active_hashcash 0.4.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a8e7f600a4c42efa28175ebb98d4ba2206295bb316b450f79167fae543a52f71
-  data.tar.gz: a62096662ee76b1b31529c71660cae12d8c0c7b01033d2440490aef839d6ed3f
+  metadata.gz: 0c53df9a89fac1a14b89fb109520d7b2c35d1455b3b2624d9200186d9a295cf7
+  data.tar.gz: d090c36da4d4d17f80b5d7a653cbe2544fc311cdcf63a97bd3b46d1cf944631b
 SHA512:
-  metadata.gz: 4fa81355c730a651547d30e0e115bbfc3bcc35623482efb85d324e6ecf826acec46dc7f3b47a8dce48264f8da227b487465d98ba964571b3670f244188653590
-  data.tar.gz: 9aeb5f2fa5c053795402d30c286491f43034a173a26913e3ec81210bb6da95dbc11a547cba98fab1bff81fc22eb832e2984744df1bdc580482c8d882ba213926
+  metadata.gz: cde7a3bfff3389e1761e461dad1a44a2fd480078fd5fb80362c59f5a4a8f8601feff6a9bf28785bab757abf725213060bffaa724815c8a131b3424f7145bedb5
+  data.tar.gz: 3f1c4d3842d4ef2aa871c986d36a9557c3c2b5f94145cdb65375dff56bf3a8e8bd5a24e718783962c3f4a5aaacfef709ae5c2f063b79794fec728ac3c9ef1aab

data/AGENTS.md

@@ -0,0 +1,9 @@
+# Agents - ActiveHashcas
+
+## Coding instructions
+
+- Keep everything as simple as possible
+- Do not extract methods in modules from your initiative
+- Do not use service objects
+- Do not rescue exceptions unless a specific behavior is required
+- Do not test private methods

data/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog of ActiveHashcash
 
+## 0.6.0 (2026-09-22)
+
+- Penalize bad IPs reported by FireHOL lists. For this feature to do anything you must run the migration and schedule the sync job from a cron:
+
+    ```
+    rails active_hashcash:install:migrations
+    rails db:migrate
+    ```
+
+    Then schedule `ActiveHashcash::Reputation::UpdateAllScoresJob.perform_later` anywhere from once per hour to once per day.
+
+- Add `ActiveHashcash.throttle_rules` to slow down pushy IPs
+
+## 0.5.0 (2026-08-08)
+
+- Fix stamp date mismatch by using server date instead of client
+- Replace SHA-1 with SHA-256 for proof-of-work stamps
+- Mine stamps in a Web Worker using pure JS SHA-256 (keeps the main thread unblocked)
+- Support SHA-1 fallback on the backend for backward compatibility (via the `ext` stamp field)
+
 ## 0.4.0 (2025-05-15)
 
 - Prevent from password managers to submit the form before the stamp has been computed

data/README.md

@@ -153,42 +153,125 @@ authenticate :user, -> (u) { u.admin? } do # Supposing there is a User#admin? me
 end
 ```
 
-### Before version 0.3.0
+## Complexity
 
-You must have Redis in order to prevent double spent stamps. Otherwise it will be useless.
-It automatically tries to connect with the environment variables `ACTIVE_HASHCASH_REDIS_URL` or `REDIS_URL`.
-You can also manually set the URL with `ActiveHashcash.redis_url = redis://user:password@localhost:6379`.
+Complexity controls the base proof-of-work difficulty.
+Increasing by one doubles the work time.
+By default its value is 20 and you can change it with `ActiveHashcash.bits = 24` or by overriding the method `hashcash_bits` in the controller.
 
-You should call `ActiveHashcash::Store#clean` once a day, to remove expired stamps.
+### Penalties
 
-To upgrade from 0.2.0 you must run the migration :
+To improve protection, a penalty is added for pushy and bad IPs.
+
+### For pushy IPs
 
+A penalty is added for IPs which submit valid stamps too fast.
+The goal is to slow down attackers using a botnet.
+The penalty rules can be defined like this.
+
+```ruby
+ActiveHashcash.throttle_rules = [
+  {period: 1.hour, rate: 0.5},
+  {period: 24.hours, rate: 0.25}
+]
 ```
-rails active_hashcash:install:migrations
-rails db:migrate
+
+For every valid stamp sent less than an hour ago, a penalty of 0.5 is added.
+Then, for every valid stamp sent between 1 and 24 hours ago a penalty of 0.25 is added.
+Thus, if an IP sent 1 stamp one minute ago, and 3 others few hours ago, it adds a complexity of `(1 * 0.5 + 3 * 0.25).floor # => 1`.
+So next hashcash must have a complexity of `ActiveHashcash.bits + 1`.
+
+If you have many users behind the same IP, such as a NAT, you can either lower the rates or disable the penalty.
+In your controller, override the method `hashcash_throttle_penalty`:
+
+```ruby
+class SessionController < ApplicationController
+  include ActiveHashcash
+
+  def hashcash_throttle_penalty
+    # Only the base complexity (ActiveHashcash.bits) will apply for people with IP 1.2.3.4
+    hashcash_ip_address == "1.2.3.4" ? 0 : super
+  end
+end
 ```
 
-## Complexity
+Or, if someone is attacking you from a specific country:
+
+```ruby
+class SessionController < ApplicationController
+  include ActiveHashcash
+
+  def hashcash_throttle_penalty
+    geoip.country(hashcash_ip_address).country_code == "XX" ? super + 2 : super
+  end
+end
+```
 
-Complexity is the most important parameter. By default its value is 20 and requires most of the time 5 to 20 seconds to be solved on a decent laptop.
-The user won't wait that long, since he needs to fill the form while the problem is solving.
-However, if your application includes people with slow and old devices, then consider lowering this value, to 16 or 18.
+### For IPs with poor reputation
 
-You can change the minimum complexity with `ActiveHashcash.bits = 20`.
+The following lists are used to increase the complexity for bad IPs:
 
-Since version 0.3.0, the complexity increases with the number of stamps spent during le last 24H from the same IP address.
-Thus it becomes very efficient to slow down brute force attacks.
+  - [FireHOL abusers 1 day](https://iplists.firehol.org/files/firehol_abusers_1d.netset)
+  - [FireHOL abusers 30 days](https://iplists.firehol.org/files/firehol_abusers_30d.netset)
+  - [FireHOL anonymous](https://iplists.firehol.org/files/firehol_anonymous.netset) (Tor, public proxies, etc.)
