@anonympins/fingerprint 0.4.0 → 0.4.2

package/src/php/FingerprintEngine.php

@@ -1,1006 +1,1010 @@
-<?php
-
- declare(strict_types=1);
-
- namespace Anonympins\Fingerprint;
-
- use Anonympins\Fingerprint\Challenge\ChallengeUtils;
- use Anonympins\Fingerprint\Config\SecurityProfiles;
- use Anonympins\Fingerprint\Store\StoreManager;
- use Anonympins\Fingerprint\Utils\BlockList;
- use Anonympins\Fingerprint\Utils\Logger;
- use Anonympins\Fingerprint\Utils\MetricsManager;
- use Anonympins\Fingerprint\Utils\RequestUtils;
-
- // Correction de l'import
-
- /**
-  * Le moteur principal de la bibliothèque de fingerprinting.
-  * Orchestre l'identification, le calcul de suspicion et la gestion des challenges.
-  */
- class FingerprintEngine
- {
-     private array $securityConfig;
-     private bool $isProduction;
-     private BlockList $allowlist;
-     private bool $verbose;
-     private ?Logger $logger = null;
-     private bool $dryRun;
-
-     public function __construct(array $securityConfig)
-     {
-         $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
-         $this->securityConfig = $securityConfig;
-         $this->verbose = $securityConfig['verbose'] ?? false;
-         $this->allowlist = $this->buildAllowlist();
-         $this->logger = isset($securityConfig['logger']) && is_callable($securityConfig['logger']) ? new Logger($securityConfig['logger']) : null;
-         $this->dryRun = $securityConfig['dryRun'] ?? false;
-         $this->validateConfig($securityConfig);
-     }
-
-     private function validateConfig(array $config): void
-     {
-         if (empty($config)) {
-             $this->log('Warning: No securityConfig provided. Using default behaviors.', [], 'warn');
-             return;
-         }
-
-         $knownKeys = [
-             'weights', 'thresholds', 'cpu', 'ticketMaxAge', 'challengeTtl',
-             'deviceIdCookieMaxAge', 'challengePagePath', 'verbose', 'patterns',
-             'honeypot', 'threatIntel', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger', 'probationaryTtl',
-             'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
-             'similarityThreshold', 'summary', 'description'
-         ];
-
-         if (empty($config['weights'])) {
-             $this->log('Warning: `securityConfig.weights` is not defined. Suspicion scores will be 0.', [], 'warn');
-         }
-         if (empty($config['thresholds'])) {
-             $this->log('Warning: `securityConfig.thresholds` is not defined. Challenges may not be issued correctly.', [], 'warn');
-         }
-
-         foreach (array_keys($config) as $key) {
-             if (!in_array($key, $knownKeys, true)) {
-                 $this->log("Warning: Unknown key '{$key}' found in securityConfig. This might be a typo.", [], 'warn');
-             }
-         }
-     }
-
-     private function log(string $message, array $data = [], string $level = 'info'): void
-     {
-         if ($this->verbose) {
-             // Utilise le logger s'il est configuré, sinon error_log
-             if ($this->logger) {
-                 $this->logger->log($level, "[FingerprintEngine] " . $message, $data);
-             } else {
-                 $logMessage = "[FingerprintEngine] {$message}";
-                 if (!empty($data)) $logMessage .= ' ' . json_encode($data);
-                 error_log($logMessage);
-             }
-         }
-     }
-
-     public function calculateFinalScore(array $suspicionVector): float
-     {
-         $weights = $this->securityConfig['weights'] ?? [];
-         if (empty($weights)) {
-             return 0.0;
-         }
-
-         $score = 0.0;
-         foreach ($weights as $key => $weight) {
-             $score += ($suspicionVector[$key] ?? 0) * $weight;
-         }
-
-         return min(100.0, $score);
-     }
-
-     private function buildAllowlist(): BlockList
-     {
-         $blockList = new BlockList();
-         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
-
-         $allowlistRule = null;
-         foreach ($whitelistRules as $rule) {
-             if (($rule['type'] ?? '') === 'allowlist') {
-                 $allowlistRule = $rule;
-                 break;
-             }
-         }
-
-         if (empty($allowlistRule['entries'])) {
-             return $blockList;
-         }
-
-         foreach ($allowlistRule['entries'] as $entry) {
-             $blockList->add($entry);
-         }
-         return $blockList;
-     }
-
-     private function isIpInAllowlist(string $clientIp): bool
-     {
-         return $this->allowlist->check($clientIp);
-     }
-
-     private function isPathInAllowlist(string $requestPath): bool
-     {
-         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
-         $pathAllowlistRule = null;
-         foreach ($whitelistRules as $rule) {
-             if (($rule['type'] ?? '') === 'path_allowlist') {
-                 $pathAllowlistRule = $rule;
-                 break;
-             }
-         }
-
-         if (empty($pathAllowlistRule['entries'])) {
-             return false;
-         }
-
-         foreach ($pathAllowlistRule['entries'] as $entry) {
-             if (str_ends_with($entry, '*')) {
-                 $base = substr($entry, 0, -1);
-                 if (str_starts_with($requestPath, $base)) {
-                     return true;
-                 }
-             } elseif ($requestPath === $entry) {
-                 return true;
-             }
-         }
-
-         return false;
-     }
-
-     private function isHostPathInAllowlist(?string $requestHost, string $requestPath): bool
-     {
-         if (empty($requestHost)) {
-             return false;
-         }
- 
-         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
-         $hostPathRule = null;
-         foreach ($whitelistRules as $rule) {
-             if (($rule['type'] ?? '') === 'host_path_allowlist') {
-                 $hostPathRule = $rule;
-                 break;
-             }
-         }
- 
-         if (empty($hostPathRule['entries'])) {
-             return false;
-         }
- 
-         foreach ($hostPathRule['entries'] as $entry) {
-             if (RequestUtils::hostPathMatches($requestHost, $requestPath, $entry)) {
-                 return true;
-             }
-         }
-         return false;
-     }
-
-     /**
-      * Vérifie si une requête doit être exemptée en raison d'une règle de liste blanche.
-      */
-     private function checkAllowlists(RequestContext $context): bool
-     {
-         if ($this->isIpInAllowlist($context->clientIp)) {
-             $this->log('IP in allowlist - allowing request', ['clientIp' => $context->clientIp]);
-             return true;
-         }
-         if ($this->isPathInAllowlist($context->path)) {
-             $this->log('Path in allowlist - allowing request', ['path' => $context->path]);
-             return true;
-         }
-         if ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
-             $this->log('Host and path in allowlist - allowing request', ['host' => $context->getHeader('host'), 'path' => $context->path]);
-             return true;
-         }
-         // NOUVEAU: Vérifier la liste blanche GraphQL
-         if ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
-             $this->log('GraphQL operation in allowlist - allowing request', ['operation' => "{$context->graphqlOperation['type']}:{$context->graphqlOperation['name']}"]);
-             return true;
-         }
-         if ($this->verifyWhitelistedBot($context)) {
-             $this->log('Whitelisted bot verified - allowing request', ['clientIp' => $context->clientIp]);
-             return true;
-         }
- 
-         return false;
-     }
-
-     /**
-      * @return array{deviceId: string, deviceData: ?array, newCookie: ?array}
-       */
-     private function resolveRequestIdentity(RequestContext $context, array &$suspicionVector): array
-     {
-         $this->log('Resolving request identity', ['clientIp' => $context->clientIp, 'cookies' => $context->cookies]);
-         $store = StoreManager::getStore();
-         $existingDeviceId = $context->cookies['device_id'] ?? null; // @phpstan-ignore-line
-         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
-         $pendingCookieTtl = 120; // 2 minutes pour détecter la suppression
-
-         $deviceId = $existingDeviceId;
-         $deviceData = null;
-         $newCookie = null;
-
-         if ($deviceId) {
-             $deviceData = $store->get("device:{$deviceId}");
-         }
-
-         if ($deviceData === null) {
-             // Nouvel utilisateur ou cookie perdu/invalide
-             $pendingDeviceId = $store->get("pending_cookie:{$context->clientIp}");
-             if ($pendingDeviceId && !$existingDeviceId) {
-                 // La pénalité est maintenant ajoutée directement au vecteur de suspicion.
-                 $this->log('Cookie dropping detected', ['clientIp' => $context->clientIp, 'pendingDeviceId' => $pendingDeviceId]);
-                 $suspicionVector['cookieDroppingScore'] = 100.0;
-             }
-
-             $deviceId = bin2hex(random_bytes(16)); // UUID-like
-
-             // Préparer le cookie à envoyer
-             $newCookie = [
-                 'name' => 'device_id',
-                 'value' => $deviceId,
-                 'options' => [
-                     'httponly' => true,
-                     'secure' => $this->isProduction,
-                     'samesite' => 'Strict',
-                     'path' => '/',
-                 ]
-             ];
-             if (isset($this->securityConfig['deviceIdCookieMaxAge'])) {
-                 $newCookie['options']['expires'] = time() + ($this->securityConfig['deviceIdCookieMaxAge'] / 1000);
-             }
-
-             $store->set("pending_cookie:{$context->clientIp}", $deviceId, $pendingCookieTtl);
-
-             $deviceData = [
-                 'initialDeviceHash' => $currentDeviceHash,
-                 'ips' => [$context->clientIp],
-                 'requestHistory' => [],
-                 'lastUpdate' => time() * 1000,
-                 'lastFpHash' => $currentDeviceHash,
-                 'lastChangeTimestamp' => 0,
-                 'rapidChangeCount' => 0,
-                 'highScoreCount' => 0,
-                 'lastHighScoreTimestamp' => 0,
-             ];
-         } else {
-             // S'assurer que 'ips' est un tableau pour les opérations suivantes.
-             if (!isset($deviceData['ips']) || !is_array($deviceData['ips'])) { // @phpstan-ignore-line
-                 $deviceData['ips'] = [];
-             }
-         }
-
-         return [
-             'deviceId' => $deviceId,
-             'deviceData' => $deviceData,
-             'newCookie' => $newCookie,
-         ];
-     }
-
-     /**
-      * @return array<string, float>
-      */
-     public function getSuspicionVector(RequestContext $context, array &$suspicionVector): array
-     {
-         $store = StoreManager::getStore();
-         $identity = $this->resolveRequestIdentity($context, $suspicionVector);
-         $deviceData = $identity['deviceData'];
-         $deviceId = $identity['deviceId'];
-         if ($deviceData && ($deviceData['condemned'] ?? false)) {
-             $suspicionVector['honeypotScore'] = 100;
-             return $suspicionVector;
-         }
- 
-         // Si un nouveau cookie doit être défini, on le stocke temporairement dans le contexte
-         // pour que le code appelant puisse le gérer.
-         if ($identity['newCookie']) {
-             // Cette propriété n'est pas standard, on la préfixe pour éviter les conflits.
