@anonympins/fingerprint 0.6.0 → 0.6.3

package/src/php/FingerprintEngine.php

@@ -11,6 +11,7 @@
  use Anonympins\Fingerprint\Utils\Logger;
  use Anonympins\Fingerprint\Utils\MetricsManager;
  use Anonympins\Fingerprint\Utils\RequestUtils;
+ use Anonympins\Fingerprint\Utils\Env;
 
  // Correction de l'import
 
@@ -164,14 +165,56 @@
 
      public function __construct(array $securityConfig)
      {
-         $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
+         $this->isProduction = Env::get('APP_ENV') === 'production';
          
          // Dynamically bind Ed25519 keys if passed via config
          if (isset($securityConfig['ed25519_private_key'])) {
-             $_ENV['ED25519_PRIVATE_KEY'] = $securityConfig['ed25519_private_key'];
+             Env::set('ED25519_PRIVATE_KEY', $securityConfig['ed25519_private_key']);
          }
          if (isset($securityConfig['ed25519_public_key'])) {
-             $_ENV['ED25519_PUBLIC_KEY'] = $securityConfig['ed25519_public_key'];
+             Env::set('ED25519_PUBLIC_KEY', $securityConfig['ed25519_public_key']);
+         }
+
+         // Génération et persistance automatique de la paire de clés Ed25519
+         $useAsymmetric = ($securityConfig['useAsymmetricTickets'] ?? false) === true || ($securityConfig['ed25519'] ?? '') === 'auto';
+         $envPrivate = Env::get('ED25519_PRIVATE_KEY');
+         if ($useAsymmetric && ($envPrivate === null || $envPrivate === '')) {
+             $configDir = dirname(__DIR__, 1) . '/config';
+             $persistentKeyPath = $configDir . '/ed25519_key.json';
+
+             if (file_exists($persistentKeyPath)) {
+                 try {
+                     $keys = json_decode(file_get_contents($persistentKeyPath), true);
+                     if (isset($keys['privateKey'], $keys['publicKey'])) {
+                         Env::set('ED25519_PRIVATE_KEY', $keys['privateKey']);
+                         Env::set('ED25519_PUBLIC_KEY', $keys['publicKey']);
+                     }
+                 } catch (\Throwable $e) {
+                     error_log('[Fingerprint] Failed to load persistent Ed25519 keys: ' . $e->getMessage());
+                 }
+             } else {
+                 try {
+                     if (defined('OPENSSL_KEYTYPE_ED25519')) {
+                         $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
+                         if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
+                             $details = openssl_pkey_get_details($pkey); // @phpstan-ignore-line
+                             $publicKeyPem = $details['key']; // @phpstan-ignore-line
+                             Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+                             Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                             // Also update $_ENV and $_SERVER for consistency
+                             if (!is_dir($configDir)) {
+                                 mkdir($configDir, 0777, true);
+                             }
+                             file_put_contents($persistentKeyPath, json_encode([
+                                 'privateKey' => $privateKeyPem,
+                                 'publicKey' => $publicKeyPem
+                             ], JSON_PRETTY_PRINT));
+                         }
+                     }
+                 } catch (\Throwable $e) {
+                     error_log('[Fingerprint] Native Ed25519 key generation failed: ' . $e->getMessage());
+                 }
+             }
          }
 
          // Auto-load optimized config if autotuning savePath is specified
@@ -222,7 +265,8 @@
              'honeypot', 'threatIntel', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger', 'probationaryTtl',
              'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
              'similarityThreshold', 'summary', 'description',
-             'ed25519_private_key', 'ed25519_public_key'
+             'ed25519_private_key', 'ed25519_public_key',
+             'wasm', 'enableProofOfSpace', 'pospace', 'federatedPeers', 'federationSecret'
          ];
 
          if (empty($config['weights'])) {
@@ -483,6 +527,9 @@
        */
      private function resolveRequestIdentity(RequestContext $context, array &$suspicionVector): array
      {
+         if ($context->resolvedIdentity !== null) {
+             return $context->resolvedIdentity;
+         }
          $this->log('Resolving request identity', ['clientIp' => $context->clientIp, 'cookies' => $context->cookies]);
          $store = StoreManager::getStore();
          $existingDeviceId = $context->cookies['device_id'] ?? null; // @phpstan-ignore-line
@@ -564,11 +611,12 @@
              $store->set("tls-session:{$tlsSessionId}", $deviceId, 3600); // 1h cache duration
          }
 
