@anonympins/fingerprint 0.5.1 → 0.5.4

package/src/js/fingerprint.js

@@ -8,12 +8,76 @@ import {DynamicWasmGenerator} from "./dynamic-wasm.js";
 import {readFileSync, existsSync} from "node:fs";
 import {fileURLToPath} from "node:url";
 import {dirname, join, resolve} from "node:path";
-import { verifyZkpProof, decodePolymorphicFingerprint, deepMerge, getHeaderSignature, parseJa3, modPow, hashNetwork, normalizeReferer, isPrivateIp, parseUserAgent } from "./fingerprint.utils.js";
+import {
+    verifyZkpProof,
+    sanitizeRedirectPath,
+    decodePolymorphicFingerprint,
+    deepMerge,
+    getHeaderSignature,
+    parseJa3,
+    modPow,
+    hashNetwork,
+    normalizeReferer,
+    isPrivateIp,
+    parseUserAgent,
+    safeJsonStringify
+} from "./fingerprint.utils.js";
 
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
+let dnsCircuitBreaker = {
+  state: 'CLOSED', // 'CLOSED', 'OPEN', 'HALF-OPEN'
+  failureCount: 0,
+  lastStateChange: 0,
+  threshold: 5,
+  cooldownMs: 30000, // 30 seconds
+};
+
+function recordDnsSuccess() {
+  dnsCircuitBreaker.failureCount = 0;
+  dnsCircuitBreaker.state = 'CLOSED';
+}
+
+function recordDnsFailure() {
+  dnsCircuitBreaker.failureCount++;
+  if (dnsCircuitBreaker.failureCount >= dnsCircuitBreaker.threshold) {
+    dnsCircuitBreaker.state = 'OPEN';
+    dnsCircuitBreaker.lastStateChange = Date.now();
+  }
+}
+
+function canAttemptDns() {
+  if (dnsCircuitBreaker.state === 'CLOSED') {
+    return true;
+  }
+  if (dnsCircuitBreaker.state === 'OPEN') {
+    if (Date.now() - dnsCircuitBreaker.lastStateChange > dnsCircuitBreaker.cooldownMs) {
+      dnsCircuitBreaker.state = 'HALF-OPEN';
+      return true;
+    }
+    return false;
+  }
+  return true; // HALF-OPEN
+}
+
+const withTimeout = (promise, ms) => {
+  let timeoutId;
+  const timeoutPromise = new Promise((_, reject) => {
+    timeoutId = setTimeout(() => {
+      reject(new Error('DNS_TIMEOUT'));
+    }, ms);
+  });
+  return Promise.race([
+    promise.then((res) => {
+      clearTimeout(timeoutId);
+      return res;
+    }),
+    timeoutPromise
+  ]);
+};
+
 export { createRedisStore } from "./redis-store.js";
 export { createMongoDbStore } from "./mongodb-store.js";
 
@@ -22,6 +86,42 @@ let lastMappingTime = 0;
 let isCompilingMapping = false;
 const MAPPING_ROTATION_INTERVAL = 60000; // 60 seconds
 
+const configDir = resolve(__dirname, '../../config');
+
+const loadBotWhitelist = (filename, fallbackEntries) => {
+  const filePath = join(configDir, filename);
+  if (existsSync(filePath)) {
+    try {
+      return JSON.parse(readFileSync(filePath, 'utf-8'));
+    } catch (e) {
+      console.error(`[Fingerprint] Error loading whitelist file ${filename}:`, e.message);
+    }
+  }
+  return fallbackEntries;
+};
+
+const googlebotEntries = loadBotWhitelist('googlebot.json', [
+  "2001:4860:4801:10::/64",
+  "2001:4860:4801:11::/64",
+  "2001:4860:4801:12::/64",
+  // ... [Keep fallback inline values for safety]
+  "66.249.79.64"
+]);
+
+const bingbotEntries = loadBotWhitelist('bingbot.json', [
+  "157.55.39.0/24",
+  "207.46.13.0/24",
+  // ... [Keep fallback inline values for safety]
+  "40.77.178.0/23"
+]);
+
+const yandexEntries = loadBotWhitelist('yandex.json', [
+  "2a02:6b8::/29",
+  "5.45.192.0/18",
+  // ... [Keep fallback inline values for safety]
+  "213.180.192.0/19"
+]);
+
 function generateSessionMapping() {
     const randomStr = (len = 6) => crypto.randomBytes(len).toString('hex').replace(/[0-9]/g, 'g').substring(0, len);
     const randomHeader = () => `X-Sess-${crypto.randomBytes(4).toString('hex')}`;
@@ -584,15 +684,17 @@ const getPowSecret = () => {
   return secret || "fallback-dev-secret-32-chars-minimum";
 };
 
