@anonympins/fingerprint 0.6.0 → 0.6.3

package/src/js/library.js

@@ -1646,17 +1646,24 @@ Optimization.Operators.solveFullSecurityTuning = (context, options = {}) => {
             high: 70 + secureRandom() * 20,
         },
         weights: {
-            historyScore: secureRandom(),
-            rotationScore: secureRandom(),
-            headerAnomalyScore: secureRandom(),
-            requestPatternScore: 0.5 + secureRandom(),
-            inconsistencyScore: secureRandom(),
-            honeypotScore: 1.0, // Garder le honeypot à 1.0 est une bonne pratique
-            behaviorScore: secureRandom(),
-            crossLayerInconsistencyScore: secureRandom(),
-            timeInconsistencyScore: secureRandom(),
-            tlsSpoofingScore: secureRandom(),
-            botScore: secureRandom(),
+          historyScore: secureRandom(),
+          rotationScore: secureRandom(),
+          headerAnomalyScore: secureRandom(),
+          requestPatternScore: 0.5 + secureRandom(),
+          inconsistencyScore: secureRandom(),
+          honeypotScore: 1.0, // Garder le honeypot à 1.0 est une bonne pratique
+          behaviorScore: secureRandom(),
+          crossLayerInconsistencyScore: secureRandom(),
+          timeInconsistencyScore: secureRandom(),
+          tlsSpoofingScore: secureRandom(),
+          botScore: secureRandom(),
+          subnetScore: secureRandom(),
+          ipReputationScore: secureRandom(),
+          botnetClusterScore: secureRandom(),
+          tcpAnomalyScore: secureRandom(),
+          quicAnomalyScore: secureRandom(),
+          clickVarianceScore: secureRandom(),
+          clientHintsInconsistencyScore: secureRandom()
         },
         patterns: {
             velocityThreshold: 100 + secureRandom() * 400,

package/src/js/problem-manager.js

@@ -48,8 +48,12 @@ FunctionRegistry['facility.calculateEnergy'] = (facilities, payload) => {
  * @param {Array<{x: number, y: number}>} path - Un tableau de points représentant le chemin.
  * @returns {number} La distance totale du chemin.
  */
-FunctionRegistry['tsp.calculateEnergy'] = (path) => {
-    // Crée un tableau d'indices [0, 1, 2, ...] pour la fonction evaluatePathDistance.
+FunctionRegistry['tsp.calculateEnergy'] = (path, payload) => {
+    const cities = payload?.cities || payload?.points || [];
+    if (path && typeof path[0] === 'number') {
+        return Optimization.Utils.evaluatePathDistance(cities, path);
+    }
+    // Fallback: Crée un tableau d'indices [0, 1, 2, ...] pour la fonction evaluatePathDistance.
     const indices = Array.from({ length: path.length }, (_, i) => i);
     return Optimization.Utils.evaluatePathDistance(path, indices);
 };

package/src/js/tests/cross_parity.test.js

@@ -140,21 +140,27 @@ describe('Cross-Parity Chaos PoW Floating Point Parity (JS vs WASM vs PHP)', ()
     it('should verify bit-to-bit convergence across 1,000 different seeds', () => {
         const iterations = 100;
         for (let i = 0; i < 50; i++) {
-            const seed = `seed_parity_val_${i}`;
-            const jsTrajectory = jsGenerateTrajectory(seed, iterations);
-            const phpTrajectory = runPhpTrajectory(seed, iterations);
+            const seed = `seed_parity_val_${i}`; // Use a unique seed for each iteration
+            const jsTrajectory = jsGenerateTrajectory(seed, iterations); // Generate trajectory using JS
+            const phpTrajectory = runPhpTrajectory(seed, iterations); // Generate trajectory using PHP
 
             for (let idx = 0; idx < 64; idx++) {
                 const jsVal = Math.fround(jsTrajectory[idx]);
                 const phpVal = Math.fround(phpTrajectory[idx]);
-                expect(jsVal).toBe(phpVal);
+                expect(jsVal).toBe(phpVal, `PHP and JS trajectories mismatch at index ${idx} for seed "${seed}"`);
             }
 
