npm - @anonympins/fingerprint - Versions diffs - 0.1.1 → 0.1.3 - Mend

@anonympins/fingerprint 0.1.1 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/README.md CHANGED Viewed

@@ -97,6 +97,7 @@ const securityConfig = {
     ticketMaxAge: 3600000, // 1 hour. Duration for which a solved challenge ticket is valid.
     challengeTtl: 300000, // 5 minutes. Time during which a challenge nonce is valid.
     deviceIdCookieMaxAge: undefined, // By default, it's a session cookie. Set a value in ms for a persistent cookie.
+    challengePagePath: './path/to/your/custom-challenge-page.html', // (Optional) Path to a custom HTML template for the challenge page.
     verbose: true, // set to true to log for fingerprint detection output
     patterns: { // (Optional) Initial values for request pattern detection, optimized by auto-tuner if enabled.
         velocityThreshold: 800,   // ms between requests to be considered "fast"
@@ -199,7 +200,50 @@ app.use((req, res, next) => {
 app.listen(3000, () => console.log('Server started on port 3000'));
 ```
+### Customizing the Challenge Page
+You can provide your own HTML template for the Proof-of-Work challenge page to maintain a consistent user experience with your brand.
+1.  **Configuration**: In your `securityConfig`, specify the path to your template file using the `challengePagePath` option.
+    ```javascript
+    const securityConfig = {
+        // ... other options
+        challengePagePath: './path/to/your/custom-challenge-page.html',
+    };
+    ```
+2.  **Template Placeholders**: Your HTML file **must** contain the following placeholders. The system will replace them with the dynamic JavaScript code required to run the challenge.
+    *   `<!-- FINGERPRINT_SOLVER_SCRIPT -->`: This will be replaced by the script that contains the logic for solving the CPU and memory challenges.
+    *   `<!-- FINGERPRINT_CHALLENGE_SCRIPT -->`: This will be replaced by the script that initiates the challenge with the specific parameters for the current request (nonce, difficulty, etc.).
+    *   `<!-- FINGERPRINT_TRAPS -->`: This will be replaced by hidden "honeypot" links designed to trap simple bots. This placeholder is crucial for an effective defense.
+#### Example Custom HTML Template
+Here is a basic example of what your `custom-challenge-page.html` could look like:
+```html
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <title>Security Verification</title>
+    <style>
+        body { font-family: sans-serif; text-align: center; padding-top: 50px; }
+        h1 { color: #333; }
+    </style>
+</head>
+<body>
+    <h1>Please wait while we verify your connection...</h1>
+    <div id="loader" style="margin:20px;">⚙️ Initializing verification...</div>
+    <script><!-- FINGERPRINT_SOLVER_SCRIPT --></script>
+    <script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script>
+    <!-- FINGERPRINT_TRAPS -->
+</body>
+</html>
+```
 ## Public API
 In addition to the main middleware, several functions are exported to allow for more advanced integrations.

package/fingerprint.client.js CHANGED Viewed

@@ -238,9 +238,9 @@ const ClientLibrary = {
     _isFetchPatched: false,
     _interceptorChain: [],
-    // On "lie" (bind) la fonction fetch à son contexte d'origine (window) pour éviter les erreurs "Illegal invocation".
-    // C'est la correction clé pour le problème que vous rencontrez.
-    _originalFetch: (typeof window !== 'undefined') ? window.fetch.bind(window) : () => Promise.reject(new Error('fetch is not available')),
+    // On stocke la fonction fetch originale et on la lie à son contexte (window)
+    // pour éviter les erreurs "Illegal invocation" si une autre lib la modifie.
+    _originalFetch: (typeof window !== 'undefined') ? window.fetch.bind(window) : null,
 /**
  * Adds an interceptor function to the `fetch` chain.
@@ -256,7 +256,7 @@ const ClientLibrary = {
   },
   patchGlobalFetch() {
-    if (this._isFetchPatched || typeof window === 'undefined') return;
+    if (this._isFetchPatched || !this._originalFetch) return;
     this._isFetchPatched = true;
     window.fetch = (resource, options) => {

package/fingerprint.js CHANGED Viewed

@@ -1,4 +1,3 @@
-// C:/Dev/games.primals.net/src/utils/fingerprint.js
 import crypto from "node:crypto";
 import { BlockList } from "node:net";
 import dns from "node:dns/promises";
@@ -30,17 +29,19 @@ const getPowSolverCode = () => {
   try {
     const __filename = fileURLToPath(import.meta.url);
     const __dirname = dirname(__filename);
-    const solverPath = join(__dirname, 'pow.solver.js');
+    const solverPath = join(__dirname, 'pow.solver.inline.js'); // Use the inline version
     return readFileSync(solverPath, 'utf-8');
   } catch (error) {
     console.warn('Could not load pow.solver.js for inlining, using fallback inline code');
     // Fallback inline code if file cannot be loaded
     return `(function(global){
-        async function solveCpuTargetInline(clientIp, nonce, target, clientSecret, progressCallback){
+        async function solveCpuTargetInline(clientIp, nonce, target, clientSecret, progressCallback){ const cpuTarget = typeof target === 'bigint' ? target : BigInt('0x' + target);
             const cpuTarget = BigInt(target);
             let cpuSolution = 0;
+            const ipPart = clientIp || '';
             while(true){
-                const msg = clientSecret ? clientIp+':'+nonce+':'+cpuSolution+':'+clientSecret : clientIp+':'+nonce+':'+cpuSolution;
+                // When a clientSecret is used, the IP is omitted from the hash to make it independent of the network.
