@anonympins/fingerprint 0.6.1 → 0.6.4

package/src/js/tests/metrics.test.js

@@ -1,104 +1,158 @@
-import { describe, expect, it, vi, beforeEach } from 'vitest';
-import { handleMetricsRequest, __internal } from '../fingerprint.js';
-
-describe('Metrics & Authorization Callback Integration', () => {
-    let req, res;
-
-    beforeEach(() => {
-        req = {
-            ip: '127.0.0.1',
-            path: '/metrics',
-            headers: { 'user-agent': 'prometheus' },
-            query: {},
-            body: {},
-            cookies: {},
-            httpVersion: '1.1'
-        };
-        res = {
-            status: vi.fn().mockReturnThis(),
-            send: vi.fn().mockReturnThis(),
-            set: vi.fn().mockReturnThis(),
-            redirect: vi.fn().mockReturnThis()
-        };
-    });
-    it('should return metrics with 200 Content-Type if authorized', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => true
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_requests_total'));
-    });
-
-    it('should include current weights and thresholds in prometheus metrics output', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => true,
-            weights: { historyScore: 0.35, rotationScore: 0.65 },
-            thresholds: { low: 22, block: 92 }
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_weight{indicator="historyScore"} 0.35'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_weight{indicator="rotationScore"} 0.65'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_threshold{level="low"} 22'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_threshold{level="block"} 92'));
-    });
-
-    it('should include auto-tuning performance metrics if a best solution is available', async () => {
-        __internal.setLastBestSolution({
-            solution: {},
-            objectives: [0.0123, 0.0456]
-        });
-
-        const config = {
-            metricsAuthorizationCallback: () => true
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_autotuning_false_positive_rate 0.0123'));
-        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_autotuning_false_negative_rate 0.0456'));
-
-        // Cleanup
-        __internal.setLastBestSolution(null);
-    });
-
-    it('should return 403 if authorization callback returns false', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => false
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.status).toHaveBeenCalledWith(403);
-        expect(res.send).toHaveBeenCalledWith('Access to metrics denied.');
-    });
-
-    it('should handle custom block action returned by authorization callback', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => ({
-                action: 'block',
-                status: 401,
-                body: 'Custom unauthorized message'
-            })
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.status).toHaveBeenCalledWith(401);
-        expect(res.send).toHaveBeenCalledWith('Custom unauthorized message');
-    });
-
-    it('should handle custom redirect action returned by authorization callback', async () => {
-        const config = {
-            metricsAuthorizationCallback: () => ({
-                action: 'redirect',
-                status: 302,
-                path: '/forbidden'
-            })
-        };
-        await handleMetricsRequest(req, res, config);
-
-        expect(res.redirect).toHaveBeenCalledWith(302, '/forbidden');
-    });
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { handleMetricsRequest, getMetric, incrementCounter, observeValue, __internal } from '../fingerprint.js';
+
+describe('Metrics & Authorization Callback Integration', () => {
+    let req, res;
+
+    beforeEach(() => {
+        req = {
+            ip: '127.0.0.1',
+            path: '/metrics',
+            headers: { 'user-agent': 'prometheus' },
+            query: {},
+            body: {},
+            cookies: {},
+            httpVersion: '1.1'
+        };
+        res = {
+            status: vi.fn().mockReturnThis(),
+            send: vi.fn().mockReturnThis(),
+            set: vi.fn().mockReturnThis(),
+            redirect: vi.fn().mockReturnThis()
+        };
+    });
+    it('should return metrics with 200 Content-Type if authorized', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => true
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_requests_total'));
+    });
+
+    it('should include current weights and thresholds in prometheus metrics output', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => true,
+            weights: { historyScore: 0.35, rotationScore: 0.65 },
+            thresholds: { low: 22, block: 92 }
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_weight{indicator="historyScore"} 0.35'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_weight{indicator="rotationScore"} 0.65'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_threshold{level="low"} 22'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_security_threshold{level="block"} 92'));
+    });
+
+    it('should include auto-tuning performance metrics if a best solution is available', async () => {
+        __internal.setLastBestSolution({
+            solution: {},
+            objectives: [0.0123, 0.0456]
+        });
+
+        const config = {
+            metricsAuthorizationCallback: () => true
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.set).toHaveBeenCalledWith('Content-Type', expect.stringContaining('text/plain'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_autotuning_false_positive_rate 0.0123'));
+        expect(res.send).toHaveBeenCalledWith(expect.stringContaining('fingerprint_autotuning_false_negative_rate 0.0456'));
+
+        // Cleanup
+        __internal.setLastBestSolution(null);
+    });
+
+    it('should return 403 if authorization callback returns false', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => false
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.status).toHaveBeenCalledWith(403);
+        expect(res.send).toHaveBeenCalledWith('Access to metrics denied.');
+    });
+
+    it('should handle custom block action returned by authorization callback', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => ({
+                action: 'block',
+                status: 401,
+                body: 'Custom unauthorized message'
+            })
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.status).toHaveBeenCalledWith(401);
+        expect(res.send).toHaveBeenCalledWith('Custom unauthorized message');
+    });
+
+    it('should handle custom redirect action returned by authorization callback', async () => {
+        const config = {
+            metricsAuthorizationCallback: () => ({
+                action: 'redirect',
+                status: 302,
+                path: '/forbidden'
+            })
+        };
+        await handleMetricsRequest(req, res, config);
+
+        expect(res.redirect).toHaveBeenCalledWith(302, '/forbidden');
+    });
+});
+
+describe('getMetric Unit Tests', () => {
+    it('should retrieve security weights from config', () => {
+        const config = {
+            weights: { historyScore: 0.5, rotationScore: 0.2, someInvalidWeight: 'not-a-number' }
+        };
+        const weights = getMetric('security_weight', config);
+        expect(weights.get('historyScore')).toBe(0.5);
+        expect(weights.get('rotationScore')).toBe(0.2);
+        expect(weights.has('someInvalidWeight')).toBe(false);
+    });
+
+    it('should retrieve security thresholds from config', () => {
+        const config = {
+            thresholds: { low: 10, medium: 30, high: 70, block: 90 }
+        };
+        const thresholds = getMetric('security_threshold', config);
+        expect(thresholds.get('low')).toBe(10);
+        expect(thresholds.get('medium')).toBe(30);
+        expect(thresholds.get('high')).toBe(70);
+        expect(thresholds.get('block')).toBe(90);
+    });
+
+    it('should retrieve dynamic counters', () => {
+        incrementCounter('requests_total', { status: 'passed' });
+        incrementCounter('requests_total', { status: 'blocked' });
+
+        const metric = getMetric('requests_total');
+        expect(metric.get('status="passed"')).toBeGreaterThanOrEqual(1);
+        expect(metric.get('status="blocked"')).toBeGreaterThanOrEqual(1);
+    });
+
+    it('should retrieve dynamic observations', () => {
+        observeValue('suspicion_score', 45.5, { action: 'passed' });
+
+        const metric = getMetric('suspicion_score');
+        expect(metric.get('action="passed"')).toBe(45.5);
+    });
+
+    it('should retrieve autotuning false positive and negative rates', () => {
+        __internal.setLastBestSolution({
+            solution: {},
+            objectives: [0.015, 0.045]
+        });
+
+        const fpr = getMetric('autotuning_false_positive_rate');
+        const fnr = getMetric('autotuning_false_negative_rate');
+
+        expect(fpr.get('fpr')).toBe(0.015);
+        expect(fnr.get('fnr')).toBe(0.045);
+
+        __internal.setLastBestSolution(null);
+    });
 });

