@anonympins/fingerprint 0.6.1 → 0.6.4

package/src/php/FingerprintEngine.php

@@ -11,6 +11,7 @@
  use Anonympins\Fingerprint\Utils\Logger;
  use Anonympins\Fingerprint\Utils\MetricsManager;
  use Anonympins\Fingerprint\Utils\RequestUtils;
+ use Anonympins\Fingerprint\Utils\Env;
 
  // Correction de l'import
 
@@ -164,14 +165,56 @@
 
      public function __construct(array $securityConfig)
      {
-         $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
+         $this->isProduction = Env::get('APP_ENV') === 'production';
          
          // Dynamically bind Ed25519 keys if passed via config
          if (isset($securityConfig['ed25519_private_key'])) {
-             $_ENV['ED25519_PRIVATE_KEY'] = $securityConfig['ed25519_private_key'];
+             Env::set('ED25519_PRIVATE_KEY', $securityConfig['ed25519_private_key']);
          }
          if (isset($securityConfig['ed25519_public_key'])) {
-             $_ENV['ED25519_PUBLIC_KEY'] = $securityConfig['ed25519_public_key'];
+             Env::set('ED25519_PUBLIC_KEY', $securityConfig['ed25519_public_key']);
+         }
+
+         // Génération et persistance automatique de la paire de clés Ed25519
+         $useAsymmetric = ($securityConfig['useAsymmetricTickets'] ?? false) === true || ($securityConfig['ed25519'] ?? '') === 'auto';
+         $envPrivate = Env::get('ED25519_PRIVATE_KEY');
+         if ($useAsymmetric && ($envPrivate === null || $envPrivate === '')) {
+             $configDir = dirname(__DIR__, 1) . '/config';
+             $persistentKeyPath = $configDir . '/ed25519_key.json';
+
+             if (file_exists($persistentKeyPath)) {
+                 try {
+                     $keys = json_decode(file_get_contents($persistentKeyPath), true);
+                     if (isset($keys['privateKey'], $keys['publicKey'])) {
+                         Env::set('ED25519_PRIVATE_KEY', $keys['privateKey']);
+                         Env::set('ED25519_PUBLIC_KEY', $keys['publicKey']);
+                     }
+                 } catch (\Throwable $e) {
+                     error_log('[Fingerprint] Failed to load persistent Ed25519 keys: ' . $e->getMessage());
+                 }
+             } else {
+                 try {
+                     if (defined('OPENSSL_KEYTYPE_ED25519')) {
+                         $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
+                         if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
+                             $details = openssl_pkey_get_details($pkey); // @phpstan-ignore-line
+                             $publicKeyPem = $details['key']; // @phpstan-ignore-line
+                             Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+                             Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                             // Also update $_ENV and $_SERVER for consistency
+                             if (!is_dir($configDir)) {
+                                 mkdir($configDir, 0777, true);
+                             }
+                             file_put_contents($persistentKeyPath, json_encode([
+                                 'privateKey' => $privateKeyPem,
+                                 'publicKey' => $publicKeyPem
+                             ], JSON_PRETTY_PRINT));
+                         }
+                     }
+                 } catch (\Throwable $e) {
+                     error_log('[Fingerprint] Native Ed25519 key generation failed: ' . $e->getMessage());
+                 }
+             }
          }
 
          // Auto-load optimized config if autotuning savePath is specified
@@ -194,6 +237,9 @@
          $this->logger = isset($securityConfig['logger']) && is_callable($securityConfig['logger']) ? new Logger($securityConfig['logger']) : null;
          $this->dryRun = $securityConfig['dryRun'] ?? false;
          $this->validateConfig($securityConfig);
+         if ($this->securityConfig['reset'] ?? false) {
+             $this->resetStore();
+         }
      }
 
     /**
@@ -209,6 +255,18 @@
         $this->log('Configuration mise à jour à chaud (Hot-Reloaded)', $this->securityConfig);
     }
 
