perimeterx-js-core 0.7.1 → 0.9.0

package/lib/esm/products/credential_intelligence/endpoint/login_successful/StatusLoginSuccessfulParser.js

@@ -0,0 +1,9 @@
+export class StatusLoginSuccessfulParser {
+    statuses;
+    constructor(statuses) {
+        this.statuses = statuses;
+    }
+    async isLoginSuccessful(response) {
+        return this.statuses.includes(response.status);
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/matcher/ExactPathEndpointMatcher.js

@@ -0,0 +1,11 @@
+export class ExactPathEndpointMatcher {
+    pathname;
+    method;
+    constructor(pathname, method) {
+        this.pathname = pathname;
+        this.method = method;
+    }
+    matches({ method, url }) {
+        return method === this.method && url.pathname === this.pathname;
+    }
+}

package/lib/esm/products/credential_intelligence/endpoint/matcher/RegexPathEndpointMatcher.js

@@ -0,0 +1,11 @@
+export class RegexPathEndpointMatcher {
+    pathnameRegex;
+    method;
+    constructor(pathname, method) {
+        this.pathnameRegex = pathname;
+        this.method = method;
+    }
+    matches({ method, url }) {
+        return method === this.method && this.pathnameRegex.test(url.pathname);
+    }
+}

package/lib/esm/pxde/DefaultDataEnrichment.js

@@ -0,0 +1,60 @@
+import { Algorithm, PXDE_COOKIE_NAME } from '../utils';
+import { PXDE_COOKIE_DELIMITER, PXDE_COOKIE_PARTS_COUNT, PXDE_HMAC_INDEX, PXDE_PAYLOAD_INDEX } from './constants';
+export class DefaultDataEnrichment {
+    config;
+    base64Utils;
+    hmacUtils;
+    constructor(config, base64Utils, hmacUtils) {
+        this.config = config;
+        this.base64Utils = base64Utils;
+        this.hmacUtils = hmacUtils;
+    }
+    async handlePxde(context) {
+        try {
+            const pxdeCookie = context.requestData.cookies[PXDE_COOKIE_NAME];
+            if (pxdeCookie) {
+                return await this.parsePxde(pxdeCookie);
+            }
+        }
+        catch (e) {
+            this.config.logger.debug(`unable to parse pxde cookie - ${e}`);
+        }
+        return null;
+    }
+    async parsePxde(pxdeCookie) {
+        const pxdeParts = pxdeCookie.split(PXDE_COOKIE_DELIMITER);
+        if (pxdeParts.length !== PXDE_COOKIE_PARTS_COUNT) {
+            this.config.logger.debug(`malformed pxde cookie: ${pxdeCookie}`);
+            return null;
+        }
+        const hmac = pxdeParts[PXDE_HMAC_INDEX];
+        const encodedPayload = pxdeParts[PXDE_PAYLOAD_INDEX];
+        if (!hmac || !encodedPayload) {
+            this.config.logger.debug(`malformed pxde cookie: hmac: ${hmac}, payload: ${encodedPayload}`);
+            return null;
+        }
+        return {
+            pxde: await this.parsePxdePayload(encodedPayload),
+            pxdeVerified: await this.verifyPxdeHmac(hmac, encodedPayload),
+        };
+    }
+    async verifyPxdeHmac(givenHmac, encodedPayload) {
+        try {
+            return givenHmac === this.hmacUtils.createHmac(Algorithm.SHA256, encodedPayload, this.config.cookieSecret);
+        }
+        catch (e) {
+            this.config.logger.debug(`failed verifying pxde hmac: ${e}`);
+            return false;
+        }
+    }
+    async parsePxdePayload(encodedPayload) {
+        try {
+            const decodedPayload = this.base64Utils.base64Decode(encodedPayload);
+            return JSON.parse(decodedPayload);
+        }
+        catch (e) {
+            this.config.logger.debug(`failed parsing pxde payload: ${e}`);
+            return null;
+        }
+    }
+}

