@anonympins/fingerprint 0.3.6 → 0.3.7

package/src/js/mongodb-store.js

@@ -1,53 +1,80 @@
-/**
- * @file Creates a store adapter for MongoDB.
- * This adapter uses a collection as a key-value store and leverages MongoDB's TTL indexes
- * for automatic expiration of documents.
- */
-
-/**
- * Creates a store adapter for a MongoDB collection.
- * It's recommended to pass the `db` object and let the adapter handle the collection.
- *
- * **Note:** For TTL to work, you must create a TTL index on the `expiresAt` field in your collection.
- * In the mongo shell, run:
- * `db.yourCollectionName.createIndex({ "expiresAt": 1 }, { expireAfterSeconds: 0 })`
- *
- * @param {import('mongodb').Db} db - An instance of a MongoDB Db object.
- * @param {string} [collectionName='fingerprint_store'] - The name of the collection to use.
- * @returns {import('./fingerprint.js').IStore} An object that complies with the IStore interface.
- */
-export function createMongoDbStore(db, collectionName = 'fingerprint_store') {
-  const collection = db.collection(collectionName);
-
-  return {
-    async get(key) {
-      const doc = await collection.findOne({ _id: key });
-      // The TTL index automatically removes expired documents, so no need to check `expiresAt` here.
-      return doc ? doc.value : null;
-    },
-    async set(key, value, ttl) {
-      const doc = {
-        _id: key,
-        value: value,
-      };
-
-      if (ttl && ttl > 0) {
-        // Set the expiration date for the TTL index.
-        doc.expiresAt = new Date(Date.now() + ttl * 1000);
-      }
-
-      await collection.updateOne(
-        { _id: key },
-        { $set: doc },
-        { upsert: true }
-      );
-    },
-    async has(key) {
-      const count = await collection.countDocuments({ _id: key });
-      return count > 0;
-    },
-    async delete(key) {
-      await collection.deleteOne({ _id: key });
-    },
-  };
+/**
+ * @file Creates a store adapter for MongoDB.
+ * This adapter uses a collection as a key-value store and leverages MongoDB's TTL indexes
+ * for automatic expiration of documents.
+ */
+
+/**
+ * Creates a store adapter for a MongoDB collection.
+ * It's recommended to pass the `db` object and let the adapter handle the collection.
+ *
+ * **Note:** For TTL to work, you must create a TTL index on the `expiresAt` field in your collection.
+ * In the mongo shell, run:
+ * `db.yourCollectionName.createIndex({ "expiresAt": 1 }, { expireAfterSeconds: 0 })`
+ *
+ * @param {import('mongodb').Db} db - An instance of a MongoDB Db object.
+ * @param {string} [collectionName='fingerprint_store'] - The name of the collection to use.
+ * @returns {import('./fingerprint.js').IStore} An object that complies with the IStore interface.
+ */
+export function createMongoDbStore(db, collectionName = 'fingerprint_store') {
+  const collection = db.collection(collectionName);
+  
+  // Custom replacer/reviver to handle Set serialization (identical to Redis/SQL stores)
+  const replacer = (k, v) => (v instanceof Set ? Array.from(v) : v);
+  const reviver = (k, v) => (k === 'ips' && Array.isArray(v) ? new Set(v) : v);
+
+  return {
+    async get(key) {
+      const doc = await collection.findOne({ _id: key });
+      if (!doc) return null;
+
+      // Active expiration check to bypass eventual consistency of MongoDB's 60s TTL cleanup daemon
+      if (doc.expiresAt && new Date(doc.expiresAt) < new Date()) {
+        await this.delete(key);
+        return null;
+      }
+
+      try {
+        return JSON.parse(doc.value, reviver);
+      } catch (e) {
+        // Fallback for legacy un-serialized raw values
+        return doc.value;
+      }
+    },
+    async set(key, value, ttl) {
+      const stringValue = JSON.stringify(value, replacer);
+      const doc = {
+        _id: key,
+        value: stringValue,
+      };
+
+      if (ttl && ttl > 0) {
+        // Set the expiration date for the TTL index.
+        doc.expiresAt = new Date(Date.now() + ttl * 1000);
+      }
+
+      await collection.updateOne(
+        { _id: key },
+        { $set: doc },
+        { upsert: true }
+      );
+    },
+    async has(key) {
+      const doc = await collection.findOne({ _id: key }, { projection: { expiresAt: 1 } });
+      if (!doc) return false;
+
+      if (doc.expiresAt && new Date(doc.expiresAt) < new Date()) {
+        await this.delete(key);
+        return false;
+      }
+      return true;
+    },
+    async delete(key) {
+      await collection.deleteOne({ _id: key });
+    },
+    async init() {
+      // Automates index configuration
+      await collection.createIndex({ "expiresAt": 1 }, { expireAfterSeconds: 0 });
+    }
+  };
 }

