siarashield_workspace 0.0.33 → 0.0.36

package/fesm2022/siarashield_workspace.mjs

@@ -112,6 +112,133 @@ function installVendorRuntimeErrorSuppression() {
     patchState.installed = true;
 }
 
+const SUBMIT_GUARD_STATE_KEY = '__siaraShieldSubmitGuardInstalled__';
+const SYNTHETIC_CLICK_GUARD_WINDOW_MS = 1200;
+function installCaptchaSubmitGuard() {
+    const globalState = globalThis;
+    if (globalState[SUBMIT_GUARD_STATE_KEY])
+        return;
+    const lastSyntheticClickByButton = new WeakMap();
+    document.addEventListener('click', (event) => {
+        const target = event.target;
+        if (!(target instanceof Element))
+            return;
+        const submitButton = target.closest('.CaptchaSubmit');
+        if (!submitButton)
+            return;
+        // Vendor runtime can emit synthetic clicks on .CaptchaSubmit.
+        // Allow one synthetic click (needed for vendor auto-submit) but block rapid duplicates.
+        if (!event.isTrusted) {
+            const now = Date.now();
+            const lastSyntheticClickAt = lastSyntheticClickByButton.get(submitButton) ?? 0;
+            if (now - lastSyntheticClickAt < SYNTHETIC_CLICK_GUARD_WINDOW_MS) {
+                event.preventDefault();
+                event.stopImmediatePropagation();
+                return;
+            }
+            lastSyntheticClickByButton.set(submitButton, now);
+        }
+    }, true);
+    globalState[SUBMIT_GUARD_STATE_KEY] = true;
+}
+
+const VENDOR_RUNTIME_PATCH_KEY = '__siaraShieldVendorRuntimePatchInstalled__';
+const VENDOR_TOKEN_BRIDGE_KEY = '__siaraShieldVendorTokenBridgeInstalled__';
+const WRAPPED_FN_PREFIX = '__siaraShieldWrappedVendorFn__';
+function isKnownVendorNullDomError(error) {
+    const msg = error instanceof Error ? error.message.toLowerCase() : String(error ?? '').toLowerCase();
+    return (msg.includes("cannot read properties of null (reading 'style')") ||
+        msg.includes("cannot read properties of null (reading 'queryselector')") ||
+        msg.includes("cannot read properties of null (reading 'removechild')"));
+}
+function runFallbackChallengeOpen(excluding) {
+    const globals = getSiaraShieldGlobals();
+    const candidates = ['OpenCaptchaSlid', 'GetCyberSiara', 'Open_Pluin', 'Open_Plugin', 'Open_Plugin_'];
+    for (const name of candidates) {
+        if (name === excluding)
+            continue;
+        const fn = globals[name];
+        if (typeof fn !== 'function')
+            continue;
+        try {
+            fn();
+            return;
+        }
+        catch {
+            // Try next candidate.
+        }
+    }
+}
+function wrapVendorOpenFunction(name) {
+    const globals = getSiaraShieldGlobals();
+    const marker = `${WRAPPED_FN_PREFIX}${name}`;
+    if (globals[marker] === true)
+        return;
+    const candidate = globals[name];
+    if (typeof candidate !== 'function')
+        return;
+    const original = candidate;
+    globals[name] = ((...args) => {
+        try {
+            return original(...args);
+        }
+        catch (error) {
+            if (!isKnownVendorNullDomError(error)) {
+                throw error;
+            }
+            // Vendor challenge opener hit a missing DOM node.
+            // Try alternative open functions so challenge can still render.
