@anonympins/fingerprint 0.3.1 → 0.3.3

package/{fingerprint.js → src/js/fingerprint.js}

@@ -44,7 +44,7 @@ const securityProfiles = {
             headerAnomalyScore: 0.1,
             requestPatternScore: 0.6,
             inconsistencyScore: 0.8,
-            behaviorScore: 0.7,
+            behaviorScore: 0.7, // Poids pour les métriques comportementales (souris, clavier)
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.9,
@@ -79,7 +79,7 @@ const securityProfiles = {
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.6,
             timeInconsistencyScore: 1.0,
-            tlsSpoofingScore: 1.0 // NOUVEAU: Plus agressif pour le spoofing TLS
+            tlsSpoofingScore: 1.0 // Plus agressif pour le spoofing TLS
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
         patterns: {
@@ -111,7 +111,7 @@ const securityProfiles = {
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.5,
             timeInconsistencyScore: 0.8,
-            tlsSpoofingScore: 0.7 // NOUVEAU: Important pour les API
+            tlsSpoofingScore: 0.7 // Important pour les API
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
         patterns: {
@@ -144,7 +144,7 @@ const securityProfiles = {
             honeypotScore: 1.0, // Crucial for comment spam
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.8,
-            tlsSpoofingScore: 0.6 // NOUVEAU: Moins critique pour les blogs
+            tlsSpoofingScore: 0.6 // Moins critique pour les blogs
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
         patterns: {
@@ -169,17 +169,14 @@ const securityProfiles = {
             historyScore: 0.4,
             rotationScore: 0.6,
             headerAnomalyScore: 0.2,
-            // Scission du requestPatternScore pour un contrôle plus fin
-            velocityScore: 0.8,       // Pénalise la vitesse globale
-            burstScore: 1.0,          // Pénalise fortement les rafales sur la même ressource (scalping)
-            scrapeScore: 0.9,         // Pénalise le parcours de pages/produits
-            regularityScore: 0.7,     // Détecte les bots de type "cron"
+            // Utilisation d'un score de pattern unifié avec un poids très élevé
+            requestPatternScore: 0.9,
             inconsistencyScore: 1.0, // Crucial for preventing account takeover
             behaviorScore: 0.8, // Important for checkout/login forms
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.7,
             timeInconsistencyScore: 0.9,
-            tlsSpoofingScore: 0.9 // NOUVEAU: Très important pour l'e-commerce
+            tlsSpoofingScore: 0.9 // Très important pour l'e-commerce
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
         patterns: {
@@ -235,6 +232,38 @@ const getPowSolverCode = () => {
   return readFileSync(solverPath, 'utf-8');
 };
 
+/**
+ * @private
+ * A mapping of IANA cipher suite names (as used by Node.js) to their decimal IDs.
+ * This is essential for correct JA3 fingerprint calculation.
+ * The list is not exhaustive but covers the most common cipher suites.
+ */
+const cipherSuiteMap = {
+    'TLS_AES_128_GCM_SHA256': 4865,
+    'TLS_AES_256_GCM_SHA384': 4866,
+    'TLS_CHACHA20_POLY1305_SHA256': 4867,
+    'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256': 49195,
+    'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256': 49199,
+    'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384': 49196,
+    'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384': 49200,
+    'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256': 52393,
+    'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256': 52392,
+    'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA': 49171,
+    'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA': 49172,
+    'TLS_RSA_WITH_AES_128_GCM_SHA256': 156,
+    'TLS_RSA_WITH_AES_256_GCM_SHA384': 157,
+    'TLS_RSA_WITH_AES_128_CBC_SHA': 47,
+    'TLS_RSA_WITH_AES_256_CBC_SHA': 53,
+    // Older/Less common suites
+    'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA': 49161,
+    'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA': 49162,
+    'TLS_DHE_RSA_WITH_AES_128_GCM_SHA256': 158,
+    'TLS_DHE_RSA_WITH_AES_256_GCM_SHA384': 159,
+    'TLS_DHE_RSA_WITH_AES_128_CBC_SHA': 51,
+    'TLS_DHE_RSA_WITH_AES_256_CBC_SHA': 57,
+    'TLS_RSA_WITH_3DES_EDE_CBC_SHA': 10,
+};
+
 /**
  * Extracts TLS fingerprints (JA3 and JA4) from request context.
  * Prioritizes headers from reverse proxies (x-ja4-hash) and falls back to JA3 calculation
@@ -265,15 +294,19 @@ function getTlsFingerprint(context) {
 
