@anonympins/fingerprint 0.6.1 → 0.6.4

package/src/js/fingerprint.js

@@ -6,7 +6,7 @@ import {getProblemManager, problemManager} from "./problem-manager.js";
 import {Optimization} from "./library.js";
 import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
 import {DynamicWasmGenerator} from "./dynamic-wasm.js";
-import {readFileSync, existsSync} from "node:fs";
+import {writeFileSync, readFileSync, existsSync} from "node:fs";
 import {fileURLToPath} from "node:url";
 import {dirname, join, resolve} from "node:path";
 import {
@@ -564,6 +564,7 @@ const securityProfiles = {
         },
         allowCrossNetworkRoaming: true, // Profil balancé : tolérant par défaut
     wasm: true,
+    filterWhitelist: 85.0, // Stratégie d'inspection modérée pour les IP/chemins en liste blanche
         useAsymmetricTickets: true,
     },
     /**
@@ -603,6 +604,7 @@ const securityProfiles = {
         },
         challengeNewDevices: true, // Challenge all new devices
         allowCrossNetworkRoaming: false, // Strict : interdiction de changer complètement de réseau sans re-challenge
+    filterWhitelist: true, // Tout comportement d'attaque certain bypass immédiatement la liste blanche
     wasm: true,
         useAsymmetricTickets: true,
     },
@@ -643,6 +645,7 @@ const securityProfiles = {
         },
         isApiRequest: (req) => req.path.startsWith('/api/') || req.headers.accept?.includes('application/json'),
         allowCrossNetworkRoaming: false, // Les API ne doivent pas subir de roaming inter-IP suspect
+    filterWhitelist: 75.0, // Seuil bas pour parer au vol de clés/tokens API légitimes
     wasm: true,
         useAsymmetricTickets: true,
     }
@@ -663,13 +666,17 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.4,
             timeInconsistencyScore: 0.8,
             tlsSpoofingScore: 0.6, // Moins critique pour les blogs
-            subnetScore: 0.2,
+            botScore: 0.8,
+            cookieDroppingScore: 0.7, // Moins critique, mais toujours un signal
+            threatIntelScore: 0.3, // Lower priority for a blog
+            clientHintsInconsistencyScore: 0.5,
+            clickVarianceScore: 0.5, // Moderate weight for click variance
+            subnetScore: 0.4, // Utile contre le spam de commentaires coordonné
             ipReputationScore: 0.3, // NOUVEAU: Poids pour la réputation IP
             botnetClusterScore: 0.5, // NOUVEAU: Poids pour le clustering botnet
             tcpAnomalyScore: 0.5, // NEW: Anomalie de pile TCP/IP
             quicAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie QUIC
             renderingAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie de rendu
-            threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
         patterns: {
@@ -686,6 +693,7 @@ const securityProfiles = {
         },
         allowCrossNetworkRoaming: true,
     wasm: true,
+    filterWhitelist: 90.0, // Très tolérant, n'inspecte que si le score est presque au blocage
         useAsymmetricTickets: true,
     },
     /**
@@ -705,13 +713,17 @@ const securityProfiles = {
             crossLayerInconsistencyScore: 0.7,
             timeInconsistencyScore: 0.9,
             tlsSpoofingScore: 0.9, // Très important pour l'e-commerce
-            subnetScore: 0.5,
+            botScore: 1.0,
+            cookieDroppingScore: 1.0, // Crucial pour la détection de bots e-commerce
+            threatIntelScore: 0.8, // Very important for e-commerce (scalping proxies)
+            clientHintsInconsistencyScore: 0.9, // Very important for e-commerce
+            clickVarianceScore: 0.8, // Very high weight for click variance
+            subnetScore: 0.9, // Crucial contre les attaques de scalping distribuées
             ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
             botnetClusterScore: 0.9, // NOUVEAU: Poids pour le clustering botnet
             tcpAnomalyScore: 0.9, // NEW: Anomalie de pile TCP/IP
             quicAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie QUIC
             renderingAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie de rendu,threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
-            threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
         patterns: {
@@ -729,6 +741,7 @@ const securityProfiles = {
         challengeNewDevices: true, // New devices are suspicious in e-commerce
         isApiRequest: (req) => req.path.startsWith('/api/cart') || req.path.startsWith('/api/stock') || req.path.startsWith('/api/checkout'),
         allowCrossNetworkRoaming: false, // E-commerce : interdiction de changer de réseau sans re-challenge
+    filterWhitelist: true, // Tolérance zéro pour le scraping / scalping distribué
     wasm: true,
         useAsymmetricTickets: true,
     }
@@ -2793,12 +2806,20 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
         highScoreCount: 0,
         deviceIds: [],
         highScoreDevices: {},
-        lastActivity: 0
+        lastActivity: 0,
+        ips: [],
+        uas: []
     };
 
     if (!subnetData.highScoreDevices) {
         subnetData.highScoreDevices = {};
     }
+    if (subnetData.ips instanceof Set) {
+        subnetData.ips = Array.from(subnetData.ips);
+    } else if (!subnetData.ips) {
+        subnetData.ips = [];
+    }
+    if (!subnetData.uas) subnetData.uas = [];
 