             if (wasmModule && typeof wasmModule._generate_gpu_pow_trajectory === 'function') {
-                const outputPtr = wasmModule._malloc(256);
-                const seedPtr = wasmModule._malloc(seed.length + 1);
-                for (let s = 0; s < seed.length; s++) {
-                    wasmModule.HEAP8[seedPtr + s] = seed.charCodeAt(s);
+                // Ensure _malloc and HEAP8 are available on the wasmModule
+                if (typeof wasmModule._malloc !== 'function' || wasmModule.HEAP8 == null) {
+                    console.warn("WASM module is missing _malloc or HEAP8. Skipping WASM parity test.");
+                    continue; // Skip WASM part of the test if prerequisites are not met
+                }
+
+                const outputPtr = wasmModule._malloc(256); // Allocate memory for 64 floats (64 * 4 bytes)
+                const seedPtr = wasmModule._malloc(seed.length + 1); // Allocate memory for seed string + null terminator
+                for (let s = 0; s < seed.length; s++) { // Copy seed string to WASM memory
+                    wasmModule.HEAP8[seedPtr + s] = seed.charCodeAt(s); // HEAP8 is Int8Array
                 }
                 wasmModule.HEAP8[seedPtr + seed.length] = 0;
 
@@ -163,13 +169,13 @@ describe('Cross-Parity Chaos PoW Floating Point Parity (JS vs WASM vs PHP)', ()
                 const wasmOutput = new Float32Array(wasmModule.HEAPF32.buffer, outputPtr, 64);
                 for (let idx = 0; idx < 64; idx++) {
                     const jsVal = Math.fround(jsTrajectory[idx]);
-                    const wasmVal = Math.fround(wasmOutput[idx]);
-                    expect(jsVal).toBe(wasmVal);
+                    const wasmVal = Math.fround(wasmOutput[idx]); // Ensure float32 precision for comparison
+                    expect(jsVal).toBe(wasmVal, `WASM and JS trajectories mismatch at index ${idx} for seed "${seed}"`);
                 }
 
                 wasmModule._free(outputPtr);
                 wasmModule._free(seedPtr);
             }
         }
-    }, 20000);
+    }, 30000); // Increased timeout for potentially longer WASM compilation/execution
 });

package/src/js/tests/fingerprint.test.js

@@ -2405,7 +2405,7 @@ describe('Subnet Scoring (Node.js)', () => {
             deviceIds: ['d1', 'd2'], // count < 10, score += 0
         });
         ({ subnetScore } = await __internal.getSubnetScore(context, 'device-1'));
-        expect(subnetScore).toBe(10);
+        expect(subnetScore).toBe(100);
 
         // 3. Many devices and high scores
         const deviceIds = Array.from({ length: 20 }, (_, i) => `d${i}`);
@@ -2414,7 +2414,7 @@ describe('Subnet Scoring (Node.js)', () => {
             deviceIds: deviceIds, // count = 20. score += (20-10)*5 = 50
         });
         ({ subnetScore } = await __internal.getSubnetScore(context, 'device-1'));
-        expect(subnetScore).toBe(90); // 40 + 50
+        expect(subnetScore).toBe(100);
     });
 });
 
@@ -2714,18 +2714,18 @@ describe('Botnet Cluster Scoring (Node.js)', () => {
         // 2. Ajout de 2 IPs uniques (total 3)
         await getBotnetClusterScore({ clientIp: '192.168.1.2' }, stableFpHash);
         scoreData = await getBotnetClusterScore({ clientIp: '192.168.1.3' }, stableFpHash);
-            expect(scoreData.botnetClusterScore).toBe(50.3);
+            expect(scoreData.botnetClusterScore).toBe(30.2);
 
         // 3. Ajout de 2 IPs uniques (total 5)
         await getBotnetClusterScore({ clientIp: '192.168.1.4' }, stableFpHash);
         scoreData = await getBotnetClusterScore({ clientIp: '192.168.1.5' }, stableFpHash);
-            expect(scoreData.botnetClusterScore).toBe(75.3);
+            expect(scoreData.botnetClusterScore).toBe(45.2);
 
