@anonympins/fingerprint 0.3.5 → 0.3.7

package/src/js/fingerprint.js

@@ -1,12 +1,13 @@
 import crypto from "node:crypto";
-import { BlockList, isIPv4, isIPv6 } from "node:net";
+import {BlockList, isIPv4, isIPv6} from "node:net";
 import * as dns from "node:dns/promises";
-import { getProblemManager, problemManager } from "./problem-manager.js";
-import { Optimization } from "./library.js";
-import { cyrb53, FingerprintBuilder } from "./fingerprint.builder.js";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
+import {getProblemManager, problemManager} from "./problem-manager.js";
+import {Optimization} from "./library.js";
+import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
+import {readFileSync} from "node:fs";
+import {fileURLToPath} from "node:url";
+import {dirname, join} from "node:path";
+
 export { createRedisStore } from "./redis-store.js";
 export { createMongoDbStore } from "./mongodb-store.js";
 
@@ -769,6 +770,8 @@ export const verifyPoWAndGenerateTicket = (
   nonce,
   solution,
   difficulty = 4,
+  deviceId = '',
+  deviceHash = ''
 ) => {
   // 1. Verify the solution: hash(ip + nonce + solution) must start with N zeros
   const hash = crypto
@@ -784,10 +787,10 @@ export const verifyPoWAndGenerateTicket = (
   const expiry = Date.now() + 3600000; // 1 heure
   const signature = crypto
     .createHmac("sha256", getPowSecret())
-    .update(`${ip}:${expiry}`)
+    .update(`${expiry}:${ip}:${deviceId}:${deviceHash}`)
     .digest("hex");
 
-  return `${expiry}:${signature}`;
+  return `${expiry}|${ip}|${signature}`;
 };
 
 
@@ -822,23 +825,61 @@ export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret =
   }
   return finalHash === parseInt(solution, 10);
 };
-export const isTicketValid = (ip, ticket) => {
+export const isTicketValid = (ip, ticket, deviceId = '', deviceHash = '') => {
   // Input validation: ensure the ticket is a non-empty string with the correct format.
-  if (typeof ticket !== 'string' || !ticket.includes(':')) return false;
-  const [expiry, sig] = ticket.split(':');
+  if (typeof ticket !== 'string') return false;
+
+  let expiry, originalIp, sig;
+  if (ticket.includes('|')) {
+    const parts = ticket.split('|');
+    if (parts.length < 3) return false;
+    [expiry, originalIp, sig] = parts;
+  } else if (ticket.includes(':')) {
+    // Legacy fallback format
+    const parts = ticket.split(':');
+    if (parts.length < 2) return false;
+    [expiry, sig] = parts;
+    originalIp = ip;
+  } else {
+    return false;
+  }
+
   if (!expiry || !sig || Date.now() > parseInt(expiry, 10)) return false;
-  const expectedSig = crypto
-    .createHmac("sha256", getPowSecret())
-    .update(`${ip}:${expiry}`)
-    .digest("hex");
+
+  let expectedSig;
+  if (ticket.includes('|')) {
+    expectedSig = crypto
+      .createHmac("sha256", getPowSecret())
+      .update(`${expiry}:${originalIp}:${deviceId}:${deviceHash}`)
+      .digest("hex");
+  } else {
+    // Legacy expected signature
+    expectedSig = crypto
+      .createHmac("sha256", getPowSecret())
+      .update(`${ip}:${expiry}`)
+      .digest("hex");
+  }
 