+                const msg = clientSecret ? \`\${nonce}:\${cpuSolution}:\${clientSecret}\` : \`\${ipPart}:\${nonce}:\${cpuSolution}\`;
                 const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
                 const hashHex = Array.from(new Uint8Array(buf)).map(b=>b.toString(16).padStart(2,'0')).join('');
                 if(BigInt('0x'+hashHex) < cpuTarget) break;
@@ -95,9 +96,39 @@ const getPowSolverCode = () => {
             const solutionDistance=evaluatePathDistance(cities,solutionPath);
             return{path:solutionPath,distance:solutionDistance};
         }
+        async function solveChallenge(challenge) {
+            const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance } = challenge;
+            const solutions = {};
+            switch (type) {
+                case 'cpu_target':
+                    solutions.cpu = await solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret);
+                    break;
+                case 'cpu_mem':
+                case 'cpu_mem_inline':
+                    const memSeed = nonce + ":" + clientSecret;
+                    const [cpuSol, memSol] = await Promise.all([
+                        solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret),
+                        solveMemory(memSeed, memDifficulty)
+                    ]);
+                    solutions.cpu = cpuSol;
+                    solutions.mem = memSol;
+                    break;
+                case 'tsp':
+                    const tspResult = await solveTsp(cities, targetMaxDistance);
+                    solutions.tsp = tspResult.path;
+                    solutions.distance = tspResult.distance;
+                    break;
+                default:
+                    throw new Error(\`Unknown challenge type: \${type}\`);
+            }
+            return solutions;
+        }
         global.solveCpuChallengeInline=solveCpuTargetInline;
         global.solveMemoryChallenge=solveMemory;
         global.solveTspChallenge=solveTsp;
+        global.solveChallenge=solveChallenge;
     })(typeof window!=='undefined'?window:global);`;
   }
 };
@@ -1224,48 +1255,61 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  * @param {string} clientIp - The client's IP address.
  * @returns {string} HTML content.
  */
-function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret) {
+function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapContainerHtml) {
     const { nonce, target, path } = cpuChallengeDetails;
     const solverCode = getPowSolverCode();
-    return `
-      <html><head><title>Advanced Security Check</title></head>
-      <body style="font-family:sans-serif; text-align:center; padding-top:50px;">
-        <h1>Enhanced Verification... (Level 2)</h1>
-        <p>Your activity requires an additional security check. This may take a few moments.</p>
-        <div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div>
-        <script>${solverCode}</script>
-        <script>
-          async function solve() {
-            const nonce = "${nonce}";
-            const path = "${path}";
-            const clientSecret = "${clientSecret}";
-            const clientIp = "${clientIp}";
-            const cpuTarget = BigInt("0x${target}");
-            const memDifficulty = ${memoryDifficulty};
-            // --- CPU Challenge ---
-            document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';
-            const cpuSolution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, clientSecret, (progress) => {
-                // Optional progress callback
-            });
+    const challengeScript = `
+      async function solve() {
+        const nonce = "${nonce}";
+        const path = "${path}";
+        const clientSecret = "${clientSecret}";
+        const clientIp = "${clientIp}";
+        const cpuTarget = BigInt("0x${target}");
+        const memDifficulty = ${memoryDifficulty};
+        // --- CPU Challenge ---
+        document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';
+        const cpuSolution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, clientSecret, (progress) => {
+            // Optional progress callback
+        });
-            // --- Memory Challenge ---
-            document.getElementById('loader').innerText = '⚙️ Performing memory allocation and calculation... (' + memDifficulty + ' MB)';
-            await new Promise(r => setTimeout(r, 10)); // Yield to update UI
+        // --- Memory Challenge ---
+        document.getElementById('loader').innerText = '⚙️ Performing memory allocation and calculation... (' + memDifficulty + ' MB)';
+        await new Promise(r => setTimeout(r, 10)); // Yield to update UI
-            let memSolution = 0;
-            try {
-                const memSeed = nonce + ":" + clientSecret;
-                memSolution = await window.solveMemoryChallenge(memSeed, memDifficulty);
-            } catch(e) {
-                document.getElementById('loader').innerText = "Error: Insufficient memory. Please refresh.";
-                return;
-            }
-            window.location.href = path + "?pow_type=cpu_mem&pow_nonce=" + nonce + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
-          }
-          solve();
-        </script>
-      </body></html>`;
+        let memSolution = 0;
+        try {
+            const memSeed = nonce + ":" + clientSecret;
+            memSolution = await window.solveMemoryChallenge(memSeed, memDifficulty);
+        } catch(e) {
+            document.getElementById('loader').innerText = "Error: Insufficient memory. Please refresh.";
+            return;
+        }
+        window.location.href = path + "?pow_type=cpu_mem&pow_nonce=" + nonce + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
+      }
+      solve();
+    `;
+    let htmlTemplate;
+    const customTemplatePath = securityConfig?.challengePagePath;
+    if (customTemplatePath) {
+        try {
+            htmlTemplate = readFileSync(customTemplatePath, 'utf-8');
+        } catch (error) {