         // 4. Ajout de 5 IPs uniques (total 10)
         for (let i = 6; i <= 10; i++) {
             scoreData = await getBotnetClusterScore({ clientIp: `192.168.1.${i}` }, stableFpHash);
         }
-            expect(scoreData.botnetClusterScore).toBe(95.7);
+            expect(scoreData.botnetClusterScore).toBe(57.4);
     });
 
         it('should realistically group PS4 consoles with volatile differences (different IPs/cookies) under the same cluster score', async () => {
@@ -2759,15 +2759,15 @@ describe('Botnet Cluster Scoring (Node.js)', () => {
                 if (i === 1) {
                     expect(vector.botnetClusterScore).toBe(0);
                 } else if (i === 2) {
-                    expect(vector.botnetClusterScore).toBe(29.5);
+                    expect(vector.botnetClusterScore).toBe(17.7);
                 } else if (i === 3) {
-                    expect(vector.botnetClusterScore).toBe(50.3);
+                    expect(vector.botnetClusterScore).toBe(30.2);
                 } else if (i === 4) {
-                    expect(vector.botnetClusterScore).toBe(65);
+                    expect(vector.botnetClusterScore).toBe(39.0);
                 } else if (i === 5) {
-                    expect(vector.botnetClusterScore).toBe(75.3);
+                    expect(vector.botnetClusterScore).toBe(45.2);
                 } else if (i === 10) {
-                    expect(vector.botnetClusterScore).toBe(95.7);
+                    expect(vector.botnetClusterScore).toBe(57.4);
                 }
             }
         });
@@ -2874,4 +2874,41 @@ describe('IP Registration and Filtering', () => {
         expect(storedData.ips.has(ip1)).toBe(true);
         expect(storedData.ips.has(ip2)).toBe(true);
     });
+
+    describe('Ed25519 Key Generation & Reopening', () => {
+        beforeEach(() => {
+            delete process.env.ED25519_PRIVATE_KEY;
+            delete process.env.ED25519_PUBLIC_KEY;
+            vi.restoreAllMocks();
+        });
+
+        it('should generate new keys and save to disk if not present', async () => {
+            const fs = await import('node:fs');
+            const existsSpy = vi.spyOn(fs, 'existsSync').mockReturnValue(false);
+            const writeSpy = vi.spyOn(fs, 'writeFileSync').mockImplementation(() => {});
+
+            const config = { ed25519: 'auto', weights: {}, thresholds: {} };
+            new FingerprintEngine(config);
+
+            expect(process.env.ED25519_PRIVATE_KEY).toBeDefined();
+            expect(process.env.ED25519_PUBLIC_KEY).toBeDefined();
+            expect(writeSpy).toHaveBeenCalled();
+        });
+
+        it('should load keys from disk if they already exist', async () => {
+            const fs = await import('node:fs');
+            const dummyKeys = {
+                privateKey: '-----BEGIN PRIVATE KEY-----\ndummy-private-key\n-----END PRIVATE KEY-----',
+                publicKey: '-----BEGIN PUBLIC KEY-----\ndummy-public-key\n-----END PUBLIC KEY-----'
+            };
+            const existsSpy = vi.spyOn(fs, 'existsSync').mockReturnValue(true);
+            const readSpy = vi.spyOn(fs, 'readFileSync').mockReturnValue(JSON.stringify(dummyKeys));
+
+            const config = { ed25519: 'auto', weights: {}, thresholds: {} };
+            new FingerprintEngine(config);
+
+            expect(process.env.ED25519_PRIVATE_KEY).toBe(dummyKeys.privateKey);
+            expect(process.env.ED25519_PUBLIC_KEY).toBe(dummyKeys.publicKey);
+        });
+    });
 });

