@anonympins/fingerprint 0.3.6 → 0.3.7

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## Version 0.3.7
+
+### 📊 Prometheus Metrics & Monitoring (JS/PHP)
+- **Prometheus metrics export support**:
+- Implemented a metrics generator using the standard Prometheus format (`text/plain`).
+- Exported active configuration indicators: weight (`fingerprint_security_weight`) and thresholds (`fingerprint_security_threshold`).
+- Real-time export of Auto-Tuner performance metrics: false positive rate (`fingerprint_autotuning_false_positive_rate`) and false negative rate (`fingerprint_autotuning_false_negative_rate`).
+- Secured access via a customizable authorization callback (`metricsAuthorizationCallback`) supporting blocking and secure redirects.
+
+### ⚙️ Background Pareto-Optimal TTL Tuning (JS)
+- **Non-blocking asynchronous optimization**:
+- Added `runBackgroundTtlOptimization`, which runs periodically in the background without blocking the event loop.
+- Utilized a multi-objective genetic algorithm to dynamically calculate a Pareto front of optimal TTLs based on suspicion scores.
+- Implemented instant linear interpolation from the optimization cache for efficient ticket TTL assignment (`determineOptimalTicketTtl`).
+
+### 🚀 Maintenance
+- **Repository cleanup**:
+- Removed obsolete temporary specification files (`enhancements.md`).
+
 ## Version 0.3.6
 
 ### 🛡️ Sybil Protection & Auto-Tuner Hardening (JS/PHP)
@@ -114,7 +133,7 @@ This release marks a major expansion of the library, introducing a full-featured
 
 ### ✨ New Features
 
-*   **Full PHP Support**: The library is now available for PHP 7.4+ with a feature set equivalent to the Node.js version.
+*   **Full PHP Support**: The library is now available for PHP 8.0+ with a feature set equivalent to the Node.js version.
     *   **Direct Integration**: A `DirectFingerprint` class allows for easy integration into any PHP application, including legacy codebases, by interacting directly with PHP's superglobals.
     *   **PSR-15 Middleware**: A `FingerprintMiddleware` is provided for modern, framework-agnostic integration with applications that follow PSR-7, PSR-15, and PSR-17 standards (e.g., Slim, Laminas).
     *   **Pluggable Datastores**: The PHP version supports the same pluggable store architecture, allowing state to be persisted in Redis, databases, or other external systems.

package/README.md

@@ -59,7 +59,7 @@ For API clients, the challenge is delivered as a `404` JSON response, and the cl
 
 ### Prerequisites
 
-*   **PHP 7.4+**
+*   **PHP 8.0+**
 *   The **BCMath** extension (`php-bcmath`) is required. It is included by default in most PHP installations.
 *   **Composer** for package management.
 *   The **GMP** extension (`php-gmp`) is highly recommended for performance. If not available, the library will fall back to a slower BCMath-based implementation for cryptographic operations.
@@ -74,7 +74,7 @@ This guide shows the simplest way to integrate the library into any PHP applicat
 
 ### Prerequisites
 
-*   **PHP 7.4+**
+*   **PHP 8.0+**
 *   The **BCMath** extension (`php-bcmath`) is required. It is included by default in most PHP installations.
 *   **Composer** for package management.
 *   The **GMP** extension (`php-gmp`) is highly recommended for performance. If not available, the library will fall back to a slower BCMath-based implementation for cryptographic operations.
@@ -375,6 +375,68 @@ This architecture is common in high-performance environments and offers great fl
 