package/lib/esm/pxhd/PXHDUtils.js

@@ -0,0 +1,28 @@
+import { PXHD_COOKIE_NAME } from '../utils';
+import { MinimalResponseUtils, SET_COOKIE_HEADER_NAME } from '../http';
+export var PXHDUtils;
+(function (PXHDUtils) {
+    PXHDUtils.PXHD_SAMESITE_VALUE = 'Lax';
+    PXHDUtils.PXHD_PATH_VALUE = '/';
+    PXHDUtils.addPxhdToOutgoingResponse = (context, response) => {
+        if (!context?.pxhd) {
+            return;
+        }
+        const setPxhdCookie = PXHDUtils.getPxhdCookieValue(context.pxhd);
+        response.headers.append(SET_COOKIE_HEADER_NAME, setPxhdCookie);
+    };
+    PXHDUtils.addPxhdToMinimalResponse = (context, response) => {
+        if (context?.pxhd) {
+            const setPxhdCookie = PXHDUtils.getPxhdCookieValue(context.pxhd);
+            return MinimalResponseUtils.appendHeader(response, SET_COOKIE_HEADER_NAME, setPxhdCookie);
+        }
+        return response;
+    };
+    PXHDUtils.getPxhdCookieValue = (pxhd) => {
+        const value = `${PXHD_COOKIE_NAME}=${pxhd.value}`;
+        const domain = pxhd.domain && `domain=${pxhd.domain}`;
+        const path = `path=${PXHDUtils.PXHD_PATH_VALUE}`;
+        const sameSite = `SameSite=${PXHDUtils.PXHD_SAMESITE_VALUE}`;
+        return [value, domain, path, sameSite].filter(Boolean).join('; ');
+    };
+})(PXHDUtils || (PXHDUtils = {}));