     // Utilisation d'un identifiant d'appareil stable (fingerprint matériel) plutôt que l'ID de cookie volatil
     const currentDeviceHash = getCompositeDeviceHash(context);
@@ -2813,6 +2834,16 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
     if (!subnetData.deviceIds.includes(stableFpId)) {
         subnetData.deviceIds.push(stableFpId);
     }
+
+    if (!subnetData.ips.includes(context.clientIp)) {
+        subnetData.ips.push(context.clientIp);
+    }
+
+    const userAgent = context.headers?.['user-agent'] || '';
+    if (userAgent && !subnetData.uas.includes(userAgent)) {
+        subnetData.uas.push(userAgent);
+    }
+
     subnetData.lastActivity = Date.now();
 
     if (subnetData.deviceIds.length > 100) {
@@ -2823,6 +2854,8 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
             delete subnetData.highScoreDevices[oldDeviceId];
         }
     }
+    if (subnetData.ips.length > 100) subnetData.ips.shift();
+    if (subnetData.uas.length > 50) subnetData.uas.shift();
 
     await store.set(key, subnetData, 86400); // 24-hour TTL
 }
@@ -2846,16 +2879,37 @@ async function getSubnetScore(context) {
 
     let highScoreCount = subnetData.highScoreCount || 0;
     let deviceCount = subnetData.deviceIds ? subnetData.deviceIds.length : 0;
+    let ipCount = 1;
+    if (subnetData.ips) {
+        ipCount = subnetData.ips instanceof Set ? subnetData.ips.size : (subnetData.ips.length || 1);
+    }
+    let uaCount = subnetData.uas ? subnetData.uas.length : 1;
 
     if (halfLives > 0) {
-        highScoreCount = Math.max(0, Math.floor(highScoreCount / Math.pow(2, halfLives)));
-        deviceCount = Math.max(0, Math.floor(deviceCount / Math.pow(2, halfLives)));
+        const decay = Math.pow(2, halfLives);
+        highScoreCount = Math.max(0, Math.floor(highScoreCount / decay));
+        deviceCount = Math.max(0, Math.floor(deviceCount / decay));
+        ipCount = Math.max(1, Math.floor(ipCount / decay));
+        uaCount = Math.max(1, Math.floor(uaCount / decay));
+    }
+
+    if (deviceCount === 0) {
+        return { subnetScore: 0.0 };
     }
 
-    const deviceCountPenalty = Math.min(80, Math.max(0, deviceCount - 10) * 5);
-    const highScorePenalty = Math.min(40, highScoreCount * 2);
+    // Calculs analogues continus (sans sauts brusques)
+    const suspicionDensity = highScoreCount / deviceCount;
+    const ipDeviceRatio = ipCount / deviceCount;
+
+    // Base score continu basé sur le volume de menaces
+    const baseScore = 100 * (1 - Math.exp(-0.15 * highScoreCount));
+
+    // Multiplicateurs continus
+    const densityMultiplier = 0.4 + (1.6 * suspicionDensity); // Favorise les densités de suspicion élevées
+    const distributionMultiplier = 0.5 + (1.0 * ipDeviceRatio); // NAT (faible ratio IP/Device) vs Proxy distribué (fort ratio)
 
-    return { subnetScore: Math.min(100, deviceCountPenalty + highScorePenalty) };
+    const finalScore = Math.min(100, Math.round(baseScore * densityMultiplier * distributionMultiplier * 10) / 10);
+    return { subnetScore: finalScore };
 }
 
 /**
@@ -2877,17 +2931,31 @@ async function getBotnetClusterScore(context, stableFpHash) {
 
   clusterData = clusterData.filter(entry => entry.timestamp > tenMinutesAgo);
   const existingIndex = clusterData.findIndex(entry => entry.ip === context.clientIp);
+  const userAgent = context.headers?.['user-agent'] || '';
+  const subnet = getIpSubnet(context.clientIp) || 'unknown';
+
   if (existingIndex !== -1) {
     clusterData[existingIndex].timestamp = now;
+    clusterData[existingIndex].ua = userAgent;
+    clusterData[existingIndex].subnet = subnet;
   } else {
-    clusterData.push({ ip: context.clientIp, timestamp: now });
+    clusterData.push({ ip: context.clientIp, timestamp: now, ua: userAgent, subnet: subnet });
   }
 
   await store.set(key, clusterData, 600);
   const uniqueIpsCount = clusterData.length;
   let botnetClusterScore = 0;
   if (uniqueIpsCount >= 2) {
-    botnetClusterScore = Math.min(100, Math.round(1000 * (1 - Math.exp(-0.35 * (uniqueIpsCount - 1)))) / 10);
+    // Calcul de la diversité des sous-réseaux et de la rotation des User-Agents
+    const uniqueSubnets = new Set(clusterData.map(e => e.subnet)).size;
+    const uniqueUserAgents = new Set(clusterData.map(e => e.ua).filter(Boolean)).size;
+
+    // Facteurs d'ajustement
+    const subnetMultiplier = uniqueSubnets > 1 ? 1.3 : 0.6; // Réduit le score si même sous-réseau (NAT), l'augmente si distribué
+    const uaRotationMultiplier = uniqueUserAgents > 1 ? 1.5 : 1.0; // Forte pénalité en cas de rotation d'en-tête UA
+
+    const baseScore = 100 * (1 - Math.exp(-0.35 * (uniqueIpsCount - 1)));
+    botnetClusterScore = Math.min(100, Math.round(baseScore * subnetMultiplier * uaRotationMultiplier * 10) / 10);
   }
   return { botnetClusterScore };
 }
@@ -3105,6 +3173,7 @@ function verifyTrapUrl(path, signature, nonce) {
  * @property {(key: string, value: any, ttl?: number) => Promise<void>} set
  * @property {(key: string) => Promise<boolean>} has
  * @property {(key: string) => Promise<void>} delete
+ * @property {() => Promise<void>} clear
  */
 