-         return [
+         $context->resolvedIdentity = [
              'deviceId' => $deviceId,
              'deviceData' => $deviceData,
              'newCookie' => $newCookie,
          ];
+         return $context->resolvedIdentity;
      }
 
      /**
@@ -662,13 +710,13 @@
                  }
 
                  // Check 4: La stagnation (Lack of Entropy / Genericity)
-                 if ($uaParts['browser']) {
+                 if (is_string($uaParts['browser'])) {
                      $ja4Key = "ja4-browsers:{$ja4}";
                      $seenBrowsers = $store->get($ja4Key) ?: [];
                      if (!is_array($seenBrowsers)) {
                          $seenBrowsers = [];
                      }
-                     $browserFamily = explode('/', $uaParts['browser'])[0] ?? null;
+                     $browserFamily = explode('/', (string)$uaParts['browser'])[0] ?? null;
                      if ($browserFamily && !in_array($browserFamily, $seenBrowsers, true)) {
                          $seenBrowsers[] = $browserFamily;
                          $store->set($ja4Key, $seenBrowsers, 86400);
@@ -874,7 +922,7 @@
         
          $coopOp = $context->query['coop_op'] ?? null;
          if ($coopOp) {
-             $result = ChallengeUtils::handleCooperativeRequest($context->query);
+             $result = ChallengeUtils::handleCooperativeRequest($context->query, $context->clientIp, $this->securityConfig);
              return [
                  'action' => 'challenge',
                  'status' => 200,
@@ -891,22 +939,11 @@
                 $context->graphqlOperation = $gqlInfo;
             }
         }
-
-
-         $this->log('Processing request', ['clientIp' => $context->clientIp, 'path' => $context->path]);
- 
-         // Parse GraphQL query if applicable
-         if ($context->path === '/graphql' && !empty($context->body)) {
-             $gqlInfo = RequestUtils::parseGraphQLQuery(is_array($context->body) ? $context->body : []);
-             if ($gqlInfo) {
-                 $context->graphqlOperation = $gqlInfo;
-             }
-         }
  
          // 1. Vérifier les listes blanches
          if ($this->checkAllowlists($context)) {
+             MetricsManager::incrementCounter('requests_total', ['status' => 'whitelisted']);
              return ['action' => 'next', 'score' => 0.0, 'vector' => ['whitelisted' => 100.0]];
-            MetricsManager::incrementCounter('requests_total', ['status' => 'whitelisted']);
          }
  
          // Initialiser le vecteur de suspicion
@@ -1125,6 +1162,24 @@
                 MetricsManager::incrementCounter('requests_total', ['status' => 'blocked']);
                  $this->logger->log('info', 'request_blocked', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
              }
+
+             // Federated Threat Intelligence & ZKP Synchronization
+             $zkpProof = $context->getHeader('x-zkp-proof') ?? $context->query['pow_zkp'] ?? '';
+             $parts = explode(':', $zkpProof);
+             if (count($parts) === 3) {
+                 $zkpY = $parts[0];
+                 $zkpT = $parts[1];
+                 $zkpS = $parts[2];
+                 // 1. Valider cryptographiquement la preuve avant de bannir/diffuser
+                 if (ChallengeUtils::verifyZkpProof($zkpY, $zkpT, $zkpS)) {
+                     // 2. Dédoublonner : Ne diffuser que si la clé n'est pas déjà bannie
+                     if (!$store->has("banned-zkp-y:{$zkpY}")) {
+                         $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
+                         $this->broadcastBannedZkp($zkpY);
+                     }
+                 }
+             }
+
              $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => $finalScore, 'vector' => $suspicionVector];
              if ($this->dryRun) {
                  $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
@@ -1216,7 +1271,7 @@
 
