@anonympins/fingerprint 0.4.5 → 0.5.0

package/src/php/FingerprintEngine.php

@@ -30,6 +30,29 @@
      public function __construct(array $securityConfig)
      {
          $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
+         
+         // Dynamically bind Ed25519 keys if passed via config
+         if (isset($securityConfig['ed25519_private_key'])) {
+             $_ENV['ED25519_PRIVATE_KEY'] = $securityConfig['ed25519_private_key'];
+         }
+         if (isset($securityConfig['ed25519_public_key'])) {
+             $_ENV['ED25519_PUBLIC_KEY'] = $securityConfig['ed25519_public_key'];
+         }
+
+         // Auto-load optimized config if autotuning savePath is specified
+         if (isset($securityConfig['autotuning']['savePath'])) {
+             $savePath = $securityConfig['autotuning']['savePath'];
+             if (file_exists($savePath)) {
+                 try {
+                     $savedConfig = json_decode(file_get_contents($savePath), true);
+                     if (json_last_error() === JSON_ERROR_NONE && is_array($savedConfig)) {
+                         $securityConfig = SecurityProfiles::deepMerge($securityConfig, $savedConfig);
+                     }
+                 } catch (\Throwable $e) {
+                     error_log("[FingerprintEngine] Failed to auto-load optimized config from {$savePath}: " . $e->getMessage());
+                 }
+             }
+         }
          $this->securityConfig = $securityConfig;
          $this->verbose = $securityConfig['verbose'] ?? false;
          $this->allowlist = $this->buildAllowlist();
@@ -50,7 +73,8 @@
              'deviceIdCookieMaxAge', 'challengePagePath', 'verbose', 'patterns',
              'honeypot', 'threatIntel', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger', 'probationaryTtl',
              'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
-             'similarityThreshold', 'summary', 'description'
+             'similarityThreshold', 'summary', 'description',
+             'ed25519_private_key', 'ed25519_public_key'
          ];
 
          if (empty($config['weights'])) {
@@ -225,6 +249,16 @@
          $deviceData = null;
          $newCookie = null;
 
+         // Cookieless Identity Tracking: Attempt to restore device ID using TLS session resume ID
+         $tlsSessionId = $context->tlsSessionId;
+         if (!$deviceId && $tlsSessionId) {
+             $resumedDeviceId = $store->get("tls-session:{$tlsSessionId}");
+             if ($resumedDeviceId) {
+                 $deviceId = $resumedDeviceId;
+                 $this->log('Identity resumed via TLS Session ID', ['deviceId' => $deviceId, 'tlsSessionId' => $tlsSessionId]);
+             }
+         }
+
          if ($deviceId) {
              $deviceData = $store->get("device:{$deviceId}");
          }
@@ -275,6 +309,11 @@
              }
          }
 
+         // Bind the current TLS session ID to the device ID
+         if ($deviceId && $tlsSessionId) {
+             $store->set("tls-session:{$tlsSessionId}", $deviceId, 3600); // 1h cache duration
+         }
+
          return [
              'deviceId' => $deviceId,
              'deviceData' => $deviceData,
@@ -515,6 +554,53 @@
          ];
      }
 
