npm - @anonympins/fingerprint - Versions diffs - 0.3.2 → 0.3.3 - Mend

@anonympins/fingerprint 0.3.2 → 0.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (50) hide show

package/CHANGELOG.md +172 -0
package/README.md +276 -34
package/composer.json +38 -0
package/index.js +5 -0
package/package.json +23 -18
package/phpunit.xml +20 -0
package/public/fp.js +2 -0
package/src/js/build-client.js +69 -0
package/{fingerprint.builder.js → src/js/fingerprint.builder.js} +168 -175
package/{fingerprint.client.js → src/js/fingerprint.client.js} +634 -538
package/src/js/fingerprint.client.obfuscated.js +1 -0
package/{fingerprint.js → src/js/fingerprint.js} +255 -101
package/{library.js → src/js/library.js} +1729 -1729
package/{problem-manager.js → src/js/problem-manager.js} +539 -522
package/src/php/AutoTuner.php +155 -0
package/src/php/Challenge/ChallengeUtils.php +306 -0
package/src/php/Config/SecurityProfiles.php +257 -0
package/src/php/DirectFingerprint.php +81 -0
package/src/php/FingerprintBuilder.php +185 -0
package/src/php/FingerprintClient.php +118 -0
package/src/php/FingerprintEngine.php +850 -0
package/src/php/Optimization/FunctionRegistry.php +63 -0
package/src/php/Optimization/Optimization.php +256 -0
package/src/php/Optimization/OptimizationOperators.php +305 -0
package/src/php/Optimization/ProblemInitializers.php +53 -0
package/src/php/ProblemManager.php +255 -0
package/src/php/RequestContext.php +87 -0
package/src/php/Store/IStore.php +42 -0
package/src/php/Store/InMemoryStore.php +67 -0
package/src/php/Store/StoreManager.php +26 -0
package/src/php/Tests/ChallengeUtilsTest.php +82 -0
package/src/php/Tests/FingerprintBuilderTest.php +58 -0
package/src/php/Tests/FingerprintEngineTest.php +219 -0
package/src/php/Tests/PowTest.php +40 -0
package/src/php/Tests/ProblemManagerTest.php +295 -0
package/src/php/Tests/RequestUtilsTest.php +81 -0
package/src/php/Tests/problems.config.json +9 -0
package/src/php/Utils/BigInt.php +102 -0
package/src/php/Utils/BlockList.php +100 -0
package/src/php/Utils/Logger.php +30 -0
package/src/php/Utils/MaliciousPatterns.php +59 -0
package/src/php/Utils/RequestUtils.php +673 -0
package/fingerprint.client.obfuscated.js +0 -1
/package/{mongodb-store.js → src/js/mongodb-store.js} +0 -0
/package/{optimization.worker.js → src/js/optimization.worker.js} +0 -0
/package/{pow.solver.inline.js → src/js/pow.solver.inline.js} +0 -0
/package/{pow.solver.js → src/js/pow.solver.js} +0 -0
/package/{pow.worker.js → src/js/pow.worker.js} +0 -0
/package/{redis-store.js → src/js/redis-store.js} +0 -0
/package/{sql-store.js → src/js/sql-store.js} +0 -0

package/{fingerprint.js → src/js/fingerprint.js} RENAMED Viewed

@@ -44,7 +44,7 @@ const securityProfiles = {
             headerAnomalyScore: 0.1,
             requestPatternScore: 0.6,
             inconsistencyScore: 0.8,
-            behaviorScore: 0.7,
+            behaviorScore: 0.7, // Poids pour les métriques comportementales (souris, clavier)
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.9,
@@ -79,7 +79,7 @@ const securityProfiles = {
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.6,
             timeInconsistencyScore: 1.0,
-            tlsSpoofingScore: 1.0 // NOUVEAU: Plus agressif pour le spoofing TLS
+            tlsSpoofingScore: 1.0 // Plus agressif pour le spoofing TLS
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
         patterns: {
@@ -111,7 +111,7 @@ const securityProfiles = {
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.5,
             timeInconsistencyScore: 0.8,
-            tlsSpoofingScore: 0.7 // NOUVEAU: Important pour les API
+            tlsSpoofingScore: 0.7 // Important pour les API
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
         patterns: {
@@ -144,7 +144,7 @@ const securityProfiles = {
             honeypotScore: 1.0, // Crucial for comment spam
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.8,
-            tlsSpoofingScore: 0.6 // NOUVEAU: Moins critique pour les blogs
+            tlsSpoofingScore: 0.6 // Moins critique pour les blogs
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
         patterns: {