+let cachedPowSolverCode = null;
 /**
  * Loads the pow.solver.js content for inlining in HTML pages.
  * @returns {string} The solver JavaScript code.
  */
 const getPowSolverCode = () => {
-  // On supprime le try/catch. Si le fichier n'est pas trouvé, le processus plantera,
-  // ce qui est préférable à servir un code de secours potentiellement désynchronisé.
-  const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
-  return readFileSync(solverPath, 'utf-8');
+  if (!cachedPowSolverCode) {
+    const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
+    cachedPowSolverCode = readFileSync(solverPath, 'utf-8');
+  }
+  return cachedPowSolverCode;
 };
 /**
  * Extracts the "stable" part of a fingerprint string.
@@ -858,6 +960,7 @@ const generateTspChallenge = (
 ) => {
   const citiesJson = JSON.stringify(cities);
   const solverCode = getPowSolverCode();
+    const safePath = sanitizeRedirectPath(path);
   return `
       <html>
         <head><title>Advanced Security Check (Level 3)</title></head>
@@ -868,14 +971,14 @@ const generateTspChallenge = (
           <script>${solverCode}</script>
           <script>
             const cities = ${citiesJson}; // Safe, as it's JSON
-            const nonce = ${JSON.stringify(nonce)}; // Safe
+            const nonce = ${safeJsonStringify(nonce)}; // Safe
             const targetMaxDistance = ${targetMaxDistance};
 
             async function solve() {
               const result = await window.solveTspChallenge(cities, targetMaxDistance);
               
               if (result.distance <= targetMaxDistance) {
-                window.location.href = ${JSON.stringify(path)} + "?pow_type=tsp&pow_nonce=" + nonce + "&pow_solution=" + JSON.stringify(result.path);
+                window.location.href = ${safeJsonStringify(safePath)} + "?pow_type=tsp&pow_nonce=" + nonce + "&pow_solution=" + JSON.stringify(result.path);
               } else {
                 document.getElementById('loader').innerText = "Error: Could not find a sufficient solution. Please try again.";
               }
@@ -972,6 +1075,7 @@ const generateMemoryPoWChallenge = (
   difficulty = 16,
   path = "",
 ) => {
+    const safePath = sanitizeRedirectPath(path);
   // difficulty here is the buffer size in MB.
   return `
       <html>
@@ -982,8 +1086,8 @@ const generateMemoryPoWChallenge = (
           <div id="loader" style="margin:20px;">⚙️ Performing memory allocation and calculation... (${difficulty} MB)</div>
           <script>
             async function solve() {
-              const nonce = "${nonce}";
-              const size = ${difficulty} * 1024 * 1024; // en octets
+              const nonce = ${safeJsonStringify(nonce)};
+                   const size = ${difficulty} * 1024 * 1024; // en octets
               const iterations = size / 16;
               
               try {
@@ -1000,8 +1104,8 @@ const generateMemoryPoWChallenge = (
                 }
                 window.location.href = "${path}" + "?pow_type=mem&pow_nonce=" + nonce + "&pow_solution=" + finalHash;
               } catch(e) {
-                document.getElementById('loader').innerText = "Error: Insufficient memory. Please refresh.";
-              }
+                window.location.href = ${safeJsonStringify(safePath)} + "?pow_type=mem&pow_nonce=" + nonce + "&pow_solution=" + finalHash;
+                 }
             }
             solve();
           </script>
@@ -1056,40 +1160,123 @@ export const verifyPoWAndGenerateTicket = async (
  * For higher difficulties (production workloads), we skip the massive memory allocation on the server,
  * avoiding server-side memory DoS vectors completely.
  */
+function getChallengedIndices(seed, solution, numBlocks, k = 4) {
+    const indices = [];
+    let h = cyrb53(seed + ":" + solution);
+    for (let i = 0; i < k; i++) {
+        h = Math.imul(h ^ i, 1597334677);
+        indices.push(Math.abs(h) % numBlocks);
+    }
+    return indices;
+}
+
+function verifyMerkleProof(leafHash, index, proof, root) {
+    let currentHash = leafHash;
+    let idx = index;
+    for (let i = 0; i < proof.length; i++) {
+        const sibling = proof[i];
+        const combined = idx % 2 === 0 ? currentHash + sibling : sibling + currentHash;
+        currentHash = crypto.createHash('sha256').update(Buffer.from(combined, 'hex')).digest('hex');
+        idx = Math.floor(idx / 2);
+    }
+    return currentHash === root;
+}
+
+function verifyMemoryPoWLegacy(nonce, solution, difficulty, clientSecret) {
+    const size = difficulty * 1024 * 1024;
+    const iterations = size / 16;
+    const buffer = new Uint32Array(size / 4);
+    const seed = `:${nonce}:${clientSecret}`;
+    let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
+
+    for (let i = 0; i < buffer.length; i++) {
+        buffer[i] = h = Math.imul(h ^ i, 1597334677);
+    }
+
+    let finalHash = 0;
+    let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
+    for (let i = 0; i < iterations; i++) {
+        addr = buffer[addr] % buffer.length;
+        finalHash ^= addr;
+    }
+    return finalHash === solution;
+}
+
 export const verifyMemoryPoW = (nonce, solution, difficulty = 16, clientSecret = '') => {
   const MAX_ALLOWED_MEM_DIFFICULTY = 128; // 128MB
   if (difficulty > MAX_ALLOWED_MEM_DIFFICULTY) {
     console.warn(`[Security] Memory PoW verification attempt with excessive difficulty: ${difficulty}MB. Denied.`);
     return false;
   }
+  if (Number(difficulty) === 0) {
+    return true;
+  }
   if (!solution) {
     return false;
   }
 
-  // If difficulty is high (production workloads), we treat memory PoW purely as a client-side cost.
-  // Cryptographic integrity is already fully enforced by the chained CPU PoW verification.
-  if (difficulty > 4) {
-    return true;
+  let data;
+  try {
+      data = typeof solution === 'string' ? JSON.parse(solution) : solution;
+  } catch (e) {
+      data = null;
   }
 