+    /**
+     * Réinitialise le store de persistance actif.
+     */
+    public function resetStore(): void
+    {
+        $store = StoreManager::getStore();
+        if (method_exists($store, 'clear')) {
+            $store->clear();
+        }
+        $this->log('Store has been reset/cleared.');
+    }
+
      private function validateConfig(array $config): void
      {
          if (empty($config)) {
@@ -222,7 +280,8 @@
              'honeypot', 'threatIntel', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger', 'probationaryTtl',
              'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
              'similarityThreshold', 'summary', 'description',
-             'ed25519_private_key', 'ed25519_public_key'
+             'ed25519_private_key', 'ed25519_public_key',
+             'wasm', 'enableProofOfSpace', 'pospace', 'federatedPeers', 'federationSecret', 'reset'
          ];
 
          if (empty($config['weights'])) {
@@ -453,28 +512,50 @@
       */
      private function checkAllowlists(RequestContext $context): bool
      {
+         $whitelisted = false;
+         $type = '';
+
          if ($this->isIpInAllowlist($context->clientIp)) {
-             $this->log('IP in allowlist - allowing request', ['clientIp' => $context->clientIp]);
-             return true;
-         }
-         if ($this->isPathInAllowlist($context->path)) {
-             $this->log('Path in allowlist - allowing request', ['path' => $context->path]);
-             return true;
-         }
-         if ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
-             $this->log('Host and path in allowlist - allowing request', ['host' => $context->getHeader('host'), 'path' => $context->path]);
-             return true;
-         }
-         // NOUVEAU: Vérifier la liste blanche GraphQL
-         if ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
-             $this->log('GraphQL operation in allowlist - allowing request', ['operation' => "{$context->graphqlOperation['type']}:{$context->graphqlOperation['name']}"]);
-             return true;
-         }
-         if ($this->verifyWhitelistedBot($context)) {
-             $this->log('Whitelisted bot verified - allowing request', ['clientIp' => $context->clientIp]);
+             $whitelisted = true;
+             $type = 'allowlist';
+         } elseif ($this->isPathInAllowlist($context->path)) {
+             $whitelisted = true;
+             $type = 'path_allowlist';
+         } elseif ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
+             $whitelisted = true;
+             $type = 'host_path_allowlist';
+         } elseif ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
+             $whitelisted = true;
+             $type = 'graphql_operation_allowlist';
+         } elseif ($this->verifyWhitelistedBot($context)) {
+             $whitelisted = true;
+             $type = 'bot';
+         }
+
+         if ($whitelisted) {
+             $filterWhitelist = $this->securityConfig['filterWhitelist'] ?? false;
+             $bypassWhitelist = false;
+             if ($filterWhitelist === true) {
+                 $bypassWhitelist = $this->hasCertainAttack($context);
+             } elseif (is_numeric($filterWhitelist)) {
+                 if ($context->preCalculatedScore === null) {
+                     $suspicionVector = [];
+                     $context->preCalculatedVector = $this->getSuspicionVector($context, $suspicionVector);
+                     $context->preCalculatedScore = $this->calculateFinalScore($context->preCalculatedVector);
+                 }
+                 if ($context->preCalculatedScore > $filterWhitelist) {
+                     $bypassWhitelist = true;
+                 }
+             }
+
+             if ($bypassWhitelist) {
+                 $this->log('Whitelisted request exceeds filter threshold - bypassing whitelist bypass', ['clientIp' => $context->clientIp, 'path' => $context->path]);
+                 return false;
+             }
+             $this->log("IP/Path in allowlist ({$type}) - allowing request", ['clientIp' => $context->clientIp, 'path' => $context->path]);
              return true;
          }
- 
+
          return false;
      }
 
@@ -483,6 +564,9 @@
        */
      private function resolveRequestIdentity(RequestContext $context, array &$suspicionVector): array
      {
+         if ($context->resolvedIdentity !== null) {
+             return $context->resolvedIdentity;
+         }
          $this->log('Resolving request identity', ['clientIp' => $context->clientIp, 'cookies' => $context->cookies]);
          $store = StoreManager::getStore();
          $existingDeviceId = $context->cookies['device_id'] ?? null; // @phpstan-ignore-line
@@ -564,11 +648,12 @@
              $store->set("tls-session:{$tlsSessionId}", $deviceId, 3600); // 1h cache duration
          }
 
-         return [
+         $context->resolvedIdentity = [
              'deviceId' => $deviceId,
              'deviceData' => $deviceData,
              'newCookie' => $newCookie,
          ];
+         return $context->resolvedIdentity;
      }
 
