perimeterx-js-core 1.0.1 → 1.1.0

package/lib/cjs/action/Action.js

@@ -22,4 +22,12 @@ var Action;
      * Indicates that the request should be blocked and a block response should be returned.
      */
     Action["BLOCK"] = "block";
+    /**
+     * Indicates that the client should be redirected to a specified URL with a 302 response.
+     */
+    Action["REDIRECT"] = "redirect";
+    /**
+     * Indicates that the client would be redirected, but no redirect response will be returned (monitor mode).
+     */
+    Action["SIMULATED_REDIRECT"] = "simulated_redirect";
 })(Action || (exports.Action = Action = {}));

package/lib/cjs/action/ActionPriorityOrder.js

@@ -7,6 +7,8 @@ var Action_1 = require("./Action.js");
  * and the first action that matches a product recommendation will be taken.
  */
 exports.ACTION_PRIORITY_ORDER = [
+    Action_1.Action.REDIRECT,
+    Action_1.Action.SIMULATED_REDIRECT,
     Action_1.Action.BLOCK,
     Action_1.Action.SIMULATED_BLOCK,
     Action_1.Action.TRIGGER_RISK_API,

package/lib/cjs/activities/ActivityType.js

@@ -7,4 +7,5 @@ var ActivityType;
     ActivityType["BLOCK"] = "block";
     ActivityType["ADDITIONAL_S2S"] = "additional_s2s";
     ActivityType["ENFORCER_TELEMETRY"] = "enforcer_telemetry";
+    ActivityType["PAGE_REDIRECTED"] = "page_redirected";
 })(ActivityType || (exports.ActivityType = ActivityType = {}));

package/lib/cjs/activities/HttpActivityClient.js

@@ -89,17 +89,30 @@ var HttpActivityClient = /** @class */ (function () {
      */
     HttpActivityClient.prototype.createActivities = function (context) {
         var activities = [];
-        if (this.shouldCreateBlockActivity(context)) {
-            activities.push(this.createBlockActivity(context));
+        if (this.shouldCreatePageRedirectedActivity(context)) {
+            activities.push(this.createPageRedirectedActivity(context));
         }
-        if (this.shouldCreatePageRequestedActivity(context)) {
-            activities.push(this.createPageRequestedActivity(context));
-        }
-        if (this.shouldCreateAdditionalS2SActivity(context)) {
-            activities.push(this.createAdditionalS2SActivity(context));
+        else {
+            if (this.shouldCreateBlockActivity(context)) {
+                activities.push(this.createBlockActivity(context));
+            }
+            if (this.shouldCreatePageRequestedActivity(context)) {
+                activities.push(this.createPageRequestedActivity(context));
+            }
+            if (this.shouldCreateAdditionalS2SActivity(context)) {
+                activities.push(this.createAdditionalS2SActivity(context));
+            }
         }
         return activities.map(this.finalizeActivity);
     };
+    /**
+     * Whether to create a page_redirected activity based on the context.
+     * @param context
+     * @protected
+     */
+    HttpActivityClient.prototype.shouldCreatePageRedirectedActivity = function (context) {
+        return context.action === action_1.Action.REDIRECT || context.action === action_1.Action.SIMULATED_REDIRECT;
+    };
     /**
      * Whether to create a block activity based on the context.
      * @param context
@@ -126,6 +139,14 @@ var HttpActivityClient = /** @class */ (function () {
             !!context.productData.ci &&
             this.config.ciAutomaticAdditionalS2SEnabled);
     };
+    /**
+     * Creates a page_redirected activity based on the context.
+     * @param context
+     * @protected
+     */
+    HttpActivityClient.prototype.createPageRedirectedActivity = function (context) {
+        return (0, utils_2.createAsyncActivity)(ActivityType_1.ActivityType.PAGE_REDIRECTED, this.config, context);
+    };
     /**
      * Creates a block activity based on the context.
      * @param context

package/lib/cjs/activities/utils.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.toHeaderEntryArray = exports.createAdditionalS2SActivityDetails = exports.createBlockActivityDetails = exports.createPageRequestedActivityDetails = exports.addResponseDataToAsyncActivityCommonDetails = exports.addRiskApiDataToAsyncActivityCommonDetails = exports.addTokenDataToDetails = exports.addRequestDataToDetails = exports.addServerDataToDetails = exports.addTlsDataToDetails = exports.addProductDataToDetails = exports.addCustomParametersToDetails = exports.addConfigDataToDetails = exports.addRootContextDataToDetails = exports.createCommonActivityDetails = exports.createAsyncActivityCommonDetails = exports.createActivityDetails = exports.createAsyncActivity = void 0;
+exports.toHeaderEntryArray = exports.createPageRedirectedActivityDetails = exports.createAdditionalS2SActivityDetails = exports.createBlockActivityDetails = exports.createPageRequestedActivityDetails = exports.addResponseDataToAsyncActivityCommonDetails = exports.addRiskApiDataToAsyncActivityCommonDetails = exports.addTokenDataToDetails = exports.addRequestDataToDetails = exports.addServerDataToDetails = exports.addTlsDataToDetails = exports.addProductDataToDetails = exports.addCustomParametersToDetails = exports.addConfigDataToDetails = exports.addRootContextDataToDetails = exports.createCommonActivityDetails = exports.createAsyncActivityCommonDetails = exports.createActivityDetails = exports.createAsyncActivity = void 0;
 exports.redactCookieSecret = redactCookieSecret;
 var utils_1 = require("../utils/index.js");
 var products_1 = require("../products/index.js");
@@ -52,6 +52,9 @@ var createActivityDetails = function (activityType, config, context) {
         case ActivityType_1.ActivityType.ADDITIONAL_S2S:
             specificActivityDetails = (0, exports.createAdditionalS2SActivityDetails)(config, context);
             break;
+        case ActivityType_1.ActivityType.PAGE_REDIRECTED:
+            specificActivityDetails = (0, exports.createPageRedirectedActivityDetails)(context);
+            break;
     }
     return Object.assign(commonActivityDetails, commonAsyncActivityDetails, specificActivityDetails);
 };
@@ -325,6 +328,22 @@ var createAdditionalS2SActivityDetails = function (_a, _b) {
     return details;
 };
 exports.createAdditionalS2SActivityDetails = createAdditionalS2SActivityDetails;
+var createPageRedirectedActivityDetails = function (context) {
+    var details = {
+        redirect_url: context.redirectUrl,
+        redirect_reason: 's2s',
+        simulated_redirect: context.action === action_1.Action.SIMULATED_REDIRECT,
+    };
+    var riskResponse = context.riskApiData.riskResponse;
+    if (riskResponse === null || riskResponse === void 0 ? void 0 : riskResponse.redirectRuleId) {
+        details.redirect_rule_id = riskResponse.redirectRuleId;
+    }
+    if (riskResponse === null || riskResponse === void 0 ? void 0 : riskResponse.redirectRuleName) {
+        details.redirect_rule_name = riskResponse.redirectRuleName;
+    }
+    return details;
+};
+exports.createPageRedirectedActivityDetails = createPageRedirectedActivityDetails;
 var toHeaderEntryArray = function (headers) {
     return Object.entries(headers).flatMap(function (_a) {
         var key = _a[0], values = _a[1];

