@anonympins/fingerprint 0.4.5 → 0.4.6

package/src/js/pow.solver.js

@@ -9,6 +9,98 @@
 
 'use strict';
 
+function cyrb53(str, seed = 0) {
+    let h1 = 0xdeadbeef ^ seed,
+        h2 = 0x41c6ce57 ^ seed;
+    for (let i = 0, ch; i < str.length; i++) {
+        ch = str.charCodeAt(i);
+        h1 = Math.imul(h1 ^ ch, 2654435761);
+        h2 = Math.imul(h2 ^ ch, 1597334677);
+    }
+    h1 = Math.imul(h1 ^ (h1 >>> 16), 2246822507) ^ Math.imul(h2 ^ (h2 >>> 13), 3266489909);
+    h2 = Math.imul(h2 ^ (h2 >>> 16), 2246822507) ^ Math.imul(h1 ^ (h1 >>> 13), 3266489909);
+    return 4294967296 * (2097151 & h2) + (h1 >>> 0);
+}
+
+function openDb() {
+    return new Promise((resolve, reject) => {
+        const request = indexedDB.open("pospace-db", 1);
+        request.onupgradeneeded = (e) => {
+            const db = e.target.result;
+            if (!db.objectStoreNames.contains("blocks")) {
+                db.createObjectStore("blocks");
+            }
+        };
+        request.onsuccess = (e) => resolve(e.target.result);
+        request.onerror = (e) => reject(e.target.error);
+    });
+}
+
+function generateBlock(seed, blockIndex, blockSize = 1024) {
+    const block = new Uint8Array(blockSize);
+    let h = cyrb53(seed + ":" + blockIndex);
+    for (let i = 0; i < blockSize; i++) {
+        h = Math.imul(h ^ i, 1597334677);
+        block[i] = h & 0xff;
+    }
+    return block;
+}
+
+export async function initializeSpace(seed, sizeMb) {
+    const db = await openDb();
+    const transaction = db.transaction("blocks", "readwrite");
+    const store = transaction.objectStore("blocks");
+    const numBlocks = sizeMb * 1024;
+    const metadataKey = "pospace-metadata";
+
+    const metaReq = store.get(metadataKey);
+    const meta = await new Promise((resolve) => {
+        metaReq.onsuccess = () => resolve(metaReq.result);
+    });
+    if (meta && meta.sizeMb === sizeMb && meta.seed === seed) {
+        return;
+    }
+
+    const CHUNK_SIZE = 1000;
+    for (let i = 0; i < numBlocks; i += CHUNK_SIZE) {
+        const end = Math.min(numBlocks, i + CHUNK_SIZE);
+        for (let j = i; j < end; j++) {
+            const block = generateBlock(seed, j);
+            store.put(block, j);
+        }
+        await new Promise(r => setTimeout(r, 0));
+    }
+    store.put({ sizeMb, seed }, metadataKey);
+}
+
+export async function solveSpaceChallenge(seed, queries, nonce, clientSecret) {
+    const db = await openDb();
+    const transaction = db.transaction("blocks", "readonly");
+    const store = transaction.objectStore("blocks");
+    
+    let combined = new Uint8Array(queries.length * 1024);
+    for (let i = 0; i < queries.length; i++) {
+        const idx = queries[i];
+        const getReq = store.get(idx);
+        let block = await new Promise((resolve) => {
+            getReq.onsuccess = () => resolve(getReq.result);
+        });
+        if (!block) {
+            block = generateBlock(seed, idx);
+        }
+        combined.set(block, i * 1024);
+    }
+    
+    const encoder = new TextEncoder();
+    const nonceBytes = encoder.encode(nonce + ":" + clientSecret);
+    const finalBlock = new Uint8Array(combined.length + nonceBytes.length);
+    finalBlock.set(combined);
+    finalBlock.set(nonceBytes, combined.length);
+    
+    const buf = await crypto.subtle.digest("SHA-256", finalBlock);
+    return Array.from(new Uint8Array(buf)).map(b => b.toString(16).padStart(2, '0')).join('');
+}
+
 /**
  * Résout un challenge CPU basé sur une cible en utilisant un bloc de base binaire.
  * @param {Uint8Array} baseBlock - Le bloc de données initial (nonce, secret, fp) fourni par le serveur.
@@ -458,7 +550,7 @@ class ChallengeSolution {
  * @returns {Promise<ChallengeSolution>} Un objet `ChallengeSolution` encapsulant le résultat.
  */
 export async function solveChallenge(challenge, fingerprint = '') { // The fingerprint is now passed from the client library
-    const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance, optimizationTask, usefulWorkTask } = challenge;
+    const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance, optimizationTask, usefulWorkTask, queries, sizeMb } = challenge;
     let rawSolution = {};
 