+  - [FireHOL level 1](https://iplists.firehol.org/files/firehol_level1.netset)
+  - [FireHOL level 2](https://iplists.firehol.org/files/firehol_level2.netset)
+  - [FireHOL level 3](https://iplists.firehol.org/files/firehol_level3.netset)
+  - [FireHOL level 4](https://iplists.firehol.org/files/firehol_level4.netset)
+
+The lists are stored in `ActiveHashcash::Reputation::IPv4Address` (single IPs) and `ActiveHashcash::Reputation::IPv4Range` (CIDR ranges). For this feature to do anything you must run the migration and schedule `ActiveHashcash::Reputation::UpdateAllScoresJob.perform_later` from a cron anywhere from once per hour to once per day.
+If you update too often you might be blocked.
+Updating reputation for ranges probably will not work before Rails 7.1 because of composite primary key + `upsert_all`.
+
+If you don't trust these external lists, don't schedule that job and delete all records of `ActiveHashcash::Reputation::IPv4Address` and `ActiveHashcash::Reputation::IPv4Range`.
+
+The penalty can be high enough that the proof of work is almost impossible.
+That is useful to neutralize bots.
+
+## Testing Your Application
+
+Browser tests submit the real form, so they have to compute a real stamp. At the default complexity this adds noticeable time to every submission and slows down your suite. Drop the complexity in the test environment so it finishes almost instantly:
+
+```ruby
+# spec/rails_helper.rb (RSpec) or test/test_helper.rb (Minitest)
+ActiveHashcash.bits = 1
+```
+
+Use `ActiveHashcash::Stamp.mint` to submit hashcash to your sensitive forms:
+
+```ruby
+class SessionControllerTest < ActionDispatch::IntegrationTest
+  def test_create
+    # ...
+    hashcash = ActiveHashcash::Stamp.mint(host).to_s
+    post(session_path, params: {email: email, password: password, hashcash: hashcash})
+    # ...
+  end
+end
+```
 
 ## Limitations
 
-The JavaScript implementation is 10 to 20 times slower than the official C version.
-I first used the SubtleCrypto API but it is surprisingly slower than a custom SHA1 implementation.
-Maybe I did in an inefficient way 2df3ba5?
-Another idea would be to compile the work algorithm in wasm.
+The JavaScript implementation is slower than the official C version.
+It uses a pure JS SHA-256 implementation running inside a Web Worker, which keeps the main thread responsive while mining.
+A synchronous tight loop avoids the per-call async overhead of `crypto.subtle.digest()`, making it the fastest browser-side approach across Chrome and Safari.
+
+No `crypto.subtle` or secure context (HTTPS) is required, so it works in any environment including plain HTTP during development.
 
-Unfortunately, I'm not a JavaScript expert.
-Maybe you have good JS skills to optimize it?
-Any help would be appreciate to better fights bots and brute for attacks!
+### Before version 0.3.0
+
+You must have Redis in order to prevent double spent stamps. Otherwise it will be useless.
+It automatically tries to connect with the environment variables `ACTIVE_HASHCASH_REDIS_URL` or `REDIS_URL`.
+You can also manually set the URL with `ActiveHashcash.redis_url = redis://user:password@localhost:6379`.
+
+You should call `ActiveHashcash::Store#clean` once a day, to remove expired stamps.
+
+To upgrade from 0.2.0 you must run the migration :
+
+```
+rails active_hashcash:install:migrations
+rails db:migrate
+```
 
 ## Contributing
 

data/app/assets/javascripts/hashcash.js

@@ -1,11 +1,15 @@
 // http://www.hashcash.org/docs/hashcash.html
-// <input type="hiden" name="hashcash" data-hashcash="{resource: 'site.example', bits: 16}"/>
+// <input type="hidden" name="hashcash" data-hashcash="{resource: 'site.example', bits: 16}"/>
 Hashcash = function(input) {
   options = JSON.parse(input.getAttribute("data-hashcash"))
   Hashcash.disableParentForm(input, options)
   input.dispatchEvent(new CustomEvent("hashcash:mint", {bubbles: true}))
 
   Hashcash.mint(options.resource, options, function(stamp) {
+    // Guard against Turbo navigation: if the input is no longer in the DOM,
+    // the user has navigated away and we should silently discard the result.
+    if (!input.isConnected) return
+
     input.value = stamp.toString()
     Hashcash.enableParentForm(input, options)
     input.dispatchEvent(new CustomEvent("hashcash:minted", {bubbles: true, detail: {stamp: stamp}}))
@@ -20,9 +24,39 @@ Hashcash.setup = function() {
     var input = document.querySelector("input#hashcash")
     input && new Hashcash(input)
   } else
-    document.addEventListener("DOMContentLoaded", Hashcash.setup )
+    document.addEventListener("DOMContentLoaded", Hashcash.setup)
 }
 
+// Terminate the active worker and clean up its Blob URL.
+Hashcash.cleanup = function() {
+  if (Hashcash._worker) {
+    Hashcash._worker.terminate()
+    Hashcash._worker = null
+  }
+  if (Hashcash._workerUrl) {
+    URL.revokeObjectURL(Hashcash._workerUrl)
+    Hashcash._workerUrl = null
+  }
+}
+
+// Turbo Drive: terminate the worker when navigating away so it doesn't
+// complete after the page has changed, and restore the form state for
+// Turbo's page cache so the snapshot doesn't have disabled buttons.