package/lib/cjs/blocker/model/BlockAction.js

@@ -9,4 +9,5 @@ var BlockAction;
     BlockAction["CHALLENGE"] = "j";
     BlockAction["HYPE_SALE_CHALLENGE"] = "hsc";
     BlockAction["HYPE_SALE_CHALLENGE_LEGACY"] = "cp";
+    BlockAction["REDIRECT"] = "re";
 })(BlockAction || (exports.BlockAction = BlockAction = {}));

package/lib/cjs/flow/EnforceFlow.js

@@ -27,6 +27,7 @@ var EnforceFlow = /** @class */ (function (_super) {
             new phase_1.EnrichContextFromRequestPhase(config, products, dataEnrichment, graphQLParser),
             new phase_1.RiskApiPhase(products, riskApiClient),
             new phase_1.AdditionalActivityHandlerPhase(config),
+            new phase_1.CreateRedirectResponsePhase(config, cors),
             new phase_1.CreateBlockResponsePhase(config, phase_1.CreateBlockResponsePhase.getBlockers(products), cors),
             new phase_1.ModifyIncomingRequestPhase(Object.values(products)),
         ]) || this;

package/lib/cjs/phase/impl/CreateRedirectResponsePhase.js

@@ -0,0 +1,100 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __generator = (this && this.__generator) || function (thisArg, body) {
+    var _ = { label: 0, sent: function() { if (t[0] & 1) throw t[1]; return t[1]; }, trys: [], ops: [] }, f, y, t, g = Object.create((typeof Iterator === "function" ? Iterator : Object).prototype);
+    return g.next = verb(0), g["throw"] = verb(1), g["return"] = verb(2), typeof Symbol === "function" && (g[Symbol.iterator] = function() { return this; }), g;
+    function verb(n) { return function (v) { return step([n, v]); }; }
+    function step(op) {
+        if (f) throw new TypeError("Generator is already executing.");
+        while (g && (g = 0, op[0] && (_ = 0)), _) try {
+            if (f = 1, y && (t = op[0] & 2 ? y["return"] : op[0] ? y["throw"] || ((t = y["return"]) && t.call(y), 0) : y.next) && !(t = t.call(y, op[1])).done) return t;
+            if (y = 0, t) op = [op[0] & 2, t.value];
+            switch (op[0]) {
+                case 0: case 1: t = op; break;
+                case 4: _.label++; return { value: op[1], done: false };
+                case 5: _.label++; y = op[1]; op = [0]; continue;
+                case 7: op = _.ops.pop(); _.trys.pop(); continue;
+                default:
+                    if (!(t = _.trys, t = t.length > 0 && t[t.length - 1]) && (op[0] === 6 || op[0] === 2)) { _ = 0; continue; }
+                    if (op[0] === 3 && (!t || (op[1] > t[0] && op[1] < t[3]))) { _.label = op[1]; break; }
+                    if (op[0] === 6 && _.label < t[1]) { _.label = t[1]; t = op; break; }
+                    if (t && _.label < t[2]) { _.label = t[2]; _.ops.push(op); break; }
+                    if (t[2]) _.ops.pop();
+                    _.trys.pop(); continue;
+            }
+            op = body.call(thisArg, _);
+        } catch (e) { op = [6, e]; y = 0; } finally { f = t = 0; }
+        if (op[0] & 5) throw op[1]; return { value: op[0] ? op[1] : void 0, done: true };
+    }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateRedirectResponsePhase = void 0;
+var http_1 = require("../../http/index.js");
+var action_1 = require("../../action/index.js");
+var pxhd_1 = require("../../pxhd/index.js");
+/**
+ * `CreateRedirectResponsePhase` is a phase that creates a 302 redirect response when the enforcer
+ * action is REDIRECT. It mirrors the structure of `CreateBlockResponsePhase`.
+ */
+var CreateRedirectResponsePhase = /** @class */ (function () {
+    function CreateRedirectResponsePhase(config, cors) {
+        this.config = config;
+        if (cors) {
+            this.cors = cors;
+        }
+    }
+    CreateRedirectResponsePhase.prototype.execute = function (context) {
+        return __awaiter(this, void 0, void 0, function () {
+            var response;
+            return __generator(this, function (_a) {
+                switch (_a.label) {
+                    case 0:
+                        if (context.action !== action_1.Action.REDIRECT) {
+                            return [2 /*return*/, { done: false }];
+                        }
+                        context.logger.debug('create redirect response phase');
+                        response = new http_1.MinimalResponseImpl({
+                            status: 302,
+                            headers: { location: [context.redirectUrl] },
+                            body: '',
+                        });
+                        return [4 /*yield*/, this.addHeadersToResponse(response, context)];
+                    case 1:
+                        response = _a.sent();
+                        return [2 /*return*/, { done: true, response: response }];
+                }
+            });
+        });
+    };
+    CreateRedirectResponsePhase.prototype.addHeadersToResponse = function (response, context) {
+        return __awaiter(this, void 0, void 0, function () {
+            var corsHeaders;
+            var _a;
+            return __generator(this, function (_b) {
+                switch (_b.label) {
+                    case 0:
+                        if (!context.isMobile && ((_a = context.pxhd) === null || _a === void 0 ? void 0 : _a.source) === pxhd_1.PXHDSource.RISK) {
+                            response = pxhd_1.PXHDUtils.addPxhdToMinimalResponse(this.config, context, response);
+                        }
+                        if (!(this.config.corsSupportEnabled && this.cors && this.cors.isCorsRequest(context))) return [3 /*break*/, 2];
+                        return [4 /*yield*/, this.cors.getCorsBlockHeaders(context)];
+                    case 1:
+                        corsHeaders = _b.sent();
+                        response = http_1.MinimalResponseUtils.appendHeaders(response, corsHeaders);
+                        _b.label = 2;
+                    case 2: return [2 /*return*/, response];
+                }
+            });
+        });
+    };
+    return CreateRedirectResponsePhase;
+}());
+exports.CreateRedirectResponsePhase = CreateRedirectResponsePhase;

package/lib/cjs/phase/impl/RiskApiPhase.js

@@ -55,6 +55,7 @@ exports.RiskApiPhase = void 0;
 var action_1 = require("../../action/index.js");
 var utils_1 = require("../../utils/index.js");
 var pxhd_1 = require("../../pxhd/index.js");
+var blocker_1 = require("../../blocker/index.js");
 var DecideActionPhase_1 = require("./DecideActionPhase.js");
 /**
  * The `RiskApiPhase` class is responsible for making the synchronous Risk API request when necessary. If a Risk API call
@@ -152,6 +153,9 @@ var RiskApiPhase = /** @class */ (function (_super) {
                 source: pxhd_1.PXHDSource.RISK,
             };
         }
+        if (riskResponse.action === blocker_1.BlockAction.REDIRECT && riskResponse.redirectUrl) {
+            context.redirectUrl = riskResponse.redirectUrl;
+        }
     };
     RiskApiPhase.prototype.enrichContextWithProductDataFromRiskApi = function (context) {
         return __awaiter(this, void 0, void 0, function () {