 /**
@@ -3130,6 +3199,13 @@ const inMemoryStore = {
   },
   async has(key) { return this._map.has(key); },
   async delete(key) { this._map.delete(key); },
+  async clear() {
+    this._map.clear();
+    for (const timeoutId of this._timeouts.values()) {
+      clearTimeout(timeoutId);
+    }
+    this._timeouts.clear();
+  }
 };
 
 /** @type {IStore} */
@@ -3513,13 +3589,15 @@ function calculateTarget(suspicionFactor, securityConfig = {}) {
  * @param {string} nonce
  * @param {string} clientSecret
  * @param {string} fingerprint
+ * @param {string} clientIp
+ * @param {string} tlsSessionId
  * @returns {Buffer}
  */
-function createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint) {
+function createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint, clientIp = '', tlsSessionId = '') {
     const sortedFingerprint = (fingerprint || '').split('|').filter(p => p).sort().join('|');
     // On concatène les chaînes, puis on les convertit en buffer une seule fois.
     // Cela garantit que le client et le serveur travaillent sur la même base binaire.
-    const messageBase = `${nonce}:${clientSecret}:${sortedFingerprint}:`; // Le ':' final est le séparateur pour la solution.
+    const messageBase = `${nonce}:${clientSecret}:${sortedFingerprint}:${clientIp}:${tlsSessionId}:`; // Le ':' final est le séparateur pour la solution.
     return Buffer.from(messageBase, 'utf8');
 }
 
@@ -3532,10 +3610,11 @@ export function generateCpuTargetChallenge(
   suspicionFactor,
   originalUrl,
   securityConfig,
+  tlsSessionId = '',
 ) {
   const target = calculateTarget(suspicionFactor, securityConfig);
   // Le baseBlock est créé ici et sera stocké dans le contexte du challenge.
-  const baseBlock = createCpuChallengeBaseBlock(nonce, null, ''); // Pour le challenge simple, le secret et le fingerprint sont vides.
+  const baseBlock = createCpuChallengeBaseBlock(nonce, null, '', clientIp, tlsSessionId);
   return {
     type: "cpu_target",
     nonce: nonce,
@@ -3619,14 +3698,14 @@ function generateCpuTargetChallengePage(challengeDetails, clientIp) {
  * @param {string} clientIp - The client's IP address.
  * @returns {string} HTML content.
  */
-function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapUrls, originalFingerprint) { // eslint-disable-line max-len
+function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty, clientIp, clientSecret, securityConfig, trapUrls, originalFingerprint, tlsSessionId = '') { // eslint-disable-line max-len
     const { nonce, target, path } = cpuChallengeDetails;
     const safePath = sanitizeRedirectPath(path);
     const solverCode = getPowSolverCode();
     // On prépare le baseBlock pour le client. Il sera envoyé sous forme de tableau d'octets.
     // Le fingerprint est maintenant passé directement en paramètre.
     const fingerprint = originalFingerprint;
-    const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint);
+    const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, fingerprint, clientIp, tlsSessionId);
     const baseBlockBytes = `[${baseBlock.toString('utf8').split('').map(c => c.charCodeAt(0)).join(',')}]`;
 
     // Prépare la configuration pour l'initialisation du client, y compris les URL pièges.
@@ -3825,16 +3904,31 @@ export class FingerprintEngine {
 
         // Auto-generate Ed25519 key pair on load if indicated and keys are not set
         if (securityConfig && (securityConfig.useAsymmetricTickets || securityConfig.ed25519 === 'auto') && !process.env.ED25519_PRIVATE_KEY) {
-          try {
-            const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519', {
-              privateKeyEncoding: { format: 'pem', type: 'pkcs8' },
-              publicKeyEncoding: { format: 'pem', type: 'spki' }
-            });
-            process.env.ED25519_PRIVATE_KEY = privateKey;
-            process.env.ED25519_PUBLIC_KEY = publicKey;
-          } catch (e) {
-            console.error('[Fingerprint] Native Ed25519 key generation failed:', e.message);
-          }
+            const persistentKeyPath = join(configDir, 'ed25519_key.json');
+            if (existsSync(persistentKeyPath)) {
+                try {
+                    const keys = JSON.parse(readFileSync(persistentKeyPath, 'utf-8'));
+                    process.env.ED25519_PRIVATE_KEY = keys.privateKey;
+                    process.env.ED25519_PUBLIC_KEY = keys.publicKey;
+                    this._log('Persistent Ed25519 keys loaded from disk');
+                } catch (e) {
+                    console.error('[Fingerprint] Failed to load persistent Ed25519 keys:', e.message);
+                }
+            } else {
+                try {
+                    const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519', {
+                        privateKeyEncoding: { format: 'pem', type: 'pkcs8' },
+                        publicKeyEncoding: { format: 'pem', type: 'spki' }
+                    });
+                    process.env.ED25519_PRIVATE_KEY = privateKey;
+                    process.env.ED25519_PUBLIC_KEY = publicKey;
+                    // Persist keys on disk for subsequent restarts
+                    writeFileSync(persistentKeyPath, JSON.stringify({ privateKey, publicKey }, null, 2), 'utf-8');
+                    this._log('New persistent Ed25519 keys generated and saved to disk');
+                } catch (e) {
+                    console.error('[Fingerprint] Native Ed25519 key generation failed:', e.message);
+                }
+                }
         }
 
     let finalConfig = securityConfig;
@@ -3855,6 +3949,11 @@ export class FingerprintEngine {
     this._validateConfig(finalConfig); // Validate the configuration
     this.verbose = finalConfig.verbose || false;
     this.dryRun = finalConfig.dryRun || false;
+    if (finalConfig.reset) {
+      this.resetStore().catch(err => {
+        console.error('[FingerprintEngine] Failed to reset store on startup:', err.message);
+      });
+    }
   }
 