     switch (type) {
@@ -515,6 +607,10 @@ export async function solveChallenge(challenge, fingerprint = '') { // The finge
             rawSolution.work_result = workResult;
             rawSolution.problem_id = usefulWorkTask.problemId;
             break;
+        case 'pospace':
+            await initializeSpace(nonce + ":" + clientSecret, sizeMb || 100);
+            rawSolution.hash = await solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret);
+            break;
         default:
             throw new Error(`Unknown challenge type: ${type}`);
     }

package/src/js/tests/fingerprint.test.js

@@ -66,6 +66,18 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(FingerprintBuilder.compare(fp1, ''), "Comparison with empty string should be 0").toBe(0);
             expect(FingerprintBuilder.compare(null, fp2), "Comparison with null should be 0").toBe(0);
         });
+
+      it('should calculate a high crossLayerInconsistencyScore when viewport width exceeds screen width', () => {
+          const context = {
+              headers: {
+                  'x-device-fingerprint': `scr:${cyrb53("1920x1080_24")}`,
+                  'sec-ch-viewport-width': '2560'
+              }
+          };
+
+          const { crossLayerInconsistencyScore } = __internal.getCrossLayerInconsistency(context);
+          expect(crossLayerInconsistencyScore).toBe(20);
+      });
     });
 
     describe('JA3 Fingerprinting', () => {
@@ -1635,6 +1647,53 @@ describe('Fingerprint & PoW Security Suite', () => {
     });
 });
 
+describe('TLS Session Resumption (Cookieless Identity)', () => {
+    const inMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+        async has(key) { return this._map.has(key); },
+        async delete(key) { this._map.delete(key); },
+    };
+
+    beforeEach(() => {
+        inMemoryStore._map.clear();
+        configureStore(inMemoryStore);
+    });
+
+    it('should resume device ID using TLS Session ID even if cookies are cleared', async () => {
+        const securityConfig = {
+            weights: { historyScore: 1.0 },
+            thresholds: { low: 20, block: 95 }
+        };
+        const engine = new FingerprintEngine(securityConfig);
+
+        const req1 = {
+            clientIp: '1.2.3.4',
+            path: '/',
+            cookies: {},
+            headers: { 'x-tls-session-id': 'session-xyz-123', 'user-agent': 'test-agent' },
+            rawHeaders: [],
+            httpVersion: '1.1'
+        };
+        const decision1 = await engine.processRequest(req1);
+        const deviceId = decision1.newCookieForResponse.value;
+        expect(deviceId).toBeDefined();
+
+        const req2 = {
+            clientIp: '1.2.3.4',
+            path: '/',
+            cookies: {}, // Cookies cleared!
+            headers: { 'x-tls-session-id': 'session-xyz-123', 'user-agent': 'test-agent' },
+            rawHeaders: [],
+            httpVersion: '1.1'
+        };
+
+        const decision2 = await engine.processRequest(req2);
+        expect(decision2.newCookieForResponse).toBeUndefined(); // Resumed successfully, no new cookie needed
+    });
+});
+
 describe('getTlsSpoofingScore', () => {
     let getTlsFingerprintMock; // Renamed to reflect it's the mock function
     let getTlsSpoofingScore;

package/src/php/AutoTuner.php

@@ -77,7 +77,7 @@ class AutoTuner
 
         echo sprintf("[AutoTuning] Démarrage du cycle d'optimisation complet avec %d points de données assainis.\n", count($sanitizedData));
 
-        $paretoFront = OptimizationOperators::solveFullSecurityTuning(['trafficData' => $sanitizedData]);
+        $paretoFront = OptimizationOperators::solveFullSecurityTuning(['trafficData' => $sanitizedData, 'currentConfig' => $this->securityConfig], []);
 
         if (empty($paretoFront)) {
             echo "[AutoTuning] L'optimisation n'a retourné aucune solution.\n";

package/src/php/Challenge/ChallengeUtils.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace Anonympins\Fingerprint\Challenge;
 
 use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\FingerprintBuilder;
 use Anonympins\Fingerprint\Utils\BigInt;
 use Anonympins\Fingerprint\Utils\RequestUtils;
 
