@anonympins/fingerprint 0.5.2 → 0.5.5

package/src/js/fingerprint.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import {BlockList, isIPv4, isIPv6} from "node:net";
 import * as dns from "node:dns/promises";
+import {Worker} from "node:worker_threads";
 import {getProblemManager, problemManager} from "./problem-manager.js";
 import {Optimization} from "./library.js";
 import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
@@ -27,6 +28,57 @@ import {
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
+let dnsCircuitBreaker = {
+  state: 'CLOSED', // 'CLOSED', 'OPEN', 'HALF-OPEN'
+  failureCount: 0,
+  lastStateChange: 0,
+  threshold: 5,
+  cooldownMs: 30000, // 30 seconds
+};
+
+function recordDnsSuccess() {
+  dnsCircuitBreaker.failureCount = 0;
+  dnsCircuitBreaker.state = 'CLOSED';
+}
+
+function recordDnsFailure() {
+  dnsCircuitBreaker.failureCount++;
+  if (dnsCircuitBreaker.failureCount >= dnsCircuitBreaker.threshold) {
+    dnsCircuitBreaker.state = 'OPEN';
+    dnsCircuitBreaker.lastStateChange = Date.now();
+  }
+}
+
+function canAttemptDns() {
+  if (dnsCircuitBreaker.state === 'CLOSED') {
+    return true;
+  }
+  if (dnsCircuitBreaker.state === 'OPEN') {
+    if (Date.now() - dnsCircuitBreaker.lastStateChange > dnsCircuitBreaker.cooldownMs) {
+      dnsCircuitBreaker.state = 'HALF-OPEN';
+      return true;
+    }
+    return false;
+  }
+  return true; // HALF-OPEN
+}
+
+const withTimeout = (promise, ms) => {
+  let timeoutId;
+  const timeoutPromise = new Promise((_, reject) => {
+    timeoutId = setTimeout(() => {
+      reject(new Error('DNS_TIMEOUT'));
+    }, ms);
+  });
+  return Promise.race([
+    promise.then((res) => {
+      clearTimeout(timeoutId);
+      return res;
+    }),
+    timeoutPromise
+  ]);
+};
+
 export { createRedisStore } from "./redis-store.js";
 export { createMongoDbStore } from "./mongodb-store.js";
 
@@ -72,7 +124,7 @@ const yandexEntries = loadBotWhitelist('yandex.json', [
 ]);
 
 function generateSessionMapping() {
-    const randomStr = (len = 6) => crypto.randomBytes(len).toString('hex').replace(/[0-9]/g, 'g').substring(0, len);
+    const randomStr = (len = 6) => Array.from({ length: len }, () => String.fromCharCode(crypto.randomInt(97, 123))).join('');
     const randomHeader = () => `X-Sess-${crypto.randomBytes(4).toString('hex')}`;
 
     return {
@@ -133,18 +185,29 @@ async function compilePolymorphicJs(mapping) {
         jsCode = jsCode.replace(regex2, `addRaw("${randKey}"`);
     }
 
-    const obfuscationResult = JavaScriptObfuscator.obfuscate(jsCode, {
-        compact: true,
-        controlFlowFlattening: true,
-        deadCodeInjection: true,
-        stringArray: true,
-        stringArrayRotate: true,
-        stringArrayShuffle: true,
-        seed: Math.abs(mapping.wasmConstants.seed),
-        selfDefending: true,
+    return new Promise((resolve, reject) => {
+        const worker = new Worker(new URL('./obfuscation.worker.js', import.meta.url));
+        worker.on('message', (message) => {
+            if (message.error) {
+                console.error('[Fingerprint] Obfuscation worker error:', message.error, message.stack);
+                reject(new Error('Obfuscation failed in worker.'));
+            } else {
+                resolve(message.obfuscatedCode);
+            }
+            worker.terminate();
+        });
+        worker.on('error', (error) => {
+            console.error('[Fingerprint] Obfuscation worker crashed:', error);
+            reject(error);
+        });
+        worker.on('exit', (code) => {
+            if (code !== 0) {
+                console.error(`[Fingerprint] Obfuscation worker stopped with exit code ${code}`);
+                reject(new Error(`Obfuscation worker stopped with exit code ${code}`));
+            }
+        });
+        worker.postMessage({ jsCode, seed: mapping.wasmConstants.seed });
     });
-
-    return obfuscationResult.getObfuscatedCode();
 }
 
 async function ensureLatestMapping() {
@@ -699,6 +762,54 @@ const cipherSuiteMap = {
     'TLS_RSA_WITH_3DES_EDE_CBC_SHA': 10,
 };
 