package/lib/cjs/phase/impl/SendAsyncActivitiesPhase.js

@@ -52,7 +52,13 @@ var SendAsyncActivitiesPhase = /** @class */ (function () {
             return __generator(this, function (_a) {
                 switch (_a.label) {
                     case 0:
-                        if (![action_1.Action.PASS_REQUEST, action_1.Action.BLOCK, action_1.Action.SIMULATED_BLOCK].includes(context.action)) return [3 /*break*/, 2];
+                        if (![
+                            action_1.Action.PASS_REQUEST,
+                            action_1.Action.BLOCK,
+                            action_1.Action.SIMULATED_BLOCK,
+                            action_1.Action.REDIRECT,
+                            action_1.Action.SIMULATED_REDIRECT,
+                        ].includes(context.action)) return [3 /*break*/, 2];
                         promise = this.activityClient.sendActivities(context);
                         if (!this.config.awaitAsyncHttpRequests) return [3 /*break*/, 2];
                         return [4 /*yield*/, promise];

package/lib/cjs/phase/impl/index.js

@@ -22,6 +22,7 @@ __exportStar(require("./ParseTokenPhase.js"), exports);
 __exportStar(require("./DecideActionPhase.js"), exports);
 __exportStar(require("./RiskApiPhase.js"), exports);
 __exportStar(require("./CreateBlockResponsePhase.js"), exports);
+__exportStar(require("./CreateRedirectResponsePhase.js"), exports);
 __exportStar(require("./ModifyIncomingRequestPhase.js"), exports);
 __exportStar(require("./EnrichContextFromResponsePhase.js"), exports);
 __exportStar(require("./ModifyOutgoingResponsePhase.js"), exports);

package/lib/cjs/products/bot_defender/BotDefender.js

@@ -58,6 +58,7 @@ var block_1 = require("./block/index.js");
 var filter_1 = require("./filter/index.js");
 var first_party_1 = require("./first_party/index.js");
 var reasons_1 = require("./reasons/index.js");
+var blocker_1 = require("../../blocker/index.js");
 var BotDefenderActionData_1 = require("./BotDefenderActionData.js");
 var BotDefenderUtils_1 = require("./BotDefenderUtils.js");
 var BotDefender = /** @class */ (function () {
@@ -161,7 +162,8 @@ var BotDefender = /** @class */ (function () {
     };
     BotDefender.prototype.getRiskApiActionData = function (_a) {
         return __awaiter(this, arguments, void 0, function (_b) {
-            var riskApiData = _b.riskApiData, bd = _b.productData.bd;
+            var riskResponse, isMonitored, actionData;
+            var riskApiData = _b.riskApiData, bd = _b.productData.bd, logger = _b.logger;
             return __generator(this, function (_c) {
                 switch (riskApiData.riskApiCallResult) {
                     case risk_api_1.RiskApiCallResult.NONE:
@@ -170,14 +172,25 @@ var BotDefender = /** @class */ (function () {
                         return [2 /*return*/, new BotDefenderActionData_1.BotDefenderActionData(action_1.Action.PASS_REQUEST, reasons_1.BotDefenderPassReason.S2S_ERROR)];
                     case risk_api_1.RiskApiCallResult.TIMEOUT:
                         return [2 /*return*/, new BotDefenderActionData_1.BotDefenderActionData(action_1.Action.PASS_REQUEST, reasons_1.BotDefenderPassReason.S2S_TIMEOUT)];
-                    case risk_api_1.RiskApiCallResult.SUCCESSFUL:
-                        return [2 /*return*/, this.getSuccessfulRiskApiAction(riskApiData.riskResponse, !!(bd === null || bd === void 0 ? void 0 : bd.isMonitoredRequest))];
+                    case risk_api_1.RiskApiCallResult.SUCCESSFUL: {
+                        riskResponse = riskApiData.riskResponse;
+                        isMonitored = !!(bd === null || bd === void 0 ? void 0 : bd.isMonitoredRequest);
+                        actionData = this.getSuccessfulRiskApiAction(riskResponse, isMonitored);
+                        logger.debug("bot defender action: ".concat(actionData.action, ", risk action: ").concat(riskResponse.action, ", redirect url: ").concat(riskResponse.redirectUrl, ", score: ").concat(riskResponse.score, ", monitored: ").concat(isMonitored));
+                        return [2 /*return*/, actionData];
+                    }
                 }
                 return [2 /*return*/];
             });
         });
     };
     BotDefender.prototype.getSuccessfulRiskApiAction = function (riskResponse, isMonitored) {
+        if (riskResponse.action === blocker_1.BlockAction.REDIRECT) {
+            if (!riskResponse.redirectUrl) {
+                return new BotDefenderActionData_1.BotDefenderActionData(action_1.Action.PASS_REQUEST, reasons_1.BotDefenderPassReason.S2S_ERROR);
+            }
+            return new BotDefenderActionData_1.BotDefenderActionData(isMonitored ? action_1.Action.SIMULATED_REDIRECT : action_1.Action.REDIRECT, reasons_1.BotDefenderRedirectReason.S2S);
+        }
         if (riskResponse.score >= this.config.blockingScore) {
             return new BotDefenderActionData_1.BotDefenderActionData(isMonitored ? action_1.Action.SIMULATED_BLOCK : action_1.Action.BLOCK, reasons_1.BotDefenderBlockReason.S2S_HIGH_SCORE);
         }

package/lib/cjs/products/bot_defender/reasons/BotDefenderRedirectReason.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BotDefenderRedirectReason = void 0;
+var BotDefenderRedirectReason;
+(function (BotDefenderRedirectReason) {
+    BotDefenderRedirectReason["S2S"] = "s2s";
+})(BotDefenderRedirectReason || (exports.BotDefenderRedirectReason = BotDefenderRedirectReason = {}));

package/lib/cjs/products/bot_defender/reasons/index.js

@@ -16,5 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./BotDefenderBlockReason.js"), exports);
 __exportStar(require("./BotDefenderPassReason.js"), exports);
+__exportStar(require("./BotDefenderRedirectReason.js"), exports);
 __exportStar(require("./BotDefenderS2SCallReason.js"), exports);
 __exportStar(require("./BotDefenderReasonType.js"), exports);

package/lib/cjs/risk_api/model/GetRiskResponseHeaders.js

@@ -13,4 +13,7 @@ exports.GetRiskResponseHeaders = {
     Status: 'x-px-status',
     TelemetryRequested: 'x-px-telemetry-requested',
     Uuid: 'x-px-uuid',
+    RedirectUrl: 'x-px-redirect-url',
+    RedirectRuleId: 'x-px-redirect-rule-id',
+    RedirectRuleName: 'x-px-redirect-rule-name',
 };

package/lib/cjs/risk_api/risk_response/RiskResponseBase.js

@@ -145,6 +145,30 @@ var RiskResponseBase = /** @class */ (function () {
         enumerable: false,
         configurable: true
     });
+    Object.defineProperty(RiskResponseBase.prototype, "redirectUrl", {
+        get: function () {
+            var _a;
+            return (_a = this.riskResponse) === null || _a === void 0 ? void 0 : _a.redirect_url;
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(RiskResponseBase.prototype, "redirectRuleId", {
+        get: function () {
+            var _a;
+            return (_a = this.riskResponse) === null || _a === void 0 ? void 0 : _a.redirect_rule_id;
+        },
+        enumerable: false,
+        configurable: true
+    });
+    Object.defineProperty(RiskResponseBase.prototype, "redirectRuleName", {
+        get: function () {
+            var _a;
+            return (_a = this.riskResponse) === null || _a === void 0 ? void 0 : _a.redirect_rule_name;
+        },
+        enumerable: false,
+        configurable: true
+    });
     RiskResponseBase.prototype.toJSON = function () {
         return {
             status: this.status,
@@ -158,6 +182,9 @@ var RiskResponseBase = /** @class */ (function () {
             additionalRiskInfo: this.additionalRiskInfo,
             telemetryRequested: this.telemetryRequested,
             uuid: this.uuid,
+            redirectUrl: this.redirectUrl,
+            redirectRuleId: this.redirectRuleId,
+            redirectRuleName: this.redirectRuleName,
         };
     };
     return RiskResponseBase;