+            console.warn(`[Fingerprint] Could not load custom challenge page at '${customTemplatePath}'. Falling back to default. Error: ${error.message}`);
+        }
+    }
+    if (!htmlTemplate) {
+        htmlTemplate = `<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script><!-- FINGERPRINT_TRAPS --></body></html>`;
+    }
+    return htmlTemplate
+        .replace('<!-- FINGERPRINT_SOLVER_SCRIPT -->', solverCode)
+        .replace('<!-- FINGERPRINT_CHALLENGE_SCRIPT -->', challengeScript)
+        .replace('<!-- FINGERPRINT_TRAPS -->', trapContainerHtml);
 }
 /**
@@ -1276,20 +1320,19 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   ticketMaxAge, // NOUVEAU: Durée de validité du ticket configurable
   nonce,
   solution,
-  suspicionFactor,
   clientSecret, // Le secret est maintenant requis
+  target, // La cible est maintenant passée directement
 ) {
-  const target = calculateTarget(suspicionFactor);
   const message = clientSecret
-    ? `${clientIp}:${nonce}:${solution}:${clientSecret}`
-    : `${clientIp}:${nonce}:${solution}`;
+    ? `${nonce}:${solution}:${clientSecret}` // FIX: Ne pas inclure l'IP si un secret client est utilisé
+    : `${clientIp}:${nonce}:${solution}`; // L'IP est utilisée uniquement pour les challenges sans secret (plus anciens/simples)
   const hash = crypto
     .createHash("sha256")
     .update(message)
     .digest("hex");
   const hashAsInt = BigInt("0x" + hash);
-  if (hashAsInt < target) {
+  if (hashAsInt < BigInt("0x" + target)) {
     // The comparison is direct with native BigInts
     // The proof is valid, generate the ticket
       const expiry = Date.now() + (ticketMaxAge || 3600000); // Utilise la durée passée ou un fallback.
@@ -1304,7 +1347,7 @@ export function verifyCpuTargetPoWAndGenerateTicket(
 }
 const staticExtensions = new RegExp(
-  "\\.(js|css|png|jpg|jpeg|gif|svg|mp3|webp|ico|woff|woff2|ttf|otf|map|json|manifest)$",
+  "\\.(js|css|png|jpg|jpeg|gif|svg|mp3|webp|ico|woff|woff2|ttf|otf|map|json|manifest|webmanifest)$",
   "i",
 );
 const isStaticResource = (path) => staticExtensions.test(path);
@@ -1381,22 +1424,28 @@ function determineOptimalTicketTtl(suspicionScore) {
  * @private
  */
 function isMalicious(str) {
+    if (typeof str !== 'string') return false;
     // Regex pour les injections SQL et NoSQL de base
     // Ajout de la détection des injections basées sur le temps (SLEEP, BENCHMARK, WAITFOR) et d'autres commandes dangereuses.
-    const injectionRegex = /(\$ne|' OR '1'='1|['";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|SLEEP\(|BENCHMARK\(|WAITFOR DELAY)/i;
+    const injectionRegex = /(\$ne|' *OR *'1'='1|['";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|SLEEP\(|BENCHMARK\(|WAITFOR DELAY)/i;
     // Regex pour les injections plus avancées
     const log4ShellRegex = /\$\{jndi:(ldap|rmi|dns):/i;
     const sstiRegex = /\{\{.*\}\}|\{%.*%\}/; // Détecte les syntaxes de type Jinja2, Twig, etc.
     const xxeRegex = /<!ENTITY\s+.*SYSTEM/i;
     const pathTraversalRegex = /(\.\.\/|\.\.\\)/;
-    // NOUVEAU : Regex pour les injections de commandes basiques.
-    // Cible les séparateurs de commandes et les backticks d'exécution.
-    const commandInjectionRegex = /(&&|\|\||;|\n|`)/;
+    // Regex pour les injections de commandes.
+    // Elle détecte deux cas :
+    // 1. L'utilisation de backticks `` pour l'exécution de commandes.
+    // 2. Des commandes dangereuses (comme rm, whoami) précédées par un séparateur de commande (;, &&, ||, |)
+    //    pour éviter les faux positifs sur des phrases comme "A normal command like ls -la".
+    const commandInjectionRegex = /`.*`|[\n;&|]\s*(ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i;
     return injectionRegex.test(str) || log4ShellRegex.test(str) || sstiRegex.test(str) || xxeRegex.test(str) || pathTraversalRegex.test(str) || commandInjectionRegex.test(str);
 }
 // --- Middleware Proof-of-Work (Le péage) ---
+export { isMalicious };
 export class FingerprintEngine {
   constructor(securityConfig) {
     const isProduction = process.env.NODE_ENV === 'production';
@@ -1580,18 +1629,20 @@ export class FingerprintEngine {
         let isValid = false;
         const challengeContext = await store.get(`secret:${pow_nonce}`);
         let ticket = null;
+        // Déclarer optimalTtl ici avec une valeur par défaut
+        let optimalTtl = this.securityConfig.ticketMaxAge || 3600000;
         if (challengeContext) {
-            const optimalTtl = determineOptimalTicketTtl(preliminaryScore);
+            optimalTtl = determineOptimalTicketTtl(preliminaryScore);
             this._log('Challenge context found, verifying solution', { optimalTtl });
             if (pow_type === "cpu_target") {
                 // On passe la durée de vie du ticket configurée
-                ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, optimalTtl, pow_nonce, pow_solution, null, challengeContext.clientSecret, challengeContext.cpuTarget);
+                ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, optimalTtl, pow_nonce, pow_solution, challengeContext.clientSecret, challengeContext.cpuTarget);
                 isValid = ticket !== null;
                 this._log('CPU target challenge verification', { isValid });
             } else if (pow_type === "cpu_mem") {
-                const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, optimalTtl, pow_nonce, pow_solution_cpu, null, challengeContext.clientSecret, challengeContext.cpuTarget);
+                const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, optimalTtl, pow_nonce, pow_solution_cpu, challengeContext.clientSecret, challengeContext.cpuTarget);
                 const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret);
                 isValid = cpuTicket !== null && isMemValid;
                 if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
@@ -1605,18 +1656,40 @@ export class FingerprintEngine {
             this._log('Challenge context not found or expired', { pow_nonce });
         }
+        console.log({isValid})
         if (isValid) {
             // La solution est valide. On supprime le secret et on redirige.