             // The official JA3 spec includes the TLS version.
             // Node.js provides it as a string like 'TLSv1.3', we need the corresponding decimal value.
-            const tlsVersionMap = {
+            const tlsVersionMap = { // NOSONAR
                 'TLSv1': 769, 'TLSv1.1': 770, 'TLSv1.2': 771, 'TLSv1.3': 772
             };
             const tlsVersionId = tlsVersionMap[version] || 0;
 
+            // Convert cipher suite names to their decimal IDs.
+            const cipherIds = Array.isArray(ciphers)
+                ? ciphers.map(c => cipherSuiteMap[c.name] || c).join('-') // Use the raw ID if name is not in map
+                : '';
+
             const ja3String = [
                 tlsVersionId,
-                // The ciphers array from clientHello is an array of objects, not just IDs.
-                Array.isArray(ciphers) ? ciphers.join('-') : '',
+                cipherIds,
                 extensions?.join('-') || '',
                 ellipticCurves?.join('-') || '',
                 ellipticCurvePointFormats?.join('-') || ''
@@ -621,47 +654,6 @@ export const verifyTspChallenge = (
   }
 };
 
-/**
- * Generates the HTML content for the CPU PoW challenge (SHA-256).
- */
-const generateCpuPoWChallenge = (
-  clientIp,
-  nonce,
-  difficulty = 4,
-  path = "",
-) => {
-  return `
-      <html>
-        <head><title>Security Check</title></head>
-        <body style="font-family:sans-serif; text-align:center; padding-top:50px;">
-          <h1>One moment... (Level 1)</h1>
-          <p>We are verifying that you are not a bot. This takes a few seconds.</p>
-          <div id="loader" style="margin:20px;">⚙️ Performing CPU security calculation...</div>
-          <script>
-            async function solve() {
-              const ip = "${clientIp}";
-              const nonce = "${nonce}";
-              const diff = ${difficulty};
-              const target = "0".repeat(diff);
-              let solution = 0;
-              
-              while (true) {
-                const msg = "${ip}" + ":" + "${nonce}" + ":" + solution;
-                const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
-                const hash = Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
-                if (hash.startsWith(target)) break;
-                solution++;
-                if (solution % 100000 === 0) await new Promise(resolve => setTimeout(resolve, 0)); // To avoid freezing the browser
-              }
-              window.location.href = "${path}" + "?pow_type=cpu&pow_nonce=" + nonce + "&pow_solution=" + solution;
-            }
-            solve();
-          </script>
-        </body>
-      </html>
-    `;
-};
-
 /**
  * Generates the HTML content for a memory-intensive PoW challenge.
  */
@@ -906,7 +898,7 @@ function getHoneypotScore(context, honeypotConfig = {}) {
  */
 const injectionPatterns = {
     // SQL/NoSQL injections, including time-based attacks
-    sql: /(\$ne|' *OR *'1'='1|['";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|SLEEP\(|BENCHMARK\(|WAITFOR DELAY)/i,
+    sql: /(\$ne|\' *OR *\'1\'=\'1|['";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|(?:SLEEP|BENCHMARK)\s*\(|WAITFOR DELAY)/i,
     // Log4Shell (JNDI injection)
     log4shell: /\$\{jndi:(ldap|rmi|dns):/i,
     // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
@@ -919,6 +911,68 @@ const injectionPatterns = {
     rce: /`.*`|(^|[\n;&|]\s*)(ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i,
 };
 