-             $context->newCookieForResponse = $identity['newCookie'];
-         }
- 
-         // Nettoyage périodique des données de l'appareil
-         if ((time() * 1000) - ($deviceData['lastUpdate'] ?? 0) > 10 * 60 * 1000) { // 10 minutes
-             $deviceData['ips'] = [];
-             $deviceData['rapidChangeCount'] = 0;
-         }
-         $deviceData['lastUpdate'] = time() * 1000;
- 
-         // --- Calcul des différents scores de suspicion ---
- 
-         // Score d'incohérence du fingerprint (déplacé ici pour être avec les autres)
-         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
-         $consistencyScore = FingerprintBuilder::compare($deviceData['initialDeviceHash'] ?? '', $currentDeviceHash);
-         $inconsistencyScore = min(100.0, max(0.0, (1 - $consistencyScore) * 200));
-         if ($consistencyScore < ($this->securityConfig['similarityThreshold'] ?? 0.7)) {
-             $inconsistencyScore = 100.0;
-         }
-
-         $behavioral = RequestUtils::getBehavioralIndicators($context, $deviceData);
-
-         // Score des anomalies d'en-têtes
-         $headerAnomalies = RequestUtils::getHeaderAnomalies($context);
-
-         // Score de spoofing TLS
-         $tlsSpoofing = RequestUtils::getTlsSpoofingScore($context);
-         $tlsSpoofingScore = (float)($tlsSpoofing['tlsSpoofingScore'] ?? 0.0);
-
-         // Advanced JA4 TLS Inconsistency checks
-         $ja4 = $context->getHeader('x-ja4-hash');
-         if ($ja4) {
-             $spoofedJa4s = [
-                 't13d1516h2_8daaf6152771_390237aa04be', // Chrome classique (curl-impersonate / tls-client)
-                 't13d1413h2_bc66258908f0_bc2531da1615', // Firefox statique (curl-impersonate-ff / curl_cffi)
-                 't13d1515h2_8daaf6152771_a729e2f67de4', // Safari statique (curl-impersonate-safari / tls-client)
-                 't13d1516h2_8daaf6152771_4be0df930c2c', // Alternatif Chrome (tls-client Go)
-                 't12d1516h2_8daaf6152771_390237aa04be', // Chrome usurpé dégradé en TLS 1.2
-                 't13d1516h2_e822d36d892d_93ec3f0b2f5b'  // Scraping bot OpenSSL customisé
-             ];
-             if (in_array($ja4, $spoofedJa4s, true)) {
-                 $tlsSpoofingScore = max($tlsSpoofingScore, 100.0);
-             }
-
-             $parsedJa4 = $this->parseJa4($ja4);
-             if ($parsedJa4) {
-                 $ua = $context->getHeader('user-agent') ?? '';
-                 $uaParts = $this->parseUserAgent($ua);
-
-                 // Check 1: Incohérence ALPN / HTTP Version
-                 $httpVersion = $context->httpVersion ?? '1.1';
-                 if ($parsedJa4['alpn'] === 'h2' && ($httpVersion === '1.1' || $httpVersion === '1.0')) {
-                     $hasProxy = $context->getHeader('via') || $context->getHeader('forwarded') || $context->getHeader('x-forwarded-proto') || $context->getHeader('x-forwarded-for');
-                     if (!$hasProxy) {
-                         $tlsSpoofingScore = max($tlsSpoofingScore, 40.0);
-                     }
-                 }
-
-                 // Check 2: Incohérence OS/Plateforme vs Capabilities TLS
-                 if ($parsedJa4['version'] === '12' && ($uaParts['os'] === 'iOS' || $uaParts['os'] === 'macOS') && ($uaParts['browser'] && str_starts_with($uaParts['browser'], 'Safari'))) {
-                     $tlsSpoofingScore = max($tlsSpoofingScore, 60.0);
-                 }
-
-                 // Check 3: Incohérence User-Agent vs Signature JA4
-                 if ($uaParts['browser'] && str_starts_with($uaParts['browser'], 'Chrome') && $parsedJa4['alpn'] === '00') {
-                     $tlsSpoofingScore = max($tlsSpoofingScore, 50.0);
-                 }
-                 if ($uaParts['browser'] && str_starts_with($uaParts['browser'], 'Firefox') && $parsedJa4['extensionsCount'] > 15) {
-                     $tlsSpoofingScore = max($tlsSpoofingScore, 50.0);
-                 }
-
-                 // Check 4: La stagnation (Lack of Entropy / Genericity)
-                 if ($uaParts['browser']) {
-                     $ja4Key = "ja4-browsers:{$ja4}";
-                     $seenBrowsers = $store->get($ja4Key) ?: [];
-                     if (!is_array($seenBrowsers)) {
-                         $seenBrowsers = [];
-                     }
-                     $browserFamily = explode('/', $uaParts['browser'])[0] ?? null;
-                     if ($browserFamily && !in_array($browserFamily, $seenBrowsers, true)) {
-                         $seenBrowsers[] = $browserFamily;
-                         $store->set($ja4Key, $seenBrowsers, 86400);
-                     }
-                     if (count($seenBrowsers) > 1) {
-                         $tlsSpoofingScore = max($tlsSpoofingScore, 80.0);
-                     }
-                 }
-             }
-         }
-
-         // Score d'incohérence temporelle (attaque par rejeu)
-         $timeInconsistency = RequestUtils::getTimeInconsistencyScore($context);
-
-         // Score des incohérences entre couches (client vs serveur)
-         $crossLayerInconsistency = RequestUtils::getCrossLayerInconsistency($context);
-
-         // Score des patterns de requêtes (scraping, vélocité)
-         $requestPattern = RequestUtils::getRequestPatternScore($context, $deviceData, $this->securityConfig['patterns'] ?? []);
-
-         // Score des honeypots
-         $honeypot = RequestUtils::getHoneypotScore($context, $this->securityConfig['honeypot'] ?? []);
-
-         // Score des métriques comportementales client (souris, clavier)
-         $behavior = RequestUtils::getBehaviorScore($context);
-
-         // Score de détection de bot explicite (marqueurs d'automatisation)
-         $bot = RequestUtils::getBotScore($context);
-
-         // Score de variance des clics
-         $clickVariance = RequestUtils::getClickVarianceScore($context);
-
-         // Score basé sur les listes de menaces (Threat Intelligence)
-         $threatIntel = RequestUtils::getThreatIntelScore($context, $this->securityConfig['threatIntel'] ?? []);
-
-         // Score d'incohérence des Client-Hints
-         $clientHintsInconsistency = RequestUtils::getClientHintsInconsistencyScore($context);
-
-         // NOUVEAU: Score de réputation du sous-réseau IP
-         $subnetScore = RequestUtils::getSubnetScore($context, $deviceId);
-
-         // Assemblage du vecteur de suspicion final
-         $suspicionVector = array_merge($suspicionVector, [
-             'inconsistencyScore' => $inconsistencyScore,
-             'historyScore' => $behavioral['historyScore'],
-             'rotationScore' => $behavioral['rotationScore'],
-             'headerAnomalyScore' => $headerAnomalies['headerAnomalyScore'],
-             'tlsSpoofingScore' => $tlsSpoofingScore,
-             'timeInconsistencyScore' => $timeInconsistency['timeInconsistencyScore'],
-             'crossLayerInconsistencyScore' => $crossLayerInconsistency['crossLayerInconsistencyScore'],
-             'requestPatternScore' => $requestPattern['requestPatternScore'], // Ce score est maintenant calculé
-             'honeypotScore' => $honeypot['honeypotScore'],
-             'behaviorScore' => $behavior['behaviorScore'],
-             'botScore' => $bot['botScore'],
-             'clickVarianceScore' => $clickVariance['clickVarianceScore'],
-             'threatIntelScore' => $threatIntel['threatIntelScore'],
-             'clientHintsInconsistencyScore' => $clientHintsInconsistency['clientHintsInconsistencyScore'],
-             'subnetScore' => $subnetScore['subnetScore'],
-         ]);
- 
-         // Sauvegarder l'état mis à jour de l'appareil dans le store
-         $store->set("device:{$deviceId}", $deviceData);
- 
-         return $suspicionVector;
-     }
-
-     /**
-      * Parse a basic User-Agent string.
-      */
-     private function parseUserAgent(string $ua): array
-     {
-         $result = ['browser' => null, 'os' => null];
-         
-         if (str_contains($ua, 'Chrome') && !str_contains($ua, 'Edg')) {
-             $result['browser'] = 'Chrome';
-             if (preg_match('/Chrome\/(\d+)/', $ua, $matches)) {
-                 $result['browser'] .= '/' . $matches[1];
-             }
-         } elseif (str_contains($ua, 'Firefox')) {
-             $result['browser'] = 'Firefox';
-             if (preg_match('/Firefox\/(\d+)/', $ua, $matches)) {
-                 $result['browser'] .= '/' . $matches[1];
-             }
-         } elseif (str_contains($ua, 'Safari') && !str_contains($ua, 'Chrome')) {
-             $result['browser'] = 'Safari';
-             if (preg_match('/Version\/(\d+)/', $ua, $matches)) {
-                 $result['browser'] .= '/' . $matches[1];
-             }
-         } elseif (str_contains($ua, 'Edg')) {
-             $result['browser'] = 'Edge';
-             if (preg_match('/Edg\/(\d+)/', $ua, $matches)) {
-                 $result['browser'] .= '/' . $matches[1];
-             }
-         }
-
-         if (str_contains($ua, 'Windows NT 10.0')) $result['os'] = 'Windows 10';
-         elseif (str_contains($ua, 'Windows NT 6.1')) $result['os'] = 'Windows 7';
-         elseif (str_contains($ua, 'Mac OS X')) $result['os'] = 'macOS';
-         elseif (str_contains($ua, 'Linux') && !str_contains($ua, 'Android')) $result['os'] = 'Linux';
-         elseif (str_contains($ua, 'Android')) $result['os'] = 'Android';
-         elseif (str_contains($ua, 'iPhone') || str_contains($ua, 'iPad')) $result['os'] = 'iOS';
-
-         return $result;
-     }
-
-     /**
-      * Parse JA4 string into protocol, version, ALPN etc.
-      */
-     private function parseJa4(?string $ja4): ?array
-     {
-         if (empty($ja4)) return null;
-         $parts = explode('_', $ja4);
-         $ja4a = $parts[0];
-         if (strlen($ja4a) < 10) return null;
-         return [
-             'protocol' => $ja4a[0],
-             'version' => substr($ja4a, 1, 2),
-             'sni' => $ja4a[3],
-             'ciphersCount' => (int)substr($ja4a, 4, 2),
-             'extensionsCount' => (int)substr($ja4a, 6, 2),
-             'alpn' => substr($ja4a, 8, 2),
-             'ja4b' => $parts[1] ?? null,
-             'ja4c' => $parts[2] ?? null
-         ];
-     }
-
-     /**
-      * Traite une requête entrante et retourne une décision.
-      * @param RequestContext $context Le contexte de la requête.
-      * @return array{action: string, score: float, vector: array, status?: int, body?: mixed, cookie?: array, path?: string, newCookieForResponse?: array}
-      */
-     public function processRequest(RequestContext $context): array
-     {
-         // Initialiser le vecteur de suspicion pour éviter les erreurs de type.