             await store.delete(`secret:${pow_nonce}`);
-            this._log('Challenge solution valid - issuing ticket', { ticketMaxAge: this.securityConfig.ticketMaxAge || 3600000 });
+            this._log('Challenge solution valid - issuing ticket', { ticketMaxAge: optimalTtl });
             if (logger) {
                 logger({ type: 'challenge_solved', deviceId: cookies?.device_id, score: preliminaryScore, challengeType: pow_type, timestamp: Date.now() });
             }
+            // NOUVELLE LOGIQUE DE REDIRECTION (plus robuste)
+            // 1. On part du chemin original stocké, qui peut contenir des query params.
+            const originalUrl = new URL(challengeContext?.originalPath || path, `http://${requestContext.headers.host || 'localhost'}`);
+            console.log({originalUrl})
+            // 2. On crée un nouvel objet de paramètres à partir de la requête entrante (qui contient les solutions ET les params originaux).
+            const finalSearchParams = new URLSearchParams(requestContext.query);
+            // 3. On supprime uniquement les paramètres liés au challenge.
+            finalSearchParams.delete('pow_type');
+            finalSearchParams.delete('pow_nonce');
+            finalSearchParams.delete('pow_solution');
+            finalSearchParams.delete('pow_solution_cpu');
+            finalSearchParams.delete('pow_solution_mem');
+            // 4. On reconstruit le chemin final.
+            const finalQueryString = finalSearchParams.toString();
+            const finalRedirectPath = finalQueryString ? `${originalUrl.pathname}?${finalQueryString}` : originalUrl.pathname;
+            this._log('Redirecting to clean path', { finalRedirectPath });
+            console.log({finalRedirectPath})
             return {
               action: 'redirect',
-              path: path,
+              path: finalRedirectPath,
               score: 0, // Le score n'est pas pertinent ici, on a passé le test.
               vector: { challenge_solved: 100 },
               cookie: {
@@ -1625,7 +1698,7 @@ export class FingerprintEngine {
                 options: {
                   httpOnly: true,
                   secure: this.isProduction, // Le maxAge est déjà inclus dans le ticket, mais on le met aussi sur le cookie
-                  maxAge: this.securityConfig.ticketMaxAge || 3600000,
+                  maxAge: optimalTtl,
                 }
               }
             };
@@ -1791,7 +1864,8 @@ export class FingerprintEngine {
             await store.set(`secret:${nonce}`, {
                 clientSecret,
                 cpuTarget: cpuChallengeDetails.target,
-                memDifficulty: memDifficulty
+                memDifficulty: memDifficulty,
+                originalPath: path, // *** FIX: Store the original path ***
             }, this.securityConfig.challengeTtl || 300); // NOUVEAU: TTL configurable (5min par défaut)
             // Associate the current challenge nonce with the device for trap URL verification later.
@@ -1811,7 +1885,7 @@ export class FingerprintEngine {
             }
             // Check if the request is an API request to return a JSON challenge
-            const isApi = this.securityConfig.thresholds?.isApiRequest?.(requestContext);
+            const isApi = requestContext.rawReq && this.securityConfig.thresholds?.isApiRequest?.(requestContext.rawReq);
             if (isApi) {
                 // For API clients, send a JSON response with challenge details.
@@ -1828,8 +1902,7 @@ export class FingerprintEngine {
                 return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
             } else {
                 // For browsers, send the HTML page.