   // Use timingSafeEqual to prevent timing attacks
   try {
-    return crypto.timingSafeEqual(Buffer.from(sig, 'hex'), Buffer.from(expectedSig, 'hex'));
+    const isSigValid = crypto.timingSafeEqual(Buffer.from(sig, 'hex'), Buffer.from(expectedSig, 'hex'));
+    if (!isSigValid) return false;
   } catch (e) {
-    // This can happen if the buffers have different lengths, which is a failure case.
     return false;
   }
+
+  if (!ticket.includes('|')) {
+    return ip === originalIp;
+  }
+
+  // Roaming & Terminal Identity checks:
+  if (ip === originalIp) return true;
+  const currentSubnet = getIpSubnet(ip);
+  const originalSubnet = getIpSubnet(originalIp);
+  if (currentSubnet && originalSubnet && currentSubnet === originalSubnet) return true;
+
+  // Perfect terminal identity matched via HMAC signature
+  return !!(deviceId && deviceHash);
 };
 
 
@@ -1778,6 +1819,22 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
         }
     }
 
+    // Détection d'énumération de chemins (crawling/scraping de ressources séquentielles)
+    let enumerationScore = 0;
+    if (history.length >= 3) {
+        const templates = history.map(h => h.path.replace(/\d+/g, '{num}'));
+        const uniquePaths = new Set(history.map(h => h.path));
+
+        const templateCounts = {};
+        templates.forEach(t => templateCounts[t] = (templateCounts[t] || 0) + 1);
+
+        const maxTemplateRepetition = Math.max(...Object.values(templateCounts), 0);
+        // Si une même structure de route est répétée mais sur des URLs réelles différentes
+        if (maxTemplateRepetition >= 3 && uniquePaths.size === history.length) {
+            enumerationScore = patternWeight * 0.8; // Appliquer une forte pénalité
+        }
+    }
+
     // Garder l'historique à une taille raisonnable
     if (history.length > historySize) {
         history.shift();
@@ -1796,7 +1853,7 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
     }
     newPatternScore = Math.max(0, newPatternScore);
 
-    deviceData.lastPatternScore = newPatternScore + instantScore;
+    deviceData.lastPatternScore = newPatternScore + instantScore + enumerationScore;
 
     return { requestPatternScore: Math.min(100, deviceData.lastPatternScore) };
 }
@@ -2341,6 +2398,8 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   nonce,
   solution,
   challengeContext = {}, // Le contexte complet du challenge est maintenant passé
+  deviceId = '',
+  deviceHash = ''
 ) {
   const { cpuTarget, baseBlock } = challengeContext;
   if (!cpuTarget || !baseBlock) {
@@ -2392,9 +2451,9 @@ export function verifyCpuTargetPoWAndGenerateTicket(
       const expiry = Date.now() + (ticketTtl || 3600000); // Calcule l'expiration à partir du TTL
       const signature = crypto
       .createHmac("sha256", getPowSecret())
-      .update(`${clientIp}:${expiry}`)
+      .update(`${expiry}:${clientIp}:${deviceId}:${deviceHash}`)
       .digest("hex");
-    return `${expiry}:${signature}`;
+    return `${expiry}|${clientIp}|${signature}`;
   }
 
   return null;
@@ -2474,7 +2533,7 @@ export class FingerprintEngine {
       console.log(`[FingerprintEngine] ${message}`, data);
     }
   }
-    calculateFinalScore = function(suspicionVector) {
+    calculateFinalScore(suspicionVector) {
         const { weights } = this.securityConfig;
         if (!weights) return 0;
 
@@ -2760,6 +2819,11 @@ export class FingerprintEngine {
       return { action: 'next', score: 0, vector: {} };
     }
 
+    // Resolve identity and check for persisted "condemned" status early.
+    const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
+    const currentDeviceHash = getCompositeDeviceHash(requestContext);
+    const isNewDevice = !!newCookie;
+
     // 1. Check static IP allowlist first for maximum performance.
     if (this._isIpInAllowlist(clientIp)) {
       this._log('IP in allowlist - allowing request', { clientIp });
@@ -2798,7 +2862,7 @@ export class FingerprintEngine {
     // If we see a pow_nonce on a request that isn't (yet) considered suspicious, it's a bot probe.
     if (pow_nonce) {
         const powCookie = cookies?.pow_clearance;
-        if (!isTicketValid(clientIp, powCookie)) { // Only check if there's no valid ticket
+        if (!isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash)) { // Only check if there's no valid ticket
             // This is a potential probe. We'll let the main logic confirm if it's not a legitimate challenge response.
             // The final decision is made later, after calculating the score.
         }
@@ -2810,10 +2874,6 @@ export class FingerprintEngine {
       return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'bot' } };
     }
     