   /**
@@ -3869,6 +3968,16 @@ export class FingerprintEngine {
     this._log('Configuration mise à jour à chaud (Hot-Reloaded)', this.securityConfig);
   }
 
+  /**
+   * Réinitialise le store de persistance actif.
+   */
+  async resetStore() {
+    if (store && typeof store.clear === 'function') {
+      await store.clear();
+      this._log('Store has been reset/cleared.');
+    }
+  }
+
   /**
    * Validates the security configuration object to detect potential typos or missing essential keys.
    * @private
@@ -3887,9 +3996,9 @@ export class FingerprintEngine {
       'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
       'trustedProxies',
       'wasm',
-      'similarityThreshold',
+      'similarityThreshold', 'reset',
       'ed25519_private_key', 'ed25519_public_key',
-      'federatedPeers', 'federationSecret'
+      'federatedPeers', 'federationSecret', 'filterWhitelist'
     ]);
 
     // 1. Check for essential keys
@@ -3908,6 +4017,19 @@ export class FingerprintEngine {
     }
   }
 
+  _hasCertainAttack(context) {
+    const honeypotConfig = this.securityConfig.honeypot || {};
+    const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
+    if (honeypotScore >= 100) {
+      return true;
+    }
+    const { botScore } = getBotScore(context);
+    if (botScore >= 100) {
+      return true;
+    }
+    return false;
+  }
+
   _log(message, data = {}) {
     if (this.verbose) {
       console.log(`[FingerprintEngine] ${message}`, data);
@@ -4223,6 +4345,16 @@ export class FingerprintEngine {
 
       const { weights, thresholds, logger, onDeviceCompromised } = this.securityConfig;
     
+    let preCalculatedVector = null;
+    let preCalculatedScore = null;
+    const getScoreAndVector = async () => {
+      if (preCalculatedScore === null) {
+        preCalculatedVector = await __internal.getSuspicionVector(requestContext, this.securityConfig);
+        preCalculatedScore = this.calculateFinalScore(preCalculatedVector);
+      }
+      return { score: preCalculatedScore, vector: preCalculatedVector };
+    };
+
     this._log('Processing request', { clientIp, path, isStatic });
     
     // Bypass instantané si l'appareil a prouvé cryptographiquement son identité matérielle (Secure Enclave / TPM)
@@ -4243,34 +4375,47 @@ export class FingerprintEngine {
     const allowRoaming = this.securityConfig?.allowCrossNetworkRoaming ?? false;
 
     // 1. Check static IP allowlist first for maximum performance.
-    if (this._isIpInAllowlist(clientIp)) {
-      this._log('IP in allowlist - allowing request', { clientIp });
-      return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'allowlist' } };
-    }
-
-    // 2. Check hostname-based allowlist.
-    if (await this._isIpInHostnameAllowlist(clientIp)) {
-      this._log('IP resolves to a whitelisted hostname - allowing request', { clientIp });
-      return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'hostname_allowlist' } };
-    }
+    let whitelisted = false;
+    let whitelistType = '';
 
-    // 3. Check host+path based allowlist.
-    const requestHost = requestContext.headers?.host;
-    if (requestHost && this._isHostPathInAllowlist(requestHost, path)) {
-      this._log('Host and path in allowlist - allowing request', { host: requestHost, path });
-      return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'host_path_allowlist' } };
+    if (this._isIpInAllowlist(clientIp)) {
+      whitelisted = true;
+      whitelistType = 'allowlist';
+    } else if (await this._isIpInHostnameAllowlist(clientIp)) {
+      whitelisted = true;
+      whitelistType = 'hostname_allowlist';
+    } else {
+      const requestHost = requestContext.headers?.host;
+      if (requestHost && this._isHostPathInAllowlist(requestHost, path)) {
+        whitelisted = true;
+        whitelistType = 'host_path_allowlist';
+      } else if (this._isPathInAllowlist(path)) {
+        whitelisted = true;
+        whitelistType = 'path_allowlist';
+      } else if (graphqlOperationType && this._isGraphqlOperationInAllowlist(graphqlOperationType, graphqlOperationName)) {
+        whitelisted = true;
+        whitelistType = 'graphql_operation_allowlist';
+      }
     }
 
-    // 3. Check path-based allowlist.
-    if (this._isPathInAllowlist(path)) {
-      this._log('Path in allowlist - allowing request', { path });
-      return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'path_allowlist' } };
-    }
+    if (whitelisted) {
+      const filterWhitelist = this.securityConfig.filterWhitelist || false;
+      let bypassWhitelist = false;
+      if (filterWhitelist === true) {
+        bypassWhitelist = this._hasCertainAttack(requestContext);
+      } else if (typeof filterWhitelist === 'number') {
+        const res = await getScoreAndVector();
+        if (res.score > filterWhitelist) {
+          bypassWhitelist = true;
+        }
+      }
 