package/lib/esm/risk_api/client/PostRiskApiClientBase.js

@@ -0,0 +1,134 @@
+import { AUTHORIZATION_HEADER_NAME, CONTENT_TYPE_HEADER_NAME, ContentType, HttpMethod, OutgoingRequestImpl, } from '../../http';
+import { EnforcerErrorName, getAuthorizationHeader, removeSensitiveHeaders, } from '../../utils';
+import { createCommonActivityDetails, toHeaderEntryArray } from '../../activities';
+import { RISK_API_ENDPOINT } from '../constants';
+import { RiskApiCallResult, RiskStatus, S2SErrorReason } from '../model';
+export class PostRiskApiClientBase {
+    config;
+    httpClient;
+    constructor(config, httpClient) {
+        this.config = config;
+        this.httpClient = httpClient;
+    }
+    /**
+     * Builds the Risk API activity, sends the request, and returns RiskApiData with the response.
+     * @param context
+     * @returns Promise<RiskApiData>
+     */
+    async executeRiskApi(context) {
+        let response, riskResponse;
+        const riskApiData = { riskApiCallResult: RiskApiCallResult.NONE };
+        try {
+            const riskActivity = this.createRiskActivity(context);
+            response = await this.sendRiskActivity(riskActivity, riskApiData);
+            if (response?.status !== 200) {
+                return await this.handleS2SError(riskApiData, response);
+            }
+            riskResponse = this.createRiskResponse(response);
+            riskApiData.riskResponse = riskResponse;
+            if (!(await riskResponse.validate())) {
+                return await this.handleS2SError(riskApiData, response);
+            }
+            this.config.logger.debug(`received risk response, score: ${riskResponse.score}, rtt: ${riskApiData.riskRtt}`);
+            return riskApiData;
+        }
+        catch (err) {
+            if (err.name === EnforcerErrorName.ENFORCER_TIMEOUT_ERROR) {
+                return this.handleS2STimeout(riskApiData);
+            }
+            this.config.logger.error(`caught error in risk api: ${err} - ${JSON.stringify(context.requestData.url)}`);
+            return await this.handleS2SError(riskApiData, response, err);
+        }
+    }
+    /**
+     * Creates the RiskActivity payload
+     * @param context
+     * @returns RiskActivity
+     * @protected
+     */
+    createRiskActivity(context) {
+        const riskActivity = {
+            vid: context.vid,
+            client_uuid: context.uuid,
+            pxhd: context.pxhd?.value,
+            request: {
+                socket_ip: context.requestData.ip,
+                headers: this.formatRiskHeadersField(context.requestData.headers),
+                url: context.requestData.rawUrl,
+            },
+            additional: {
+                ...createCommonActivityDetails(this.config, context),
+                s2s_call_reason: context.riskApiData.s2sCallReason,
+            },
+        };
+        return this.finalizeRiskActivity(riskActivity);
+    }
+    /**
+     * Protected function in case expansions or alterations to the risk activity are needed for certain platforms.
+     * @param riskActivity
+     * @returns RiskActivity
+     * @protected
+     */
+    finalizeRiskActivity(riskActivity) {
+        return riskActivity;
+    }
+    formatRiskHeadersField(headers) {
+        const headersWithoutSensitive = removeSensitiveHeaders(headers, this.config.sensitiveHeaders);
+        return toHeaderEntryArray(headersWithoutSensitive);
+    }
+    async sendRiskActivity(riskActivity, riskApiData) {
+        const url = this.getRiskUrl();
+        const headers = this.getRiskHeaders();
+        const body = JSON.stringify(riskActivity);
+        const method = HttpMethod.POST;
+        const riskRequest = new OutgoingRequestImpl({ url, method, headers, body });
+        this.config.logger.debug(`sending risk api to ${url}`);
+        const startTime = Date.now();
+        const response = await this.httpClient.send(riskRequest, { timeoutMs: this.config.s2sTimeout });
+        const endTime = Date.now();
+        riskApiData.riskApiCallResult = RiskApiCallResult.SUCCESSFUL;
+        riskApiData.riskRtt = endTime - startTime;
+        return response;
+    }
+    getRiskUrl() {
+        return `${this.config.backendScoreApiUrl}${RISK_API_ENDPOINT}`;
+    }
+    getRiskHeaders() {
+        return {
+            [CONTENT_TYPE_HEADER_NAME]: [ContentType.APPLICATION_JSON],
+            [AUTHORIZATION_HEADER_NAME]: [getAuthorizationHeader(this.config.authToken)],
+        };
+    }
+    handleS2STimeout(riskApiData) {
+        riskApiData.riskApiCallResult = RiskApiCallResult.TIMEOUT;
+        return riskApiData;
+    }
+    async handleS2SError(riskApiData, response, error) {
+        riskApiData.riskApiCallResult = RiskApiCallResult.ERROR;
+        riskApiData.errorReason = S2SErrorReason.UNKNOWN_ERROR;
+        if (response || riskApiData.riskResponse) {
+            riskApiData.errorHttpStatus = response.status;
+            riskApiData.errorMessage = riskApiData.riskResponse?.message || `response body: ${await response.text()}`;
+            if (response.status === 200) {
+                if (riskApiData.riskResponse?.status === RiskStatus.FAILURE) {
+                    riskApiData.errorReason = S2SErrorReason.REQUEST_FAILED_ON_SERVER;
+                }
+                else if (!(await riskApiData.riskResponse?.validate())) {
+                    riskApiData.errorReason = S2SErrorReason.INVALID_RESPONSE;
+                }
+            }
+            else if (response.status >= 400 && response.status < 500) {
+                riskApiData.errorReason = S2SErrorReason.BAD_REQUEST;
+            }
+            else if (response.status >= 500 && response.status < 600) {
+                riskApiData.errorReason = S2SErrorReason.SERVER_ERROR;
+            }
+        }
+        if (error) {
+            const errorMessage = `${error}`;
+            const existingMessage = riskApiData.errorMessage;
+            riskApiData.errorMessage = existingMessage ? `${existingMessage}, ${errorMessage}` : errorMessage;
+        }
+        return riskApiData;
+    }
+}