+/**
+ * @private
+ * Analyse une série de mouvements de souris pour en extraire des métriques comportementales.
+ * @param {Array<{x: number, y: number, t: number}>} history - L'historique des points de la souris.
+ * @returns {{avgSpeed: number, avgAcceleration: number, straightness: number, pauses: number, segments: Array<number>}}
+ */
+function analyzeMouseMovements(history) {
+    if (!history || history.length < 3) {
+        return { avgSpeed: 0, avgAcceleration: 0, straightness: 1, pauses: 0, segments: [] };
+    }
+
+    const segments = [];
+    let totalDistance = 0;
+    let pauses = 0;
+
+    for (let i = 1; i < history.length; i++) {
+        const p1 = history[i - 1];
+        const p2 = history[i];
+        const dx = p2.x - p1.x;
+        const dy = p2.y - p1.y;
+        const dt = p2.t - p1.t;
+        const distance = Math.sqrt(dx * dx + dy * dy);
+
+        if (dt > 0) {
+            const speed = distance / dt;
+            segments.push({ distance, dt, speed });
+            totalDistance += distance;
+        }
+        // Une "micro-pause" est un intervalle de temps long sans mouvement significatif.
+        if (dt > 100 && distance < 5) {
+            pauses++;
+        }
+    }
+
+    if (segments.length < 2) {
+        return { avgSpeed: 0, avgAcceleration: 0, straightness: 1, pauses, segments: [] };
+    }
+
+    const totalTime = history[history.length - 1].t - history[0].t;
+    const avgSpeed = totalTime > 0 ? segments.reduce((sum, s) => sum + s.speed, 0) / segments.length : 0;
+
+    let totalAbsAcceleration = 0;
+    for (let i = 1; i < segments.length; i++) {
+        const s1 = segments[i - 1];
+        const s2 = segments[i];
+        if (s2.dt > 0) {
+            const acceleration = (s2.speed - s1.speed) / s2.dt;
+            totalAbsAcceleration += Math.abs(acceleration);
+        }
+    }
+    const avgAcceleration = totalAbsAcceleration / (segments.length - 1);
+
+    // Le score de rectitude compare la distance totale parcourue à la distance en ligne droite.
+    // Un score proche de 1 signifie un mouvement très droit (suspect).
+    const startPoint = history[0];
+    const endPoint = history[history.length - 1];
+    const straightDistance = Math.sqrt(Math.pow(endPoint.x - startPoint.x, 2) + Math.pow(endPoint.y - startPoint.y, 2));
+    const straightness = totalDistance > 0 ? straightDistance / totalDistance : 1;
+
+    return { avgSpeed, avgAcceleration, straightness, pauses, segments: segments.map(s => s.distance) };
+}
+
 /**
  * Calcule un score basé sur les métriques comportementales envoyées par le client.
  * @param {object} context - Le contexte de la requête, contenant les en-têtes.
@@ -939,8 +993,11 @@ function getBehaviorScore(context) {
       return { behaviorScore: 100 };
     }
 
-    // 2. Pénalité pour absence totale d'interaction.
-    if (metrics.mouseEntropy === 0 && metrics.keystrokeLatency === 0) {
+    // 2. Analyse des mouvements de la souris
+    const { avgSpeed, avgAcceleration, straightness, pauses, segments } = analyzeMouseMovements(metrics.mouseMovementsHistory);
+
+    // Pénalité pour absence totale d'interaction (pas de mouvements, pas de frappes).
+    if (avgSpeed === 0 && metrics.keystrokeLatency === 0) {
       score += 40;
     }
 
@@ -955,35 +1012,28 @@ function getBehaviorScore(context) {
             score -= 10; // Petit bonus pour une navigation de base.
         }
     }
-    // 3. Vérification de la plausibilité et de la distribution des métriques.
-    // Un bot pourrait envoyer des valeurs aléatoires, mais elles ne suivront probablement pas
-    // des distributions naturelles (comme la loi de Benford pour les premiers chiffres).
 
-    // Plausibilité de l'entropie de la souris
-    if (metrics.mouseEntropy > 0 && metrics.mouseEntropy < 0.1) score += 20; // Entropie très faible, suspect.
-    if (metrics.mouseEntropy > 500) score += 30; // Entropie irréalistement élevée.
+    // 3. Analyse des métriques de la souris
+    if (avgSpeed > 0) {
+        if (avgSpeed > 3) score += 25; // Vitesse irréaliste (3 pixels/ms)
+        if (avgAcceleration > 0.5) score += 20; // Accélération trop brutale
+        if (straightness > 0.95) score += 30; // Mouvement trop droit
+        if (pauses === 0 && segments.length > 20) score += 15; // Mouvement continu sans micro-pauses
+    }
 
     // Plausibilité de la latence de frappe
     if (metrics.keystrokeLatency > 0 && metrics.keystrokeLatency < 40) score += 25; // Frappe trop rapide pour un humain.
     if (metrics.keystrokeLatency > 1000) score += 15; // Latence très élevée, peut être un script lent.
 