@@ -23,6 +24,65 @@ class ChallengeUtils
         '/.git/config_{RANDOM}'
     ];
 
+    private static function imul(int $a, int $b): int
+    {
+        $ah = ($a >> 16) & 0xffff;
+        $al = $a & 0xffff;
+        $bh = ($b >> 16) & 0xffff;
+        $bl = $b & 0xffff;
+        $lo = $al * $bl;
+        $hi = (($lo >> 16) + ($al * $bh) + ($ah * $bl)) & 0xffff;
+        return (($hi << 16) | ($lo & 0xffff)) | 0;
+    }
+
+    private static function generateBlock(string $seed, int $blockIndex, int $blockSize = 1024): string
+    {
+        $block = str_repeat("\x00", $blockSize);
+        $h = FingerprintBuilder::cyrb53($seed . ":" . $blockIndex);
+        
+        $h_int = (int)bcmod($h, '4294967296');
+        for ($i = 0; $i < $blockSize; $i++) {
+            $h_int = self::imul($h_int ^ $i, 1597334677);
+            $block[$i] = chr($h_int & 0xff);
+        }
+        return $block;
+    }
+
+    public static function generateSpaceChallenge(string $clientIp, string $nonce, float $suspicionFactor, string $originalUrl, array $securityConfig): array
+    {
+        $pospaceConfig = $securityConfig['pospace'] ?? [];
+        $sizeMb = $pospaceConfig['sizeMb'] ?? 100;
+        $numQueries = $pospaceConfig['numQueries'] ?? 10;
+
+        $queries = [];
+        $maxBlocks = $sizeMb * 1024;
+        while (count($queries) < $numQueries) {
+            $idx = random_int(0, $maxBlocks - 1);
+            if (!in_array($idx, $queries, true)) {
+                $queries[] = $idx;
+            }
+        }
+
+        return [
+            'type' => 'pospace',
+            'nonce' => $nonce,
+            'sizeMb' => $sizeMb,
+            'queries' => $queries,
+            'path' => $originalUrl
+        ];
+    }
+
+    public static function verifySpacePoW(string $nonce, string $solution, array $queries, string $seed, string $clientSecret): bool
+    {
+        $combined = '';
+        foreach ($queries as $idx) {
+            $combined .= self::generateBlock($seed, (int)$idx);
+        }
+        $finalBlock = $combined . $nonce . ":" . $clientSecret;
+        $hash = hash('sha256', $finalBlock);
+        return hash_equals($hash, $solution);
+    }
+
     /**
      * Récupère la clé secrète pour les PoW depuis les variables d'environnement.
      */
@@ -401,6 +461,43 @@ class ChallengeUtils
         return file_get_contents($solverPath) ?: '';
     }
 
+    public static function generateSpaceChallengePage(array $challengeDetails, string $clientSecret, array $securityConfig): string
+    {
+        $nonce = $challengeDetails['nonce'];
+        $sizeMb = $challengeDetails['sizeMb'];
+        $queries = $challengeDetails['queries'];
+        $path = $challengeDetails['path'];
+
+        $solverCode = self::getPowSolverCode();
+        $queriesJson = json_encode($queries);
+
+        $challengeScript = <<<JS
+          async function solve() {
+            const nonce = "{$nonce}";
+            const path = "{$path}";
+            const clientSecret = "{$clientSecret}";
+            const queries = {$queriesJson};
+            const sizeMb = {$sizeMb};
+            
+            document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
+            await new Promise(r => setTimeout(r, 10));
+            
+            try {
+                await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
+                document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
+                const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret);
+                
+                window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash;
+            } catch(e) {
+                document.getElementById('loader').innerText = "Error initializing local storage: " + e.message;
+            }
+          }
+          solve();
+JS;
+
+        return "<html><head><title>Security Check</title></head><body style=\"font-family:sans-serif; text-align:center; padding-top:50px;\"><h1>Security Check (Level 2)</h1><p>We are verifying your storage allocation. This may take a few seconds on first load.</p><div id=\"loader\" style=\"margin:20px;\">⚙️ Initializing storage space...</div><script>{$solverCode}</script><script>{$challengeScript}</script></body></html>";
+    }
+
     /**
      * Génère le contenu HTML pour un challenge combiné CPU + Mémoire.
      * @param array $cpuChallengeDetails

package/src/php/FingerprintEngine.php

@@ -225,6 +225,16 @@
          $deviceData = null;
          $newCookie = null;
 