package/lib/esm/risk_api/risk_response/RiskResponseBase.js

@@ -0,0 +1,41 @@
+import { RiskStatus } from '../model';
+export class RiskResponseBase {
+    response;
+    riskResponse;
+    constructor(response) {
+        this.response = response;
+    }
+    async validate() {
+        try {
+            this.riskResponse = (await this.response.json());
+            return this.status === RiskStatus.SUCCESS && this.validateRiskResponseScore();
+        }
+        catch (e) {
+            return false;
+        }
+    }
+    get status() {
+        return this.riskResponse?.status;
+    }
+    get action() {
+        return this.riskResponse?.action;
+    }
+    get message() {
+        return this.riskResponse?.message;
+    }
+    get pxhd() {
+        return this.riskResponse?.pxhd;
+    }
+    get uuid() {
+        return this.riskResponse?.uuid;
+    }
+    get dataEnrichment() {
+        return this.riskResponse?.data_enrichment;
+    }
+    get pxhdDomain() {
+        return this.riskResponse?.pxhdDomain;
+    }
+    get additionalRiskInfo() {
+        return this.riskResponse?.additional_risk_info;
+    }
+}

package/lib/esm/risk_api/risk_response/v2/DefaultRiskResponseV2.js

@@ -0,0 +1,16 @@
+import { RiskResponseBase } from '../RiskResponseBase';
+export class DefaultRiskResponseV2 extends RiskResponseBase {
+    constructor(response) {
+        super(response);
+    }
+    get score() {
+        return typeof this.riskResponse?.cookie_cfg_block_result === 'undefined'
+            ? undefined
+            : this.riskResponse?.cookie_cfg_block_result === '1'
+                ? 100
+                : 0;
+    }
+    validateRiskResponseScore() {
+        return ['0', '1'].includes(this.riskResponse?.cookie_cfg_block_result);
+    }
+}

package/lib/esm/risk_api/risk_response/v3/DefaultRiskResponseV3.js

@@ -0,0 +1,12 @@
+import { RiskResponseBase } from '../RiskResponseBase';
+export class DefaultRiskResponseV3 extends RiskResponseBase {
+    constructor(response) {
+        super(response);
+    }
+    get score() {
+        return this.riskResponse?.score;
+    }
+    validateRiskResponseScore() {
+        return typeof this.riskResponse?.score === 'number';
+    }
+}

