@anonympins/fingerprint 0.5.4 → 0.6.0

package/src/js/tests/fingerprint.client.test.js

@@ -1,129 +1,131 @@
-/**
- * @vitest-environment jsdom
- */
-
-import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
-import ClientLibrary from '../fingerprint.client.js';
-
-describe('ClientLibrary WASM Integration', () => {
-    beforeEach(() => {
-        // Réinitialise le cache et les mocks avant chaque test
-        ClientLibrary._resetCache();
-        vi.spyOn(console, 'log').mockImplementation(() => {});
-        vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-        // Supprime les mocks globaux pour éviter les fuites entre les tests
-        delete window.createFingerprintModule;
-    });
-
-    afterEach(() => {
-        vi.restoreAllMocks();
-    });
-
-    it('should successfully load WASM module and switch hasher', async () => {
-        // 1. Simuler un module WASM fonctionnel
-        const mockWasmModule = {
-            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
-        };
-
-        // 2. Simuler le chargement du script et l'initialisation du module
-        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        // On simule l'injection du script en appelant directement `onload`
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            // Simule le chargement réussi du script
-            script.onload();
-            return script;
-        });
-
-        // 3. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 4. Vérifier que le hasher a été remplacé
-        const wasmHash = ClientLibrary._hasher("test");
-        expect(wasmHash).toBe(99999);
-        expect(mockWasmModule._hash_string).toHaveBeenCalledWith("test");
-        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-    });
-
-    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
-        // 1. Simuler un échec de chargement du script
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onerror(new Error('Script loading failed'));
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier que le hasher est toujours l'implémentation JS
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        
-        expect(jsHash).toBe(originalJsHash);
-        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
-    });
-
-    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
-        // 1. Simuler un module WASM malformé (sans la fonction attendue)
-        const mockWasmModule = {};
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onload();
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier le fallback
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        expect(jsHash).toBe(originalJsHash); 
-        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
-        expect(console.warn).toHaveBeenCalledWith(
-            expect.stringContaining('WASM module failed to load'), 
-            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
-        );
-    });
-
-    it('should successfully load raw WASM and use standalone polymorphic hasher', async () => {
-        const mockWasmInstance = {
-            exports: {
-                memory: { buffer: new ArrayBuffer(65536) },
-                hash: vi.fn().mockReturnValue(123456)
-            }
-        };
-        
-        global.WebAssembly = {
-            compile: vi.fn().mockResolvedValue({}),
-            instantiate: vi.fn().mockResolvedValue(mockWasmInstance)
-        };
-        
-        global.fetch = vi.fn().mockResolvedValue({
-            arrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(100))
-        });
-
-        await ClientLibrary.initializeWasm('/fp.wasm');
-
-        const hash = ClientLibrary._hasher("test");
-        expect(hash).toBe(123456);
-        expect(mockWasmInstance.exports.hash).toHaveBeenCalledWith(0, 4);
-    });
-
-    it('should use the default JS hasher if WASM is not configured', async () => {
-        // Ensure no WASM path is provided in the config
-        ClientLibrary.initializeClient({});
-
-        // Verify that the active hasher is the original JS implementation
-        const jsHash = ClientLibrary._hasher("another test string");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
-
-        expect(jsHash).toBe(originalJsHash);
-        // Ensure no WASM-related console logs or warnings were made
-        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
-    });
+/**
+ * @vitest-environment jsdom
+ */
+
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
+import ClientLibrary from '../fingerprint.client.js';
+
+describe('ClientLibrary WASM Integration', () => {
+    beforeEach(() => {
+        // Réinitialise le cache et les mocks avant chaque test
+        ClientLibrary._resetCache();
+        vi.spyOn(console, 'log').mockImplementation(() => {});
+        vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+        // Supprime les mocks globaux pour éviter les fuites entre les tests
+        delete window.createFingerprintModule;
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    it('should successfully load WASM module and switch hasher', async () => {
+        // 1. Simuler un module WASM fonctionnel
+        const mockWasmModule = {
+            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
+            _malloc: vi.fn().mockReturnValue(0),
+            HEAPU8: new Uint8Array(4096)
+        };
+
+        // 2. Simuler le chargement du script et l'initialisation du module
+        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        // On simule l'injection du script en appelant directement `onload`
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            // Simule le chargement réussi du script
+            script.onload();
+            return script;
+        });
+
+        // 3. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 4. Vérifier que le hasher a été remplacé
+        const wasmHash = ClientLibrary._hasher("test");
+        expect(wasmHash).toBe(99999);
+        expect(mockWasmModule._hash_string).toHaveBeenCalledWith(0);
+        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+    });
+
+    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
+        // 1. Simuler un échec de chargement du script
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onerror(new Error('Script loading failed'));
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier que le hasher est toujours l'implémentation JS
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        
+        expect(jsHash).toBe(originalJsHash);
+        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
+    });
+
+    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
+        // 1. Simuler un module WASM malformé (sans la fonction attendue)
+        const mockWasmModule = {};
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onload();
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier le fallback
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        expect(jsHash).toBe(originalJsHash); 
+        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
+        expect(console.warn).toHaveBeenCalledWith(
+            expect.stringContaining('WASM module failed to load'), 
+            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
+        );
+    });
+
+    it('should successfully load raw WASM and use standalone polymorphic hasher', async () => {
+        const mockWasmInstance = {
+            exports: {
+                memory: { buffer: new ArrayBuffer(65536) },
+                hash: vi.fn().mockReturnValue(123456)
+            }
+        };
+        
+        global.WebAssembly = {
+            compile: vi.fn().mockResolvedValue({}),
+            instantiate: vi.fn().mockResolvedValue(mockWasmInstance)
+        };
+        
+        global.fetch = vi.fn().mockResolvedValue({
+            arrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(100))
+        });
+
+        await ClientLibrary.initializeWasm('/fp.wasm');
+
+        const hash = ClientLibrary._hasher("test");
+        expect(hash).toBe(123456);
+        expect(mockWasmInstance.exports.hash).toHaveBeenCalledWith(0, 4);
+    });
+
+    it('should use the default JS hasher if WASM is not configured', async () => {
+        // Ensure no WASM path is provided in the config
+        ClientLibrary.initializeClient({});
+
+        // Verify that the active hasher is the original JS implementation
+        const jsHash = ClientLibrary._hasher("another test string");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
+
+        expect(jsHash).toBe(originalJsHash);
+        // Ensure no WASM-related console logs or warnings were made
+        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
+    });
 });