-                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;
-                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret).replace('</body>', `${trapContainer}</body>`);
+                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapContainer);
                 this._log('Browser challenge page generated', {
                     pageLength: page.length,
                     hasTrapContainer: true
@@ -2090,7 +2163,6 @@ export const powMiddleware = (securityConfig) => {
  */
 export const __internal = {
     getDeviceHash,
-    isMalicious,
     getSuspicionVector,
     cyrb53, // Export for testing
     FingerprintBuilder, // Export for testing

package/package.json CHANGED Viewed

@@ -1,76 +1,76 @@
-{
-  "name": "@anonympins/fingerprint",
-  "version": "0.1.1",
-  "description": "An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.",
-  "main": "fingerprint.js",
-  "type": "module",
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "scripts": {
-    "test": "vitest run --reporter=verbose"
-  },
-  "files": [
-    "fingerprint.js",
-    "fingerprint.client.js",
-    "fingerprint.builder.js",
-    "pow.solver.js",
-    "library.js",
-    "redis-store.js",
-    "mongodb-store.js",
-    "sql-store.js",
-    "README.md",
-    "LICENSE"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/anonympins/fingerprint.git"
-  },
-  "keywords": [
-    "fingerprint",
-    "bot",
-    "anti-bot",
-    "security",
-    "express",
-    "middleware",
-    "proof-of-work",
-    "pow",
-    "rate-limiting",
-    "mitigation",
-    "captcha",
-    "dns"
-  ],
-  "author": "anonympins",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/anonympins/fingerprint/issues"
-  },
-  "homepage": "https://github.com/anonympins/fingerprint#readme",
-  "devDependencies": {
-    "body-parser": "^1.20.2",
-    "cookie-parser": "^1.4.6",
-    "express": "^4.18.2",
-    "prom-client": "^15.1.2",
-    "vitest": "^4.1.11"
-  },
-  "peerDependencies": {
-    "ioredis": "^5.3.2",
-    "knex": ">=3.0.0",
-    "mongodb": "^6.3.0",
-    "sqlite3": "^5.1.7"
-  },
-  "peerDependenciesMeta": {
-    "ioredis": {
-      "optional": true
-    },
-    "mongodb": {
-      "optional": true
-    },
-    "knex": {
-      "optional": true
-    },
-    "sqlite3": {
-      "optional": true
-    }
-  }
-}
+{
+  "name": "@anonympins/fingerprint",
+  "version": "0.1.3",
+  "description": "An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.",
+  "main": "fingerprint.js",
+  "type": "module",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "test": "vitest run --reporter=verbose"
+  },
+  "files": [
+    "fingerprint.js",
+    "fingerprint.client.js",
+    "fingerprint.builder.js",
+    "pow.solver.js",
+    "library.js",
+    "redis-store.js",
+    "mongodb-store.js",
+    "sql-store.js",
+    "README.md",
+    "LICENSE"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/anonympins/fingerprint.git"
+  },
+  "keywords": [
+    "fingerprint",
+    "bot",
+    "anti-bot",
+    "security",
+    "express",
+    "middleware",
+    "proof-of-work",
+    "pow",
+    "rate-limiting",
+    "mitigation",
+    "captcha",
+    "dns"
+  ],
+  "author": "anonympins",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/anonympins/fingerprint/issues"
+  },
+  "homepage": "https://github.com/anonympins/fingerprint#readme",
+  "devDependencies": {
+    "body-parser": "^1.20.2",
+    "cookie-parser": "^1.4.6",
+    "express": "^4.18.2",
+    "prom-client": "^15.1.2",
+    "vitest": "^4.1.11"
+  },
+  "peerDependencies": {
+    "ioredis": "^5.3.2",
+    "knex": ">=3.0.0",
+    "mongodb": "^6.3.0",
+    "sqlite3": "^5.1.7"
+  },
+  "peerDependenciesMeta": {
+    "ioredis": {
+      "optional": true
+    },
+    "mongodb": {
+      "optional": true
+    },
+    "knex": {
+      "optional": true
+    },
+    "sqlite3": {
+      "optional": true
+    }
+  }
+}

package/pow.solver.js CHANGED Viewed

@@ -1,214 +1,224 @@
-/**
- * @file @/pow.solver.js
- * @description Contient les fonctions côté client pour résoudre les différents types de challenges Proof-of-Work.
- * Fichier compatible à la fois avec l'import de modules ES6 et l'injection directe dans un script HTML.
- */
-'use strict';
-/**
- * Résout un challenge CPU basé sur une cible (version inline pour compatibilité HTML).
- * @param {string} clientIp - L'adresse IP du client.
- * @param {string} nonce - Le nonce du challenge.
- * @param {bigint} target - La cible à atteindre.
- * @param {string} clientSecret - Le secret client (optionnel).
- * @param {Function} progressCallback - Callback pour les mises à jour de progression.
- * @returns {Promise<number>} La solution (un nombre entier).
- */
-export async function solveCpuTargetInline(clientIp, nonce, target, clientSecret = null, progressCallback) {
-    const cpuTarget = BigInt(target);
-    let cpuSolution = 0;
-    while (true) {
-        const msg = clientSecret
-            ? `${clientIp}:${nonce}:${cpuSolution}:${clientSecret}`
-            : `${clientIp}:${nonce}:${cpuSolution}`;
-        const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
-        const hashHex = Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
-        if (BigInt('0x' + hashHex) < cpuTarget) break;
-        cpuSolution++;
-        if (cpuSolution % 100000 === 0) {
-            await new Promise(r => setTimeout(r, 0));
-            if (progressCallback) progressCallback(cpuSolution);
-        }
-    }
-    return cpuSolution;
-}
-/**
- * Résout un challenge CPU basé sur une cible (version Web Worker).
- * @param {string} message - Le message à hasher (ex: `ip:nonce:solution:secret`).
- * @param {bigint} target - La cible à atteindre.
- * @returns {Promise<number>} La solution (un nombre entier).
- */
-export async function solveCpuTarget(message, target) {
-    // Vérifie si les Web Workers sont supportés par le navigateur.
-    if (typeof(Worker) === "undefined") {
-        console.warn("Web Workers not supported. Falling back to main thread calculation (UI may freeze).");
-        // Ici, on pourrait remettre l'ancienne implémentation comme solution de secours.
-        // Pour la clarté, nous supposons que les workers sont disponibles.