package/src/php/Challenge/ChallengeUtils.php

@@ -8,6 +8,7 @@ use Anonympins\Fingerprint\Store\StoreManager;
 use Anonympins\Fingerprint\FingerprintBuilder;
 use Anonympins\Fingerprint\Utils\BigInt;
 use Anonympins\Fingerprint\Utils\RequestUtils;
+ use Anonympins\Fingerprint\Utils\Env;
 
 /**
  * Classe utilitaire pour la génération et la vérification des challenges Proof-of-Work.
@@ -397,8 +398,9 @@ class ChallengeUtils
      */
     public static function getPowSecret(): string
     {
-        $secret = $_ENV['POW_SECRET'] ?? getenv('POW_SECRET');
-        if (!$secret && ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production') {
+        $secret = Env::get('POW_SECRET');
+        $appEnv = Env::get('APP_ENV');
+        if (!$secret && $appEnv === 'production') {
             throw new \RuntimeException('POW_SECRET environment variable is not set. This is required for production.');
         }
         return $secret ?: "fallback-dev-secret-32-chars-minimum";
@@ -411,7 +413,7 @@ class ChallengeUtils
      */
     public static function generateStatelessTicket(array $payload): string
     {
-        $ed25519Key = $_ENV['ED25519_PRIVATE_KEY'] ?? getenv('ED25519_PRIVATE_KEY');
+        $ed25519Key = Env::get('ED25519_PRIVATE_KEY');
         if ($ed25519Key) {
             try {
                 $serialized = json_encode($payload);
@@ -457,7 +459,7 @@ class ChallengeUtils
                 $payloadJson = $base64UrlDecode($parts[1]);
                 $signature = $base64UrlDecode($parts[2]);
                 
