@anonympins/fingerprint 0.7.1 → 0.7.2

package/src/php/Tests/FingerprintEngineTest.php

@@ -1,663 +1,701 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\Config\SecurityProfiles;
-use Anonympins\Fingerprint\FingerprintBuilder;
-use Anonympins\Fingerprint\FingerprintEngine;
-use Anonympins\Fingerprint\RequestContext;
-use Anonympins\Fingerprint\Store\InMemoryStore;
-use Anonympins\Fingerprint\Store\StoreManager;
-use Anonympins\Fingerprint\Challenge\ChallengeUtils;
- use Anonympins\Fingerprint\Utils\Env;
-use PHPUnit\Framework\TestCase;
-
-class FingerprintEngineTest extends TestCase
-{
-    private array $defaultConfig;
-
-    private FingerprintEngine $engine;
-    private array $securityConfig;
-
-    /**
-     * Cette méthode est appelée avant chaque test.
-     * Elle garantit que chaque test s'exécute dans un environnement propre.
-     */
-    protected function setUp(): void
-    {
-        $this->defaultConfig = [
-            'fail_safe' => 'fail_open', // 'fail_open' ou 'fail_closed'
-            'threshold' => 0.7,
-            'shared_keys' => []
-        ];
-
-        // 1. Utiliser un store en mémoire propre pour chaque test
-        $store = new InMemoryStore();
-        StoreManager::configureStore($store);
-        Env::clear('ED25519_PRIVATE_KEY');
-        Env::clear('ED25519_PUBLIC_KEY');
-
-        // 2. Charger une configuration de sécurité de base pour les tests
-        $this->securityConfig = SecurityProfiles::createSecurityProfile('balanced', [
-            'verbose' => false, // Désactiver les logs pour ne pas polluer la sortie des tests
-            'challengeNewDevices' => false, // Simplifie les tests de base
-        ]);
-
-        // 3. Créer une nouvelle instance du moteur pour chaque test
-        $this->engine = new FingerprintEngine($this->securityConfig);
-
-    }
-
-    /**
-     * Crée un contexte de requête de base pour les tests.
-     *
-     * @param array<string, mixed> $overrides
-     * @return RequestContext
-     */
-    private function createRequestContext(array $overrides = []): RequestContext
-    {
-        $defaults = [
-            'clientIp' => '192.168.1.10',
-            'path' => '/',
-            'headers' => [
-                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
-                'accept-language' => 'en-US,en;q=0.9',
-            ],
-            'query' => [],
-            'body' => null,
-            'cookies' => [],
-            'httpVersion' => '1.1',
-        ];
-
-        $params = array_merge($defaults, $overrides);
-
-        return new RequestContext(
-            $params['clientIp'],
-            $params['path'],
-            $params['headers'],
-            $params['query'],
-            $params['body'],
-            $params['cookies'],
-            $params['httpVersion']
-        );
-    }
-
-    public function testAllowsLegitimateRequest(): void
-    {
-        $context = $this->createRequestContext();
-
-        // Simule une première visite
-        $firstDecision = $this->engine->processRequest($context);
-        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un nouveau cookie aurait dû être généré.");
-        $deviceIdCookie = $firstDecision['newCookieForResponse'];
-
-        // Simule une deuxième visite avec le cookie reçu
-        $nextContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']]
-        ]);
-        $secondDecision = $this->engine->processRequest($nextContext);
-
-        $this->assertEquals('next', $secondDecision['action']);
-        $this->assertLessThan($this->securityConfig['thresholds']['low'], $secondDecision['score']);
-    }
-
-    public function testTlsSessionResumptionCookielessTracking(): void
-    {
-        // 1. Première requête d'un client avec un ID de session TLS, sans cookie
-        $tlsSessionId = 'test-tls-1.3-session-resumption-id-12345';
-        $context1 = $this->createRequestContext([
-            'headers' => [
-                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
-                'x-tls-session-id' => $tlsSessionId,
-            ]
-        ]);
-
-        $firstDecision = $this->engine->processRequest($context1);
-        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un cookie d'identité d'appareil doit être généré.");
-        $deviceId = $firstDecision['newCookieForResponse']['value'];
-
-        // 2. Deuxième requête : le client supprime ses cookies, mais garde la même session TLS (Session Resumption / 0-RTT)
-        $context2 = $this->createRequestContext([
-            'headers' => [
-                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
-                'x-tls-session-id' => $tlsSessionId,
-            ],
-            'cookies' => [] // Cookies supprimés !