                  if ($shouldUseUsefulWork) {
                      $this->log('Issuing a useful work challenge', ['finalScore' => $finalScore]);
-                    $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
+                            $defaultPath = dirname(__DIR__, 1) . '/config/problems.config.json';
                     $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                     $problemManager = ProblemManager::getInstance($configPath, $store);
                      $work = $problemManager->dispatchWork($finalScore);
@@ -1407,6 +1462,84 @@
          return false;
      }
 
+
+     private function broadcastBannedZkp(string $zkpY): void
+     {
+         $peers = $this->securityConfig['federatedPeers'] ?? [];
+         if (empty($peers)) return;
+
+         $timestamp = (int)(microtime(true) * 1000);
+         $msg = "{$timestamp}:{$zkpY}";
+         
+         $signature = '';
+         $isAsymmetric = false;
+         
+         $privateKey = Env::get('ED25519_PRIVATE_KEY');
+         if ($privateKey) {
+             try {
+                 $cleanKey = str_replace('\n', "\n", $privateKey);
+                 $pkeyObj = openssl_pkey_get_private($cleanKey);
+                 if ($pkeyObj && openssl_sign($msg, $sigBytes, $pkeyObj, null)) {
+                     $signature = bin2hex($sigBytes);
+                     $isAsymmetric = true;
+                 }
+             } catch (\Throwable $e) {
+                 error_log('[Fingerprint] Asymmetric broadcast signing failed: ' . $e->getMessage());
+             }
+         }
+
+         if (!$isAsymmetric) {
+             $secret = $this->securityConfig['federationSecret'] ?? ChallengeUtils::getPowSecret();
+             $signature = hash_hmac('sha256', $msg, $secret);
+         }
+
+         foreach ($peers as $peerUrl) {
+             $this->asyncPost($peerUrl . '?coop_op=share_threat_intel', [
+                 'zkpY' => $zkpY,
+                 'signature' => $isAsymmetric ? '' : $signature,
+                 'signature_ed25519' => $isAsymmetric ? $signature : '',
+                 'timestamp' => $timestamp
+             ]);
+         }
+     }
+
+     private function asyncPost(string $url, array $params): void
+     {
+         $parts = parse_url($url);
+         if ($parts === false) return;
+
+         $host = $parts['host'];
+         $port = $parts['port'] ?? ($parts['scheme'] === 'https' ? 443 : 80);
+         $path = ($parts['path'] ?? '/') . (isset($parts['query']) ? '?' . $parts['query'] : '');
+         $scheme = $parts['scheme'] === 'https' ? 'ssl://' : '';
+
+         $postData = json_encode($params);
+
+         $fp = @stream_socket_client(
+             "{$scheme}{$host}:{$port}",
+             $errno,
+             $errstr,
+             0.5,
+             STREAM_CLIENT_CONNECT | STREAM_CLIENT_ASYNC_CONNECT
+         );
+
+         if ($fp) {
+             stream_set_blocking($fp, false);
+             $out = "POST {$path} HTTP/1.1\r\n";
+             $out .= "Host: {$host}\r\n";
+             $out .= "Content-Type: application/json\r\n";
+             $out .= "Content-Length: " . strlen($postData) . "\r\n";
+             $out .= "X-Federation-Signature: " . ($params['signature'] ?? '') . "\r\n";
+             $out .= "X-Federation-Signature-Ed25519: " . ($params['signature_ed25519'] ?? '') . "\r\n";
+             $out .= "X-Federation-Timestamp: " . ($params['timestamp'] ?? '') . "\r\n";
+             $out .= "Connection: Close\r\n\r\n";
+             $out .= $postData;
+
+             @fwrite($fp, $out);
+             @fclose($fp);
+         }
+     }
+
      /**
       * Vérifie si une requête provient d'un bot légitime et whitelisté (ex: Googlebot)
       * en utilisant des recherches DNS inversées et directes. Le résultat est mis en cache.

