@anonympins/fingerprint 0.3.2 → 0.3.4

package/src/php/Tests/FingerprintEngineTest.php

@@ -0,0 +1,300 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use PHPUnit\Framework\TestCase;
+use Anonympins\Fingerprint\FingerprintEngine;
+use Anonympins\Fingerprint\FingerprintBuilder;
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Store\InMemoryStore;
+use Anonympins\Fingerprint\Config\SecurityProfiles;
+
+class FingerprintEngineTest extends TestCase
+{
+    private FingerprintEngine $engine;
+    private array $securityConfig;
+
+    /**
+     * Cette méthode est appelée avant chaque test.
+     * Elle garantit que chaque test s'exécute dans un environnement propre.
+     */
+    protected function setUp(): void
+    {
+        // 1. Utiliser un store en mémoire propre pour chaque test
+        $store = new InMemoryStore();
+        StoreManager::configureStore($store);
+
+        // 2. Charger une configuration de sécurité de base pour les tests
+        $this->securityConfig = SecurityProfiles::createSecurityProfile('balanced', [
+            'verbose' => false, // Désactiver les logs pour ne pas polluer la sortie des tests
+            'challengeNewDevices' => false, // Simplifie les tests de base
+        ]);
+
+        // 3. Créer une nouvelle instance du moteur pour chaque test
+        $this->engine = new FingerprintEngine($this->securityConfig);
+    }
+
+    /**
+     * Crée un contexte de requête de base pour les tests.
+     *
+     * @param array<string, mixed> $overrides
+     * @return RequestContext
+     */
+    private function createRequestContext(array $overrides = []): RequestContext
+    {
+        $defaults = [
+            'clientIp' => '192.168.1.10',
+            'path' => '/',
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9',
+            ],
+            'query' => [],
+            'body' => null,
+            'cookies' => [],
+            'httpVersion' => '1.1',
+        ];
+
+        $params = array_merge($defaults, $overrides);
+
+        return new RequestContext(
+            $params['clientIp'],
+            $params['path'],
+            $params['headers'],
+            $params['query'],
+            $params['body'],
+            $params['cookies'],
+            $params['httpVersion']
+        );
+    }
+
+    public function testAllowsLegitimateRequest(): void
+    {
+        $context = $this->createRequestContext();
+
+        // Simule une première visite
+        $firstDecision = $this->engine->processRequest($context);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un nouveau cookie aurait dû être généré.");
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // Simule une deuxième visite avec le cookie reçu
+        $nextContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']]
+        ]);
+        $secondDecision = $this->engine->processRequest($nextContext);
+
+        $this->assertEquals('next', $secondDecision['action']);
+        $this->assertLessThan($this->securityConfig['thresholds']['low'], $secondDecision['score']);
+    }
+
+    public function testIssuesChallengeForSuspiciousRequest(): void
+    {
+        // 1. First, establish a device identity to avoid the cookie-dropping penalty
+        $firstContext = $this->createRequestContext();
+        $firstDecision = $this->engine->processRequest($firstContext);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "A device ID cookie should have been generated.");
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // 2. Now, simulate a suspicious request from that same device (e.g., missing user-agent)
+        $suspiciousContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => [
+                // No user-agent, which is anomalous
+                'accept-language' => 'en-US,en;q=0.9',
+            ]
+        ]);
+
+        $decision = $this->engine->processRequest($suspiciousContext);
+
+        $this->assertEquals('challenge', $decision['action'], "The action should be to issue a challenge.");
+        $this->assertGreaterThanOrEqual($this->securityConfig['thresholds']['low'], $decision['score'], "The score should be above the 'low' threshold.");
+        $this->assertLessThan($this->securityConfig['thresholds']['block'], $decision['score']);
+    }
+
+    public function testBlocksHighlySuspiciousRequest(): void
+    {
+        // Configure the engine to recognize the 'email_confirm' honeypot field.
+        // We need to create a new engine instance for this test with a custom config.
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'honeypot' => ['fields' => ['email_confirm']],
+            'verbose' => true,
+            'weights'=> ['honeypotScore' => 1]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        // 1. First, establish a device identity to avoid other scores interfering.
+        $firstContext = $this->createRequestContext();
+        $firstDecision = $engine->processRequest($firstContext);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision);
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // 2. Now, simulate a request from that device that falls into a honeypot trap.