package/lib/cjs/risk_api/risk_response/serialize/SerializedRiskResponse.js

@@ -15,6 +15,9 @@ var SerializedRiskResponse = /** @class */ (function () {
         this.score = riskResponseJson.score;
         this.status = riskResponseJson.status;
         this.uuid = riskResponseJson.uuid;
+        this.redirectUrl = riskResponseJson.redirectUrl;
+        this.redirectRuleId = riskResponseJson.redirectRuleId;
+        this.redirectRuleName = riskResponseJson.redirectRuleName;
     }
     SerializedRiskResponse.prototype.validate = function () {
         throw new utils_1.EnforcerError('SerializedRiskResponse.validate() should not be invoked');

package/lib/cjs/risk_api/risk_response/v2/GetRiskResponseV2.js

@@ -39,6 +39,9 @@ var GetRiskResponseV2 = /** @class */ (function (_super) {
         var telemetryRequested = this.getHeader(response, model_1.GetRiskResponseHeaders.TelemetryRequested);
         var uuid = this.getHeader(response, model_1.GetRiskResponseHeaders.Uuid);
         var action = this.getHeader(response, model_1.GetRiskResponseHeaders.Action);
+        var redirectUrl = this.getHeader(response, model_1.GetRiskResponseHeaders.RedirectUrl);
+        var redirectRuleId = this.getHeader(response, model_1.GetRiskResponseHeaders.RedirectRuleId);
+        var redirectRuleName = this.getHeader(response, model_1.GetRiskResponseHeaders.RedirectRuleName);
         return {
             status: status,
             action: action,
@@ -51,6 +54,9 @@ var GetRiskResponseV2 = /** @class */ (function (_super) {
             telemetry_requested: telemetryRequested === 'true',
             drc: drc ? parseInt(drc) : undefined,
             cookie_cfg_block_result: blockResult,
+            redirect_url: redirectUrl,
+            redirect_rule_id: redirectRuleId,
+            redirect_rule_name: redirectRuleName,
         };
     };
     GetRiskResponseV2.prototype.getHeader = function (response, header) {

package/lib/cjs/utils/constants.js

@@ -15,4 +15,4 @@ exports.PUSH_DATA_FEATURE_HEADER_NAME = 'x-px-feature';
 exports.EMAIL_ADDRESS_REGEX = /^[a-zA-Z0-9_+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$/;
 exports.URL_REGEX = /^(https?:)\/\/(([^@\s:\/]+):?([^@\s\/]*)@)?(([^:\/?#]*)(?:\:([0-9]+))?)(\/?[^?#]*)(\?[^#]*|)(#.*|)$/;
 exports.REGEX_STRUCTURE = /^\/(.+?)\/([gimsuyvd]*)$/;
-exports.CORE_MODULE_VERSION = 'JS Core 1.0.1';
+exports.CORE_MODULE_VERSION = 'JS Core 1.1.0';

package/lib/esm/action/Action.js

@@ -19,4 +19,12 @@ export var Action;
      * Indicates that the request should be blocked and a block response should be returned.
      */
     Action["BLOCK"] = "block";
+    /**
+     * Indicates that the client should be redirected to a specified URL with a 302 response.
+     */
+    Action["REDIRECT"] = "redirect";
+    /**
+     * Indicates that the client would be redirected, but no redirect response will be returned (monitor mode).
+     */
+    Action["SIMULATED_REDIRECT"] = "simulated_redirect";
 })(Action || (Action = {}));

package/lib/esm/action/ActionPriorityOrder.js

@@ -4,6 +4,8 @@ import { Action } from './Action.js';
  * and the first action that matches a product recommendation will be taken.
  */
 export const ACTION_PRIORITY_ORDER = [
+    Action.REDIRECT,
+    Action.SIMULATED_REDIRECT,
     Action.BLOCK,
     Action.SIMULATED_BLOCK,
     Action.TRIGGER_RISK_API,

package/lib/esm/activities/ActivityType.js

@@ -4,4 +4,5 @@ export var ActivityType;
     ActivityType["BLOCK"] = "block";
     ActivityType["ADDITIONAL_S2S"] = "additional_s2s";
     ActivityType["ENFORCER_TELEMETRY"] = "enforcer_telemetry";
+    ActivityType["PAGE_REDIRECTED"] = "page_redirected";
 })(ActivityType || (ActivityType = {}));

package/lib/esm/activities/HttpActivityClient.js

@@ -46,17 +46,30 @@ export class HttpActivityClient {
      */
     createActivities(context) {
         const activities = [];
-        if (this.shouldCreateBlockActivity(context)) {
-            activities.push(this.createBlockActivity(context));
+        if (this.shouldCreatePageRedirectedActivity(context)) {
+            activities.push(this.createPageRedirectedActivity(context));
         }
-        if (this.shouldCreatePageRequestedActivity(context)) {
-            activities.push(this.createPageRequestedActivity(context));
-        }
-        if (this.shouldCreateAdditionalS2SActivity(context)) {
-            activities.push(this.createAdditionalS2SActivity(context));
+        else {
+            if (this.shouldCreateBlockActivity(context)) {
+                activities.push(this.createBlockActivity(context));
+            }
+            if (this.shouldCreatePageRequestedActivity(context)) {
+                activities.push(this.createPageRequestedActivity(context));
+            }
+            if (this.shouldCreateAdditionalS2SActivity(context)) {
+                activities.push(this.createAdditionalS2SActivity(context));
+            }
         }
         return activities.map(this.finalizeActivity);
     }
+    /**
+     * Whether to create a page_redirected activity based on the context.
+     * @param context
+     * @protected
+     */
+    shouldCreatePageRedirectedActivity(context) {
+        return context.action === Action.REDIRECT || context.action === Action.SIMULATED_REDIRECT;
+    }
     /**
      * Whether to create a block activity based on the context.
      * @param context
@@ -83,6 +96,14 @@ export class HttpActivityClient {
             !!context.productData.ci &&
             this.config.ciAutomaticAdditionalS2SEnabled);
     }
+    /**
+     * Creates a page_redirected activity based on the context.
+     * @param context
+     * @protected
+     */
+    createPageRedirectedActivity(context) {
+        return createAsyncActivity(ActivityType.PAGE_REDIRECTED, this.config, context);
+    }
     /**
      * Creates a block activity based on the context.
      * @param context