package/src/js/optimization.worker.js

@@ -4,8 +4,8 @@
  * Ce script s'exécute sur un thread séparé pour ne pas bloquer l'interface utilisateur.
  */
 
-import { parentPort, workerData } from 'worker_threads';
-import { Optimization } from './library.js'; // Assurez-vous que le chemin est correct
+import {parentPort, workerData} from 'worker_threads';
+import {Optimization} from './library.js'; // Assurez-vous que le chemin est correct
 
 if (parentPort) {
     parentPort.on('message', async () => { // Le message est vide, on utilise workerData

package/src/js/problem-manager.js

@@ -1,5 +1,5 @@
-import { promises as fs } from 'node:fs';
-import { Optimization } from './library.js';
+import {promises as fs} from 'node:fs';
+import {Optimization} from './library.js';
 
 /**
  * @namespace FunctionRegistry

package/src/php/DirectFingerprint.php

@@ -1,81 +1,146 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint;
-
-/**
- * Intégration directe du moteur de fingerprinting pour les applications PHP sans framework PSR.
- * Cette classe interagit directement avec les superglobales PHP et les fonctions de réponse.
- */
-class DirectFingerprint
-{
-    private FingerprintEngine $engine;
-
-    /**
-     * @param array $securityConfig La configuration de sécurité pour le moteur.
-     */
-    public function __construct(array $securityConfig)
-    {
-        $this->engine = new FingerprintEngine($securityConfig);
-    }
-
-    /**
-     * Protège le point d'entrée actuel.
-     * Analyse la requête entrante et, si nécessaire, envoie une réponse de challenge/blocage et termine le script.
-     * Si la requête est autorisée, la méthode retourne simplement et le reste du script peut s'exécuter.
-     *
-     * @return array{score: float, vector: array}|null Les données du fingerprint si la requête est autorisée, null sinon.
-     */
-    public function protect(): ?array
-    {
-        // 1. Construire le contexte de la requête à partir des superglobales PHP.
-        $body = $_POST ?: json_decode(file_get_contents('php://input'), true);
-        $headers = function_exists('getallheaders') ? getallheaders() : [];
-
-        $context = new RequestContext(
-            $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1',
-            parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '/',
-            $headers,
-            $_GET,
-            $body,
-            $_COOKIE,
-            $_SERVER['SERVER_PROTOCOL'] ?? '1.1'
-        );
-
-        // 2. Traiter la requête avec le moteur.
-        $decision = $this->engine->processRequest($context);
-
-        // 3. Agir sur la décision.
-        if (isset($context->newCookieForResponse)) {
-            $cookie = $context->newCookieForResponse;
-            setcookie($cookie['name'], $cookie['value'], $cookie['options']);
-        }
-
-        switch ($decision['action']) {
-            case 'block':
-            case 'challenge':
-                http_response_code($decision['status'] ?? 403);
-                if (is_array($decision['body'])) {
-                    header('Content-Type: application/json');
-                    echo json_encode($decision['body']);
-                } else {
-                    header('Content-Type: text/html; charset=utf-8');
-                    echo $decision['body'];
-                }
-                exit(); // Termine le script.
-
-            case 'redirect':
-                if (isset($decision['cookie'])) {
-                    setcookie($decision['cookie']['name'], $decision['cookie']['value'], $decision['cookie']['options']);
-                }
-                header('Location: ' . $decision['path'], true, 302);
-                exit(); // Termine le script.
-
-            case 'next':
-            default:
-                // La requête est autorisée, on retourne les informations du fingerprint.
-                return ['score' => $decision['score'], 'vector' => $decision['vector']];
-        }
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint;
+
+use Anonympins\Fingerprint\Utils\MetricsManager;
+
+/**
+ * Intégration directe du moteur de fingerprinting pour les applications PHP sans framework PSR.
+ * Cette classe interagit directement avec les superglobales PHP et les fonctions de réponse.
+ */
+class DirectFingerprint
+{
+    private array $securityConfig;
+    private FingerprintEngine $engine;
+
+    /**
+     * @param array $securityConfig La configuration de sécurité pour le moteur.
+     */
+    public function __construct(array $securityConfig)
+    {
+        $this->engine = new FingerprintEngine($securityConfig);
+        $this->securityConfig = $securityConfig;
+    }
+
+    /**
+     * Protège le point d'entrée actuel.
+     * Analyse la requête entrante et, si nécessaire, envoie une réponse de challenge/blocage et termine le script.
+     * Si la requête est autorisée, la méthode retourne simplement et le reste du script peut s'exécuter.