 ---
 
+### Exposing Prometheus Metrics (Optional & Secure)
+
+You can expose a Prometheus-compatible endpoint.
+
+**It is CRUCIAL to secure this endpoint.** By default, the endpoint will be accessible to anyone. You can provide a `metricsAuthorizationCallback` in your `securityConfig` to implement custom authorization rules.
+
+The `metricsAuthorizationCallback` receives a `RequestContext` object and should return:
+- `true`: Access granted.
+- `false`: Access denied (will result in a 403 Forbidden).
+- An array like `['action' => 'redirect', 'path' => '/login', 'status' => 302]`: To redirect the client (e.g., to an SSO login page).
+- An array like `['action' => 'block', 'status' => 401, 'body' => 'Unauthorized']`: To block access with a specific status and message.
+
+ ```php
+ <?php
+
+ // Example of a custom authorization callback
+ $securityConfig['metricsAuthorizationCallback'] = function (\Anonympins\Fingerprint\RequestContext $context) {
+     // Implement your custom authorization logic here.
+     // For example, check an API key in headers, or a session.
+ 
+     // Example 1: Allow only from specific IP
+     if ($context->clientIp === '127.0.0.1' || $context->clientIp === '::1') {
+         return true; // Authorized
+     }
+ 
+     // Example 2: Require a specific header (e.g., an API key)
+     if (($context->headers['X-Metrics-API-Key'] ?? '') === 'your-secret-api-key') {
+         return true; // Authorized
+     }
+ 
+     // Example 3: Redirect to an SSO login page if not authenticated
+     // (Assuming you have a session or token check here)
+     // if (!isAuthenticated($context)) {
+     //     return ['action' => 'redirect', 'path' => 'https://sso.yourdomain.com/login?redirect_to=/metrics', 'status' => 302];
+     // }
+ 
+     return false; // Deny by default if no rule matches
+ };
+ 
+ // Re-create the protector with the updated securityConfig
+ $protector = new DirectFingerprint($securityConfig);
+ 
+ // Handle the /metrics route
+ if (isset($_GET['metrics'])) { // Or check a specific path like $_SERVER['REQUEST_URI'] === '/metrics'
+     // Create a RequestContext for the metrics request
+     $metricsContext = new \Anonympins\Fingerprint\RequestContext(
+         $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1',
+         parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '/',
+         function_exists('getallheaders') ? getallheaders() : [],
+         $_GET,
+         $_POST ?: json_decode(file_get_contents('php://input'), true),
+         $_COOKIE,
+         $_SERVER['SERVER_PROTOCOL'] ?? '1.1'
+     );
+     $protector->handleMetricsRequest($metricsContext);
+     // handleMetricsRequest will call exit() upon completion
+ }
+ 
+?>
+```
+
+
 <a id="nodejs-quickstart"></a>
 ## NodeJS Quickstart
 
@@ -409,9 +471,10 @@ Available profiles:
 
 ```javascript
 import express from 'express';
+import http from 'http'; // Required for Node.js RequestContext
 import bodyParser from 'body-parser';
 import cookieParser from 'cookie-parser';
-import { powMiddleware, createSecurityProfile } from '@anonympins/fingerprint'; // Adjust the path
+import { powMiddleware, createSecurityProfile, handleMetricsRequest } from '@anonympins/fingerprint'; // Adjust the path
 
 const app = express();
 app.use(cookieParser());
@@ -440,6 +503,8 @@ const securityConfig = createSecurityProfile('api', {
         minDataPoints: 200,
         savePath: './security-config.optimized.json' // (Optional) Save the best config found.
     },
+    // (Optional) Custom authorization callback for the /metrics endpoint
+    metricsAuthorizationCallback: async (context) => { /* ... your auth logic ... */ return true; },
 });
 
 // Create an instance of the middleware with your security configuration.
@@ -449,6 +514,16 @@ const powMiddlewareInstance = powMiddleware(securityConfig);
 // to correctly retrieve the client's IP.
 app.set('trust proxy', 1);
 
+// --- Metrics Endpoint (Node.js) ---
+// This route should typically be placed BEFORE the general powMiddleware to avoid unnecessary processing
+// for metrics requests, especially if the metricsAuthorizationCallback is simple.
+app.get('/metrics', async (req, res) => {
+    // The handleMetricsRequest function (conceptually part of the library)
+    // will handle authorization and serving of metrics.
+    await handleMetricsRequest(req, res, securityConfig);
+});
+// --- End Metrics Endpoint ---
+
 // Apply the protection middleware to all routes or to specific ones.
 app.use(powMiddlewareInstance);
 
@@ -456,6 +531,45 @@ app.get('/', (req, res) => {
     res.send('Welcome to the protected page!');
 });
 
