@anonympins/fingerprint 0.4.5 → 0.4.6

package/src/php/Tests/FingerprintEngineTest.php

@@ -10,6 +10,7 @@ use Anonympins\Fingerprint\FingerprintEngine;
 use Anonympins\Fingerprint\RequestContext;
 use Anonympins\Fingerprint\Store\InMemoryStore;
 use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Challenge\ChallengeUtils;
 use PHPUnit\Framework\TestCase;
 
 class FingerprintEngineTest extends TestCase
@@ -90,6 +91,35 @@ class FingerprintEngineTest extends TestCase
         $this->assertLessThan($this->securityConfig['thresholds']['low'], $secondDecision['score']);
     }
 
+    public function testTlsSessionResumptionCookielessTracking(): void
+    {
+        // 1. Première requête d'un client avec un ID de session TLS, sans cookie
+        $tlsSessionId = 'test-tls-1.3-session-resumption-id-12345';
+        $context1 = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'x-tls-session-id' => $tlsSessionId,
+            ]
+        ]);
+
+        $firstDecision = $this->engine->processRequest($context1);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un cookie d'identité d'appareil doit être généré.");
+        $deviceId = $firstDecision['newCookieForResponse']['value'];
+
+        // 2. Deuxième requête : le client supprime ses cookies, mais garde la même session TLS (Session Resumption / 0-RTT)
+        $context2 = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'x-tls-session-id' => $tlsSessionId,
+            ],
+            'cookies' => [] // Cookies supprimés !
+        ]);
+
+        $secondDecision = $this->engine->processRequest($context2);
+        $this->assertEquals('next', $secondDecision['action']);
+        $this->assertArrayNotHasKey('newCookieForResponse', $secondDecision, "Aucun nouveau cookie d'identité ne doit être généré car la session TLS a permis de restaurer l'identité.");
+    }
+
     public function testIssuesChallengeForSuspiciousRequest(): void
     {
         // 1. First, establish a device identity to avoid the cookie-dropping penalty
@@ -354,4 +384,79 @@ class FingerprintEngineTest extends TestCase
         // Le poids de tcpAnomalyScore dans le profil balanced est de 0.8 (80 * 0.8 = 64)
         $this->assertGreaterThanOrEqual(64.0, $decision['score']);
     }
+
+    public function testDetectsAndVerifiesSpaceChallenge(): void
+    {
+        $store = StoreManager::getStore();
+        
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'enableProofOfSpace' => true,
+            'pospace' => [
+                'sizeMb' => 1,
+                'numQueries' => 5
+            ],
+            'challengeNewDevices' => false,
+        ]);
+        
+        $engine = $this->getMockBuilder(FingerprintEngine::class)
+            ->setConstructorArgs([$config])
+            ->onlyMethods(['calculateFinalScore'])
+            ->getMock();
+        $engine->method('calculateFinalScore')->willReturn(30.0);
+        
+        $headers = [
+            'user-agent' => 'A normal browser',
+            'accept-language' => 'en-US,en;q=0.9',
+        ];
+        
+        // 1. Première requête provoquant un challenge
+        $context = $this->createRequestContext([
+            'headers' => $headers
+        ]);
+        
+        $decision = $engine->processRequest($context);
+        $this->assertEquals('challenge', $decision['action']);
+        
+        $html = $decision['body'];
+        $this->assertStringContainsString('initializeSpace', $html);
+        
+        preg_match('/const nonce = "(.*?)";/', $html, $matchesNonce);
+        preg_match('/const clientSecret = "(.*?)";/', $html, $matchesSecret);
+        preg_match('/const queries = (\[.*?\]);/', $html, $matchesQueries);
+        
+        $nonce = $matchesNonce[1];
+        $clientSecret = $matchesSecret[1];
+        $queries = json_decode($matchesQueries[1], true);
+        
+        // 2. Résoudre le challenge
+        $combined = '';
+        foreach ($queries as $idx) {
+            $combined .= $this->callPrivateGenerateBlock($nonce . ":" . $clientSecret, (int)$idx);
+        }
+        $finalBlock = $combined . $nonce . ":" . $clientSecret;
+        $solution = hash('sha256', $finalBlock);
+        
+        // 3. Soumettre le challenge
+        $submitContext = $this->createRequestContext([
+            'headers' => $headers,
+            'query' => [
+                'pow_type' => 'pospace',
+                'pow_nonce' => $nonce,
+                'pow_solution_space' => $solution
+            ]
+        ]);
+        
+        $engineReal = new FingerprintEngine($config);
+        $submitDecision = $engineReal->processRequest($submitContext);
+        $this->assertEquals('redirect', $submitDecision['action']);
+        $this->assertArrayHasKey('cookie', $submitDecision);
+        $this->assertEquals('pow_clearance', $submitDecision['cookie']['name']);
+    }
+
+    private function callPrivateGenerateBlock(string $seed, int $blockIndex): string
+    {
+        $ref = new \ReflectionClass(ChallengeUtils::class);
+        $method = $ref->getMethod('generateBlock');
+        return $method->invoke(null, $seed, $blockIndex);
+    }
 }