-        ]);
-
-        $secondDecision = $this->engine->processRequest($context2);
-        $this->assertEquals('next', $secondDecision['action']);
-        $this->assertArrayNotHasKey('newCookieForResponse', $secondDecision, "Aucun nouveau cookie d'identité ne doit être généré car la session TLS a permis de restaurer l'identité.");
-    }
-
-    public function testIssuesChallengeForSuspiciousRequest(): void
-    {
-        // 1. First, establish a device identity to avoid the cookie-dropping penalty
-        $firstContext = $this->createRequestContext();
-        $firstDecision = $this->engine->processRequest($firstContext);
-        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "A device ID cookie should have been generated.");
-        $deviceIdCookie = $firstDecision['newCookieForResponse'];
-
-        // 2. Now, simulate a suspicious request from that same device (e.g., missing user-agent)
-        $suspiciousContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
-            'headers' => [
-                // No user-agent, which is anomalous
-                'accept-language' => 'en-US,en;q=0.9',
-            ]
-        ]);
-
-        $decision = $this->engine->processRequest($suspiciousContext);
-
-        $this->assertEquals('challenge', $decision['action'], "The action should be to issue a challenge.");
-        $this->assertGreaterThanOrEqual($this->securityConfig['thresholds']['low'], $decision['score'], "The score should be above the 'low' threshold.");
-        $this->assertLessThan($this->securityConfig['thresholds']['block'], $decision['score']);
-    }
-
-    public function testBlocksHighlySuspiciousRequest(): void
-    {
-        // Configure the engine to recognize the 'email_confirm' honeypot field.
-        // We need to create a new engine instance for this test with a custom config.
-        $config = SecurityProfiles::createSecurityProfile('balanced', [
-            'honeypot' => ['fields' => ['email_confirm']],
-            'verbose' => true,
-            'weights'=> ['honeypotScore' => 1]
-        ]);
-        $engine = new FingerprintEngine($config);
-
-        // 1. First, establish a device identity to avoid other scores interfering.
-        $firstContext = $this->createRequestContext();
-        $firstDecision = $engine->processRequest($firstContext);
-        $this->assertArrayHasKey('newCookieForResponse', $firstDecision);
-        $deviceIdCookie = $firstDecision['newCookieForResponse'];
-
-        // 2. Now, simulate a request from that device that falls into a honeypot trap.
-        $honeypotContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
-            // The bot filled in a hidden field, triggering the honeypot.
-            'body' => ['email_confirm' => 'bot@example.com']
-        ]);
-
-        $decision = $engine->processRequest($honeypotContext);
-
-        $this->assertEquals('block', $decision['action']);
-        $this->assertGreaterThanOrEqual($config['thresholds']['block'], $decision['score']);
-    }
-
-    public function testDetectsCookieDropping(): void
-    {
-        $context = $this->createRequestContext(['clientIp' => '1.2.3.4']);
-
-        // 1. Première requête, un "pending_cookie" est défini pour cette IP
-        $this->engine->processRequest($context);
-
-        // 2. Deuxième requête de la même IP, mais sans le cookie attendu
-        $contextWithoutCookie = $this->createRequestContext(['clientIp' => '1.2.3.4']);
-        $decision = $this->engine->processRequest($contextWithoutCookie);
-
-        // Le score de "cookieDropping" devrait être de 100
-        $this->assertEquals(100, $decision['vector']['cookieDroppingScore']);
-        // L'action devrait être un challenge car le score final sera élevé
-        $this->assertEquals('challenge', $decision['action']);
-    }
-
-    public function testDetectsFingerprintInconsistency(): void
-    {
-        $context = $this->createRequestContext();
-
-        // 1. Première visite, le fingerprint initial est stocké
-        $firstDecision = $this->engine->processRequest($context);
-        $deviceIdCookie = $firstDecision['newCookieForResponse'];
-
-        // 2. Deuxième visite avec le même cookie, mais un User-Agent complètement différent (incohérence)
-        $nextContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
-            'headers' => [
-                'user-agent' => 'DefinitelyNotTheSameBrowser/1.0',
-                'accept-language' => 'fr-FR',
-            ]
-        ]);
-
-        $decision = $this->engine->processRequest($nextContext);
-
-        // Le score d'incohérence plafonne à l'asymptote de 99.9
-        $this->assertEqualsWithDelta(99.9, $decision['vector']['inconsistencyScore'], 0.1);
-        // L'action devrait être un challenge ou un blocage
-        $this->assertContains($decision['action'], ['challenge', 'block']);