+         // Cookieless Identity Tracking: Attempt to restore device ID using TLS session resume ID
+         $tlsSessionId = $context->tlsSessionId;
+         if (!$deviceId && $tlsSessionId) {
+             $resumedDeviceId = $store->get("tls-session:{$tlsSessionId}");
+             if ($resumedDeviceId) {
+                 $deviceId = $resumedDeviceId;
+                 $this->log('Identity resumed via TLS Session ID', ['deviceId' => $deviceId, 'tlsSessionId' => $tlsSessionId]);
+             }
+         }
+
          if ($deviceId) {
              $deviceData = $store->get("device:{$deviceId}");
          }
@@ -275,6 +285,11 @@
              }
          }
 
+         // Bind the current TLS session ID to the device ID
+         if ($deviceId && $tlsSessionId) {
+             $store->set("tls-session:{$tlsSessionId}", $deviceId, 3600); // 1h cache duration
+         }
+
          return [
              'deviceId' => $deviceId,
              'deviceData' => $deviceData,
@@ -515,6 +530,53 @@
          ];
      }
 
+
+     private function decodePolymorphicFingerprint(string $fpString, array $mapping): string
+     {
+         if (empty($mapping['keys'])) {
+             return $fpString;
+         }
+         $reverseKeys = array_flip($mapping['keys']);
+         $parts = explode('|', $fpString);
+         $mappedParts = [];
+         foreach ($parts as $part) {
+             $pair = explode(':', $part, 2);
+             if (count($pair) === 2) {
+                 $origKey = $reverseKeys[$pair[0]] ?? $pair[0];
+                 $mappedParts[] = "{$origKey}:{$pair[1]}";
+             } else {
+                 $mappedParts[] = $part;
+             }
+         }
+         return implode('|', $mappedParts);
+     }
+     private function translatePolymorphicHeaders(RequestContext $context): void
+     {
+         $store = StoreManager::getStore();
+         $activeMappings = $store->get('active-polymorphic-mappings') ?: [];
+         if (!is_array($activeMappings)) {
+             return;
+         }
+
+         foreach ($activeMappings as $mapping) {
+             $devFpHeader = strtolower($mapping['headers']['x-device-fingerprint'] ?? '');
+             $behaviorHeader = strtolower($mapping['headers']['x-behavior-metrics'] ?? '');
+
+             if (!empty($devFpHeader) && isset($context->headers[$devFpHeader])) {
+                 $context->headers['x-device-fingerprint'] = $context->headers[$devFpHeader];
+                 if (!empty($behaviorHeader) && isset($context->headers[$behaviorHeader])) {
+                     $context->headers['x-behavior-metrics'] = $context->headers[$behaviorHeader];
+                 }
+
+                 $clientFp = $context->headers['x-device-fingerprint'];
+                 if ($clientFp && is_string($clientFp)) {
+                     $context->headers['x-device-fingerprint'] = $this->decodePolymorphicFingerprint($clientFp, $mapping);
+                 }
+                 break;
+             }
+         }
+     }
+
      /**
       * Traite une requête entrante et retourne une décision.
       * @param RequestContext $context Le contexte de la requête.
@@ -522,8 +584,21 @@
       */
      public function processRequest(RequestContext $context): array
      {
+        $this->translatePolymorphicHeaders($context);
+
          // Initialiser le vecteur de suspicion pour éviter les erreurs de type.
          $suspicionVector = [];
+        
+        $this->log('Processing request', ['clientIp' => $context->clientIp, 'path' => $context->path]);
+        
+        // Parse GraphQL query if applicable
+        if ($context->path === '/graphql' && !empty($context->body)) {
+            $gqlInfo = RequestUtils::parseGraphQLQuery(is_array($context->body) ? $context->body : []);
+            if ($gqlInfo) {
+                $context->graphqlOperation = $gqlInfo;
+            }
+        }
+
 
          $this->log('Processing request', ['clientIp' => $context->clientIp, 'path' => $context->path]);
  