-        throw new Error("Web Worker support is required for CPU challenges.");
-    }
-    return new Promise((resolve, reject) => {
-        // Crée un worker à partir du script dédié. Le chemin doit être accessible publiquement.
-        // Assurez-vous que `pow.worker.js` est servi par votre serveur statique.
-        const worker = new Worker('./pow.worker.js');
-        worker.onmessage = (event) => {
-            resolve(event.data.solution);
-            worker.terminate(); // Nettoie le worker une fois le travail terminé.
-        };
-        worker.onerror = (error) => {
-            reject(error);
-            worker.terminate();
-        };
-        // Envoie les données du challenge au worker pour qu'il commence le calcul.
-        worker.postMessage({ message, target });
-    });
-}
-/**
- * Résout un challenge basé sur la mémoire.
- * @param {string} seed - La graine pour l'initialisation de la mémoire.
- * @param {number} difficulty - La difficulté (en Mo).
- * @returns {Promise<number>} La solution (nombre entier).
- */
-export async function solveMemory(seed, difficulty) {
-    const size = difficulty * 1024 * 1024;
-    const buffer = new Uint32Array(size / 4);
-    let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
-    for (let i = 0; i < buffer.length; i++) {
-        buffer[i] = (h = Math.imul(h ^ i, 1597334677));
-    }
-    let solution = 0;
-    const iterations = size / 16;
-    let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
-    for (let i = 0; i < iterations; i++) {
-        addr = buffer[addr] % buffer.length;
-        solution ^= addr;
-    }
-    return solution;
-}
-/**
- * Résout un challenge de type "Problème du Voyageur de Commerce" (TSP).
- * NOTE: Ceci est une implémentation simple (heuristique du plus proche voisin) et n'est pas garantie
- * de trouver la solution optimale, mais elle est suffisante pour un challenge.
- * @param {Array<{x: number, y: number}>} cities - Les coordonnées des villes.
- * @param {number} targetMaxDistance - La distance maximale acceptable.
- * @returns {Promise<{path: number[], distance: number}>} Le chemin et la distance.
- */
-export async function solveTsp(cities, targetMaxDistance) {
-    // Utility function to calculate the distance between two cities
-    function distance(city1, city2) {
-        return Math.sqrt(Math.pow(city1.x - city2.x, 2) + Math.pow(city1.y - city2.y, 2));
-    }
-    // Utility function to evaluate the total distance of a path
-    function evaluatePathDistance(cities, path) {
-        let totalDistance = 0;
-        for (let i = 0; i < path.length - 1; i++) {
-            totalDistance += distance(cities[path[i]], cities[path[i + 1]]);
-        }
-        totalDistance += distance(cities[path[path.length - 1]], cities[path[0]]); // Return to start
-        return totalDistance;
-    }
-    // Solveur simple du TSP (heuristique du plus proche voisin)
-    function solveTspNearestNeighbor(cities) {
-        const numCities = cities.length;
-        if (numCities === 0) return [];
-        let currentPath = [];
-        let visited = new Array(numCities).fill(false);
-        let currentCityIndex = 0; // Always start with the first city for reproducibility
-        currentPath.push(currentCityIndex);
-        visited[currentCityIndex] = true;
-        for (let i = 1; i < numCities; i++) {
-            let nearestCityIndex = -1;
-            let minDistance = Infinity;
-            for (let j = 0; j < numCities; j++) {
-                if (!visited[j]) {
-                    const dist = distance(cities[currentCityIndex], cities[j]);
-                    if (dist < minDistance) {
-                        minDistance = dist;
-                        nearestCityIndex = j;
-                    }
-                }
-            }
-            currentCityIndex = nearestCityIndex;
-            currentPath.push(currentCityIndex);
-            visited[currentCityIndex] = true;
-        }
-        return currentPath;
-    }
-    // To avoid freezing the browser, yield the thread from time to time
-    await new Promise(resolve => setTimeout(resolve, 10));
-    const solutionPath = solveTspNearestNeighbor(cities);
-    const solutionDistance = evaluatePathDistance(cities, solutionPath);
-    return { path: solutionPath, distance: solutionDistance };
-}
-/**
- * Fonction principale qui reçoit un objet challenge et le résout.
- * @param {object} challenge - L'objet challenge reçu du serveur.
- * @returns {Promise<object>} Un objet contenant la ou les solutions.