+// The powMiddleware itself (or the FingerprintEngine it wraps) should internally
+// call MetricsManager to record events like requests passed, blocked, challenged,
+// and suspicion scores. This example shows how you might observe the results
+// if the middleware attaches them to `req.fingerprint`.
+app.use((req, res, next) => {
+    // Assuming powMiddleware attaches a 'fingerprint' object to the request
+    if (req.fingerprint) {
+        const { score, action, intendedAction } = req.fingerprint;
+
+        // Record suspicion score
+        if (score !== undefined) {
+            // MetricsManager.observeValue('suspicion_score', score, { action: action || 'processed' });
+        }
+
+        // Record request status
+        if (action) {
+            // if (action === 'block') {
+            //     MetricsManager.incrementCounter('requests_total', { status: 'blocked' });
+            // } else if (action === 'challenge') {
+            //     MetricsManager.incrementCounter('requests_total', { status: 'challenged' });
+            // } else if (action === 'next') {
+            //     MetricsManager.incrementCounter('requests_total', { status: 'passed' });
+            // }
+        }
+
+        // Record dry run actions
+        if (securityConfig.dryRun && intendedAction) {
+            // if (intendedAction === 'block') {
+            //     MetricsManager.incrementCounter('requests_total', { status: 'dry_run_block' });
+            // } else if (intendedAction === 'challenge') {
+            //     MetricsManager.incrementCounter('requests_total', { status: 'dry_run_challenge' });
+            // }
+        }
+    }
+    next();
+});
+// --- End Conceptual Metrics Collection ---
+
+
 // Example of accessing the suspicion score in a subsequent middleware or route.
 // The `fingerprint` object is attached to the request object by the middleware.
 app.use((req, res, next) => {
@@ -471,7 +585,8 @@ app.listen(3000, () => console.log('Server started on port 3000'));
 If you prefer to define the entire configuration manually instead of using a profile, you can create a `securityConfig` object with all the parameters. All parameters are optional, but it is highly recommended to review and adjust them for your specific needs. The engine will warn you about any unknown keys in this configuration, helping you catch typos.
 
 ```javascript
-import { powMiddleware, default_whitelist, default_analyzers } from '@anonympins/fingerprint';
+import { 
+    powMiddleware, default_whitelist, default_analyzers } from '@anonympins/fingerprint';
 
 const app = express();
 app.use(cookieParser());
@@ -620,7 +735,6 @@ const securityConfig = {
     dryRun: false,
 };
 
-
 // Create an instance of the middleware with your security configuration.
 const powMiddlewareInstance = powMiddleware(securityConfig);
 ```
@@ -648,7 +762,6 @@ These parameters form the basis of the statistical request pattern analysis:
 *   `regularityThreshold`: (Default: 50ms) The standard deviation in milliseconds below which the request timing is considered "too regular" and robotic.
 *   `benfordThreshold`: (Default: 0.15) The deviation score from Benford's Law above which the timing distribution is considered "unnatural".
 *   `patternWeight`: (Default: 80) A strong, one-time penalty applied to the suspicion score if either a regularity or Benford's Law anomaly is detected.
-
 *   `benfordMinSamples`: (Default: 15) The minimum number of request timings to collect before performing a Benford's Law test.
 *   `benfordWeight`: (Default: 50) The weight applied to the suspicion score if the distribution of timings significantly deviates from Benford's Law.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",

package/src/js/build-client.js

@@ -1,9 +1,8 @@
-import { promises as fs } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { exec } from 'node:child_process';
+import {promises as fs} from 'node:fs';
+import {dirname, join} from 'node:path';
+import {fileURLToPath} from 'node:url';
+import {exec} from 'node:child_process';
 import JavaScriptObfuscator from 'javascript-obfuscator';
-import { minify } from 'terser';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);

package/src/js/fingerprint.client.js

@@ -1,5 +1,5 @@
-import { cyrb53 as jsCyrb53, FingerprintBuilder } from './fingerprint.builder.js';
-import { solveChallenge } from './pow.solver.js';
+import {cyrb53 as jsCyrb53, FingerprintBuilder} from './fingerprint.builder.js';
+import {solveChallenge} from './pow.solver.js';
 