     // 4. Analyse de la distribution avec la loi de Benford (si les valeurs sont non nulles).
-    // On utilise les décimales pour avoir plus de chiffres à analyser.
-    const mouseEntropyStr = String(metrics.mouseEntropy).replace(".", "");
-    const keystrokeLatencyStr = String(metrics.keystrokeLatency).replace(".", "");
-
-    if (mouseEntropyStr.length > 2) {
-      const mouseDeviation = Optimization.Operators.benfordTest(mouseEntropyStr);
-      // Une déviation > 0.15 est fortement suspecte.
-      if (mouseDeviation > 0.15) score += 40;
-    }
-
-    if (keystrokeLatencyStr.length > 2) {
-      const keystrokeDeviation = Optimization.Operators.benfordTest(keystrokeLatencyStr);
-      if (keystrokeDeviation > 0.15) score += 40;
+    if (segments.length > 10) {
+        const benfordDeviation = Optimization.Operators.benfordTest(segments);
+        if (benfordDeviation > 0.18) { // Seuil légèrement plus élevé pour cette métrique
+            score += 35;
+        }
     }
 
-    return { behaviorScore: Math.max(0, Math.min(100, score)) }; // Assure que le score reste entre 0 et 100
+    return { behaviorScore: Math.min(100, score) }; // Assure que le score ne dépasse pas 100, mais peut être négatif (bonus)
   } catch (e) {
     return { behaviorScore: 10 }; // En-tête malformé = légèrement suspect.
   }
@@ -1116,6 +1166,64 @@ function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerprint) {
     return { tlsSpoofingScore: 0 };
 }
 
+/**
+ * @private
+ * Analyzes click positions from client-side metrics to detect unnaturally low variance,
+ * which can be a sign of automated clicking.
+ * @param {Array<{x: number, y: number, targetId: string}>|null} history - The click history from the client.
+ * @returns {number} A score from 0 to 100, where a higher score indicates lower variance (more bot-like).
+ */
+function analyzeClickPositions(history) {
+    if (!history || history.length < 3) {
+        return 0;
+    }
+
+    const clicksByTarget = {};
+    for (const click of history) {
+        if (!click.targetId) continue;
+        if (!clicksByTarget[click.targetId]) {
+            clicksByTarget[click.targetId] = [];
+        }
+        clicksByTarget[click.targetId].push(click);
+    }
+
+    let maxScore = 0;
+
+    for (const targetId in clicksByTarget) {
+        const clicks = clicksByTarget[targetId];
+        if (clicks.length < 3) continue;
+
+        const n = clicks.length;
+        const meanX = clicks.reduce((sum, c) => sum + c.x, 0) / n;
+        const meanY = clicks.reduce((sum, c) => sum + c.y, 0) / n;
+
+        const variance = clicks.reduce((sum, c) => sum + Math.pow(c.x - meanX, 2) + Math.pow(c.y - meanY, 2), 0) / n;
+
+        // If variance is extremely low (e.g., less than 1 pixel), it's highly suspicious.
+        // The score increases as variance approaches zero.
+        if (variance < 1.0) {
+            // A simple scoring model: score is 100 if variance is 0, and decreases.
+            const score = (1 - Math.sqrt(variance) / 5) * 100;
+            if (score > maxScore) {
+                maxScore = score;
+            }
+        }
+    }
+
+    return Math.min(100, maxScore);
+}
+
+/**
+ * Calculates a score based on click variance metrics sent by the client.
+ * @param {object} context - The request context.
+ * @returns {{clickVarianceScore: number}}
+ */
+function getClickVarianceScore(context) {
+    const metrics = JSON.parse(context.headers['x-behavior-metrics'] || '{}');
+    const score = analyzeClickPositions(metrics.clicksHistory);
+    return { clickVarianceScore: score };
+}
+
 
 /**
  * Calcule un score basé sur la détection explicite de frameworks d'automatisation.
@@ -1475,10 +1583,8 @@ export const getSuspicionVector = async (context, securityConfig) => {
   // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
   const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
 
-  // NOUVEAU: On calcule le score de spoofing TLS.
   const { tlsSpoofingScore } = getTlsSpoofingScore(context);
 
-  // NOUVEAU: On appelle getBotScore pour détecter les marqueurs d'automatisation.
   const { botScore } = getBotScore(context);
 