@@ -549,6 +624,7 @@
          $isChallengeSubmission = $powNonce && (
              isset($context->query['pow_solution']) || 
              isset($context->query['pow_solution_cpu']) ||
+             isset($context->query['pow_solution_space']) ||
              (isset($context->query['pow_type']) && $context->query['pow_type'] === 'useful_work_task')
          );
          if ($isChallengeSubmission) {
@@ -587,6 +663,28 @@
                                  $isValid = $isValid && $isMemValid;
                              }
                          }
+                     } elseif ($powType === 'pospace') {
+                         $powSolutionSpace = $context->query['pow_solution_space'] ?? null;
+                         if ($powSolutionSpace && isset($challengeContext['queries'])) {
+                             $isSpaceValid = ChallengeUtils::verifySpacePoW(
+                                 $powNonce,
+                                 $powSolutionSpace,
+                                 $challengeContext['queries'],
+                                 $powNonce . ":" . $challengeContext['clientSecret'],
+                                 $challengeContext['clientSecret']
+                             );
+                             $isValid = $isSpaceValid;
+                             if ($isValid) {
+                                 $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000;
+                                 $expiry = (int)floor(microtime(true) * 1000) + $ticketTtl;
+                                 $ticket = ChallengeUtils::generateStatelessTicket([
+                                     'expiry' => $expiry,
+                                     'originalIp' => $context->clientIp,
+                                     'deviceId' => '',
+                                     'deviceHash' => ''
+                                 ]);
+                             }
+                         }
                      } elseif ($powType === 'useful_work_task') {
                          $problemId = $context->query['pow_problem_id'] ?? null;
                          $workResultJson = $context->query['pow_solution_work_result'] ?? null;
@@ -622,10 +720,6 @@
                      $this->log('Challenge solution valid - issuing ticket', ['ticketMaxAge' => $ticketTtl]);
  
                      return [
-                 // ... (le reste de la logique de redirection)
-                 'action' => 'redirect',
-                 'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
-                 'score' => 0.0,
                          'action' => 'redirect',
                          'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
                          'score' => 0.0,
@@ -791,7 +885,11 @@
  
                  $nonce = bin2hex(random_bytes(16));
                  $clientSecret = bin2hex(random_bytes(16));
- 
+                 $highThreshold = $thresholds['high'] ?? 75;
+
+                 $suspicionFactor = ($finalScore - $lowThreshold) / (($thresholds['high'] ?? 75) - $lowThreshold);
+                 $suspicionFactor = max(0, min(1.5, $suspicionFactor));
+
                  // --- NOUVELLE LOGIQUE uPoW ---
                  $shouldUseUsefulWork = ($this->securityConfig['enableUsefulWork'] ?? false) && (
                      ($this->securityConfig['forceUsefulWork'] ?? false) || (random_int(0, 255) / 255) > 0.5
@@ -843,9 +941,39 @@
 
                  // --- FIN DE LA LOGIQUE uPoW (le reste est le fallback) ---
 
-                 $suspicionFactor = ($finalScore - $lowThreshold) / (($thresholds['high'] ?? 75) - $lowThreshold);
-                 $suspicionFactor = max(0, min(1.5, $suspicionFactor));
- 
+                 if ($this->securityConfig['enableProofOfSpace'] ?? false) {
+                     $spaceChallenge = ChallengeUtils::generateSpaceChallenge($context->clientIp, $nonce, $suspicionFactor, $context->path, $this->securityConfig);
+                     $store->set("secret:{$nonce}", [
+                         'clientSecret' => $clientSecret,
+                         'suspicionScore' => $finalScore,
+                         'queries' => $spaceChallenge['queries'],
+                         'sizeMb' => $spaceChallenge['sizeMb'],
+                         'fingerprint' => RequestUtils::getCompositeDeviceHash($context),
+                         'originalPath' => $context->path,
+                     ], $this->securityConfig['challengeTtl'] ?? 300);
+
+                     if ($deviceData) {
+                         $deviceData['lastChallengeNonce'] = $nonce;
+                         $store->set("device:{$deviceId}", $deviceData); // @phpstan-ignore-line
+                     }
+
+                     if ($isApiRequest) {
+                         $decision['body'] = [
+                             'challenge' => [
+                                 'type' => 'pospace',
+                                 'nonce' => $nonce,
+                                 'clientSecret' => $clientSecret,
+                                 'queries' => $spaceChallenge['queries'],
+                                 'sizeMb' => $spaceChallenge['sizeMb'],
+                             ]
+                         ];
+                     } else {
+                         $page = ChallengeUtils::generateSpaceChallengePage($spaceChallenge, $clientSecret, $this->securityConfig);
+                         $decision['body'] = $page;
+                     }
+                     return $decision;
+                 }
+
                  $cpuChallengeDetails = [
                      'type' => 'cpu_target',
                      'nonce' => $nonce,