@@ -169,17 +169,14 @@ const securityProfiles = {
             historyScore: 0.4,
             rotationScore: 0.6,
             headerAnomalyScore: 0.2,
-            // Scission du requestPatternScore pour un contrôle plus fin
-            velocityScore: 0.8,       // Pénalise la vitesse globale
-            burstScore: 1.0,          // Pénalise fortement les rafales sur la même ressource (scalping)
-            scrapeScore: 0.9,         // Pénalise le parcours de pages/produits
-            regularityScore: 0.7,     // Détecte les bots de type "cron"
+            // Utilisation d'un score de pattern unifié avec un poids très élevé
+            requestPatternScore: 0.9,
             inconsistencyScore: 1.0, // Crucial for preventing account takeover
             behaviorScore: 0.8, // Important for checkout/login forms
             honeypotScore: 1.0,
             crossLayerInconsistencyScore: 0.7,
             timeInconsistencyScore: 0.9,
-            tlsSpoofingScore: 0.9 // NOUVEAU: Très important pour l'e-commerce
+            tlsSpoofingScore: 0.9 // Très important pour l'e-commerce
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
         patterns: {
@@ -657,47 +654,6 @@ export const verifyTspChallenge = (
   }
 };
-/**
- * Generates the HTML content for the CPU PoW challenge (SHA-256).
- */
-const generateCpuPoWChallenge = (
-  clientIp,
-  nonce,
-  difficulty = 4,
-  path = "",
-) => {
-  return `
-      <html>
-        <head><title>Security Check</title></head>
-        <body style="font-family:sans-serif; text-align:center; padding-top:50px;">
-          <h1>One moment... (Level 1)</h1>
-          <p>We are verifying that you are not a bot. This takes a few seconds.</p>
-          <div id="loader" style="margin:20px;">⚙️ Performing CPU security calculation...</div>
-          <script>
-            async function solve() {
-              const ip = "${clientIp}";
-              const nonce = "${nonce}";
-              const diff = ${difficulty};
-              const target = "0".repeat(diff);
-              let solution = 0;
-              while (true) {
-                const msg = "${ip}" + ":" + "${nonce}" + ":" + solution;
-                const buf = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(msg));
-                const hash = Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
-                if (hash.startsWith(target)) break;
-                solution++;
-                if (solution % 100000 === 0) await new Promise(resolve => setTimeout(resolve, 0)); // To avoid freezing the browser
-              }
-              window.location.href = "${path}" + "?pow_type=cpu&pow_nonce=" + nonce + "&pow_solution=" + solution;
-            }
-            solve();
-          </script>
-        </body>
-      </html>
-    `;
-};
 /**
  * Generates the HTML content for a memory-intensive PoW challenge.
  */
@@ -955,6 +911,68 @@ const injectionPatterns = {
     rce: /`.*`|(^|[\n;&|]\s*)(ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i,
 };
+/**
+ * @private
+ * Analyse une série de mouvements de souris pour en extraire des métriques comportementales.
+ * @param {Array<{x: number, y: number, t: number}>} history - L'historique des points de la souris.
+ * @returns {{avgSpeed: number, avgAcceleration: number, straightness: number, pauses: number, segments: Array<number>}}
+ */
+function analyzeMouseMovements(history) {
+    if (!history || history.length < 3) {
+        return { avgSpeed: 0, avgAcceleration: 0, straightness: 1, pauses: 0, segments: [] };
+    }
+    const segments = [];
+    let totalDistance = 0;
+    let pauses = 0;
+    for (let i = 1; i < history.length; i++) {
+        const p1 = history[i - 1];
+        const p2 = history[i];
+        const dx = p2.x - p1.x;
+        const dy = p2.y - p1.y;
+        const dt = p2.t - p1.t;
+        const distance = Math.sqrt(dx * dx + dy * dy);
+        if (dt > 0) {
+            const speed = distance / dt;
+            segments.push({ distance, dt, speed });
+            totalDistance += distance;
+        }
+        // Une "micro-pause" est un intervalle de temps long sans mouvement significatif.