-    // 5. Check GraphQL operation allowlist.
-    if (graphqlOperationType && this._isGraphqlOperationInAllowlist(graphqlOperationType, graphqlOperationName)) {
-      this._log('GraphQL operation in allowlist - allowing request', { operation: `${graphqlOperationType}:${graphqlOperationName}` });
-      return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'graphql_operation_allowlist' } };
+      if (bypassWhitelist) {
+        this._log('Whitelisted request exceeds filter threshold - bypassing whitelist bypass', { clientIp, path });
+      } else {
+        this._log(`IP/Path in allowlist (${whitelistType}) - allowing request`, { clientIp, path });
+        return { action: 'next', score: 0, vector: { whitelisted: 100, type: whitelistType } };
+      }
     }
 
     const { pow_nonce } = query;
@@ -4288,8 +4433,23 @@ export class FingerprintEngine {
 
     // Check if the request is from a verified, whitelisted bot (e.g., Googlebot)
     if (await this._verifyWhitelistedBot(requestContext)) {
-      this._log('Whitelisted bot verified - allowing request', { clientIp });
-      return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'bot' } };
+      const filterWhitelist = this.securityConfig.filterWhitelist || false;
+      let bypassWhitelist = false;
+      if (filterWhitelist === true) {
+        bypassWhitelist = this._hasCertainAttack(requestContext);
+      } else if (typeof filterWhitelist === 'number') {
+        const res = await getScoreAndVector();
+        if (res.score > filterWhitelist) {
+          bypassWhitelist = true;
+        }
+      }
+
+      if (bypassWhitelist) {
+        this._log('Verified bot request exceeds filter threshold - bypassing bot whitelist bypass', { clientIp });
+      } else {
+        this._log('Whitelisted bot verified - allowing request', { clientIp });
+        return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'bot' } };
+      }
     }
     
     this._log('Identity resolved', { deviceId, isNewDevice, hasDeviceData: !!deviceData });
@@ -4318,16 +4478,14 @@ export class FingerprintEngine {
     }
 
     // The engine now works with the context directly, no more rawReq dependency here.
-    const suspicionVector = await __internal.getSuspicionVector(requestContext, this.securityConfig);
-    // honeypotScore et behaviorScore sont maintenant inclus directement dans le vecteur de suspicion.
+    const suspicionVector = preCalculatedVector || await __internal.getSuspicionVector(requestContext, this.securityConfig);
+    let finalScore = preCalculatedScore !== null ? preCalculatedScore : this.calculateFinalScore(suspicionVector);
 
     this._log('Suspicion vector calculated', { 
         vector: suspicionVector,
         weights: this.securityConfig.weights 
     });
 
-    let finalScore = this.calculateFinalScore(suspicionVector);
-    
     this._log('Final score calculated', { finalScore });
 
     const blockThreshold = thresholds.block ?? 95;
@@ -4609,6 +4767,27 @@ export class FingerprintEngine {
                 }, store);
                 await manager.integrateSolution(pow_problem_id, workResult);
 
+                // Si le problème résolu est l'auto-tuning de sécurité et que l'auto-tuning est activé,
+                // on applique directement la meilleure solution calculée au moteur en direct.
+                if (pow_problem_id === 'security_auto_tuning' && this.securityConfig.autotuning?.enabled) {
+                    const paretoFront = workResult.paretoFront;
+                    if (Array.isArray(paretoFront) && paretoFront.length > 0) {
+                        let bestSolution = paretoFront[0];
+                        let minDistance = Math.sqrt(Math.pow(bestSolution.objectives[0], 2) + Math.pow(bestSolution.objectives[1], 2));
+                        for (let i = 1; i < paretoFront.length; i++) {
+                            const distance = Math.sqrt(Math.pow(paretoFront[i].objectives[0], 2) + Math.pow(paretoFront[i].objectives[1], 2));
+                            if (distance < minDistance) {
+                                minDistance = distance;
+                                bestSolution = paretoFront[i];
+                            }
+                        }
+                        if (bestSolution && bestSolution.solution) {
+                            this.updateConfig(bestSolution.solution);
+                            this._log('Useful Work auto-tuning applied successfully to live config.');
+                        }
+                    }
+                }
+
                 await store.delete(`secret:${pow_nonce}`);
                 // Accorder un ticket de passage comme pour un PoW normal
                 const ticket = "valid_ticket_placeholder"; // Générer un vrai ticket ici
@@ -4896,7 +5075,8 @@ export class FingerprintEngine {
             const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce)); // Génère les URL
 
             // On passe la configuration pour que la difficulté soit calculée correctement.
-            const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig);
+    const tlsSessionId = getTlsSessionId(requestContext) || '';
+    const cpuChallengeDetails = generateCpuTargetChallenge(clientIp, nonce, suspicionFactor, path, this.securityConfig, tlsSessionId);
 
             // La difficulté mémoire augmente désormais en parfaite synergie avec le facteur de suspicion (ratio constant)
             const memActivationFactor = suspicionFactor;
@@ -4915,7 +5095,7 @@ export class FingerprintEngine {
             const originalFingerprint = requestContext.headers['x-device-fingerprint'] || __internal.getCompositeDeviceHash(requestContext);
 
             // Store the entire challenge context with a short TTL (e.g., 5 minutes)
-            const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, originalFingerprint);
+    const baseBlock = createCpuChallengeBaseBlock(nonce, clientSecret, originalFingerprint, clientIp, tlsSessionId);
 
