@anonympins/fingerprint 0.4.2 → 0.4.3

package/src/php/Tests/FingerprintEngineTest.php

@@ -1,300 +1,331 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\Config\SecurityProfiles;
-use Anonympins\Fingerprint\FingerprintBuilder;
-use Anonympins\Fingerprint\FingerprintEngine;
-use Anonympins\Fingerprint\RequestContext;
-use Anonympins\Fingerprint\Store\InMemoryStore;
-use Anonympins\Fingerprint\Store\StoreManager;
-use PHPUnit\Framework\TestCase;
-
-class FingerprintEngineTest extends TestCase
-{
-    private FingerprintEngine $engine;
-    private array $securityConfig;
-
-    /**
-     * Cette méthode est appelée avant chaque test.
-     * Elle garantit que chaque test s'exécute dans un environnement propre.
-     */
-    protected function setUp(): void
-    {
-        // 1. Utiliser un store en mémoire propre pour chaque test
-        $store = new InMemoryStore();
-        StoreManager::configureStore($store);
-
-        // 2. Charger une configuration de sécurité de base pour les tests
-        $this->securityConfig = SecurityProfiles::createSecurityProfile('balanced', [
-            'verbose' => false, // Désactiver les logs pour ne pas polluer la sortie des tests
-            'challengeNewDevices' => false, // Simplifie les tests de base
-        ]);
-
-        // 3. Créer une nouvelle instance du moteur pour chaque test
-        $this->engine = new FingerprintEngine($this->securityConfig);
-    }
-
-    /**
-     * Crée un contexte de requête de base pour les tests.
-     *
-     * @param array<string, mixed> $overrides
-     * @return RequestContext
-     */
-    private function createRequestContext(array $overrides = []): RequestContext
-    {
-        $defaults = [
-            'clientIp' => '192.168.1.10',
-            'path' => '/',
-            'headers' => [
-                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
-                'accept-language' => 'en-US,en;q=0.9',
-            ],
-            'query' => [],
-            'body' => null,
-            'cookies' => [],
-            'httpVersion' => '1.1',
-        ];
-
-        $params = array_merge($defaults, $overrides);
-
-        return new RequestContext(
-            $params['clientIp'],
-            $params['path'],
-            $params['headers'],
-            $params['query'],
-            $params['body'],
-            $params['cookies'],
-            $params['httpVersion']
-        );
-    }
-
-    public function testAllowsLegitimateRequest(): void
-    {
-        $context = $this->createRequestContext();
-
-        // Simule une première visite
-        $firstDecision = $this->engine->processRequest($context);
-        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un nouveau cookie aurait dû être généré.");
-        $deviceIdCookie = $firstDecision['newCookieForResponse'];
-
-        // Simule une deuxième visite avec le cookie reçu
-        $nextContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']]
-        ]);
-        $secondDecision = $this->engine->processRequest($nextContext);
-
-        $this->assertEquals('next', $secondDecision['action']);
-        $this->assertLessThan($this->securityConfig['thresholds']['low'], $secondDecision['score']);
-    }
-
-    public function testIssuesChallengeForSuspiciousRequest(): void
-    {
-        // 1. First, establish a device identity to avoid the cookie-dropping penalty
-        $firstContext = $this->createRequestContext();
-        $firstDecision = $this->engine->processRequest($firstContext);
-        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "A device ID cookie should have been generated.");
-        $deviceIdCookie = $firstDecision['newCookieForResponse'];
-
-        // 2. Now, simulate a suspicious request from that same device (e.g., missing user-agent)
-        $suspiciousContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
-            'headers' => [
-                // No user-agent, which is anomalous
-                'accept-language' => 'en-US,en;q=0.9',
-            ]
-        ]);
-
-        $decision = $this->engine->processRequest($suspiciousContext);
-
-        $this->assertEquals('challenge', $decision['action'], "The action should be to issue a challenge.");
-        $this->assertGreaterThanOrEqual($this->securityConfig['thresholds']['low'], $decision['score'], "The score should be above the 'low' threshold.");
-        $this->assertLessThan($this->securityConfig['thresholds']['block'], $decision['score']);
-    }
-
-    public function testBlocksHighlySuspiciousRequest(): void
-    {
-        // Configure the engine to recognize the 'email_confirm' honeypot field.
-        // We need to create a new engine instance for this test with a custom config.
-        $config = SecurityProfiles::createSecurityProfile('balanced', [
-            'honeypot' => ['fields' => ['email_confirm']],
-            'verbose' => true,
-            'weights'=> ['honeypotScore' => 1]
-        ]);
-        $engine = new FingerprintEngine($config);
-
-        // 1. First, establish a device identity to avoid other scores interfering.