+            runFallbackChallengeOpen(name);
+            return undefined;
+        }
+    });
+    globals[marker] = true;
+}
+function installVerifiedSubmitTokenBridge() {
+    const globals = getSiaraShieldGlobals();
+    if (globals[VENDOR_TOKEN_BRIDGE_KEY])
+        return;
+    const patchAjaxOwner = (owner) => {
+        if (!owner || typeof owner.ajax !== 'function')
+            return;
+        const originalAjax = owner.ajax.bind(owner);
+        owner.ajax = ((...args) => {
+            const firstArg = args[0];
+            if (!firstArg || typeof firstArg !== 'object') {
+                return originalAjax(...args);
+            }
+            const options = firstArg;
+            const url = String(options['url'] ?? '').toLowerCase();
+            const originalSuccess = options['success'];
+            if (!url.includes('/submitcaptcha/verifiedsubmit') || typeof originalSuccess !== 'function') {
+                return originalAjax(options);
+            }
+            options['success'] = ((response, ...rest) => {
+                const payload = response;
+                const maybeTokenRaw = payload?.data ?? payload?.Data;
+                if (typeof maybeTokenRaw === 'string' && maybeTokenRaw.trim()) {
+                    globals.CyberSiaraToken = maybeTokenRaw.trim();
+                }
+                return originalSuccess(response, ...rest);
+            });
+            return originalAjax(options);
+        });
+    };
+    patchAjaxOwner(globals.$);
+    patchAjaxOwner(globals.JQuryName);
+    globals[VENDOR_TOKEN_BRIDGE_KEY] = true;
+}
+function installVendorChallengeRuntimePatch() {
+    const globals = getSiaraShieldGlobals();
+    if (globals[VENDOR_RUNTIME_PATCH_KEY])
+        return;
+    wrapVendorOpenFunction('Open_Pluin');
+    wrapVendorOpenFunction('Open_Plugin');
+    wrapVendorOpenFunction('Open_Plugin_');
+    installVerifiedSubmitTokenBridge();
+    globals[VENDOR_RUNTIME_PATCH_KEY] = true;
+}
+
 const SCRIPT_STATUS_BY_DOCUMENT = new WeakMap();
 const SCRIPT_PENDING_BY_DOCUMENT = new WeakMap();
 const DYNAMIC_SCRIPT_NONCE_STATE_KEY = '__siaraShieldDynamicScriptNonceState__';
@@ -299,7 +426,8 @@ function prepareScriptNonce(documentRef, explicitNonce) {
     return resolvedNonce;
 }
 function loadScript(documentRef, src, options) {
-    const nonce = prepareScriptNonce(documentRef, options?.nonce);
+    // CSP nonce propagation is intentionally disabled in plugin runtime path for compatibility testing.
+    const nonce = normalizeNonce(options?.nonce);
     const statusBySrc = getStatusBySrc(documentRef);
     const pendingBySrc = getPendingBySrc(documentRef);
     const existing = documentRef.querySelector(`script[src="${src}"]`);
@@ -337,36 +465,6 @@ function loadScript(documentRef, src, options) {
     return pending;
 }
 
-const SUBMIT_GUARD_STATE_KEY = '__siaraShieldSubmitGuardInstalled__';
-const SYNTHETIC_CLICK_GUARD_WINDOW_MS = 1200;
-function installCaptchaSubmitGuard() {
-    const globalState = globalThis;
-    if (globalState[SUBMIT_GUARD_STATE_KEY])
-        return;
-    const lastSyntheticClickByButton = new WeakMap();
-    document.addEventListener('click', (event) => {
-        const target = event.target;
-        if (!(target instanceof Element))
-            return;
-        const submitButton = target.closest('.CaptchaSubmit');
-        if (!submitButton)
-            return;
-        // Vendor runtime can emit synthetic clicks on .CaptchaSubmit.
-        // Allow one synthetic click (needed for vendor auto-submit) but block rapid duplicates.