             // SECURITY: Cryptographically sign the payload before storing it to prevent database tampering
             const payloadToSign = `${clientSecret}:${cpuChallengeDetails.target}:${originalFingerprint}:${memDifficulty}:${path}:${clientIp}`;
@@ -4964,7 +5144,7 @@ export class FingerprintEngine {
                 decision.body = challengePayload;
             } else {
                 // For browsers, send the HTML page.
-                const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapUrls, originalFingerprint);
+        const page = generateCombinedPoWChallengePage(cpuChallengeDetails, memDifficulty, clientIp, clientSecret, this.securityConfig, trapUrls, originalFingerprint, tlsSessionId);
                 this._log('Browser challenge page generated', {
                     pageLength: page.length,
                     trapUrlsInjected: trapUrls.length
@@ -6106,7 +6286,10 @@ export const __internal = {
     registerCooperativeNode,
     findPeerInSubnet,
     handleCooperativeRequest,
-    broadcastBannedZkp
+    broadcastBannedZkp,
+    getMetric,
+    incrementCounter,
+    observeValue
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---
@@ -6125,20 +6308,21 @@ export function sanitizeTrafficData(trafficData) {
   if (!trafficData || trafficData.length === 0) {
     return [];
   }
-  const suspiciousLogs = [];
-  const passedLogs = [];
-  const deviceCounts = new Map();
+
+    const rawLogs = [...trafficData];
+    const totalCount = rawLogs.length;
+
+    const maxLogsPerDevice = Math.max(3, Math.floor(totalCount * 0.02)); // Max 2% contribution per device
+    const maxLogsPerIp = Math.max(3, Math.floor(totalCount * 0.02));      // Max 2% par adresse IP individuelle
+    const maxLogsPerSubnet = Math.max(5, Math.floor(totalCount * 0.05));  // Max 5% par bloc réseau (anti-proxy-rotation)
+    const maxLogsPerHardwareCluster = Math.max(3, Math.floor(totalCount * 0.02)); // Max 2% par cluster matériel stable
+
+    const deviceCounts = new Map();
   const ipCounts = new Map();
   const subnetCounts = new Map();
   const hardwareClusterCounts = new Map();
   const hwClusterCache = new Map();
 
-  // Calcul des quotas maximums pour éviter l'influence démesurée d'une entité
-  const maxLogsPerDevice = Math.max(3, Math.floor(trafficData.length * 0.02)); // Max 2% contribution per device
-  const maxLogsPerIp = Math.max(3, Math.floor(trafficData.length * 0.02));      // Max 2% par adresse IP individuelle
-  const maxLogsPerSubnet = Math.max(5, Math.floor(trafficData.length * 0.05));  // Max 5% par bloc réseau (anti-proxy-rotation)
-  const maxLogsPerHardwareCluster = Math.max(3, Math.floor(trafficData.length * 0.02)); // Max 2% par cluster matériel stable
-
   const getHardwareCluster = (log) => {
     const fp = log.deviceHash || log.fingerprint || log.deviceFingerprint || '';
     if (!fp || typeof fp !== 'string') {
@@ -6159,8 +6343,41 @@ export function sanitizeTrafficData(trafficData) {
     hwClusterCache.set(fp, result);
     return result;
   };
+// --- REVOLUTION : Compression de Cohorte par Densité Vectorielle (Anti-Sybil / Anti-Poisoning) ---
+    const clusteredLogs = [];
+    const getVectorDistance = (v1, v2) => {
+        if (!v1 || !v2) return Infinity;
+        let sum = 0;
+        const keys = new Set([...Object.keys(v1), ...Object.keys(v2)]);
+        for (const key of keys) {
+            sum += Math.pow((v1[key] || 0) - (v2[key] || 0), 2);
+        }
+        return Math.sqrt(sum);
+    };
+
+    for (const log of rawLogs) {
+        let matchedCluster = null;
+        for (const cluster of clusteredLogs) {
+            if (log.type === cluster.type && getVectorDistance(log.vector, cluster.vector) < 5.0) {
+                matchedCluster = cluster;
+                break;
+            }
+        }
+        if (matchedCluster) {
+            matchedCluster.instancesCount = (matchedCluster.instancesCount || 1) + 1;
+            matchedCluster.weight = 1 + Math.log(matchedCluster.instancesCount); // Compression logarithmique
+        } else {
+            const logCopy = { ...log };
+            logCopy.instancesCount = 1;
+            logCopy.weight = 1.0;
+            clusteredLogs.push(logCopy);
+        }
+    }
 
-  for (const log of trafficData) {
+    const suspiciousLogs = [];
+    const passedLogs = [];
+
+    for (const log of clusteredLogs) {
     const devId = log.deviceId || 'anonymous';
     const ip = log.clientIp || log.ip || 'unknown';
     const subnet = getIpSubnet(ip) || 'unknown-subnet';
@@ -6249,29 +6466,33 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
     pruneTrafficData(trafficData, maxDataPoints, maxAgeMs, onCleanup);
     const sanitizedData = sanitizeTrafficData(trafficData);
 
-  const highConfidenceLogs = sanitizedData.filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered').length;
-  const highConfidenceRatio = sanitizedData.length > 0 ? highConfidenceLogs / sanitizedData.length : 0;
+  const highConfidenceLogs = sanitizedData
+    .filter(log => log.type === 'challenge_solved' || log.type === 'trap_triggered')
+    .reduce((sum, log) => sum + (log.instancesCount || 1), 0);
+  const totalSanitizedInstances = sanitizedData.reduce((sum, log) => sum + (log.instancesCount || 1), 0);
+  const highConfidenceRatio = totalSanitizedInstances > 0 ? highConfidenceLogs / totalSanitizedInstances : 0;
   const MIN_CONFIDENCE_RATIO = 0.05; // Exiger au moins 5% de signaux forts.
   const MIN_HIGH_CONFIDENCE_COUNT = 10; // Absolu de secours pour éviter le gel lors de floods
 
   const hasEnoughSignal = highConfidenceRatio >= MIN_CONFIDENCE_RATIO || highConfidenceLogs >= MIN_HIGH_CONFIDENCE_COUNT;
 