package/src/js/tests/fingerprint.test.js

@@ -2075,6 +2075,31 @@ describe('getTimeInconsistencyScore', () => {
         expect(timeInconsistencyScore).toBe(0);
     });
 
+    it('should return 100 if the signature is invalid or missing when sessionHmacKey is negotiated', () => {
+        const requestTimestamp = Date.now();
+        const clientTimestamp = requestTimestamp - 100;
+        const context = { requestTimestamp };
+        const metrics = { clientTimestamp, signature: 'bad-signature' };
+        const deviceData = { sessionHmacKey: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' };
+
+        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics, deviceData);
+        expect(timeInconsistencyScore).toBe(100);
+    });
+
+    it('should return 0 if the signature is valid when sessionHmacKey is negotiated', () => {
+        const requestTimestamp = Date.now();
+        const clientTimestamp = requestTimestamp - 100;
+        const context = { requestTimestamp };
+        const deviceData = { sessionHmacKey: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef' };
+        const metrics = { clientTimestamp };
+        const dataToSign = JSON.stringify(metrics);
+        const signature = createHmac('sha256', Buffer.from(deviceData.sessionHmacKey, 'hex')).update(dataToSign).digest('hex');
+        metrics.signature = signature;
+
+        const { timeInconsistencyScore } = __internal.getTimeInconsistencyScore(context, metrics, deviceData);
+        expect(timeInconsistencyScore).toBe(0);
+    });
+
     it('should return a score > 0 for a replayed request (clientTimestamp significantly before requestTimestamp)', () => {
         const requestTimestamp = Date.now();
         const clientTimestamp = requestTimestamp - (REPLAY_THRESHOLD_MS + 1000); // 1 second beyond threshold
@@ -2618,6 +2643,11 @@ describe('Ed25519 Asymmetric Tickets', () => {
         const nodeIdA = 'node-a';
         const seedA = 'seed-a';
 