+     *
+     * @return array{score: float, vector: array}|null Les données du fingerprint si la requête est autorisée, null sinon.
+     */
+    public function protect(): ?array
+    {
+        // 1. Construire le contexte de la requête à partir des superglobales PHP.
+        $body = $_POST ?: json_decode(file_get_contents('php://input'), true);
+        $headers = function_exists('getallheaders') ? getallheaders() : [];
+
+        $context = new RequestContext(
+            $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1',
+            parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '/',
+            $headers,
+            $_GET,
+            $body,
+            $_COOKIE,
+            $_SERVER['SERVER_PROTOCOL'] ?? '1.1'
+        );
+
+        // 2. Traiter la requête avec le moteur.
+        $decision = $this->engine->processRequest($context);
+
+        // 3. Agir sur la décision.
+        if (isset($context->newCookieForResponse)) {
+            $cookie = $context->newCookieForResponse;
+            setcookie($cookie['name'], $cookie['value'], $cookie['options']);
+        }
+
+        switch ($decision['action']) {
+            case 'block':
+            case 'challenge':
+                http_response_code($decision['status'] ?? 403);
+                if (is_array($decision['body'])) {
+                    header('Content-Type: application/json');
+                    echo json_encode($decision['body']);
+                } else {
+                    header('Content-Type: text/html; charset=utf-8');
+                    echo $decision['body'];
+                }
+                exit(); // Termine le script.
+
+            case 'redirect':
+                if (isset($decision['cookie'])) {
+                    setcookie($decision['cookie']['name'], $decision['cookie']['value'], $decision['cookie']['options']);
+                }
+                header('Location: ' . $decision['path'], true, 302);
+                exit(); // Termine le script.
+
+            case 'next':
+            default:
+                // La requête est autorisée, on retourne les informations du fingerprint.
+                return ['score' => $decision['score'], 'vector' => $decision['vector']];
+        }
+    }
+
+    /**
+     * Handles a request to the /metrics endpoint, applying authorization rules.
+     * If metrics are enabled and authorized, it outputs Prometheus formatted metrics and exits.
+     * Otherwise, it handles unauthorized access or returns a 404 if metrics are not enabled.
+     *
+     * @param RequestContext $context The current request context.
+     */
+    public function handleMetricsRequest(RequestContext $context): void
+    {
+        // 2. Appliquer le callback d'autorisation personnalisé si défini.
+        $authorizationCallback = $this->securityConfig['metricsAuthorizationCallback'] ?? null;
+        if (is_callable($authorizationCallback)) {
+            $decision = call_user_func($authorizationCallback, $context);
+
+            if (is_bool($decision)) {
+                if (!$decision) {
+                    http_response_code(403); // Forbidden
+                    echo "Access to metrics denied.";
+                    exit();
+                }
+            } elseif (is_array($decision) && isset($decision['action'])) {
+                switch ($decision['action']) {
+                    case 'block':
+                        http_response_code($decision['status'] ?? 403);
+                        echo $decision['body'] ?? "Access denied.";
+                        exit();
+                    case 'redirect':
+                        header('Location: ' . $decision['path'], true, $decision['status'] ?? 302);
+                        exit();
+                    case 'next':
+                        // Autorisé, continuer pour servir les métriques
+                        break;
+                    default:
+                        // Action inconnue, refuser par défaut
+                        http_response_code(403);
+                        echo "Invalid authorization decision.";
+                        exit();
+                }
+            } else {
+                // Retour inattendu du callback, refuser par défaut
+                http_response_code(403);
+                echo "Invalid authorization callback response.";
+                exit();
+            }
+        }
+
+        // 3. Si autorisé, servir les métriques.
+        header('Content-Type: text/plain; version=0.0.4; charset=utf-8');
+        echo MetricsManager::getPrometheusMetrics();
+        exit();
+    }
+
+    /**
+     * Returns Prometheus formatted metrics if enabled in the security configuration.
+     * @return string|null
+     */
+    public function getPrometheusMetrics(): ?string
+    {
+        return MetricsManager::getPrometheusMetrics();
+    }
 }