   // NOUVEAU: On calcule le score d'incohérence temporelle.
@@ -1487,6 +1593,9 @@ export const getSuspicionVector = async (context, securityConfig) => {
   // NOUVEAU: On calcule le score d'incohérence entre les couches.
   const { crossLayerInconsistencyScore } = getCrossLayerInconsistency(context);
 
+  // NOUVEAU: On calcule le score de variance des clics.
+  const { clickVarianceScore } = getClickVarianceScore(context);
+
   const { requestPatternScore } = getRequestPatternScore(context, deviceData, securityConfig.patterns);
 
   // Save the updated device state to the store
@@ -1499,7 +1608,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore: clickVarianceScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -1662,7 +1771,7 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  * @param {string} clientIp - The client's IP address.
  * @returns {string} HTML content.
  */
-function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapContainerHtml, originalFingerprint) {
+function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapUrls, originalFingerprint) { // eslint-disable-line max-len
     const { nonce, target, path } = cpuChallengeDetails;
     const solverCode = getPowSolverCode();
     // On prépare le baseBlock pour le client. Il sera envoyé sous forme de tableau d'octets.
@@ -1671,6 +1780,13 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint);
     const baseBlockBytes = `[${baseBlock.toString('utf8').split('').map(c => c.charCodeAt(0)).join(',')}]`;
 
+    // Prépare la configuration pour l'initialisation du client, y compris les URL pièges.
+    const clientInitConfig = {
+        mouse: true,
+        keystrokes: true,
+        trapUrls: trapUrls // On passe directement le tableau d'URL
+    };
+
     const challengeScript = `
       async function solve() {
         const nonce = ${JSON.stringify(nonce)};
@@ -1702,6 +1818,12 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
         const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
         window.location.href = finalUrl;
       }
+
+      // Initialise la bibliothèque client avec les URL pièges
+      // On crée un alias pour un appel plus propre, tout en s'assurant que la bibliothèque est chargée.
+      const initializeClient = window.ClientLibrary?.initializeClient;
+      if (initializeClient) initializeClient(${JSON.stringify(clientInitConfig)});
+      
       solve();
     `;
 
@@ -1717,13 +1839,12 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     }
 
     if (!htmlTemplate) {
-        htmlTemplate = `<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script><!-- FINGERPRINT_TRAPS --></body></html>`;
+        htmlTemplate = `<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script></body></html>`; // eslint-disable-line max-len
     }
 
     return htmlTemplate
         .replace('<!-- FINGERPRINT_SOLVER_SCRIPT -->', solverCode)
-        .replace('<!-- FINGERPRINT_CHALLENGE_SCRIPT -->', challengeScript)
-        .replace('<!-- FINGERPRINT_TRAPS -->', trapContainerHtml);
+        .replace('<!-- FINGERPRINT_CHALLENGE_SCRIPT -->', challengeScript);
 }
 
 /**
@@ -1825,6 +1946,7 @@ export class FingerprintEngine {
     this._allowlist = this._buildAllowlist();
     this._validateConfig(securityConfig); // Validate the configuration
     this.verbose = securityConfig.verbose || false;
+    this.dryRun = securityConfig.dryRun || false;
   }
 
   /**
@@ -1842,7 +1964,7 @@ export class FingerprintEngine {
       'weights', 'thresholds', 'cpu', 'ticketMaxAge', 'challengeTtl',
       'deviceIdCookieMaxAge', 'challengePagePath', 'verbose', 'patterns',
       'honeypot', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger',
-      'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist',
+      'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
       'similarityThreshold'
     ]);
 
@@ -1882,7 +2004,8 @@ export class FingerprintEngine {
             (suspicionVector.botScore || 0) * (weights.botScore || 0) + // Ajout du nouveau score
             (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0) +
             (suspicionVector.tlsSpoofingScore || 0) * (weights.tlsSpoofingScore || 0) + // NOUVEAU: TLS Spoofing
-            (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0);
+            (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0) +
+            (suspicionVector.clickVarianceScore || 0) * (weights.clickVarianceScore || 0);
 
         return Math.min(100, score);
     }
@@ -2203,7 +2326,15 @@ export class FingerprintEngine {
         if (onDeviceCompromised) {
             onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
         }
-        return { action: 'block', status: 404, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+        const decision = { action: 'block', status: 404, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+        if (this.dryRun) {
+            this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+            decision.intendedAction = decision.action;
+            decision.action = 'next';
+            delete decision.status;
+            delete decision.body;
+        }
+        return decision;
     }
 