+/**
+ * Valide cryptographiquement l'attestation/assertion WebAuthn émise par l'enclave sécurisée.
+ * @private
+ * @param {object} anchor Les données d'attestation WebAuthn reçues du client
+ * @param {object} deviceData Les données persistantes de l'appareil dans notre store
+ * @returns {boolean} True si la signature matérielle est valide
+ */
+function verifyWebAuthnHardwareAnchor(anchor, deviceData) {
+    if (!anchor || !anchor.type) return false;
+
+    try {
+        const clientDataHash = crypto.createHash('sha256')
+            .update(Buffer.from(anchor.clientDataJSON, 'base64'))
+            .digest();
+
+        if (anchor.type === 'registration') {
+            if (!anchor.publicKey || !anchor.credentialId) return false;
+            
+            // Enregistrement initial : on stocke la clé publique matérielle SPKI
+            deviceData.webauthnPublicKey = anchor.publicKey;
+            deviceData.webauthnCredentialId = anchor.credentialId;
+            return true;
+        } else if (anchor.type === 'assertion') {
+            const storedPublicKeyPem = deviceData.webauthnPublicKey;
+            if (!storedPublicKeyPem || deviceData.webauthnCredentialId !== anchor.credentialId) {
+                return false;
+            }
+
+            // Reconstitution du message signé (authenticatorData + clientDataHash)
+            const verifyBuffer = Buffer.concat([
+                Buffer.from(anchor.authenticatorData, 'base64'),
+                clientDataHash
+            ]);
+
+            const publicKey = crypto.createPublicKey(Buffer.from(storedPublicKeyPem, 'base64'));
+            return crypto.verify(
+                'sha256',
+                verifyBuffer,
+                publicKey,
+                Buffer.from(anchor.signature, 'base64')
+            );
+        }
+    } catch (e) {
+        console.error('[WebAuthn-Server] Verification failed:', e.message);
+    }
+    return false;
+}
+
 /**
  * Extracts TLS fingerprints (JA3 and JA4) from request context.
  * Prioritizes headers from reverse proxies (x-ja4-hash) and falls back to JA3 calculation
@@ -1455,9 +1566,10 @@ export async function generateSpaceChallenge(clientIp, nonce, suspicionFactor, o
 }
 
 function generateSpaceChallengePage(challengeDetails, clientSecret, securityConfig) {
-  const { nonce, sizeMb, queries, path } = challengeDetails;
+  const { nonce, sizeMb, queries, path, peerId, peerBlockIdx } = challengeDetails;
   const solverCode = getPowSolverCode();
     const safePath = sanitizeRedirectPath(path);
+  const coopTimeout = securityConfig?.pospace?.coopTimeout ?? 15;
 
     const challengeScript = `
     async function solve() {
@@ -1466,16 +1578,49 @@ function generateSpaceChallengePage(challengeDetails, clientSecret, securityConf
        const clientSecret = ${safeJsonStringify(clientSecret)};
       const queries = ${JSON.stringify(queries)};
       const sizeMb = ${sizeMb};
+      const nodeId = nonce;
+      const peerId = ${safeJsonStringify(peerId || '')};
+      const peerBlockIdx = ${peerBlockIdx ?? -1};
+      const coopTimeout = ${coopTimeout};
       
       document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
       await new Promise(r => setTimeout(r, 10));
       
       try {
           await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
+          
+          if (peerId && peerBlockIdx !== -1) {
+              // Enregistrement coopératif
+              await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret));
+          }
+
           document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
-          const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret);
+
+          let peerBlock = "";
+          if (peerId && peerBlockIdx !== -1) {
+              document.getElementById('loader').innerText = '📥 Téléchargement du bloc de validation du pair (' + peerId + ')...';
+              const reqId = Math.random().toString(36).substring(2);
+              await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId);
+              
+              let attempts = 0;
+              while (attempts < coopTimeout) {
+                  const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId);
+                  const data = await res.json();
+                  if (data.status === 'ready') {
+                      peerBlock = data.block_data;
+                      break;
+                  }
+                  await new Promise(r => setTimeout(r, 1000));
+                  attempts++;
+              }
+              if (!peerBlock) {
+                  document.getElementById('loader').innerText = '⚠️ Peer de sous-réseau injoignable. Validation solo...';
+              }
+          }
+
+          const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret, peerBlock);
           
-          window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash;
+          window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash + (peerBlock ? "&pow_coop=1" : "");
       } catch(e) {
           document.getElementById('loader').innerText = "Error initializing local storage: " + e.message;
       }
@@ -1879,10 +2024,29 @@ function getBehaviorScore(context) {
  * @param {object} metrics - Les métriques comportementales parsées depuis le client.
  * @returns {{timeInconsistencyScore: number}}
  */
-function getTimeInconsistencyScore(context, metrics) {
+function getTimeInconsistencyScore(context, metrics, deviceData = null) {
   const REPLAY_THRESHOLD_MS = 5000; // 5 secondes
   let score = 0;
 
+  if (deviceData && deviceData.sessionHmacKey && metrics.signature) {
+    try {
+      const copy = JSON.parse(JSON.stringify(metrics));
+      const clientSig = copy.signature;
+      delete copy.signature;
+      const dataToSign = JSON.stringify(copy);
+      const expectedSig = crypto.createHmac('sha256', Buffer.from(deviceData.sessionHmacKey, 'hex'))
+                                .update(dataToSign)
+                                .digest('hex');
+      if (!crypto.timingSafeEqual(Buffer.from(clientSig, 'hex'), Buffer.from(expectedSig, 'hex'))) {
+        return { timeInconsistencyScore: 100 }; // Replay/tampering detected
+      }
+    } catch (e) {
+      return { timeInconsistencyScore: 100 };
+    }
+  } else if (deviceData && deviceData.sessionHmacKey && !metrics.signature) {
+    return { timeInconsistencyScore: 100 }; // Missing mandatory signature
+  }
+
   if (metrics.clientTimestamp && context.requestTimestamp) {
     const timeDelta = context.requestTimestamp - metrics.clientTimestamp;
 