-        if (!event.isTrusted) {
-            const now = Date.now();
-            const lastSyntheticClickAt = lastSyntheticClickByButton.get(submitButton) ?? 0;
-            if (now - lastSyntheticClickAt < SYNTHETIC_CLICK_GUARD_WINDOW_MS) {
-                event.preventDefault();
-                event.stopImmediatePropagation();
-                return;
-            }
-            lastSyntheticClickByButton.set(submitButton, now);
-        }
-    }, true);
-    globalState[SUBMIT_GUARD_STATE_KEY] = true;
-}
-
 class SiaraShieldLoaderService {
     document;
     constructor(document) {
@@ -447,22 +545,18 @@ class SiaraShieldComponent {
         if (!options.publicKey) {
             throw new Error('SiaraShieldComponent: publicKey is required.');
         }
-        const cspNonce = prepareScriptNonce(this.host.nativeElement.ownerDocument, options.cspNonce);
         if ((options.loadJQuery ?? true) && !this.isJQueryAlreadyAvailable()) {
-            await this.loader.loadScript(JQUERY_FALLBACK_SRC$1, { nonce: cspNonce });
+            await this.loader.loadScript(JQUERY_FALLBACK_SRC$1);
         }
-        await this.loader.loadScript(CAPTCHA_SCRIPT_SRC$1, {
-            nonce: cspNonce,
-        });
-        await this.loader.loadScript(VALIDATION_SCRIPT_SRC$1, {
-            nonce: cspNonce,
-        });
+        await this.loader.loadScript(CAPTCHA_SCRIPT_SRC$1);
+        await this.loader.loadScript(VALIDATION_SCRIPT_SRC$1);
         const g = getSiaraShieldGlobals();
         ensureAccessibilityPopupAliases$1();
         this.preventDuplicateValidationBootstrap(g);
+        installVendorChallengeRuntimePatch();
         const initCaptchaFn = getInitCaptchaFn(g);
         if (!initCaptchaFn) {
-            throw new Error('SiaraShield: InitCaptcha() is not available after loading scripts. Check whether CSP blocked vendor scripts or inline execution.');
+            throw new Error('SiaraShield: InitCaptcha() is not available after loading scripts.');
         }
         if (!options.allowVendorConsoleLogs) {
             suppressVendorConsoleWindow();
@@ -504,7 +598,7 @@ class SiaraShieldComponent {
             }
             await new Promise((resolve) => setTimeout(resolve, 100));
         }
-        throw new Error('SiaraShield: CheckCaptcha() was not available within timeout. This can happen when CSP blocks the captcha runtime.');
+        throw new Error('SiaraShield: CheckCaptcha() was not available within timeout.');
     }
     /**
      * Calls the global `CheckCaptcha()` from SiaraShield script.
@@ -513,7 +607,7 @@ class SiaraShieldComponent {
     checkCaptcha() {
         const g = getSiaraShieldGlobals();
         if (!g.CheckCaptcha) {
-            throw new Error('SiaraShield: CheckCaptcha() is not available. Did init() run, and is CSP allowing the captcha scripts?');
+            throw new Error('SiaraShield: CheckCaptcha() is not available. Did init() run?');
         }
         const existingToken = typeof g.CyberSiaraToken === 'string' && g.CyberSiaraToken.length > 0 ? g.CyberSiaraToken : undefined;
         if (existingToken) {
@@ -537,15 +631,33 @@ class SiaraShieldComponent {
         const timeoutMs = options?.timeoutMs ?? 2000;
         const pollIntervalMs = options?.pollIntervalMs ?? 120;
         const beforeCheckDelayMs = options?.beforeCheckDelayMs ?? 140;
+        const retryOnFalseMs = options?.retryOnFalseMs ?? 0;
+        const falseResultTokenWaitMs = options?.falseResultTokenWaitMs ?? 900;
         const existingToken = getSiaraShieldGlobals().CyberSiaraToken;
         if (typeof existingToken === 'string' && existingToken.length > 0) {
             this.token.emit(existingToken);
             return true;
         }
         await new Promise((resolve) => setTimeout(resolve, beforeCheckDelayMs));
-        const ok = this.checkCaptcha();
-        if (!ok)
+        let ok = this.checkCaptcha();
+        // Optional retry for integrations that observe late vendor-state settling.
+        if (!ok && retryOnFalseMs > 0) {
+            await new Promise((resolve) => setTimeout(resolve, retryOnFalseMs));
+            ok = this.checkCaptcha();
+        }
+        if (!ok) {
+            // Some vendor flows return false first, then set token shortly after.
+            const falseStartedAt = Date.now();
+            while (Date.now() - falseStartedAt < falseResultTokenWaitMs) {
+                await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+                const token = getSiaraShieldGlobals().CyberSiaraToken;
+                if (typeof token === 'string' && token.length > 0) {
+                    this.token.emit(token);
+                    return true;
+                }
+            }
             return false;
+        }
         const g = getSiaraShieldGlobals();
         if (typeof g.CyberSiaraToken === 'string' && g.CyberSiaraToken.length > 0) {
             return true;
@@ -644,7 +756,7 @@ async function waitForCheckCaptchaApi(timeoutMs = CAPTCHA_READY_TIMEOUT_MS) {
         }
         await new Promise((resolve) => setTimeout(resolve, 100));
     }
-    throw new Error('SiaraShield: CheckCaptcha() was not available within timeout. This can happen when CSP blocks the captcha runtime.');
+    throw new Error('SiaraShield: CheckCaptcha() was not available within timeout.');
 }
 /**
  * Drop-in initializer for SiaraShield.