-  // Fallback: Cryptographic verification path for low-difficulty challenges / unit tests
-  const size = difficulty * 1024 * 1024;
-  const iterations = size / 16;
-  const buffer = new Uint32Array(size / 4);
+  if (!data || typeof data !== 'object' || data.solution === undefined || !data.merkleRoot || !data.proofs) {
+      if (difficulty <= 4 && /^\d+$/.test(String(solution))) {
+          return verifyMemoryPoWLegacy(nonce, parseInt(solution, 10), difficulty, clientSecret);
+      }
+      return false;
+  }
+
+  const { solution: sol, merkleRoot, proofs } = data;
+  const numBlocks = difficulty * 256;
   const seed = `:${nonce}:${clientSecret}`;
-  let h = new TextEncoder().encode(seed).reduce((acc, v) => acc + v, 0);
 
-  for (let i = 0; i < buffer.length; i++) {
-    buffer[i] = h = Math.imul(h ^ i, 1597334677);
+  const challengedIndices = getChallengedIndices(seed, sol, numBlocks, 4);
+
+  for (const b of challengedIndices) {
+      const proof = proofs[b] || proofs[String(b)];
+      if (!proof) return false;
+
+      const block = new Uint32Array(1024);
+      let h = cyrb53(seed + ":" + b);
+      for (let i = 0; i < 1024; i++) {
+          block[i] = (h = Math.imul(h ^ i, 1597334677));
+      }
+
+      const expectedLeaf = crypto.createHash('sha256').update(Buffer.from(block.buffer)).digest('hex');
+
+      if (!verifyMerkleProof(expectedLeaf, b, proof, merkleRoot)) {
+          return false;
+      }
   }
 
-  let finalHash = 0;
-  let addr = buffer.length > 0 ? buffer[0] % buffer.length : 0;
+  const blockCache = new Map();
+  function getBlockElement(blockIdx, elementIdx) {
+      if (!blockCache.has(blockIdx)) {
+          const block = new Uint32Array(1024);
+          let h = cyrb53(seed + ":" + blockIdx);
+          for (let i = 0; i < 1024; i++) {
+              block[i] = (h = Math.imul(h ^ i, 1597334677));
+          }
+          blockCache.set(blockIdx, block);
+      }
+      return blockCache.get(blockIdx)[elementIdx];
+  }
+
+  const totalElements = numBlocks * 1024;
+  let addr = totalElements > 0 ? getBlockElement(0, 0) % totalElements : 0;
+  let expectedSolution = 0;
+  const iterations = 1024;
   for (let i = 0; i < iterations; i++) {
-    addr = buffer[addr] % buffer.length;
-    finalHash ^= addr;
+      const blockIdx = Math.floor(addr / 1024);
+      const elementIdx = addr % 1024;
+      addr = getBlockElement(blockIdx, elementIdx) % totalElements;
+      expectedSolution ^= addr;
   }
-  return finalHash === parseInt(solution, 10);
+
+  return expectedSolution === parseInt(sol, 10);
 };
 
 export async function verifySpacePoW(nonce, solution, queries, seed, clientSecret) {
@@ -1319,26 +1506,61 @@ export async function generateSpaceChallenge(clientIp, nonce, suspicionFactor, o
 }
 
 function generateSpaceChallengePage(challengeDetails, clientSecret, securityConfig) {
-  const { nonce, sizeMb, queries, path } = challengeDetails;
+  const { nonce, sizeMb, queries, path, peerId, peerBlockIdx } = challengeDetails;
   const solverCode = getPowSolverCode();
-  
-  const challengeScript = `
+    const safePath = sanitizeRedirectPath(path);
+  const coopTimeout = securityConfig?.pospace?.coopTimeout ?? 15;
+
+    const challengeScript = `
     async function solve() {
-      const nonce = ${JSON.stringify(nonce)};
-      const path = ${JSON.stringify(path)};
-      const clientSecret = ${JSON.stringify(clientSecret)};
+      const nonce = ${safeJsonStringify(nonce)};
+       const path = ${safeJsonStringify(safePath)};
+       const clientSecret = ${safeJsonStringify(clientSecret)};
       const queries = ${JSON.stringify(queries)};
       const sizeMb = ${sizeMb};
+      const nodeId = nonce;
+      const peerId = ${safeJsonStringify(peerId || '')};
+      const peerBlockIdx = ${peerBlockIdx ?? -1};
+      const coopTimeout = ${coopTimeout};
       
       document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
       await new Promise(r => setTimeout(r, 10));
       
       try {
           await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
+          
+          if (peerId && peerBlockIdx !== -1) {
+              // Enregistrement coopératif
+              await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret));
+          }
+
           document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
-          const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret);
+
+          let peerBlock = "";
+          if (peerId && peerBlockIdx !== -1) {
+              document.getElementById('loader').innerText = '📥 Téléchargement du bloc de validation du pair (' + peerId + ')...';
+              const reqId = Math.random().toString(36).substring(2);
+              await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId);
+              
+              let attempts = 0;
+              while (attempts < coopTimeout) {
+                  const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId);
+                  const data = await res.json();
+                  if (data.status === 'ready') {
+                      peerBlock = data.block_data;
+                      break;
+                  }
+                  await new Promise(r => setTimeout(r, 1000));
+                  attempts++;
+              }
+              if (!peerBlock) {
+                  document.getElementById('loader').innerText = '⚠️ Peer de sous-réseau injoignable. Validation solo...';
+              }
+          }
+
+          const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret, peerBlock);
           