+        if (dt > 100 && distance < 5) {
+            pauses++;
+        }
+    }
+    if (segments.length < 2) {
+        return { avgSpeed: 0, avgAcceleration: 0, straightness: 1, pauses, segments: [] };
+    }
+    const totalTime = history[history.length - 1].t - history[0].t;
+    const avgSpeed = totalTime > 0 ? segments.reduce((sum, s) => sum + s.speed, 0) / segments.length : 0;
+    let totalAbsAcceleration = 0;
+    for (let i = 1; i < segments.length; i++) {
+        const s1 = segments[i - 1];
+        const s2 = segments[i];
+        if (s2.dt > 0) {
+            const acceleration = (s2.speed - s1.speed) / s2.dt;
+            totalAbsAcceleration += Math.abs(acceleration);
+        }
+    }
+    const avgAcceleration = totalAbsAcceleration / (segments.length - 1);
+    // Le score de rectitude compare la distance totale parcourue à la distance en ligne droite.
+    // Un score proche de 1 signifie un mouvement très droit (suspect).
+    const startPoint = history[0];
+    const endPoint = history[history.length - 1];
+    const straightDistance = Math.sqrt(Math.pow(endPoint.x - startPoint.x, 2) + Math.pow(endPoint.y - startPoint.y, 2));
+    const straightness = totalDistance > 0 ? straightDistance / totalDistance : 1;
+    return { avgSpeed, avgAcceleration, straightness, pauses, segments: segments.map(s => s.distance) };
+}
 /**
  * Calcule un score basé sur les métriques comportementales envoyées par le client.
  * @param {object} context - Le contexte de la requête, contenant les en-têtes.
@@ -975,8 +993,11 @@ function getBehaviorScore(context) {
       return { behaviorScore: 100 };
     }
-    // 2. Pénalité pour absence totale d'interaction.
-    if (metrics.mouseEntropy === 0 && metrics.keystrokeLatency === 0) {
+    // 2. Analyse des mouvements de la souris
+    const { avgSpeed, avgAcceleration, straightness, pauses, segments } = analyzeMouseMovements(metrics.mouseMovementsHistory);
+    // Pénalité pour absence totale d'interaction (pas de mouvements, pas de frappes).
+    if (avgSpeed === 0 && metrics.keystrokeLatency === 0) {
       score += 40;
     }
@@ -991,32 +1012,25 @@ function getBehaviorScore(context) {
             score -= 10; // Petit bonus pour une navigation de base.
         }
     }
-    // 3. Vérification de la plausibilité et de la distribution des métriques.
-    // Un bot pourrait envoyer des valeurs aléatoires, mais elles ne suivront probablement pas
-    // des distributions naturelles (comme la loi de Benford pour les premiers chiffres).
-    // Plausibilité de l'entropie de la souris
-    if (metrics.mouseEntropy > 0 && metrics.mouseEntropy < 0.1) score += 20; // Entropie très faible, suspect.
-    if (metrics.mouseEntropy > 500) score += 30; // Entropie irréalistement élevée.
+    // 3. Analyse des métriques de la souris
+    if (avgSpeed > 0) {
+        if (avgSpeed > 3) score += 25; // Vitesse irréaliste (3 pixels/ms)
+        if (avgAcceleration > 0.5) score += 20; // Accélération trop brutale
+        if (straightness > 0.95) score += 30; // Mouvement trop droit
+        if (pauses === 0 && segments.length > 20) score += 15; // Mouvement continu sans micro-pauses
+    }
     // Plausibilité de la latence de frappe
     if (metrics.keystrokeLatency > 0 && metrics.keystrokeLatency < 40) score += 25; // Frappe trop rapide pour un humain.
     if (metrics.keystrokeLatency > 1000) score += 15; // Latence très élevée, peut être un script lent.
     // 4. Analyse de la distribution avec la loi de Benford (si les valeurs sont non nulles).
-    // On utilise les décimales pour avoir plus de chiffres à analyser.
-    const mouseEntropyStr = String(metrics.mouseEntropy).replace(".", "");
-    const keystrokeLatencyStr = String(metrics.keystrokeLatency).replace(".", "");
-    if (mouseEntropyStr.length > 2) {
-      const mouseDeviation = Optimization.Operators.benfordTest(mouseEntropyStr);
-      // Une déviation > 0.15 est fortement suspecte.