+        // Configurer les secrets dans le store pour passer la validation de signature
+        const store = __internal.store;
+        await store.set('secret:node-a', { clientSecret: 'secret-a' });
+        await store.set('secret:node-b', { clientSecret: 'secret-b' });
+
         // 1. Enregistrement du nœud A (pair)
         await __internal.registerCooperativeNode(clientIp, nodeIdA, seedA);
 
@@ -2627,21 +2657,31 @@ describe('Ed25519 Asymmetric Tickets', () => {
         expect(peer.nodeId).toBe(nodeIdA);
         expect(peer.seed).toBe(seedA);
 
+        const sigReq = createHash('sha256')
+            .update('secret-b:request_peer_block:node-b:node-a:42:req-123')
+            .digest('hex');
+
         // 3. Demande de bloc du nœud B vers le nœud A
         const paramsReq = {
             coop_op: 'request_peer_block',
             node_id: 'node-b',
             peer_id: 'node-a',
             block_idx: '42',
-            req_id: 'req-123'
+            req_id: 'req-123',
+            coop_sig: sigReq
         };
         const resReq = await __internal.handleCooperativeRequest(paramsReq, clientIp);
         expect(resReq.status).toBe('queued');
 
+        const sigPoll = createHash('sha256')
+            .update('secret-a:poll_requests:node-a')
+            .digest('hex');
+
         // 4. Récupération de la demande par le nœud A
         const paramsPoll = {
             coop_op: 'poll_requests',
-            node_id: 'node-a'
+            node_id: 'node-a',
+            coop_sig: sigPoll
         };
         const resPoll = await __internal.handleCooperativeRequest(paramsPoll, clientIp);
         expect(resPoll.requests.length).toBe(1);