      /**
@@ -860,6 +945,23 @@
          }
      }
 
+     /**
+      * Évalue si la requête présente des caractéristiques d'attaque flagrantes ou a déclenché un honeypot.
+      */
+     private function hasCertainAttack(RequestContext $context): bool
+     {
+         $honeypotConfig = $this->securityConfig['honeypot'] ?? [];
+         $honeypot = RequestUtils::getHoneypotScore($context, $honeypotConfig);
+         if (($honeypot['honeypotScore'] ?? 0.0) >= 100.0) {
+             return true;
+         }
+         $bot = RequestUtils::getBotScore($context);
+         if (($bot['botScore'] ?? 0.0) >= 100.0) {
+             return true;
+         }
+         return false;
+     }
+
      /**
       * Traite une requête entrante et retourne une décision.
       * @param RequestContext $context Le contexte de la requête.
@@ -891,22 +993,11 @@
                 $context->graphqlOperation = $gqlInfo;
             }
         }
-
-
-         $this->log('Processing request', ['clientIp' => $context->clientIp, 'path' => $context->path]);
- 
-         // Parse GraphQL query if applicable
-         if ($context->path === '/graphql' && !empty($context->body)) {
-             $gqlInfo = RequestUtils::parseGraphQLQuery(is_array($context->body) ? $context->body : []);
-             if ($gqlInfo) {
-                 $context->graphqlOperation = $gqlInfo;
-             }
-         }
  
          // 1. Vérifier les listes blanches
          if ($this->checkAllowlists($context)) {
+             MetricsManager::incrementCounter('requests_total', ['status' => 'whitelisted']);
              return ['action' => 'next', 'score' => 0.0, 'vector' => ['whitelisted' => 100.0]];
-            MetricsManager::incrementCounter('requests_total', ['status' => 'whitelisted']);
          }
  
          // Initialiser le vecteur de suspicion
@@ -995,6 +1086,28 @@
                                 $problemManager = \Anonympins\Fingerprint\ProblemManager::getInstance($configPath, $store);
                                  // FIX: La solution est directement le $workResult, pas une sous-propriété.
                                  $problemManager->integrateSolution($problemId, $workResult);
+
+                             // Si le problème résolu est l'auto-tuning de sécurité et que l'auto-tuning est activé,
+                             // on applique directement la meilleure solution calculée au moteur en direct.
+                             if ($problemId === 'security_auto_tuning' && ($this->securityConfig['autotuning']['enabled'] ?? false)) {
+                                 $paretoFront = $workResult['paretoFront'] ?? null;
+                                 if (is_array($paretoFront) && !empty($paretoFront)) {
+                                     $bestSolution = $paretoFront[0];
+                                     $minDistance = sqrt(pow((float)$bestSolution['objectives'][0], 2) + pow((float)$bestSolution['objectives'][1], 2));
+                                     for ($i = 1; $i < count($paretoFront); $i++) {
+                                         $distance = sqrt(pow((float)$paretoFront[$i]['objectives'][0], 2) + pow((float)$paretoFront[$i]['objectives'][1], 2));
+                                         if ($distance < $minDistance) {
+                                             $minDistance = $distance;
+                                             $bestSolution = $paretoFront[$i];
+                                         }
+                                     }
+                                     if (isset($bestSolution['solution'])) {
+                                         $this->updateConfig($bestSolution['solution']);
+                                         $this->log('Useful Work auto-tuning applied successfully to live config.');
+                                     }
+                                 }
+                             }
+
                                  $isValid = true;
                                  // FIX: Générer un vrai ticket pour uPoW, comme pour un PoW normal.
                                  $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000; // 1 heure par défaut
@@ -1076,8 +1189,8 @@
              return $decision;
          }
 