+document.addEventListener("turbo:before-visit", Hashcash.cleanup)
+document.addEventListener("turbo:before-cache", function() {
+  Hashcash.cleanup()
+  var input = document.querySelector("input#hashcash")
+  if (input && input.form) {
+    input.value = ""
+    input.form.querySelectorAll("[type=submit]").forEach(function(submit) {
+      if (submit.originalValue) {
+        Hashcash.setSubmitText(submit, submit.originalValue)
+      }
+      submit.disabled = null
+    })
+  }
+})
+
 Hashcash.setSubmitText = function(submit, text) {
   if (!text) {
     return
@@ -57,62 +91,45 @@ Hashcash.prototype.preventFromAutoSubmitFromPasswordManagers = function(event) {
 Hashcash.default = {
   version: 1,
   bits: 20,
-  extension: null,
 }
 
 Hashcash.mint = function(resource, options, callback) {
-  // Format date to YYMMDD
-  var date = new Date
-  var year = date.getFullYear().toString()
-  year = year.slice(year.length - 2, year.length)
-  var month = (date.getMonth() + 1).toString().padStart(2, "0")
-  var day = date.getDate().toString().padStart(2, "0")
-
   var stamp = new Hashcash.Stamp(
     options.version || Hashcash.default.version,
     options.bits || Hashcash.default.bits,
-    options.date || year + month + day,
+    options.date || Hashcash.formatToday(),
     resource,
-    options.extension || Hashcash.default.extension,
-    options.rand || Math.random().toString(36).substr(2, 10),
+    options.rand || Math.random().toString(36).substr(2, 10)
   )
   return stamp.work(callback)
 }
 
-Hashcash.Stamp = function(version, bits, date, resource, extension, rand, counter = 0) {
+// Format date to YYMMDD
+Hashcash.formatToday = function() {
+  var date = new Date
+  var year = date.getFullYear().toString()
+  year = year.slice(year.length - 2, year.length)
+  var month = (date.getMonth() + 1).toString().padStart(2, "0")
+  var day = date.getDate().toString().padStart(2, "0")
+  return year + month + day
+}
+
+Hashcash.Stamp = function(version, bits, date, resource, rand, counter) {
   this.version = version
   this.bits = bits
   this.date = date
   this.resource = resource
-  this.extension = extension
   this.rand = rand
-  this.counter = counter
+  this.counter = counter || 0
 }
 
 Hashcash.Stamp.parse = function(string) {
   var args = string.split(":")
-  return new Hashcash.Stamp(args[0], args[1], args[2], args[3], args[4], args[5], args[6])
+  return new Hashcash.Stamp(args[0], args[1], args[2], args[3], args[5], args[6])
 }
 
 Hashcash.Stamp.prototype.toString = function() {
-  return [this.version, this.bits, this.date, this.resource, this.extension, this.rand, this.counter].join(":")
-}
-
-// Trigger the given callback when the problem is solved.
-// In order to not freeze the page, setTimeout is called every 100ms to let some CPU to other tasks.
-Hashcash.Stamp.prototype.work = function(callback) {
-  this.startClock()
-  var timer = performance.now()
-  while (!this.check())
-    if (this.counter++ && performance.now() - timer > 100)
-      return setTimeout(this.work.bind(this), 0, callback)
-  this.stopClock()
-  callback(this)
-}
-
-Hashcash.Stamp.prototype.check = function() {
-  var array = Hashcash.sha1(this.toString())
-  return array[0] >> (160-this.bits) == 0
+  return [this.version, this.bits, this.date, this.resource, "sha256", this.rand, this.counter].join(":")
 }
 
 Hashcash.Stamp.prototype.startClock = function() {
@@ -126,151 +143,176 @@ Hashcash.Stamp.prototype.stopClock = function() {
   console.debug("Hashcash " + this.toString() + " minted in " + duration + "ms (" + speed + " per seconds)")
 }
 
-/**
- * Secure Hash Algorithm (SHA1)
- * http://www.webtoolkit.info/
- **/
-Hashcash.sha1 = function(msg) {
-  var rotate_left = Hashcash.sha1.rotate_left
-  var Utf8Encode = Hashcash.sha1.Utf8Encode
-
-  var blockstart;
-  var i, j;
-  var W = new Array(80);
-  var H0 = 0x67452301;
-  var H1 = 0xEFCDAB89;
-  var H2 = 0x98BADCFE;
-  var H3 = 0x10325476;
-  var H4 = 0xC3D2E1F0;
-  var A, B, C, D, E;
-  var temp;
-  msg = Utf8Encode(msg);
-  var msg_len = msg.length;
-  var word_array = new Array();
-  for (i = 0; i < msg_len - 3; i += 4) {
-    j = msg.charCodeAt(i) << 24 | msg.charCodeAt(i + 1) << 16 |
-      msg.charCodeAt(i + 2) << 8 | msg.charCodeAt(i + 3);
-    word_array.push(j);
-  }
-  switch (msg_len % 4) {
-    case 0:
-      i = 0x080000000;
-      break;
-    case 1:
-      i = msg.charCodeAt(msg_len - 1) << 24 | 0x0800000;
-      break;
-    case 2:
-      i = msg.charCodeAt(msg_len - 2) << 24 | msg.charCodeAt(msg_len - 1) << 16 | 0x08000;
-      break;
-    case 3:
-      i = msg.charCodeAt(msg_len - 3) << 24 | msg.charCodeAt(msg_len - 2) << 16 | msg.charCodeAt(msg_len - 1) << 8 | 0x80;
-      break;
-  }
-  word_array.push(i);
-  while ((word_array.length % 16) != 14) word_array.push(0);
-  word_array.push(msg_len >>> 29);
-  word_array.push((msg_len << 3) & 0x0ffffffff);
-  for (blockstart = 0; blockstart < word_array.length; blockstart += 16) {
-    for (i = 0; i < 16; i++) W[i] = word_array[blockstart + i];
-    for (i = 16; i <= 79; i++) W[i] = rotate_left(W[i - 3] ^ W[i - 8] ^ W[i - 14] ^ W[i - 16], 1);
-    A = H0;
-    B = H1;
-    C = H2;
-    D = H3;
-    E = H4;
-    for (i = 0; i <= 19; i++) {
-      temp = (rotate_left(A, 5) + ((B & C) | (~B & D)) + E + W[i] + 0x5A827999) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
-    }
-    for (i = 20; i <= 39; i++) {
-      temp = (rotate_left(A, 5) + (B ^ C ^ D) + E + W[i] + 0x6ED9EBA1) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
+// Mine a valid stamp using a Web Worker with a pure JS SHA-256 implementation.
+// The worker is inlined as a Blob URL so no extra file needs to be served.
+// Using a Web Worker keeps the main thread completely unblocked while mining.
+// A synchronous SHA-256 in a tight loop is faster than async crypto.subtle
+// because it avoids the per-call Promise/microtask overhead entirely.
+Hashcash.Stamp.prototype.work = function(callback) {
+  this.startClock()
+  var self = this
+
+  var workerCode = function() {
+    // SHA-256 round constants (FIPS 180-4 §4.2.2)
+    var K = new Uint32Array([
+      0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
+      0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
+      0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
+      0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
+      0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
+      0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
+      0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
+      0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2
+    ]);
+
+    // Compute SHA-256 over the first `len` bytes of `bytes`. Returns an array
+    // of 8 big-endian 32-bit integers (the 256-bit digest).