package/lib/esm/risk_token/parser/TokenParserBase.js

@@ -0,0 +1,83 @@
+import { X_PX_AUTHORIZATION_HEADER_NAME, X_PX_BYPASS_REASON_HEADER_NAME, X_PX_ORIGINAL_TOKEN_HEADER_NAME, } from '../../utils';
+import { TokenParseResult } from '../TokenParseResult';
+import { COOKIE_SPLIT_DELIMITER } from '../constants';
+import { convertMobileTokenVersionToCookieName } from '../utils';
+export class TokenParserBase {
+    config;
+    options;
+    constructor(config, options) {
+        this.config = config;
+        this.options = options;
+    }
+    async parseToken(context) {
+        const tokenData = this.initializeToken(context);
+        try {
+            if (!tokenData.token) {
+                this.config.logger.debug('no token found');
+                await this.handleMobileErrorIfNeeded(context, tokenData);
+                return tokenData;
+            }
+            tokenData.tokenParseResult = await tokenData.token.verify(context);
+        }
+        catch (e) {
+            this.config.logger.debug(`could not parse token - ${e}`);
+            tokenData.tokenParseResult = tokenData.token ? TokenParseResult.DECRYPTION_FAILED : TokenParseResult.NONE;
+        }
+        return tokenData;
+    }
+    initializeToken({ requestData, isMobile }) {
+        if (isMobile) {
+            return this.createMobileTokenData(requestData);
+        }
+        else {
+            return this.createWebTokenData(requestData.cookies);
+        }
+    }
+    createMobileTokenData({ request }) {
+        const mobileToken = request.headers.get(X_PX_AUTHORIZATION_HEADER_NAME);
+        const tokenData = {
+            tokenParseResult: TokenParseResult.NONE,
+            token: this.getMobileToken(mobileToken),
+            mobileData: {
+                originalToken: this.getMobileToken(request.headers.get(X_PX_ORIGINAL_TOKEN_HEADER_NAME)),
+                bypassReason: request.headers.get(X_PX_BYPASS_REASON_HEADER_NAME) || '',
+            },
+        };
+        if (!tokenData.token && /^\d+$/.test(mobileToken)) {
+            tokenData.mobileData.mobileError = mobileToken;
+        }
+        return tokenData;
+    }
+    getMobileToken(mobileToken) {
+        try {
+            if (!mobileToken || mobileToken?.indexOf(COOKIE_SPLIT_DELIMITER) === -1) {
+                return null;
+            }
+            const [tokenVersion, ...cookieString] = mobileToken.split(COOKIE_SPLIT_DELIMITER);
+            const cookieName = convertMobileTokenVersionToCookieName(tokenVersion);
+            if (!cookieName) {
+                return null;
+            }
+            return this.createToken(this.config, { [cookieName]: cookieString.join(COOKIE_SPLIT_DELIMITER) }, this.options);
+        }
+        catch (e) {
+            this.config.logger.debug(`error extracting mobile token - ${e}, token: ${mobileToken}`);
+            return null;
+        }
+    }
+    createWebTokenData(cookies) {
+        return {
+            tokenParseResult: TokenParseResult.NONE,
+            token: this.createToken(this.config, cookies, this.options),
+        };
+    }
+    async handleMobileErrorIfNeeded(context, { mobileData }) {
+        if (!mobileData || !mobileData.mobileError || !mobileData.originalToken) {
+            return;
+        }
+        mobileData.originalTokenParseResult = await mobileData.originalToken.verify(context);
+        if (mobileData.originalTokenParseResult === TokenParseResult.SUCCESSFUL) {
+            mobileData.decodedOriginalToken = mobileData.originalToken.getPayloadString();
+        }
+    }
+}

package/lib/esm/risk_token/token/TokenBase.js

@@ -0,0 +1,45 @@
+import { TokenParseResult } from '../TokenParseResult';
+export class TokenBase {
+    logger;
+    payload;
+    cookieString;
+    cookieSecret;
+    cookieMaxLength;
+    isValidated;
+    constructor(config, cookieString) {
+        this.logger = config.logger;
+        this.cookieSecret = config.cookieSecret;
+        this.cookieMaxLength = config.riskCookieMaxLength;
+        this.cookieString = cookieString;
+        this.isValidated = false;
+    }
+    async verify(context) {
+        if (!this.cookieString) {
+            return TokenParseResult.NONE;
+        }
+        if (this.isValid()) {
+            return TokenParseResult.SUCCESSFUL;
+        }
+        if (this.cookieString.length > this.cookieMaxLength) {
+            return TokenParseResult.DECRYPTION_FAILED;
+        }
+        this.payload = this.payload || (await this.decrypt(context));
+        if (!this.payload) {
+            return TokenParseResult.DECRYPTION_FAILED;
+        }
+        if (!(await this.validate(context))) {
+            return TokenParseResult.VALIDATION_FAILED;
+        }
+        this.isValidated = true;
+        return TokenParseResult.SUCCESSFUL;
+    }
+    isValid() {
+        return this.isValidated;
+    }
+    getTokenString() {
+        return this.cookieString;
+    }
+    getPayloadString() {
+        return this.payload ? JSON.stringify(this.payload) : '';
+    }
+}