-         $suspicionVector = $this->getSuspicionVector($context, $suspicionVector);
-         $finalScore = $this->calculateFinalScore($suspicionVector);
+         $suspicionVector = $context->preCalculatedVector ?? $this->getSuspicionVector($context, $suspicionVector);
+         $finalScore = $context->preCalculatedScore ?? $this->calculateFinalScore($suspicionVector);
          $this->log('Suspicion vector and final score calculated', [
              'finalScore' => round($finalScore, 2),
              'vector' => $suspicionVector
@@ -1234,7 +1347,7 @@
 
                  if ($shouldUseUsefulWork) {
                      $this->log('Issuing a useful work challenge', ['finalScore' => $finalScore]);
-                    $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
+                            $defaultPath = dirname(__DIR__, 1) . '/config/problems.config.json';
                     $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                     $problemManager = ProblemManager::getInstance($configPath, $store);
                      $work = $problemManager->dispatchWork($finalScore);
@@ -1317,7 +1430,8 @@
                  $memDifficulty = (int)round($memActivationFactor * 48); // 0 à 48MB
 
                  $originalFingerprint = RequestUtils::getCompositeDeviceHash($context);
-                 $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint);
+                 $tlsSessionId = $context->tlsSessionId ?? '';
+                 $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint, $context->clientIp, $tlsSessionId);
 
                  $challengeContext = [
                      'clientSecret' => $clientSecret,
@@ -1437,7 +1551,7 @@
          $signature = '';
          $isAsymmetric = false;
          
-         $privateKey = $_ENV['ED25519_PRIVATE_KEY'] ?? getenv('ED25519_PRIVATE_KEY');
+         $privateKey = Env::get('ED25519_PRIVATE_KEY');
          if ($privateKey) {
              try {
                  $cleanKey = str_replace('\n', "\n", $privateKey);

package/src/php/Optimization/OptimizationOperators.php

@@ -70,18 +70,22 @@ class OptimizationOperators
      */
     public static function createFullSecurityConfigEvaluator(array $context): callable
     {
-        $trafficData = $context['trafficData'];
+        $trafficData = $context['trafficData'] ?? [];
+        $currentConfig = $context['currentConfig'] ?? null;
 
-        return function (array $config) use ($trafficData): array {
-            $falsePositives = 0;
-            $falseNegatives = 0;
-            $totalHumans = 0;
-            $totalBots = 0;
+        return function (array $config) use ($trafficData, $currentConfig): array {
+            $falsePositives = 0.0;
+            $falseNegatives = 0.0;
+            $totalHumans = 0.0;
+            $totalBots = 0.0;
+
+            $maxHumanScore = 0.0;
+            $minBotScore = 100.0;
 
             $calculateScore = function (array $log) use ($config): float {
                 $score = 0.0;
                 foreach ($config['weights'] as $key => $weight) {
-                    $score += ($log['vector'][$key] ?? 0) * $weight;
+                    $score += ($log['vector'][$key] ?? 0.0) * $weight;
                 }
                 return $score;
             };
@@ -94,30 +98,50 @@ class OptimizationOperators
                 'trap_triggered' => 2.0,
             ];
 
+            // 1. Évaluation sur les logs de trafic réels
             foreach ($trafficData as $log) {
-                $confidence = $confidenceWeights[$log['type']] ?? 1.0;
-                $isLikelyBot = in_array($log['type'], ['challenge_issued', 'request_blocked', 'trap_triggered']);
-                $isLikelyHuman = in_array($log['type'], ['request_passed', 'challenge_solved']);
+                $weight = (float)($log['weight'] ?? 1.0);
+                $confidence = ($confidenceWeights[$log['type'] ?? ''] ?? 1.0) * $weight;
+                $isLikelyBot = in_array($log['type'] ?? '', ['challenge_issued', 'request_blocked', 'trap_triggered']);
+                $isLikelyHuman = in_array($log['type'] ?? '', ['request_passed', 'challenge_solved']);
+
+                $score = $calculateScore($log);
 
                 if ($isLikelyBot) {
                     $totalBots += $confidence;
-                    $score = $calculateScore($log);
+                    $minBotScore = min($minBotScore, $score);
                     if ($score < $config['thresholds']['low']) {
                         $falseNegatives += $confidence;
                     }
                 } elseif ($isLikelyHuman) {
                     $totalHumans += $confidence;
-                    $score = $calculateScore($log);
+                    $maxHumanScore = max($maxHumanScore, $score);
                     if ($score >= $config['thresholds']['low']) {
                         $falsePositives += $confidence;
                     }
                 }
             }
 