@@ -2351,80 +2515,6 @@ function getClickVarianceScore(context) {
  * @returns {string|null} The subnet CIDR or null if the IP is invalid.
  */
 function getIpSubnet(ip, ipv4Prefix = 24, ipv6Prefix = 48) { // eslint-disable-line no-unused-vars
-  /**
-   * @private
-   * Parses an IPv6 string, expanding '::' into a 16-byte Buffer.
-   * @param {string} ipStr The IPv6 address string.
-   * @returns {Buffer|null}
-   */
-  const parseIPv6 = (ipStr) => {
-    const parts = ipStr.split('::');
-    if (parts.length > 2) return null;
-
-    let hextets = [];
-    if (parts[0]) hextets.push(...parts[0].split(':'));
-
-    if (parts.length === 2) {
-      const hextetsInPart2 = parts[1] ? parts[1].split(':').length : 0;
-      const zerosToInsert = 8 - hextets.length - hextetsInPart2;
-      for (let i = 0; i < zerosToInsert; i++) {
-        hextets.push('0');
-      }
-      if (parts[1]) hextets.push(...parts[1].split(':'));
-    }
-
-    if (hextets.length !== 8) return null;
-
-    const buffer = Buffer.alloc(16);
-    for (let i = 0; i < 8; i++) {
-      const val = parseInt(hextets[i] || '0', 16);
-      if (isNaN(val)) return null;
-      buffer.writeUInt16BE(val, i * 2);
-    }
-    return buffer;
-  };
-
-  /**
-   * @private
-   * Formats a 16-byte IPv6 buffer into a compressed string representation.
-   * @param {Buffer} buffer The 16-byte buffer.
-   * @returns {string}
-   */
-  const formatIPv6 = (buffer) => {
-    const hextets = [];
-    for (let i = 0; i < 16; i += 2) {
-      hextets.push(buffer.readUInt16BE(i).toString(16));
-    }
-
-    let bestStart = -1, bestLength = 0, currentStart = -1, currentLength = 0;
-    for (let i = 0; i < hextets.length; i++) {
-      if (hextets[i] === '0') {
-        if (currentStart === -1) currentStart = i;
-        currentLength++;
-      } else {
-        if (currentLength > bestLength) {
-          bestStart = currentStart;
-          bestLength = currentLength;
-        }
-        currentStart = -1;
-        currentLength = 0;
-      }
-    }
-    if (currentLength > bestLength) {
-      bestStart = currentStart;
-      bestLength = currentLength;
-    }
-
-    // For subnet calculations, an uncompressed view is often clearer.
-    // We will avoid compression to match test expectations.
-    // if (bestLength > 1) {
-    //   const part1 = hextets.slice(0, bestStart).join(':');
-    //   const part2 = hextets.slice(bestStart + bestLength).join(':');
-    //   return `${part1}::${part2}`;
-    // }
-    return hextets.join(':');
-  };
-
   try {
     if (isIPv4(ip)) {
       const ipBuffer = Buffer.from(ip.split('.').map(Number));
@@ -2433,14 +2523,37 @@ function getIpSubnet(ip, ipv4Prefix = 24, ipv6Prefix = 48) { // eslint-disable-l
       for (let i = 0; i < 4; i++) ipBuffer[i] &= mask[i];
       return `${Array.from(ipBuffer).join('.')}/${ipv4Prefix}`;
     } else if (isIPv6(ip)) {
-      const ipBuffer = parseIPv6(ip);
-      if (!ipBuffer) return null;
-
-      const mask = Buffer.alloc(16, 0);
-      for (let i = 0; i < ipv6Prefix; i++) mask[Math.floor(i / 8)] |= 1 << (7 - (i % 8));
-      for (let i = 0; i < 16; i++) ipBuffer[i] &= mask[i];
-
-      return `${formatIPv6(ipBuffer)}/${ipv6Prefix}`;
+      let normalized = ip.trim().toLowerCase();
+      if (normalized.includes("::")) {
+        const parts = normalized.split("::");
+        if (parts.length > 2) return null;
+        const left = parts[0] ? parts[0].split(":") : [];
+        const right = parts[1] ? parts[1].split(":") : [];
+        const missing = 8 - (left.length + right.length);
+        const middle = Array(missing).fill("0000");
+        normalized = [...left, ...middle, ...right].join(":");
+      } else {
+        const parts = normalized.split(":");
+        if (parts.length !== 8) return null;
+      }
+      const groups = normalized.split(":").map(g => {
+        const val = parseInt(g, 16);
+        return isNaN(val) ? "0000" : val.toString(16).padStart(4, "0");
+      });
+      for (let i = 0; i < 8; i++) {
+        const startBit = i * 16;
+        if (ipv6Prefix >= (i + 1) * 16) {
+          continue;
+        } else if (ipv6Prefix <= startBit) {
+          groups[i] = "0000";
+        } else {
+          const bitsToKeep = ipv6Prefix - startBit;
+          const val = parseInt(groups[i], 16);
+          const mask = (0xffff << (16 - bitsToKeep)) & 0xffff;
+          groups[i] = (val & mask).toString(16).padStart(4, "0");
+        }
+      }
+      return `${groups.join(":")}/${ipv6Prefix}`;
     }
   } catch (e) {
     // Catch any unexpected errors during parsing or manipulation
@@ -2853,12 +2966,19 @@ async function resolveRequestIdentity(context, securityConfig = {}) {
     // Case 2: New user or lost/invalid cookie.
     deviceId = crypto.randomUUID(); // Generate a new "passport".
 