-          window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash;
+          window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash + (peerBlock ? "&pow_coop=1" : "");
       } catch(e) {
           document.getElementById('loader').innerText = "Error initializing local storage: " + e.message;
       }
@@ -2214,80 +2436,6 @@ function getClickVarianceScore(context) {
  * @returns {string|null} The subnet CIDR or null if the IP is invalid.
  */
 function getIpSubnet(ip, ipv4Prefix = 24, ipv6Prefix = 48) { // eslint-disable-line no-unused-vars
-  /**
-   * @private
-   * Parses an IPv6 string, expanding '::' into a 16-byte Buffer.
-   * @param {string} ipStr The IPv6 address string.
-   * @returns {Buffer|null}
-   */
-  const parseIPv6 = (ipStr) => {
-    const parts = ipStr.split('::');
-    if (parts.length > 2) return null;
-
-    let hextets = [];
-    if (parts[0]) hextets.push(...parts[0].split(':'));
-
-    if (parts.length === 2) {
-      const hextetsInPart2 = parts[1] ? parts[1].split(':').length : 0;
-      const zerosToInsert = 8 - hextets.length - hextetsInPart2;
-      for (let i = 0; i < zerosToInsert; i++) {
-        hextets.push('0');
-      }
-      if (parts[1]) hextets.push(...parts[1].split(':'));
-    }
-
-    if (hextets.length !== 8) return null;
-
-    const buffer = Buffer.alloc(16);
-    for (let i = 0; i < 8; i++) {
-      const val = parseInt(hextets[i] || '0', 16);
-      if (isNaN(val)) return null;
-      buffer.writeUInt16BE(val, i * 2);
-    }
-    return buffer;
-  };
-
-  /**
-   * @private
-   * Formats a 16-byte IPv6 buffer into a compressed string representation.
-   * @param {Buffer} buffer The 16-byte buffer.
-   * @returns {string}
-   */
-  const formatIPv6 = (buffer) => {
-    const hextets = [];
-    for (let i = 0; i < 16; i += 2) {
-      hextets.push(buffer.readUInt16BE(i).toString(16));
-    }
-
-    let bestStart = -1, bestLength = 0, currentStart = -1, currentLength = 0;
-    for (let i = 0; i < hextets.length; i++) {
-      if (hextets[i] === '0') {
-        if (currentStart === -1) currentStart = i;
-        currentLength++;
-      } else {
-        if (currentLength > bestLength) {
-          bestStart = currentStart;
-          bestLength = currentLength;
-        }
-        currentStart = -1;
-        currentLength = 0;
-      }
-    }
-    if (currentLength > bestLength) {
-      bestStart = currentStart;
-      bestLength = currentLength;
-    }
-
-    // For subnet calculations, an uncompressed view is often clearer.
-    // We will avoid compression to match test expectations.
-    // if (bestLength > 1) {
-    //   const part1 = hextets.slice(0, bestStart).join(':');
-    //   const part2 = hextets.slice(bestStart + bestLength).join(':');
-    //   return `${part1}::${part2}`;
-    // }
-    return hextets.join(':');
-  };
-
   try {
     if (isIPv4(ip)) {
       const ipBuffer = Buffer.from(ip.split('.').map(Number));
@@ -2296,14 +2444,37 @@ function getIpSubnet(ip, ipv4Prefix = 24, ipv6Prefix = 48) { // eslint-disable-l
       for (let i = 0; i < 4; i++) ipBuffer[i] &= mask[i];
       return `${Array.from(ipBuffer).join('.')}/${ipv4Prefix}`;
     } else if (isIPv6(ip)) {
-      const ipBuffer = parseIPv6(ip);
-      if (!ipBuffer) return null;
-
-      const mask = Buffer.alloc(16, 0);
-      for (let i = 0; i < ipv6Prefix; i++) mask[Math.floor(i / 8)] |= 1 << (7 - (i % 8));
-      for (let i = 0; i < 16; i++) ipBuffer[i] &= mask[i];
-
-      return `${formatIPv6(ipBuffer)}/${ipv6Prefix}`;
+      let normalized = ip.trim().toLowerCase();
+      if (normalized.includes("::")) {
+        const parts = normalized.split("::");
+        if (parts.length > 2) return null;
+        const left = parts[0] ? parts[0].split(":") : [];
+        const right = parts[1] ? parts[1].split(":") : [];
+        const missing = 8 - (left.length + right.length);
+        const middle = Array(missing).fill("0000");
+        normalized = [...left, ...middle, ...right].join(":");
+      } else {
+        const parts = normalized.split(":");
+        if (parts.length !== 8) return null;
+      }
+      const groups = normalized.split(":").map(g => {
+        const val = parseInt(g, 16);
+        return isNaN(val) ? "0000" : val.toString(16).padStart(4, "0");
+      });
+      for (let i = 0; i < 8; i++) {
+        const startBit = i * 16;
+        if (ipv6Prefix >= (i + 1) * 16) {
+          continue;
+        } else if (ipv6Prefix <= startBit) {
+          groups[i] = "0000";
+        } else {
+          const bitsToKeep = ipv6Prefix - startBit;
+          const val = parseInt(groups[i], 16);
+          const mask = (0xffff << (16 - bitsToKeep)) & 0xffff;
+          groups[i] = (val & mask).toString(16).padStart(4, "0");
+        }
+      }
+      return `${groups.join(":")}/${ipv6Prefix}`;
     }
   } catch (e) {
     // Catch any unexpected errors during parsing or manipulation
@@ -2716,12 +2887,19 @@ async function resolveRequestIdentity(context, securityConfig = {}) {
     // Case 2: New user or lost/invalid cookie.
     deviceId = crypto.randomUUID(); // Generate a new "passport".
 