+        $honeypotContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            // The bot filled in a hidden field, triggering the honeypot.
+            'body' => ['email_confirm' => 'bot@example.com']
+        ]);
+
+        $decision = $engine->processRequest($honeypotContext);
+
+        $this->assertEquals('block', $decision['action']);
+        $this->assertGreaterThanOrEqual($config['thresholds']['block'], $decision['score']);
+    }
+
+    public function testDetectsCookieDropping(): void
+    {
+        $context = $this->createRequestContext(['clientIp' => '1.2.3.4']);
+
+        // 1. Première requête, un "pending_cookie" est défini pour cette IP
+        $this->engine->processRequest($context);
+
+        // 2. Deuxième requête de la même IP, mais sans le cookie attendu
+        $contextWithoutCookie = $this->createRequestContext(['clientIp' => '1.2.3.4']);
+        $decision = $this->engine->processRequest($contextWithoutCookie);
+
+        // Le score de "cookieDropping" devrait être de 100
+        $this->assertEquals(100, $decision['vector']['cookieDroppingScore']);
+        // L'action devrait être un challenge car le score final sera élevé
+        $this->assertEquals('challenge', $decision['action']);
+    }
+
+    public function testDetectsFingerprintInconsistency(): void
+    {
+        $context = $this->createRequestContext();
+
+        // 1. Première visite, le fingerprint initial est stocké
+        $firstDecision = $this->engine->processRequest($context);
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // 2. Deuxième visite avec le même cookie, mais un User-Agent complètement différent (incohérence)
+        $nextContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => [
+                'user-agent' => 'DefinitelyNotTheSameBrowser/1.0',
+                'accept-language' => 'fr-FR',
+            ]
+        ]);
+
+        $decision = $this->engine->processRequest($nextContext);
+
+        // Le score d'incohérence devrait être de 100
+        $this->assertEquals(100, $decision['vector']['inconsistencyScore']);
+        // L'action devrait être un challenge ou un blocage
+        $this->assertContains($decision['action'], ['challenge', 'block']);
+    }
+
+    public function testAllowsWhitelistedIp(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext(['clientIp' => '10.0.0.1']);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('next', $decision['action']);
+        $this->assertEquals(0, $decision['score']);
+    }
+    public function testFingerprintBuilderCompareLogic(): void
+    {
+        $fp1 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
+        $fp2 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
+        $fp3 = (new FingerprintBuilder())->add('hw', '4_8')->add('gpu', 'amd')->__toString(); // hw:1039882088834313|gpu:14339535343484648
+        $fp4 = (new FingerprintBuilder())->add('hw', '8_16')->add('os', 'win32')->__toString(); // hw:1039882088834313|os:14339535343484648
+
+        $this->assertEquals(1.0, FingerprintBuilder::compare($fp1, $fp2), "Identical FPs should return 1.0");
+        $this->assertLessThan(0.5, FingerprintBuilder::compare($fp1, $fp3), "Different FPs should have low similarity");
+
+        // The partial match score calculation reflects the current weights in FingerprintBuilder.
+        // Matching keys: 'hw' (weight 1.5).
+        // All relevant keys considered from both fingerprints: 'hw' (1.5), 'gpu' (4.0), 'os' (0.8).
+        // Total weight = 1.5 + 4.0 + 0.8 = 6.3.
+        // Score = 1.5 / 6.3 = ~0.238095... (This logic is correct, the test is fine)
+        $this->assertEqualsWithDelta(0.238, FingerprintBuilder::compare($fp1, $fp4), 0.001, "Partial match score should reflect current weights"); // This test is correct, no change needed.
+    }
+
+    /**
+     * @dataProvider clientHintsInconsistencyProvider
+     * @param array<string, string> $headers Les en-têtes à tester.
+     * @param float $expectedScore Le score attendu.
+     * @param string $message Le message de test.
+     */
+    public function testDetectsClientHintsInconsistency(array $headers, float $expectedScore, string $message): void
+    {
+        // Le test nécessite un deviceId, donc on simule une première visite.
+        // Les en-têtes de la première visite n'ont pas d'importance ici.