package/lib/esm/activities/utils.js

@@ -46,6 +46,9 @@ export const createActivityDetails = (activityType, config, context) => {
         case ActivityType.ADDITIONAL_S2S:
             specificActivityDetails = createAdditionalS2SActivityDetails(config, context);
             break;
+        case ActivityType.PAGE_REDIRECTED:
+            specificActivityDetails = createPageRedirectedActivityDetails(context);
+            break;
     }
     return Object.assign(commonActivityDetails, commonAsyncActivityDetails, specificActivityDetails);
 };
@@ -297,6 +300,21 @@ export const createAdditionalS2SActivityDetails = ({ ciSendRawUsernameOnAddition
     }
     return details;
 };
+export const createPageRedirectedActivityDetails = (context) => {
+    const details = {
+        redirect_url: context.redirectUrl,
+        redirect_reason: 's2s',
+        simulated_redirect: context.action === Action.SIMULATED_REDIRECT,
+    };
+    const { riskResponse } = context.riskApiData;
+    if (riskResponse?.redirectRuleId) {
+        details.redirect_rule_id = riskResponse.redirectRuleId;
+    }
+    if (riskResponse?.redirectRuleName) {
+        details.redirect_rule_name = riskResponse.redirectRuleName;
+    }
+    return details;
+};
 export const toHeaderEntryArray = (headers) => {
     return Object.entries(headers).flatMap(([key, values]) => values.map((value) => ({
         name: key,

package/lib/esm/blocker/model/BlockAction.js

@@ -6,4 +6,5 @@ export var BlockAction;
     BlockAction["CHALLENGE"] = "j";
     BlockAction["HYPE_SALE_CHALLENGE"] = "hsc";
     BlockAction["HYPE_SALE_CHALLENGE_LEGACY"] = "cp";
+    BlockAction["REDIRECT"] = "re";
 })(BlockAction || (BlockAction = {}));

package/lib/esm/context/DefaultContext.js

@@ -28,6 +28,7 @@ export class DefaultContext {
     reasons;
     score;
     blockAction;
+    redirectUrl;
     pxhd;
     pxde;
     pxdeVerified;

package/lib/esm/flow/EnforceFlow.js

@@ -1,4 +1,4 @@
-import { AdditionalActivityHandlerPhase, CreateBlockResponsePhase, EnrichContextFromRequestPhase, ModifyIncomingRequestPhase, ParseTokenPhase, RiskApiPhase, } from '../phase/index.js';
+import { AdditionalActivityHandlerPhase, CreateBlockResponsePhase, CreateRedirectResponsePhase, EnrichContextFromRequestPhase, ModifyIncomingRequestPhase, ParseTokenPhase, RiskApiPhase, } from '../phase/index.js';
 import { Flow } from './Flow.js';
 export class EnforceFlow extends Flow {
     constructor(config, { dataEnrichment, tokenParser, riskApiClient, cors, products, graphQLParser, }) {
@@ -7,6 +7,7 @@ export class EnforceFlow extends Flow {
             new EnrichContextFromRequestPhase(config, products, dataEnrichment, graphQLParser),
             new RiskApiPhase(products, riskApiClient),
             new AdditionalActivityHandlerPhase(config),
+            new CreateRedirectResponsePhase(config, cors),
             new CreateBlockResponsePhase(config, CreateBlockResponsePhase.getBlockers(products), cors),
             new ModifyIncomingRequestPhase(Object.values(products)),
         ]);

package/lib/esm/phase/impl/CreateRedirectResponsePhase.js

@@ -0,0 +1,40 @@
+import { MinimalResponseImpl, MinimalResponseUtils } from '../../http/index.js';
+import { Action } from '../../action/index.js';
+import { PXHDSource, PXHDUtils } from '../../pxhd/index.js';
+/**
+ * `CreateRedirectResponsePhase` is a phase that creates a 302 redirect response when the enforcer
+ * action is REDIRECT. It mirrors the structure of `CreateBlockResponsePhase`.
+ */
+export class CreateRedirectResponsePhase {
+    config;
+    cors;
+    constructor(config, cors) {
+        this.config = config;
+        if (cors) {
+            this.cors = cors;
+        }
+    }
+    async execute(context) {
+        if (context.action !== Action.REDIRECT) {
+            return { done: false };
+        }
+        context.logger.debug('create redirect response phase');
+        let response = new MinimalResponseImpl({
+            status: 302,
+            headers: { location: [context.redirectUrl] },
+            body: '',
+        });
+        response = await this.addHeadersToResponse(response, context);
+        return { done: true, response };
+    }
+    async addHeadersToResponse(response, context) {
+        if (!context.isMobile && context.pxhd?.source === PXHDSource.RISK) {
+            response = PXHDUtils.addPxhdToMinimalResponse(this.config, context, response);
+        }
+        if (this.config.corsSupportEnabled && this.cors && this.cors.isCorsRequest(context)) {
+            const corsHeaders = await this.cors.getCorsBlockHeaders(context);
+            response = MinimalResponseUtils.appendHeaders(response, corsHeaders);
+        }
+        return response;
+    }
+}

package/lib/esm/phase/impl/RiskApiPhase.js

@@ -1,6 +1,7 @@
 import { Action, getReasonForHighestPriorityProduct } from '../../action/index.js';
 import { isNullOrUndefined } from '../../utils/index.js';
 import { PXHDSource } from '../../pxhd/index.js';
+import { BlockAction } from '../../blocker/index.js';
 import { DecideActionPhase } from './DecideActionPhase.js';
 /**
  * The `RiskApiPhase` class is responsible for making the synchronous Risk API request when necessary. If a Risk API call
@@ -64,6 +65,9 @@ export class RiskApiPhase extends DecideActionPhase {
                 source: PXHDSource.RISK,
             };
         }
+        if (riskResponse.action === BlockAction.REDIRECT && riskResponse.redirectUrl) {
+            context.redirectUrl = riskResponse.redirectUrl;
+        }
     }
     async enrichContextWithProductDataFromRiskApi(context) {
         await Promise.all(Object.entries(this.products).map(async ([name, product]) => {

package/lib/esm/phase/impl/SendAsyncActivitiesPhase.js

@@ -10,7 +10,13 @@ export class SendAsyncActivitiesPhase {
         this.activityClient = activityClient;
     }
     async execute(context) {
-        if ([Action.PASS_REQUEST, Action.BLOCK, Action.SIMULATED_BLOCK].includes(context.action)) {
+        if ([
+            Action.PASS_REQUEST,
+            Action.BLOCK,
+            Action.SIMULATED_BLOCK,
+            Action.REDIRECT,
+            Action.SIMULATED_REDIRECT,
+        ].includes(context.action)) {
             // ensure error handling is done in the sendActivities method
             const promise = this.activityClient.sendActivities(context);
             if (this.config.awaitAsyncHttpRequests) {

package/lib/esm/phase/impl/index.js

@@ -6,6 +6,7 @@ export * from './ParseTokenPhase.js';
 export * from './DecideActionPhase.js';
 export * from './RiskApiPhase.js';
 export * from './CreateBlockResponsePhase.js';
+export * from './CreateRedirectResponsePhase.js';
 export * from './ModifyIncomingRequestPhase.js';
 export * from './EnrichContextFromResponsePhase.js';
 export * from './ModifyOutgoingResponsePhase.js';