+    function sha256bytes(bytes, len) {
+      // Pad to a multiple of 64 bytes: append 0x80, then zeros, then 64-bit
+      // big-endian bit length (we only use the low 32 bits since stamp strings
+      // are always shorter than 512 MB).
+      var padded = new Uint8Array(((len + 9 + 63) & ~63));
+      for (var i = 0; i < len; i++) padded[i] = bytes[i];
+      padded[len] = 0x80;
+      var bitLen = len * 8;
+      var pLen = padded.length;
+      padded[pLen - 4] = (bitLen >>> 24) & 0xff;
+      padded[pLen - 3] = (bitLen >>> 16) & 0xff;
+      padded[pLen - 2] = (bitLen >>> 8) & 0xff;
+      padded[pLen - 1] = bitLen & 0xff;
+
+      // Initial hash values (FIPS 180-4 §5.3.3)
+      var H0 = 0x6a09e667, H1 = 0xbb67ae85, H2 = 0x3c6ef372, H3 = 0xa54ff53a;
+      var H4 = 0x510e527f, H5 = 0x9b05688c, H6 = 0x1f83d9ab, H7 = 0x5be0cd19;
+      var W = new Int32Array(64);
+
+      // Process each 512-bit (64-byte) block
+      for (var off = 0; off < pLen; off += 64) {
+        for (var t = 0; t < 16; t++) {
+          W[t] = (padded[off+t*4]<<24)|(padded[off+t*4+1]<<16)|(padded[off+t*4+2]<<8)|padded[off+t*4+3];
+        }
+        for (var t = 16; t < 64; t++) {
+          var w15 = W[t-15], w2 = W[t-2];
+          W[t] = (W[t-16] + (((w15>>>7)|(w15<<25))^((w15>>>18)|(w15<<14))^(w15>>>3)) + W[t-7] + (((w2>>>17)|(w2<<15))^((w2>>>19)|(w2<<13))^(w2>>>10))) | 0;
+        }
+        var a=H0,b=H1,c=H2,d=H3,e=H4,f=H5,g=H6,h=H7;
+        for (var t = 0; t < 64; t++) {
+          var t1 = (h + (((e>>>6)|(e<<26))^((e>>>11)|(e<<21))^((e>>>25)|(e<<7))) + ((e&f)^(~e&g)) + K[t] + W[t]) | 0;
+          var t2 = ((((a>>>2)|(a<<30))^((a>>>13)|(a<<19))^((a>>>22)|(a<<10))) + ((a&b)^(a&c)^(b&c))) | 0;
+          h=g; g=f; f=e; e=(d+t1)|0; d=c; c=b; b=a; a=(t1+t2)|0;
+        }
+        H0=(H0+a)|0; H1=(H1+b)|0; H2=(H2+c)|0; H3=(H3+d)|0;
+        H4=(H4+e)|0; H5=(H5+f)|0; H6=(H6+g)|0; H7=(H7+h)|0;
+      }
+      return [H0, H1, H2, H3, H4, H5, H6, H7];
     }
-    for (i = 40; i <= 59; i++) {
-      temp = (rotate_left(A, 5) + ((B & C) | (B & D) | (C & D)) + E + W[i] + 0x8F1BBCDC) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
+
+    // Encode a string as bytes into a pre-allocated buffer at `offset`.
+    // Handles ASCII and basic UTF-8 (BMP only).
+    function strToBytes(str, out, offset) {
+      for (var i = 0; i < str.length; i++) {
+        var c = str.charCodeAt(i);
+        if (c < 128) out[offset++] = c;
+        else if (c < 2048) { out[offset++] = (c>>6)|192; out[offset++] = (c&63)|128; }
+        else { out[offset++] = (c>>12)|224; out[offset++] = ((c>>6)&63)|128; out[offset++] = (c&63)|128; }
+      }
+      return offset;
     }
-    for (i = 60; i <= 79; i++) {
-      temp = (rotate_left(A, 5) + (B ^ C ^ D) + E + W[i] + 0xCA62C1D6) & 0x0ffffffff;
-      E = D;
-      D = C;
-      C = rotate_left(B, 30);
-      B = A;
-      A = temp;
+
+    // Write the decimal digits of `n` as ASCII bytes into `out` at `offset`.
+    // Avoids string allocation in the hot loop.
+    function numToBytes(n, out, offset) {
+      if (n === 0) { out[offset] = 48; return offset + 1; }
+      var digs = [];
+      while (n > 0) { digs.push(48 + (n % 10)); n = (n / 10) | 0; }
+      for (var i = digs.length - 1; i >= 0; i--) out[offset++] = digs[i];
+      return offset;
     }
-    H0 = (H0 + A) & 0x0ffffffff;
-    H1 = (H1 + B) & 0x0ffffffff;
-    H2 = (H2 + C) & 0x0ffffffff;
-    H3 = (H3 + D) & 0x0ffffffff;
-    H4 = (H4 + E) & 0x0ffffffff;
-  }
-  return [H0, H1, H2, H3, H4]
-}
 
-Hashcash.hexSha1 = function(msg) {
-  var array = Hashcash.sha1(msg)
-  var cvt_hex = Hashcash.sha1.cvt_hex
-  return cvt_hex(array[0]) + cvt_hex(array[1]) + cvt_hex(array[2]) + cvt_hex(array3) + cvt_hex(array[4])
-}
+    self.addEventListener("message", function(e) {
+      var d = e.data;
+      var prefix = d.prefix + ":";
+      var bits = d.bits;
+      var counter = 0;
 
-Hashcash.sha1.rotate_left = function(n, s) {
-  var t4 = (n << s) | (n >>> (32 - s));
-  return t4;
-};
-
-Hashcash.sha1.lsb_hex = function(val) {
-  var str = '';
-  var i;
-  var vh;
-  var vl;
-  for (i = 0; i <= 6; i += 2) {
-    vh = (val >>> (i * 4 + 4)) & 0x0f;
-    vl = (val >>> (i * 4)) & 0x0f;
-    str += vh.toString(16) + vl.toString(16);
-  }
-  return str;
-};
-
-Hashcash.sha1.cvt_hex = function(val) {
-  var str = '';
-  var i;
-  var v;
-  for (i = 7; i >= 0; i--) {
-    v = (val >>> (i * 4)) & 0x0f;
-    str += v.toString(16);
+      // Pre-compute how many leading zero bytes and remaining bits to check
+      var fullBytes = Math.floor(bits / 8);
+      var remBits = bits % 8;
+      var mask = remBits > 0 ? (0xFF << (8 - remBits)) & 0xFF : 0;
+
+      // Pre-encode the stamp prefix (everything before the counter) into a
+      // reusable byte buffer. Only the counter digits change per iteration.