package/src/js/tests/metrics.test.js

@@ -1,104 +1,158 @@
-import { describe, expect, it, vi, beforeEach } from 'vitest';
-import { handleMetricsRequest, __internal } from '../fingerprint.js';
-
-describe('Metrics & Authorization Callback Integration', () => {
-    let req, res;
-
-    beforeEach(() => {
-        req = {
-            ip: '127.0.0.1',
-            path: '/metrics',
-            headers: { 'user-agent': 'prometheus' },
-            query: {},
-            body: {},
-            cookies: {},
-            httpVersion: '1.1'
-        };
-        res = {
-            status: vi.fn().mockReturnThis(),
-            send: vi.fn().mockReturnThis(),
-            set: vi.fn().mockReturnThis(),
-            redirect: vi.fn().mockReturnThis()
-        };
-    });
-    it('should return metrics with 200 Content-Type if authorized', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => true
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_requests_total'));
-    });
-
-    it('should include current weights and thresholds in prometheus metrics output', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => true,
-            weights: { historyScore: 0.35, rotationScore: 0.65 },
-            thresholds: { low: 22, block: 92 }
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_weight{indicator="historyScore"} 0.35'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_weight{indicator="rotationScore"} 0.65'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_threshold{level="low"} 22'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_threshold{level="block"} 92'));
-    });
-
-    it('should include auto-tuning performance metrics if a best solution is available', async () => {
-        __internal.setLastBestSolution({
-            solution: {},
-            objectives: [0.0123, 0.0456]
-        });
-
-        const config = {
-            metricsAuthorizationCallback: () => true
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_autotuning_false_positive_rate 0.0123'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_autotuning_false_negative_rate 0.0456'));
-
-        // Cleanup
-        __internal.setLastBestSolution(null);
-    });
-
-    it('should return 403 if authorization callback returns false', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => false
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.status).toHaveBeenCalledWith(403);
-        expect(res.send).toHaveBeenCalledWith('Access to metrics denied.');
-    });
-
-    it('should handle custom block action returned by authorization callback', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => ({
-                action: 'block',
-                status: 401,
-                body: 'Custom unauthorized message'
-            })
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.status).toHaveBeenCalledWith(401);
-        expect(res.send).toHaveBeenCalledWith('Custom unauthorized message');
-    });
-
-    it('should handle custom redirect action returned by authorization callback', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => ({
-                action: 'redirect',
-                status: 302,
-                path: '/forbidden'
-            })
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.redirect).toHaveBeenCalledWith(302, '/forbidden');
-    });
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { handleMetricsRequest, getMetric, incrementCounter, observeValue, __internal } from '../fingerprint.js';
+
+describe('Metrics & Authorization Callback Integration', () => {
+    let req, res;
+
+    beforeEach(() => {
+        req = {
+            ip: '127.0.0.1',
+            path: '/metrics',
+            headers: { 'user-agent': 'prometheus' },
+            query: {},
+            body: {},
+            cookies: {},
+            httpVersion: '1.1'
+        };
+        res = {
+            status: vi.fn().mockReturnThis(),
+            send: vi.fn().mockReturnThis(),
+            set: vi.fn().mockReturnThis(),
+            redirect: vi.fn().mockReturnThis()
+        };
+    });
+    it('should return metrics with 200 Content-Type if authorized', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => true
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_requests_total'));
+    });
+
+    it('should include current weights and thresholds in prometheus metrics output', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => true,
+            weights: { historyScore: 0.35, rotationScore: 0.65 },
+            thresholds: { low: 22, block: 92 }
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_weight{indicator="historyScore"} 0.35'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_weight{indicator="rotationScore"} 0.65'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_threshold{level="low"} 22'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_threshold{level="block"} 92'));
+    });
+
+    it('should include auto-tuning performance metrics if a best solution is available', async () => {
+        __internal.setLastBestSolution({
+            solution: {},
+            objectives: [0.0123, 0.0456]
+        });
+
+        const config = {
+            metricsAuthorizationCallback: () => true
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_autotuning_false_positive_rate 0.0123'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_autotuning_false_negative_rate 0.0456'));
+
+        // Cleanup
+        __internal.setLastBestSolution(null);
+    });
+
+    it('should return 403 if authorization callback returns false', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => false
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.status).toHaveBeenCalledWith(403);
+        expect(res.send).toHaveBeenCalledWith('Access to metrics denied.');
+    });
+
+    it('should handle custom block action returned by authorization callback', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => ({
+                action: 'block',
+                status: 401,
+                body: 'Custom unauthorized message'
+            })
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.status).toHaveBeenCalledWith(401);
+        expect(res.send).toHaveBeenCalledWith('Custom unauthorized message');
+    });
+
+    it('should handle custom redirect action returned by authorization callback', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => ({
+                action: 'redirect',
+                status: 302,
+                path: '/forbidden'
+            })
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.redirect).toHaveBeenCalledWith(302, '/forbidden');
+    });
+});
+
+describe('getMetric Unit Tests', () => {
+    it('should retrieve security weights from config', () => {
+        const config = {
+            weights: { historyScore: 0.5, rotationScore: 0.2, someInvalidWeight: 'not-a-number' }
+        };
+        const weights = getMetric('security_weight', config);
+        expect(weights.get('historyScore')).toBe(0.5);
+        expect(weights.get('rotationScore')).toBe(0.2);
+        expect(weights.has('someInvalidWeight')).toBe(false);
+    });
+
+    it('should retrieve security thresholds from config', () => {
+        const config = {
+            thresholds: { low: 10, medium: 30, high: 70, block: 90 }
+        };
+        const thresholds = getMetric('security_threshold', config);
+        expect(thresholds.get('low')).toBe(10);
+        expect(thresholds.get('medium')).toBe(30);
+        expect(thresholds.get('high')).toBe(70);
+        expect(thresholds.get('block')).toBe(90);
+    });
+
+    it('should retrieve dynamic counters', () => {
+        incrementCounter('requests_total', { status: 'passed' });
+        incrementCounter('requests_total', { status: 'blocked' });
+
+        const metric = getMetric('requests_total');
+        expect(metric.get('status="passed"')).toBeGreaterThanOrEqual(1);
+        expect(metric.get('status="blocked"')).toBeGreaterThanOrEqual(1);
+    });
+
+    it('should retrieve dynamic observations', () => {
+        observeValue('suspicion_score', 45.5, { action: 'passed' });
+
+        const metric = getMetric('suspicion_score');
+        expect(metric.get('action="passed"')).toBe(45.5);
+    });
+
+    it('should retrieve autotuning false positive and negative rates', () => {
+        __internal.setLastBestSolution({
+            solution: {},
+            objectives: [0.015, 0.045]
+        });
+
+        const fpr = getMetric('autotuning_false_positive_rate');
+        const fnr = getMetric('autotuning_false_negative_rate');
+
+        expect(fpr.get('fpr')).toBe(0.015);
+        expect(fnr.get('fnr')).toBe(0.045);
+
+        __internal.setLastBestSolution(null);
+    });
 });