package/src/js/tests/obfuscation.test.js

@@ -0,0 +1,48 @@
+import { describe, expect, it } from 'vitest';
+import { __internal } from '../fingerprint.js';
+
+describe('Système de Polymorphisme et Compilateur d\'Obfuscation', () => {
+    
+    it('should generate a valid session mapping with randomized headers and globals', () => {
+        const mapping1 = __internal.generateSessionMapping();
+        const mapping2 = __internal.generateSessionMapping();
+
+        // Vérification de la présence des structures attendues
+        expect(mapping1).toBeDefined();
+        expect(mapping1.headers).toHaveProperty('x-device-fingerprint');
+        expect(mapping1.headers).toHaveProperty('x-behavior-metrics');
+        expect(mapping1.globals).toHaveProperty('ClientLibrary');
+        expect(mapping1.globals).toHaveProperty('getDeviceFingerprint');
+        expect(mapping1.globals).toHaveProperty('getClientBehaviorMetrics');
+        expect(mapping1.keys).toHaveProperty('ua');
+        expect(mapping1.wasmConstants).toHaveProperty('seed');
+
+        // Vérification de l'aléa (deux sessions consécutives doivent avoir des mappings uniques)
+        expect(mapping1.headers['x-device-fingerprint']).not.toBe(mapping2.headers['x-device-fingerprint']);
+        expect(mapping1.globals['ClientLibrary']).not.toBe(mapping2.globals['ClientLibrary']);
+        expect(mapping1.keys['ua']).not.toBe(mapping2.keys['ua']);
+        expect(mapping1.wasmConstants.seed).not.toBe(mapping2.wasmConstants.seed);
+    });
+
+    it('should compile and obfuscate client script asynchronously using the obfuscation worker', async () => {
+        const mapping = __internal.generateSessionMapping();
+        
+        // On lance la compilation lourde qui instancie le Worker d'arrière-plan
+        const obfuscatedCode = await __internal.compilePolymorphicJs(mapping);
+
+        expect(obfuscatedCode).toBeDefined();
+        expect(typeof obfuscatedCode).toBe('string');
+        expect(obfuscatedCode.length).toBeGreaterThan(0);
+
+        // Vérification que les placeholders originaux ont bien été purgés du code client final
+        expect(obfuscatedCode).not.toContain('X-Device-Fingerprint');
+        expect(obfuscatedCode).not.toContain('X-Behavior-Metrics');
+        expect(obfuscatedCode).not.toContain('ClientLibrary');
+
+        // Vérification que le code est minifié/obfusqué (ne contient pas de commentaires de développement par exemple)
+        expect(obfuscatedCode).not.toContain('// Nom trompeur aléatoire pour attirer les analyseurs');
+        
+        // La structure globale de javascript-obfuscator génère typiquement un tableau de chaînes au début
+        expect(obfuscatedCode).toMatch(/_0x/);
+    }, 15000); // Augmentation du timeout à 15s car l'obfuscation via Worker thread consomme du CPU
+});

package/src/js/ttl-optimization.worker.js

@@ -0,0 +1,51 @@
+import { parentPort } from "node:worker_threads";
+import { Optimization } from "./library.js";
+
+const MIN_TTL = 300000;
+const MAX_TTL = 86400000;
+const keyScores = [0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100];
+const tempCache = {};
+
+for (const suspicionScore of keyScores) {
+    const solverFunction = () => {
+        const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+        const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
+        const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
+        const mutate = (ttl) => {
+            const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1;
+            return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
+        };
+
+        const paretoFront = Optimization.geneticAlgorithmMultiObjective(
+            createIndividual,
+            fitnessFunction,
+            crossover,
+            mutate,
+            {
+                generations: 40,
+                populationSize: 30,
+            }
+        );
+
+        if (!paretoFront || paretoFront.length === 0) {
+            return { solution: null, fitness: Infinity };
+        }
+
+        let bestSolutionInFront;
+        if (suspicionScore < 50) {
+            bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+        } else {
+            bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+        }
+        return { solution: bestSolutionInFront, fitness: 0 };
+    };
+
+    const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+    if (bestResult && bestResult.solution && bestResult.solution !== Infinity) {
+        tempCache[suspicionScore] = Math.round(bestResult.solution);
+    } else {
+        tempCache[suspicionScore] = Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL);
+    }
+}
+
+parentPort.postMessage(tempCache);

package/src/php/AutoTuner.php

@@ -30,6 +30,7 @@ class AutoTuner
     /** @var ?callable */
     private $onCleanup;
     private ?string $savePath;
+    private float $validationTolerance;
 
     /**
      * @var ?array<string, mixed> La dernière meilleure solution trouvée par l'optimiseur.
@@ -51,6 +52,7 @@ class AutoTuner
         $this->clearAfterTuning = $options['clearAfterTuning'] ?? false;
         $this->onCleanup = $options['onCleanup'] ?? null;
         $this->savePath = $options['savePath'] ?? null;
+        $this->validationTolerance = $options['validationTolerance'] ?? 0.15;
     }
 
     /**
@@ -211,6 +213,46 @@ class AutoTuner
             }
         };
 