+      var buf = new Uint8Array(prefix.length + 12);
+      var prefixLen = strToBytes(prefix, buf, 0);
+
+      // Yield every 65536 iterations so the worker stays terminable.
+      var YIELD = 65536;
+
+      function mine() {
+        var end = counter + YIELD;
+        while (counter < end) {
+          var len = numToBytes(counter, buf, prefixLen);
+          var H = sha256bytes(buf, len);
+
+          // Check leading zero bits by walking the digest words byte-by-byte.
+          var ok = true, byteIdx = 0;
+          check:
+          for (var w = 0; w < 8 && byteIdx <= fullBytes; w++) {
+            var word = H[w];
+            for (var s = 24; s >= 0; s -= 8) {
+              var bv = (word >>> s) & 0xFF;
+              if (byteIdx < fullBytes) {
+                if (bv !== 0) { ok = false; break check; }
+              } else if (byteIdx === fullBytes && remBits > 0) {
+                if ((bv & mask) !== 0) ok = false;
+                break check;
+              } else { break check; }
+              byteIdx++;
+            }
+          }
+          if (ok) { self.postMessage({ found: true, counter: counter }); return; }
+          counter++;
+        }
+        setTimeout(mine, 0);
+      }
+      mine();
+    });
   }
-  return str;
-};
-
-Hashcash.sha1.Utf8Encode = function(string) {
-  string = string.replace(/\r\n/g, '\n');
-  var utftext = '';
-  for (var n = 0; n < string.length; n++) {
-    var c = string.charCodeAt(n);
-    if (c < 128) {
-      utftext += String.fromCharCode(c);
-    } else if ((c > 127) && (c < 2048)) {
-      utftext += String.fromCharCode((c >> 6) | 192);
-      utftext += String.fromCharCode((c & 63) | 128);
-    } else {
-      utftext += String.fromCharCode((c >> 12) | 224);
-      utftext += String.fromCharCode(((c >> 6) & 63) | 128);
-      utftext += String.fromCharCode((c & 63) | 128);
+
+  // Clean up any previous worker (e.g. Turbo restoring a cached page)
+  Hashcash.cleanup()
+
+  var blob = new Blob(
+    ["(" + workerCode.toString() + ")()"],
+    {type: "application/javascript"}
+  )
+  var workerUrl = URL.createObjectURL(blob)
+  var worker = new Worker(workerUrl)
+
+  // Track the active worker so Hashcash.cleanup() can terminate it
+  Hashcash._worker = worker
+  Hashcash._workerUrl = workerUrl
+
+  worker.onmessage = function(e) {
+    if (e.data.found) {
+      Hashcash._worker = null
+      Hashcash._workerUrl = null
+      self.counter = e.data.counter
+      self.stopClock()
+      worker.terminate()
+      URL.revokeObjectURL(workerUrl)
+      callback(self)
     }
   }
-  return utftext;
-};
+
+  // Build the prefix once and send it to the worker. The worker appends the
+  // counter on each iteration, avoiding repeated string building.
+  var prefix = [this.version, this.bits, this.date, this.resource, "sha256", this.rand].join(":")
+
+  worker.postMessage({
+    prefix: prefix,
+    bits: parseInt(this.bits, 10)
+  })
+}
 
 Hashcash.setup()

data/app/jobs/active_hashcash/reputation/cleanup_job.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module ActiveHashcash
+  module Reputation
+    class CleanupJob < ApplicationJob
+      def perform
+        IPv4Address.delete_zero_scores
+        IPv4Range.delete_zero_scores
+      end
+    end
+  end
+end

data/app/jobs/active_hashcash/reputation/update_abuse_score_job.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module ActiveHashcash
+  module Reputation
+    class UpdateAbuseScoreJob < UpdateScoreJob
+      # Higher scores first so upsert_score keeps the max via uniq.
+      URLS = {
+        "https://iplists.firehol.org/files/firehol_abusers_1d.netset" => 2,
+        "https://iplists.firehol.org/files/firehol_abusers_30d.netset" => 1
+      }.freeze
+    end
+  end
+end

data/app/jobs/active_hashcash/reputation/update_all_scores_job.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module ActiveHashcash
+  module Reputation
+    class UpdateAllScoresJob < ApplicationJob
+      DEFAULT_JOBS = [UpdateAbuseScoreJob, UpdateAnonymousScoreJob, UpdateAttackScoreJob, CleanupJob].freeze
+
+      def perform(jobs = DEFAULT_JOBS.dup)
+        if (job = jobs.shift)
+          job.perform_now
+          self.class.perform_later(jobs) if jobs.any?
+        end
+      end
+    end
+  end
+end

data/app/jobs/active_hashcash/reputation/update_anonymous_score_job.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module ActiveHashcash
+  module Reputation
+    class UpdateAnonymousScoreJob < UpdateScoreJob
+      URLS = {
+        "https://iplists.firehol.org/files/firehol_anonymous.netset" => 1
+      }.freeze
+
+      def max_body_size
+        50.megabytes
+      end
+
+      def read_timeout
+        20
+      end
+    end
+  end
+end

data/app/jobs/active_hashcash/reputation/update_attack_score_job.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module ActiveHashcash
+  module Reputation
+    class UpdateAttackScoreJob < UpdateScoreJob
+      # Higher scores first so upsert_score keeps the max via uniq.
+      URLS = {
+        "https://iplists.firehol.org/files/firehol_level1.netset" => 4,
+        "https://iplists.firehol.org/files/firehol_level2.netset" => 3,
+        "https://iplists.firehol.org/files/firehol_level3.netset" => 2,
+        "https://iplists.firehol.org/files/firehol_level4.netset" => 1
+      }.freeze
+    end
+  end
+end

data/app/jobs/active_hashcash/reputation/update_score_job.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "net/http"
+require "uri"
+
+module ActiveHashcash
+  module Reputation
+    class UpdateScoreJob < ApplicationJob
+      def perform
+        entries = self.class::URLS.flat_map { |url, score| normalize(fetch(url), score) }
+        raise "Empty list" if entries.empty?