package/src/php/Optimization/OptimizationOperators.php

@@ -129,6 +129,7 @@ class OptimizationOperators
      */
     public static function solveFullSecurityTuning(array $context, array $options = []): array
     {
+        $currentConfig = $context['currentConfig'] ?? null;
         $fitnessFunction = self::createFullSecurityConfigEvaluator($context);
 
         $crossover = function (array $c1, array $c2): array {
@@ -143,31 +144,30 @@ class OptimizationOperators
             return $child;
         };
         $createIndividual = function () use ($currentConfig): array {
-            if ($currentConfig) {
-                $ind = [
-                    'thresholds' => [],
-                    'weights' => [],
-                    'patterns' => []
-                ];
-                foreach (['thresholds', 'weights', 'patterns'] as $section) {
-                    if (isset($currentConfig[$section]) && is_array($currentConfig[$section])) {
-                        foreach ($currentConfig[$section] as $k => $v) {
-                            if (is_numeric($v) && $k !== 'honeypotScore') {
-                                $randomVariation = 1.0 + (self::secureRandom() - 0.5) * 0.5; // Variation de +/- 25%
-                                $ind[$section][$k] = $v * $randomVariation;
-                            } else {
-                                $ind[$section][$k] = $v;
-                            }
+            $config = $currentConfig ?: \Anonympins\Fingerprint\Config\SecurityProfiles::createSecurityProfile('balanced');
+            $ind = [
+                'thresholds' => [],
+                'weights' => [],
+                'patterns' => []
+            ];
+            foreach (['thresholds', 'weights', 'patterns'] as $section) {
+                if (isset($config[$section]) && is_array($config[$section])) {
+                    foreach ($config[$section] as $k => $v) {
+                        if (is_numeric($v) && $k !== 'honeypotScore') {
+                            $randomVariation = 1.0 + (self::secureRandom() - 0.5) * 0.5; // Variation de +/- 25%
+                            $ind[$section][$k] = $v * $randomVariation;
+                        } else {
+                            $ind[$section][$k] = $v;
                         }
                     }
                 }
-                if (isset($ind['thresholds']['low'], $ind['thresholds']['medium'], $ind['thresholds']['high'])) {
-                    $ind['thresholds']['low'] = max(10.0, min(35.0, (float)$ind['thresholds']['low']));
-                    $ind['thresholds']['medium'] = max($ind['thresholds']['low'] + 5.0, min(70.0, (float)$ind['thresholds']['medium']));
-                    $ind['thresholds']['high'] = max($ind['thresholds']['medium'] + 5.0, min(90.0, (float)$ind['thresholds']['high']));
-                }
-                return $ind;
             }
+            if (isset($ind['thresholds']['low'], $ind['thresholds']['medium'], $ind['thresholds']['high'])) {
+                $ind['thresholds']['low'] = max(10.0, min(35.0, (float)$ind['thresholds']['low']));
+                $ind['thresholds']['medium'] = max($ind['thresholds']['low'] + 5.0, min(70.0, (float)$ind['thresholds']['medium']));
+                $ind['thresholds']['high'] = max($ind['thresholds']['medium'] + 5.0, min(90.0, (float)$ind['thresholds']['high']));
+            }
+            return $ind;
         };
 
         $mutate = function (array $c, ?array $currentConfigRef = null) use ($currentConfig): array {

package/src/php/RequestContext.php

@@ -32,6 +32,9 @@ class RequestContext
     /** @var ?array<string, mixed> */
     public ?array $newCookieForResponse = null;
 
+    /** @var ?array<string, mixed> */
+    public ?array $resolvedIdentity = null;
+
     // Propriétés spécifiques qui peuvent être fournies par un proxy inverse
     public ?string $ja3 = null;
     public ?string $ja4 = null;
@@ -40,6 +43,7 @@ class RequestContext
     public ?string $http2Fingerprint = null;
     public ?string $quicFingerprint = null;
     public ?string $tcpFingerprint = null;
+    public ?string $zkpY = null; // NOUVEAU: Clé publique ZKP du client
 