+    const isHttps = context.headers?.['x-forwarded-proto'] === 'https' || 
+                    context.rawReq?.secure || 
+                    context.rawReq?.protocol === 'https' ||
+                    context.rawReq?.connection?.encrypted;
+    const secureOption = isHttps || process.env.NODE_ENV === "production";
+
     // Return the intention to set a cookie.
     newCookie = {
       name: "device_id",
       value: deviceId,
       options: {
-        httpOnly: true, secure: process.env.NODE_ENV === "production", sameSite: "strict",
+        httpOnly: true, secure: secureOption, sameSite: "strict",
+        ...(secureOption && { partitioned: true }),
         // Le maxAge est maintenant configurable. Par défaut, c'est un cookie de session.
         ...(securityConfig.deviceIdCookieMaxAge && { maxAge: securityConfig.deviceIdCookieMaxAge }),
       }
@@ -2971,8 +3149,8 @@ function calculateTarget(suspicionFactor, securityConfig = {}) {
   // MAX_DIFFICULTY: Slow enough to heavily penalize a bot, but feasible for a patient human (5-30s).
   // NOUVEAU: La difficulté est maintenant configurable.
   const { cpu: cpuConfig = {} } = securityConfig;
-  const MIN_DIFFICULTY_BITS = cpuConfig.minDifficultyBits ?? 8;
-  const MAX_DIFFICULTY_BITS = cpuConfig.maxDifficultyBits ?? 16;
+                      const MIN_DIFFICULTY_BITS = cpuConfig.minDifficultyBits ?? 8;
+                      const MAX_DIFFICULTY_BITS = cpuConfig.maxDifficultyBits ?? 22;
 
   // Use linear interpolation between min and max difficulty.
   const totalDifficultyBits =
@@ -3026,6 +3204,8 @@ export function generateCpuTargetChallenge(
   };
 }
 
+const htmlTemplateCache = new Map();
+
 /**
  * Generates the HTML page for the CPU target challenge.
  * @param {object} challengeDetails - The details from generateCpuTargetChallenge.
@@ -3034,6 +3214,7 @@ export function generateCpuTargetChallenge(
  */
 function generateCpuTargetChallengePage(challengeDetails, clientIp) {
     const { nonce, target, path } = challengeDetails;
+    const safePath = sanitizeRedirectPath(path);
     const solverCode = getPowSolverCode();
     return `
       <html><head><title>Security Check</title></head>
@@ -3045,14 +3226,14 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
         <script>
           async function solve() {
             const clientIp = ${JSON.stringify(clientIp)};
-            const nonce = ${JSON.stringify(nonce)};
+            const nonce = ${safeJsonStringify(nonce)};
             const cpuTarget = BigInt("0x" + "${target}");
             // La nouvelle version de solveCpuChallengeInline n'a plus besoin de l'IP ou du secret,
             // car tout est dans le baseBlock. Pour la compatibilité de ce challenge simple, on passe null.
             const baseBlockBytes = new TextEncoder().encode(nonce + ":");
             const solution = await window.solveCpuChallengeInline(baseBlockBytes, cpuTarget, (progress) => {});
             window.location.href = ${JSON.stringify(path)} + "?pow_type=cpu_target&pow_nonce=" + nonce + "&pow_solution=" + solution;
-          }
+           }
           solve();
         </script>
       </body></html>`;
@@ -3067,6 +3248,7 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  */
 function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapUrls, originalFingerprint) { // eslint-disable-line max-len
     const { nonce, target, path } = cpuChallengeDetails;
+    const safePath = sanitizeRedirectPath(path);
     const solverCode = getPowSolverCode();
     // On prépare le baseBlock pour le client. Il sera envoyé sous forme de tableau d'octets.
     // Le fingerprint est maintenant passé directement en paramètre.
@@ -3083,10 +3265,10 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
 
     const challengeScript = `
       async function solve() {
-        const nonce = ${JSON.stringify(nonce)};
-        const path = ${JSON.stringify(path)};
-        const clientSecret = ${JSON.stringify(clientSecret)};
-        const clientIp = ${JSON.stringify(clientIp)};
+        const nonce = ${safeJsonStringify(nonce)};
+           const path = ${JSON.stringify(path)};
+           const clientSecret = ${safeJsonStringify(clientSecret)};
+           const clientIp = ${JSON.stringify(clientIp)};
         const cpuTarget = BigInt("0x" + "${target}");
         const memDifficulty = ${memoryDifficulty};
         // Le client reçoit directement le 'baseBlock' sous forme de tableau d'octets.
@@ -3109,7 +3291,7 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
         }
 
         // Redirect with both solutions and the fingerprint used to solve.
-        const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
+        const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + encodeURIComponent(JSON.stringify(memSolution));
         window.location.href = finalUrl;
       }
 
@@ -3125,10 +3307,15 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     const customTemplatePath = securityConfig?.challengePagePath;
 
     if (customTemplatePath) {
-        try {
-            htmlTemplate = readFileSync(customTemplatePath, 'utf-8');
-        } catch (error) {
-            console.warn(`[Fingerprint] Could not load custom challenge page at '${customTemplatePath}'. Falling back to default. Error: ${error.message}`);
+        if (htmlTemplateCache.has(customTemplatePath)) {
+            htmlTemplate = htmlTemplateCache.get(customTemplatePath);
+        } else {
+            try {
+                htmlTemplate = readFileSync(customTemplatePath, 'utf-8');
+                htmlTemplateCache.set(customTemplatePath, htmlTemplate);
+            } catch (error) {
+                console.warn(`[Fingerprint] Could not load custom challenge page at '${customTemplatePath}'. Falling back to default. Error: ${error.message}`);
+            }
         }
     }
 
