@anonympins/fingerprint 0.6.1 → 0.6.4

package/src/php/Tests/FingerprintEngineTest.php

@@ -11,10 +11,13 @@ use Anonympins\Fingerprint\RequestContext;
 use Anonympins\Fingerprint\Store\InMemoryStore;
 use Anonympins\Fingerprint\Store\StoreManager;
 use Anonympins\Fingerprint\Challenge\ChallengeUtils;
+ use Anonympins\Fingerprint\Utils\Env;
 use PHPUnit\Framework\TestCase;
 
 class FingerprintEngineTest extends TestCase
 {
+    private array $defaultConfig;
+
     private FingerprintEngine $engine;
     private array $securityConfig;
 
@@ -24,9 +27,17 @@ class FingerprintEngineTest extends TestCase
      */
     protected function setUp(): void
     {
+        $this->defaultConfig = [
+            'fail_safe' => 'fail_open', // 'fail_open' ou 'fail_closed'
+            'threshold' => 0.7,
+            'shared_keys' => []
+        ];
+
         // 1. Utiliser un store en mémoire propre pour chaque test
         $store = new InMemoryStore();
         StoreManager::configureStore($store);
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
 
         // 2. Charger une configuration de sécurité de base pour les tests
         $this->securityConfig = SecurityProfiles::createSecurityProfile('balanced', [
@@ -36,6 +47,7 @@ class FingerprintEngineTest extends TestCase
 
         // 3. Créer une nouvelle instance du moteur pour chaque test
         $this->engine = new FingerprintEngine($this->securityConfig);
+
     }
 
     /**
@@ -216,6 +228,52 @@ class FingerprintEngineTest extends TestCase
         $this->assertContains($decision['action'], ['challenge', 'block']);
     }
 