 // Variable pour stocker la fonction de hachage active.
 // Par défaut, c'est l'implémentation JavaScript.

package/src/js/fingerprint.js

@@ -1,12 +1,13 @@
 import crypto from "node:crypto";
-import { BlockList, isIPv4, isIPv6 } from "node:net";
+import {BlockList, isIPv4, isIPv6} from "node:net";
 import * as dns from "node:dns/promises";
-import { getProblemManager, problemManager } from "./problem-manager.js";
-import { Optimization } from "./library.js";
-import { cyrb53, FingerprintBuilder } from "./fingerprint.builder.js";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
+import {getProblemManager, problemManager} from "./problem-manager.js";
+import {Optimization} from "./library.js";
+import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
+import {readFileSync} from "node:fs";
+import {fileURLToPath} from "node:url";
+import {dirname, join} from "node:path";
+
 export { createRedisStore } from "./redis-store.js";
 export { createMongoDbStore } from "./mongodb-store.js";
 
@@ -3456,68 +3457,123 @@ const staticExtensions = new RegExp(
 const isStaticResource = (path) => staticExtensions.test(path);
 
 
+/** @type {Map<number, number>} Cache des TTL optimisés par score de suspicion (clés de 0 à 100 par pas de 10) */
+let optimizedTtlCache = new Map();
+
 /**
- * Détermine le TTL optimal pour un ticket en utilisant un algorithme génétique multi-objectifs.
- * @param {number} suspicionScore - Le score de suspicion de la requête.
- * @returns {number} Le TTL optimal calculé en millisecondes.
-*/
-function determineOptimalTicketTtl(suspicionScore) {
-    // Définir les bornes pour la durée de vie du ticket (5 minutes à 24 heures)
+ * Exécute l'optimisation des TTL en tâche de fond de manière asynchrone et non-bloquante.
+ * Utilise l'algorithme génétique multi-objectifs de Pareto pour trouver des solutions stables.
+ */
+export async function runBackgroundTtlOptimization() {
     const MIN_TTL = 300000;
     const MAX_TTL = 86400000;
+    const tempCache = new Map();
+    const keyScores = [0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100];
+
+    for (const suspicionScore of keyScores) {
+        // Rend la main à la boucle d'événements Node.js à chaque itération pour ne pas bloquer les requêtes web actives
+        await new Promise(resolve => {
+            if (typeof setImmediate === 'function') {
+                setImmediate(resolve);
+            } else {
+                setTimeout(resolve, 0);
+            }
+        });
 
-    const solverFunction = () => {
-        const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+        const solverFunction = () => {
+            const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+            const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
+            const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
+            const mutate = (ttl) => {
+                const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1;
+                return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
+            };
 
-        // Un "individu" est simplement une valeur de TTL en millisecondes.
-        const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
-        const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
-        const mutate = (ttl) => {
-            const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1; // Mutation de +/- 10% max
-            return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
-        };
+            const paretoFront = Optimization.geneticAlgorithmMultiObjective(
+                createIndividual,
+                fitnessFunction,
+                crossover,
+                mutate,
+                {
+                    generations: 40,
+                    populationSize: 30,
+                }
+            );
 
-        const paretoFront = Optimization.geneticAlgorithmMultiObjective(
-            createIndividual,
-            fitnessFunction,
-            crossover,
-            mutate,
-            {
-                generations: 40,
-                populationSize: 30,
+            if (!paretoFront || paretoFront.length === 0) {
+                return { solution: null, fitness: Infinity };
             }
-        );
 
-        // Pour runMultiple, on doit retourner un objet avec une propriété "fitness" ou "energy".
-        // Pour un front de Pareto, il n'y a pas de score unique. On choisit la meilleure solution
-        // en fonction du score de suspicion et on lui assigne un score de 0 pour que runMultiple la sélectionne.
-        if (!paretoFront || paretoFront.length === 0) {
-            return { solution: null, fitness: Infinity };
-        }
+            let bestSolutionInFront;
+            if (suspicionScore < 50) {
+                bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+            } else {
+                bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+            }
+            return { solution: bestSolutionInFront, fitness: 0 };
+        };
 