-      if (mouseDeviation > 0.15) score += 40;
-    }
-    if (keystrokeLatencyStr.length > 2) {
-      const keystrokeDeviation = Optimization.Operators.benfordTest(keystrokeLatencyStr);
-      if (keystrokeDeviation > 0.15) score += 40;
+    if (segments.length > 10) {
+        const benfordDeviation = Optimization.Operators.benfordTest(segments);
+        if (benfordDeviation > 0.18) { // Seuil légèrement plus élevé pour cette métrique
+            score += 35;
+        }
     }
     return { behaviorScore: Math.min(100, score) }; // Assure que le score ne dépasse pas 100, mais peut être négatif (bonus)
@@ -1152,6 +1166,64 @@ function getTlsSpoofingScore(context, getTlsFingerprintFn = getTlsFingerprint) {
     return { tlsSpoofingScore: 0 };
 }
+/**
+ * @private
+ * Analyzes click positions from client-side metrics to detect unnaturally low variance,
+ * which can be a sign of automated clicking.
+ * @param {Array<{x: number, y: number, targetId: string}>|null} history - The click history from the client.
+ * @returns {number} A score from 0 to 100, where a higher score indicates lower variance (more bot-like).
+ */
+function analyzeClickPositions(history) {
+    if (!history || history.length < 3) {
+        return 0;
+    }
+    const clicksByTarget = {};
+    for (const click of history) {
+        if (!click.targetId) continue;
+        if (!clicksByTarget[click.targetId]) {
+            clicksByTarget[click.targetId] = [];
+        }
+        clicksByTarget[click.targetId].push(click);
+    }
+    let maxScore = 0;
+    for (const targetId in clicksByTarget) {
+        const clicks = clicksByTarget[targetId];
+        if (clicks.length < 3) continue;
+        const n = clicks.length;
+        const meanX = clicks.reduce((sum, c) => sum + c.x, 0) / n;
+        const meanY = clicks.reduce((sum, c) => sum + c.y, 0) / n;
+        const variance = clicks.reduce((sum, c) => sum + Math.pow(c.x - meanX, 2) + Math.pow(c.y - meanY, 2), 0) / n;
+        // If variance is extremely low (e.g., less than 1 pixel), it's highly suspicious.
+        // The score increases as variance approaches zero.
+        if (variance < 1.0) {
+            // A simple scoring model: score is 100 if variance is 0, and decreases.
+            const score = (1 - Math.sqrt(variance) / 5) * 100;
+            if (score > maxScore) {
+                maxScore = score;
+            }
+        }
+    }
+    return Math.min(100, maxScore);
+}
+/**
+ * Calculates a score based on click variance metrics sent by the client.
+ * @param {object} context - The request context.
+ * @returns {{clickVarianceScore: number}}
+ */
+function getClickVarianceScore(context) {
+    const metrics = JSON.parse(context.headers['x-behavior-metrics'] || '{}');
+    const score = analyzeClickPositions(metrics.clicksHistory);
+    return { clickVarianceScore: score };
+}
 /**
  * Calcule un score basé sur la détection explicite de frameworks d'automatisation.
@@ -1511,10 +1583,8 @@ export const getSuspicionVector = async (context, securityConfig) => {
   // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
   const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
-  // NOUVEAU: On calcule le score de spoofing TLS.
   const { tlsSpoofingScore } = getTlsSpoofingScore(context);
-  // NOUVEAU: On appelle getBotScore pour détecter les marqueurs d'automatisation.
   const { botScore } = getBotScore(context);
   // NOUVEAU: On calcule le score d'incohérence temporelle.
@@ -1523,6 +1593,9 @@ export const getSuspicionVector = async (context, securityConfig) => {
   // NOUVEAU: On calcule le score d'incohérence entre les couches.
   const { crossLayerInconsistencyScore } = getCrossLayerInconsistency(context);
+  // NOUVEAU: On calcule le score de variance des clics.
+  const { clickVarianceScore } = getClickVarianceScore(context);
   const { requestPatternScore } = getRequestPatternScore(context, deviceData, securityConfig.patterns);
   // Save the updated device state to the store
@@ -1535,7 +1608,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore: clickVarianceScore };
 };
 // A residential user can change networks (home, 4G, public wifi).
@@ -1698,7 +1771,7 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  * @param {string} clientIp - The client's IP address.