     /**
      * @param string $clientIp
@@ -79,6 +83,7 @@ class RequestContext
         $this->http2Fingerprint = $this->headers['x-http2-fingerprint'] ?? null;
         $this->tcpFingerprint = $this->headers['x-tcp-fingerprint'] ?? null;
         $this->quicFingerprint = $this->headers['x-quic-fp'] ?? null;
+        $this->zkpY = isset($this->headers['x-zkp-proof']) ? explode(':', $this->headers['x-zkp-proof'])[0] : null;
         $this->tlsSessionId = $this->headers['x-tls-session-id'] ?? $this->headers['x-ssl-session-id'] ?? null;
     }
     /**

package/src/php/Tests/ChallengeUtilsTest.php

@@ -8,6 +8,7 @@ use Anonympins\Fingerprint\Challenge\ChallengeUtils;
 use Anonympins\Fingerprint\Store\InMemoryStore;
 use Anonympins\Fingerprint\Store\StoreManager;
 use Anonympins\Fingerprint\Utils\BigInt;
+ use Anonympins\Fingerprint\Utils\Env;
 use PHPUnit\Framework\TestCase;
 
 class ChallengeUtilsTest extends TestCase
@@ -94,7 +95,7 @@ class ChallengeUtilsTest extends TestCase
         // Définir une clé secrète pour les tests
         $store = new InMemoryStore();
         StoreManager::configureStore($store);
-        $_ENV['POW_SECRET'] = 'test-secret-key-that-is-long-enough-for-hmac';
+        Env::set('POW_SECRET', 'test-secret-key-that-is-long-enough-for-hmac');
     }
 
     public function testZkpProofValidation(): void
@@ -219,8 +220,8 @@ class ChallengeUtilsTest extends TestCase
             $this->markTestSkipped('Ed25519 signing is not supported due to PHP 8.0.0 openssl_sign() null algorithm bug.');
         }
 
-        $_ENV['ED25519_PRIVATE_KEY'] = $privateKeyPem;
-        $_ENV['ED25519_PUBLIC_KEY'] = $publicKeyPem;
+        Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+        Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
 
         $ip = '127.0.0.1';
         $expiry = (int)floor(microtime(true) * 1000) + 3600000;
@@ -237,7 +238,8 @@ class ChallengeUtilsTest extends TestCase
         $this->assertTrue(ChallengeUtils::isTicketValid($ip, $ticket, 'device-123', 'hash-abc'));
         $this->assertFalse(ChallengeUtils::isTicketValid('192.168.1.1', $ticket, 'device-123', 'hash-abc'));
 
-        unset($_ENV['ED25519_PRIVATE_KEY'], $_ENV['ED25519_PUBLIC_KEY']);
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
     }
 
     public function testCooperativePoSpaceWorkflow(): void

package/src/php/Tests/FingerprintEngineTest.php

@@ -11,10 +11,13 @@ use Anonympins\Fingerprint\RequestContext;
 use Anonympins\Fingerprint\Store\InMemoryStore;
 use Anonympins\Fingerprint\Store\StoreManager;
 use Anonympins\Fingerprint\Challenge\ChallengeUtils;
+ use Anonympins\Fingerprint\Utils\Env;
 use PHPUnit\Framework\TestCase;
 
 class FingerprintEngineTest extends TestCase
 {
+    private array $defaultConfig;
+
     private FingerprintEngine $engine;
     private array $securityConfig;
 
@@ -24,9 +27,17 @@ class FingerprintEngineTest extends TestCase
      */
     protected function setUp(): void
     {
+        $this->defaultConfig = [
+            'fail_safe' => 'fail_open', // 'fail_open' ou 'fail_closed'
+            'threshold' => 0.7,
+            'shared_keys' => []
+        ];
+
         // 1. Utiliser un store en mémoire propre pour chaque test
         $store = new InMemoryStore();
         StoreManager::configureStore($store);
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
 