-        $firstContext = $this->createRequestContext();
-        $firstDecision = $engine->processRequest($firstContext);
-        $this->assertArrayHasKey('newCookieForResponse', $firstDecision);
-        $deviceIdCookie = $firstDecision['newCookieForResponse'];
-
-        // 2. Now, simulate a request from that device that falls into a honeypot trap.
-        $honeypotContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
-            // The bot filled in a hidden field, triggering the honeypot.
-            'body' => ['email_confirm' => 'bot@example.com']
-        ]);
-
-        $decision = $engine->processRequest($honeypotContext);
-
-        $this->assertEquals('block', $decision['action']);
-        $this->assertGreaterThanOrEqual($config['thresholds']['block'], $decision['score']);
-    }
-
-    public function testDetectsCookieDropping(): void
-    {
-        $context = $this->createRequestContext(['clientIp' => '1.2.3.4']);
-
-        // 1. Première requête, un "pending_cookie" est défini pour cette IP
-        $this->engine->processRequest($context);
-
-        // 2. Deuxième requête de la même IP, mais sans le cookie attendu
-        $contextWithoutCookie = $this->createRequestContext(['clientIp' => '1.2.3.4']);
-        $decision = $this->engine->processRequest($contextWithoutCookie);
-
-        // Le score de "cookieDropping" devrait être de 100
-        $this->assertEquals(100, $decision['vector']['cookieDroppingScore']);
-        // L'action devrait être un challenge car le score final sera élevé
-        $this->assertEquals('challenge', $decision['action']);
-    }
-
-    public function testDetectsFingerprintInconsistency(): void
-    {
-        $context = $this->createRequestContext();
-
-        // 1. Première visite, le fingerprint initial est stocké
-        $firstDecision = $this->engine->processRequest($context);
-        $deviceIdCookie = $firstDecision['newCookieForResponse'];
-
-        // 2. Deuxième visite avec le même cookie, mais un User-Agent complètement différent (incohérence)
-        $nextContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
-            'headers' => [
-                'user-agent' => 'DefinitelyNotTheSameBrowser/1.0',
-                'accept-language' => 'fr-FR',
-            ]
-        ]);
-
-        $decision = $this->engine->processRequest($nextContext);
-
-        // Le score d'incohérence devrait être de 100
-        $this->assertEquals(100, $decision['vector']['inconsistencyScore']);
-        // L'action devrait être un challenge ou un blocage
-        $this->assertContains($decision['action'], ['challenge', 'block']);
-    }
-
-    public function testAllowsWhitelistedIp(): void
-    {
-        $config = SecurityProfiles::createSecurityProfile('strict', [
-            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]]
-        ]);
-        $engine = new FingerprintEngine($config);
-
-        $context = $this->createRequestContext(['clientIp' => '10.0.0.1']);
-        $decision = $engine->processRequest($context);
-
-        $this->assertEquals('next', $decision['action']);
-        $this->assertEquals(0, $decision['score']);
-    }
-    public function testFingerprintBuilderCompareLogic(): void
-    {
-        $fp1 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
-        $fp2 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
-        $fp3 = (new FingerprintBuilder())->add('hw', '4_8')->add('gpu', 'amd')->__toString(); // hw:1039882088834313|gpu:14339535343484648
-        $fp4 = (new FingerprintBuilder())->add('hw', '8_16')->add('os', 'win32')->__toString(); // hw:1039882088834313|os:14339535343484648
-
-        $this->assertEquals(1.0, FingerprintBuilder::compare($fp1, $fp2), "Identical FPs should return 1.0");
-        $this->assertLessThan(0.5, FingerprintBuilder::compare($fp1, $fp3), "Different FPs should have low similarity");
-
-        // The partial match score calculation reflects the current weights in FingerprintBuilder.
-        // Matching keys: 'hw' (weight 1.5).
-        // All relevant keys considered from both fingerprints: 'hw' (1.5), 'gpu' (4.0), 'os' (0.8).
-        // Total weight = 1.5 + 4.0 + 0.8 = 6.3.
-        // Score = 1.5 / 6.3 = ~0.238095... (This logic is correct, the test is fine)
-        $this->assertEqualsWithDelta(0.238, FingerprintBuilder::compare($fp1, $fp4), 0.001, "Partial match score should reflect current weights"); // This test is correct, no change needed.
-    }
-
-    /**
-     * @dataProvider clientHintsInconsistencyProvider
-     * @param array<string, string> $headers Les en-têtes à tester.