+        $firstDecision = $this->engine->processRequest($this->createRequestContext());
+        $deviceIdCookie = $firstDecision['newCookieForResponse'] ?? null;
+        $this->assertNotNull($deviceIdCookie, "Un cookie deviceId aurait dû être créé.");
+
+        // On simule la visite suivante avec les en-têtes à tester.
+        $testContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => $headers,
+        ]);
+
+        $decision = $this->engine->processRequest($testContext);
+        $this->assertEquals($expectedScore, $decision['vector']['clientHintsInconsistencyScore'], $message);
+    }
+
+    /**
+     * Fournisseur de données pour le test d'incohérence des Client Hints.
+     * @return array<string, array{0: array<string, string>, 1: float, 2: string}>
+     */
+    public function clientHintsInconsistencyProvider(): array
+    {
+        $baseHeaders = ['accept-language' => 'en-US,en;q=0.9'];
+
+        return [
+            'no inconsistency' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                0.0,
+                'Should return 0 for consistent headers.'
+            ],
+            'large version mismatch' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                80.0,
+                'Should return 80 for a large version mismatch (>5).'
+            ],
+            'small version mismatch' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                40.0,
+                'Should return 40 for a small version mismatch (>1).'
+            ],
+            'browser mismatch' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                90.0,
+                'Should return 90 for a browser mismatch (Firefox vs Chrome).'
+            ],
+            'missing client hints header' => [
+                ['user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0'],
+                0.0,
+                'Should return 0 if sec-ch-ua header is missing.'
+            ],
+            'malformed client hints' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0',
+                    'sec-ch-ua' => '"SomeOtherBrowser";v="abc"',
+                ]),
+                0.0,
+                'Should return 0 if headers are malformed or unparsable.'
+            ],
+        ];
+    }
+}

package/src/php/Tests/IpReputationTest.php

@@ -0,0 +1,157 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use PHPUnit\Framework\TestCase;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Store\IStore;
+use Anonympins\Fingerprint\RequestContext;
+
+class IpReputationTest extends TestCase
+{
+    private $store;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        // Un mock anonyme simple et en mémoire du Store pour isoler les tests
+        $this->store = new class implements IStore {
+            private array $data = [];
+            public function get(string $key) { return $this->data[$key] ?? null; }
+            public function set(string $key, $value, ?int $ttl = null): void { $this->data[$key] = $value; }
+            public function has(string $key): bool { return isset($this->data[$key]); }
+            public function delete(string $key): void { unset($this->data[$key]); }
+        };
+
+        StoreManager::setStore($this->store);
+    }
+
+    public function testGetScoreReturnsZeroForUnknownIp(): void
+    {
+        $score = RequestUtils::getIpReputationScore('8.8.8.8');
+        $this->assertEquals(0.0, $score);
+    }
+
+    public function testUpdateScoreChangesValueCorrectly(): void
+    {
+        $ip = '8.8.4.4';
+        RequestUtils::updateIpReputationScore($ip, 45.0);
+        $this->assertEquals(45.0, RequestUtils::getIpReputationScore($ip));
+
+        RequestUtils::updateIpReputationScore($ip, -15.0);
+        $this->assertEquals(30.0, RequestUtils::getIpReputationScore($ip));
+    }
+
+    public function testBoundsAreClampedBetween0And100(): void
+    {
+        $ip = '1.1.1.1';
+        RequestUtils::updateIpReputationScore($ip, 120.0);
+        $this->assertEquals(100.0, RequestUtils::getIpReputationScore($ip));
+
+        RequestUtils::updateIpReputationScore($ip, -150.0);
+        $this->assertEquals(0.0, RequestUtils::getIpReputationScore($ip));
+    }
+
+    public function testTimeDecayCalculatesLossOfTwoPointsPerHour(): void
+    {
+        $ip = '2.2.2.2';
+        $now = time();
+
+        // Simulation d'un score de 80 vieux de 4 heures (4 * 2 = 8 points de perte)
+        $this->store->set("ip-reputation:{$ip}", [