-  if (sanitizedData.length < minDataPoints || !hasEnoughSignal) {
-    if (sanitizedData.length < minDataPoints) {
-    console.log(`[AutoTuning] Reporté : ${sanitizedData.length}/${minDataPoints} points de données.`);
+  if (totalSanitizedInstances < minDataPoints || !hasEnoughSignal) {
+    if (totalSanitizedInstances < minDataPoints) {
+    console.log(`[AutoTuning] Reporté : ${totalSanitizedInstances}/${minDataPoints} points de données.`);
     } else {
       console.log(`[AutoTuning] Reporté : Signaux de confiance insuffisants (Ratio: ${(highConfidenceRatio * 100).toFixed(2)}% < ${(MIN_CONFIDENCE_RATIO * 100).toFixed(2)}% et absolu: ${highConfidenceLogs} < ${MIN_HIGH_CONFIDENCE_COUNT}).`);
     }
     return;
   }
-  console.log(`[AutoTuning] Démarrage du cycle d'optimisation complet avec ${sanitizedData.length} points de données assainis.`);
+  console.log(`[AutoTuning] Démarrage du cycle d'optimisation complet avec ${totalSanitizedInstances} points de données assainis.`);
 
-  const paretoFront = Optimization.Operators.solveFullSecurityTuning({ trafficData: sanitizedData });
+  try {
+    const paretoFront = Optimization.Operators.solveFullSecurityTuning({ trafficData: sanitizedData });
 
-  if (!paretoFront || paretoFront.length === 0) {
-    console.warn("[AutoTuning] L'optimisation n'a retourné aucune solution.");
-    return;
-  }
+    if (!paretoFront || paretoFront.length === 0) {
+      console.warn("[AutoTuning] L'optimisation n'a retourné aucune solution.");
+      return;
+    }
 
   // Règles de gardiennage (Sanity Guardrails) pour filtrer le front de Pareto
   const isValidSecurityConfig = (config) => {
@@ -6429,13 +6650,14 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
   if (savePath) {
       try {
           const configToSave = JSON.stringify(bestSolution.solution, null, 2);
-          fs.writeFileSync(savePath, configToSave, 'utf-8');
+          writeFileSync(savePath, configToSave, 'utf-8');
           console.log(`[AutoTuning] Meilleure configuration sauvegardée dans : ${savePath}`);
       } catch (error) {
           console.error(`[AutoTuning] Erreur lors de la sauvegarde de la configuration optimisée : ${error.message}`);
       }
   }
 
+  } finally {
     if (clearAfterTuning) {
         const cleared = trafficData.splice(0, trafficData.length);
         if (onCleanup && typeof onCleanup === 'function' && cleared.length > 0) {
@@ -6447,6 +6669,7 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints, ma
         }
         console.log(`[AutoTuning] Explicitly cleared ${cleared.length} processed traffic data points.`);
     }
+  }
 }
 
 /**
@@ -6523,36 +6746,156 @@ class RequestContext {
   }
 }
 
-const MetricsManager = {
-  getPrometheusMetrics(securityConfig = {}) {
-    let metrics = `# HELP fingerprint_requests_total Total requests processed.\n# TYPE fingerprint_requests_total counter\nfingerprint_requests_total{status="passed"} 1\n`;
+const dynamicCounters = new Map();
+const dynamicObservations = new Map();
 
-    if (securityConfig.weights) {
-      metrics += `\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n# TYPE fingerprint_security_weight gauge\n`;
-      for (const [indicator, weight] of Object.entries(securityConfig.weights)) {
-        if (typeof weight === 'number') {
-          metrics += `fingerprint_security_weight{indicator="${indicator}"} ${weight}\n`;
-        }
-      }
+export function incrementCounter(name, labels = {}) {
+    const sortedLabels = Object.keys(labels).sort().reduce((acc, key) => {
+        acc[key] = labels[key];
+        return acc;
+    }, {});
+    const labelsKey = JSON.stringify(sortedLabels);
+    const queryName = name.startsWith('fingerprint_') ? name : `fingerprint_${name}`;
+    const fullKey = `${queryName}:${labelsKey}`;
+
+    if (!dynamicCounters.has(fullKey)) {
+        dynamicCounters.set(fullKey, { name: queryName, labels: sortedLabels, value: 0 });
     }
+    dynamicCounters.get(fullKey).value++;
+}
 
