsoStep.PASS,
+        };
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/hash_protocol/SingleStepAndMultistepHashProtocol.js

@@ -0,0 +1,16 @@
+export class SingleStepAndMultistepHashProtocol {
+    singleStepHashProtocol;
+    multistepHashProtocol;
+    constructor(singleStepHashProtocol, multistepHashProtocol) {
+        this.singleStepHashProtocol = singleStepHashProtocol;
+        this.multistepHashProtocol = multistepHashProtocol;
+    }
+    async hashCredentials(credentials) {
+        if (credentials.user && credentials.pass) {
+            return this.singleStepHashProtocol.hashCredentials(credentials);
+        }
+        else {
+            return this.multistepHashProtocol.hashCredentials(credentials);
+        }
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/hash_protocol/SingleStepHashProtocol.js

@@ -0,0 +1,37 @@
+import { Algorithm, isEmailAddress } from '../../../../utils';
+import { CredentialIntelligenceVersion } from './CredentialIntelligenceVersion';
+export class SingleStepHashProtocol {
+    hashUtils;
+    constructor(hashUtils) {
+        this.hashUtils = hashUtils;
+    }
+    async hashCredentials({ user, pass }) {
+        const normalizedUsername = isEmailAddress(user) ? this.normalizeEmailAddress(user) : user;
+        const hashedUsername = await this.sha256(normalizedUsername);
+        const hashedPassword = await this.sha256(hashedUsername + (await this.sha256(pass)));
+        return {
+            ciVersion: CredentialIntelligenceVersion.SINGLE_STEP,
+            rawUsername: user,
+            hashedUsername,
+            hashedPassword,
+        };
+    }
+    normalizeEmailAddress(emailAddress) {
+        const lowercaseEmail = emailAddress.trim().toLowerCase();
+        const atIndex = lowercaseEmail.indexOf('@');
+        const domain = lowercaseEmail.substring(atIndex);
+        let normalizedUsername = lowercaseEmail.substring(0, atIndex);
+        const plusIndex = normalizedUsername.indexOf('+');
+        if (plusIndex > -1) {
+            normalizedUsername = normalizedUsername.substring(0, plusIndex);
+        }
+        const GMAIL_DOMAIN = '@gmail.com';
+        if (domain === GMAIL_DOMAIN) {
+            normalizedUsername = normalizedUsername.replace('.', '');
+        }
+        return `${normalizedUsername}${domain}`;
+    }
+    async sha256(text) {
+        return await this.hashUtils.hashString(text, Algorithm.SHA256);
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/login_successful/BodyLoginSuccessfulParser.js

@@ -0,0 +1,10 @@
+export class BodyLoginSuccessfulParser {
+    bodyRegex;
+    constructor(regex) {
+        this.bodyRegex = new RegExp(regex);
+    }
+    async isLoginSuccessful(response) {
+        // TODO: Possibly add IBody methods to IOutgoingResponse interface?
+        return this.bodyRegex.test(response.body);
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/login_successful/CustomLoginSuccessfulParser.js

@@ -0,0 +1,16 @@
+export class CustomLoginSuccessfulParser {
+    callback;
+    constructor(callback) {
+        this.callback = callback;
+    }
+    async isLoginSuccessful(response) {
+        try {
+            const retVal = await this.callback(response.getUnderlyingResponse());
+            return typeof retVal === 'boolean' ? retVal : null;
+        }
+        catch {
+            // We cannot say definitively if the login was successful or not here
+            return null;
+        }
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/login_successful/HeaderLoginSuccessfulParser.js

@@ -0,0 +1,14 @@
+export class HeaderLoginSuccessfulParser {
+    headerName;
+    headerValue;
+    constructor(headerName, headerValue) {
+        this.headerName = headerName;
+        this.headerValue = headerValue || null;
+    }
+    async isLoginSuccessful(response) {
+        if (this.headerValue) {
+            return response.headers.get(this.headerName) === this.headerValue;
+        }
+        return response.headers.has(this.headerName);
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/login_successful/LoginSuccessfulParserFactory.js

@@ -0,0 +1,27 @@
+import { LoginSuccessfulReportingMethod } from './LoginSuccessfulReportingMethod';
+import { BodyLoginSuccessfulParser } from './BodyLoginSuccessfulParser';
+import { CustomLoginSuccessfulParser } from './CustomLoginSuccessfulParser';
+import { HeaderLoginSuccessfulParser } from './HeaderLoginSuccessfulParser';
+import { StatusLoginSuccessfulParser } from './StatusLoginSuccessfulParser';
+import { EnforcerError } from '../../../../utils';
+export class LoginSuccessfulParserFactory {
+    static create(config, endpointConfig) {
+        const { ciDefaultLoginSuccessfulReportingMethod, ciDefaultLoginSuccessfulBodyRegex, ciDefaultLoginSuccessfulStatus, ciDefaultLoginSuccessfulCustomCallback, ciDefaultLoginSuccessfulHeaderName, ciDefaultLoginSuccessfulHeaderValue, } = config;
+        const { login_successful_reporting_method, login_successful_callback, login_successful_statuses, login_successful_body_regex, login_successful_header_name, login_successful_header_value, } = endpointConfig;
+        const reportingMethod = login_successful_reporting_method ??
+            ciDefaultLoginSuccessfulReportingMethod ??
+            LoginSuccessfulReportingMethod.STATUS;
+        switch (reportingMethod) {
+            case LoginSuccessfulReportingMethod.BODY:
+                return new BodyLoginSuccessfulParser(login_successful_body_regex ?? ciDefaultLoginSuccessfulBodyRegex);
+            case LoginSuccessfulReportingMethod.CUSTOM:
+                return new CustomLoginSuccessfulParser(login_successful_callback ?? ciDefaultLoginSuccessfulCustomCallback);
+            case LoginSuccessfulReportingMethod.HEADER:
+                return new HeaderLoginSuccessfulParser(login_successful_header_name ?? ciDefaultLoginSuccessfulHeaderName, login_successful_header_value ?? ciDefaultLoginSuccessfulHeaderValue);
+            case LoginSuccessfulReportingMethod.STATUS:
+                return new StatusLoginSuccessfulParser(login_successful_statuses ?? ciDefaultLoginSuccessfulStatus);
+            default:
+                throw new EnforcerError('unknown login successful reporting method defined');
+        }
+    }
+}