-    // Resolve identity and check for persisted "condemned" status early.
-    const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
-    const isNewDevice = !!newCookie;
-    
     this._log('Identity resolved', { deviceId, isNewDevice, hasDeviceData: !!deviceData });
 
     if (deviceData?.condemned) {
@@ -2908,7 +2968,26 @@ export class FingerprintEngine {
         });
 
         let isValid = false;
-        const challengeContext = await store.get(`secret:${pow_nonce}`);
+            let challengeContext = await store.get(`secret:${pow_nonce}`);
+
+            // SECURITY: Verify that the retrieved context has not been tampered with
+            if (challengeContext && challengeContext.signature) {
+                const payloadToSign = `${challengeContext.clientSecret}:${challengeContext.cpuTarget}:${challengeContext.fingerprint}:${challengeContext.memDifficulty}:${challengeContext.originalPath}:${clientIp}`;
+                const expectedSignature = crypto.createHmac("sha256", getPowSecret()).update(payloadToSign).digest("hex");
+                try {
+                    const isSignatureValid = crypto.timingSafeEqual(
+                        Buffer.from(challengeContext.signature, 'hex'),
+                        Buffer.from(expectedSignature, 'hex')
+                    );
+                    if (!isSignatureValid) {
+                        this._log('Challenge context signature invalid - storage tampering detected!', { nonce: pow_nonce });
+                        challengeContext = null; // Invalidate context immediately
+                    }
+                } catch (e) {
+                    this._log('Error validating challenge context signature:', e);
+                    challengeContext = null;
+                }
+            }
         let ticket = null;
         // Déclarer optimalTtl ici avec une valeur par défaut
         let optimalTtl = this.securityConfig.ticketMaxAge || 3600000;
@@ -2957,11 +3036,12 @@ export class FingerprintEngine {
 
                 if ((pow_type === "cpu_target" || !pow_type) && (pow_solution_cpu || pow_solution)) { // !pow_type pour compatibilité
                     const cpuSolution = pow_solution_cpu || pow_solution;
-            ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext);
+                    ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, cpuSolution, challengeContext, deviceId, currentDeviceHash);
                     isValid = ticket !== null;
                     this._log('CPU target challenge verification', { isValid });
-                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext);
-            const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
+                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
+                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext, deviceId, currentDeviceHash);
+                    const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret); // Memory PoW is independent of fingerprint
                     isValid = cpuTicket !== null && isMemValid;
                     if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
                     this._log('Combined CPU+Memory challenge verification', {
@@ -3087,7 +3167,10 @@ export class FingerprintEngine {
         if (challengeContext) {
             try {
                 const workResult = JSON.parse(pow_solution_work_result);
-                getProblemManager(this.securityConfig.usefulWorkConfigPath).integrateSolution(pow_problem_id, workResult);
+                getProblemManager({
+                    configPath: this.securityConfig.usefulWorkConfigPath,
+                    config: this.securityConfig.usefulWorkConfig
+                }, store).integrateSolution(pow_problem_id, workResult);
 
                 await store.delete(`secret:${pow_nonce}`);
                 // Accorder un ticket de passage comme pour un PoW normal
@@ -3153,7 +3236,7 @@ export class FingerprintEngine {
     // 1. La requête est suspecte ET il n'y a pas de ticket valide.
     // OU
     // 2. La requête est *très* suspecte (dépasse le seuil 'high'), ce qui annule la validité du ticket actuel.
-    const hasValidTicket = isTicketValid(clientIp, powCookie);
+    const hasValidTicket = isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash);
     const mustReChallenge = isSuspiciousHigh && hasValidTicket;
 
     if (isSuspicious && (!hasValidTicket || mustReChallenge)) {
@@ -3197,7 +3280,10 @@ export class FingerprintEngine {
         if (isSuspicious && shouldUseUsefulWork) {
             this._log('Issuing a useful work challenge', { finalScore });
 