@@ -3559,6 +3746,10 @@ export class FingerprintEngine {
       return false;
     }
 
+    if (!canAttemptDns()) {
+      return false;
+    }
+
     const cacheKey = `ip-whitelist:${clientIp}`;
     const cachedStatus = await store.get(cacheKey);
 
@@ -3571,32 +3762,35 @@ export class FingerprintEngine {
 
     try {
       // 1. Reverse DNS lookup
-      const hostnames = await dns.reverse(clientIp);
+      const hostnames = await withTimeout(dns.reverse(clientIp), 500);
       const validHostname = hostnames.find(h => h.endsWith(matchedRule.hostnameSuffix));
 
       if (!validHostname) {
-        await store.set(cacheKey, 'failed', 86400); // Cache failure for 24h (TTL in seconds)
+        await store.set(cacheKey, 'failed', 300); // Temporary negative caching (5 minutes)
         return false;
       }
 
       // 2. Forward DNS lookup
     let addresses = [];
     try {
-      addresses = await dns.resolve(validHostname);
+        addresses = await withTimeout(dns.resolve(validHostname), 500);
     } catch (e) {}
     try {
-      const ipv6 = await dns.resolve(validHostname, 'AAAA');
+        const ipv6 = await withTimeout(dns.resolve(validHostname, 'AAAA'), 500);
       addresses = addresses.concat(ipv6);
     } catch (e) {}
     if (addresses.includes(clientIp)) {
+        recordDnsSuccess();
         await store.set(cacheKey, 'verified', 86400); // Cache success for 24h (TTL in seconds)
         return true;
       }
     } catch (error) {
-      // DNS errors are common (e.g., for IPs with no rDNS record), treat as failure.
+      recordDnsFailure();
+      await store.set(cacheKey, 'failed', 300); // Temporary negative caching (5 minutes)
+      return false;
     }
 
-    await store.set(cacheKey, 'failed', 86400); // Cache failure for 24h (TTL in seconds)
+    await store.set(cacheKey, 'failed', 300); // Temporary negative caching (5 minutes)
     return false;
   }
 
@@ -3789,8 +3983,9 @@ export class FingerprintEngine {
             // lors de l'émission du challenge.
             // --- FIX: Use submitted fingerprint, but fallback to current request's fingerprint ---
             // This handles API clients that might not use the full client-side library but still solve the challenge.
-            const solverFingerprint = pow_fp || getCompositeDeviceHash(requestContext);
-    const originalFingerprint = challengeContext.fingerprint; // This is the fingerprint of the request that *triggered* the challenge
+                const safe_pow_fp = typeof pow_fp === 'string' ? pow_fp : (Array.isArray(pow_fp) ? String(pow_fp[0]) : '');
+                const solverFingerprint = safe_pow_fp || getCompositeDeviceHash(requestContext);
+                const originalFingerprint = typeof challengeContext.fingerprint === 'string' ? challengeContext.fingerprint : '';
 
             let similarity;
             const similarityThreshold = this.securityConfig.similarityThreshold ?? 0.95;
@@ -3893,6 +4088,11 @@ export class FingerprintEngine {
             const finalQueryString = finalSearchParams.toString();
             const finalRedirectPath = finalQueryString ? `${originalUrl.pathname}?${finalQueryString}` : originalUrl.pathname;
             this._log('Redirecting to clean path', { finalRedirectPath, cookieMaxAge: finalTtl });
+            const isHttps = requestContext.headers?.['x-forwarded-proto'] === 'https' || 
+                            requestContext.rawReq?.secure || 
+                            requestContext.rawReq?.protocol === 'https' ||
+                            requestContext.rawReq?.connection?.encrypted;
+            const secureOption = isHttps || this.isProduction;
             return {
               action: 'redirect',
               path: finalRedirectPath,
@@ -3901,7 +4101,13 @@ export class FingerprintEngine {
               cookie: {
                 name: 'pow_clearance',
                 value: ticket, // The ticket itself
-                options: { httpOnly: true, secure: this.isProduction, maxAge: finalTtl } // Options for setting the cookie
+                options: { 
+                  httpOnly: true, 
+                  secure: secureOption, 
+                  sameSite: 'strict',
+                  ...(secureOption && { partitioned: true }),
+                  maxAge: finalTtl 
+                } // Options for setting the cookie
               }
             };
         } else {
@@ -3976,7 +4182,7 @@ export class FingerprintEngine {
         if (challengeContext) {
             try {
                 const workResult = JSON.parse(pow_solution_work_result);
-                const defaultPath = resolve(__dirname, '..', '..', 'problems.config.json');
+                const defaultPath = resolve(__dirname, '..', '..', 'config', 'problems.config.json');
                 const configPath = this.securityConfig.usefulWorkConfigPath || (existsSync(defaultPath) ? defaultPath : undefined);
                 const manager = await getProblemManager({
                     configPath,
@@ -4172,7 +4378,7 @@ export class FingerprintEngine {
             this._log('Issuing a useful work challenge', { finalScore });
 
             try {
-                const defaultPath = resolve(process.cwd(), 'problems.config.json');
+                const defaultPath = resolve(process.cwd(), 'config', 'problems.config.json');
                 const configPath = this.securityConfig.usefulWorkConfigPath || (existsSync(defaultPath) ? defaultPath : undefined);
                 const manager = await getProblemManager({
                     configPath,
@@ -4252,9 +4458,8 @@ export class FingerprintEngine {
             // On passe la configuration pour que la difficulté soit calculée correctement.
             const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
 