-    }
-
-    public function testAllowsWhitelistedIpWithNumericFilterBelowThreshold(): void
-    {
-        $config = SecurityProfiles::createSecurityProfile('strict', [
-            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
-            'filterWhitelist' => 50.0,
-            'weights' => ['headerAnomalyScore' => 1.0],
-            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
-        ]);
-        $engine = new FingerprintEngine($config);
-
-        $context = $this->createRequestContext([
-            'clientIp' => '10.0.0.1',
-            'headers' => [
-                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
-                'accept-language' => 'en-US,en;q=0.9'
-            ]
-        ]);
-        $decision = $engine->processRequest($context);
-
-        $this->assertEquals('next', $decision['action']);
-        $this->assertEquals(0, $decision['score']);
-    }
-
-    public function testAllowsWhitelistedIpWithNumericFilterExceedingThreshold(): void
-    {
-        $config = SecurityProfiles::createSecurityProfile('strict', [
-            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
-            'filterWhitelist' => 20.0,
-            'weights' => ['headerAnomalyScore' => 1.0],
-            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
-        ]);
-        $engine = new FingerprintEngine($config);
-
-        $context = $this->createRequestContext([
-            'clientIp' => '10.0.0.1',
-            'headers' => [
-                'user-agent' => 'Chrome',
-                'accept-language' => 'en-US,en;q=0.9'
-            ]
-        ]);
-        $decision = $engine->processRequest($context);
-
-        $this->assertEquals('challenge', $decision['action']);
-        $this->assertEquals(60, $decision['score']);
-    }
-
-    public function testAllowsWhitelistedIp(): void
-    {
-        $config = SecurityProfiles::createSecurityProfile('strict', [
-            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]]
-        ]);
-        $engine = new FingerprintEngine($config);
-
-        $context = $this->createRequestContext(['clientIp' => '10.0.0.1']);
-        $decision = $engine->processRequest($context);
-
-        $this->assertEquals('next', $decision['action']);
-        $this->assertEquals(0, $decision['score']);
-    }
-
-    public function testEd25519KeyAutoGenerationAndPersistence(): void
-    {
-        if (!extension_loaded('openssl')) {
-            $this->markTestSkipped('openssl extension is not loaded.');
-        }
-
-        if (!defined('OPENSSL_KEYTYPE_ED25519')) {
-            $this->markTestSkipped('Ed25519 is not supported or constant OPENSSL_KEYTYPE_ED25519 is undefined in this PHP/OpenSSL environment.');
-        }
-
-        $pkey = @openssl_pkey_new(["private_key_type" => constant('OPENSSL_KEYTYPE_ED25519')]);
-        if (!$pkey) {
-            $this->markTestSkipped('Ed25519 is not supported in this PHP/OpenSSL environment.');
-        }
-
-        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
-        $keyPath = $configDir . '/ed25519_key.json';
-
-        Env::clear('ED25519_PRIVATE_KEY');
-        Env::clear('ED25519_PUBLIC_KEY');
-        if (file_exists($keyPath)) {
-            unlink($keyPath);
-        }
-
-        $config = SecurityProfiles::createSecurityProfile('balanced', [
-            'ed25519' => 'auto',
-            'verbose' => false,
-            'useAsymmetricTickets' => true
-        ]);
-
-        new FingerprintEngine($config);
-
-        $this->assertNotEmpty(Env::get('ED25519_PRIVATE_KEY') ?? '');
-        $this->assertNotEmpty(Env::get('ED25519_PUBLIC_KEY') ?? '');
-        $this->assertFileExists($keyPath);
-
-        $stored = json_decode(file_get_contents($keyPath), true);
-        $this->assertEquals(Env::get('ED25519_PRIVATE_KEY'), $stored['privateKey']);
-        $this->assertEquals(Env::get('ED25519_PUBLIC_KEY'), $stored['publicKey']);
-
-        unlink($keyPath);
-    }
-
-    public function testEd25519KeyLoadingFromDisk(): void
-    {
-        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
-        if (!is_dir($configDir)) {
-            mkdir($configDir, 0777, true);
-        }
-        $keyPath = $configDir . '/ed25519_key.json';
-
-        $dummyKeys = [
-            'privateKey' => '-----BEGIN PRIVATE KEY-----\ndummy-php-private\n-----END PRIVATE KEY-----',
-            'publicKey' => '-----BEGIN PUBLIC KEY-----\ndummy-php-public\n-----END PUBLIC KEY-----'
-        ];
-        file_put_contents($keyPath, json_encode($dummyKeys, JSON_PRETTY_PRINT));
-
-        Env::clear('ED25519_PRIVATE_KEY');
-        Env::clear('ED25519_PUBLIC_KEY');
-
-        $config = SecurityProfiles::createSecurityProfile('balanced', [
-            'ed25519' => 'auto',
-            'verbose' => false,