-            $falsePositiveRate = $totalHumans > 0 ? $falsePositives / $totalHumans : 0;
-            $falseNegativeRate = $totalBots > 0 ? $falseNegatives / $totalBots : 0;
+            $falsePositiveRate = $totalHumans > 0.0 ? $falsePositives / $totalHumans : 0.0;
+            $falseNegativeRate = $totalBots > 0.0 ? $falseNegatives / $totalBots : 0.0;
+
+            // 3. Pénalité de dérive d'échelle (L2 Regularization par rapport au profil d'origine)
+            $regularizationPenalty = 0.0;
+            if ($currentConfig && isset($currentConfig['weights'])) {
+                foreach ($config['weights'] as $key => $val) {
+                    $originalVal = (float)($currentConfig['weights'][$key] ?? 0.0);
+                    $regularizationPenalty += pow((float)$val - $originalVal, 2);
+                }
+            }
+
+            // 4. Maximisation de la marge
+            $marginOverlap = max(0.0, $maxHumanScore - $minBotScore);
+            $marginPenalty = $marginOverlap / 100.0;
+
+            $obj1 = $falsePositiveRate + ($regularizationPenalty * 0.05);
+            $obj2 = $falseNegativeRate + $marginPenalty;
 
-            return [$falsePositiveRate, $falseNegativeRate];
+            return [$obj1, $obj2];
         };
     }
 
@@ -129,6 +153,7 @@ class OptimizationOperators
      */
     public static function solveFullSecurityTuning(array $context, array $options = []): array
     {
+        $currentConfig = $context['currentConfig'] ?? null;
         $fitnessFunction = self::createFullSecurityConfigEvaluator($context);
 
         $crossover = function (array $c1, array $c2): array {
@@ -143,31 +168,30 @@ class OptimizationOperators
             return $child;
         };
         $createIndividual = function () use ($currentConfig): array {
-            if ($currentConfig) {
-                $ind = [
-                    'thresholds' => [],
-                    'weights' => [],
-                    'patterns' => []
-                ];
-                foreach (['thresholds', 'weights', 'patterns'] as $section) {
-                    if (isset($currentConfig[$section]) && is_array($currentConfig[$section])) {
-                        foreach ($currentConfig[$section] as $k => $v) {
-                            if (is_numeric($v) && $k !== 'honeypotScore') {
-                                $randomVariation = 1.0 + (self::secureRandom() - 0.5) * 0.5; // Variation de +/- 25%
-                                $ind[$section][$k] = $v * $randomVariation;
-                            } else {
-                                $ind[$section][$k] = $v;
-                            }
+            $config = $currentConfig ?: \Anonympins\Fingerprint\Config\SecurityProfiles::createSecurityProfile('balanced');
+            $ind = [
+                'thresholds' => [],
+                'weights' => [],
+                'patterns' => []
+            ];
+            foreach (['thresholds', 'weights', 'patterns'] as $section) {
+                if (isset($config[$section]) && is_array($config[$section])) {
+                    foreach ($config[$section] as $k => $v) {
+                        if (is_numeric($v) && $k !== 'honeypotScore') {
+                            $randomVariation = 1.0 + (self::secureRandom() - 0.5) * 0.5; // Variation de +/- 25%
+                            $ind[$section][$k] = $v * $randomVariation;
+                        } else {
+                            $ind[$section][$k] = $v;
                         }
                     }
                 }
-                if (isset($ind['thresholds']['low'], $ind['thresholds']['medium'], $ind['thresholds']['high'])) {
-                    $ind['thresholds']['low'] = max(10.0, min(35.0, (float)$ind['thresholds']['low']));
-                    $ind['thresholds']['medium'] = max($ind['thresholds']['low'] + 5.0, min(70.0, (float)$ind['thresholds']['medium']));
-                    $ind['thresholds']['high'] = max($ind['thresholds']['medium'] + 5.0, min(90.0, (float)$ind['thresholds']['high']));
-                }
-                return $ind;
             }
+            if (isset($ind['thresholds']['low'], $ind['thresholds']['medium'], $ind['thresholds']['high'])) {
+                $ind['thresholds']['low'] = max(10.0, min(35.0, (float)$ind['thresholds']['low']));
+                $ind['thresholds']['medium'] = max($ind['thresholds']['low'] + 5.0, min(70.0, (float)$ind['thresholds']['medium']));
+                $ind['thresholds']['high'] = max($ind['thresholds']['medium'] + 5.0, min(90.0, (float)$ind['thresholds']['high']));
+            }
+            return $ind;
         };
 