+    const isHttps = context.headers?.['x-forwarded-proto'] === 'https' || 
+                    context.rawReq?.secure || 
+                    context.rawReq?.protocol === 'https' ||
+                    context.rawReq?.connection?.encrypted;
+    const secureOption = isHttps || process.env.NODE_ENV === "production";
+
     // Return the intention to set a cookie.
     newCookie = {
       name: "device_id",
       value: deviceId,
       options: {
-        httpOnly: true, secure: process.env.NODE_ENV === "production", sameSite: "strict",
+        httpOnly: true, secure: secureOption, sameSite: "strict",
+        ...(secureOption && { partitioned: true }),
         // Le maxAge est maintenant configurable. Par défaut, c'est un cookie de session.
         ...(securityConfig.deviceIdCookieMaxAge && { maxAge: securityConfig.deviceIdCookieMaxAge }),
       }
@@ -2931,6 +3051,23 @@ async function getBehavioralIndicators(context, deviceData) {
   deviceData.lastFpHash = currentFpHash;
   deviceData.ips.add(clientIp); // Record the IP used by this device
 
+  // --- VALIDATION DE L'ANCRAGE MATÉRIEL WEBAUTHN ---
+  const behaviorHeader = context.headers?.['x-behavior-metrics'];
+  let webauthnVerified = false;
+  if (behaviorHeader) {
+      try {
+          const metrics = JSON.parse(behaviorHeader);
+          if (metrics && metrics.webauthnAnchor) {
+              if (verifyWebAuthnHardwareAnchor(metrics.webauthnAnchor, deviceData)) {
+                  webauthnVerified = true;
+                  deviceData.webauthnVerified = true;
+              }
+          }
+      } catch (e) {
+          // Ignorer les erreurs de parsing
+      }
+  }
+
   // NOUVELLE LOGIQUE : Le score d'historique est basé sur le nombre d'IPs utilisées par l'appareil.
   // Très efficace contre la rotation de proxy.
   const maxIpsForDevice = isSharedIp
@@ -2974,7 +3111,6 @@ export const getSuspicionVector = async (context, securityConfig) => {
     context._newCookies = context._newCookies || [];
     context._newCookies.push(newCookie);
   }
-  await store.set(`ip-device:${clientIp}`, deviceId, 600); // Link the IP to the device for 10 minutes
 
   // Periodically clean up device data
   if (Date.now() - deviceData.lastUpdate > 10 * 60 * 1000) { // 10 minutes
@@ -2983,48 +3119,56 @@ export const getSuspicionVector = async (context, securityConfig) => {
   }
   deviceData.lastUpdate = Date.now();
 
-  const behavioral = await getBehavioralIndicators(context, deviceData);
-  const { headerAnomalyScore } = getHeaderAnomalies(context);
-  // Calculate the inconsistency score here, separately.
-  let inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200)); // Amplified score
-
-  // NOUVEAU: Si l'incohérence est très forte (cookie probablement volé), on applique une pénalité maximale.
-  if (consistencyScore < 0.7) { // Seuil de rupture
-      inconsistencyScore = 100;
-  }
-
-  const { behaviorScore } = getBehaviorScore(context); // Appel de la fonction
-
-  // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
-  const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
+  const stableFp = extractStablePart(currentDeviceHash);
+  const stableFpHash = cyrb53(stableFp).toString();
 
-  const { tlsSpoofingScore } = await getTlsSpoofingScore(context);
+      // Execute non-interdependent asynchronous operations in parallel
+      const [
+        behavioral,
+        { tlsSpoofingScore },
+        { subnetScore },
+        ipReputationScore,
+        { botnetClusterScore },
+        _ // store.set result
+      ] = await Promise.all([
+        getBehavioralIndicators(context, deviceData),
+        getTlsSpoofingScore(context),
+        getSubnetScore(context, deviceId),
+        getIpReputationScore(clientIp),
+        getBotnetClusterScore(context, stableFpHash),
+        store.set(`ip-device:${clientIp}`, deviceId, 600) // Link the IP to the device for 10 minutes
+      ]);
+
+      // Synchronous calculations
+      const { headerAnomalyScore } = getHeaderAnomalies(context);
+      let inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200)); // Amplified score
+
+      // NOUVEAU: Si l'incohérence est très forte (cookie probablement volé), on applique une pénalité maximale.
+      if (consistencyScore < 0.7) { // Seuil de rupture
+          inconsistencyScore = 100;
+      }
 
-  const { botScore } = getBotScore(context);
+      const { behaviorScore } = getBehaviorScore(context); // Appel de la fonction
 
-  // NOUVEAU: On calcule le score d'incohérence temporelle.
-  const { timeInconsistencyScore } = getTimeInconsistencyScore(context, JSON.parse(context.headers['x-behavior-metrics'] || '{}'));
+      // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
+      const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
 