  * @returns {string} HTML content.
  */
-function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapContainerHtml, originalFingerprint) {
+function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapUrls, originalFingerprint) { // eslint-disable-line max-len
     const { nonce, target, path } = cpuChallengeDetails;
     const solverCode = getPowSolverCode();
     // On prépare le baseBlock pour le client. Il sera envoyé sous forme de tableau d'octets.
@@ -1707,6 +1780,13 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint);
     const baseBlockBytes = `[${baseBlock.toString('utf8').split('').map(c => c.charCodeAt(0)).join(',')}]`;
+    // Prépare la configuration pour l'initialisation du client, y compris les URL pièges.
+    const clientInitConfig = {
+        mouse: true,
+        keystrokes: true,
+        trapUrls: trapUrls // On passe directement le tableau d'URL
+    };
     const challengeScript = `
       async function solve() {
         const nonce = ${JSON.stringify(nonce)};
@@ -1738,6 +1818,12 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
         const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
         window.location.href = finalUrl;
       }
+      // Initialise la bibliothèque client avec les URL pièges
+      // On crée un alias pour un appel plus propre, tout en s'assurant que la bibliothèque est chargée.
+      const initializeClient = window.ClientLibrary?.initializeClient;
+      if (initializeClient) initializeClient(${JSON.stringify(clientInitConfig)});
       solve();
     `;
@@ -1753,13 +1839,12 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     }
     if (!htmlTemplate) {
-        htmlTemplate = `<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script><!-- FINGERPRINT_TRAPS --></body></html>`;
+        htmlTemplate = `<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script></body></html>`; // eslint-disable-line max-len
     }
     return htmlTemplate
         .replace('<!-- FINGERPRINT_SOLVER_SCRIPT -->', solverCode)
-        .replace('<!-- FINGERPRINT_CHALLENGE_SCRIPT -->', challengeScript)
-        .replace('<!-- FINGERPRINT_TRAPS -->', trapContainerHtml);
+        .replace('<!-- FINGERPRINT_CHALLENGE_SCRIPT -->', challengeScript);
 }
 /**
@@ -1861,6 +1946,7 @@ export class FingerprintEngine {
     this._allowlist = this._buildAllowlist();
     this._validateConfig(securityConfig); // Validate the configuration
     this.verbose = securityConfig.verbose || false;
+    this.dryRun = securityConfig.dryRun || false;
   }
   /**
@@ -1878,7 +1964,7 @@ export class FingerprintEngine {
       'weights', 'thresholds', 'cpu', 'ticketMaxAge', 'challengeTtl',
       'deviceIdCookieMaxAge', 'challengePagePath', 'verbose', 'patterns',
       'honeypot', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger',
-      'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist',
+      'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
       'similarityThreshold'
     ]);
@@ -1918,7 +2004,8 @@ export class FingerprintEngine {
             (suspicionVector.botScore || 0) * (weights.botScore || 0) + // Ajout du nouveau score
             (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0) +
             (suspicionVector.tlsSpoofingScore || 0) * (weights.tlsSpoofingScore || 0) + // NOUVEAU: TLS Spoofing
-            (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0);
+            (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0) +
+            (suspicionVector.clickVarianceScore || 0) * (weights.clickVarianceScore || 0);
         return Math.min(100, score);
     }
@@ -2239,7 +2326,15 @@ export class FingerprintEngine {
         if (onDeviceCompromised) {
             onDeviceCompromised({ deviceId: deviceId, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
         }
-        return { action: 'block', status: 404, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+        const decision = { action: 'block', status: 404, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
+        if (this.dryRun) {
+            this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+            decision.intendedAction = decision.action;
+            decision.action = 'next';
+            delete decision.status;
+            delete decision.body;
+        }
+        return decision;
     }
     // The engine now works with the context directly, no more rawReq dependency here.
@@ -2440,7 +2535,15 @@ export class FingerprintEngine {
             const newBlockThreshold = thresholds.block ?? 95;
             if (finalScore >= newBlockThreshold) {
                 this._log('Request blocked after invalid challenge solution', { finalScore, newBlockThreshold });
-                return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+                const decision = { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+                if (this.dryRun) {
+                    this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+                    decision.intendedAction = decision.action;
+                    decision.action = 'next';
+                    delete decision.status;
+                    delete decision.body;
+                }
+                return decision;
             }
             // If not blocked, the request will proceed to be re-challenged.