@@ -664,22 +776,18 @@ async function initSiaraShield(options) {
     }
     pending = (async () => {
         installCaptchaSubmitGuard();
-        const cspNonce = prepareScriptNonce(document, options.cspNonce);
         if ((options.loadJQuery ?? true) && !isJQueryAlreadyAvailable()) {
-            await loadScript(document, JQUERY_FALLBACK_SRC, { nonce: cspNonce });
+            await loadScript(document, JQUERY_FALLBACK_SRC);
         }
-        await loadScript(document, CAPTCHA_SCRIPT_SRC, {
-            nonce: cspNonce,
-        });
-        await loadScript(document, VALIDATION_SCRIPT_SRC, {
-            nonce: cspNonce,
-        });
+        await loadScript(document, CAPTCHA_SCRIPT_SRC);
+        await loadScript(document, VALIDATION_SCRIPT_SRC);
         const g = getSiaraShieldGlobals();
         ensureAccessibilityPopupAliases();
         preventDuplicateValidationBootstrap(g);
+        installVendorChallengeRuntimePatch();
         const initCaptchaFn = getInitCaptchaFn(g);
         if (!initCaptchaFn) {
-            throw new Error('SiaraShield: InitCaptcha() is not available after loading scripts. Check whether CSP blocked vendor scripts or inline execution.');
+            throw new Error('SiaraShield: InitCaptcha() is not available after loading scripts.');
         }
         if (!options.allowVendorConsoleLogs) {
             suppressVendorConsoleWindow();
@@ -703,7 +811,7 @@ async function initSiaraShield(options) {
 function checkSiaraShieldCaptcha(options) {
     const g = getSiaraShieldGlobals();
     if (!g.CheckCaptcha) {
-        throw new Error('SiaraShield: CheckCaptcha() is not available. Did initSiaraShield() run, and is CSP allowing the captcha scripts?');
+        throw new Error('SiaraShield: CheckCaptcha() is not available. Did initSiaraShield() run?');
     }
     const existingToken = typeof g.CyberSiaraToken === 'string' && g.CyberSiaraToken.length > 0 ? g.CyberSiaraToken : undefined;
     if (existingToken) {
@@ -723,14 +831,31 @@ async function checkSiaraShieldCaptchaAsync(options) {
     const timeoutMs = options?.timeoutMs ?? 1200;
     const pollIntervalMs = options?.pollIntervalMs ?? 120;
     const beforeCheckDelayMs = options?.beforeCheckDelayMs ?? 140;
+    const retryOnFalseMs = options?.retryOnFalseMs ?? 0;
+    const falseResultTokenWaitMs = options?.falseResultTokenWaitMs ?? 900;
     const existingToken = getSiaraShieldGlobals().CyberSiaraToken;
     if (typeof existingToken === 'string' && existingToken.length > 0) {
         return { ok: true, token: existingToken };
     }
     await new Promise((resolve) => setTimeout(resolve, beforeCheckDelayMs));
-    const firstCheck = checkSiaraShieldCaptcha(); // one API call only
-    if (!firstCheck.ok)
+    let firstCheck = checkSiaraShieldCaptcha(); // one API call only
+    if (!firstCheck.ok && retryOnFalseMs > 0) {
+        // Optional retry for integrations that observe late vendor-state settling.
+        await new Promise((resolve) => setTimeout(resolve, retryOnFalseMs));
+        firstCheck = checkSiaraShieldCaptcha();
+    }
+    if (!firstCheck.ok) {
+        // Some vendor flows return false first, then set token shortly after.
+        const falseStartedAt = Date.now();
+        while (Date.now() - falseStartedAt < falseResultTokenWaitMs) {
+            await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+            const token = getSiaraShieldGlobals().CyberSiaraToken;
+            if (typeof token === 'string' && token.length > 0) {
+                return { ok: true, token };
+            }
+        }
         return firstCheck;
+    }
     if (firstCheck.token)
         return firstCheck;
     const startedAt = Date.now();