-            const { problemId, task } = getProblemManager(this.securityConfig.usefulWorkConfigPath).dispatchWork(suspicionFactor);
+            const { problemId, task } = getProblemManager({
+                configPath: this.securityConfig.usefulWorkConfigPath,
+                config: this.securityConfig.usefulWorkConfig
+            }, store).dispatchWork(suspicionFactor);
 
             await store.set(`secret:${nonce}`, { clientSecret, originalPath: path }, 300);
 
@@ -3245,6 +3331,11 @@ export class FingerprintEngine {
 
             // Store the entire challenge context with a short TTL (e.g., 5 minutes)
             const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, originalFingerprint);
+
+            // SECURITY: Cryptographically sign the payload before storing it to prevent database tampering
+            const payloadToSign = `${clientSecret}:${cpuChallengeDetails.target}:${originalFingerprint}:${memDifficulty}:${path}:${clientIp}`;
+            const signature = crypto.createHmac("sha256", getPowSecret()).update(payloadToSign).digest("hex");
+
             await store.set(`secret:${nonce}`, {
                 clientSecret,
                 cpuTarget: cpuChallengeDetails.target,
@@ -3253,6 +3344,7 @@ export class FingerprintEngine {
                 memDifficulty: memDifficulty,
                 baseBlock: baseBlock, // *** NOUVEAU: Le bloc de base est stocké pour la vérification ***
                 originalPath: path, // *** FIX: Store the original path ***
+                signature, // *** NOUVEAU: Cryptographic signature to prevent storage tampering ***
             }, this.securityConfig.challengeTtl || 300); // NOUVEAU: TTL configurable (5min par défaut)
 
             // Associate the current challenge nonce with the device for trap URL verification later.
@@ -3302,7 +3394,7 @@ export class FingerprintEngine {
     }
 
     // Basic log for each non-static request that passed without a challenge
-    this._log('Request passed - no challenge required', { finalScore, hasValidTicket: isTicketValid(clientIp, powCookie) });
+    this._log('Request passed - no challenge required', { finalScore, hasValidTicket: isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash) });
     
     if (logger) {
         logger({ type: 'request_passed', deviceId: cookies?.device_id, score: finalScore, timestamp: Date.now(), vector: suspicionVector });
@@ -3365,68 +3457,123 @@ const staticExtensions = new RegExp(
 const isStaticResource = (path) => staticExtensions.test(path);
 
 
+/** @type {Map<number, number>} Cache des TTL optimisés par score de suspicion (clés de 0 à 100 par pas de 10) */
+let optimizedTtlCache = new Map();
+
 /**
- * Détermine le TTL optimal pour un ticket en utilisant un algorithme génétique multi-objectifs.
- * @param {number} suspicionScore - Le score de suspicion de la requête.
- * @returns {number} Le TTL optimal calculé en millisecondes.
-*/
-function determineOptimalTicketTtl(suspicionScore) {
-    // Définir les bornes pour la durée de vie du ticket (5 minutes à 24 heures)
+ * Exécute l'optimisation des TTL en tâche de fond de manière asynchrone et non-bloquante.
+ * Utilise l'algorithme génétique multi-objectifs de Pareto pour trouver des solutions stables.
+ */
+export async function runBackgroundTtlOptimization() {
     const MIN_TTL = 300000;
     const MAX_TTL = 86400000;
+    const tempCache = new Map();
+    const keyScores = [0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100];
+
+    for (const suspicionScore of keyScores) {
+        // Rend la main à la boucle d'événements Node.js à chaque itération pour ne pas bloquer les requêtes web actives
+        await new Promise(resolve => {
+            if (typeof setImmediate === 'function') {
+                setImmediate(resolve);
+            } else {
+                setTimeout(resolve, 0);
+            }
+        });
 