         }
@@ -2510,7 +2613,15 @@ export class FingerprintEngine {
       if (logger) {
         logger({ type: 'request_blocked', deviceId: deviceId, score: finalScore, vector: suspicionVector, timestamp: Date.now() });
       }
-      return { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+      const decision = { action: 'block', status: 404, body: 'Forbidden', score: finalScore, vector: suspicionVector };
+      if (this.dryRun) {
+          this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+          decision.intendedAction = decision.action;
+          decision.action = 'next';
+          delete decision.status;
+          delete decision.body;
+      }
+      return decision;
     }
     // Honeypot: Check if the request is for a trap URL generated in a previous challenge.
@@ -2526,7 +2637,15 @@ export class FingerprintEngine {
             logger({ type: 'trap_triggered', deviceId: cookies?.device_id, score: 100, path: path, timestamp: Date.now(), vector: { honeypotScore: 100 } });
         }
         await store.set(`device:${cookies.device_id}`, deviceData); // No TTL for condemned status
-        return { action: 'block', status: 404, score: 100, vector: { honeypotScore: 100 } };
+        const decision = { action: 'block', status: 404, score: 100, vector: { honeypotScore: 100 } };
+        if (this.dryRun) {
+            this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+            decision.intendedAction = decision.action;
+            decision.action = 'next';
+            delete decision.status;
+            delete decision.body;
+        }
+        return decision;
     }
     // --- NOUVELLE LOGIQUE DE RE-CHALLENGE ---
@@ -2555,7 +2674,15 @@ export class FingerprintEngine {
             suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
             // Recalculate the final score with the updated vector.
             const newFinalScore = this.calculateFinalScore(suspicionVector);
-            return { action: 'block', status: 404, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
+            const decision = { action: 'block', status: 404, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
+            if (this.dryRun) {
+                this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+                decision.intendedAction = decision.action;
+                decision.action = 'next';
+                delete decision.status;
+                delete decision.body;
+            }
+            return decision;
         }
         // --- SELECTION AND SENDING OF THE APPROPRIATE CHALLENGE ---
@@ -2583,11 +2710,18 @@ export class FingerprintEngine {
                 }
             };
             return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
-        } else if (isSuspicious) { // Pour les scores bas/moyens ou si le travail utile n'est pas choisi
+            } else if (isSuspicious) { // Pour les scores bas/moyens ou si le travail utile n'est pas choisi
+                const decision = { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404 };
+                if (this.dryRun) {
+                    this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+                    decision.intendedAction = decision.action;
+                    decision.action = 'next';
+                    delete decision.status;
+                    return decision;
+                }
             // Generate some trap URLs to embed in the challenge page.
             // These links are visually hidden but present in the DOM to trap bots.
-            const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
-            const trapLinksHtml = trapUrls.map(url => `<a href="${url}" tabindex="-1">config</a>`).join(' ');
+            const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce)); // Génère les URL
             // On passe la configuration pour que la difficulté soit calculée correctement.
             const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
@@ -2653,16 +2787,17 @@ export class FingerprintEngine {
                     }
                 };
                 this._log('API challenge response generated', { challengePayload });
-                return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
+                decision.body = challengePayload;
             } else {
                 // For browsers, send the HTML page.
-                const trapContainer = `<div style="position:absolute;left:-9999px;top:-9999px;" aria-hidden="true">${trapLinksHtml}</div>`;                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapContainer, originalFingerprint);
-                this._log('Browser challenge page generated', {
-                    pageLength: page.length,
-                    hasTrapContainer: true
+                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapUrls, originalFingerprint);
+                this._log('Browser challenge page generated', {
+                    pageLength: page.length,
+                    trapUrlsInjected: trapUrls.length
                 });
-                return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: page };
+                decision.body = page;
             }
+            return decision;
         }
     }
@@ -2673,7 +2808,7 @@ export class FingerprintEngine {
         logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
     }
-    return { action: 'next', score: finalScore, vector: suspicionVector };
+    return { action: 'next', score: finalScore, vector: suspicionVector, intendedAction: 'next' };
   }
   /**
@@ -3018,8 +3153,11 @@ export const powMiddleware = (securityConfig) => {
   const engine = new FingerprintEngine(securityConfig);
   // Initialize the problem manager with the configured path, if provided.