+
+     private function decodePolymorphicFingerprint(string $fpString, array $mapping): string
+     {
+         if (empty($mapping['keys'])) {
+             return $fpString;
+         }
+         $reverseKeys = array_flip($mapping['keys']);
+         $parts = explode('|', $fpString);
+         $mappedParts = [];
+         foreach ($parts as $part) {
+             $pair = explode(':', $part, 2);
+             if (count($pair) === 2) {
+                 $origKey = $reverseKeys[$pair[0]] ?? $pair[0];
+                 $mappedParts[] = "{$origKey}:{$pair[1]}";
+             } else {
+                 $mappedParts[] = $part;
+             }
+         }
+         return implode('|', $mappedParts);
+     }
+     private function translatePolymorphicHeaders(RequestContext $context): void
+     {
+         $store = StoreManager::getStore();
+         $activeMappings = $store->get('active-polymorphic-mappings') ?: [];
+         if (!is_array($activeMappings)) {
+             return;
+         }
+
+         foreach ($activeMappings as $mapping) {
+             $devFpHeader = strtolower($mapping['headers']['x-device-fingerprint'] ?? '');
+             $behaviorHeader = strtolower($mapping['headers']['x-behavior-metrics'] ?? '');
+
+             if (!empty($devFpHeader) && isset($context->headers[$devFpHeader])) {
+                 $context->headers['x-device-fingerprint'] = $context->headers[$devFpHeader];
+                 if (!empty($behaviorHeader) && isset($context->headers[$behaviorHeader])) {
+                     $context->headers['x-behavior-metrics'] = $context->headers[$behaviorHeader];
+                 }
+
+                 $clientFp = $context->headers['x-device-fingerprint'];
+                 if ($clientFp && is_string($clientFp)) {
+                     $context->headers['x-device-fingerprint'] = $this->decodePolymorphicFingerprint($clientFp, $mapping);
+                 }
+                 break;
+             }
+         }
+     }
+
      /**
       * Traite une requête entrante et retourne une décision.
       * @param RequestContext $context Le contexte de la requête.
@@ -522,8 +608,31 @@
       */
      public function processRequest(RequestContext $context): array
      {
+        $this->translatePolymorphicHeaders($context);
+
          // Initialiser le vecteur de suspicion pour éviter les erreurs de type.
          $suspicionVector = [];
+        
+         $coopOp = $context->query['coop_op'] ?? null;
+         if ($coopOp) {
+             $result = ChallengeUtils::handleCooperativeRequest($context->query);
+             return [
+                 'action' => 'challenge',
+                 'status' => 200,
+                 'body' => $result
+             ];
+         }
+
+        $this->log('Processing request', ['clientIp' => $context->clientIp, 'path' => $context->path]);
+        
+        // Parse GraphQL query if applicable
+        if ($context->path === '/graphql' && !empty($context->body)) {
+            $gqlInfo = RequestUtils::parseGraphQLQuery(is_array($context->body) ? $context->body : []);
+            if ($gqlInfo) {
+                $context->graphqlOperation = $gqlInfo;
+            }
+        }
+
 
          $this->log('Processing request', ['clientIp' => $context->clientIp, 'path' => $context->path]);
  
@@ -549,6 +658,7 @@
          $isChallengeSubmission = $powNonce && (
              isset($context->query['pow_solution']) || 
              isset($context->query['pow_solution_cpu']) ||
+             isset($context->query['pow_solution_space']) ||
              (isset($context->query['pow_type']) && $context->query['pow_type'] === 'useful_work_task')
          );
          if ($isChallengeSubmission) {
@@ -587,6 +697,28 @@
                                  $isValid = $isValid && $isMemValid;
                              }
                          }
+                     } elseif ($powType === 'pospace') {
+                         $powSolutionSpace = $context->query['pow_solution_space'] ?? null;
+                         if ($powSolutionSpace && isset($challengeContext['queries'])) {
+                             $isSpaceValid = ChallengeUtils::verifySpacePoW(
+                                 $powNonce,
+                                 $powSolutionSpace,
+                                 $challengeContext['queries'],
+                                 $powNonce . ":" . $challengeContext['clientSecret'],
+                                 $challengeContext['clientSecret']
+                             );
+                             $isValid = $isSpaceValid;
+                             if ($isValid) {
+                                 $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000;
+                                 $expiry = (int)floor(microtime(true) * 1000) + $ticketTtl;
+                                 $ticket = ChallengeUtils::generateStatelessTicket([
+                                     'expiry' => $expiry,
+                                     'originalIp' => $context->clientIp,
+                                     'deviceId' => '',
+                                     'deviceHash' => ''
+                                 ]);
+                             }
+                         }
                      } elseif ($powType === 'useful_work_task') {
                          $problemId = $context->query['pow_problem_id'] ?? null;
                          $workResultJson = $context->query['pow_solution_work_result'] ?? null;
@@ -622,10 +754,6 @@
                      $this->log('Challenge solution valid - issuing ticket', ['ticketMaxAge' => $ticketTtl]);
  