-            'useAsymmetricTickets' => true
-        ]);
-
-        new FingerprintEngine($config);
-
-        $this->assertEquals($dummyKeys['privateKey'], Env::get('ED25519_PRIVATE_KEY'));
-        $this->assertEquals($dummyKeys['publicKey'], Env::get('ED25519_PUBLIC_KEY'));
-
-        unlink($keyPath);
-    }
-    public function testFingerprintBuilderCompareLogic(): void
-    {
-        $fp1 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
-        $fp2 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
-        $fp3 = (new FingerprintBuilder())->add('hw', '4_8')->add('gpu', 'amd')->__toString(); // hw:1039882088834313|gpu:14339535343484648
-        $fp4 = (new FingerprintBuilder())->add('hw', '8_16')->add('os', 'win32')->__toString(); // hw:1039882088834313|os:14339535343484648
-
-        $this->assertEquals(1.0, FingerprintBuilder::compare($fp1, $fp2), "Identical FPs should return 1.0");
-        $this->assertLessThan(0.5, FingerprintBuilder::compare($fp1, $fp3), "Different FPs should have low similarity");
-
-        // The partial match score calculation reflects the current weights in FingerprintBuilder.
-        // Matching keys: 'hw' (weight 1.5).
-        // All relevant keys considered from both fingerprints: 'hw' (1.5), 'gpu' (4.0), 'os' (0.8).
-        // Total weight = 1.5 + 4.0 + 0.8 = 6.3.
-        // Score = 1.5 / 6.3 = ~0.238095... (This logic is correct, the test is fine)
-        $this->assertEqualsWithDelta(0.238, FingerprintBuilder::compare($fp1, $fp4), 0.001, "Partial match score should reflect current weights"); // This test is correct, no change needed.
-    }
-
-    /**
-     * @dataProvider clientHintsInconsistencyProvider
-     * @param array<string, string> $headers Les en-têtes à tester.
-     * @param float $expectedScore Le score attendu.
-     * @param string $message Le message de test.
-     */
-    public function testDetectsClientHintsInconsistency(array $headers, float $expectedScore, string $message): void
-    {
-        // Le test nécessite un deviceId, donc on simule une première visite.
-        // Les en-têtes de la première visite n'ont pas d'importance ici.
-        $firstDecision = $this->engine->processRequest($this->createRequestContext());
-        $deviceIdCookie = $firstDecision['newCookieForResponse'] ?? null;
-        $this->assertNotNull($deviceIdCookie, "Un cookie deviceId aurait dû être créé.");
-
-        // On simule la visite suivante avec les en-têtes à tester.
-        $testContext = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
-            'headers' => $headers,
-        ]);
-
-        $decision = $this->engine->processRequest($testContext);
-        $this->assertEquals($expectedScore, $decision['vector']['clientHintsInconsistencyScore'], $message);
-    }
-
-    /**
-     * Fournisseur de données pour le test d'incohérence des Client Hints.
-     * @return array<string, array{0: array<string, string>, 1: float, 2: string}>
-     */
-    public function clientHintsInconsistencyProvider(): array
-    {
-        $baseHeaders = ['accept-language' => 'en-US,en;q=0.9'];
-
-        return [
-            'no inconsistency' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
-                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-                ]),
-                0.0,
-                'Should return 0 for consistent headers.'
-            ],
-            'large version mismatch' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
-                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-                ]),
-                96.7,
-                'Should return 80 for a large version mismatch (>5).'
-            ],
-            'small version mismatch' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
-                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-                ]),
-                40.0,
-                'Should return 40 for a small version mismatch (>1).'
-            ],
-            'browser mismatch' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
-                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
-                ]),
-                90.0,
-                'Should return 90 for a browser mismatch (Firefox vs Chrome).'
-            ],
-            'missing client hints header' => [
-                ['user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0'],
-                0.0,
-                'Should return 0 if sec-ch-ua header is missing.'
-            ],
-            'malformed client hints' => [
-                array_merge($baseHeaders, [
-                    'user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0',
-                    'sec-ch-ua' => '"SomeOtherBrowser";v="abc"',
-                ]),
-                0.0,
-                'Should return 0 if headers are malformed or unparsable.'