-                $ed25519PubKey = $_ENV['ED25519_PUBLIC_KEY'] ?? getenv('ED25519_PUBLIC_KEY');
+                $ed25519PubKey = Env::get('ED25519_PUBLIC_KEY');
                 if (!$ed25519PubKey) {
                     error_log("[ChallengeUtils] ED25519_PUBLIC_KEY is not defined in environment.");
                     return null;
@@ -631,14 +633,14 @@ class ChallengeUtils
     /**
      * Crée le bloc de données de base pour le challenge CPU.
      */
-    public static function createCpuChallengeBaseBlock(string $nonce, string $clientSecret, string $fingerprint): string
+    public static function createCpuChallengeBaseBlock(string $nonce, string $clientSecret, string $fingerprint, string $clientIp = '', string $tlsSessionId = ''): string
     {
         $parts = explode('|', $fingerprint);
         $filteredParts = array_filter($parts);
         sort($filteredParts);
         $sortedFingerprint = implode('|', $filteredParts);
         
-        return "{$nonce}:{$clientSecret}:{$sortedFingerprint}:";
+        return "{$nonce}:{$clientSecret}:{$sortedFingerprint}:{$clientIp}:{$tlsSessionId}:";
     }
 
     /**

package/src/php/Config/SecurityProfiles.php

@@ -43,7 +43,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
                 'quicAnomalyScore' => 0.8, // NEW: Anomalie QUIC
                 'renderingAnomalyScore' => 0.8, // NEW: Anomalie de rendu
-
+                'ipReputationScore' => 0.5, // NOUVEAU: Poids pour la réputation IP
             ],
             'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95],
             'patterns' => [
@@ -58,6 +58,7 @@ class SecurityProfiles
                 'decayFactor' => 0.9,
                 'inactivityReset' => 5000,
             ],
+        'filterWhitelist' => 85.0, // Stratégie d'inspection modérée pour les IP/chemins en liste blanche
         'wasm' => true,
         ],
 
@@ -108,6 +109,7 @@ class SecurityProfiles
             ],
             'challengeNewDevices' => true, // Challenge all new devices
         'wasm' => true,
+        'filterWhitelist' => true, // Tout comportement d'attaque certain bypass immédiatement la liste blanche
         ],
 
         /**
@@ -155,6 +157,7 @@ class SecurityProfiles
             ],
             // This would be a callable in PHP, but for now, we represent its intent.
             'isApiRequest' => 'req.path.startsWith("/api/") || req.headers.accept?.includes("application/json")',
+        'filterWhitelist' => 75.0, // Seuil bas pour parer au vol de clés/tokens API légitimes
         'wasm' => true,
         ],
 
@@ -177,13 +180,14 @@ class SecurityProfiles
                 'honeypotScore' => 1.0, // Crucial for comment spam
                 'crossLayerInconsistencyScore' => 0.4,
                 'timeInconsistencyScore' => 0.8,
-                'tlsSpoofingScore' => 0.6,
+                'tlsSpoofingScore' => 0.6, // Moins critique pour les blogs
                 'botScore' => 0.8,
                 'cookieDroppingScore' => 0.7, // Moins critique, mais toujours un signal
                 'threatIntelScore' => 0.3, // Lower priority for a blog
                 'clientHintsInconsistencyScore' => 0.5,
                 'clickVarianceScore' => 0.5, // Moderate weight for click variance
                 'subnetScore' => 0.4, // Utile contre le spam de commentaires coordonné
+                'ipReputationScore' => 0.3, // NOUVEAU: Poids pour la réputation IP
                 'botnetClusterScore' => 0.5, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.5, // NEW: Anomalie de pile TCP/IP
                 'quicAnomalyScore' => 0.5, // NEW: Anomalie QUIC
@@ -203,6 +207,7 @@ class SecurityProfiles
                 'decayFactor' => 0.92,
                 'inactivityReset' => 10000,
             ],
+        'filterWhitelist' => 90.0, // Très tolérant, n'inspecte que si le score est presque au blocage
         'wasm' => true,
         ],
 
@@ -256,6 +261,7 @@ class SecurityProfiles
             // This would be a callable in PHP, but for now, we represent its intent.
             'isApiRequest' => 'req.path.startsWith("/api/cart") || req.path.startsWith("/api/stock") || req.path.startsWith("/api/checkout")',
         'wasm' => true,
+        'filterWhitelist' => true, // Tolérance zéro pour le scraping / scalping distribué
         ],
     ];