-    const solverFunction = () => {
-        const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+        const solverFunction = () => {
+            const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+            const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
+            const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
+            const mutate = (ttl) => {
+                const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1;
+                return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
+            };
 
-        // Un "individu" est simplement une valeur de TTL en millisecondes.
-        const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
-        const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
-        const mutate = (ttl) => {
-            const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1; // Mutation de +/- 10% max
-            return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
-        };
+            const paretoFront = Optimization.geneticAlgorithmMultiObjective(
+                createIndividual,
+                fitnessFunction,
+                crossover,
+                mutate,
+                {
+                    generations: 40,
+                    populationSize: 30,
+                }
+            );
 
-        const paretoFront = Optimization.geneticAlgorithmMultiObjective(
-            createIndividual,
-            fitnessFunction,
-            crossover,
-            mutate,
-            {
-                generations: 40,
-                populationSize: 30,
+            if (!paretoFront || paretoFront.length === 0) {
+                return { solution: null, fitness: Infinity };
             }
-        );
 
-        // Pour runMultiple, on doit retourner un objet avec une propriété "fitness" ou "energy".
-        // Pour un front de Pareto, il n'y a pas de score unique. On choisit la meilleure solution
-        // en fonction du score de suspicion et on lui assigne un score de 0 pour que runMultiple la sélectionne.
-        if (!paretoFront || paretoFront.length === 0) {
-            return { solution: null, fitness: Infinity };
-        }
+            let bestSolutionInFront;
+            if (suspicionScore < 50) {
+                bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+            } else {
+                bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+            }
+            return { solution: bestSolutionInFront, fitness: 0 };
+        };
 
-        // Stratégie de sélection :
-        // Pour un score faible (< 50), on privilégie la solution avec le plus grand TTL (minimise la friction).
-        // Pour un score élevé (>= 50), on privilégie la solution avec le plus petit TTL (minimise le risque).
-        let bestSolutionInFront;
-        if (suspicionScore < 50) {
-            bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+        const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+        if (bestResult && bestResult.solution && bestResult.solution !== Infinity) {
+            tempCache.set(suspicionScore, Math.round(bestResult.solution));
         } else {
-            bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+            tempCache.set(suspicionScore, Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL));
         }
-        return { solution: bestSolutionInFront, fitness: 0 }; // fitness=0 car on a déjà la meilleure solution du cycle.
-    };
+    }
+
+    optimizedTtlCache = tempCache;
+}
+
+// Lancement de l'optimisation initiale immédiate en arrière-plan
+runBackgroundTtlOptimization().catch(err => {
+    console.error('[Fingerprint] Error in background TTL optimization:', err);
+});
 
-    // On exécute le solveur 20 fois pour trouver une solution plus stable et robuste.
-    const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+// Planification périodique toutes les 30 minutes sans bloquer la fermeture du processus Node.js (via unref)
+const ttlInterval = setInterval(() => {
+    runBackgroundTtlOptimization().catch(err => {
+        console.error('[Fingerprint] Error in background TTL optimization:', err);
+    });
+}, 1800000);
+if (ttlInterval && typeof ttlInterval.unref === 'function') {
+    ttlInterval.unref();
+}
+
+/**
+ * Détermine le TTL optimal pour un ticket.
+ * Utilise les valeurs pré-calculées de la tâche d'optimisation en arrière-plan et effectue
+ * une interpolation linéaire instantanée pour le score requis.
+ *
+ * @param {number} suspicionScore - Le score de suspicion de la requête.
+ * @returns {number} Le TTL optimal calculé en millisecondes.
+ */
+function determineOptimalTicketTtl(suspicionScore) {
+    const MIN_TTL = 300000;
+    const MAX_TTL = 86400000;
+    const score = Math.max(0, Math.min(100, suspicionScore));
+
+    if (!optimizedTtlCache || optimizedTtlCache.size === 0) {
+        // Formule mathématique instantanée de secours si le cache de fond n'est pas encore prêt
+        return Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
+    }
+
+    const lowerKey = Math.floor(score / 10) * 10;
+    const upperKey = Math.ceil(score / 10) * 10;
+
+    const lowerTtl = optimizedTtlCache.get(lowerKey);
+    const upperTtl = optimizedTtlCache.get(upperKey);
 