     // The engine now works with the context directly, no more rawReq dependency here.
@@ -2404,7 +2535,15 @@ export class FingerprintEngine {
             const newBlockThreshold = thresholds.block ?? 95;
             if (finalScore >= newBlockThreshold) {
                 this._log('Request blocked after invalid challenge solution', { finalScore, newBlockThreshold });
-                return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+                const decision = { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+                if (this.dryRun) {
+                    this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+                    decision.intendedAction = decision.action;
+                    decision.action = 'next';
+                    delete decision.status;
+                    delete decision.body;
+                }
+                return decision;
             }
             // If not blocked, the request will proceed to be re-challenged.
         }
@@ -2474,7 +2613,15 @@ export class FingerprintEngine {
       if (logger) {
         logger({ type: 'request_blocked', deviceId: deviceId, score: finalScore, vector: suspicionVector, timestamp: Date.now() });
       }
-      return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+      const decision = { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+      if (this.dryRun) {
+          this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+          decision.intendedAction = decision.action;
+          decision.action = 'next';
+          delete decision.status;
+          delete decision.body;
+      }
+      return decision;
     }
 
     // Honeypot: Check if the request is for a trap URL generated in a previous challenge.
@@ -2490,7 +2637,15 @@ export class FingerprintEngine {
             logger({ type: 'trap_triggered', deviceId: cookies?.device_id, score: 100, path: path, timestamp: Date.now(), vector: { honeypotScore: 100 } });
         }
         await store.set(`device:${cookies.device_id}`, deviceData); // No TTL for condemned status
-        return { action: 'block', status: 404, score: 100, vector: { honeypotScore: 100 } };
+        const decision = { action: 'block', status: 404, score: 100, vector: { honeypotScore: 100 } };
+        if (this.dryRun) {
+            this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+            decision.intendedAction = decision.action;
+            decision.action = 'next';
+            delete decision.status;
+            delete decision.body;
+        }
+        return decision;
     }
     
     // --- NOUVELLE LOGIQUE DE RE-CHALLENGE ---
@@ -2519,7 +2674,15 @@ export class FingerprintEngine {
             suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
             // Recalculate the final score with the updated vector.
             const newFinalScore = this.calculateFinalScore(suspicionVector);
-            return { action: 'block', status: 404, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
+            const decision = { action: 'block', status: 404, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
+            if (this.dryRun) {
+                this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+                decision.intendedAction = decision.action;
+                decision.action = 'next';
+                delete decision.status;
+                delete decision.body;
+            }
+            return decision;
         }
 
         // --- SELECTION AND SENDING OF THE APPROPRIATE CHALLENGE ---
@@ -2547,11 +2710,18 @@ export class FingerprintEngine {
                 }
             };
             return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
-        } else if (isSuspicious) { // Pour les scores bas/moyens ou si le travail utile n'est pas choisi
+            } else if (isSuspicious) { // Pour les scores bas/moyens ou si le travail utile n'est pas choisi                
+                const decision = { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404 };
+                if (this.dryRun) {
+                    this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+                    decision.intendedAction = decision.action;
+                    decision.action = 'next';
+                    delete decision.status;
+                    return decision;
+                }
             // Generate some trap URLs to embed in the challenge page.
             // These links are visually hidden but present in the DOM to trap bots.
-            const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
-            const trapLinksHtml = trapUrls.map(url => `<a href="${url}" tabindex="-1">config</a>`).join(' ');
+            const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce)); // Génère les URL
 
             // On passe la configuration pour que la difficulté soit calculée correctement.
             const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
@@ -2617,16 +2787,17 @@ export class FingerprintEngine {
                     }
                 };
                 this._log('API challenge response generated', { challengePayload });
-                return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
+                decision.body = challengePayload;
             } else {
                 // For browsers, send the HTML page.
-                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapContainer, originalFingerprint);
-                this._log('Browser challenge page generated', { 
-                    pageLength: page.length, 
-                    hasTrapContainer: true 
+                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapUrls, originalFingerprint);
+                this._log('Browser challenge page generated', {
+                    pageLength: page.length,
+                    trapUrlsInjected: trapUrls.length
                 });
-                return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: page };
+                decision.body = page;
             }
+            return decision;
         }
     }
 
@@ -2637,7 +2808,7 @@ export class FingerprintEngine {
         logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
     }
 