-         $suspicionVector = [];
-
-         $this->log('Processing request', ['clientIp' => $context->clientIp, 'path' => $context->path]);
- 
-         // Parse GraphQL query if applicable
-         if ($context->path === '/graphql' && !empty($context->body)) {
-             $gqlInfo = RequestUtils::parseGraphQLQuery(is_array($context->body) ? $context->body : []);
-             if ($gqlInfo) {
-                 $context->graphqlOperation = $gqlInfo;
-             }
-         }
- 
-         // 1. Vérifier les listes blanches
-         if ($this->checkAllowlists($context)) {
-             return ['action' => 'next', 'score' => 0.0, 'vector' => ['whitelisted' => 100.0]];
-            MetricsManager::incrementCounter('requests_total', ['status' => 'whitelisted']);
-         }
- 
-         // Initialiser le vecteur de suspicion
-         $thresholds = $this->securityConfig['thresholds'];
- 
-         // 2. Gérer la soumission d'une solution de challenge (PRIORITÉ HAUTE)
-         $powNonce = $context->query['pow_nonce'] ?? null;
-         $isChallengeSubmission = $powNonce && (
-             isset($context->query['pow_solution']) || 
-             isset($context->query['pow_solution_cpu']) ||
-             (isset($context->query['pow_type']) && $context->query['pow_type'] === 'useful_work_task')
-         );
-         if ($isChallengeSubmission) {
-             $this->log('Challenge solution submitted', ['pow_type' => $context->query['pow_type'] ?? 'unknown', 'nonce' => $powNonce]);
-             $store = StoreManager::getStore();
-             $challengeContext = $store->get("secret:{$powNonce}");
-             $powType = $context->query['pow_type'] ?? null;
- 
-             if ($challengeContext) {
-                 $isValid = false;
-                 $ticket = null;
- 
-                 // Vérification de la cohérence du fingerprint
-                 $solverFingerprint = $context->query['pow_fp'] ?? RequestUtils::getCompositeDeviceHash($context);
-                 $originalFingerprint = $challengeContext['fingerprint'] ?? '';
-                 $similarity = FingerprintBuilder::compare($originalFingerprint, $solverFingerprint);
-                 $similarityThreshold = $this->securityConfig['similarityThreshold'] ?? 0.95;
- 
-                 if ($similarity < $similarityThreshold) {
-                     $this->log('Fingerprint mismatch - challenge solved on a different machine!', [
-                         'similarity' => round($similarity, 4),
-                         'threshold' => $similarityThreshold
-                     ], 'warn');
-                     $isValid = false;
-                 } else {
-                     // Le fingerprint est cohérent, on peut valider la solution
-                     if ($powType === 'cpu_target' || $powType === 'cpu_mem') {
-                         $cpuSolution = $context->query['pow_solution_cpu'] ?? $context->query['pow_solution'] ?? null;
-                         if ($cpuSolution) {
-                             $ticket = ChallengeUtils::verifyCpuTargetPoWAndGenerateTicket($context->clientIp, 3600000, $powNonce, $cpuSolution, $challengeContext);
-                             $isValid = $ticket !== null;
- 
-                             if ($powType === 'cpu_mem') {
-                                 $memSolution = $context->query['pow_solution_mem'] ?? null;
-                                 $isMemValid = $memSolution ? ChallengeUtils::verifyMemoryPoW($powNonce, $memSolution, $challengeContext['memDifficulty'] ?? 0, $challengeContext['clientSecret'] ?? '') : false;
-                                 $isValid = $isValid && $isMemValid;
-                             }
-                         }
-                     } elseif ($powType === 'useful_work_task') {
-                         $problemId = $context->query['pow_problem_id'] ?? null;
-                         $workResultJson = $context->query['pow_solution_work_result'] ?? null;
-                         if ($problemId && $workResultJson) {
-                             $workResult = json_decode($workResultJson, true);
-                             $this->log('Verifying useful work solution.', [
-                                 'problemId' => $problemId,
-                                 'receivedData' => $workResult,
-                                 'jsonLastError' => json_last_error_msg()
-                             ]);
-                             if (json_last_error() === JSON_ERROR_NONE) {
-                                 // @phpstan-ignore-next-line - L'instance est gérée par le singleton
-                                 $problemManager = \Anonympins\Fingerprint\ProblemManager::getInstance($this->securityConfig['usefulWorkConfigPath'] ?? null, $store);
-                                 // FIX: La solution est directement le $workResult, pas une sous-propriété.
-                                 $problemManager->integrateSolution($problemId, $workResult);
-                                 $isValid = true;
-                                 // FIX: Générer un vrai ticket pour uPoW, comme pour un PoW normal.
-                                 $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000; // 1 heure par défaut
-                                 $expiry = (int)floor(microtime(true) * 1000) + $ticketTtl;
-                                 $signature = hash_hmac('sha256', "{$context->clientIp}:{$expiry}", ChallengeUtils::getPowSecret());
-                                 $ticket = "{$expiry}:{$signature}";
-                             }
-                         }
-                     }
-                 }
- 
-                 if ($isValid) {
-                     $store->delete("secret:{$powNonce}");
-                     $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000;
-                    MetricsManager::incrementCounter('challenges_solved_total');
-                     $this->log('Challenge solution valid - issuing ticket', ['ticketMaxAge' => $ticketTtl]);
- 
-                     return [
-                 // ... (le reste de la logique de redirection)
-                 'action' => 'redirect',
-                 'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
-                 'score' => 0.0,
-                         'action' => 'redirect',
-                         'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
-                         'score' => 0.0,
-                         'vector' => ['challenge_solved' => 100],
-                         'cookie' => ['name' => 'pow_clearance', 'value' => $ticket, 'options' => ['httponly' => true, 'secure' => $this->isProduction, 'expires' => time() + ($ticketTtl / 1000), 'path' => '/']]
-                     ];
-                 }
-             }
-             // Si la solution est invalide ou le nonce est expiré, on pénalise fortement pour la suite.
-            MetricsManager::incrementCounter('challenges_failed_total');
-             $this->log('Challenge solution invalid or context expired', ['nonce' => $powNonce], 'warn');
-             $suspicionVector['honeypotScore'] = 100.0;
-         }
- 
-         // 3. Vérifier un ticket existant
-         $hasValidTicket = false;
-         $powCookie = $context->cookies['pow_clearance'] ?? null;
-         if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie)) {
-             $hasValidTicket = true;
-            MetricsManager::incrementCounter('tickets_valid_total');
-             // On ne retourne pas tout de suite pour permettre le re-challenge
-             // $this->log('Valid clearance ticket found');
-             // return ['action' => 'next', 'score' => 0.0, 'vector' => ['ticket_valid' => 100]];
-         }
- 
-         // 4. Calculer le vecteur et le score de suspicion
-         // Résoudre l'identité et vérifier le statut "condamné"
-         $store = StoreManager::getStore();
-         $identity = $this->resolveRequestIdentity($context, $suspicionVector);
-         $deviceId = $identity['deviceId'];
-         $deviceData = $identity['deviceData'];
-         if ($deviceData && ($deviceData['condemned'] ?? false)) {
-             $this->log('Device condemned - blocking request', ['deviceId' => $deviceId], 'warn');
-             $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => 100, 'vector' => ['honeypotScore' => 100]];
-             if ($this->dryRun) {
-                 $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
-                 $decision['intendedAction'] = $decision['action'];
-                 $decision['action'] = 'next';
-                 unset($decision['status'], $decision['body']);
-             }
-             return $decision;
-         }
-
-         $suspicionVector = $this->getSuspicionVector($context, $suspicionVector);
-         $finalScore = $this->calculateFinalScore($suspicionVector);
-         $this->log('Suspicion vector and final score calculated', [
-             'finalScore' => round($finalScore, 2),
-             'vector' => $suspicionVector
-         ]);
-
-         // Mettre à jour les métriques du sous-réseau après le calcul du score final
-         if ($finalScore > ($thresholds['low'] ?? 20)) {
-            RequestUtils::updateSubnetMetrics($context, $deviceId, $finalScore);
-            MetricsManager::observeValue('suspicion_score', $finalScore, ['action' => 'high_score_subnet_update']);
-         }
- 
-         // Logique pour challenger les nouveaux appareils (déplacée ici pour avoir le score final)
-         $isNewDevice = $identity['newCookie'] !== null;
-         if ($isNewDevice && ($this->securityConfig['challengeNewDevices'] ?? false) && $finalScore < $thresholds['low']) {
-             $this->log('New device - enforcing minimum challenge score', [
-                 'originalScore' => round($finalScore, 2),
-                 'enforcedScore' => (float)$thresholds['low']
-             ]);
-             $finalScore = (float)$thresholds['low'];
-         }
- 
-         // Vérifier les URL pièges (après calcul du score)
-         $lastNonce = $deviceData['lastChallengeNonce'] ?? null;
-         if ($lastNonce && ChallengeUtils::verifyTrapUrl($context->path, $context->query['sig'] ?? '', $lastNonce)) {
-             if ($this->logger) {
-                 $this->logger->log('info', 'trap_triggered', ['deviceId' => $deviceId, 'score' => 100, 'path' => $context->path, 'vector' => ['honeypotScore' => 100]]);
-             }
-             $this->log('Honeypot trap URL triggered - condemning device', ['path' => $context->path, 'deviceId' => $deviceId]);
-             $deviceData['condemned'] = true; // @phpstan-ignore-line
-             $store->set("device:{$deviceId}", $deviceData);
-             $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => 100, 'vector' => ['honeypotScore' => 100]];
-             if ($this->dryRun) {
-                 $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
-                 $decision['intendedAction'] = $decision['action'];
-                 $decision['action'] = 'next';
-                 unset($decision['status'], $decision['body']);
-             }
-             return $decision;
-         }
- 
-         // 5. Prendre une décision basée sur le score - Vérifier le blocage d'abord.
-         $blockThreshold = $thresholds['block'] ?? 95;
-         if ($finalScore >= $blockThreshold) {
-             if ($this->logger) {
-                MetricsManager::incrementCounter('requests_total', ['status' => 'blocked']);
-                 $this->logger->log('info', 'request_blocked', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
-             }
-             $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => $finalScore, 'vector' => $suspicionVector];
-             if ($this->dryRun) {
-                 $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
-                 $decision['intendedAction'] = $decision['action'];
-                 $decision['action'] = 'next';
-                 unset($decision['status'], $decision['body']);
-                MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_block']);
-             }
-             $response = $decision;
-         } else {
-             // Logique de re-challenge
-             // Si un nonce est présent mais que ce n'est pas une soumission de solution valide, c'est une sonde.