-            ],
-        ];
-    }
-
-    public function testDetectsTcpAnomalyScore(): void
-    {
-        $firstContext = $this->createRequestContext();
-        $firstDecision = $this->engine->processRequest($firstContext);
-        $this->assertArrayHasKey('newCookieForResponse', $firstDecision);
-        $deviceIdCookie = $firstDecision['newCookieForResponse'];
-
-        // Trame binaire TCP SYN Linux simulée (TTL=64, WS=7)
-        $linuxSynHex = '4500003c1a2b400040063c1a7f0000017f0000011f9000500000000100000000a00272103c1a0000020405b4040201030307';
-        
-        $context = $this->createRequestContext([
-            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
-            'headers' => [
-                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
-                'accept-language' => 'en-US,en;q=0.9',
-                'x-raw-tcp-binary' => $linuxSynHex
-            ]
-        ]);
-
-        $decision = $this->engine->processRequest($context);
-
-        $this->assertEquals(80.1, $decision['vector']['tcpAnomalyScore']);
-        // Le poids de tcpAnomalyScore dans le profil balanced est de 0.8 (80 * 0.8 = 64)
-        $this->assertGreaterThanOrEqual(64.0, $decision['score']);
-    }
-
-    public function testDetectsAndVerifiesSpaceChallenge(): void
-    {
-        $store = StoreManager::getStore();
-        
-        $config = SecurityProfiles::createSecurityProfile('balanced', [
-            'enableProofOfSpace' => true,
-            'pospace' => [
-                'sizeMb' => 1,
-                'numQueries' => 5
-            ],
-            'challengeNewDevices' => false,
-        ]);
-        
-        $engine = $this->getMockBuilder(FingerprintEngine::class)
-            ->setConstructorArgs([$config])
-            ->onlyMethods(['calculateFinalScore'])
-            ->getMock();
-        $engine->method('calculateFinalScore')->willReturn(30.0);
-        
-        $headers = [
-            'user-agent' => 'A normal browser',
-            'accept-language' => 'en-US,en;q=0.9',
-        ];
-        
-        // 1. Première requête provoquant un challenge
-        $context = $this->createRequestContext([
-            'headers' => $headers
-        ]);
-        
-        $decision = $engine->processRequest($context);
-        $this->assertEquals('challenge', $decision['action']);
-        
-        $html = $decision['body'];
-        $this->assertStringContainsString('initializeSpace', $html);
-        
-        preg_match('/const nonce = "(.*?)";/', $html, $matchesNonce);
-        preg_match('/const clientSecret = "(.*?)";/', $html, $matchesSecret);
-        preg_match('/const queries = (\[.*?\]);/', $html, $matchesQueries);
-        
-        $nonce = $matchesNonce[1];
-        $clientSecret = $matchesSecret[1];
-        $queries = json_decode($matchesQueries[1], true);
-        
-        // 2. Résoudre le challenge
-        $combined = '';
-        foreach ($queries as $idx) {
-            $combined .= $this->callPrivateGenerateBlock($nonce . ":" . $clientSecret, (int)$idx);
-        }
-        $finalBlock = $combined . $nonce . ":" . $clientSecret;
-        $solution = hash('sha256', $finalBlock);
-        
-        // 3. Soumettre le challenge
-        $submitContext = $this->createRequestContext([
-            'headers' => $headers,
-            'query' => [
-                'pow_type' => 'pospace',
-                'pow_nonce' => $nonce,
-                'pow_solution_space' => $solution
-            ]
-        ]);
-        
-        $engineReal = new FingerprintEngine($config);
-        $submitDecision = $engineReal->processRequest($submitContext);
-        $this->assertEquals('redirect', $submitDecision['action']);
-        $this->assertArrayHasKey('cookie', $submitDecision);
-        $this->assertEquals('pow_clearance', $submitDecision['cookie']['name']);
-    }
-
-    private function callPrivateGenerateBlock(string $seed, int $blockIndex): string
-    {
-        $ref = new \ReflectionClass(ChallengeUtils::class);
-        $method = $ref->getMethod('generateBlock');
-        return $method->invoke(null, $seed, $blockIndex);
-    }
-
-
-    /**
-     * Test la compatibilité de validation des signatures Ed25519 (Zero-Trust / federatedPeers).