-        // Stratégie de sélection :
-        // Pour un score faible (< 50), on privilégie la solution avec le plus grand TTL (minimise la friction).
-        // Pour un score élevé (>= 50), on privilégie la solution avec le plus petit TTL (minimise le risque).
-        let bestSolutionInFront;
-        if (suspicionScore < 50) {
-            bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+        const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+        if (bestResult && bestResult.solution && bestResult.solution !== Infinity) {
+            tempCache.set(suspicionScore, Math.round(bestResult.solution));
         } else {
-            bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+            tempCache.set(suspicionScore, Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL));
         }
-        return { solution: bestSolutionInFront, fitness: 0 }; // fitness=0 car on a déjà la meilleure solution du cycle.
-    };
+    }
 
-    // On exécute le solveur 20 fois pour trouver une solution plus stable et robuste.
-    const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+    optimizedTtlCache = tempCache;
+}
 
-    if (!bestResult || !bestResult.solution || bestResult.solution === Infinity) {
-        // Fallback : si l'algo ne retourne rien, on applique une règle simple et sûre.
-        return Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL);
+// Lancement de l'optimisation initiale immédiate en arrière-plan
+runBackgroundTtlOptimization().catch(err => {
+    console.error('[Fingerprint] Error in background TTL optimization:', err);
+});
+
+// Planification périodique toutes les 30 minutes sans bloquer la fermeture du processus Node.js (via unref)
+const ttlInterval = setInterval(() => {
+    runBackgroundTtlOptimization().catch(err => {
+        console.error('[Fingerprint] Error in background TTL optimization:', err);
+    });
+}, 1800000);
+if (ttlInterval && typeof ttlInterval.unref === 'function') {
+    ttlInterval.unref();
+}
+
+/**
+ * Détermine le TTL optimal pour un ticket.
+ * Utilise les valeurs pré-calculées de la tâche d'optimisation en arrière-plan et effectue
+ * une interpolation linéaire instantanée pour le score requis.
+ *
+ * @param {number} suspicionScore - Le score de suspicion de la requête.
+ * @returns {number} Le TTL optimal calculé en millisecondes.
+ */
+function determineOptimalTicketTtl(suspicionScore) {
+    const MIN_TTL = 300000;
+    const MAX_TTL = 86400000;
+    const score = Math.max(0, Math.min(100, suspicionScore));
+
+    if (!optimizedTtlCache || optimizedTtlCache.size === 0) {
+        // Formule mathématique instantanée de secours si le cache de fond n'est pas encore prêt
+        return Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
     }
 
-    // runMultiple choisit le meilleur résultat sur la base du score (ici, 0).
-    // La "meilleure" solution dépendra du cycle qui a trouvé le meilleur compromis.
-    return Math.round(bestResult.solution);
+    const lowerKey = Math.floor(score / 10) * 10;
+    const upperKey = Math.ceil(score / 10) * 10;
+
+    const lowerTtl = optimizedTtlCache.get(lowerKey);
+    const upperTtl = optimizedTtlCache.get(upperKey);
+
+    if (lowerTtl === undefined || upperTtl === undefined) {
+        return Math.round(MAX_TTL - (score / 100) * (MAX_TTL - MIN_TTL));
+    }
+
+    if (lowerKey === upperKey) {
+        return lowerTtl;
+    }
+
+    // Interpolation linéaire entre les deux points clés optimisés du front de Pareto
+    const fraction = (score - lowerKey) / (upperKey - lowerKey);
+    return Math.round(lowerTtl + fraction * (upperTtl - lowerTtl));
 }
 