-             if ($powNonce && !$isChallengeSubmission) {
-                 $this->log('Honeypot probe detected - blocking request', ['path' => $context->path, 'pow_nonce' => $powNonce]);
-                 $suspicionVector['honeypotScore'] = 100.0;
-                 $finalScore = $this->calculateFinalScore($suspicionVector); // Recalculate score
-                 $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => $finalScore, 'vector' => $suspicionVector];
-                 // Apply dry run logic here as well
-                 if ($this->dryRun) {
-                    MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_block']);
-                     $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
-                     $decision['intendedAction'] = $decision['action'];
-                     $decision['action'] = 'next';
-                     unset($decision['status'], $decision['body']);
-                 }
-                 return $decision;
-             }
-
-             $highThreshold = $thresholds['high'] ?? 75;
-             $mustReChallenge = $finalScore >= $highThreshold && $hasValidTicket;
- 
-             $lowThreshold = $thresholds['low'] ?? 20;
-             if (($finalScore >= $lowThreshold && !$hasValidTicket) || $mustReChallenge) {
-                 if ($mustReChallenge) {
-                     $this->log('High suspicion score detected - overriding valid ticket to re-issue challenge', ['finalScore' => $finalScore, 'deviceId' => $deviceId]);
-                 }
- 
-                 $decision = ['action' => 'challenge', 'score' => $finalScore, 'vector' => $suspicionVector, 'status' => 403];
- 
-                 if ($this->dryRun) {
-                    MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_challenge']);
-                     $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
-                     $decision['intendedAction'] = $decision['action'];
-                     $decision['action'] = 'next';
-                     unset($decision['status']);
-                     return $decision;
-                 }
- 
-                MetricsManager::incrementCounter('requests_total', ['status' => 'challenged']);
-                 $this->log('Suspicious request - selecting challenge type', ['finalScore' => $finalScore]);
- 
-                 $nonce = bin2hex(random_bytes(16));
-                 $clientSecret = bin2hex(random_bytes(16));
- 
-                 // --- NOUVELLE LOGIQUE uPoW ---
-                 $shouldUseUsefulWork = ($this->securityConfig['enableUsefulWork'] ?? false) && (
-                     ($this->securityConfig['forceUsefulWork'] ?? false) || (random_int(0, 255) / 255) > 0.5
-                 );
-
-                 // Déterminer si c'est une requête API avant de choisir le type de challenge
-                 $isApiRequest = false;
-                 if (isset($this->securityConfig['isApiRequest']) && is_callable($this->securityConfig['isApiRequest'])) {
-                     $isApiRequest = ($this->securityConfig['isApiRequest'])($context);
-                 }
-
-                 if ($shouldUseUsefulWork) {
-                     $this->log('Issuing a useful work challenge', ['finalScore' => $finalScore]);
-                     $problemManager = ProblemManager::getInstance($this->securityConfig['usefulWorkConfigPath'] ?? null, $store);
-                     $work = $problemManager->dispatchWork($finalScore);
-
-                     if ($work !== null) {
-                         $store->set("secret:{$nonce}", ['clientSecret' => $clientSecret, 'originalPath' => $context->path], 300);
-                         $challengePayload = [
-                             'challenge' => [
-                                 'type' => 'useful_work_task',
-                                 'nonce' => $nonce,
-                                 'clientSecret' => $clientSecret,
-                                 'usefulWorkTask' => [
-                                     'problemId' => $work['problemId'],
-                                     'task' => $work['task']
-                                 ]
-                             ]
-                         ];
-                         $decision['body'] = $challengePayload;
-                         return $decision;
-                     } else {
-                         // This case handles when uPoW is enabled but dispatching a task fails (e.g., config not found).
-                         // We log it and fall through to the standard PoW challenge.
-                         $this->log('Useful work dispatch failed, falling back to standard PoW.', [], 'warn');
-                         $shouldUseUsefulWork = false; // Explicitly disable for this request
-                     }
-                 }
-
-                 // --- FIN DE LA LOGIQUE uPoW (le reste est le fallback) ---
-
-                 $suspicionFactor = ($finalScore - $lowThreshold) / (($thresholds['high'] ?? 75) - $lowThreshold);
-                 $suspicionFactor = max(0, min(1.5, $suspicionFactor));
- 
-                 $cpuChallengeDetails = [
-                     'type' => 'cpu_target',
-                     'nonce' => $nonce,
-                     'target' => ChallengeUtils::calculateCpuTarget($suspicionFactor, $this->securityConfig),
-                     'path' => $context->path,
-                 ];
- 
-                 $memActivationFactor = max(0, ($suspicionFactor - 0.25) / 0.75);
-                 $memDifficulty = (int)round($memActivationFactor * 48); // 0 à 48MB
- 
-                 $originalFingerprint = RequestUtils::getCompositeDeviceHash($context);
-                 $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint);
- 
-                 $challengeContext = [
-                     'clientSecret' => $clientSecret,
-                     'cpuTarget' => $cpuChallengeDetails['target'],
-                     'suspicionScore' => $finalScore,
-                     'fingerprint' => $originalFingerprint,
-                     'memDifficulty' => $memDifficulty,
-                     'baseBlock' => $baseBlock,
-                     'originalPath' => $context->path,
-                 ];
- 
-                 $store->set("secret:{$nonce}", $challengeContext, $this->securityConfig['challengeTtl'] ?? 300);
- 
-                 // Associer le nonce au device pour la vérification des URL pièges
-                 if ($deviceData) {
-                     $deviceData['lastChallengeNonce'] = $nonce;
-                     $store->set("device:{$deviceId}", $deviceData); // @phpstan-ignore-line
-                 }
- 
-                 $trapUrls = [ChallengeUtils::generateTrapUrl($nonce), ChallengeUtils::generateTrapUrl($nonce)];
-                 $this->log('Challenge issued', ['nonce' => $nonce, 'ttl' => $this->securityConfig['challengeTtl'] ?? 300]);
- 
-                 if ($this->logger) {
-                     $this->logger->log('info', 'challenge_issued', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
-                 }
- 
-                 // Pour les API, retourner un challenge JSON
-                 if ($isApiRequest) {
-                     $challengePayload = [
-                         'challenge' => [
-                             'type' => 'cpu_mem',
-                             'nonce' => $nonce,
-                             'clientSecret' => $clientSecret,
-                             'cpuTarget' => $cpuChallengeDetails['target'],
-                             'memDifficulty' => $memDifficulty,
-                             'baseBlock' => array_values(unpack('C*', $baseBlock)), // Envoyer comme un tableau d'octets
-                         ]
-                     ];
-                     $decision['body'] = $challengePayload;
-                 } else {
-                     // Pour les navigateurs, retourner une page HTML
-                     $pageBody = ChallengeUtils::generateCombinedPoWChallengePage(
-                         $cpuChallengeDetails, $memDifficulty, $clientSecret, 
-                         $this->securityConfig, $trapUrls, $originalFingerprint
-                     );
-                     $decision['body'] = $pageBody;
-                 }
-                 $response = $decision;
-             } elseif ($hasValidTicket) {
-                 // Si on arrive ici avec un ticket valide et un score bas, on autorise
-                MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
-                 $this->log('Valid clearance ticket found and score is low - allowing request');
-                 $response = ['action' => 'next', 'score' => 0.0, 'vector' => ['ticket_valid' => 100], 'intendedAction' => 'next'];
-             } else {
-                 // 6. Si le score est bas et qu'il n'y a pas de ticket, autoriser la requête
-                MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
-                 $this->log('Request passed - no challenge required', ['finalScore' => $finalScore]);
-                 if ($this->logger) {
-                    MetricsManager::observeValue('suspicion_score', $finalScore, ['action' => 'passed']);
-                     $this->logger->log('info', 'request_passed', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
-                 }
-                 $response = ['action' => 'next', 'score' => $finalScore, 'vector' => $suspicionVector, 'intendedAction' => 'next'];
-             }
-         }
- 
-         // Si un nouveau cookie d'identification a été généré, on l'ajoute à la réponse.
-         if (isset($context->newCookieForResponse)) {
-             $response['newCookieForResponse'] = $context->newCookieForResponse;
-         }
- 
-         return $response;
-     }
-
-     /**
-      * Vérifie si l'opération GraphQL correspond à une entrée dans la liste blanche.
-      */
-     private function isGraphqlOperationInAllowlist(?string $operationType, ?string $operationName): bool
-     {
-         if (empty($operationType) || empty($operationName)) {
-             return false;
-         }
- 
-         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
-         $graphqlRule = null;
-         foreach ($whitelistRules as $rule) {
-             if (($rule['type'] ?? '') === 'graphql_operation_allowlist') {
-                 $graphqlRule = $rule;
-                 break;
-             }
-         }
- 
-         if (empty($graphqlRule['entries'])) {
-             return false;
-         }
- 
-         foreach ($graphqlRule['entries'] as $entry) {
-             [$entryType, $entryName] = explode(':', $entry, 2);
-             if ($entryType !== $operationType) continue;
- 
-             if ($entryName === $operationName || $entryName === '*') return true;
- 
-             if (str_ends_with($entryName, '*') && str_starts_with($operationName, substr($entryName, 0, -1))) return true;
-         }
- 
-         return false;
-     }
- 
-     /**
-      * Vérifie si une requête provient d'un bot légitime et whitelisté (ex: Googlebot)
-      * en utilisant des recherches DNS inversées et directes. Le résultat est mis en cache.
-      */
-     private function verifyWhitelistedBot(RequestContext $context): bool
-     {
-         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
-         $botRules = array_filter($whitelistRules, fn($rule) => isset($rule['hostnameSuffix']));
-         if (empty($botRules)) {
-             return false;
-         }
-
-         $userAgent = $context->getHeader('user-agent') ?? '';
-         $matchedRule = null;
-         foreach ($botRules as $rule) {
-             if (isset($rule['userAgent']) && preg_match('/' . $rule['userAgent'] . '/', $userAgent)) {
-                 $matchedRule = $rule;
-                 break;
-             }
-         }
-         if ($matchedRule === null) {
-             return false;
-         }
-
-         $store = StoreManager::getStore();
-         $cacheKey = "ip-whitelist:{$context->clientIp}";
-         $cachedStatus = $store->get($cacheKey);
-
-         if ($cachedStatus === 'verified') return true;
-         if ($cachedStatus === 'failed') return false;
-
-         try {
-             // 1. Reverse DNS lookup. gethostbyaddr peut être lent, mais c'est la méthode standard.
-             // @ pour supprimer les warnings si l'IP n'a pas de PTR record.
-             $hostname = @gethostbyaddr($context->clientIp);
-             if ($hostname === false || $hostname === $context->clientIp) {
-                 $store->set($cacheKey, 'failed', 86400);
-                 return false;
-             }
-
-             $validHostname = null;
-             if (str_ends_with($hostname, $matchedRule['hostnameSuffix'])) {
-                 $validHostname = $hostname;
-             }
-
-             if ($validHostname === null) {
-                 $store->set($cacheKey, 'failed', 86400);
-                 return false;
-             }
- 
-             // 2. Forward DNS lookup
-             $addresses = array_merge(dns_get_record($validHostname, DNS_A) ?: [], dns_get_record($validHostname, DNS_AAAA) ?: []);
-             $ips = [];
-             foreach ($addresses as $address) {
-                 if (isset($address['ip'])) {
-                     $ips[] = $address['ip'];
-                 }
-                 if (isset($address['ipv6'])) {
-                     $ips[] = $address['ipv6'];
-                 }
-             }
- 
-             if (in_array($context->clientIp, $ips, true)) {
-                 $store->set($cacheKey, 'verified', 86400);
-                 return true;
-             }
-         } catch (\Exception $e) { /* DNS errors */ }
-
-         $store->set($cacheKey, 'failed', 86400);
-         return false;
-     }
-
-    /**
-     * @internal For testing purposes only.