+            'score' => 80.0,
+            'lastUpdate' => $now - 14400
+        ]);
+
+        $score = RequestUtils::getIpReputationScore($ip);
+        $this->assertEquals(72.0, $score);
+    }
+
+    public function testIpReputationScoreIsIntegratedIntoFinalScore(): void
+    {
+        $ip = '1.2.3.4';
+        RequestUtils::updateIpReputationScore($ip, 60.0);
+
+        $weights = [
+            'ipReputationScore' => 0.5,
+            'historyScore' => 0.0,
+            'rotationScore' => 0.0,
+            'headerAnomalyScore' => 0.0,
+            'requestPatternScore' => 0.0,
+            'inconsistencyScore' => 0.0,
+            'honeypotScore' => 0.0,
+            'behaviorScore' => 0.0,
+            'botScore' => 0.0,
+            'crossLayerInconsistencyScore' => 0.0,
+            'tlsSpoofingScore' => 0.0,
+            'timeInconsistencyScore' => 0.0,
+            'clickVarianceScore' => 0.0,
+            'clientHintsInconsistencyScore' => 0.0,
+            'subnetScore' => 0.0,
+        ];
+
+        $ipRepScore = RequestUtils::getIpReputationScore($ip);
+        $this->assertEquals(60.0, $ipRepScore);
+        $score = $ipRepScore * $weights['ipReputationScore'];
+        $this->assertEquals(30.0, $score);
+    }
+
+    public function testGetIpSubnetIpv4AndIpv6(): void
+    {
+        $ipv4Subnet = RequestUtils::getIpSubnet('192.168.1.50', 24, 48);
+        $this->assertEquals('192.168.1.0/24', $ipv4Subnet);
+
+        $ipv6Subnet = RequestUtils::getIpSubnet('2001:db8:abcd:0012::1', 24, 48);
+        $this->assertEquals('2001:db8:abcd::/48', $ipv6Subnet);
+    }
+
+    public function testGetClientHintsInconsistencyScoreMismatch(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/117.0';
+            }
+            if ($name === 'sec-ch-ua') {
+                return '"Google Chrome";v="117"';
+            }
+            return null;
+        });
+
+        $score = RequestUtils::getClientHintsInconsistencyScore($context);
+        $this->assertEquals(90.0, $score['clientHintsInconsistencyScore']);
+    }
+
+    public function testGetSubnetScoreCalculations(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->clientIp = '192.168.1.50';
+
+        $score = RequestUtils::getSubnetScore($context, 'device-1');
+        $this->assertEquals(0.0, $score['subnetScore']);
+
+        for ($i = 1; $i <= 12; $i++) {
+            RequestUtils::updateSubnetMetrics($context, "device-{$i}", 30.0);
+        }
+
+        $scoreWithHistory = RequestUtils::getSubnetScore($context, 'device-1');
+        $this->assertGreaterThan(0.0, $scoreWithHistory['subnetScore']);
+    }
+
+    public function testTlsSpoofingScoreWithJa4(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->ja4 = 't13d1517h2_8daaf61527d5';
+        $context->ja3 = null;
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            return $name === 'user-agent' ? 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/117.0' : null;
+        });
+
+        $score = RequestUtils::getTlsSpoofingScore($context);
+        $this->assertEquals(90.0, $score['tlsSpoofingScore']);
+    }
+}

package/src/php/Tests/PowTest.php

@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use PHPUnit\Framework\TestCase;
+use Anonympins\Fingerprint\FingerprintEngine;
+use Anonympins\Fingerprint\ProblemManager;
+use Anonympins\Fingerprint\Store\InMemoryStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Config\SecurityProfiles;
+
+class PowTest extends TestCase
+{
+    private FingerprintEngine $engine;
+
+    protected function setUp(): void
+    {
+        // 1. Configurer un store en mémoire pour l'isolation des tests.
+        $store = new InMemoryStore();
+        StoreManager::configureStore($store);
+
+        // 2. Initialiser le ProblemManager avec une configuration et un store valides.
+        // C'est l'étape cruciale qui manquait.
+        $configPath = dirname(__FILE__) . '/problems.config.json';
+        ProblemManager::getInstance($configPath, $store);
+
+        // 3. Créer l'instance du moteur.
+        $this->engine = new FingerprintEngine(SecurityProfiles::createSecurityProfile('balanced'));
+    }
+
+    public function testGetProblemsIsExposedForTesting(): void
+    {
+        // Cette méthode appelle ProblemManager::getInstance() en interne.
+        // Grâce au setUp(), l'instance est déjà initialisée et le test passe.
+        $problems = $this->engine->getProblems();
+        $this->assertIsArray($problems);
+    }
+}