package/lib/esm/products/bot_defender/BotDefender.js

@@ -7,7 +7,8 @@ import { MonitoredRequestUtils } from '../../monitored_request/index.js';
 import { DefaultBotDefenderBlocker } from './block/index.js';
 import { DefaultBotDefenderFilter } from './filter/index.js';
 import { DefaultBotDefenderFirstParty } from './first_party/index.js';
-import { BotDefenderBlockReason, BotDefenderPassReason, BotDefenderS2SCallReason } from './reasons/index.js';
+import { BotDefenderBlockReason, BotDefenderPassReason, BotDefenderRedirectReason, BotDefenderS2SCallReason, } from './reasons/index.js';
+import { BlockAction } from '../../blocker/index.js';
 import { BotDefenderActionData } from './BotDefenderActionData.js';
 import { BotDefenderUtils } from './BotDefenderUtils.js';
 export class BotDefender {
@@ -77,7 +78,7 @@ export class BotDefender {
     async enrichContextFromRiskApi(context) {
         return await this.getRiskApiActionData(context);
     }
-    async getRiskApiActionData({ riskApiData, productData: { bd }, }) {
+    async getRiskApiActionData({ riskApiData, productData: { bd }, logger, }) {
         switch (riskApiData.riskApiCallResult) {
             case RiskApiCallResult.NONE:
                 throw new EnforcerError('risk api call result should not be none!');
@@ -85,11 +86,22 @@ export class BotDefender {
                 return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.S2S_ERROR);
             case RiskApiCallResult.TIMEOUT:
                 return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.S2S_TIMEOUT);
-            case RiskApiCallResult.SUCCESSFUL:
-                return this.getSuccessfulRiskApiAction(riskApiData.riskResponse, !!bd?.isMonitoredRequest);
+            case RiskApiCallResult.SUCCESSFUL: {
+                const riskResponse = riskApiData.riskResponse;
+                const isMonitored = !!bd?.isMonitoredRequest;
+                const actionData = this.getSuccessfulRiskApiAction(riskResponse, isMonitored);
+                logger.debug(`bot defender action: ${actionData.action}, risk action: ${riskResponse.action}, redirect url: ${riskResponse.redirectUrl}, score: ${riskResponse.score}, monitored: ${isMonitored}`);
+                return actionData;
+            }
         }
     }
     getSuccessfulRiskApiAction(riskResponse, isMonitored) {
+        if (riskResponse.action === BlockAction.REDIRECT) {
+            if (!riskResponse.redirectUrl) {
+                return new BotDefenderActionData(Action.PASS_REQUEST, BotDefenderPassReason.S2S_ERROR);
+            }
+            return new BotDefenderActionData(isMonitored ? Action.SIMULATED_REDIRECT : Action.REDIRECT, BotDefenderRedirectReason.S2S);
+        }
         if (riskResponse.score >= this.config.blockingScore) {
             return new BotDefenderActionData(isMonitored ? Action.SIMULATED_BLOCK : Action.BLOCK, BotDefenderBlockReason.S2S_HIGH_SCORE);
         }

package/lib/esm/products/bot_defender/reasons/BotDefenderRedirectReason.js

@@ -0,0 +1,4 @@
+export var BotDefenderRedirectReason;
+(function (BotDefenderRedirectReason) {
+    BotDefenderRedirectReason["S2S"] = "s2s";
+})(BotDefenderRedirectReason || (BotDefenderRedirectReason = {}));

package/lib/esm/products/bot_defender/reasons/index.js

@@ -1,4 +1,5 @@
 export * from './BotDefenderBlockReason.js';
 export * from './BotDefenderPassReason.js';
+export * from './BotDefenderRedirectReason.js';
 export * from './BotDefenderS2SCallReason.js';
 export * from './BotDefenderReasonType.js';

package/lib/esm/risk_api/model/GetRiskResponseHeaders.js

@@ -10,4 +10,7 @@ export const GetRiskResponseHeaders = {
     Status: 'x-px-status',
     TelemetryRequested: 'x-px-telemetry-requested',
     Uuid: 'x-px-uuid',
+    RedirectUrl: 'x-px-redirect-url',
+    RedirectRuleId: 'x-px-redirect-rule-id',
+    RedirectRuleName: 'x-px-redirect-rule-name',
 };

package/lib/esm/risk_api/risk_response/RiskResponseBase.js

@@ -48,6 +48,15 @@ export class RiskResponseBase {
     get drc() {
         return this.riskResponse?.drc;
     }
+    get redirectUrl() {
+        return this.riskResponse?.redirect_url;
+    }
+    get redirectRuleId() {
+        return this.riskResponse?.redirect_rule_id;
+    }
+    get redirectRuleName() {
+        return this.riskResponse?.redirect_rule_name;
+    }
     toJSON() {
         return {
             status: this.status,
@@ -61,6 +70,9 @@ export class RiskResponseBase {
             additionalRiskInfo: this.additionalRiskInfo,
             telemetryRequested: this.telemetryRequested,
             uuid: this.uuid,
+            redirectUrl: this.redirectUrl,
+            redirectRuleId: this.redirectRuleId,
+            redirectRuleName: this.redirectRuleName,
         };
     }
 }

package/lib/esm/risk_api/risk_response/serialize/SerializedRiskResponse.js

@@ -11,6 +11,9 @@ export class SerializedRiskResponse {
     score;
     status;
     uuid;
+    redirectUrl;
+    redirectRuleId;
+    redirectRuleName;
     constructor(riskResponseJson) {
         this.action = riskResponseJson.action;
         this.additionalRiskInfo = riskResponseJson.additionalRiskInfo;
@@ -23,6 +26,9 @@ export class SerializedRiskResponse {
         this.score = riskResponseJson.score;
         this.status = riskResponseJson.status;
         this.uuid = riskResponseJson.uuid;
+        this.redirectUrl = riskResponseJson.redirectUrl;
+        this.redirectRuleId = riskResponseJson.redirectRuleId;
+        this.redirectRuleName = riskResponseJson.redirectRuleName;
     }
     validate() {
         throw new EnforcerError('SerializedRiskResponse.validate() should not be invoked');

package/lib/esm/risk_api/risk_response/v2/GetRiskResponseV2.js

@@ -20,6 +20,9 @@ export class GetRiskResponseV2 extends RiskResponseBase {
         const telemetryRequested = this.getHeader(response, GetRiskResponseHeaders.TelemetryRequested);
         const uuid = this.getHeader(response, GetRiskResponseHeaders.Uuid);
         const action = this.getHeader(response, GetRiskResponseHeaders.Action);
+        const redirectUrl = this.getHeader(response, GetRiskResponseHeaders.RedirectUrl);
+        const redirectRuleId = this.getHeader(response, GetRiskResponseHeaders.RedirectRuleId);
+        const redirectRuleName = this.getHeader(response, GetRiskResponseHeaders.RedirectRuleName);
         return {
             status,
             action,
@@ -32,6 +35,9 @@ export class GetRiskResponseV2 extends RiskResponseBase {
             telemetry_requested: telemetryRequested === 'true',
             drc: drc ? parseInt(drc) : undefined,
             cookie_cfg_block_result: blockResult,
+            redirect_url: redirectUrl,
+            redirect_rule_id: redirectRuleId,
+            redirect_rule_name: redirectRuleName,
         };
     }
     getHeader(response, header) {