-    if (!bestResult || !bestResult.solution || bestResult.solution === Infinity) {
-        // Fallback : si l'algo ne retourne rien, on applique une règle simple et sûre.
-        return Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL);
+    if (lowerTtl === undefined || upperTtl === undefined) {
+        return Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
     }
 
-    // runMultiple choisit le meilleur résultat sur la base du score (ici, 0).
-    // La "meilleure" solution dépendra du cycle qui a trouvé le meilleur compromis.
-    return Math.round(bestResult.solution);
+    if (lowerKey === upperKey) {
+        return lowerTtl;
+    }
+
+    // Interpolation linéaire entre les deux points clés optimisés du front de Pareto
+    const fraction = (score - lowerKey) / (upperKey - lowerKey);
+    return Math.round(lowerTtl + fraction * (upperTtl - lowerTtl));
 }
 
 /**
@@ -3744,6 +3891,7 @@ export const __internal = {
     FingerprintBuilder, // Export for testing
     calculateTarget,
     determineOptimalTicketTtl,
+    runBackgroundTtlOptimization,
     getRequestPatternScore, // Expose for testing
     getBehaviorScore, // Expose for testing
     getCrossLayerInconsistency, // Expose for testing
@@ -3751,6 +3899,7 @@ export const __internal = {
     getTimeInconsistencyScore,
     getClickVarianceScore, // NOUVEAU: Expose pour les tests
     getTlsFingerprint, // NOUVEAU: Expose pour les tests
+    sanitizeTrafficData, // NOUVEAU: Expose pour l'auto-tuner/tests
     getTlsSpoofingScore, // NOUVEAU: Expose pour les tests
     parseJa3,
     generateCpuTargetChallengePage,
@@ -3762,6 +3911,7 @@ export const __internal = {
     getSubnetScore, // Expose for testing
     getIpReputationScore, // Expose for testing
     updateIpReputationScore, // Expose for testing
+    setLastBestSolution: (val) => { lastBestSolution = val; }, // Expose to test auto-tuning metrics
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---
@@ -3769,25 +3919,60 @@ export const __internal = {
 let autoTuningJobId = null;
 let lastBestSolution = null; // NOUVEAU: Stocke la meilleure solution trouvée
 