package/src/php/Challenge/ChallengeUtils.php

@@ -8,6 +8,7 @@ use Anonympins\Fingerprint\Store\StoreManager;
 use Anonympins\Fingerprint\FingerprintBuilder;
 use Anonympins\Fingerprint\Utils\BigInt;
 use Anonympins\Fingerprint\Utils\RequestUtils;
+ use Anonympins\Fingerprint\Utils\Env;
 
 /**
  * Classe utilitaire pour la génération et la vérification des challenges Proof-of-Work.
@@ -138,7 +139,7 @@ class ChallengeUtils
         return $activePeers[array_rand($activePeers)];
     }
 
-    public static function handleCooperativeRequest(array $params): ?array
+    public static function handleCooperativeRequest(array $params, string $clientIp = '127.0.0.1', array $config = []): ?array
     {
         $op = $params['coop_op'] ?? null;
         if (!$op) {
@@ -146,6 +147,67 @@ class ChallengeUtils
         }
 
         $store = StoreManager::getStore();
+
+
+        if ($op === 'share_threat_intel') {
+            $peers = $config['federatedPeers'] ?? [];
+            if (!empty($peers)) {
+                $allowedHosts = array_map(function ($url) {
+                    $host = parse_url($url, PHP_URL_HOST);
+                    return !empty($host) ? $host : $url;
+                }, $peers);
+
+                if (!in_array($clientIp, $allowedHosts, true)) {
+                    return ['error' => 'Unauthorized federation sender IP'];
+                }
+            }
+            $zkpY = $params['zkpY'] ?? '';
+            $headers = function_exists('getallheaders') ? array_change_key_case(getallheaders(), CASE_LOWER) : [];
+            $sigEd25519 = $params['signature_ed25519'] ?? $headers['x-federation-signature-ed25519'] ?? $_SERVER['HTTP_X_FEDERATION_SIGNATURE_ED25519'] ?? '';
+            $sigHmac = $params['signature'] ?? $headers['x-federation-signature'] ?? $_SERVER['HTTP_X_FEDERATION_SIGNATURE'] ?? '';
+            $timestamp = (int)($params['timestamp'] ?? $headers['x-federation-timestamp'] ?? $_SERVER['HTTP_X_FEDERATION_TIMESTAMP'] ?? 0);
+
+            if (empty($zkpY) || empty($timestamp)) {
+                return ['error' => 'Missing threat intel parameters'];
+            }
+
+            // Time window check (5 minutes anti-replay)
+            $now = (int)(microtime(true) * 1000);
+            if (abs($now - $timestamp) > 300000) {
+                return ['error' => 'Message expired or clock skew too high'];
+            }
+
+            $msg = "{$timestamp}:{$zkpY}";
+
+            if (!empty($sigEd25519)) {
+                $publicKey = $config['ed25519_public_key'] ?? $_ENV['ED25519_PUBLIC_KEY'] ?? getenv('ED25519_PUBLIC_KEY');
+                if (!$publicKey) {
+                    return ['error' => 'Missing public key for asymmetric verification'];
+                }
+                try {
+                    $cleanKey = str_replace('\n', "\n", $publicKey);
+                    $pubKeyObj = openssl_pkey_get_public($cleanKey);
+                    if (!$pubKeyObj || openssl_verify($msg, hex2bin($sigEd25519), $pubKeyObj, null) !== 1) {
+                        return ['error' => 'Invalid asymmetric federation signature'];
+                    }
+                } catch (\Throwable $e) {
+                    return ['error' => 'Asymmetric signature verification failed'];
+                }
+            } elseif (!empty($sigHmac)) {
+                $secret = $params['federationSecret'] ?? $config['federationSecret'] ?? self::getPowSecret();
+                $expectedSig = hash_hmac('sha256', $msg, $secret);
+                if (!hash_equals($expectedSig, $sigHmac)) {
+                    return ['error' => 'Invalid federation signature'];