+        addresses, ranges = entries.partition { |ip, _| ip.prefix == 32 }
+        IPv4Address.transaction do
+          IPv4Address.reset_score(score_name, addresses)
+          IPv4Range.reset_score(score_name, ranges)
+        end
+      end
+
+      def score_name
+        self.class.name[/Update(\w*)ScoreJob/, 1].downcase.to_sym
+      end
+
+      def fetch(url)
+        uri = URI(url)
+        body = +""
+
+        Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https", open_timeout: open_timeout, read_timeout: read_timeout) do |http|
+          http.request(Net::HTTP::Get.new(uri)) do |response|
+            response.error! unless response.is_a?(Net::HTTPSuccess)
+            response.read_body do |chunk|
+              body << chunk
+              raise "Response body exceeds #{max_body_size} bytes" if body.bytesize > max_body_size
+            end
+          end
+        end
+
+        body
+      end
+
+      def open_timeout
+        5
+      end
+
+      def read_timeout
+        10
+      end
+
+      def max_body_size
+        10.megabytes
+      end
+
+      def normalize(body, score)
+        body.each_line.filter_map do |line|
+          next if (line = line.strip).blank? || line.start_with?("#", ";")
+          next if (ip = IPAddr.new(line)).private? || ip.loopback? || ip.link_local? || !ip.ipv4? || ip.prefix < IPv4Range::MIN_PREFIX
+          [ip, score]
+        rescue IPAddr::InvalidAddressError
+          next
+        end
+      end
+    end
+  end
+end

data/app/models/active_hashcash/reputation/ipv4_address.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module ActiveHashcash
+  module Reputation
+    class IPv4Address < ApplicationRecord
+      self.table_name = "active_hashcash_reputation_ipv4_addresses"
+
+      validates :id, presence: true, length: {is: 4}
+      validates :anonymous_score, inclusion: {in: 0..1}
+      validates :abuse_score, inclusion: {in: 0..2}
+      validates :attack_score, inclusion: {in: 0..4}
+
+      def self.scores(ip)
+        abuse, anonymous, attack = where(id: ActiveRecord::Type::Binary.new.serialize(IPAddr.new(ip).hton)).pick(:abuse_score, :anonymous_score, :attack_score)
+        {abuse: abuse || 0, anonymous: anonymous || 0, attack: attack || 0}
+      rescue IPAddr::InvalidAddressError
+        {abuse: 0, anonymous: 0, attack: 0}
+      end
+
+      def self.reset_score(name, entries)
+        column = :"#{name}_score"
+        entries.uniq! { |ip, _| ip }
+        transaction do
+          where(column => 1..).update_all(column => 0)
+          entries.each_slice(10_000) { |batch| upsert_score(column, batch) }
+        end
+      end
+
+      def self.upsert_score(column, entries)
+        upsert_all(
+          entries.map { |ip, value| {id: ip.hton, column => value} },
+          record_timestamps: false,
+          update_only: [column]
+        )
+      end
+
+      def self.delete_zero_scores
+        where(anonymous_score: 0, abuse_score: 0, attack_score: 0).delete_all
+      end
+    end
+  end
+end

data/app/models/active_hashcash/reputation/ipv4_range.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module ActiveHashcash
+  module Reputation
+    class IPv4Range < ApplicationRecord
+      self.table_name = "active_hashcash_reputation_ipv4_ranges"
+
+      MIN_PREFIX = 16 # Reject nets too large
+
+      validates :first_address, :last_address, presence: true, length: {is: 4}
+      validates :anonymous_score, inclusion: {in: 0..1}
+      validates :abuse_score, inclusion: {in: 0..2}
+      validates :attack_score, inclusion: {in: 0..4}
+
+      # PK probes for ancestor CIDRs /MIN_PREFIX../32 (wider prefixes are ignored).
+      scope :by_address, -> (string) {
+        ip = IPAddr.new(string)
+        binary = ActiveRecord::Type::Binary.new
+        pairs = (MIN_PREFIX..32).map do |prefix|
+          range = IPAddr.new("#{ip}/#{prefix}").to_range
+          [binary.serialize(range.first.hton), binary.serialize(range.last.hton)]
+        end
+        where(pairs.map { "(first_address = ? AND last_address = ?)" }.join(" OR "), *pairs.flatten)
+      }
+
+      def self.scores(ip)
+        abuse, anonymous, attack = by_address(ip).pick(Arel.sql("max(abuse_score), max(anonymous_score), max(attack_score)"))
+        {abuse: abuse || 0, anonymous: anonymous || 0, attack: attack || 0}
+      rescue IPAddr::InvalidAddressError
+        {abuse: 0, anonymous: 0, attack: 0}
+      end
+
+      def self.reset_score(name, entries)
+        column = :"#{name}_score"
+        entries.uniq! { |ip, _| ip }
+        transaction do
+          where(column => 1..).update_all(column => 0)
+          entries.each_slice(10_000) { |batch| upsert_score(column, batch) }
+        end
+      end
+
+      def self.upsert_score(column, entries)
+        upsert_all(
+          entries.map do |ip, value|
+            range = ip.to_range
+            {first_address: range.first.hton, last_address: range.last.hton, column => value}
+          end,
+          record_timestamps: false,
+          update_only: [column]
+        )
+      end
+
+      def self.delete_zero_scores
+        where(anonymous_score: 0, abuse_score: 0, attack_score: 0).delete_all
+      end
+    end
+  end
+end

data/app/models/active_hashcash/reputation.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module ActiveHashcash
+  module Reputation
+    def self.scores(ip)
+      address = IPv4Address.scores(ip)
+      range = IPv4Range.scores(ip)
+      {
+        abuse: [address[:abuse], range[:abuse]].max,
+        anonymous: [address[:anonymous], range[:anonymous]].max,
+        attack: [address[:attack], range[:attack]].max
+      }
+    end
+  end
+end

data/app/models/active_hashcash/stamp.rb

@@ -26,6 +26,24 @@ module ActiveHashcash
       scope
     end
 
+    # Returns stamp counts per period for disjoint windows.
+    # +periods+ must be sorted shortest to longest (as ensured by ActiveHashcash.throttle_rules=).
+    def self.sum_by_periods(periods)
+      return [] if periods.blank?
+
+      cutoffs = periods.map(&:ago)
+      columns = cutoffs.each_with_index.map do |cutoff, index|
+        if index.zero?