-     * @param float $expectedScore Le score attendu.
-     * @param string $message Le message de test.
-     */
-    public function testDetectsClientHintsInconsistency(array $headers, float $expectedScore, string $message): void
-    {
-        // Le test nécessite un deviceId, donc on simule une première visite.
-        // Les en-têtes de la première visite n'ont pas d'importance ici.
-        $firstDecision = $this->engine->processRequest($this->createRequestContext());
-        $deviceIdCookie = $firstDecision['newCookieForResponse'] ?? null;
-        $this->assertNotNull($deviceIdCookie, "Un cookie deviceId aurait dû être créé.");
-
-        // On simule la visite suivante avec les en-têtes à tester.
-        $testContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
-            'headers' => $headers,
-        ]);
-
-        $decision = $this->engine->processRequest($testContext);
-        $this->assertEquals($expectedScore, $decision['vector']['clientHintsInconsistencyScore'], $message);
-    }
-
-    /**
-     * Fournisseur de données pour le test d'incohérence des Client Hints.
-     * @return array<string, array{0: array<string, string>, 1: float, 2: string}>
-     */
-    public function clientHintsInconsistencyProvider(): array
-    {
-        $baseHeaders = ['accept-language' => 'en-US,en;q=0.9'];
-
-        return [
-            'no inconsistency' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
-                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-                ]),
-                0.0,
-                'Should return 0 for consistent headers.'
-            ],
-            'large version mismatch' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
-                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-                ]),
-                80.0,
-                'Should return 80 for a large version mismatch (>5).'
-            ],
-            'small version mismatch' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
-                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-                ]),
-                40.0,
-                'Should return 40 for a small version mismatch (>1).'
-            ],
-            'browser mismatch' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
-                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-                ]),
-                90.0,
-                'Should return 90 for a browser mismatch (Firefox vs Chrome).'
-            ],
-            'missing client hints header' => [
-                ['user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0'],
-                0.0,
-                'Should return 0 if sec-ch-ua header is missing.'
-            ],
-            'malformed client hints' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0',
-                    'sec-ch-ua' => '"SomeOtherBrowser";v="abc"',
-                ]),
-                0.0,
-                'Should return 0 if headers are malformed or unparsable.'
-            ],
-        ];
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Config\SecurityProfiles;
+use Anonympins\Fingerprint\FingerprintBuilder;
+use Anonympins\Fingerprint\FingerprintEngine;
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Store\InMemoryStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use PHPUnit\Framework\TestCase;
+
+class FingerprintEngineTest extends TestCase
+{
+    private FingerprintEngine $engine;
+    private array $securityConfig;
+
+    /**
+     * Cette méthode est appelée avant chaque test.
+     * Elle garantit que chaque test s'exécute dans un environnement propre.
+     */
+    protected function setUp(): void
+    {
+        // 1. Utiliser un store en mémoire propre pour chaque test
+        $store = new InMemoryStore();
+        StoreManager::configureStore($store);
+
+        // 2. Charger une configuration de sécurité de base pour les tests
+        $this->securityConfig = SecurityProfiles::createSecurityProfile('balanced', [
+            'verbose' => false, // Désactiver les logs pour ne pas polluer la sortie des tests
+            'challengeNewDevices' => false, // Simplifie les tests de base
+        ]);
+
+        // 3. Créer une nouvelle instance du moteur pour chaque test
+        $this->engine = new FingerprintEngine($this->securityConfig);
+    }
+
+    /**
+     * Crée un contexte de requête de base pour les tests.