-  // NOUVEAU: On calcule le score d'incohérence entre les couches.
-  const { crossLayerInconsistencyScore } = getCrossLayerInconsistency(context);
+      const { botScore } = getBotScore(context);
 
-  // NOUVEAU: On calcule le score de variance des clics.
-  const { clickVarianceScore } = getClickVarianceScore(context);
+      // NOUVEAU: On calcule le score d'incohérence temporelle.
+      const { timeInconsistencyScore } = getTimeInconsistencyScore(context, JSON.parse(context.headers['x-behavior-metrics'] || '{}'), deviceData);
 
-  // NOUVEAU: On calcule le score d'incohérence des Client-Hints.
-  const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
+      // NOUVEAU: On calcule le score d'incohérence entre les couches.
+      const { crossLayerInconsistencyScore } = getCrossLayerInconsistency(context);
 
-  // NOUVEAU: On calcule le score de réputation du sous-réseau.
-  // FIX: Pass the deviceId to getSubnetScore
-  const { subnetScore } = await getSubnetScore(context, deviceId);
+      // NOUVEAU: On calcule le score de variance des clics.
+      const { clickVarianceScore } = getClickVarianceScore(context);
 
-  const { requestPatternScore } = getRequestPatternScore(context, deviceData, securityConfig.patterns);
+      // NOUVEAU: On calcule le score d'incohérence des Client-Hints.
+      const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
 
-  const ipReputationScore = await getIpReputationScore(clientIp);
+      const { requestPatternScore } = getRequestPatternScore(context, deviceData, securityConfig.patterns);
 
-  const stableFp = extractStablePart(currentDeviceHash);
-  const stableFpHash = cyrb53(stableFp).toString();
-  const { botnetClusterScore } = await getBotnetClusterScore(context, stableFpHash);
   const { tcpAnomalyScore } = getTcpAnomalyScore(context);
   const { quicAnomalyScore } = getQuicAnomalyScore(context);
   const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
@@ -3163,7 +3307,40 @@ export function generateCpuTargetChallenge(
   };
 }
 
-const htmlTemplateCache = new Map();
+class SimpleLRUCache {
+    constructor(maxSize = 100) {
+        this.maxSize = maxSize;
+        this.cache = new Map();
+    }
+
+    get(key) {
+        if (!this.cache.has(key)) return undefined;
+        const value = this.cache.get(key);
+        this.cache.delete(key);
+        this.cache.set(key, value);
+        return value;
+    }
+
+    set(key, value) {
+        if (this.cache.has(key)) {
+            this.cache.delete(key);
+        } else if (this.cache.size >= this.maxSize) {
+            const lruKey = this.cache.keys().next().value;
+            this.cache.delete(lruKey);
+        }
+        this.cache.set(key, value);
+    }
+
+    has(key) {
+        return this.cache.has(key);
+    }
+
+    clear() {
+        this.cache.clear();
+    }
+}
+
+const htmlTemplateCache = new SimpleLRUCache(100);
 
 /**
  * Generates the HTML page for the CPU target challenge.
@@ -3250,7 +3427,7 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
         }
 
         // Redirect with both solutions and the fingerprint used to solve.
-        const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
+        const finalUrl = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + encodeURIComponent(JSON.stringify(memSolution));
         window.location.href = finalUrl;
       }
 
@@ -3705,6 +3882,10 @@ export class FingerprintEngine {
       return false;
     }
 
+    if (!canAttemptDns()) {
+      return false;
+    }
+
     const cacheKey = `ip-whitelist:${clientIp}`;
     const cachedStatus = await store.get(cacheKey);
 
@@ -3717,32 +3898,35 @@ export class FingerprintEngine {
 
     try {
       // 1. Reverse DNS lookup
-      const hostnames = await dns.reverse(clientIp);
+      const hostnames = await withTimeout(dns.reverse(clientIp), 500);
       const validHostname = hostnames.find(h => h.endsWith(matchedRule.hostnameSuffix));
 
       if (!validHostname) {
-        await store.set(cacheKey, 'failed', 86400); // Cache failure for 24h (TTL in seconds)
+        await store.set(cacheKey, 'failed', 300); // Temporary negative caching (5 minutes)
         return false;
       }
 
       // 2. Forward DNS lookup
     let addresses = [];
     try {
-      addresses = await dns.resolve(validHostname);
+        addresses = await withTimeout(dns.resolve(validHostname), 500);
     } catch (e) {}
     try {
-      const ipv6 = await dns.resolve(validHostname, 'AAAA');
+        const ipv6 = await withTimeout(dns.resolve(validHostname, 'AAAA'), 500);
       addresses = addresses.concat(ipv6);
     } catch (e) {}
     if (addresses.includes(clientIp)) {
+        recordDnsSuccess();
         await store.set(cacheKey, 'verified', 86400); // Cache success for 24h (TTL in seconds)
         return true;
       }
     } catch (error) {
-      // DNS errors are common (e.g., for IPs with no rDNS record), treat as failure.
+      recordDnsFailure();
+      await store.set(cacheKey, 'failed', 300); // Temporary negative caching (5 minutes)
+      return false;
     }
 