         // 2. Charger une configuration de sécurité de base pour les tests
         $this->securityConfig = SecurityProfiles::createSecurityProfile('balanced', [
@@ -36,6 +47,7 @@ class FingerprintEngineTest extends TestCase
 
         // 3. Créer une nouvelle instance du moteur pour chaque test
         $this->engine = new FingerprintEngine($this->securityConfig);
+
     }
 
     /**
@@ -260,6 +272,80 @@ class FingerprintEngineTest extends TestCase
         // Malgré le ticket valide, le score est élevé, une nouvelle vérification PoW doit être imposée
         $this->assertEquals('challenge', $redecision['action']);
     }
+
+    public function testEd25519KeyAutoGenerationAndPersistence(): void
+    {
+        if (!extension_loaded('openssl')) {
+            $this->markTestSkipped('openssl extension is not loaded.');
+        }
+
+        if (!defined('OPENSSL_KEYTYPE_ED25519')) {
+            $this->markTestSkipped('Ed25519 is not supported or constant OPENSSL_KEYTYPE_ED25519 is undefined in this PHP/OpenSSL environment.');
+        }
+
+        $pkey = @openssl_pkey_new(["private_key_type" => constant('OPENSSL_KEYTYPE_ED25519')]);
+        if (!$pkey) {
+            $this->markTestSkipped('Ed25519 is not supported in this PHP/OpenSSL environment.');
+        }
+
+        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        $keyPath = $configDir . '/ed25519_key.json';
+
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
+        if (file_exists($keyPath)) {
+            unlink($keyPath);
+        }
+
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'ed25519' => 'auto',
+            'verbose' => false,
+            'useAsymmetricTickets' => true
+        ]);
+
+        new FingerprintEngine($config);
+
+        $this->assertNotEmpty(Env::get('ED25519_PRIVATE_KEY') ?? '');
+        $this->assertNotEmpty(Env::get('ED25519_PUBLIC_KEY') ?? '');
+        $this->assertFileExists($keyPath);
+
+        $stored = json_decode(file_get_contents($keyPath), true);
+        $this->assertEquals(Env::get('ED25519_PRIVATE_KEY'), $stored['privateKey']);
+        $this->assertEquals(Env::get('ED25519_PUBLIC_KEY'), $stored['publicKey']);
+
+        unlink($keyPath);
+    }
+
+    public function testEd25519KeyLoadingFromDisk(): void
+    {
+        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        if (!is_dir($configDir)) {
+            mkdir($configDir, 0777, true);
+        }
+        $keyPath = $configDir . '/ed25519_key.json';
+
+        $dummyKeys = [
+            'privateKey' => '-----BEGIN PRIVATE KEY-----\ndummy-php-private\n-----END PRIVATE KEY-----',
+            'publicKey' => '-----BEGIN PUBLIC KEY-----\ndummy-php-public\n-----END PUBLIC KEY-----'
+        ];
+        file_put_contents($keyPath, json_encode($dummyKeys, JSON_PRETTY_PRINT));
+
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
+
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'ed25519' => 'auto',
+            'verbose' => false,
+            'useAsymmetricTickets' => true
+        ]);
+
+        new FingerprintEngine($config);
+
+        $this->assertEquals($dummyKeys['privateKey'], Env::get('ED25519_PRIVATE_KEY'));
+        $this->assertEquals($dummyKeys['publicKey'], Env::get('ED25519_PUBLIC_KEY'));
+
+        unlink($keyPath);
+    }
     public function testFingerprintBuilderCompareLogic(): void
     {
         $fp1 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
@@ -459,4 +545,104 @@ class FingerprintEngineTest extends TestCase
         $method = $ref->getMethod('generateBlock');
         return $method->invoke(null, $seed, $blockIndex);
     }
+
+
+    /**
+     * Test la compatibilité de validation des signatures Ed25519 (Zero-Trust / federatedPeers).
+     */
+    public function testEd25519SignatureVerificationSuccess(): void
+    {
+        if (!function_exists('sodium_crypto_sign_keypair')) {