package/lib/esm/risk_token/token/v2/DefaultTokenV2.js

@@ -0,0 +1,97 @@
+import { BlockAction } from '../../../blocker';
+import { Algorithm, isValidUuid } from '../../../utils';
+import { TokenBase } from '../TokenBase';
+export class DefaultTokenV2 extends TokenBase {
+    base64Utils;
+    hmacUtils;
+    isHighRisk;
+    constructor(config, cookieString, base64Utils, hmacUtils) {
+        super(config, cookieString);
+        this.base64Utils = base64Utils;
+        this.hmacUtils = hmacUtils;
+        this.isHighRisk = undefined;
+    }
+    decrypt(context) {
+        try {
+            const payload = this.decode(this.cookieString);
+            if (payload?.t == null || payload?.h == null || payload?.u == null || payload?.v == null) {
+                return null;
+            }
+            return payload;
+        }
+        catch (e) {
+            this.logger.debug(`cookie v2 decryption failed: ${e}`);
+        }
+        return null;
+    }
+    async validate(context) {
+        if (typeof this.payload.t !== 'number' ||
+            !isValidUuid(this.payload.v) ||
+            !isValidUuid(this.payload.u) ||
+            !this.payload.h) {
+            return false;
+        }
+        try {
+            const signingFields = this.getSigningFields(context);
+            const passHmac = await this.calculateHmac(this.getHashParam('0', signingFields));
+            if (passHmac === this.payload.h) {
+                this.isHighRisk = false;
+                return true;
+            }
+            const blockHmac = await this.calculateHmac(this.getHashParam('1', signingFields));
+            if (blockHmac === this.payload.h) {
+                this.isHighRisk = true;
+                return true;
+            }
+        }
+        catch (e) {
+            this.logger.debug(`cookie v2 validation caught error: ${e}`);
+        }
+        return false;
+    }
+    decode(cookieString) {
+        const decodedCookie = this.base64Utils.base64Decode(cookieString);
+        return JSON.parse(decodedCookie);
+    }
+    getSigningFields(context) {
+        return context.isMobile ? '' : context.requestData.userAgent;
+    }
+    getHashParam(startingValue, signingFields) {
+        let hashParam = startingValue;
+        if (signingFields) {
+            hashParam += signingFields;
+        }
+        return hashParam;
+    }
+    async calculateHmac(param) {
+        const payload = `${this.payload.t}${this.payload.u}${this.payload.v}${param}`;
+        return this.hmacUtils.createHmac(Algorithm.SHA256, payload, this.cookieSecret);
+    }
+    isExpired() {
+        return Date.now() > this.payload?.t;
+    }
+    isHighScore() {
+        return this.isHighRisk;
+    }
+    get hmac() {
+        return this.payload?.h;
+    }
+    get timestamp() {
+        return this.payload?.t;
+    }
+    get uuid() {
+        return this.payload?.u;
+    }
+    get vid() {
+        return this.payload?.v;
+    }
+    get score() {
+        if (this.isValid()) {
+            return this.isHighScore() ? 100 : 0;
+        }
+        return undefined;
+    }
+    get action() {
+        return BlockAction.CAPTCHA;
+    }
+}