-    return { action: 'next', score: finalScore, vector: suspicionVector };
+    return { action: 'next', score: finalScore, vector: suspicionVector, intendedAction: 'next' };
   }
 
   /**
@@ -2982,8 +3153,11 @@ export const powMiddleware = (securityConfig) => {
   const engine = new FingerprintEngine(securityConfig);
 
   // Initialize the problem manager with the configured path, if provided.
-  if (securityConfig.enableUsefulWork && securityConfig.usefulWorkConfigPath) {
-    getProblemManager(securityConfig.usefulWorkConfigPath, store); // This correctly initializes the singleton
+  if (securityConfig.enableUsefulWork) {
+    getProblemManager({
+        configPath: securityConfig.usefulWorkConfigPath,
+        config: securityConfig.usefulWorkConfig
+    }, store);
   }
 
   if (securityConfig.autotuning) {
@@ -3033,6 +3207,7 @@ export const powMiddleware = (securityConfig) => {
     req.fingerprint = {
       score: decision.score,
       vector: decision.vector,
+      intendedAction: decision.intendedAction, // Add intended action for logging
     };
 
     // After getSuspicionVector runs, it might have attached cookies to be set.
@@ -3083,6 +3258,7 @@ export const __internal = {
     getCrossLayerInconsistency, // Expose for testing
     // Expose page generators for security testing
     getTimeInconsistencyScore,
+    getClickVarianceScore, // NOUVEAU: Expose pour les tests
     getTlsFingerprint, // NOUVEAU: Expose pour les tests
     getTlsSpoofingScore, // NOUVEAU: Expose pour les tests
     generateCpuTargetChallengePage,
@@ -3093,6 +3269,7 @@ export const __internal = {
 // --- THRESHOLD AUTO-TUNING SECTION ---
 
 let autoTuningJobId = null;
+let lastBestSolution = null; // NOUVEAU: Stocke la meilleure solution trouvée
 
 /**
  * Executes a threshold optimization pass using collected traffic data.
@@ -3101,8 +3278,9 @@ let autoTuningJobId = null;
  * @param {Array<object>} trafficData - The array containing traffic logs.
  * @param {number} minDataPoints - The minimum number of data points required to start optimization.
  * @param {number} maxDataPoints - The maximum number of data points to keep after an optimization cycle.
+ * @param {string} [savePath] - Optional path to save the best configuration to a file.
  */
-function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints) {
+function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath) {
   const highConfidenceLogs = trafficData.filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered').length;
   const highConfidenceRatio = trafficData.length > 0 ? highConfidenceLogs / trafficData.length : 0;
   const MIN_CONFIDENCE_RATIO = 0.05; // Exiger au moins 5% de signaux forts.
@@ -3151,35 +3329,63 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
 
   /**
    * Met à jour un objet de configuration (ex: thresholds, weights) en douceur.
+   * Cette nouvelle version préserve la proportionnalité des valeurs initiales.
    * @param {object} currentConfig - La configuration actuelle à modifier.
    * @param {object} targetConfig - La configuration cible proposée par l'optimiseur.
    */
   const applyInertialUpdate = (currentConfig, targetConfig) => {
-      if (!currentConfig || !targetConfig) return; // Vérifier aussi currentConfig
-      for (const key in targetConfig) {
-          if (Object.hasOwnProperty.call(currentConfig, key)) {
-              const currentValue = currentConfig[key];
-              const targetValue = targetConfig[key];
-              const delta = targetValue - currentValue;
-              const maxChange = Math.abs(currentValue * MAX_CHANGE_VELOCITY);
-
-              // Limite le changement à la vélocité maximale
-              const change = Math.max(-maxChange, Math.min(maxChange, delta));
-              
-              currentConfig[key] += change;
-          }
+    if (!currentConfig || !targetConfig) return; // Vérifier aussi currentConfig
+
+    // --- NOUVELLE LOGIQUE PROPORTIONNELLE ---
+    let totalCurrentWeight = 0;
+    let totalTargetWeight = 0;
+
+    // 1. Calculer la somme des poids actuels et cibles pour les clés communes.
+    for (const key in currentConfig) {
+      if (Object.hasOwnProperty.call(targetConfig, key)) {
+        totalCurrentWeight += currentConfig[key];
+        totalTargetWeight += targetConfig[key];
       }
-  };
+    }
+
+    if (totalCurrentWeight === 0) return; // Éviter la division par zéro
+
+    // 2. Déterminer le ratio de changement global et le limiter par la vélocité.
+    // Cela crée un "facteur d'ajustement" unique pour l'ensemble de la configuration.
+    const globalChangeRatio = (totalTargetWeight - totalCurrentWeight) / totalCurrentWeight;
+    const adjustmentFactor = Math.max(-MAX_CHANGE_VELOCITY, Math.min(MAX_CHANGE_VELOCITY, globalChangeRatio));
 