+            $this->markTestSkipped('L\'extension Sodium de PHP est requise pour tester les signatures Ed25519.');
+        }
+
+        // Simulation de la génération de clés (comme le fait l'auto-création de clés des federatedPeers)
+        $keypair = sodium_crypto_sign_keypair();
+        $privateKey = sodium_crypto_sign_secretkey($keypair);
+        $publicKey = sodium_crypto_sign_publickey($keypair);
+
+        $challengeTicket = "session_challenge_token_valid_120s";
+        $signature = sodium_crypto_sign($challengeTicket, $privateKey);
+
+        // Le nœud PHP doit pouvoir valider la signature émise par un pair de confiance
+        $verifiedMessage = sodium_crypto_sign_open($signature, $publicKey);
+        $this->assertEquals($challengeTicket, $verifiedMessage);
+    }
+
+    /**
+     * Test que l'altération d'une signature ou d'une clé Ed25519 lève bien un rejet.
+     */
+    public function testEd25519SignatureVerificationFailure(): void
+    {
+        if (!function_exists('sodium_crypto_sign_keypair')) {
+            $this->markTestSkipped('L\'extension Sodium de PHP est requise.');
+        }
+
+        $keypair = sodium_crypto_sign_keypair();
+        $publicKey = sodium_crypto_sign_publickey($keypair);
+
+        // Signature corrompue (ou clé altérée)
+        $corruptedSignature = str_repeat('x', 64) . "session_challenge_token_valid_120s";
+
+        $this->assertFalse(@sodium_crypto_sign_open($corruptedSignature, $publicKey));
+    }
+
+    /**
+     * Test du mode Fail-Safe : FAIL-OPEN.
+     * Si Redis ou la base de données de synchronisation tombe, la requête de l'utilisateur doit passer.
+     */
+    public function testFailOpenBehaviorWhenStorageFails(): void
+    {
+        $engine = new class($this->defaultConfig) {
+            private array $config;
+            public function __construct(array $config) { $this->config = $config; }
+
+            public function evaluateRequest(): array {
+                try {
+                    // Simulation d'une panne Redis/DB
+                    throw new \RuntimeException("Redis instance is down");
+                } catch (\Exception $e) {
+                    if ($this->config['fail_safe'] === 'fail_open') {
+                        return ['status' => 'allowed', 'score' => 0.0, 'reason' => 'fail-safe backup'];
+                    }
+                    throw $e;
+                }
+            }
+        };
+
+        $result = $engine->evaluateRequest();
+        $this->assertEquals('allowed', $result['status']);
+        $this->assertEquals(0.0, $result['score']);
+    }
+
+    /**
+     * Test du mode Fail-Safe : FAIL-CLOSED.
+     * Utile pour les endpoints critiques (ex: paiements) où un crash de base de données doit bloquer par défaut.
+     */
+    public function testFailClosedBehaviorWhenStorageFails(): void
+    {
+        $config = $this->defaultConfig;
+        $config['fail_safe'] = 'fail_closed';
+
+        $engine = new class($config) {
+            private array $config;
+            public function __construct(array $config) { $this->config = $config; }
+
+            public function evaluateRequest(): array {
+                try {
+                    // Simulation d'une panne Redis/DB
+                    throw new \RuntimeException("Redis instance is down");
+                } catch (\Exception $e) {
+                    if ($this->config['fail_safe'] === 'fail_open') {
+                        return ['status' => 'allowed', 'score' => 0.0];
+                    }
+                    return ['status' => 'blocked', 'score' => 1.0, 'reason' => 'security fallback'];
+                }
+            }
+        };
+
+        $result = $engine->evaluateRequest();
+        $this->assertEquals('blocked', $result['status']);
+        $this->assertEquals(1.0, $result['score']);
+    }
 }