package/src/php/Tests/RequestUtilsTest.php

@@ -35,6 +35,19 @@ class RequestUtilsTest extends TestCase
         );
     }
 
+    public function testGetCrossLayerInconsistencyViewportExceedsScreen(): void
+    {
+        $scrHash = FingerprintBuilder::cyrb53("1920x1080_24");
+        $context = $this->createRequestContext([
+            'headers' => [
+                'x-device-fingerprint' => "scr:{$scrHash}",
+                'sec-ch-viewport-width' => '2560'
+            ]
+        ]);
+
+        $score = RequestUtils::getCrossLayerInconsistency($context);
+        $this->assertEquals(20.0, $score['crossLayerInconsistencyScore']);
+    }
     public function testGetClickVarianceScoreReturnsZeroForNoHistory(): void
     {
         $context = $this->createRequestContext([

package/src/php/Utils/RequestUtils.php

@@ -552,6 +552,51 @@ class RequestUtils
             }
         }
 
+          // 2. Incohérence de l'écran (si les Client Hints sont disponibles)
+          $clientScreenHash = $clientFpMap['scr'] ?? null;
+          $viewportWidth = $context->getHeader('sec-ch-viewport-width');
+          if ($clientScreenHash && $viewportWidth) {
+              $viewportWidthInt = (int)$viewportWidth;
+              $matchedScreenWidth = null;
+              $commonWidths = [320, 360, 375, 390, 412, 414, 768, 1024, 1280, 1366, 1440, 1536, 1600, 1920, 2560, 3840];
+              $commonHeights = [480, 568, 640, 667, 736, 800, 812, 844, 896, 900, 1024, 1080, 1200, 1440, 1600, 2160];
+              $commonDepths = [24, 30, 32];
+              
+              foreach ($commonWidths as $w) {
+                  foreach ($commonHeights as $h) {
+                      foreach ($commonDepths as $d) {
+                          $candidate = "{$w}x{$h}_{$d}";
+                          $candidateHash = (string)FingerprintBuilder::cyrb53($candidate);
+                          if ($clientScreenHash === $candidateHash) {
+                              $matchedScreenWidth = $w;
+                              break 3;
+                          }
+                      }
+                  }
+              }
+              
+              if ($matchedScreenWidth !== null && $viewportWidthInt > $matchedScreenWidth) {
+                  $score += 20;
+              }
+          }
+
+          // 3. Incohérence du GPU/Canvas et JA3
+          $clientGpuHash = $clientFpMap['gpu'] ?? null;
+          $ja3 = $context->ja3;
+          if ($clientGpuHash && $ja3) {
+              $expectedClients = self::TLS_FINGERPRINT_DB[$ja3] ?? null;
+              if ($expectedClients) {
+                  if (!is_array($expectedClients)) {
+                      $expectedClients = [$expectedClients];
+                  }
+                  $nonBrowserLibraries = ['Python', 'Go', 'Java', 'curl'];
+                  $isLibrary = !empty(array_intersect($expectedClients, $nonBrowserLibraries));
+                  if ($isLibrary) {
+                      $score += 30;
+                  }
+              }
+          }
+
         return ['crossLayerInconsistencyScore' => min(100.0, $score)];
     }