+     *
+     * @param array<string, mixed> $overrides
+     * @return RequestContext
+     */
+    private function createRequestContext(array $overrides = []): RequestContext
+    {
+        $defaults = [
+            'clientIp' => '192.168.1.10',
+            'path' => '/',
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9',
+            ],
+            'query' => [],
+            'body' => null,
+            'cookies' => [],
+            'httpVersion' => '1.1',
+        ];
+
+        $params = array_merge($defaults, $overrides);
+
+        return new RequestContext(
+            $params['clientIp'],
+            $params['path'],
+            $params['headers'],
+            $params['query'],
+            $params['body'],
+            $params['cookies'],
+            $params['httpVersion']
+        );
+    }
+
+    public function testAllowsLegitimateRequest(): void
+    {
+        $context = $this->createRequestContext();
+
+        // Simule une première visite
+        $firstDecision = $this->engine->processRequest($context);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un nouveau cookie aurait dû être généré.");
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // Simule une deuxième visite avec le cookie reçu
+        $nextContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']]
+        ]);
+        $secondDecision = $this->engine->processRequest($nextContext);
+
+        $this->assertEquals('next', $secondDecision['action']);
+        $this->assertLessThan($this->securityConfig['thresholds']['low'], $secondDecision['score']);
+    }
+
+    public function testIssuesChallengeForSuspiciousRequest(): void
+    {
+        // 1. First, establish a device identity to avoid the cookie-dropping penalty
+        $firstContext = $this->createRequestContext();
+        $firstDecision = $this->engine->processRequest($firstContext);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "A device ID cookie should have been generated.");
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // 2. Now, simulate a suspicious request from that same device (e.g., missing user-agent)
+        $suspiciousContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => [
+                // No user-agent, which is anomalous
+                'accept-language' => 'en-US,en;q=0.9',
+            ]
+        ]);
+
+        $decision = $this->engine->processRequest($suspiciousContext);
+
+        $this->assertEquals('challenge', $decision['action'], "The action should be to issue a challenge.");
+        $this->assertGreaterThanOrEqual($this->securityConfig['thresholds']['low'], $decision['score'], "The score should be above the 'low' threshold.");
+        $this->assertLessThan($this->securityConfig['thresholds']['block'], $decision['score']);
+    }
+
+    public function testBlocksHighlySuspiciousRequest(): void
+    {
+        // Configure the engine to recognize the 'email_confirm' honeypot field.
+        // We need to create a new engine instance for this test with a custom config.
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'honeypot' => ['fields' => ['email_confirm']],
+            'verbose' => true,
+            'weights'=> ['honeypotScore' => 1]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        // 1. First, establish a device identity to avoid other scores interfering.
+        $firstContext = $this->createRequestContext();
+        $firstDecision = $engine->processRequest($firstContext);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision);
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // 2. Now, simulate a request from that device that falls into a honeypot trap.
+        $honeypotContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            // The bot filled in a hidden field, triggering the honeypot.
+            'body' => ['email_confirm' => 'bot@example.com']
+        ]);
+
+        $decision = $engine->processRequest($honeypotContext);
+
+        $this->assertEquals('block', $decision['action']);
+        $this->assertGreaterThanOrEqual($config['thresholds']['block'], $decision['score']);
+    }
+
+    public function testDetectsCookieDropping(): void
+    {
+        $context = $this->createRequestContext(['clientIp' => '1.2.3.4']);
+
+        // 1. Première requête, un "pending_cookie" est défini pour cette IP
+        $this->engine->processRequest($context);
+
+        // 2. Deuxième requête de la même IP, mais sans le cookie attendu
+        $contextWithoutCookie = $this->createRequestContext(['clientIp' => '1.2.3.4']);
+        $decision = $this->engine->processRequest($contextWithoutCookie);
+
+        // Le score de "cookieDropping" devrait être de 100
+        $this->assertEquals(100, $decision['vector']['cookieDroppingScore']);
+        // L'action devrait être un challenge car le score final sera élevé
+        $this->assertEquals('challenge', $decision['action']);
+    }
+
+    public function testDetectsFingerprintInconsistency(): void
+    {
+        $context = $this->createRequestContext();
+
+        // 1. Première visite, le fingerprint initial est stocké
+        $firstDecision = $this->engine->processRequest($context);
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // 2. Deuxième visite avec le même cookie, mais un User-Agent complètement différent (incohérence)
+        $nextContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => [
+                'user-agent' => 'DefinitelyNotTheSameBrowser/1.0',
+                'accept-language' => 'fr-FR',
+            ]
+        ]);
+
+        $decision = $this->engine->processRequest($nextContext);
+
+        // Le score d'incohérence devrait être de 100
+        $this->assertEquals(100, $decision['vector']['inconsistencyScore']);
+        // L'action devrait être un challenge ou un blocage
+        $this->assertContains($decision['action'], ['challenge', 'block']);