-    await store.set(cacheKey, 'failed', 86400); // Cache failure for 24h (TTL in seconds)
+    await store.set(cacheKey, 'failed', 300); // Temporary negative caching (5 minutes)
     return false;
   }
 
@@ -3764,13 +3948,19 @@ export class FingerprintEngine {
     
     this._log('Processing request', { clientIp, path, isStatic });
     
+    // Bypass instantané si l'appareil a prouvé cryptographiquement son identité matérielle (Secure Enclave / TPM)
+    const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
+    if (deviceData && deviceData.webauthnVerified) {
+        this._log('Hardware-anchored device verified (WebAuthn) - full bypass granted', { deviceId });
+        return { action: 'next', score: 0, vector: { webauthn_verified: 100 } };
+    }
+
     if (isStatic) {
       this._log('Static resource - skipping checks');
       return { action: 'next', score: 0, vector: {} };
     }
 
     // Resolve identity and check for persisted "condemned" status early.
-    const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
     const currentDeviceHash = getCompositeDeviceHash(requestContext);
     const isNewDevice = !!newCookie;
     const allowRoaming = this.securityConfig?.allowCrossNetworkRoaming ?? false;
@@ -4040,6 +4230,11 @@ export class FingerprintEngine {
             const finalQueryString = finalSearchParams.toString();
             const finalRedirectPath = finalQueryString ? `${originalUrl.pathname}?${finalQueryString}` : originalUrl.pathname;
             this._log('Redirecting to clean path', { finalRedirectPath, cookieMaxAge: finalTtl });
+            const isHttps = requestContext.headers?.['x-forwarded-proto'] === 'https' || 
+                            requestContext.rawReq?.secure || 
+                            requestContext.rawReq?.protocol === 'https' ||
+                            requestContext.rawReq?.connection?.encrypted;
+            const secureOption = isHttps || this.isProduction;
             return {
               action: 'redirect',
               path: finalRedirectPath,
@@ -4048,7 +4243,13 @@ export class FingerprintEngine {
               cookie: {
                 name: 'pow_clearance',
                 value: ticket, // The ticket itself
-                options: { httpOnly: true, secure: this.isProduction, maxAge: finalTtl } // Options for setting the cookie
+                options: { 
+                  httpOnly: true, 
+                  secure: secureOption, 
+                  sameSite: 'strict',
+                  ...(secureOption && { partitioned: true }),
+                  maxAge: finalTtl 
+                } // Options for setting the cookie
               }
             };
         } else {
@@ -4123,7 +4324,7 @@ export class FingerprintEngine {
         if (challengeContext) {
             try {
                 const workResult = JSON.parse(pow_solution_work_result);
-                const defaultPath = resolve(__dirname, '..', '..', 'problems.config.json');
+                const defaultPath = resolve(__dirname, '..', '..', 'config', 'problems.config.json');
                 const configPath = this.securityConfig.usefulWorkConfigPath || (existsSync(defaultPath) ? defaultPath : undefined);
                 const manager = await getProblemManager({
                     configPath,
@@ -4178,17 +4379,22 @@ export class FingerprintEngine {
 
     const isBlocked = finalScore >= blockThreshold;
 
-    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
+    const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked && finalScore > 0;
     const isSuspiciousMedium = finalScore >= thresholds.medium;
     const isSuspicious = finalScore >= thresholds.low;
     const isVerySuspicious = finalScore >= thresholds.medium; // Seuil pour le challenge d'optimisation
 
     // Calculate an analog "suspicion factor" (0 to 1+) for progressive difficulty
-    const suspicionFactor = isSuspicious
-        ? Math.min(
-            1.5, // On autorise un dépassement pour rendre les challenges très difficiles si le score est très élevé
-            (finalScore - thresholds.low) / (thresholds.high - thresholds.low),
-        )
+    const suspicionFactor = isSuspicious // eslint-disable-line no-nested-ternary
+        ? (() => {
+            const denominator = thresholds.high - thresholds.low;
+            if (denominator === 0) {
+                // If the range is zero, and finalScore is at or above low threshold,
+                // return 0 to avoid NaN.
+                return 0;
+            }
+            return Math.min(1.5, (finalScore - thresholds.low) / denominator);
+        })()
         : 0;
 
     this._log('Suspicion levels evaluated', { 
@@ -4319,7 +4525,7 @@ export class FingerprintEngine {
             this._log('Issuing a useful work challenge', { finalScore });
 
             try {
-                const defaultPath = resolve(process.cwd(), 'problems.config.json');
+                const defaultPath = resolve(process.cwd(), 'config', 'problems.config.json');
                 const configPath = this.securityConfig.usefulWorkConfigPath || (existsSync(defaultPath) ? defaultPath : undefined);
                 const manager = await getProblemManager({
                     configPath,
@@ -5278,14 +5484,14 @@ function getTlsSessionId(context) {
 }
 
 // --- Proof-of-Work Middleware (The Tollbooth) ---
-const staticFileCache = new Map();
+const staticFileCache = new SimpleLRUCache(50);
 
 export const powMiddleware = (securityConfig) => {
   const engine = new FingerprintEngine(securityConfig);
 