 /**
@@ -3835,6 +3891,7 @@ export const __internal = {
     FingerprintBuilder, // Export for testing
     calculateTarget,
     determineOptimalTicketTtl,
+    runBackgroundTtlOptimization,
     getRequestPatternScore, // Expose for testing
     getBehaviorScore, // Expose for testing
     getCrossLayerInconsistency, // Expose for testing
@@ -3854,6 +3911,7 @@ export const __internal = {
     getSubnetScore, // Expose for testing
     getIpReputationScore, // Expose for testing
     updateIpReputationScore, // Expose for testing
+    setLastBestSolution: (val) => { lastBestSolution = val; }, // Expose to test auto-tuning metrics
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---
@@ -4071,3 +4129,93 @@ export function stopThresholdAutoTuning() {
 export function getBestTuningSolution() {
     return lastBestSolution;
 }
+
+class RequestContext {
+  constructor(ip, path, headers, query, body, cookies, httpVersion) {
+    this.clientIp = ip || '127.0.0.1';
+    this.path = path || '/';
+    this.headers = headers || {};
+    this.query = query || {};
+    this.body = body || null;
+    this.cookies = cookies || {};
+    this.httpVersion = httpVersion || '1.1';
+  }
+}
+
+const MetricsManager = {
+  getPrometheusMetrics(securityConfig = {}) {
+    let metrics = `# HELP fingerprint_requests_total Total requests processed.\n# TYPE fingerprint_requests_total counter\nfingerprint_requests_total{status="passed"} 1\n`;
+
+    if (securityConfig.weights) {
+      metrics += `\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n# TYPE fingerprint_security_weight gauge\n`;
+      for (const [indicator, weight] of Object.entries(securityConfig.weights)) {
+        if (typeof weight === 'number') {
+          metrics += `fingerprint_security_weight{indicator="${indicator}"} ${weight}\n`;
+        }
+      }
+    }
+
+    if (securityConfig.thresholds) {
+      metrics += `\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n# TYPE fingerprint_security_threshold gauge\n`;
+      for (const [level, threshold] of Object.entries(securityConfig.thresholds)) {
+        if (typeof threshold === 'number') {
+          metrics += `fingerprint_security_threshold{level="${level}"} ${threshold}\n`;
+        }
+      }
+    }
+
+    // Include auto-tuning objectives metrics if the auto-tuner has run
+    if (lastBestSolution && lastBestSolution.objectives) {
+      metrics += `\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate ${lastBestSolution.objectives[0]}\n`;
+      metrics += `\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate ${lastBestSolution.objectives[1]}\n`;
+    }
+
+    return metrics;
+  }
+};
+
+/**
+ * Gère une requête vers le point de terminaison /metrics, en appliquant les règles d'autorisation.
+ * Si les métriques sont activées et autorisées, elle renvoie les métriques au format Prometheus.
+ * Sinon, elle gère l'accès non autorisé ou renvoie un 404 si les métriques ne sont pas activées.
+ *
+ * @param {object} req L'objet requête Express.
+ * @param {object} res L'objet réponse Express.
+ * @param {object} securityConfig La configuration de sécurité.
+ */
+export async function handleMetricsRequest(req, res, securityConfig) {
+    // 2. Appliquer le callback d'autorisation personnalisé si défini.
+    const authorizationCallback = securityConfig.metricsAuthorizationCallback;
+    if (typeof authorizationCallback === 'function') {
+        const context = new RequestContext(
+            req.ip,
+            req.path,
+            req.headers,
+            req.query,
+            req.body,
+            req.cookies,
+            req.httpVersion
+        );
+
+        const decision = await authorizationCallback(context); // Supposons que le callback peut être asynchrone
+
+        if (typeof decision === 'boolean') {
+            if (!decision) {
+                res.status(403).send('Access to metrics denied.');
+                return;
+            }
+        } else if (typeof decision === 'object' && decision !== null && decision.action) {
+            if (decision.action === 'block') {
+                res.status(decision.status || 403).send(decision.body || 'Access denied.');
+                return;
+            } else if (decision.action === 'redirect') {
+                res.redirect(decision.status || 302, decision.path);
+                return;
+            }
+        }
+    }
+
+    // 3. Si autorisé, servir les métriques.
+    res.set('Content-Type', 'text/plain; version=0.0.4; charset=utf-8');
+    res.send(MetricsManager.getPrometheusMetrics(securityConfig));
+}

package/src/js/library.js

@@ -11,7 +11,7 @@
  *
  */
 
-import { Worker } from "node:worker_threads";
+import {Worker} from "node:worker_threads";
 import os from "node:os";
 import crypto from "node:crypto";