+        // --- VALIDATION POST-CALCUL (PHP Rollback & Seuil de Tolérance) ---
+        $tempConfig = [
+            'thresholds' => $this->securityConfig['thresholds'],
+            'weights' => $this->securityConfig['weights'],
+            'patterns' => $this->securityConfig['patterns'],
+        ];
+
+        $applyInertialUpdate($tempConfig['thresholds'], $newConfig['thresholds'], 'thresholds', $trafficConfidence);
+        $applyInertialUpdate($tempConfig['weights'], $newConfig['weights'], 'weights', $trafficConfidence);
+        $applyInertialUpdate($tempConfig['patterns'], $newConfig['patterns'], 'patterns', $trafficConfidence);
+
+        $evaluator = OptimizationOperators::createFullSecurityConfigEvaluator(['trafficData' => $sanitizedData]);
+        $currentObjectives = $evaluator($this->securityConfig);
+        $proposedObjectives = $evaluator($tempConfig);
+
+        $currentFPR = $currentObjectives[0];
+        $currentFNR = $currentObjectives[1];
+        $proposedFPR = $proposedObjectives[0];
+        $proposedFNR = $proposedObjectives[1];
+
+        $validationTolerance = $this->securityConfig['autotuning']['validationTolerance'] ?? $this->validationTolerance;
+
+        if ($proposedFPR > $currentFPR + $validationTolerance || $proposedFNR > $currentFNR + $validationTolerance) {
+            error_log(sprintf(
+                "[AutoTuning] [SECURITY ALERT] Proposed configuration rejected due to instability/poisoning risk! Proposed FPR: %.4f (Current: %.4f), Proposed FNR: %.4f (Current: %.4f)",
+                $proposedFPR, $currentFPR, $proposedFNR, $currentFNR
+            ));
+            if (isset($this->securityConfig['logger']) && is_callable($this->securityConfig['logger'])) {
+                call_user_func($this->securityConfig['logger'], [
+                    'type' => 'autotuning_instability_alert',
+                    'proposedFPR' => $proposedFPR,
+                    'currentFPR' => $currentFPR,
+                    'proposedFNR' => $proposedFNR,
+                    'currentFNR' => $currentFNR,
+                    'timestamp' => (int)(microtime(true) * 1000)
+                ]);
+            }
+            return; // Rollback
+        }
+
         $applyInertialUpdate($this->securityConfig['thresholds'], $newConfig['thresholds'], 'thresholds', $trafficConfidence);
         $applyInertialUpdate($this->securityConfig['weights'], $newConfig['weights'], 'weights', $trafficConfidence);
         $applyInertialUpdate($this->securityConfig['patterns'], $newConfig['patterns'], 'patterns', $trafficConfidence);

package/src/php/Challenge/ChallengeUtils.php

@@ -151,6 +151,42 @@ class ChallengeUtils
             return ['error' => 'Missing node_id'];
         }
 
+        // --- VÉRIFICATION DE LA SIGNATURE COOPÉRATIVE ---
+        $challengeContext = $store->get("secret:{$nodeId}");
+        if (!$challengeContext || empty($challengeContext['clientSecret'])) {
+            return ['error' => 'Invalid or expired node_id'];
+        }
+
+        $clientSecret = $challengeContext['clientSecret'];
+        $coopSig = $params['coop_sig'] ?? '';
+
+        $expectedMsg = '';
+        switch ($op) {
+            case 'register':
+                $expectedMsg = "{$clientSecret}:register:{$nodeId}:" . ($params['seed'] ?? '');
+                break;
+            case 'request_peer_block':
+                $expectedMsg = "{$clientSecret}:request_peer_block:{$nodeId}:" . ($params['peer_id'] ?? '') . ":" . ($params['block_idx'] ?? '0') . ":" . ($params['req_id'] ?? '');
+                break;
+            case 'poll_requests':
+                $expectedMsg = "{$clientSecret}:poll_requests:{$nodeId}";
+                break;
+            case 'respond_block':
+                $expectedMsg = "{$clientSecret}:respond_block:{$nodeId}:" . ($params['requester_id'] ?? '') . ":" . ($params['req_id'] ?? '') . ":" . ($params['block_data'] ?? '');
+                break;
+            case 'poll_response':
+                $expectedMsg = "{$clientSecret}:poll_response:{$nodeId}:" . ($params['req_id'] ?? '');
+                break;
+            default:
+                return ['error' => 'Invalid cooperative operation'];
+        }
+
+        $expectedSig = hash('sha256', $expectedMsg);
+        if (!hash_equals($expectedSig, $coopSig)) {
+            return ['error' => 'Invalid cooperative signature'];
+        }
+        // --- FIN DE LA VÉRIFICATION ---
+
         switch ($op) {
             case 'register':
                 $clientIp = $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1';
@@ -857,25 +893,38 @@ class ChallengeUtils
             const peerBlockIdx = {$peerBlockIdx};
             const coopTimeout = {$coopTimeout};
             