-     */
-    public function getProblems(): array
-    {
-        $problemManager = ProblemManager::getInstance();
-        return $problemManager->getProblems();
-    }
- }
+<?php
+
+ declare(strict_types=1);
+
+ namespace Anonympins\Fingerprint;
+
+ use Anonympins\Fingerprint\Challenge\ChallengeUtils;
+ use Anonympins\Fingerprint\Config\SecurityProfiles;
+ use Anonympins\Fingerprint\Store\StoreManager;
+ use Anonympins\Fingerprint\Utils\BlockList;
+ use Anonympins\Fingerprint\Utils\Logger;
+ use Anonympins\Fingerprint\Utils\MetricsManager;
+ use Anonympins\Fingerprint\Utils\RequestUtils;
+
+ // Correction de l'import
+
+ /**
+  * Le moteur principal de la bibliothèque de fingerprinting.
+  * Orchestre l'identification, le calcul de suspicion et la gestion des challenges.
+  */
+ class FingerprintEngine
+ {
+     private array $securityConfig;
+     private bool $isProduction;
+     private BlockList $allowlist;
+     private bool $verbose;
+     private ?Logger $logger = null;
+     private bool $dryRun;
+
+     public function __construct(array $securityConfig)
+     {
+         $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
+         $this->securityConfig = $securityConfig;
+         $this->verbose = $securityConfig['verbose'] ?? false;
+         $this->allowlist = $this->buildAllowlist();
+         $this->logger = isset($securityConfig['logger']) && is_callable($securityConfig['logger']) ? new Logger($securityConfig['logger']) : null;
+         $this->dryRun = $securityConfig['dryRun'] ?? false;
+         $this->validateConfig($securityConfig);
+     }
+
+     private function validateConfig(array $config): void
+     {
+         if (empty($config)) {
+             $this->log('Warning: No securityConfig provided. Using default behaviors.', [], 'warn');
+             return;
+         }
+
+         $knownKeys = [
+             'weights', 'thresholds', 'cpu', 'ticketMaxAge', 'challengeTtl',
+             'deviceIdCookieMaxAge', 'challengePagePath', 'verbose', 'patterns',
+             'honeypot', 'threatIntel', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger', 'probationaryTtl',
+             'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
+             'similarityThreshold', 'summary', 'description'
+         ];
+
+         if (empty($config['weights'])) {
+             $this->log('Warning: `securityConfig.weights` is not defined. Suspicion scores will be 0.', [], 'warn');
+         }
+         if (empty($config['thresholds'])) {
+             $this->log('Warning: `securityConfig.thresholds` is not defined. Challenges may not be issued correctly.', [], 'warn');
+         }
+
+         foreach (array_keys($config) as $key) {
+             if (!in_array($key, $knownKeys, true)) {
+                 $this->log("Warning: Unknown key '{$key}' found in securityConfig. This might be a typo.", [], 'warn');
+             }
+         }
+     }
+
+     private function log(string $message, array $data = [], string $level = 'info'): void
+     {
+         if ($this->verbose) {
+             // Utilise le logger s'il est configuré, sinon error_log
+             if ($this->logger) {
+                 $this->logger->log($level, "[FingerprintEngine] " . $message, $data);
+             } else {
+                 $logMessage = "[FingerprintEngine] {$message}";
+                 if (!empty($data)) $logMessage .= ' ' . json_encode($data);
+                 error_log($logMessage);
+             }
+         }
+     }
+
+     public function calculateFinalScore(array $suspicionVector): float
+     {
+         $weights = $this->securityConfig['weights'] ?? [];
+         if (empty($weights)) {
+             return 0.0;
+         }
+
+         $score = 0.0;
+         foreach ($weights as $key => $weight) {
+             $score += ($suspicionVector[$key] ?? 0) * $weight;
+         }
+
+         return min(100.0, $score);
+     }
+
+     private function buildAllowlist(): BlockList
+     {
+         $blockList = new BlockList();
+         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
+
+         $allowlistRule = null;
+         foreach ($whitelistRules as $rule) {
+             if (($rule['type'] ?? '') === 'allowlist') {
+                 $allowlistRule = $rule;
+                 break;
+             }
+         }
+
+         if (empty($allowlistRule['entries'])) {
+             return $blockList;
+         }
+
+         foreach ($allowlistRule['entries'] as $entry) {
+             $blockList->add($entry);
+         }
+         return $blockList;
+     }
+
+     private function isIpInAllowlist(string $clientIp): bool
+     {
+         return $this->allowlist->check($clientIp);
+     }
+
+     private function isPathInAllowlist(string $requestPath): bool
+     {
+         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
+         $pathAllowlistRule = null;
+         foreach ($whitelistRules as $rule) {
+             if (($rule['type'] ?? '') === 'path_allowlist') {
+                 $pathAllowlistRule = $rule;
+                 break;
+             }
+         }
+
+         if (empty($pathAllowlistRule['entries'])) {
+             return false;
+         }
+
+         foreach ($pathAllowlistRule['entries'] as $entry) {
+             if (str_ends_with($entry, '*')) {
+                 $base = substr($entry, 0, -1);
+                 if (str_starts_with($requestPath, $base)) {
+                     return true;
+                 }
+             } elseif ($requestPath === $entry) {
+                 return true;
+             }
+         }
+
+         return false;
+     }
+
+     private function isHostPathInAllowlist(?string $requestHost, string $requestPath): bool
+     {
+         if (empty($requestHost)) {
+             return false;
+         }
+ 
+         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
+         $hostPathRule = null;
+         foreach ($whitelistRules as $rule) {
+             if (($rule['type'] ?? '') === 'host_path_allowlist') {
+                 $hostPathRule = $rule;
+                 break;
+             }
+         }
+ 
+         if (empty($hostPathRule['entries'])) {
+             return false;
+         }
+ 
+         foreach ($hostPathRule['entries'] as $entry) {
+             if (RequestUtils::hostPathMatches($requestHost, $requestPath, $entry)) {
+                 return true;
+             }
+         }
+         return false;
+     }
+
+     /**
+      * Vérifie si une requête doit être exemptée en raison d'une règle de liste blanche.
+      */
+     private function checkAllowlists(RequestContext $context): bool
+     {
+         if ($this->isIpInAllowlist($context->clientIp)) {
+             $this->log('IP in allowlist - allowing request', ['clientIp' => $context->clientIp]);
+             return true;
+         }
+         if ($this->isPathInAllowlist($context->path)) {
+             $this->log('Path in allowlist - allowing request', ['path' => $context->path]);
+             return true;
+         }
+         if ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
+             $this->log('Host and path in allowlist - allowing request', ['host' => $context->getHeader('host'), 'path' => $context->path]);
+             return true;
+         }
+         // NOUVEAU: Vérifier la liste blanche GraphQL
+         if ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
+             $this->log('GraphQL operation in allowlist - allowing request', ['operation' => "{$context->graphqlOperation['type']}:{$context->graphqlOperation['name']}"]);
+             return true;
+         }
+         if ($this->verifyWhitelistedBot($context)) {
+             $this->log('Whitelisted bot verified - allowing request', ['clientIp' => $context->clientIp]);
+             return true;
+         }
+ 
+         return false;
+     }
+
+     /**
+      * @return array{deviceId: string, deviceData: ?array, newCookie: ?array}
+       */
+     private function resolveRequestIdentity(RequestContext $context, array &$suspicionVector): array
+     {
+         $this->log('Resolving request identity', ['clientIp' => $context->clientIp, 'cookies' => $context->cookies]);
+         $store = StoreManager::getStore();
+         $existingDeviceId = $context->cookies['device_id'] ?? null; // @phpstan-ignore-line
+         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
+         $pendingCookieTtl = 120; // 2 minutes pour détecter la suppression
+
+         $deviceId = $existingDeviceId;
+         $deviceData = null;
+         $newCookie = null;
+
+         if ($deviceId) {
+             $deviceData = $store->get("device:{$deviceId}");
+         }
+
+         if ($deviceData === null) {
+             // Nouvel utilisateur ou cookie perdu/invalide
+             $pendingDeviceId = $store->get("pending_cookie:{$context->clientIp}");
+             if ($pendingDeviceId && !$existingDeviceId) {
+                 // La pénalité est maintenant ajoutée directement au vecteur de suspicion.
+                 $this->log('Cookie dropping detected', ['clientIp' => $context->clientIp, 'pendingDeviceId' => $pendingDeviceId]);
+                 $suspicionVector['cookieDroppingScore'] = 100.0;
+             }
+
+             $deviceId = bin2hex(random_bytes(16)); // UUID-like
+
+             // Préparer le cookie à envoyer
+             $newCookie = [
+                 'name' => 'device_id',
+                 'value' => $deviceId,
+                 'options' => [
+                     'httponly' => true,
+                     'secure' => $this->isProduction,
+                     'samesite' => 'Strict',
+                     'path' => '/',
+                 ]
+             ];
+             if (isset($this->securityConfig['deviceIdCookieMaxAge'])) {
+                 $newCookie['options']['expires'] = time() + ($this->securityConfig['deviceIdCookieMaxAge'] / 1000);
+             }
+
+             $store->set("pending_cookie:{$context->clientIp}", $deviceId, $pendingCookieTtl);
+
+             $deviceData = [
+                 'initialDeviceHash' => $currentDeviceHash,
+                 'ips' => [$context->clientIp],
+                 'requestHistory' => [],
+                 'lastUpdate' => time() * 1000,
+                 'lastFpHash' => $currentDeviceHash,
+                 'lastChangeTimestamp' => 0,
+                 'rapidChangeCount' => 0,
+                 'highScoreCount' => 0,
+                 'lastHighScoreTimestamp' => 0,
+             ];
+         } else {
+             // S'assurer que 'ips' est un tableau pour les opérations suivantes.
+             if (!isset($deviceData['ips']) || !is_array($deviceData['ips'])) { // @phpstan-ignore-line
+                 $deviceData['ips'] = [];
+             }
+         }
+
+         return [
+             'deviceId' => $deviceId,
+             'deviceData' => $deviceData,
+             'newCookie' => $newCookie,
+         ];
+     }
+
+     /**
+      * @return array<string, float>
+      */
+     public function getSuspicionVector(RequestContext $context, array &$suspicionVector): array
+     {
+         $store = StoreManager::getStore();
+         $identity = $this->resolveRequestIdentity($context, $suspicionVector);
+         $deviceData = $identity['deviceData'];
+         $deviceId = $identity['deviceId'];
+         if ($deviceData && ($deviceData['condemned'] ?? false)) {
+             $suspicionVector['honeypotScore'] = 100;
+             return $suspicionVector;
+         }
+ 
+         // Si un nouveau cookie doit être défini, on le stocke temporairement dans le contexte
+         // pour que le code appelant puisse le gérer.
+         if ($identity['newCookie']) {
+             // Cette propriété n'est pas standard, on la préfixe pour éviter les conflits.