package/src/php/FingerprintEngine.php

@@ -4,12 +4,15 @@
 
  namespace Anonympins\Fingerprint;
 
- use Anonympins\Fingerprint\Config\SecurityProfiles;
- use Anonympins\Fingerprint\Store\StoreManager; // Correction de l'import
  use Anonympins\Fingerprint\Challenge\ChallengeUtils;
+ use Anonympins\Fingerprint\Config\SecurityProfiles;
+ use Anonympins\Fingerprint\Store\StoreManager;
  use Anonympins\Fingerprint\Utils\BlockList;
  use Anonympins\Fingerprint\Utils\Logger;
- use Anonympins\Fingerprint\Utils\RequestUtils; 
+ use Anonympins\Fingerprint\Utils\MetricsManager;
+ use Anonympins\Fingerprint\Utils\RequestUtils;
+
+ // Correction de l'import
 
  /**
   * Le moteur principal de la bibliothèque de fingerprinting.
@@ -525,6 +528,7 @@
          // 1. Vérifier les listes blanches
          if ($this->checkAllowlists($context)) {
              return ['action' => 'next', 'score' => 0.0, 'vector' => ['whitelisted' => 100.0]];
+            MetricsManager::incrementCounter('requests_total', ['status' => 'whitelisted']);
          }
  
          // Initialiser le vecteur de suspicion
@@ -602,6 +606,7 @@
                  if ($isValid) {
                      $store->delete("secret:{$powNonce}");
                      $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000;
+                    MetricsManager::incrementCounter('challenges_solved_total');
                      $this->log('Challenge solution valid - issuing ticket', ['ticketMaxAge' => $ticketTtl]);
  