+          sanitize_sql(["sum(CASE WHEN created_at >= ? THEN 1 ELSE 0 END)", cutoff])
+        else
+          previous_cutoff = cutoffs[index - 1]
+          sanitize_sql(["sum(CASE WHEN created_at < ? AND created_at >= ? THEN 1 ELSE 0 END)", previous_cutoff, cutoff])
+        end
+      end.join(", ")
+
+      Array.wrap(where(created_at: cutoffs.min..).pluck(Arel.sql(columns)).first)
+    end
+
     # Verify and save the hashcash stamp.
     # Saving in the database prevent from double spending the same stamp.
     def self.spend(string, resource, bits, date, options = {})
@@ -36,7 +54,7 @@ module ActiveHashcash
       false
     end
 
-    # Pare and instanciate a stamp from a sting which respects the hashcash format:
+    # Parse and instantiate a stamp from a string which respects the hashcash format:
     #
     #   ver:bits:date:resource:[ext]:rand:counter
     def self.parse(string)
@@ -51,6 +69,7 @@ module ActiveHashcash
         bits: ActiveHashcash.bits,
         date: Date.today.strftime(ActiveHashcash.date_format),
         resource: resource,
+        ext: "sha256",
         rand: SecureRandom.alphanumeric(16),
         counter: 0,
       }.merge(attributes)).work
@@ -62,7 +81,11 @@ module ActiveHashcash
     end
 
     def authentic?
-      Digest::SHA1.hexdigest(to_s).hex >> (160-bits) == 0
+      if ext == "sha256"
+        Digest::SHA256.hexdigest(to_s).hex >> (256 - bits) == 0
+      else
+        Digest::SHA1.hexdigest(to_s).hex >> (160 - bits) == 0
+      end
     end
 
     def verify(resource, bits, date)

data/db/migrate/20260831130000_create_active_hashcash_reputation_ipv4s.rb

@@ -0,0 +1,54 @@
+# IPv4 reputation addresses and ranges are stored in the database.
+# This migration creates the tables for ActiveHashcash::Reputation::IPv4Address
+# and ActiveHashcash::Reputation::IPv4Range.
+# Run the following commands to add them to your Rails application:
+#
+#   rails active_hashcash:install:migrations
+#   rails db:migrate
+#
+class CreateActiveHashcashReputationIpv4s < ActiveRecord::Migration[5.2]
+  def up
+    # uint32 would have been the best choice for storing IPv4, but PostgreSQL does not support unsigned integers.
+    # So, 4-byte binary column is a trade off for best efficiency compatible with PostgreSQL, MySQL and SQLite.
+    create_table :active_hashcash_reputation_ipv4_addresses, id: false do |t|
+      t.binary :id, limit: 4, null: false, primary_key: true
+      t.integer :abuse_score, limit: 1, null: false, default: 0
+      t.integer :anonymous_score, limit: 1, null: false, default: 0
+      t.integer :attack_score, limit: 1, null: false, default: 0
+    end
+
+    create_table :active_hashcash_reputation_ipv4_ranges, primary_key: [:first_address, :last_address] do |t|
+      t.binary :first_address, limit: 4, null: false
+      t.binary :last_address, limit: 4, null: false
+      t.integer :abuse_score, limit: 1, null: false, default: 0
+      t.integer :anonymous_score, limit: 1, null: false, default: 0
+      t.integer :attack_score, limit: 1, null: false, default: 0
+    end
+
+    # For SQLite, save space by suffixing the CREATE TABLE statements by `WITHOUT ROWID`:
+    # execute <<-SQL
+    #   CREATE TABLE IF NOT EXISTS "active_hashcash_reputation_ipv4_addresses" (
+    #     "id" blob(4) NOT NULL,
+    #     "abuse_score" integer(1) DEFAULT 0 NOT NULL,
+    #     "anonymous_score" integer(1) DEFAULT 0 NOT NULL,
+    #     "attack_score" integer(1) DEFAULT 0 NOT NULL,
+    #     PRIMARY KEY ("id")
+    #   ) WITHOUT ROWID;
+    # SQL
+    # execute <<-SQL
+    #   CREATE TABLE IF NOT EXISTS "active_hashcash_reputation_ipv4_ranges" (
+    #     "first_address" blob(4) NOT NULL,
+    #     "last_address" blob(4) NOT NULL,
+    #     "abuse_score" integer(1) DEFAULT 0 NOT NULL,
+    #     "anonymous_score" integer(1) DEFAULT 0 NOT NULL,
+    #     "attack_score" integer(1) DEFAULT 0 NOT NULL,
+    #     PRIMARY KEY ("first_address", "last_address")
+    #   ) WITHOUT ROWID;
+    # SQL
+  end
+
+  def down
+    drop_table :active_hashcash_reputation_ipv4_addresses
+    drop_table :active_hashcash_reputation_ipv4_ranges
+  end
+end

data/lib/active_hashcash/engine.rb

@@ -3,5 +3,11 @@ module ActiveHashcash
     config.assets.paths << File.expand_path("../..", __FILE__) if config.respond_to?(:assets)
 
     isolate_namespace ActiveHashcash
+
+    initializer "active_hashcash.inflections" do
+      ActiveSupport::Inflector.inflections(:en) do |inflect|
+        inflect.acronym "IPv4"
+      end
+    end
   end
 end

data/lib/active_hashcash/version.rb

@@ -1,3 +1,3 @@
 module ActiveHashcash
-  VERSION = "0.4.0"
+  VERSION = "0.6.0"
 end

data/lib/active_hashcash.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_hashcash/version"
 require "active_hashcash/engine"
 
@@ -12,8 +14,8 @@ require "active_hashcash/engine"
 #     before_action :check_hashcash, only: :create
 #   end
 #
-# Your are welcome to override most of the methods to customize to your needs.
-# For example, if your app runs behind a loab balancer you should probably override #hashcash_ip_address.
+# You are welcome to override most of the methods to customize to your needs.
+# For example, if your app runs behind a load balancer you should probably override #hashcash_ip_address.
 #
 module ActiveHashcash
   extend ActiveSupport::Concern
@@ -26,10 +28,41 @@ module ActiveHashcash
 
   # This is base complexity.
   # Consider lowering it to not exclude people with old and slow devices.
-  mattr_accessor :bits, instance_accessor: false, default: 16
+  mattr_accessor :bits, instance_accessor: false, default: 20
+
+  # Flexible complexity penalty rules applied to pushy IP addresses.
+  # Each rule must be a hash with:
+  # - :period => time window considered (e.g. 5.minutes, 1.hour, 1.day)
+  # - :rate => multiplier applied to the number of stamps in that window
+  # Assignment sorts rules from shortest to longest period.