+/**
+ * Assainit les données de trafic pour l'auto-tuner afin de prévenir les attaques par empoisonnement.
+ * Limite la contribution de chaque deviceId à un pourcentage maximum (ex: 2%) du jeu de données total.
+ * @export
+ * @param {Array<object>} trafficData
+ * @returns {Array<object>}
+ */
+export function sanitizeTrafficData(trafficData) {
+  if (!trafficData || trafficData.length === 0) {
+    return [];
+  }
+  const tempSanitized = [];
+  const deviceCounts = new Map();
+  const maxLogsPerDevice = Math.max(3, Math.floor(trafficData.length * 0.02)); // Max 2% contribution per device
+
+  for (const log of trafficData) {
+    const devId = log.deviceId || 'anonymous';
+    const currentCount = deviceCounts.get(devId) || 0;
+    if (currentCount < maxLogsPerDevice) {
+      deviceCounts.set(devId, currentCount + 1);
+      tempSanitized.push(log);
+    }
+  }
+
+  const passedLogs = tempSanitized.filter(log => log.type === 'request_passed');
+  const suspiciousLogs = tempSanitized.filter(log => log.type !== 'request_passed');
+
+  const minDataPoints = 200; // Seuil par défaut
+  const maxPassedAllowed = Math.max(minDataPoints, suspiciousLogs.length * 9);
+  const shuffledPassed = passedLogs.sort(() => 0.5 - Math.random());
+  const selectedPassed = shuffledPassed.slice(0, maxPassedAllowed);
+
+  return [...suspiciousLogs, ...selectedPassed];
+}
+
 /**
  * Executes a threshold optimization pass using collected traffic data.
  * @private
- * @param {object} securityConfig - The security configuration object to update.
- * @param {Array<object>} trafficData - The array containing traffic logs.
- * @param {number} minDataPoints - The minimum number of data points required to start optimization.
- * @param {number} maxDataPoints - The maximum number of data points to keep after an optimization cycle.
- * @param {string} [savePath] - Optional path to save the best configuration to a file.
  */
 function runThresholdOptimization(securityConfig, trafficData, minDataPoints, maxDataPoints, savePath) {
-  const highConfidenceLogs = trafficData.filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered').length;
-  const highConfidenceRatio = trafficData.length > 0 ? highConfidenceLogs / trafficData.length : 0;
+  const sanitizedData = sanitizeTrafficData(trafficData);
+
+  const highConfidenceLogs = sanitizedData.filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered').length;
+  const highConfidenceRatio = sanitizedData.length > 0 ? highConfidenceLogs / sanitizedData.length : 0;
   const MIN_CONFIDENCE_RATIO = 0.05; // Exiger au moins 5% de signaux forts.
+  const MIN_HIGH_CONFIDENCE_COUNT = 10; // Absolu de secours pour éviter le gel lors de floods
+
+  const hasEnoughSignal = highConfidenceRatio >= MIN_CONFIDENCE_RATIO || highConfidenceLogs >= MIN_HIGH_CONFIDENCE_COUNT;
 
-  if (trafficData.length < minDataPoints || highConfidenceRatio < MIN_CONFIDENCE_RATIO) {
-    if (trafficData.length < minDataPoints) {
-    console.log(`[AutoTuning] Reporté : ${trafficData.length}/${minDataPoints} points de données.`);
+  if (sanitizedData.length < minDataPoints || !hasEnoughSignal) {
+    if (sanitizedData.length < minDataPoints) {
+    console.log(`[AutoTuning] Reporté : ${sanitizedData.length}/${minDataPoints} points de données.`);
     } else {
-      console.log(`[AutoTuning] Reporté : Ratio de confiance insuffisant (${(highConfidenceRatio * 100).toFixed(2)}% < ${(MIN_CONFIDENCE_RATIO * 100).toFixed(2)}%).`);
+      console.log(`[AutoTuning] Reporté : Signaux de confiance insuffisants (Ratio: ${(highConfidenceRatio * 100).toFixed(2)}% < ${(MIN_CONFIDENCE_RATIO * 100).toFixed(2)}% et absolu: ${highConfidenceLogs} < ${MIN_HIGH_CONFIDENCE_COUNT}).`);
     }
     return;
   }
@@ -3797,9 +3982,9 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
     trafficData.splice(0, trafficData.length - maxDataPoints);
   }
 
-  console.log(`[AutoTuning] Démarrage du cycle d'optimisation complet avec ${trafficData.length} points de données.`);
+  console.log(`[AutoTuning] Démarrage du cycle d'optimisation complet avec ${sanitizedData.length} points de données assainis.`);
 