-  if (securityConfig.enableUsefulWork && securityConfig.usefulWorkConfigPath) {
-    getProblemManager(securityConfig.usefulWorkConfigPath, store); // This correctly initializes the singleton
+  if (securityConfig.enableUsefulWork) {
+    getProblemManager({
+        configPath: securityConfig.usefulWorkConfigPath,
+        config: securityConfig.usefulWorkConfig
+    }, store);
   }
   if (securityConfig.autotuning) {
@@ -3069,6 +3207,7 @@ export const powMiddleware = (securityConfig) => {
     req.fingerprint = {
       score: decision.score,
       vector: decision.vector,
+      intendedAction: decision.intendedAction, // Add intended action for logging
     };
     // After getSuspicionVector runs, it might have attached cookies to be set.
@@ -3119,6 +3258,7 @@ export const __internal = {
     getCrossLayerInconsistency, // Expose for testing
     // Expose page generators for security testing
     getTimeInconsistencyScore,
+    getClickVarianceScore, // NOUVEAU: Expose pour les tests
     getTlsFingerprint, // NOUVEAU: Expose pour les tests
     getTlsSpoofingScore, // NOUVEAU: Expose pour les tests
     generateCpuTargetChallengePage,
@@ -3138,8 +3278,9 @@ let lastBestSolution = null; // NOUVEAU: Stocke la meilleure solution trouvée
  * @param {Array<object>} trafficData - The array containing traffic logs.
  * @param {number} minDataPoints - The minimum number of data points required to start optimization.
  * @param {number} maxDataPoints - The maximum number of data points to keep after an optimization cycle.
+ * @param {string} [savePath] - Optional path to save the best configuration to a file.
  */
-function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints) {
+function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath) {
   const highConfidenceLogs = trafficData.filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered').length;
   const highConfidenceRatio = trafficData.length > 0 ? highConfidenceLogs / trafficData.length : 0;
   const MIN_CONFIDENCE_RATIO = 0.05; // Exiger au moins 5% de signaux forts.
@@ -3234,6 +3375,17 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
   console.log("[AutoTuning] Nouveaux seuils :", securityConfig.thresholds);
   console.log("[AutoTuning] Nouveaux poids :", securityConfig.weights);
   console.log("[AutoTuning] Nouveaux patterns :", securityConfig.patterns);
+  // NOUVEAU: Sauvegarder la meilleure configuration si un chemin est fourni.
+  if (savePath) {
+      try {
+          const configToSave = JSON.stringify(bestSolution.solution, null, 2);
+          fs.writeFileSync(savePath, configToSave, 'utf-8');
+          console.log(`[AutoTuning] Meilleure configuration sauvegardée dans : ${savePath}`);
+      } catch (error) {
+          console.error(`[AutoTuning] Erreur lors de la sauvegarde de la configuration optimisée : ${error.message}`);
+      }
+  }
 }
 /**
@@ -3245,6 +3397,7 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
  * @param {number} [options.interval=1800000] - The interval in milliseconds between each optimization cycle (default: 30 minutes).
  * @param {number} [options.minDataPoints=200] - The minimum number of requests to have before starting a cycle (default: 200).
  * @param {number} [options.maxDataPoints=10000] - The maximum number of log entries to keep in memory (default: 10,000).
+ * @param {string} [options.savePath] - Optional. If provided, the best configuration found will be saved to this file path.
  */
 export function startThresholdAutoTuning(options) {
     if (autoTuningJobId) {
@@ -3257,7 +3410,8 @@ export function startThresholdAutoTuning(options) {
         trafficData,
         interval = 1800000, // 30 minutes
         minDataPoints = 200,
-        maxDataPoints = 10000 // Limite par défaut à 10 000 entrées
+        maxDataPoints = 10000, // Limite par défaut à 10 000 entrées
+        savePath, // NOUVEAU: Chemin de sauvegarde optionnel
     } = options;
     if (!securityConfig || !trafficData) {
@@ -3267,7 +3421,7 @@ export function startThresholdAutoTuning(options) {
     console.log(`[AutoTuning] Job d'optimisation des seuils démarré. Prochain cycle dans ${interval / 60000} minutes.`);
     autoTuningJobId = setInterval(() => {
-        runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints);
+        runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath);
     }, interval);
 }