   // Initialize the problem manager with the configured path, if provided.
   if (securityConfig.enableUsefulWork) {
-    const defaultPath = resolve(__dirname, '..', '..', 'problems.config.json');
+    const defaultPath = resolve(__dirname, '..', '..', 'config', 'problems.config.json');
     const configPath = securityConfig.usefulWorkConfigPath || (existsSync(defaultPath) ? defaultPath : undefined);
     getProblemManager({
         configPath,
@@ -5310,6 +5516,36 @@ export const powMiddleware = (securityConfig) => {
   }
 
   return async (req, res, next) => {
+      if (req.query && req.query.fp_handshake) {
+          const clientKeyHex = req.headers['x-client-ephemeral-key'];
+          if (clientKeyHex) {
+              try {
+                  const serverECDH = crypto.createECDH('prime256v1');
+                  serverECDH.generateKeys();
+                  const serverPubKeyHex = serverECDH.getKeys('hex');
+                  const sharedSecret = serverECDH.computeSecret(clientKeyHex, 'hex');
+                  const hmacKey = crypto.createHash('sha256').update(sharedSecret).digest('hex');
+
+                  const requestContext = {
+                      clientIp: req.ip || req.socket?.remoteAddress || "unknown",
+                      headers: req.headers,
+                      cookies: req.cookies
+                  };
+                  const { deviceId, deviceData } = await resolveRequestIdentity(requestContext, securityConfig);
+                  if (deviceData) {
+                      deviceData.sessionHmacKey = hmacKey;
+                      await store.set(`device:${deviceId}`, deviceData);
+                  }
+
+                  res.setHeader('x-server-ephemeral-key', serverPubKeyHex);
+                  return res.status(200).json({ status: 'success' });
+              } catch (e) {
+                  return res.status(400).json({ error: 'Handshake failed' });
+              }
+          }
+          return res.status(400).json({ error: 'Missing client key' });
+      }
+
       if (!req.headers_translated) {
           req.headers_translated = true;
           const matchedMapping = getActiveMappingForRequest(req.headers);
@@ -5484,6 +5720,7 @@ export const __internal = {
     getTlsFingerprint, // NOUVEAU: Expose pour les tests
     sanitizeTrafficData, // NOUVEAU: Expose pour l'auto-tuner/tests
     getTlsSpoofingScore, // NOUVEAU: Expose pour les tests
+    verifyWebAuthnHardwareAnchor,
     generateStatelessTicket,
     parseStatelessTicket,
     parseJa3,
@@ -5500,11 +5737,17 @@ export const __internal = {
     setLastBestSolution: (val) => { lastBestSolution = val; }, // Expose to test auto-tuning metrics
     verifyZkpProof,
     modPow,
+    generateSessionMapping,
+    compilePolymorphicJs,
     parseTcpSyn, // Expose for testing
     classifyTcpOs, // Expose for testing
     getTcpAnomalyScore, // Expose for testing,
     getQuicAnomalyScore, // NOUVEAU: Expose pour les tests
     getRenderingAnomalyScore, // NOUVEAU: Expose pour les tests
+    dnsCircuitBreaker,
+    recordDnsSuccess,
+    recordDnsFailure,
+    canAttemptDns,
     registerCooperativeNode,
     findPeerInSubnet,
     handleCooperativeRequest
@@ -5526,48 +5769,79 @@ export function sanitizeTrafficData(trafficData) {
   if (!trafficData || trafficData.length === 0) {
     return [];
   }
-  const tempSanitized = [];
+  const suspiciousLogs = [];
+  const passedLogs = [];
   const deviceCounts = new Map();
   const ipCounts = new Map();
   const subnetCounts = new Map();
+  const hardwareClusterCounts = new Map();
+  const hwClusterCache = new Map();
 
   // Calcul des quotas maximums pour éviter l'influence démesurée d'une entité
   const maxLogsPerDevice = Math.max(3, Math.floor(trafficData.length * 0.02)); // Max 2% contribution per device
   const maxLogsPerIp = Math.max(3, Math.floor(trafficData.length * 0.02));      // Max 2% par adresse IP individuelle
   const maxLogsPerSubnet = Math.max(5, Math.floor(trafficData.length * 0.05));  // Max 5% par bloc réseau (anti-proxy-rotation)
+  const maxLogsPerHardwareCluster = Math.max(3, Math.floor(trafficData.length * 0.02)); // Max 2% par cluster matériel stable
+
+  const getHardwareCluster = (log) => {
+    const fp = log.deviceHash || log.fingerprint || log.deviceFingerprint || '';
+    if (!fp || typeof fp !== 'string') {
+      return log.deviceId || 'anonymous-cluster';
+    }
+    if (hwClusterCache.has(fp)) {
+      return hwClusterCache.get(fp);
+    }
+    const parts = fp.split('|');
+    const hwComponents = [];
+    for (const part of parts) {
+      const pair = part.split(':');
+      if (pair.length === 2 && (pair[0] === 'gpu' || pair[0] === 'cvs' || pair[0] === 'hw')) {
+        hwComponents.push(part);
+      }
+    }
+    const result = hwComponents.length > 0 ? hwComponents.sort().join('|') : (log.deviceId || 'anonymous-cluster');
+    hwClusterCache.set(fp, result);
+    return result;
+  };
 
   for (const log of trafficData) {
     const devId = log.deviceId || 'anonymous';
     const ip = log.clientIp || log.ip || 'unknown';
     const subnet = getIpSubnet(ip) || 'unknown-subnet';
+    const hwCluster = getHardwareCluster(log);
 
     const currentDeviceCount = deviceCounts.get(devId) || 0;
     const currentIpCount = ipCounts.get(ip) || 0;
     const currentSubnetCount = subnetCounts.get(subnet) || 0;
+    const currentHwClusterCount = hardwareClusterCounts.get(hwCluster) || 0;
 