- */
-export async function solveChallenge(challenge) {
-    const { type, nonce, clientSecret, target, memDifficulty, cities, clientIp, targetMaxDistance } = challenge;
-    const solutions = {};
-    switch (type) {
-        case 'cpu_target':
-            const baseMessageCpu = `:${nonce}`; // L'IP est gérée côté serveur
-            solutions.cpu = await solveCpuTarget(baseMessageCpu, BigInt('0x' + target));
-            break;
-        case 'cpu_mem':
-            // Pour les appels API, le client IP n'est pas connu, on ne le met pas dans le message
-            const baseMessageCombined = `${nonce}:${clientSecret}`;
-            const memSeed = `:${nonce}:${clientSecret}`;
-            const [cpuSol, memSol] = await Promise.all([
-                // On utilise une version de solveCpuTarget qui n'a pas besoin de l'IP
-                solveCpuTargetInline(null, nonce, target, clientSecret),
-                solveMemory(memSeed, memDifficulty)
-            ]);
-            solutions.cpu = cpuSol;
-            solutions.mem = memSol;
-            break;
-        case 'cpu_mem_inline':
-            // Version inline pour compatibilité HTML avec IP incluse
-            const memSeedInline = `${nonce}:${clientSecret}`;
-            const [cpuSolInline, memSolInline] = await Promise.all([
-                solveCpuTargetInline(clientIp, nonce, target, clientSecret),
-                solveMemory(memSeedInline, memDifficulty)
-            ]);
-            solutions.cpu = cpuSolInline;
-            solutions.mem = memSolInline;
-            break;
-        case 'tsp':
-            const tspResult = await solveTsp(cities, targetMaxDistance);
-            solutions.tsp = tspResult.path;
-            solutions.distance = tspResult.distance;
-            break;
-        default:
-            throw new Error(`Unknown challenge type: ${type}`);
-    }
-    return solutions;
-}
-// --- Compatibilité pour l'injection directe dans le HTML ---
-// Si le script est chargé dans un navigateur (window existe), on attache les fonctions nécessaires à window.
-if (typeof window !== 'undefined') {
-    window.solveCpuChallengeInline = solveCpuTargetInline;
-    window.solveMemoryChallenge = solveMemory;
-    window.solveTspChallenge = solveTsp;
-    window.solveChallenge = solveChallenge;
+/**
+ * @file @/pow.solver.js
+ * @description Contient les fonctions côté client pour résoudre les différents types de challenges Proof-of-Work.
+ * Fichier compatible à la fois avec l'import de modules ES6 et l'injection directe dans un script HTML.
+ */
+'use strict';
+/**
+ * Résout un challenge CPU basé sur une cible (version inline pour compatibilité HTML).
+ * @param {string} clientIp - L'adresse IP du client.
+ * @param {string} nonce - Le nonce du challenge.
+ * @param {bigint} target - La cible à atteindre.
+ * @param {string} clientSecret - Le secret client (optionnel).
+ * @param {Function} progressCallback - Callback pour les mises à jour de progression.
+ * @returns {Promise<number>} La solution (un nombre entier).
+ */
+export async function solveCpuTargetInline(clientIp, nonce, target, clientSecret = null, progressCallback) {
+    const cpuTarget = BigInt('0x' + target);
+    let cpuSolution = 0;
+    const ipPart = clientIp || ''; // Use empty string if IP is null/undefined
+    while (true) { // When a clientSecret is used, the IP is omitted from the hash to make it independent of the network.
+        const msg = clientSecret ?
+            `${nonce}:${cpuSolution}:${clientSecret}` :
+            `${ipPart}:${nonce}:${cpuSolution}`;
+        const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
+        const hashHex = Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
+        if (BigInt('0x' + hashHex) < cpuTarget) break;
+        cpuSolution++;
+        if (cpuSolution % 100000 === 0) {
+            await new Promise(r => setTimeout(r, 0));
+            if (progressCallback) progressCallback(cpuSolution);
+        }
+    }
+    return cpuSolution;
+}
+/**
+ * Résout un challenge CPU basé sur une cible (version Web Worker).
+ * @param {string} message - Le message à hasher (ex: `ip:nonce:solution:secret`).
+ * @param {bigint} target - La cible à atteindre.
+ * @returns {Promise<number>} La solution (un nombre entier).
+ */
+export async function solveCpuTarget(message, target) {
+    // Vérifie si les Web Workers sont supportés par le navigateur.
+    if (typeof(Worker) === "undefined") {
+        console.warn("Web Workers not supported. Falling back to main thread calculation (UI may freeze).");
+        // Ici, on pourrait remettre l'ancienne implémentation comme solution de secours.
+        // Pour la clarté, nous supposons que les workers sont disponibles.
+        throw new Error("Web Worker support is required for CPU challenges.");
+    }
+    return new Promise((resolve, reject) => {
+        // Crée un worker à partir du script dédié. Le chemin doit être accessible publiquement.
+        // Assurez-vous que `pow.worker.js` est servi par votre serveur statique.
+        const worker = new Worker('./pow.worker.js');
+        worker.onmessage = (event) => {
+            resolve(event.data.solution);
+            worker.terminate(); // Nettoie le worker une fois le travail terminé.
+        };
+        worker.onerror = (error) => {
+            reject(error);
+            worker.terminate();
+        };
+        // Envoie les données du challenge au worker pour qu'il commence le calcul.
+        worker.postMessage({ message, target });
+    });
+}
+/**
+ * Résout un challenge basé sur la mémoire.
+ * @param {string} seed - La graine pour l'initialisation de la mémoire.
+ * @param {number} difficulty - La difficulté (en Mo).
+ * @returns {Promise<number>} La solution (nombre entier).
+ */
+export async function solveMemory(seed, difficulty) {
+    const size = difficulty * 1024 * 1024;
+    const buffer = new Uint32Array(size / 4);
+    let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
+    for (let i = 0; i < buffer.length; i++) {
+        buffer[i] = (h = Math.imul(h ^ i, 1597334677));
+    }
+    let solution = 0;
+    const iterations = size / 16;
+    let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
+    for (let i = 0; i < iterations; i++) {
+        addr = buffer[addr] % buffer.length;
+        solution ^= addr;
+    }
+    return solution;
+}
+/**
+ * Résout un challenge de type "Problème du Voyageur de Commerce" (TSP).