+             $context->newCookieForResponse = $identity['newCookie'];
+         }
+ 
+         // Nettoyage périodique des données de l'appareil
+         if ((time() * 1000) - ($deviceData['lastUpdate'] ?? 0) > 10 * 60 * 1000) { // 10 minutes
+             $deviceData['ips'] = [];
+             $deviceData['rapidChangeCount'] = 0;
+         }
+         $deviceData['lastUpdate'] = time() * 1000;
+ 
+         // --- Calcul des différents scores de suspicion ---
+ 
+         // Score d'incohérence du fingerprint (déplacé ici pour être avec les autres)
+         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
+         $consistencyScore = FingerprintBuilder::compare($deviceData['initialDeviceHash'] ?? '', $currentDeviceHash);
+         $inconsistencyScore = min(100.0, max(0.0, (1 - $consistencyScore) * 200));
+         if ($consistencyScore < ($this->securityConfig['similarityThreshold'] ?? 0.7)) {
+             $inconsistencyScore = 100.0;
+         }
+
+         $behavioral = RequestUtils::getBehavioralIndicators($context, $deviceData);
+
+         // Score des anomalies d'en-têtes
+         $headerAnomalies = RequestUtils::getHeaderAnomalies($context);
+
+         // Score de spoofing TLS
+         $tlsSpoofing = RequestUtils::getTlsSpoofingScore($context);
+         $tlsSpoofingScore = (float)($tlsSpoofing['tlsSpoofingScore'] ?? 0.0);
+
+         // Advanced JA4 TLS Inconsistency checks
+         $ja4 = $context->getHeader('x-ja4-hash');
+         if ($ja4) {
+             $spoofedJa4s = [
+                 't13d1516h2_8daaf6152771_390237aa04be', // Chrome classique (curl-impersonate / tls-client)
+                 't13d1413h2_bc66258908f0_bc2531da1615', // Firefox statique (curl-impersonate-ff / curl_cffi)
+                 't13d1515h2_8daaf6152771_a729e2f67de4', // Safari statique (curl-impersonate-safari / tls-client)
+                 't13d1516h2_8daaf6152771_4be0df930c2c', // Alternatif Chrome (tls-client Go)
+                 't12d1516h2_8daaf6152771_390237aa04be', // Chrome usurpé dégradé en TLS 1.2
+                 't13d1516h2_e822d36d892d_93ec3f0b2f5b'  // Scraping bot OpenSSL customisé
+             ];
+             if (in_array($ja4, $spoofedJa4s, true)) {
+                 $tlsSpoofingScore = max($tlsSpoofingScore, 100.0);
+             }
+
+             $parsedJa4 = $this->parseJa4($ja4);
+             if ($parsedJa4) {
+                 $ua = $context->getHeader('user-agent') ?? '';
+                 $uaParts = $this->parseUserAgent($ua);
+
+                 // Check 1: Incohérence ALPN / HTTP Version
+                 $httpVersion = $context->httpVersion ?? '1.1';
+                 if ($parsedJa4['alpn'] === 'h2' && ($httpVersion === '1.1' || $httpVersion === '1.0')) {
+                     $hasProxy = $context->getHeader('via') || $context->getHeader('forwarded') || $context->getHeader('x-forwarded-proto') || $context->getHeader('x-forwarded-for');
+                     if (!$hasProxy) {
+                         $tlsSpoofingScore = max($tlsSpoofingScore, 40.0);
+                     }
+                 }
+
+                 // Check 2: Incohérence OS/Plateforme vs Capabilities TLS
+                 if ($parsedJa4['version'] === '12' && ($uaParts['os'] === 'iOS' || $uaParts['os'] === 'macOS') && ($uaParts['browser'] && str_starts_with($uaParts['browser'], 'Safari'))) {
+                     $tlsSpoofingScore = max($tlsSpoofingScore, 60.0);
+                 }
+
+                 // Check 3: Incohérence User-Agent vs Signature JA4
+                 if ($uaParts['browser'] && str_starts_with($uaParts['browser'], 'Chrome') && $parsedJa4['alpn'] === '00') {
+                     $tlsSpoofingScore = max($tlsSpoofingScore, 50.0);
+                 }
+                 if ($uaParts['browser'] && str_starts_with($uaParts['browser'], 'Firefox') && $parsedJa4['extensionsCount'] > 15) {
+                     $tlsSpoofingScore = max($tlsSpoofingScore, 50.0);
+                 }
+
+                 // Check 4: La stagnation (Lack of Entropy / Genericity)
+                 if ($uaParts['browser']) {
+                     $ja4Key = "ja4-browsers:{$ja4}";
+                     $seenBrowsers = $store->get($ja4Key) ?: [];
+                     if (!is_array($seenBrowsers)) {
+                         $seenBrowsers = [];
+                     }
+                     $browserFamily = explode('/', $uaParts['browser'])[0] ?? null;
+                     if ($browserFamily && !in_array($browserFamily, $seenBrowsers, true)) {
+                         $seenBrowsers[] = $browserFamily;
+                         $store->set($ja4Key, $seenBrowsers, 86400);
+                     }
+                     if (count($seenBrowsers) > 1) {
+                         $tlsSpoofingScore = max($tlsSpoofingScore, 80.0);
+                     }
+                 }
+             }
+         }
+
+         // Score d'incohérence temporelle (attaque par rejeu)
+         $timeInconsistency = RequestUtils::getTimeInconsistencyScore($context);
+
+         // Score des incohérences entre couches (client vs serveur)
+         $crossLayerInconsistency = RequestUtils::getCrossLayerInconsistency($context);
+
+         // Score des patterns de requêtes (scraping, vélocité)
+         $requestPattern = RequestUtils::getRequestPatternScore($context, $deviceData, $this->securityConfig['patterns'] ?? []);
+
+         // Score des honeypots
+         $honeypot = RequestUtils::getHoneypotScore($context, $this->securityConfig['honeypot'] ?? []);
+
+         // Score des métriques comportementales client (souris, clavier)
+         $behavior = RequestUtils::getBehaviorScore($context);
+
+         // Score de détection de bot explicite (marqueurs d'automatisation)
+         $bot = RequestUtils::getBotScore($context);
+
+         // Score de variance des clics
+         $clickVariance = RequestUtils::getClickVarianceScore($context);
+
+         // Score basé sur les listes de menaces (Threat Intelligence)
+         $threatIntel = RequestUtils::getThreatIntelScore($context, $this->securityConfig['threatIntel'] ?? []);
+
+         // Score d'incohérence des Client-Hints
+         $clientHintsInconsistency = RequestUtils::getClientHintsInconsistencyScore($context);
+
+         // NOUVEAU: Score de réputation du sous-réseau IP
+         $subnetScore = RequestUtils::getSubnetScore($context, $deviceId);
+
+         // Assemblage du vecteur de suspicion final
+         $suspicionVector = array_merge($suspicionVector, [
+             'inconsistencyScore' => $inconsistencyScore,
+             'historyScore' => $behavioral['historyScore'],
+             'rotationScore' => $behavioral['rotationScore'],
+             'headerAnomalyScore' => $headerAnomalies['headerAnomalyScore'],
+             'tlsSpoofingScore' => $tlsSpoofingScore,
+             'timeInconsistencyScore' => $timeInconsistency['timeInconsistencyScore'],
+             'crossLayerInconsistencyScore' => $crossLayerInconsistency['crossLayerInconsistencyScore'],
+             'requestPatternScore' => $requestPattern['requestPatternScore'], // Ce score est maintenant calculé
+             'honeypotScore' => $honeypot['honeypotScore'],
+             'behaviorScore' => $behavior['behaviorScore'],
+             'botScore' => $bot['botScore'],
+             'clickVarianceScore' => $clickVariance['clickVarianceScore'],
+             'threatIntelScore' => $threatIntel['threatIntelScore'],
+             'clientHintsInconsistencyScore' => $clientHintsInconsistency['clientHintsInconsistencyScore'],
+             'subnetScore' => $subnetScore['subnetScore'],
+         ]);
+ 
+         // Sauvegarder l'état mis à jour de l'appareil dans le store
+         $store->set("device:{$deviceId}", $deviceData);
+ 
+         return $suspicionVector;
+     }
+
+     /**
+      * Parse a basic User-Agent string.
+      */
+     private function parseUserAgent(string $ua): array
+     {
+         $result = ['browser' => null, 'os' => null];
+         
+         if (str_contains($ua, 'Chrome') && !str_contains($ua, 'Edg')) {
+             $result['browser'] = 'Chrome';
+             if (preg_match('/Chrome\/(\d+)/', $ua, $matches)) {
+                 $result['browser'] .= '/' . $matches[1];
+             }
+         } elseif (str_contains($ua, 'Firefox')) {
+             $result['browser'] = 'Firefox';
+             if (preg_match('/Firefox\/(\d+)/', $ua, $matches)) {
+                 $result['browser'] .= '/' . $matches[1];
+             }
+         } elseif (str_contains($ua, 'Safari') && !str_contains($ua, 'Chrome')) {
+             $result['browser'] = 'Safari';
+             if (preg_match('/Version\/(\d+)/', $ua, $matches)) {
+                 $result['browser'] .= '/' . $matches[1];
+             }
+         } elseif (str_contains($ua, 'Edg')) {
+             $result['browser'] = 'Edge';
+             if (preg_match('/Edg\/(\d+)/', $ua, $matches)) {
+                 $result['browser'] .= '/' . $matches[1];
+             }
+         }
+
+         if (str_contains($ua, 'Windows NT 10.0')) $result['os'] = 'Windows 10';
+         elseif (str_contains($ua, 'Windows NT 6.1')) $result['os'] = 'Windows 7';
+         elseif (str_contains($ua, 'Mac OS X')) $result['os'] = 'macOS';
+         elseif (str_contains($ua, 'Linux') && !str_contains($ua, 'Android')) $result['os'] = 'Linux';
+         elseif (str_contains($ua, 'Android')) $result['os'] = 'Android';
+         elseif (str_contains($ua, 'iPhone') || str_contains($ua, 'iPad')) $result['os'] = 'iOS';
+
+         return $result;
+     }
+
+     /**
+      * Parse JA4 string into protocol, version, ALPN etc.
+      */
+     private function parseJa4(?string $ja4): ?array
+     {
+         if (empty($ja4)) return null;
+         $parts = explode('_', $ja4);
+         $ja4a = $parts[0];
+         if (strlen($ja4a) < 10) return null;
+         return [
+             'protocol' => $ja4a[0],
+             'version' => substr($ja4a, 1, 2),
+             'sni' => $ja4a[3],
+             'ciphersCount' => (int)substr($ja4a, 4, 2),
+             'extensionsCount' => (int)substr($ja4a, 6, 2),
+             'alpn' => substr($ja4a, 8, 2),
+             'ja4b' => $parts[1] ?? null,
+             'ja4c' => $parts[2] ?? null
+         ];
+     }
+
+     /**
+      * Traite une requête entrante et retourne une décision.
+      * @param RequestContext $context Le contexte de la requête.
+      * @return array{action: string, score: float, vector: array, status?: int, body?: mixed, cookie?: array, path?: string, newCookieForResponse?: array}
+      */
+     public function processRequest(RequestContext $context): array
+     {
+         // Initialiser le vecteur de suspicion pour éviter les erreurs de type.