+    // 3. Appliquer ce facteur à chaque valeur de la configuration actuelle.
+    // Cela fait "glisser" l'ensemble de la configuration tout en préservant les proportions.
+    for (const key in currentConfig) {
+      if (Object.hasOwnProperty.call(targetConfig, key)) {
+        currentConfig[key] *= (1 + adjustmentFactor);
+      }
+    }
+  };
   applyInertialUpdate(securityConfig.thresholds, newConfig.thresholds);
   applyInertialUpdate(securityConfig.weights, newConfig.weights);
   applyInertialUpdate(securityConfig.patterns, newConfig.patterns);
 
+  // NOUVEAU: Stocker la meilleure solution pour une consultation externe
+  lastBestSolution = bestSolution;
+
   console.log("[AutoTuning] Nouvelle configuration de sécurité optimisée appliquée.");
   console.log("[AutoTuning] Objectifs atteints :", { falsePositiveRate: bestSolution.objectives[0].toFixed(4), falseNegativeRate: bestSolution.objectives[1].toFixed(4) });
   console.log("[AutoTuning] Nouveaux seuils :", securityConfig.thresholds);
   console.log("[AutoTuning] Nouveaux poids :", securityConfig.weights);
   console.log("[AutoTuning] Nouveaux patterns :", securityConfig.patterns);
+
+  // NOUVEAU: Sauvegarder la meilleure configuration si un chemin est fourni.
+  if (savePath) {
+      try {
+          const configToSave = JSON.stringify(bestSolution.solution, null, 2);
+          fs.writeFileSync(savePath, configToSave, 'utf-8');
+          console.log(`[AutoTuning] Meilleure configuration sauvegardée dans : ${savePath}`);
+      } catch (error) {
+          console.error(`[AutoTuning] Erreur lors de la sauvegarde de la configuration optimisée : ${error.message}`);
+      }
+  }
 }
 
 /**
@@ -3191,6 +3397,7 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
  * @param {number} [options.interval=1800000] - The interval in milliseconds between each optimization cycle (default: 30 minutes).
  * @param {number} [options.minDataPoints=200] - The minimum number of requests to have before starting a cycle (default: 200).
  * @param {number} [options.maxDataPoints=10000] - The maximum number of log entries to keep in memory (default: 10,000).
+ * @param {string} [options.savePath] - Optional. If provided, the best configuration found will be saved to this file path.
  */
 export function startThresholdAutoTuning(options) {
     if (autoTuningJobId) {
@@ -3203,7 +3410,8 @@ export function startThresholdAutoTuning(options) {
         trafficData,
         interval = 1800000, // 30 minutes
         minDataPoints = 200,
-        maxDataPoints = 10000 // Limite par défaut à 10 000 entrées
+        maxDataPoints = 10000, // Limite par défaut à 10 000 entrées
+        savePath, // NOUVEAU: Chemin de sauvegarde optionnel
     } = options;
 
     if (!securityConfig || !trafficData) {
@@ -3213,7 +3421,7 @@ export function startThresholdAutoTuning(options) {
     console.log(`[AutoTuning] Job d'optimisation des seuils démarré. Prochain cycle dans ${interval / 60000} minutes.`);
 
     autoTuningJobId = setInterval(() => {
-        runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints);
+        runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath);
     }, interval);
 }
 
@@ -3228,3 +3436,13 @@ export function stopThresholdAutoTuning() {
         console.log("[AutoTuning] Job d'optimisation des seuils arrêté.");
     }
 }
+
+/**
+ * Returns the last best solution found by the auto-tuner.
+ * This is useful for logging or creating a "finops" security configuration.
+ * @export
+ * @returns {object|null} The best solution object { solution, objectives } or null if no tuning has run.
+ */
+export function getBestTuningSolution() {
+    return lastBestSolution;
+}