-    if (securityConfig.thresholds) {
-      metrics += `\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n# TYPE fingerprint_security_threshold gauge\n`;
-      for (const [level, threshold] of Object.entries(securityConfig.thresholds)) {
-        if (typeof threshold === 'number') {
-          metrics += `fingerprint_security_threshold{level="${level}"} ${threshold}\n`;
+export function observeValue(name, value, labels = {}) {
+    const sortedLabels = Object.keys(labels).sort().reduce((acc, key) => {
+        acc[key] = labels[key];
+        return acc;
+    }, {});
+    const labelsKey = JSON.stringify(sortedLabels);
+    const queryName = name.startsWith('fingerprint_') ? name : `fingerprint_${name}`;
+    const fullKey = `${queryName}:${labelsKey}`;
+    dynamicObservations.set(fullKey, { name: queryName, labels: sortedLabels, value });
+}
+
+export function getMetric(name, securityConfig = {}) {
+    const result = new Map();
+    const queryName = name.startsWith('fingerprint_') ? name : `fingerprint_${name}`;
+
+    if (queryName === 'fingerprint_security_weight') {
+        const weights = securityConfig.weights || {};
+        for (const [indicator, weight] of Object.entries(weights)) {
+            if (typeof weight === 'number') {
+                result.set(indicator, weight);
+            }
+        }
+    } else if (queryName === 'fingerprint_security_threshold') {
+        const thresholds = securityConfig.thresholds || {};
+        for (const [level, threshold] of Object.entries(thresholds)) {
+            if (typeof threshold === 'number') {
+                result.set(level, threshold);
+            }
+        }
+    } else if (queryName === 'fingerprint_autotuning_false_positive_rate') {
+        if (lastBestSolution && lastBestSolution.objectives) {
+            result.set('fpr', lastBestSolution.objectives[0]);
+        }
+    } else if (queryName === 'fingerprint_autotuning_false_negative_rate') {
+        if (lastBestSolution && lastBestSolution.objectives) {
+            result.set('fnr', lastBestSolution.objectives[1]);
+        }
+    } else {
+        // Search dynamic counters
+        for (const counter of dynamicCounters.values()) {
+            if (counter.name === queryName || counter.name === name) {
+                const labelPairs = Object.entries(counter.labels)
+                    .map(([k, v]) => `${k}="${v}"`)
+                    .join(',');
+                result.set(labelPairs || 'value', counter.value);
+            }
         }
-      }
-    }
 
-    // Include auto-tuning objectives metrics if the auto-tuner has run
-    if (lastBestSolution && lastBestSolution.objectives) {
-      metrics += `\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate ${lastBestSolution.objectives[0]}\n`;
-      metrics += `\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate ${lastBestSolution.objectives[1]}\n`;
+        // Search dynamic observations
+        for (const obs of dynamicObservations.values()) {
+            if (obs.name === queryName || obs.name === name) {
+                const labelPairs = Object.entries(obs.labels)
+                    .map(([k, v]) => `${k}="${v}"`)
+                    .join(',');
+                result.set(labelPairs || 'value', obs.value);
+            }
+        }
     }
+    return result;
+}
 
-    return metrics;
-  }
+const MetricsManager = {
+    getPrometheusMetrics(securityConfig = {}) {
+        let metrics = '';
+
+        if (dynamicCounters.size === 0) {
+            metrics += `# HELP fingerprint_requests_total Total requests processed.\n# TYPE fingerprint_requests_total counter\nfingerprint_requests_total{status="passed"} 1\n`;
+        } else {
+            const grouped = {};
+            for (const counter of dynamicCounters.values()) {
+                if (!grouped[counter.name]) {
+                    grouped[counter.name] = [];
+                }
+                grouped[counter.name].push(counter);
+            }
+            for (const [name, instances] of Object.entries(grouped)) {
+                metrics += `# HELP ${name} Total requests processed.\n# TYPE ${name} counter\n`;
+                for (const inst of instances) {
+                    const labelPairs = Object.entries(inst.labels)
+                        .map(([k, v]) => `${k}="${v}"`)
+                        .join(',');
+                    const labelStr = labelPairs ? `{${labelPairs}}` : '';
+                    metrics += `${name}${labelStr} ${inst.value}\n`;
+                }
+            }
+        }
+
+        if (dynamicObservations.size > 0) {
+            const grouped = {};
+            for (const obs of dynamicObservations.values()) {
+                if (!grouped[obs.name]) {
+                    grouped[obs.name] = [];
+                }
+                grouped[obs.name].push(obs);
+            }
+            for (const [name, instances] of Object.entries(grouped)) {
+                metrics += `\n# HELP ${name} Value observation.\n# TYPE ${name} gauge\n`;
+                for (const inst of instances) {
+                    const labelPairs = Object.entries(inst.labels)
+                        .map(([k, v]) => `${k}="${v}"`)
+                        .join(',');
+                    const labelStr = labelPairs ? `{${labelPairs}}` : '';
+                    metrics += `${name}${labelStr} ${inst.value}\n`;
+                }
+            }
+        }
+
+        if (securityConfig.weights) {
+            metrics += `\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n# TYPE fingerprint_security_weight gauge\n`;
+            for (const [indicator, weight] of Object.entries(securityConfig.weights)) {
+                if (typeof weight === 'number') {
+                    metrics += `fingerprint_security_weight{indicator="${indicator}"} ${weight}\n`;
+                }
+            }
+        }
+
+        if (securityConfig.thresholds) {
+            metrics += `\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n# TYPE fingerprint_security_threshold gauge\n`;
+            for (const [level, threshold] of Object.entries(securityConfig.thresholds)) {
+                if (typeof threshold === 'number') {
+                    metrics += `fingerprint_security_threshold{level="${level}"} ${threshold}\n`;
+                }
+            }
+        }
+
+        if (lastBestSolution && lastBestSolution.objectives) {
+            metrics += `\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate ${lastBestSolution.objectives[0]}\n`;
+            metrics += `\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate ${lastBestSolution.objectives[1]}\n`;
+        }
+
+        return metrics;
+    }
 };
 
 /**