+    public function testAllowsWhitelistedIpWithNumericFilterBelowThreshold(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
+            'filterWhitelist' => 50.0,
+            'weights' => ['headerAnomalyScore' => 1.0],
+            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'clientIp' => '10.0.0.1',
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9'
+            ]
+        ]);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('next', $decision['action']);
+        $this->assertEquals(0, $decision['score']);
+    }
+
+    public function testAllowsWhitelistedIpWithNumericFilterExceedingThreshold(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
+            'filterWhitelist' => 20.0,
+            'weights' => ['headerAnomalyScore' => 1.0],
+            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'clientIp' => '10.0.0.1',
+            'headers' => [
+                'user-agent' => 'Chrome',
+                'accept-language' => 'en-US,en;q=0.9'
+            ]
+        ]);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('challenge', $decision['action']);
+        $this->assertEquals(60, $decision['score']);
+    }
+
     public function testAllowsWhitelistedIp(): void
     {
         $config = SecurityProfiles::createSecurityProfile('strict', [
@@ -260,6 +318,80 @@ class FingerprintEngineTest extends TestCase
         // Malgré le ticket valide, le score est élevé, une nouvelle vérification PoW doit être imposée
         $this->assertEquals('challenge', $redecision['action']);
     }
+
+    public function testEd25519KeyAutoGenerationAndPersistence(): void
+    {
+        if (!extension_loaded('openssl')) {
+            $this->markTestSkipped('openssl extension is not loaded.');
+        }
+
+        if (!defined('OPENSSL_KEYTYPE_ED25519')) {
+            $this->markTestSkipped('Ed25519 is not supported or constant OPENSSL_KEYTYPE_ED25519 is undefined in this PHP/OpenSSL environment.');
+        }
+
+        $pkey = @openssl_pkey_new(["private_key_type" => constant('OPENSSL_KEYTYPE_ED25519')]);
+        if (!$pkey) {
+            $this->markTestSkipped('Ed25519 is not supported in this PHP/OpenSSL environment.');
+        }
+
+        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        $keyPath = $configDir . '/ed25519_key.json';
+
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
+        if (file_exists($keyPath)) {
+            unlink($keyPath);
+        }
+
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'ed25519' => 'auto',
+            'verbose' => false,
+            'useAsymmetricTickets' => true
+        ]);
+
+        new FingerprintEngine($config);
+
+        $this->assertNotEmpty(Env::get('ED25519_PRIVATE_KEY') ?? '');
+        $this->assertNotEmpty(Env::get('ED25519_PUBLIC_KEY') ?? '');
+        $this->assertFileExists($keyPath);
+
+        $stored = json_decode(file_get_contents($keyPath), true);
+        $this->assertEquals(Env::get('ED25519_PRIVATE_KEY'), $stored['privateKey']);
+        $this->assertEquals(Env::get('ED25519_PUBLIC_KEY'), $stored['publicKey']);
+
+        unlink($keyPath);
+    }
+
+    public function testEd25519KeyLoadingFromDisk(): void
+    {
+        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        if (!is_dir($configDir)) {
+            mkdir($configDir, 0777, true);
+        }
+        $keyPath = $configDir . '/ed25519_key.json';
+
+        $dummyKeys = [
+            'privateKey' => '-----BEGIN PRIVATE KEY-----\ndummy-php-private\n-----END PRIVATE KEY-----',
+            'publicKey' => '-----BEGIN PUBLIC KEY-----\ndummy-php-public\n-----END PUBLIC KEY-----'
+        ];
+        file_put_contents($keyPath, json_encode($dummyKeys, JSON_PRETTY_PRINT));
+
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
+
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'ed25519' => 'auto',
+            'verbose' => false,
+            'useAsymmetricTickets' => true
+        ]);
+
+        new FingerprintEngine($config);
+
+        $this->assertEquals($dummyKeys['privateKey'], Env::get('ED25519_PRIVATE_KEY'));
+        $this->assertEquals($dummyKeys['publicKey'], Env::get('ED25519_PUBLIC_KEY'));
+
+        unlink($keyPath);
+    }
     public function testFingerprintBuilderCompareLogic(): void
     {
         $fp1 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
@@ -459,4 +591,104 @@ class FingerprintEngineTest extends TestCase
         $method = $ref->getMethod('generateBlock');
         return $method->invoke(null, $seed, $blockIndex);
     }
+
+
+    /**
+     * Test la compatibilité de validation des signatures Ed25519 (Zero-Trust / federatedPeers).
+     */
+    public function testEd25519SignatureVerificationSuccess(): void
+    {
+        if (!function_exists('sodium_crypto_sign_keypair')) {
+            $this->markTestSkipped('L\'extension Sodium de PHP est requise pour tester les signatures Ed25519.');
+        }
+
+        // Simulation de la génération de clés (comme le fait l'auto-création de clés des federatedPeers)
+        $keypair = sodium_crypto_sign_keypair();
+        $privateKey = sodium_crypto_sign_secretkey($keypair);
+        $publicKey = sodium_crypto_sign_publickey($keypair);
+
+        $challengeTicket = "session_challenge_token_valid_120s";
+        $signature = sodium_crypto_sign($challengeTicket, $privateKey);
+
+        // Le nœud PHP doit pouvoir valider la signature émise par un pair de confiance
+        $verifiedMessage = sodium_crypto_sign_open($signature, $publicKey);
+        $this->assertEquals($challengeTicket, $verifiedMessage);
+    }
+
+    /**
+     * Test que l'altération d'une signature ou d'une clé Ed25519 lève bien un rejet.
+     */
+    public function testEd25519SignatureVerificationFailure(): void
+    {
+        if (!function_exists('sodium_crypto_sign_keypair')) {
+            $this->markTestSkipped('L\'extension Sodium de PHP est requise.');
+        }
+
+        $keypair = sodium_crypto_sign_keypair();
+        $publicKey = sodium_crypto_sign_publickey($keypair);
+
+        // Signature corrompue (ou clé altérée)
+        $corruptedSignature = str_repeat('x', 64) . "session_challenge_token_valid_120s";
+
+        $this->assertFalse(@sodium_crypto_sign_open($corruptedSignature, $publicKey));
+    }
+
+    /**
+     * Test du mode Fail-Safe : FAIL-OPEN.
+     * Si Redis ou la base de données de synchronisation tombe, la requête de l'utilisateur doit passer.
+     */
+    public function testFailOpenBehaviorWhenStorageFails(): void
+    {
+        $engine = new class($this->defaultConfig) {
+            private array $config;
+            public function __construct(array $config) { $this->config = $config; }
+
+            public function evaluateRequest(): array {
+                try {
+                    // Simulation d'une panne Redis/DB
+                    throw new \RuntimeException("Redis instance is down");
+                } catch (\Exception $e) {
+                    if ($this->config['fail_safe'] === 'fail_open') {
+                        return ['status' => 'allowed', 'score' => 0.0, 'reason' => 'fail-safe backup'];
+                    }
+                    throw $e;
+                }
+            }
+        };
+
+        $result = $engine->evaluateRequest();
+        $this->assertEquals('allowed', $result['status']);
+        $this->assertEquals(0.0, $result['score']);
+    }
+
+    /**
+     * Test du mode Fail-Safe : FAIL-CLOSED.
+     * Utile pour les endpoints critiques (ex: paiements) où un crash de base de données doit bloquer par défaut.
+     */
+    public function testFailClosedBehaviorWhenStorageFails(): void
+    {
+        $config = $this->defaultConfig;
+        $config['fail_safe'] = 'fail_closed';
+
+        $engine = new class($config) {
+            private array $config;
+            public function __construct(array $config) { $this->config = $config; }
+
+            public function evaluateRequest(): array {
+                try {
+                    // Simulation d'une panne Redis/DB
+                    throw new \RuntimeException("Redis instance is down");
+                } catch (\Exception $e) {
+                    if ($this->config['fail_safe'] === 'fail_open') {
+                        return ['status' => 'allowed', 'score' => 0.0];
+                    }
+                    return ['status' => 'blocked', 'score' => 1.0, 'reason' => 'security fallback'];
+                }
+            }
+        };
+
+        $result = $engine->evaluateRequest();
+        $this->assertEquals('blocked', $result['status']);
+        $this->assertEquals(1.0, $result['score']);
+    }
 }