                      return [
-                 // ... (le reste de la logique de redirection)
-                 'action' => 'redirect',
-                 'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
-                 'score' => 0.0,
                          'action' => 'redirect',
                          'path' => RequestUtils::cleanUrlFromPowParams($challengeContext['originalPath'] ?? '/', $context->query),
                          'score' => 0.0,
@@ -643,7 +771,11 @@
          // 3. Vérifier un ticket existant
          $hasValidTicket = false;
          $powCookie = $context->cookies['pow_clearance'] ?? null;
-         if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie)) {
+         $zkpProof = $context->getHeader('x-zkp-proof') ?? $context->query['pow_zkp'] ?? '';
+         $deviceId = $context->cookies['device_id'] ?? '';
+         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
+         $allowRoaming = $this->securityConfig['allowCrossNetworkRoaming'] ?? false;
+         if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie, $deviceId, $currentDeviceHash, $allowRoaming, $zkpProof)) {
              $hasValidTicket = true;
             MetricsManager::incrementCounter('tickets_valid_total');
              // On ne retourne pas tout de suite pour permettre le re-challenge
@@ -791,7 +923,11 @@
  
                  $nonce = bin2hex(random_bytes(16));
                  $clientSecret = bin2hex(random_bytes(16));
- 
+                 $highThreshold = $thresholds['high'] ?? 75;
+
+                 $suspicionFactor = ($finalScore - $lowThreshold) / (($thresholds['high'] ?? 75) - $lowThreshold);
+                 $suspicionFactor = max(0, min(1.5, $suspicionFactor));
+
                  // --- NOUVELLE LOGIQUE uPoW ---
                  $shouldUseUsefulWork = ($this->securityConfig['enableUsefulWork'] ?? false) && (
                      ($this->securityConfig['forceUsefulWork'] ?? false) || (random_int(0, 255) / 255) > 0.5
@@ -843,9 +979,39 @@
 
                  // --- FIN DE LA LOGIQUE uPoW (le reste est le fallback) ---
 
-                 $suspicionFactor = ($finalScore - $lowThreshold) / (($thresholds['high'] ?? 75) - $lowThreshold);
-                 $suspicionFactor = max(0, min(1.5, $suspicionFactor));
- 
+                 if ($this->securityConfig['enableProofOfSpace'] ?? false) {
+                     $spaceChallenge = ChallengeUtils::generateSpaceChallenge($context->clientIp, $nonce, $suspicionFactor, $context->path, $this->securityConfig);
+                     $store->set("secret:{$nonce}", [
+                         'clientSecret' => $clientSecret,
+                         'suspicionScore' => $finalScore,
+                         'queries' => $spaceChallenge['queries'],
+                         'sizeMb' => $spaceChallenge['sizeMb'],
+                         'fingerprint' => RequestUtils::getCompositeDeviceHash($context),
+                         'originalPath' => $context->path,
+                     ], $this->securityConfig['challengeTtl'] ?? 300);
+
+                     if ($deviceData) {
+                         $deviceData['lastChallengeNonce'] = $nonce;
+                         $store->set("device:{$deviceId}", $deviceData); // @phpstan-ignore-line
+                     }
+
+                     if ($isApiRequest) {
+                         $decision['body'] = [
+                             'challenge' => [
+                                 'type' => 'pospace',
+                                 'nonce' => $nonce,
+                                 'clientSecret' => $clientSecret,
+                                 'queries' => $spaceChallenge['queries'],
+                                 'sizeMb' => $spaceChallenge['sizeMb'],
+                             ]
+                         ];
+                     } else {
+                         $page = ChallengeUtils::generateSpaceChallengePage($spaceChallenge, $clientSecret, $this->securityConfig);
+                         $decision['body'] = $page;
+                     }
+                     return $decision;
+                 }
+
                  $cpuChallengeDetails = [
                      'type' => 'cpu_target',
                      'nonce' => $nonce,