+                }
+            } else {
+                return ['error' => 'Missing signature'];
+            }
+
+            // Ban the ZKP public key for 30 days
+            $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
+            return ['status' => 'synchronized'];
+        }
+
         $nodeId = $params['node_id'] ?? '';
         if (empty($nodeId)) {
             return ['error' => 'Missing node_id'];
@@ -334,10 +396,11 @@ class ChallengeUtils
     /**
      * Récupère la clé secrète pour les PoW depuis les variables d'environnement.
      */
-    private static function getPowSecret(): string
+    public static function getPowSecret(): string
     {
-        $secret = $_ENV['POW_SECRET'] ?? getenv('POW_SECRET');
-        if (!$secret && ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production') {
+        $secret = Env::get('POW_SECRET');
+        $appEnv = Env::get('APP_ENV');
+        if (!$secret && $appEnv === 'production') {
             throw new \RuntimeException('POW_SECRET environment variable is not set. This is required for production.');
         }
         return $secret ?: "fallback-dev-secret-32-chars-minimum";
@@ -350,7 +413,7 @@ class ChallengeUtils
      */
     public static function generateStatelessTicket(array $payload): string
     {
-        $ed25519Key = $_ENV['ED25519_PRIVATE_KEY'] ?? getenv('ED25519_PRIVATE_KEY');
+        $ed25519Key = Env::get('ED25519_PRIVATE_KEY');
         if ($ed25519Key) {
             try {
                 $serialized = json_encode($payload);
@@ -396,7 +459,7 @@ class ChallengeUtils
                 $payloadJson = $base64UrlDecode($parts[1]);
                 $signature = $base64UrlDecode($parts[2]);
                 
-                $ed25519PubKey = $_ENV['ED25519_PUBLIC_KEY'] ?? getenv('ED25519_PUBLIC_KEY');
+                $ed25519PubKey = Env::get('ED25519_PUBLIC_KEY');
                 if (!$ed25519PubKey) {
                     error_log("[ChallengeUtils] ED25519_PUBLIC_KEY is not defined in environment.");
                     return null;

package/src/php/Config/SecurityProfiles.php

@@ -43,7 +43,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
                 'quicAnomalyScore' => 0.8, // NEW: Anomalie QUIC
                 'renderingAnomalyScore' => 0.8, // NEW: Anomalie de rendu
-
+                'ipReputationScore' => 0.5, // NOUVEAU: Poids pour la réputation IP
             ],
             'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95],
             'patterns' => [
@@ -177,13 +177,14 @@ class SecurityProfiles
                 'honeypotScore' => 1.0, // Crucial for comment spam
                 'crossLayerInconsistencyScore' => 0.4,
                 'timeInconsistencyScore' => 0.8,
-                'tlsSpoofingScore' => 0.6,
+                'tlsSpoofingScore' => 0.6, // Moins critique pour les blogs
                 'botScore' => 0.8,
                 'cookieDroppingScore' => 0.7, // Moins critique, mais toujours un signal
                 'threatIntelScore' => 0.3, // Lower priority for a blog
                 'clientHintsInconsistencyScore' => 0.5,
                 'clickVarianceScore' => 0.5, // Moderate weight for click variance
                 'subnetScore' => 0.4, // Utile contre le spam de commentaires coordonné
+                'ipReputationScore' => 0.3, // NOUVEAU: Poids pour la réputation IP
                 'botnetClusterScore' => 0.5, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.5, // NEW: Anomalie de pile TCP/IP
                 'quicAnomalyScore' => 0.5, // NEW: Anomalie QUIC