package/lib/esm/utils/constants.js

@@ -12,4 +12,4 @@ export const PUSH_DATA_FEATURE_HEADER_NAME = 'x-px-feature';
 export const EMAIL_ADDRESS_REGEX = /^[a-zA-Z0-9_+&*-]+(?:\.[a-zA-Z0-9_+&*-]+)*@(?:[a-zA-Z0-9-]+\.)+[a-zA-Z]{2,7}$/;
 export const URL_REGEX = /^(https?:)\/\/(([^@\s:\/]+):?([^@\s\/]*)@)?(([^:\/?#]*)(?:\:([0-9]+))?)(\/?[^?#]*)(\?[^#]*|)(#.*|)$/;
 export const REGEX_STRUCTURE = /^\/(.+?)\/([gimsuyvd]*)$/;
-export const CORE_MODULE_VERSION = 'JS Core 1.0.1';
+export const CORE_MODULE_VERSION = 'JS Core 1.1.0';

package/lib/types/action/Action.d.ts

@@ -17,5 +17,13 @@ export declare enum Action {
     /**
      * Indicates that the request should be blocked and a block response should be returned.
      */
-    BLOCK = "block"
+    BLOCK = "block",
+    /**
+     * Indicates that the client should be redirected to a specified URL with a 302 response.
+     */
+    REDIRECT = "redirect",
+    /**
+     * Indicates that the client would be redirected, but no redirect response will be returned (monitor mode).
+     */
+    SIMULATED_REDIRECT = "simulated_redirect"
 }

package/lib/types/activities/ActivityType.d.ts

@@ -2,5 +2,6 @@ export declare enum ActivityType {
     PAGE_REQUESTED = "page_requested",
     BLOCK = "block",
     ADDITIONAL_S2S = "additional_s2s",
-    ENFORCER_TELEMETRY = "enforcer_telemetry"
+    ENFORCER_TELEMETRY = "enforcer_telemetry",
+    PAGE_REDIRECTED = "page_redirected"
 }

package/lib/types/activities/HttpActivityClient.d.ts

@@ -29,6 +29,12 @@ export declare class HttpActivityClient<Req, Res, Supported extends string, Adde
      * @protected
      */
     protected createActivities(context: ReadonlyContext<Req, Res>): AsyncActivity[];
+    /**
+     * Whether to create a page_redirected activity based on the context.
+     * @param context
+     * @protected
+     */
+    protected shouldCreatePageRedirectedActivity(context: ReadonlyContext<Req, Res>): boolean;
     /**
      * Whether to create a block activity based on the context.
      * @param context
@@ -47,6 +53,12 @@ export declare class HttpActivityClient<Req, Res, Supported extends string, Adde
      * @protected
      */
     protected shouldCreateAdditionalS2SActivity(context: ReadonlyContext<Req, Res>): boolean;
+    /**
+     * Creates a page_redirected activity based on the context.
+     * @param context
+     * @protected
+     */
+    protected createPageRedirectedActivity(context: ReadonlyContext<Req, Res>): AsyncActivity;
     /**
      * Creates a block activity based on the context.
      * @param context

package/lib/types/activities/model/AsyncActivityDetails.d.ts

@@ -12,7 +12,7 @@ export type AsyncActivityCommonDetails = Partial<RiskAdditionalData> & {
     http_status_code?: number;
     credentials_compromised?: boolean;
 };
-export type ActivityTypeDetails = PageRequestedActivityDetails | BlockActivityDetails | AdditionalS2SActivityDetails;
+export type ActivityTypeDetails = PageRequestedActivityDetails | BlockActivityDetails | AdditionalS2SActivityDetails | PageRedirectedActivityDetails;
 /**
  * Activity details that should be included in page_requested activities.
  */
@@ -39,3 +39,13 @@ export type AdditionalS2SActivityDetails = {
     login_successful: boolean;
     raw_username?: string;
 };
+/**
+ * Activity details that should be included in page_redirected activities.
+ */
+export type PageRedirectedActivityDetails = {
+    redirect_url: string;
+    redirect_reason: 's2s';
+    simulated_redirect: boolean;
+    redirect_rule_id?: string;
+    redirect_rule_name?: string;
+};

package/lib/types/activities/utils.d.ts

@@ -3,7 +3,7 @@ import { ReadonlyContext, RequestData, ServerData, TlsData, TokenData } from '..
 import { IConfiguration } from '../config';
 import { ProductData } from '../products';
 import { ActivityType } from './ActivityType';
-import { AdditionalS2SActivityDetails, AsyncActivity, AsyncActivityCommonDetails, AsyncActivityDetails, BlockActivityDetails, CommonActivityDetails, HeaderEntry, PageRequestedActivityDetails } from './model';
+import { AdditionalS2SActivityDetails, AsyncActivity, AsyncActivityCommonDetails, AsyncActivityDetails, BlockActivityDetails, CommonActivityDetails, HeaderEntry, PageRedirectedActivityDetails, PageRequestedActivityDetails } from './model';
 import { CustomParameters, ResponseCustomParameters } from '../custom_parameters';
 /**
  * Creates an async activity object based on the provided parameters.
@@ -37,4 +37,5 @@ export declare const addResponseDataToAsyncActivityCommonDetails: <Req, Res>(det
 export declare const createPageRequestedActivityDetails: <Req, Res>(context: ReadonlyContext<Req, Res>) => PageRequestedActivityDetails;
 export declare const createBlockActivityDetails: <Req, Res>(context: ReadonlyContext<Req, Res>) => BlockActivityDetails;
 export declare const createAdditionalS2SActivityDetails: <Req, Res, Supported extends string, Added>({ ciSendRawUsernameOnAdditionalS2SActivity }: IConfiguration<Req, Res, Supported, Added>, { productData }: ReadonlyContext<Req, Res>) => AdditionalS2SActivityDetails;
+export declare const createPageRedirectedActivityDetails: <Req, Res>(context: ReadonlyContext<Req, Res>) => PageRedirectedActivityDetails;
 export declare const toHeaderEntryArray: (headers: Record<string, string[]>) => HeaderEntry[];

package/lib/types/blocker/model/BlockAction.d.ts

@@ -4,5 +4,6 @@ export declare enum BlockAction {
     RATE_LIMIT = "r",
     CHALLENGE = "j",
     HYPE_SALE_CHALLENGE = "hsc",
-    HYPE_SALE_CHALLENGE_LEGACY = "cp"
+    HYPE_SALE_CHALLENGE_LEGACY = "cp",
+    REDIRECT = "re"
 }

package/lib/types/context/DefaultContext.d.ts

@@ -40,6 +40,7 @@ export declare class DefaultContext<Req, Res, Supported extends string, Added> i
     reasons: Partial<Record<ProductName, string>>;
     score?: number;
     blockAction: BlockAction;
+    redirectUrl?: string;
     pxhd?: PXHD;
     pxde?: PXDE;
     pxdeVerified?: boolean;

package/lib/types/context/interfaces/IContext.d.ts

@@ -95,6 +95,10 @@ export interface IContext<Req, Res> {
      * The type of block page to present in case of a block.
      */
     blockAction: BlockAction;
+    /**
+     * The URL to redirect the client to when the action is REDIRECT.
+     */
+    redirectUrl?: string;
     /**
      * The PXHD (PerimeterX Hashed Data) cookie value, if it exists on the request.
      */