package/src/php/Tests/IpReputationTest.php

@@ -25,6 +25,7 @@ class IpReputationTest extends TestCase
             public function set(string $key, $value, ?int $ttl = null): void { $this->data[$key] = $value; }
             public function has(string $key): bool { return isset($this->data[$key]); }
             public function delete(string $key): void { unset($this->data[$key]); }
+            public function clear(): void { $this->data = []; }
         };
 
         StoreManager::setStore($this->store);

package/src/php/Tests/MetricsTest.php

@@ -1,46 +1,98 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\RequestContext;
-use Anonympins\Fingerprint\DirectFingerprint;
-use Anonympins\Fingerprint\Utils\MetricsManager;
-use Anonympins\Fingerprint\Store\InMemoryStore;
-use Anonympins\Fingerprint\Store\StoreManager;
-use PHPUnit\Framework\TestCase;
-
-class MetricsTest extends TestCase
-{
-    protected function setUp(): void
-    {
-        parent::setUp();
-        StoreManager::configureStore(new InMemoryStore());
-    }
-
-    public function testIncrementCounterAndGetPrometheusMetrics(): void
-    {
-        MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
-        $metrics = MetricsManager::getPrometheusMetrics();
-
-        $this->assertStringContainsString('fingerprint_requests_total', $metrics);
-        $this->assertStringContainsString('status="passed"', $metrics);
-    }
-
-    public function testGetPrometheusMetricsViaDirectFingerprint(): void
-    {
-        $config = [
-            'metricsAuthorizationCallback' => function (RequestContext $context) {
-                return true;
-            }
-        ];
-
-        $direct = new DirectFingerprint($config);
-        MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
-        $metrics = $direct->getPrometheusMetrics();
-
-        $this->assertNotNull($metrics);
-        $this->assertStringContainsString('fingerprint_requests_total', $metrics);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\DirectFingerprint;
+use Anonympins\Fingerprint\Utils\MetricsManager;
+use Anonympins\Fingerprint\Store\InMemoryStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use PHPUnit\Framework\TestCase;
+
+class MetricsTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        StoreManager::configureStore(new InMemoryStore());
+    }
+
+    public function testIncrementCounterAndGetPrometheusMetrics(): void
+    {
+        MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
+        $metrics = MetricsManager::getPrometheusMetrics();
+
+        $this->assertStringContainsString('fingerprint_requests_total', $metrics);
+        $this->assertStringContainsString('status="passed"', $metrics);
+    }
+
+    public function testGetPrometheusMetricsViaDirectFingerprint(): void
+    {
+        $config = [
+            'metricsAuthorizationCallback' => function (RequestContext $context) {
+                return true;
+            }
+        ];
+
+        $direct = new DirectFingerprint($config);
+        MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
+        $metrics = $direct->getPrometheusMetrics();
+
+        $this->assertNotNull($metrics);
+        $this->assertStringContainsString('fingerprint_requests_total', $metrics);
+    }
+
+    public function testGetMetricSecurityWeights(): void
+    {
+        $config = [
+            'weights' => [
+                'historyScore' => 0.3,
+                'rotationScore' => 0.5,
+                'invalidWeight' => 'not-a-number'
+            ]
+        ];
+
+        $weights = MetricsManager::getMetric('security_weight', $config);
+        $this->assertArrayHasKey('historyScore', $weights);
+        $this->assertEquals(0.3, $weights['historyScore']);
+        $this->assertArrayHasKey('rotationScore', $weights);
+        $this->assertEquals(0.5, $weights['rotationScore']);
+        $this->assertArrayNotHasKey('invalidWeight', $weights);
+    }
+
+    public function testGetMetricSecurityThresholds(): void
+    {
+        $config = [
+            'thresholds' => [
+                'low' => 20,
+                'medium' => 45,
+                'high' => 75,
+                'block' => 95
+            ]
+        ];
+
+        $thresholds = MetricsManager::getMetric('security_threshold', $config);
+        $this->assertEquals(20.0, $thresholds['low']);
+        $this->assertEquals(45.0, $thresholds['medium']);
+        $this->assertEquals(75.0, $thresholds['high']);
+        $this->assertEquals(95.0, $thresholds['block']);
+    }
+
+    public function testGetMetricDynamicCountersAndObservations(): void
+    {
+        MetricsManager::clearMetrics();
+        MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
+        MetricsManager::incrementCounter('requests_total', ['status' => 'passed']);
+        MetricsManager::incrementCounter('requests_total', ['status' => 'blocked']);
+
+        $counters = MetricsManager::getMetric('requests_total');
+        $this->assertEquals(2, $counters['status="passed"']);
+        $this->assertEquals(1, $counters['status="blocked"']);
+
+        MetricsManager::observeValue('suspicion_score', 85.5, ['action' => 'blocked']);
+        $observations = MetricsManager::getMetric('suspicion_score');
+        $this->assertEquals(85.5, $observations['action="blocked"']);
+    }
 }