-    // Filtrage anti-poisoning strict sur 3 axes cumulatifs
+    // Filtrage anti-poisoning strict sur 4 axes cumulatifs (incluant le clustering matériel stable)
     if (
       currentDeviceCount < maxLogsPerDevice &&
       (ip === 'unknown' || currentIpCount < maxLogsPerIp) &&
-      (subnet === 'unknown-subnet' || currentSubnetCount < maxLogsPerSubnet)
+      (subnet === 'unknown-subnet' || currentSubnetCount < maxLogsPerSubnet) &&
+      currentHwClusterCount < maxLogsPerHardwareCluster
     ) {
       deviceCounts.set(devId, currentDeviceCount + 1);
       if (ip !== 'unknown') ipCounts.set(ip, currentIpCount + 1);
       if (subnet !== 'unknown-subnet') subnetCounts.set(subnet, currentSubnetCount + 1);
+      hardwareClusterCounts.set(hwCluster, currentHwClusterCount + 1);
 
-      tempSanitized.push(log);
+      if (log.type === 'request_passed') {
+        passedLogs.push(log);
+      } else {
+        suspiciousLogs.push(log);
+      }
     }
   }
 
-  const passedLogs = tempSanitized.filter(log => log.type === 'request_passed');
-  const suspiciousLogs = tempSanitized.filter(log => log.type !== 'request_passed');
-
   const minDataPoints = 200; // Seuil par défaut
   const maxPassedAllowed = Math.max(minDataPoints, suspiciousLogs.length * 9);
-  const shuffledPassed = passedLogs.sort(() => 0.5 - Math.random());
-  const selectedPassed = shuffledPassed.slice(0, maxPassedAllowed);
-
-  return [...suspiciousLogs, ...selectedPassed];
+  if (passedLogs.length > maxPassedAllowed) {
+    const shuffledPassed = passedLogs.sort(() => 0.5 - Math.random());
+    return [...suspiciousLogs, ...shuffledPassed.slice(0, maxPassedAllowed)];
+  }
+  return [...suspiciousLogs, ...passedLogs];
 }
 /**
  * Assainit et limite la taille/ancienneté des données de trafic pour éviter les fuites de mémoire.
@@ -5745,6 +6019,43 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
   // Plus le ratio est équilibré et le volume important, plus nous faisons confiance au Front de Pareto.
   const trafficConfidence = Math.min(1.5, Math.max(0.3, highConfidenceRatio * 4));
 
+    // --- VALIDATION POST-CALCUL (Anti-empoisonnement & Validation Croisée) ---
+    const tempConfig = {
+        thresholds: { ...securityConfig.thresholds },
+        weights: { ...securityConfig.weights },
+        patterns: { ...securityConfig.patterns }
+    };
+
+    applyInertialUpdate(tempConfig.thresholds, newConfig.thresholds, 'thresholds', trafficConfidence);
+    applyInertialUpdate(tempConfig.weights, newConfig.weights, 'weights', trafficConfidence);
+    applyInertialUpdate(tempConfig.patterns, newConfig.patterns, 'patterns', trafficConfidence);
+
+    const fitnessFunction = Optimization.Operators.createFullSecurityConfigEvaluator({ trafficData: sanitizedData });
+    const currentObjectives = fitnessFunction(securityConfig);
+    const proposedObjectives = fitnessFunction(tempConfig);
+
+    const currentFPR = currentObjectives[0];
+    const currentFNR = currentObjectives[1];
+    const proposedFPR = proposedObjectives[0];
+    const proposedFNR = proposedObjectives[1];
+
+    const validationTolerance = securityConfig?.autotuning?.validationTolerance ?? tuningOptions?.validationTolerance ?? 0.15;
+
+    if (proposedFPR > currentFPR + validationTolerance || proposedFNR > currentFNR + validationTolerance) {
+        console.error(`[AutoTuning] [SECURITY ALERT] Proposed configuration rejected due to instability/poisoning risk! Proposed FPR: ${proposedFPR.toFixed(4)} (Current: ${currentFPR.toFixed(4)}), Proposed FNR: ${proposedFNR.toFixed(4)} (Current: ${currentFNR.toFixed(4)})`);
+        if (securityConfig.logger && typeof securityConfig.logger === 'function') {
+            securityConfig.logger({
+                type: 'autotuning_instability_alert',
+                proposedFPR,
+                currentFPR,
+                proposedFNR,
+                currentFNR,
+                timestamp: Date.now()
+            });
+        }
+        return; // Rollback automatique : On arrête l'application
+    }
+
   applyInertialUpdate(securityConfig.thresholds, newConfig.thresholds, 'thresholds', trafficConfidence);
   applyInertialUpdate(securityConfig.weights, newConfig.weights, 'weights', trafficConfidence);
   applyInertialUpdate(securityConfig.patterns, newConfig.patterns, 'patterns', trafficConfidence);