-            // La difficulté mémoire démarre à 0 et augmente seulement après un certain seuil de suspicion.
-            // Par exemple, elle ne commence à augmenter qu'à partir de 25% du chemin entre 'low' et 'high'.
-            const memActivationFactor = Math.max(0, (suspicionFactor - 0.25) / 0.75);
+            // La difficulté mémoire augmente désormais en parfaite synergie avec le facteur de suspicion (ratio constant)
+            const memActivationFactor = suspicionFactor;
 
             const minMemDifficulty = 0;   // Peut être 0 Mo !
             const maxMemDifficulty = 48;  // 48Mo pour les plus suspects
@@ -4983,6 +5188,9 @@ export const modsecurity_analyzer = (rulesPath) => {
  * @returns {Array<{userAgent: string, hostnameSuffix: string}>}
  */
 export const default_whitelist = () => [
+    googlebot_whitelist(),
+    bingbot_whitelist(),
+    yandex_whitelist(),
     // === Moteurs de recherche majeurs ===
     { userAgent: 'Googlebot', hostnameSuffix: '.googlebot.com' },
     { userAgent: 'Google-Extended', hostnameSuffix: '.google.com' },
@@ -5080,6 +5288,26 @@ export const default_whitelist = () => [
     { userAgent: 'KeyCDN', hostnameSuffix: '.keycdn.com' },
 ];
 
+/**
+ * Retourne la liste officielle des préfixes IP/CIDR (IPv4 et IPv6) utilisés par Googlebot
+ * enveloppée dans un objet de type 'allowlist' prêt à être injecté.
+ * @returns {{type: string, entries: string[]}} Règle d'allowlist de sécurité.
+ */
+export const googlebot_whitelist = () => ({
+    type: 'allowlist',
+    entries: googlebotEntries
+});
+
+export const yandex_whitelist = () => ({
+    type: 'allowlist',
+    entries: yandexEntries
+});
+
+export const bingbot_whitelist = () => ({
+    type: 'allowlist',
+    entries: bingbotEntries
+});
+
 
 /**
  * Extracts the TLS Session ID or ticket hash from the request context.
@@ -5109,12 +5337,14 @@ function getTlsSessionId(context) {
 }
 
 // --- Proof-of-Work Middleware (The Tollbooth) ---
+const staticFileCache = new Map();
+
 export const powMiddleware = (securityConfig) => {
   const engine = new FingerprintEngine(securityConfig);
 
   // Initialize the problem manager with the configured path, if provided.
   if (securityConfig.enableUsefulWork) {
-    const defaultPath = resolve(__dirname, '..', '..', 'problems.config.json');
+    const defaultPath = resolve(__dirname, '..', '..', 'config', 'problems.config.json');
     const configPath = securityConfig.usefulWorkConfigPath || (existsSync(defaultPath) ? defaultPath : undefined);
     getProblemManager({
         configPath,
@@ -5189,7 +5419,11 @@ export const powMiddleware = (securityConfig) => {
                     }
                 }
                 if (jsFile && existsSync(jsFile)) {
-                    const fileContent = readFileSync(jsFile);
+                    let fileContent = staticFileCache.get(jsFile);
+                    if (!fileContent) {
+                        fileContent = readFileSync(jsFile);
+                        staticFileCache.set(jsFile, fileContent);
+                    }
                     res.setHeader('Content-Type', 'application/javascript');
                     return res.send(fileContent);
                 }
@@ -5206,7 +5440,11 @@ export const powMiddleware = (securityConfig) => {
                     }
                 }
                 if (wasmFile && existsSync(wasmFile)) {
-                    const fileContent = readFileSync(wasmFile);
+                    let fileContent = staticFileCache.get(wasmFile);
+                    if (!fileContent) {
+                        fileContent = readFileSync(wasmFile);
+                        staticFileCache.set(wasmFile, fileContent);
+                    }
                     res.setHeader('Content-Type', 'application/wasm');
                     return res.send(fileContent);
                 }
@@ -5216,7 +5454,7 @@ export const powMiddleware = (securityConfig) => {
 
     const requestContext = {
       clientIp: req.ip || req.socket?.remoteAddress || "unknown",
-      path: req.path,
+        path: sanitizeRedirectPath(req.path),
       cookies: req.cookies,
       query: req.query,
       body: req.body,
@@ -5269,7 +5507,7 @@ export const powMiddleware = (securityConfig) => {
         if (decision.cookie) {
           res.cookie(decision.cookie.name, decision.cookie.value, decision.cookie.options);
         }
-        return res.redirect(decision.path);
+        return res.redirect(sanitizeRedirectPath(decision.path));
 
       case 'next':
       default:
@@ -5278,6 +5516,7 @@ export const powMiddleware = (securityConfig) => {
   };
 };
 