-  const paretoFront = Optimization.Operators.solveFullSecurityTuning({ trafficData });
+  const paretoFront = Optimization.Operators.solveFullSecurityTuning({ trafficData: sanitizedData });
 
   if (!paretoFront || paretoFront.length === 0) {
     console.warn("[AutoTuning] L'optimisation n'a retourné aucune solution.");
@@ -3944,3 +4129,93 @@ export function stopThresholdAutoTuning() {
 export function getBestTuningSolution() {
     return lastBestSolution;
 }
+
+class RequestContext {
+  constructor(ip, path, headers, query, body, cookies, httpVersion) {
+    this.clientIp = ip || '127.0.0.1';
+    this.path = path || '/';
+    this.headers = headers || {};
+    this.query = query || {};
+    this.body = body || null;
+    this.cookies = cookies || {};
+    this.httpVersion = httpVersion || '1.1';
+  }
+}
+
+const MetricsManager = {
+  getPrometheusMetrics(securityConfig = {}) {
+    let metrics = `# HELP fingerprint_requests_total Total requests processed.\n# TYPE fingerprint_requests_total counter\nfingerprint_requests_total{status="passed"} 1\n`;
+
+    if (securityConfig.weights) {
+      metrics += `\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n# TYPE fingerprint_security_weight gauge\n`;
+      for (const [indicator, weight] of Object.entries(securityConfig.weights)) {
+        if (typeof weight === 'number') {
+          metrics += `fingerprint_security_weight{indicator="${indicator}"} ${weight}\n`;
+        }
+      }
+    }
+
+    if (securityConfig.thresholds) {
+      metrics += `\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n# TYPE fingerprint_security_threshold gauge\n`;
+      for (const [level, threshold] of Object.entries(securityConfig.thresholds)) {
+        if (typeof threshold === 'number') {
+          metrics += `fingerprint_security_threshold{level="${level}"} ${threshold}\n`;
+        }
+      }
+    }
+
+    // Include auto-tuning objectives metrics if the auto-tuner has run
+    if (lastBestSolution && lastBestSolution.objectives) {
+      metrics += `\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate ${lastBestSolution.objectives[0]}\n`;
+      metrics += `\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate ${lastBestSolution.objectives[1]}\n`;
+    }
+
+    return metrics;
+  }
+};
+
+/**
+ * Gère une requête vers le point de terminaison /metrics, en appliquant les règles d'autorisation.
+ * Si les métriques sont activées et autorisées, elle renvoie les métriques au format Prometheus.
+ * Sinon, elle gère l'accès non autorisé ou renvoie un 404 si les métriques ne sont pas activées.
+ *
+ * @param {object} req L'objet requête Express.
+ * @param {object} res L'objet réponse Express.
+ * @param {object} securityConfig La configuration de sécurité.
+ */
+export async function handleMetricsRequest(req, res, securityConfig) {
+    // 2. Appliquer le callback d'autorisation personnalisé si défini.
+    const authorizationCallback = securityConfig.metricsAuthorizationCallback;
+    if (typeof authorizationCallback === 'function') {
+        const context = new RequestContext(
+            req.ip,
+            req.path,
+            req.headers,
+            req.query,
+            req.body,
+            req.cookies,
+            req.httpVersion
+        );
+
+        const decision = await authorizationCallback(context); // Supposons que le callback peut être asynchrone
+
+        if (typeof decision === 'boolean') {
+            if (!decision) {
+                res.status(403).send('Access to metrics denied.');
+                return;
+            }
+        } else if (typeof decision === 'object' && decision !== null && decision.action) {
+            if (decision.action === 'block') {
+                res.status(decision.status || 403).send(decision.body || 'Access denied.');
+                return;
+            } else if (decision.action === 'redirect') {
+                res.redirect(decision.status || 302, decision.path);
+                return;
+            }
+        }
+    }
+
+    // 3. Si autorisé, servir les métriques.
+    res.set('Content-Type', 'text/plain; version=0.0.4; charset=utf-8');
+    res.send(MetricsManager.getPrometheusMetrics(securityConfig));
+}