package/lib/types/phase/impl/CreateRedirectResponsePhase.d.ts

@@ -0,0 +1,17 @@
+import { IConfiguration } from '../../config';
+import { IContext, ReadonlyContext } from '../../context';
+import { IMinimalResponse } from '../../http';
+import { ICors } from '../../cors';
+import { IPhase } from '../IPhase';
+import { PhaseResult } from '../PhaseResult';
+/**
+ * `CreateRedirectResponsePhase` is a phase that creates a 302 redirect response when the enforcer
+ * action is REDIRECT. It mirrors the structure of `CreateBlockResponsePhase`.
+ */
+export declare class CreateRedirectResponsePhase<Req, Res, Supported extends string, Added> implements IPhase<Req, Res> {
+    protected readonly config: IConfiguration<Req, Res, Supported, Added>;
+    protected readonly cors?: ICors<Req, Res>;
+    constructor(config: IConfiguration<Req, Res, Supported, Added>, cors?: ICors<Req, Res>);
+    execute(context: IContext<Req, Res>): Promise<PhaseResult>;
+    protected addHeadersToResponse(response: IMinimalResponse, context: ReadonlyContext<Req, Res>): Promise<IMinimalResponse>;
+}

package/lib/types/phase/impl/index.d.ts

@@ -6,6 +6,7 @@ export * from './ParseTokenPhase';
 export * from './DecideActionPhase';
 export * from './RiskApiPhase';
 export * from './CreateBlockResponsePhase';
+export * from './CreateRedirectResponsePhase';
 export * from './ModifyIncomingRequestPhase';
 export * from './EnrichContextFromResponsePhase';
 export * from './ModifyOutgoingResponsePhase';

package/lib/types/products/bot_defender/BotDefender.d.ts

@@ -42,7 +42,7 @@ export declare class BotDefender<Req, Res, Supported extends string, Added> impl
     protected getNoTokenS2SCallReason({ pxhd, isMobile, tokenData, }: ReadonlyContext<Req, Res>): BotDefenderS2SCallReason;
     protected getActionForSuccessfulTokenParse(token: IToken<Req, Res>, isMonitoredRequest: boolean, isSensitiveRequest: boolean): ActionData;
     enrichContextFromRiskApi(context: ReadonlyContext<Req, Res>): Promise<Partial<BotDefenderData>>;
-    protected getRiskApiActionData({ riskApiData, productData: { bd }, }: ReadonlyContext<Req, Res>): Promise<ActionData>;
+    protected getRiskApiActionData({ riskApiData, productData: { bd }, logger, }: ReadonlyContext<Req, Res>): Promise<ActionData>;
     protected getSuccessfulRiskApiAction(riskResponse: DeepReadonly<IRiskResponse>, isMonitored: boolean): ActionData;
     shouldBlock(context: ReadonlyContext<Req, Res>): boolean;
     createBlockResponse(context: ReadonlyContext<Req, Res>): IMinimalResponse;

package/lib/types/products/bot_defender/reasons/BotDefenderReasonType.d.ts

@@ -1,5 +1,6 @@
 import { Action } from '../../../action';
 import { BotDefenderBlockReason } from './BotDefenderBlockReason';
 import { BotDefenderPassReason } from './BotDefenderPassReason';
+import { BotDefenderRedirectReason } from './BotDefenderRedirectReason';
 import { BotDefenderS2SCallReason } from './BotDefenderS2SCallReason';
-export type BotDefenderReasonType<A extends Action> = A extends Action.BLOCK ? BotDefenderBlockReason : A extends Action.SIMULATED_BLOCK ? BotDefenderBlockReason : A extends Action.PASS_REQUEST ? BotDefenderPassReason : A extends Action.TRIGGER_RISK_API ? BotDefenderS2SCallReason : never;
+export type BotDefenderReasonType<A extends Action> = A extends Action.BLOCK ? BotDefenderBlockReason : A extends Action.SIMULATED_BLOCK ? BotDefenderBlockReason : A extends Action.PASS_REQUEST ? BotDefenderPassReason : A extends Action.TRIGGER_RISK_API ? BotDefenderS2SCallReason : A extends Action.REDIRECT ? BotDefenderRedirectReason : never;

package/lib/types/products/bot_defender/reasons/BotDefenderRedirectReason.d.ts

@@ -0,0 +1,3 @@
+export declare enum BotDefenderRedirectReason {
+    S2S = "s2s"
+}

package/lib/types/products/bot_defender/reasons/index.d.ts

@@ -1,4 +1,5 @@
 export * from './BotDefenderBlockReason';
 export * from './BotDefenderPassReason';
+export * from './BotDefenderRedirectReason';
 export * from './BotDefenderS2SCallReason';
 export * from './BotDefenderReasonType';

package/lib/types/risk_api/risk_response/CommonRiskResponsePayload.d.ts

@@ -12,4 +12,7 @@ export type CommonRiskResponsePayload = {
     drc?: number;
     additional_risk_info?: string;
     telemetry_requested?: boolean;
+    redirect_url?: string;
+    redirect_rule_id?: string;
+    redirect_rule_name?: string;
 };

package/lib/types/risk_api/risk_response/IRiskResponse.d.ts

@@ -15,6 +15,9 @@ export interface IRiskResponse {
     readonly drc?: number;
     readonly additionalRiskInfo?: string;
     readonly telemetryRequested?: boolean;
+    readonly redirectUrl?: string;
+    readonly redirectRuleId?: string;
+    readonly redirectRuleName?: string;
     validate(): AsyncOrSync<boolean>;
     toJSON(): RiskResponseJson;
 }

package/lib/types/risk_api/risk_response/RiskResponseBase.d.ts

@@ -25,5 +25,8 @@ export declare abstract class RiskResponseBase<TokenV extends TokenVersion> impl
     get additionalRiskInfo(): string | undefined;
     get telemetryRequested(): boolean | undefined;
     get drc(): number | undefined;
+    get redirectUrl(): string | undefined;
+    get redirectRuleId(): string | undefined;
+    get redirectRuleName(): string | undefined;
     toJSON(): RiskResponseJson;
 }

package/lib/types/risk_api/risk_response/serialize/RiskResponseJson.d.ts

@@ -13,4 +13,7 @@ export type RiskResponseJson = {
     readonly drc?: number;
     readonly additionalRiskInfo?: string;
     readonly telemetryRequested?: boolean;
+    readonly redirectUrl?: string;
+    readonly redirectRuleId?: string;
+    readonly redirectRuleName?: string;
 };

package/lib/types/risk_api/risk_response/serialize/SerializedRiskResponse.d.ts

@@ -15,6 +15,9 @@ export declare class SerializedRiskResponse implements IRiskResponse {
     readonly score: number | undefined;
     readonly status?: RiskStatus;
     readonly uuid: string | undefined;
+    readonly redirectUrl: string | undefined;
+    readonly redirectRuleId: string | undefined;
+    readonly redirectRuleName: string | undefined;
     constructor(riskResponseJson: RiskResponseJson);
     validate(): boolean;
     toJSON(): RiskResponseJson;

package/lib/types/utils/constants.d.ts

@@ -12,4 +12,4 @@ export declare const PUSH_DATA_FEATURE_HEADER_NAME = "x-px-feature";
 export declare const EMAIL_ADDRESS_REGEX: RegExp;
 export declare const URL_REGEX: RegExp;
 export declare const REGEX_STRUCTURE: RegExp;
-export declare const CORE_MODULE_VERSION = "JS Core 1.0.1";
+export declare const CORE_MODULE_VERSION = "JS Core 1.1.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "perimeterx-js-core",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "",
   "type": "module",
   "typesVersions": {