         $mutate = function (array $c, ?array $currentConfigRef = null) use ($currentConfig): array {

package/src/php/RequestContext.php

@@ -32,6 +32,13 @@ class RequestContext
     /** @var ?array<string, mixed> */
     public ?array $newCookieForResponse = null;
 
+    /** @var ?array<string, mixed> */
+    public ?array $resolvedIdentity = null;
+
+    public ?float $preCalculatedScore = null;
+    /** @var ?array<string, float> */
+    public ?array $preCalculatedVector = null;
+
     // Propriétés spécifiques qui peuvent être fournies par un proxy inverse
     public ?string $ja3 = null;
     public ?string $ja4 = null;

package/src/php/Store/IStore.php

@@ -39,4 +39,10 @@ interface IStore
      * @return void
      */
     public function delete(string $key): void;
+
+    /**
+     * Supprime toutes les clés du stockage.
+     * @return void
+     */
+    public function clear(): void;
 }

package/src/php/Store/MongoDbStore.php

@@ -182,4 +182,16 @@ class MongoDbStore implements IStore
             $this->lastReconnectAttempt = microtime(true);
         }
     }
+
+    public function clear(): void
+    {
+        $this->fallbackStore->clear();
+        $this->checkConnection();
+        if ($this->isDown) return;
+        try {
+            $this->collection->deleteMany([]);
+        } catch (\Throwable $e) {
+            $this->isDown = true;
+        }
+    }
 }

package/src/php/Store/RedisStore.php

@@ -131,4 +131,16 @@ class RedisStore implements IStore
             $this->lastReconnectAttempt = microtime(true);
         }
     }
+
+    public function clear(): void
+    {
+        $this->fallbackStore->clear();
+        $this->checkConnection();
+        if ($this->isDown) return;
+        try {
+            $this->redis->flushdb();
+        } catch (\Throwable $e) {
+            $this->isDown = true;
+        }
+    }
 }

package/src/php/Tests/ChallengeUtilsTest.php

@@ -8,6 +8,7 @@ use Anonympins\Fingerprint\Challenge\ChallengeUtils;
 use Anonympins\Fingerprint\Store\InMemoryStore;
 use Anonympins\Fingerprint\Store\StoreManager;
 use Anonympins\Fingerprint\Utils\BigInt;
+ use Anonympins\Fingerprint\Utils\Env;
 use PHPUnit\Framework\TestCase;
 
 class ChallengeUtilsTest extends TestCase
@@ -94,7 +95,7 @@ class ChallengeUtilsTest extends TestCase
         // Définir une clé secrète pour les tests
         $store = new InMemoryStore();
         StoreManager::configureStore($store);
-        $_ENV['POW_SECRET'] = 'test-secret-key-that-is-long-enough-for-hmac';
+        Env::set('POW_SECRET', 'test-secret-key-that-is-long-enough-for-hmac');
     }
 
     public function testZkpProofValidation(): void
@@ -219,8 +220,8 @@ class ChallengeUtilsTest extends TestCase
             $this->markTestSkipped('Ed25519 signing is not supported due to PHP 8.0.0 openssl_sign() null algorithm bug.');
         }
 
-        $_ENV['ED25519_PRIVATE_KEY'] = $privateKeyPem;
-        $_ENV['ED25519_PUBLIC_KEY'] = $publicKeyPem;
+        Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+        Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
 
         $ip = '127.0.0.1';
         $expiry = (int)floor(microtime(true) * 1000) + 3600000;
@@ -237,7 +238,8 @@ class ChallengeUtilsTest extends TestCase
         $this->assertTrue(ChallengeUtils::isTicketValid($ip, $ticket, 'device-123', 'hash-abc'));
         $this->assertFalse(ChallengeUtils::isTicketValid('192.168.1.1', $ticket, 'device-123', 'hash-abc'));
 
-        unset($_ENV['ED25519_PRIVATE_KEY'], $_ENV['ED25519_PUBLIC_KEY']);
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
     }
 
     public function testCooperativePoSpaceWorkflow(): void