+    }
+
+    public function testAllowsWhitelistedIp(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext(['clientIp' => '10.0.0.1']);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('next', $decision['action']);
+        $this->assertEquals(0, $decision['score']);
+    }
+
+    public function testReChallengeWhenScoreIsHighEvenWithValidTicket(): void
+    {
+        // 1. Établir l'identité d'origine du terminal
+        $context = $this->createRequestContext();
+        $decision = $this->engine->processRequest($context);
+        $deviceIdCookie = $decision['newCookieForResponse'];
+
+        // Générer un ticket de clearance cryptographiquement valide
+        $expiry = (time() + 3600) * 1000;
+        $secret = getenv('POW_SECRET') ?: "fallback-dev-secret-32-chars-minimum";
+        $signature = hash_hmac('sha256', "{$context->clientIp}:{$expiry}", $secret);
+        $validTicket = "{$expiry}:{$signature}";
+
+        // Créer une requête avec un ticket valide, mais avec un UA et des attributs incohérents provoquant un score >= 75
+        $suspiciousContext = $this->createRequestContext([
+            'cookies' => [
+                $deviceIdCookie['name'] => $deviceIdCookie['value'],
+                'pow_clearance' => $validTicket
+            ],
+            'headers' => [
+                'user-agent' => 'DefinitelyNotTheSameBrowser/1.0', // Incohérence matérielle forte
+                'accept-language' => 'fr-FR',
+            ]
+        ]);
+
+        $redecision = $this->engine->processRequest($suspiciousContext);
+
+        // Malgré le ticket valide, le score est élevé, une nouvelle vérification PoW doit être imposée
+        $this->assertEquals('challenge', $redecision['action']);
+    }
+    public function testFingerprintBuilderCompareLogic(): void
+    {
+        $fp1 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
+        $fp2 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
+        $fp3 = (new FingerprintBuilder())->add('hw', '4_8')->add('gpu', 'amd')->__toString(); // hw:1039882088834313|gpu:14339535343484648
+        $fp4 = (new FingerprintBuilder())->add('hw', '8_16')->add('os', 'win32')->__toString(); // hw:1039882088834313|os:14339535343484648
+
+        $this->assertEquals(1.0, FingerprintBuilder::compare($fp1, $fp2), "Identical FPs should return 1.0");
+        $this->assertLessThan(0.5, FingerprintBuilder::compare($fp1, $fp3), "Different FPs should have low similarity");
+
+        // The partial match score calculation reflects the current weights in FingerprintBuilder.
+        // Matching keys: 'hw' (weight 1.5).
+        // All relevant keys considered from both fingerprints: 'hw' (1.5), 'gpu' (4.0), 'os' (0.8).
+        // Total weight = 1.5 + 4.0 + 0.8 = 6.3.
+        // Score = 1.5 / 6.3 = ~0.238095... (This logic is correct, the test is fine)
+        $this->assertEqualsWithDelta(0.238, FingerprintBuilder::compare($fp1, $fp4), 0.001, "Partial match score should reflect current weights"); // This test is correct, no change needed.
+    }
+
+    /**
+     * @dataProvider clientHintsInconsistencyProvider
+     * @param array<string, string> $headers Les en-têtes à tester.
+     * @param float $expectedScore Le score attendu.
+     * @param string $message Le message de test.
+     */
+    public function testDetectsClientHintsInconsistency(array $headers, float $expectedScore, string $message): void
+    {
+        // Le test nécessite un deviceId, donc on simule une première visite.
+        // Les en-têtes de la première visite n'ont pas d'importance ici.
+        $firstDecision = $this->engine->processRequest($this->createRequestContext());
+        $deviceIdCookie = $firstDecision['newCookieForResponse'] ?? null;
+        $this->assertNotNull($deviceIdCookie, "Un cookie deviceId aurait dû être créé.");
+
+        // On simule la visite suivante avec les en-têtes à tester.
+        $testContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => $headers,
+        ]);
+
+        $decision = $this->engine->processRequest($testContext);
+        $this->assertEquals($expectedScore, $decision['vector']['clientHintsInconsistencyScore'], $message);
+    }
+
+    /**
+     * Fournisseur de données pour le test d'incohérence des Client Hints.
+     * @return array<string, array{0: array<string, string>, 1: float, 2: string}>
+     */
+    public function clientHintsInconsistencyProvider(): array
+    {
+        $baseHeaders = ['accept-language' => 'en-US,en;q=0.9'];
+
+        return [
+            'no inconsistency' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                0.0,
+                'Should return 0 for consistent headers.'
+            ],
+            'large version mismatch' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                80.0,
+                'Should return 80 for a large version mismatch (>5).'
+            ],
+            'small version mismatch' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                40.0,
+                'Should return 40 for a small version mismatch (>1).'
+            ],
+            'browser mismatch' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                90.0,
+                'Should return 90 for a browser mismatch (Firefox vs Chrome).'
+            ],
+            'missing client hints header' => [
+                ['user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0'],
+                0.0,
+                'Should return 0 if sec-ch-ua header is missing.'
+            ],
+            'malformed client hints' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0',
+                    'sec-ch-ua' => '"SomeOtherBrowser";v="abc"',
+                ]),
+                0.0,
+                'Should return 0 if headers are malformed or unparsable.'
+            ],
+        ];
+    }
 }