+         $suspicionVector = [];
+
+         $this->log('Processing request', ['clientIp' => $context->clientIp, 'path' => $context->path]);
+ 
+         // Parse GraphQL query if applicable
+         if ($context->path === '/graphql' && !empty($context->body)) {
+             $gqlInfo = RequestUtils::parseGraphQLQuery(is_array($context->body) ? $context->body : []);
+             if ($gqlInfo) {
+                 $context->graphqlOperation = $gqlInfo;
+             }
+         }
+ 
+         // 1. Vérifier les listes blanches
+         if ($this->checkAllowlists($context)) {
+             return ['action' => 'next', 'score' => 0.0, 'vector' => ['whitelisted' => 100.0]];
+            MetricsManager::incrementCounter('requests_total', ['status' => 'whitelisted']);
+         }
+ 
+         // Initialiser le vecteur de suspicion
+         $thresholds = $this->securityConfig['thresholds'];
+ 
+         // 2. Gérer la soumission d'une solution de challenge (PRIORITÉ HAUTE)
+         $powNonce = $context->query['pow_nonce'] ?? null;
+         $isChallengeSubmission = $powNonce && (
+             isset($context->query['pow_solution']) || 
+             isset($context->query['pow_solution_cpu']) ||
+             (isset($context->query['pow_type']) && $context->query['pow_type'] === 'useful_work_task')
+         );
+         if ($isChallengeSubmission) {
+             $this->log('Challenge solution submitted', ['pow_type' => $context->query['pow_type'] ?? 'unknown', 'nonce' => $powNonce]);
+             $store = StoreManager::getStore();
+             $challengeContext = $store->get("secret:{$powNonce}");
+             $powType = $context->query['pow_type'] ?? null;
+ 
+             if ($challengeContext) {
+                 $isValid = false;
+                 $ticket = null;
+ 
+                 // Vérification de la cohérence du fingerprint
+                 $solverFingerprint = $context->query['pow_fp'] ?? RequestUtils::getCompositeDeviceHash($context);
+                 $originalFingerprint = $challengeContext['fingerprint'] ?? '';
+                 $similarity = FingerprintBuilder::compare($originalFingerprint, $solverFingerprint);
+                 $similarityThreshold = $this->securityConfig['similarityThreshold'] ?? 0.95;
+ 
+                 if ($similarity < $similarityThreshold) {
+                     $this->log('Fingerprint mismatch - challenge solved on a different machine!', [
+                         'similarity' => round($similarity, 4),
+                         'threshold' => $similarityThreshold
+                     ], 'warn');
+                     $isValid = false;
+                 } else {
+                     // Le fingerprint est cohérent, on peut valider la solution
+                     if ($powType === 'cpu_target' || $powType === 'cpu_mem') {
+                         $cpuSolution = $context->query['pow_solution_cpu'] ?? $context->query['pow_solution'] ?? null;
+                         if ($cpuSolution) {
+                             $ticket = ChallengeUtils::verifyCpuTargetPoWAndGenerateTicket($context->clientIp, 3600000, $powNonce, $cpuSolution, $challengeContext);
+                             $isValid = $ticket !== null;
+ 
+                             if ($powType === 'cpu_mem') {
+                                 $memSolution = $context->query['pow_solution_mem'] ?? null;
+                                 $isMemValid = $memSolution ? ChallengeUtils::verifyMemoryPoW($powNonce, $memSolution, $challengeContext['memDifficulty'] ?? 0, $challengeContext['clientSecret'] ?? '') : false;
+                                 $isValid = $isValid && $isMemValid;
+                             }
+                         }
+                     } elseif ($powType === 'useful_work_task') {
+                         $problemId = $context->query['pow_problem_id'] ?? null;
+                         $workResultJson = $context->query['pow_solution_work_result'] ?? null;
+                         if ($problemId && $workResultJson) {
+                             $workResult = json_decode($workResultJson, true);
+                             $this->log('Verifying useful work solution.', [
+                                 'problemId' => $problemId,
+                                 'receivedData' => $workResult,
+                                 'jsonLastError' => json_last_error_msg()
+                             ]);
+                             if (json_last_error() === JSON_ERROR_NONE) {
+                                 // @phpstan-ignore-next-line - L'instance est gérée par le singleton
+                                $defaultPath = dirname(__DIR__, 2) . '/problems.config.json';
+                                $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
+                                $problemManager = \Anonympins\Fingerprint\ProblemManager::getInstance($configPath, $store);
+                                 // FIX: La solution est directement le $workResult, pas une sous-propriété.
+                                 $problemManager->integrateSolution($problemId, $workResult);
+                                 $isValid = true;
+                                 // FIX: Générer un vrai ticket pour uPoW, comme pour un PoW normal.
+                                 $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000; // 1 heure par défaut
+                                 $expiry = (int)floor(microtime(true) * 1000) + $ticketTtl;
+                                 $signature = hash_hmac('sha256', "{$context->clientIp}:{$expiry}", ChallengeUtils::getPowSecret());
+                                 $ticket = "{$expiry}:{$signature}";
+                             }
+                         }
+                     }
+                 }
+ 
+                 if ($isValid) {
+                     $store->delete("secret:{$powNonce}");
+                     $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000;
+                    MetricsManager::incrementCounter('challenges_solved_total');
+                     $this->log('Challenge solution valid - issuing ticket', ['ticketMaxAge' => $ticketTtl]);
+ 
+                     return [
+                 // ... (le reste de la logique de redirection)
+                 'action' => 'redirect',
+                 'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
+                 'score' => 0.0,
+                         'action' => 'redirect',
+                         'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
+                         'score' => 0.0,
+                         'vector' => ['challenge_solved' => 100],
+                         'cookie' => ['name' => 'pow_clearance', 'value' => $ticket, 'options' => ['httponly' => true, 'secure' => $this->isProduction, 'expires' => time() + ($ticketTtl / 1000), 'path' => '/']]
+                     ];
+                 }
+             }
+             // Si la solution est invalide ou le nonce est expiré, on pénalise fortement pour la suite.
+            MetricsManager::incrementCounter('challenges_failed_total');
+             $this->log('Challenge solution invalid or context expired', ['nonce' => $powNonce], 'warn');
+             $suspicionVector['honeypotScore'] = 100.0;
+         }
+ 
+         // 3. Vérifier un ticket existant
+         $hasValidTicket = false;
+         $powCookie = $context->cookies['pow_clearance'] ?? null;
+         if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie)) {
+             $hasValidTicket = true;
+            MetricsManager::incrementCounter('tickets_valid_total');
+             // On ne retourne pas tout de suite pour permettre le re-challenge
+             // $this->log('Valid clearance ticket found');
+             // return ['action' => 'next', 'score' => 0.0, 'vector' => ['ticket_valid' => 100]];
+         }
+ 
+         // 4. Calculer le vecteur et le score de suspicion
+         // Résoudre l'identité et vérifier le statut "condamné"
+         $store = StoreManager::getStore();
+         $identity = $this->resolveRequestIdentity($context, $suspicionVector);
+         $deviceId = $identity['deviceId'];
+         $deviceData = $identity['deviceData'];
+         if ($deviceData && ($deviceData['condemned'] ?? false)) {
+             $this->log('Device condemned - blocking request', ['deviceId' => $deviceId], 'warn');
+             $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => 100, 'vector' => ['honeypotScore' => 100]];
+             if ($this->dryRun) {
+                 $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
+                 $decision['intendedAction'] = $decision['action'];
+                 $decision['action'] = 'next';
+                 unset($decision['status'], $decision['body']);
+             }
+             return $decision;
+         }
+
+         $suspicionVector = $this->getSuspicionVector($context, $suspicionVector);
+         $finalScore = $this->calculateFinalScore($suspicionVector);
+         $this->log('Suspicion vector and final score calculated', [
+             'finalScore' => round($finalScore, 2),
+             'vector' => $suspicionVector
+         ]);
+
+         // Mettre à jour les métriques du sous-réseau après le calcul du score final
+         if ($finalScore > ($thresholds['low'] ?? 20)) {
+            RequestUtils::updateSubnetMetrics($context, $deviceId, $finalScore);
+            MetricsManager::observeValue('suspicion_score', $finalScore, ['action' => 'high_score_subnet_update']);
+         }
+ 
+         // Logique pour challenger les nouveaux appareils (déplacée ici pour avoir le score final)
+         $isNewDevice = $identity['newCookie'] !== null;
+         if ($isNewDevice && ($this->securityConfig['challengeNewDevices'] ?? false) && $finalScore < $thresholds['low']) {
+             $this->log('New device - enforcing minimum challenge score', [
+                 'originalScore' => round($finalScore, 2),
+                 'enforcedScore' => (float)$thresholds['low']
+             ]);
+             $finalScore = (float)$thresholds['low'];
+         }
+ 
+         // Vérifier les URL pièges (après calcul du score)
+         $lastNonce = $deviceData['lastChallengeNonce'] ?? null;
+         if ($lastNonce && ChallengeUtils::verifyTrapUrl($context->path, $context->query['sig'] ?? '', $lastNonce)) {
+             if ($this->logger) {
+                 $this->logger->log('info', 'trap_triggered', ['deviceId' => $deviceId, 'score' => 100, 'path' => $context->path, 'vector' => ['honeypotScore' => 100]]);
+             }
+             $this->log('Honeypot trap URL triggered - condemning device', ['path' => $context->path, 'deviceId' => $deviceId]);
+             $deviceData['condemned'] = true; // @phpstan-ignore-line
+             $store->set("device:{$deviceId}", $deviceData);
+             $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => 100, 'vector' => ['honeypotScore' => 100]];
+             if ($this->dryRun) {
+                 $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
+                 $decision['intendedAction'] = $decision['action'];
+                 $decision['action'] = 'next';
+                 unset($decision['status'], $decision['body']);
+             }
+             return $decision;
+         }
+ 
+         // 5. Prendre une décision basée sur le score - Vérifier le blocage d'abord.
+         $blockThreshold = $thresholds['block'] ?? 95;
+         if ($finalScore >= $blockThreshold) {
+             if ($this->logger) {
+                MetricsManager::incrementCounter('requests_total', ['status' => 'blocked']);
+                 $this->logger->log('info', 'request_blocked', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
+             }
+             $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => $finalScore, 'vector' => $suspicionVector];
+             if ($this->dryRun) {
+                 $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
+                 $decision['intendedAction'] = $decision['action'];
+                 $decision['action'] = 'next';
+                 unset($decision['status'], $decision['body']);
+                MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_block']);
+             }
+             $response = $decision;
+         } else {
+             // Logique de re-challenge
+             // Si un nonce est présent mais que ce n'est pas une soumission de solution valide, c'est une sonde.