+  #
+  # Example:
+  #   ActiveHashcash.throttle_rules = [
+  #     {period: 5.minutes, rate: 0.5},
+  #     {period: 1.hour, rate: 0.34},
+  #     {period: 1.day, rate: 0.25}
+  #   ]
+  mattr_reader :throttle_rules, instance_accessor: false, default: [
+    {period: 1.hour, rate: 0.5},
+    {period: 24.hours, rate: 0.25}
+  ]
+
+  def self.throttle_rules=(rules)
+    rules&.each do |rule|
+      raise ArgumentError, "ActiveHashcash.throttle_rules period must be present" if rule[:period].nil?
+      raise ArgumentError, "ActiveHashcash.throttle_rules rate must be >= 0" if rule[:rate].to_f.negative?
+    end
+    @@throttle_rules = rules && rules.sort_by { |rule| rule[:period] }
+  end
 
   mattr_accessor :date_format, instance_accessor: false, default: "%y%m%d"
 
+  # Base controller class used by ActiveHashcash helpers/integration.
+  # Override this if your application subclasses the default Rails
+  # `ActionController::Base` (e.g. to apply common behavior across controllers).
+
+  # By default ActiveHashcash extends `ActionController::Base`, but you can change it to any controller,
+  # such as `AdminController` to handle authentication for the dashboard.
   mattr_accessor :base_controller_class, default: "ActionController::Base"
 
   # Call that method via a before_action when the form is submitted:
@@ -58,7 +91,7 @@ module ActiveHashcash
     request.remote_ip
   end
 
-  # Return current request path to be saved to the sucessful ActiveHash::Stamp.
+  # Return current request path to be saved to the successful ActiveHashcash::Stamp.
   # If multiple forms are protected via hashcash this is an interesting info.
   def hashcash_request_path
     request.path
@@ -71,20 +104,29 @@ module ActiveHashcash
 
   # This is the resource used to build the hashcash stamp.
   # By default the host name is returned.
-  # It' should be good for most cases and prevent from reusing the same stamp between sites.
+  # It should be good for most cases and prevent from reusing the same stamp between sites.
   def hashcash_resource
     ActiveHashcash.resource || request.host
   end
 
   # Returns the complexity, the higher the slower it is.
-  # Complexity is increased logarithmicly for each IP during the last 24H to slowdown brute force attacks.
-  # The minimun value returned is ActiveHashcash.bits.
+  # Eventually adds penalties for bad and pushy IPs.
   def hashcash_bits
-    if (previous_stamp_count = ActiveHashcash::Stamp.where(ip_address: hashcash_ip_address).where(created_at: 1.day.ago..).count) > 0
-      (ActiveHashcash.bits + Math.log2(previous_stamp_count)).floor
-    else
-      ActiveHashcash.bits
-    end
+    (ActiveHashcash.bits + hashcash_throttle_penalty + hashcash_reputation_penalty).floor
+  end
+
+  # Compute a penalty for pushy IPs.
+  # The penalty rules can be defined with `ActiveHashcash.throttle_rules`.
+  def hashcash_throttle_penalty
+    rules = ActiveHashcash.throttle_rules || []
+    periods = rules.map { |rule| rule[:period] }
+    counts = ActiveHashcash::Stamp.where(ip_address: hashcash_ip_address).sum_by_periods(periods)
+    rules.each_with_index.sum { |rule, index| counts[index].to_i * rule[:rate].to_f }
+  end
+
+  # Compute a reputation penalty for the current IP.
+  def hashcash_reputation_penalty
+    Reputation.scores(hashcash_ip_address).values.sum * 4
   end
 
   # Override if you want to rename the hashcash param.
@@ -109,7 +151,7 @@ module ActiveHashcash
     # Override me for your own needs.
   end
 
-  # Call it inside the form that have to be protected and don't forget to initialize the JavaScript Hascash.setup().
+  # Call it inside the form that have to be protected and don't forget to initialize the JavaScript Hashcash.setup().
   # Unless you need something really special, you should not need to override this method.
   #
   #   <% form_for model do |form| %>
@@ -118,7 +160,12 @@ module ActiveHashcash
   #   <% end %>
   #
   def hashcash_hidden_field_tag(name = :hashcash)
-    options = {resource: hashcash_resource, bits: hashcash_bits, waiting_message: hashcash_waiting_message}
+    options = {
+      resource: hashcash_resource,
+      bits: hashcash_bits,
+      waiting_message: hashcash_waiting_message,
+      date: Date.today.strftime("%y%m%d")
+    }
     view_context.hidden_field_tag(name, "", "data-hashcash" => options.to_json)
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: active_hashcash
 version: !ruby/object:Gem::Version
-  version: 0.4.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Alexis Bernard
@@ -31,6 +31,7 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
+- AGENTS.md
 - CHANGELOG.md
 - LICENSE.txt
 - README.md
@@ -45,8 +46,17 @@ files:
 - app/helpers/active_hashcash/application_helper.rb
 - app/helpers/active_hashcash/stamps_helper.rb
 - app/jobs/active_hashcash/application_job.rb
+- app/jobs/active_hashcash/reputation/cleanup_job.rb
+- app/jobs/active_hashcash/reputation/update_abuse_score_job.rb
+- app/jobs/active_hashcash/reputation/update_all_scores_job.rb
+- app/jobs/active_hashcash/reputation/update_anonymous_score_job.rb
+- app/jobs/active_hashcash/reputation/update_attack_score_job.rb
+- app/jobs/active_hashcash/reputation/update_score_job.rb
 - app/mailers/active_hashcash/application_mailer.rb
 - app/models/active_hashcash/application_record.rb
+- app/models/active_hashcash/reputation.rb
+- app/models/active_hashcash/reputation/ipv4_address.rb
+- app/models/active_hashcash/reputation/ipv4_range.rb
 - app/models/active_hashcash/stamp.rb
 - app/views/active_hashcash/addresses/index.html.erb
 - app/views/active_hashcash/assets/_logo.svg.erb
@@ -71,6 +81,7 @@ files:
 - config/locales/pt.yml
 - config/routes.rb
 - db/migrate/20240215143453_create_active_hashcash_stamps.rb
+- db/migrate/20260831130000_create_active_hashcash_reputation_ipv4s.rb
 - lib/active_hashcash.rb
 - lib/active_hashcash/engine.rb
 - lib/active_hashcash/version.rb
@@ -96,7 +107,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.7
+rubygems_version: 4.0.10
 specification_version: 4
 summary: Protect Rails applications against bots and brute force attacks without annoying
   humans.