+ * NOTE: Ceci est une implémentation simple (heuristique du plus proche voisin) et n'est pas garantie
+ * de trouver la solution optimale, mais elle est suffisante pour un challenge.
+ * @param {Array<{x: number, y: number}>} cities - Les coordonnées des villes.
+ * @param {number} targetMaxDistance - La distance maximale acceptable.
+ * @returns {Promise<{path: number[], distance: number}>} Le chemin et la distance.
+ */
+export async function solveTsp(cities, targetMaxDistance) {
+    // Utility function to calculate the distance between two cities
+    function distance(city1, city2) {
+        return Math.sqrt(Math.pow(city1.x - city2.x, 2) + Math.pow(city1.y - city2.y, 2));
+    }
+    // Utility function to evaluate the total distance of a path
+    function evaluatePathDistance(cities, path) {
+        let totalDistance = 0;
+        for (let i = 0; i < path.length - 1; i++) {
+            totalDistance += distance(cities[path[i]], cities[path[i + 1]]);
+        }
+        totalDistance += distance(cities[path[path.length - 1]], cities[path[0]]); // Return to start
+        return totalDistance;
+    }
+    // Solveur simple du TSP (heuristique du plus proche voisin)
+    function solveTspNearestNeighbor(cities) {
+        const numCities = cities.length;
+        if (numCities === 0) return [];
+        let currentPath = [];
+        let visited = new Array(numCities).fill(false);
+        let currentCityIndex = 0; // Always start with the first city for reproducibility
+        currentPath.push(currentCityIndex);
+        visited[currentCityIndex] = true;
+        for (let i = 1; i < numCities; i++) {
+            let nearestCityIndex = -1;
+            let minDistance = Infinity;
+            for (let j = 0; j < numCities; j++) {
+                if (!visited[j]) {
+                    const dist = distance(cities[currentCityIndex], cities[j]);
+                    if (dist < minDistance) {
+                        minDistance = dist;
+                        nearestCityIndex = j;
+                    }
+                }
+            }
+            currentCityIndex = nearestCityIndex;
+            currentPath.push(currentCityIndex);
+            visited[currentCityIndex] = true;
+        }
+        return currentPath;
+    }
+    // To avoid freezing the browser, yield the thread from time to time
+    await new Promise(resolve => setTimeout(resolve, 10));
+    const solutionPath = solveTspNearestNeighbor(cities);
+    const solutionDistance = evaluatePathDistance(cities, solutionPath);
+    return { path: solutionPath, distance: solutionDistance };
+}
+/**
+ * Fonction principale qui reçoit un objet challenge et le résout.
+ * @param {object} challenge - L'objet challenge reçu du serveur.
+ * @returns {Promise<object>} Un objet contenant la ou les solutions.
+ */
+export async function solveChallenge(challenge) {
+    const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance } = challenge;
+    const solutions = {};
+    switch (type) {
+        case 'cpu_target':
+            const baseMessageCpu = `:${nonce}`; // L'IP est gérée côté serveur
+            if (!cpuTarget) {
+                throw new Error("Challenge data is missing 'cpuTarget' property.");
+            }
+            const target = cpuTarget; // Keep variable name for consistency below
+            solutions.cpu = await solveCpuTarget(baseMessageCpu, BigInt('0x' + target));
+            break;
+        case 'cpu_mem':
+            // Pour les appels API, le client IP n'est pas connu, on ne le met pas dans le message
+            const baseMessageCombined = `${nonce}:${clientSecret}`;
+            const memSeed = `:${nonce}:${clientSecret}`;
+            const [cpuSol, memSol] = await Promise.all([
+                (async () => {
+                    if (!cpuTarget) throw new Error("Challenge data is missing 'cpuTarget' property.");
+                    return solveCpuTargetInline(null, nonce, cpuTarget, clientSecret);
+                })(),
+                solveMemory(memSeed, memDifficulty)
+            ]);
+            solutions.cpu = cpuSol;
+            solutions.mem = memSol;
+            break;
+        case 'cpu_mem_inline':
+            // Version inline pour compatibilité HTML avec IP incluse
+            const memSeedInline = `${nonce}:${clientSecret}`;
+            const [cpuSolInline, memSolInline] = await Promise.all([
+                (async () => {
+                    if (!cpuTarget) throw new Error("Challenge data is missing 'cpuTarget' property.");
+                    return solveCpuTargetInline(clientIp, nonce, cpuTarget, clientSecret);
+                })(),
+                solveMemory(memSeedInline, memDifficulty)
+            ]);
+            solutions.cpu = cpuSolInline;
+            solutions.mem = memSolInline;
+            break;
+        case 'tsp':
+            const tspResult = await solveTsp(cities, targetMaxDistance);
+            solutions.tsp = tspResult.path;
+            solutions.distance = tspResult.distance;
+            break;
+        default:
+            throw new Error(`Unknown challenge type: ${type}`);
+    }
+    return solutions;
+}
+// --- Compatibilité pour l'injection directe dans le HTML ---
+// Si le script est chargé dans un navigateur (window existe), on attache les fonctions nécessaires à window.
+if (typeof window !== 'undefined') {
+    window.solveCpuChallengeInline = solveCpuTargetInline;
+    window.solveMemoryChallenge = solveMemory;
+    window.solveTspChallenge = solveTsp;
+    window.solveChallenge = solveChallenge;
 }