+             if ($powNonce && !$isChallengeSubmission) {
+                 $this->log('Honeypot probe detected - blocking request', ['path' => $context->path, 'pow_nonce' => $powNonce]);
+                 $suspicionVector['honeypotScore'] = 100.0;
+                 $finalScore = $this->calculateFinalScore($suspicionVector); // Recalculate score
+                 $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => $finalScore, 'vector' => $suspicionVector];
+                 // Apply dry run logic here as well
+                 if ($this->dryRun) {
+                    MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_block']);
+                     $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
+                     $decision['intendedAction'] = $decision['action'];
+                     $decision['action'] = 'next';
+                     unset($decision['status'], $decision['body']);
+                 }
+                 return $decision;
+             }
+
+             $highThreshold = $thresholds['high'] ?? 75;
+             $mustReChallenge = $finalScore >= $highThreshold && $hasValidTicket;
+ 
+             $lowThreshold = $thresholds['low'] ?? 20;
+             if (($finalScore >= $lowThreshold && !$hasValidTicket) || $mustReChallenge) {
+                 if ($mustReChallenge) {
+                     $this->log('High suspicion score detected - overriding valid ticket to re-issue challenge', ['finalScore' => $finalScore, 'deviceId' => $deviceId]);
+                 }
+ 
+                 $decision = ['action' => 'challenge', 'score' => $finalScore, 'vector' => $suspicionVector, 'status' => 403];
+ 
+                 if ($this->dryRun) {
+                    MetricsManager::incrementCounter('requests_total', ['status' => 'dry_run_challenge']);
+                     $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
+                     $decision['intendedAction'] = $decision['action'];
+                     $decision['action'] = 'next';
+                     unset($decision['status']);
+                     return $decision;
+                 }
+ 
+                MetricsManager::incrementCounter('requests_total', ['status' => 'challenged']);
+                 $this->log('Suspicious request - selecting challenge type', ['finalScore' => $finalScore]);
+ 
+                 $nonce = bin2hex(random_bytes(16));
+                 $clientSecret = bin2hex(random_bytes(16));
+ 
+                 // --- NOUVELLE LOGIQUE uPoW ---
+                 $shouldUseUsefulWork = ($this->securityConfig['enableUsefulWork'] ?? false) && (
+                     ($this->securityConfig['forceUsefulWork'] ?? false) || (random_int(0, 255) / 255) > 0.5
+                 );
+
+                 // Déterminer si c'est une requête API avant de choisir le type de challenge
+                 $isApiRequest = false;
+                 if (isset($this->securityConfig['isApiRequest']) && is_callable($this->securityConfig['isApiRequest'])) {
+                     $isApiRequest = ($this->securityConfig['isApiRequest'])($context);
+                 }
+
+                 if ($shouldUseUsefulWork) {
+                     $this->log('Issuing a useful work challenge', ['finalScore' => $finalScore]);
+                    $defaultPath = dirname(__DIR__, 2) . '/problems.config.json';
+                    $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
+                    $problemManager = ProblemManager::getInstance($configPath, $store);
+                     $work = $problemManager->dispatchWork($finalScore);
+
+                     if ($work !== null) {
+                         $store->set("secret:{$nonce}", ['clientSecret' => $clientSecret, 'originalPath' => $context->path], 300);
+                         $challengePayload = [
+                             'challenge' => [
+                                 'type' => 'useful_work_task',
+                                 'nonce' => $nonce,
+                                 'clientSecret' => $clientSecret,
+                                 'usefulWorkTask' => [
+                                     'problemId' => $work['problemId'],
+                                     'task' => $work['task']
+                                 ]
+                             ]
+                         ];
+                         $decision['body'] = $challengePayload;
+                         return $decision;
+                     } else {
+                         // This case handles when uPoW is enabled but dispatching a task fails (e.g., config not found).
+                         // We log it and fall through to the standard PoW challenge.
+                         $this->log('Useful work dispatch failed, falling back to standard PoW.', [], 'warn');
+                         $shouldUseUsefulWork = false; // Explicitly disable for this request
+                     }
+                 }
+
+                 // --- FIN DE LA LOGIQUE uPoW (le reste est le fallback) ---
+
+                 $suspicionFactor = ($finalScore - $lowThreshold) / (($thresholds['high'] ?? 75) - $lowThreshold);
+                 $suspicionFactor = max(0, min(1.5, $suspicionFactor));
+ 
+                 $cpuChallengeDetails = [
+                     'type' => 'cpu_target',
+                     'nonce' => $nonce,
+                     'target' => ChallengeUtils::calculateCpuTarget($suspicionFactor, $this->securityConfig),
+                     'path' => $context->path,
+                 ];
+ 
+                 $memActivationFactor = max(0, ($suspicionFactor - 0.25) / 0.75);
+                 $memDifficulty = (int)round($memActivationFactor * 48); // 0 à 48MB
+ 
+                 $originalFingerprint = RequestUtils::getCompositeDeviceHash($context);
+                 $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint);
+ 
+                 $challengeContext = [
+                     'clientSecret' => $clientSecret,
+                     'cpuTarget' => $cpuChallengeDetails['target'],
+                     'suspicionScore' => $finalScore,
+                     'fingerprint' => $originalFingerprint,
+                     'memDifficulty' => $memDifficulty,
+                     'baseBlock' => $baseBlock,
+                     'originalPath' => $context->path,
+                 ];
+ 
+                 $store->set("secret:{$nonce}", $challengeContext, $this->securityConfig['challengeTtl'] ?? 300);
+ 
+                 // Associer le nonce au device pour la vérification des URL pièges
+                 if ($deviceData) {
+                     $deviceData['lastChallengeNonce'] = $nonce;
+                     $store->set("device:{$deviceId}", $deviceData); // @phpstan-ignore-line
+                 }
+ 
+                 $trapUrls = [ChallengeUtils::generateTrapUrl($nonce), ChallengeUtils::generateTrapUrl($nonce)];
+                 $this->log('Challenge issued', ['nonce' => $nonce, 'ttl' => $this->securityConfig['challengeTtl'] ?? 300]);
+ 
+                 if ($this->logger) {
+                     $this->logger->log('info', 'challenge_issued', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
+                 }
+ 
+                 // Pour les API, retourner un challenge JSON
+                 if ($isApiRequest) {
+                     $challengePayload = [
+                         'challenge' => [
+                             'type' => 'cpu_mem',
+                             'nonce' => $nonce,
+                             'clientSecret' => $clientSecret,
+                             'cpuTarget' => $cpuChallengeDetails['target'],
+                             'memDifficulty' => $memDifficulty,
+                             'baseBlock' => array_values(unpack('C*', $baseBlock)), // Envoyer comme un tableau d'octets
+                         ]
+                     ];
+                     $decision['body'] = $challengePayload;
+                 } else {
+                     // Pour les navigateurs, retourner une page HTML
+                     $pageBody = ChallengeUtils::generateCombinedPoWChallengePage(
+                         $cpuChallengeDetails, $memDifficulty, $clientSecret, 
+                         $this->securityConfig, $trapUrls, $originalFingerprint
+                     );
+                     $decision['body'] = $pageBody;
+                 }
+                 $response = $decision;
+             } elseif ($hasValidTicket) {
+                 // Si on arrive ici avec un ticket valide et un score bas, on autorise
+                MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
+                 $this->log('Valid clearance ticket found and score is low - allowing request');
+                 $response = ['action' => 'next', 'score' => 0.0, 'vector' => ['ticket_valid' => 100], 'intendedAction' => 'next'];
+             } else {
+                 // 6. Si le score est bas et qu'il n'y a pas de ticket, autoriser la requête
+                MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
+                 $this->log('Request passed - no challenge required', ['finalScore' => $finalScore]);
+                 if ($this->logger) {
+                    MetricsManager::observeValue('suspicion_score', $finalScore, ['action' => 'passed']);
+                     $this->logger->log('info', 'request_passed', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
+                 }
+                 $response = ['action' => 'next', 'score' => $finalScore, 'vector' => $suspicionVector, 'intendedAction' => 'next'];
+             }
+         }
+ 
+         // Si un nouveau cookie d'identification a été généré, on l'ajoute à la réponse.
+         if (isset($context->newCookieForResponse)) {
+             $response['newCookieForResponse'] = $context->newCookieForResponse;
+         }
+ 
+         return $response;
+     }
+
+     /**
+      * Vérifie si l'opération GraphQL correspond à une entrée dans la liste blanche.
+      */
+     private function isGraphqlOperationInAllowlist(?string $operationType, ?string $operationName): bool
+     {
+         if (empty($operationType) || empty($operationName)) {
+             return false;
+         }
+ 
+         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
+         $graphqlRule = null;
+         foreach ($whitelistRules as $rule) {
+             if (($rule['type'] ?? '') === 'graphql_operation_allowlist') {
+                 $graphqlRule = $rule;
+                 break;
+             }
+         }
+ 
+         if (empty($graphqlRule['entries'])) {
+             return false;
+         }
+ 
+         foreach ($graphqlRule['entries'] as $entry) {
+             [$entryType, $entryName] = explode(':', $entry, 2);
+             if ($entryType !== $operationType) continue;
+ 
+             if ($entryName === $operationName || $entryName === '*') return true;
+ 
+             if (str_ends_with($entryName, '*') && str_starts_with($operationName, substr($entryName, 0, -1))) return true;
+         }
+ 
+         return false;
+     }
+ 
+     /**
+      * Vérifie si une requête provient d'un bot légitime et whitelisté (ex: Googlebot)
+      * en utilisant des recherches DNS inversées et directes. Le résultat est mis en cache.
+      */
+     private function verifyWhitelistedBot(RequestContext $context): bool
+     {
+         $whitelistRules = $this->securityConfig['whitelist'] ?? [];
+         $botRules = array_filter($whitelistRules, fn($rule) => isset($rule['hostnameSuffix']));
+         if (empty($botRules)) {
+             return false;
+         }
+
+         $userAgent = $context->getHeader('user-agent') ?? '';
+         $matchedRule = null;
+         foreach ($botRules as $rule) {
+             if (isset($rule['userAgent']) && preg_match('/' . $rule['userAgent'] . '/', $userAgent)) {
+                 $matchedRule = $rule;
+                 break;
+             }
+         }
+         if ($matchedRule === null) {
+             return false;
+         }
+
+         $store = StoreManager::getStore();
+         $cacheKey = "ip-whitelist:{$context->clientIp}";
+         $cachedStatus = $store->get($cacheKey);
+
+         if ($cachedStatus === 'verified') return true;
+         if ($cachedStatus === 'failed') return false;
+
+         try {
+             // 1. Reverse DNS lookup. gethostbyaddr peut être lent, mais c'est la méthode standard.
+             // @ pour supprimer les warnings si l'IP n'a pas de PTR record.
+             $hostname = @gethostbyaddr($context->clientIp);
+             if ($hostname === false || $hostname === $context->clientIp) {
+                 $store->set($cacheKey, 'failed', 86400);
+                 return false;
+             }
+
+             $validHostname = null;
+             if (str_ends_with($hostname, $matchedRule['hostnameSuffix'])) {
+                 $validHostname = $hostname;
+             }
+
+             if ($validHostname === null) {
+                 $store->set($cacheKey, 'failed', 86400);
+                 return false;
+             }
+ 
+             // 2. Forward DNS lookup
+             $addresses = array_merge(dns_get_record($validHostname, DNS_A) ?: [], dns_get_record($validHostname, DNS_AAAA) ?: []);
+             $ips = [];
+             foreach ($addresses as $address) {
+                 if (isset($address['ip'])) {
+                     $ips[] = $address['ip'];
+                 }
+                 if (isset($address['ipv6'])) {
+                     $ips[] = $address['ipv6'];
+                 }
+             }
+ 
+             if (in_array($context->clientIp, $ips, true)) {
+                 $store->set($cacheKey, 'verified', 86400);
+                 return true;
+             }
+         } catch (\Exception $e) { /* DNS errors */ }
+
+         $store->set($cacheKey, 'failed', 86400);
+         return false;
+     }
+
+    /**
+     * @internal For testing purposes only.
+     */
+    public function getProblems(): array
+    {
+        $problemManager = ProblemManager::getInstance();
+        return $problemManager->getProblems();
+    }
+ }