+
 /**
  * @internal
  * Exporting an object containing the functions to make them mockable in tests.
@@ -5325,6 +5564,10 @@ export const __internal = {
     getTcpAnomalyScore, // Expose for testing,
     getQuicAnomalyScore, // NOUVEAU: Expose pour les tests
     getRenderingAnomalyScore, // NOUVEAU: Expose pour les tests
+    dnsCircuitBreaker,
+    recordDnsSuccess,
+    recordDnsFailure,
+    canAttemptDns,
     registerCooperativeNode,
     findPeerInSubnet,
     handleCooperativeRequest
@@ -5346,48 +5589,79 @@ export function sanitizeTrafficData(trafficData) {
   if (!trafficData || trafficData.length === 0) {
     return [];
   }
-  const tempSanitized = [];
+  const suspiciousLogs = [];
+  const passedLogs = [];
   const deviceCounts = new Map();
   const ipCounts = new Map();
   const subnetCounts = new Map();
+  const hardwareClusterCounts = new Map();
+  const hwClusterCache = new Map();
 
   // Calcul des quotas maximums pour éviter l'influence démesurée d'une entité
   const maxLogsPerDevice = Math.max(3, Math.floor(trafficData.length * 0.02)); // Max 2% contribution per device
   const maxLogsPerIp = Math.max(3, Math.floor(trafficData.length * 0.02));      // Max 2% par adresse IP individuelle
   const maxLogsPerSubnet = Math.max(5, Math.floor(trafficData.length * 0.05));  // Max 5% par bloc réseau (anti-proxy-rotation)
+  const maxLogsPerHardwareCluster = Math.max(3, Math.floor(trafficData.length * 0.02)); // Max 2% par cluster matériel stable
+
+  const getHardwareCluster = (log) => {
+    const fp = log.deviceHash || log.fingerprint || log.deviceFingerprint || '';
+    if (!fp || typeof fp !== 'string') {
+      return log.deviceId || 'anonymous-cluster';
+    }
+    if (hwClusterCache.has(fp)) {
+      return hwClusterCache.get(fp);
+    }
+    const parts = fp.split('|');
+    const hwComponents = [];
+    for (const part of parts) {
+      const pair = part.split(':');
+      if (pair.length === 2 && (pair[0] === 'gpu' || pair[0] === 'cvs' || pair[0] === 'hw')) {
+        hwComponents.push(part);
+      }
+    }
+    const result = hwComponents.length > 0 ? hwComponents.sort().join('|') : (log.deviceId || 'anonymous-cluster');
+    hwClusterCache.set(fp, result);
+    return result;
+  };
 
   for (const log of trafficData) {
     const devId = log.deviceId || 'anonymous';
     const ip = log.clientIp || log.ip || 'unknown';
     const subnet = getIpSubnet(ip) || 'unknown-subnet';
+    const hwCluster = getHardwareCluster(log);
 
     const currentDeviceCount = deviceCounts.get(devId) || 0;
     const currentIpCount = ipCounts.get(ip) || 0;
     const currentSubnetCount = subnetCounts.get(subnet) || 0;
+    const currentHwClusterCount = hardwareClusterCounts.get(hwCluster) || 0;
 
-    // Filtrage anti-poisoning strict sur 3 axes cumulatifs
+    // Filtrage anti-poisoning strict sur 4 axes cumulatifs (incluant le clustering matériel stable)
     if (
       currentDeviceCount < maxLogsPerDevice &&
       (ip === 'unknown' || currentIpCount < maxLogsPerIp) &&
-      (subnet === 'unknown-subnet' || currentSubnetCount < maxLogsPerSubnet)
+      (subnet === 'unknown-subnet' || currentSubnetCount < maxLogsPerSubnet) &&
+      currentHwClusterCount < maxLogsPerHardwareCluster
     ) {
       deviceCounts.set(devId, currentDeviceCount + 1);
       if (ip !== 'unknown') ipCounts.set(ip, currentIpCount + 1);
       if (subnet !== 'unknown-subnet') subnetCounts.set(subnet, currentSubnetCount + 1);
+      hardwareClusterCounts.set(hwCluster, currentHwClusterCount + 1);
 
-      tempSanitized.push(log);
+      if (log.type === 'request_passed') {
+        passedLogs.push(log);
+      } else {
+        suspiciousLogs.push(log);
+      }
     }
   }
 
-  const passedLogs = tempSanitized.filter(log => log.type === 'request_passed');
-  const suspiciousLogs = tempSanitized.filter(log => log.type !== 'request_passed');
-
   const minDataPoints = 200; // Seuil par défaut
   const maxPassedAllowed = Math.max(minDataPoints, suspiciousLogs.length * 9);
-  const shuffledPassed = passedLogs.sort(() => 0.5 - Math.random());
-  const selectedPassed = shuffledPassed.slice(0, maxPassedAllowed);
-
-  return [...suspiciousLogs, ...selectedPassed];
+  if (passedLogs.length > maxPassedAllowed) {
+    const shuffledPassed = passedLogs.sort(() => 0.5 - Math.random());
+    return [...suspiciousLogs, ...shuffledPassed.slice(0, maxPassedAllowed)];
+  }
+  return [...suspiciousLogs, ...passedLogs];
 }
 /**
  * Assainit et limite la taille/ancienneté des données de trafic pour éviter les fuites de mémoire.
@@ -5723,7 +5997,7 @@ export async function handleMetricsRequest(req, res, securityConfig) {
     if (typeof authorizationCallback === 'function') {
         const context = new RequestContext(
             req.ip,
-            req.path,
+            sanitizeRedirectPath(req.path),
             req.headers,
             req.query,
             req.body,