+            async function signCoop(op, nid, extra = "") {
+              const msg = clientSecret + ":" + op + ":" + nid + (extra ? ":" + extra : "");
+              const encoder = new TextEncoder();
+              const data = encoder.encode(msg);
+              const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+              return Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, '0')).join('');
+            }
+            
             document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
             await new Promise(r => setTimeout(r, 10));
             
             try {
                 await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
                 
-                // Enregistrement coopératif
-                await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret));
+                if (peerId && peerBlockIdx !== -1) {
+                    // Enregistrement coopératif
+                    const sig = await signCoop("register", nodeId, nonce + ":" + clientSecret);
+                    await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret) + "&coop_sig=" + sig);
+                }
                 
                 // Écoute des requêtes entrantes de nos pairs suspects
                 setInterval(async () => {
                     try {
-                        const res = await fetch(window.location.pathname + "?coop_op=poll_requests&node_id=" + nodeId);
+                        const sig = await signCoop("poll_requests", nodeId);
+                        const res = await fetch(window.location.pathname + "?coop_op=poll_requests&node_id=" + nodeId + "&coop_sig=" + sig);
                         const data = await res.json();
                         if (data.requests && data.requests.length > 0) {
                             for (const req of data.requests) {
                                 document.getElementById('loader').innerText = '📤 Transfert coopératif de bloc vers le pair...';
                                 const blockData = await window.readSpaceBlock(req.block_idx);
-                                await fetch(window.location.pathname + "?coop_op=respond_block&node_id=" + nodeId + "&requester_id=" + req.requester_id + "&req_id=" + req.req_id + "&block_data=" + encodeURIComponent(blockData));
+                                const respSig = await signCoop("respond_block", nodeId, req.requester_id + ":" + req.req_id + ":" + blockData);
+                                await fetch(window.location.pathname + "?coop_op=respond_block&node_id=" + nodeId + "&requester_id=" + req.requester_id + "&req_id=" + req.req_id + "&block_data=" + encodeURIComponent(blockData) + "&coop_sig=" + respSig);
                             }
                         }
                     } catch (e) {
@@ -888,11 +937,13 @@ class ChallengeUtils
                 if (peerId && peerBlockIdx !== -1) {
                     document.getElementById('loader').innerText = '📥 Téléchargement du bloc de validation du pair (' + peerId + ')...';
                     const reqId = Math.random().toString(36).substring(2);
-                    await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId);
+                    const reqSig = await signCoop("request_peer_block", nodeId, peerId + ":" + peerBlockIdx + ":" + reqId);
+                    await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId + "&coop_sig=" + reqSig);
                     
                     let attempts = 0;
                     while (attempts < coopTimeout) {
-                        const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId);
+                        const pollSig = await signCoop("poll_response", nodeId, reqId);
+                        const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId + "&coop_sig=" + pollSig);
                         const data = await res.json();
                         if (data.status === 'ready') {
                             peerBlock = data.block_data;