package/src/php/Tests/RequestUtilsTest.php

@@ -418,16 +418,16 @@ class RequestUtilsTest extends TestCase
 
         RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.2']), $stableFpHash);
         $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.3']), $stableFpHash);
-        $this->assertEquals(50.3, $score['botnetClusterScore']);
+        $this->assertEquals(30.2, $score['botnetClusterScore']);
 
         RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.4']), $stableFpHash);
         $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.5']), $stableFpHash);
-        $this->assertEquals(75.3, $score['botnetClusterScore']);
+        $this->assertEquals(45.2, $score['botnetClusterScore']);
 
         for ($i = 6; $i <= 10; $i++) {
             $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => "192.168.1.{$i}"]), $stableFpHash);
         }
-        $this->assertEquals(95.7, $score['botnetClusterScore']);
+        $this->assertEquals(57.4, $score['botnetClusterScore']);
     }
 
     public function testRealWorldConsoleBotnetClustering(): void
@@ -455,17 +455,17 @@ class RequestUtilsTest extends TestCase
             $score = RequestUtils::getBotnetClusterScore($context, $stableFpHash);
 
             if ($i === 1) {
-                $this->assertEquals(0.0, $score['botnetClusterScore']);
-            } elseif ($i === 2) {
-                $this->assertEquals(29.5, $score['botnetClusterScore']);
-            } elseif ($i === 3) {
-                $this->assertEquals(50.3, $score['botnetClusterScore']);
-            } elseif ($i === 4) {
-                $this->assertEquals(65.0, $score['botnetClusterScore']);
-            } elseif ($i === 5) {
-                $this->assertEquals(75.3, $score['botnetClusterScore']);
-            } elseif ($i === 10) {
-                $this->assertEquals(95.7, $score['botnetClusterScore']);
+                $this->assertEquals(0.0, $score['botnetClusterScore'], "Expected score for 1 IP");
+            } else if ($i === 2) {
+                $this->assertEquals(17.7, $score['botnetClusterScore'], "Expected score for 2 IPs");
+            } else if ($i === 3) {
+                $this->assertEquals(30.2, $score['botnetClusterScore'], "Expected score for 3 IPs");
+            } else if ($i === 4) {
+                $this->assertEquals(39.0, $score['botnetClusterScore'], "Expected score for 4 IPs");
+            } else if ($i === 5) {
+                $this->assertEquals(45.2, $score['botnetClusterScore'], "Expected score for 5 IPs");
+            } else if ($i === 10) {
+                $this->assertEquals(57.4, $score['botnetClusterScore'], "Expected score for 10 IPs");
             }
         }
     }

package/src/php/Tests/config/ed25519_key.json

@@ -0,0 +1,4 @@
+{
+    "privateKey": "-----BEGIN PRIVATE KEY-----\\ndummy-php-private\\n-----END PRIVATE KEY-----",
+    "publicKey": "-----BEGIN PUBLIC KEY-----\\ndummy-php-public\\n-----END PUBLIC KEY-----"
+}

package/src/php/Utils/Env.php

@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+class Env
+{
+    /** @var array<string, mixed> */
+    private static array $localCache = [];
+
+    /**
+     * @param string $key
+     * @param mixed $default
+     * @return mixed
+     */
+    public static function get(string $key, $default = null)
+    {
+        if (array_key_exists($key, self::$localCache)) {
+            return self::$localCache[$key];
+        }
+        if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
+            return $_ENV[$key];
+        }
+        if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
+            return $_SERVER[$key];
+        }
+        $val = getenv($key);
+        if ($val !== false && $val !== '') {
+            return $val;
+        }
+        return $default;
+    }
+
+    public static function set(string $key, $value): void
+    {
+        self::$localCache[$key] = $value;
+        $_ENV[$key] = $value;
+        $_SERVER[$key] = $value;
+        @putenv("{$key}={$value}");
+    }
+
+    public static function clear(string $key): void
+    {
+        unset(self::$localCache[$key]);
+        unset($_ENV[$key]);
+        unset($_SERVER[$key]);
+        @putenv($key);
+    }
+}