package/lib/esm/risk_token/token/v3/DefaultTokenV3.js

@@ -0,0 +1,123 @@
+import { Algorithm } from '../../../utils';
+import { COOKIE_SPLIT_DELIMITER, COOKIE_V3_HMAC_INDEX, COOKIE_V3_ITERATIONS_INDEX, COOKIE_V3_MAXIMUM_SALT_LENGTH, COOKIE_V3_PARTS_COUNT, COOKIE_V3_PAYLOAD_INDEX, COOKIE_V3_SALT_INDEX, } from '../../constants';
+import { TokenSignField } from './TokenSignField';
+import { TokenBase } from '../TokenBase';
+export class DefaultTokenV3 extends TokenBase {
+    maxIterations;
+    minIterations;
+    blockingScore;
+    cipherUtils;
+    hmacUtils;
+    hash;
+    constructor(config, cookieString, cipherUtils, hmacUtils) {
+        super(config, cookieString);
+        this.maxIterations = config.riskCookieMaxIterations;
+        this.minIterations = config.riskCookieMinIterations;
+        this.blockingScore = config.blockingScore;
+        this.cookieString = cookieString;
+        this.cipherUtils = cipherUtils;
+        this.hmacUtils = hmacUtils;
+    }
+    async decrypt(context) {
+        try {
+            const data = this.cookieString.split(COOKIE_SPLIT_DELIMITER);
+            if (data.length !== COOKIE_V3_PARTS_COUNT) {
+                return null;
+            }
+            this.hash = data[COOKIE_V3_HMAC_INDEX];
+            const salt = data[COOKIE_V3_SALT_INDEX];
+            const iterations = parseInt
+                ? parseInt(data[COOKIE_V3_ITERATIONS_INDEX])
+                : Number(data[COOKIE_V3_ITERATIONS_INDEX]);
+            const encryptedCookie = data[COOKIE_V3_PAYLOAD_INDEX];
+            if (!iterations || iterations > this.maxIterations || iterations < this.minIterations) {
+                return null;
+            }
+            if (!salt || typeof salt !== 'string' || salt.length > COOKIE_V3_MAXIMUM_SALT_LENGTH) {
+                return null;
+            }
+            if (!encryptedCookie || typeof encryptedCookie !== 'string') {
+                return null;
+            }
+            return await this.decryptPayload(encryptedCookie, salt, iterations);
+        }
+        catch (e) {
+            this.logger.debug(`cookie v3 decryption failed: ${e}`);
+        }
+        return null;
+    }
+    async decryptPayload(encryptedCookie, salt, iterations) {
+        try {
+            const decryptedCookie = await this.cipherUtils.pbkdf2Decrypt(this.cookieSecret, encryptedCookie, iterations, salt);
+            if (!decryptedCookie) {
+                return null;
+            }
+            return JSON.parse(decryptedCookie);
+        }
+        catch (e) {
+            this.logger.debug(`error decrypting cookie v3: ${e}`);
+            return null;
+        }
+    }
+    async validate(context) {
+        try {
+            const signedFields = this.getSignedWithFields(context);
+            const hmacStrBase = this.cookieString.substring(this.cookieString.indexOf(COOKIE_SPLIT_DELIMITER) + 1);
+            const payload = `${hmacStrBase}${signedFields.join('')}`;
+            const hash = this.hmacUtils.createHmac(Algorithm.SHA256, payload, this.cookieSecret);
+            return hash === this.hmac;
+        }
+        catch (e) {
+            this.logger.debug(`error validating cookie v3: ${e}`);
+            return false;
+        }
+    }
+    getSignedWithFields(context) {
+        if (context.isMobile) {
+            return [];
+        }
+        else if (this.payload?.x) {
+            return this.payload.x.split('').map((char) => this.getSignedWithField(char, context));
+        }
+        else {
+            return [context.requestData.userAgent];
+        }
+    }
+    getSignedWithField(char, { requestData }) {
+        switch (char) {
+            case TokenSignField.SOCKET_IP:
+                return requestData.ip;
+            case TokenSignField.USER_AGENT:
+                return requestData.userAgent;
+            default:
+                return '';
+        }
+    }
+    isExpired() {
+        return Date.now() > this.payload?.t;
+    }
+    isHighScore() {
+        if (!this.payload) {
+            return undefined;
+        }
+        return this.payload.s >= this.blockingScore;
+    }
+    get timestamp() {
+        return this.payload?.t;
+    }
+    get uuid() {
+        return this.payload?.u;
+    }
+    get vid() {
+        return this.payload?.v;
+    }
+    get score() {
+        return this.payload?.s;
+    }
+    get action() {
+        return this.payload?.a;
+    }
+    get hmac() {
+        return this.hash;
+    }
+}