                      return [
@@ -618,6 +623,7 @@
                  }
              }
              // Si la solution est invalide ou le nonce est expiré, on pénalise fortement pour la suite.
+            MetricsManager::incrementCounter('challenges_failed_total');
              $this->log('Challenge solution invalid or context expired', ['nonce' => $powNonce], 'warn');
              $suspicionVector['honeypotScore'] = 100.0;
          }
@@ -627,6 +633,7 @@
          $powCookie = $context->cookies['pow_clearance'] ?? null;
          if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie)) {
              $hasValidTicket = true;
+            MetricsManager::incrementCounter('tickets_valid_total');
              // On ne retourne pas tout de suite pour permettre le re-challenge
              // $this->log('Valid clearance ticket found');
              // return ['action' => 'next', 'score' => 0.0, 'vector' => ['ticket_valid' => 100]];
@@ -660,6 +667,7 @@
          // Mettre à jour les métriques du sous-réseau après le calcul du score final
          if ($finalScore > ($thresholds['low'] ?? 20)) {
             RequestUtils::updateSubnetMetrics($context, $deviceId, $finalScore);
+            MetricsManager::observeValue('suspicion_score', $finalScore, ['action' => 'high_score_subnet_update']);
          }
  
          // Logique pour challenger les nouveaux appareils (déplacée ici pour avoir le score final)
@@ -695,6 +703,7 @@
          $blockThreshold = $thresholds['block'] ?? 95;
          if ($finalScore >= $blockThreshold) {
              if ($this->logger) {
+                MetricsManager::incrementCounter('requests_total', ['status' => 'blocked']);
                  $this->logger->log('info', 'request_blocked', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
              }
              $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => $finalScore, 'vector' => $suspicionVector];
@@ -703,6 +712,7 @@
                  $decision['intendedAction'] = $decision['action'];
                  $decision['action'] = 'next';
                  unset($decision['status'], $decision['body']);
+                MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_block']);
              }
              $response = $decision;
          } else {
@@ -715,6 +725,7 @@
                  $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => $finalScore, 'vector' => $suspicionVector];
                  // Apply dry run logic here as well
                  if ($this->dryRun) {
+                    MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_block']);
                      $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
                      $decision['intendedAction'] = $decision['action'];
                      $decision['action'] = 'next';
@@ -735,6 +746,7 @@
                  $decision = ['action' => 'challenge', 'score' => $finalScore, 'vector' => $suspicionVector, 'status' => 403];
  
                  if ($this->dryRun) {
+                    MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_challenge']);
                      $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
                      $decision['intendedAction'] = $decision['action'];
                      $decision['action'] = 'next';
@@ -742,6 +754,7 @@
                      return $decision;
                  }
  
+                MetricsManager::incrementCounter('requests_total', ['status' => 'challenged']);
                  $this->log('Suspicious request - selecting challenge type', ['finalScore' => $finalScore]);
  
                  $nonce = bin2hex(random_bytes(16));
@@ -853,12 +866,15 @@
                  $response = $decision;
              } elseif ($hasValidTicket) {
                  // Si on arrive ici avec un ticket valide et un score bas, on autorise
+                MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
                  $this->log('Valid clearance ticket found and score is low - allowing request');
                  $response = ['action' => 'next', 'score' => 0.0, 'vector' => ['ticket_valid' => 100], 'intendedAction' => 'next'];
              } else {
                  // 6. Si le score est bas et qu'il n'y a pas de ticket, autoriser la requête
+                MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
                  $this->log('Request passed - no challenge required', ['finalScore' => $finalScore]);
                  if ($this->logger) {
+                    MetricsManager::observeValue('suspicion_score', $finalScore, ['action' => 'passed']);
                      $this->logger->log('info', 'request_passed', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
                  }
                  $response = ['action' => 'next', 'score' => $finalScore, 'vector' => $suspicionVector, 'intendedAction' => 'next'];

package/src/php/ProblemManager.php

@@ -4,9 +4,9 @@ declare(strict_types=1);
 
 namespace Anonympins\Fingerprint;
 
-use Anonympins\Fingerprint\Store\IStore;
 use Anonympins\Fingerprint\Optimization\FunctionRegistry;
 use Anonympins\Fingerprint\Optimization\ProblemInitializers;
+use Anonympins\Fingerprint\Store\IStore;
 
 class ProblemManager
 {