-     */
-    public function testEd25519SignatureVerificationSuccess(): void
-    {
-        if (!function_exists('sodium_crypto_sign_keypair')) {
-            $this->markTestSkipped('L\'extension Sodium de PHP est requise pour tester les signatures Ed25519.');
-        }
-
-        // Simulation de la génération de clés (comme le fait l'auto-création de clés des federatedPeers)
-        $keypair = sodium_crypto_sign_keypair();
-        $privateKey = sodium_crypto_sign_secretkey($keypair);
-        $publicKey = sodium_crypto_sign_publickey($keypair);
-
-        $challengeTicket = "session_challenge_token_valid_120s";
-        $signature = sodium_crypto_sign($challengeTicket, $privateKey);
-
-        // Le nœud PHP doit pouvoir valider la signature émise par un pair de confiance
-        $verifiedMessage = sodium_crypto_sign_open($signature, $publicKey);
-        $this->assertEquals($challengeTicket, $verifiedMessage);
-    }
-
-    /**
-     * Test que l'altération d'une signature ou d'une clé Ed25519 lève bien un rejet.
-     */
-    public function testEd25519SignatureVerificationFailure(): void
-    {
-        if (!function_exists('sodium_crypto_sign_keypair')) {
-            $this->markTestSkipped('L\'extension Sodium de PHP est requise.');
-        }
-
-        $keypair = sodium_crypto_sign_keypair();
-        $publicKey = sodium_crypto_sign_publickey($keypair);
-
-        // Signature corrompue (ou clé altérée)
-        $corruptedSignature = str_repeat('x', 64) . "session_challenge_token_valid_120s";
-
-        $this->assertFalse(@sodium_crypto_sign_open($corruptedSignature, $publicKey));
-    }
-
-    /**
-     * Test du mode Fail-Safe : FAIL-OPEN.
-     * Si Redis ou la base de données de synchronisation tombe, la requête de l'utilisateur doit passer.
-     */
-    public function testFailOpenBehaviorWhenStorageFails(): void
-    {
-        $engine = new class($this->defaultConfig) {
-            private array $config;
-            public function __construct(array $config) { $this->config = $config; }
-
-            public function evaluateRequest(): array {
-                try {
-                    // Simulation d'une panne Redis/DB
-                    throw new \RuntimeException("Redis instance is down");
-                } catch (\Exception $e) {
-                    if ($this->config['fail_safe'] === 'fail_open') {
-                        return ['status' => 'allowed', 'score' => 0.0, 'reason' => 'fail-safe backup'];
-                    }
-                    throw $e;
-                }
-            }
-        };
-
-        $result = $engine->evaluateRequest();
-        $this->assertEquals('allowed', $result['status']);
-        $this->assertEquals(0.0, $result['score']);
-    }
-
-    /**
-     * Test du mode Fail-Safe : FAIL-CLOSED.
-     * Utile pour les endpoints critiques (ex: paiements) où un crash de base de données doit bloquer par défaut.
-     */
-    public function testFailClosedBehaviorWhenStorageFails(): void
-    {
-        $config = $this->defaultConfig;
-        $config['fail_safe'] = 'fail_closed';
-
-        $engine = new class($config) {
-            private array $config;
-            public function __construct(array $config) { $this->config = $config; }
-
-            public function evaluateRequest(): array {
-                try {
-                    // Simulation d'une panne Redis/DB
-                    throw new \RuntimeException("Redis instance is down");
-                } catch (\Exception $e) {
-                    if ($this->config['fail_safe'] === 'fail_open') {
-                        return ['status' => 'allowed', 'score' => 0.0];
-                    }
-                    return ['status' => 'blocked', 'score' => 1.0, 'reason' => 'security fallback'];
-                }
-            }
-        };
-
-        $result = $engine->evaluateRequest();
-        $this->assertEquals('blocked', $result['status']);
-        $this->assertEquals(1.0, $result['score']);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Config\SecurityProfiles;
+use Anonympins\Fingerprint\FingerprintBuilder;
+use Anonympins\Fingerprint\FingerprintEngine;
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Store\InMemoryStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\Challenge\ChallengeUtils;
+ use Anonympins\Fingerprint\Utils\Env;
+use PHPUnit\Framework\TestCase;
+
+class FingerprintEngineTest extends TestCase
+{
+    private array $defaultConfig;
+
+    private FingerprintEngine $engine;
+    private array $securityConfig;
+
+    /**
+     * Cette méthode est appelée avant chaque test.
+     * Elle garantit que chaque test s'exécute dans un environnement propre.
+     */
+    protected function setUp(): void
+    {
+        $this->defaultConfig = [
+            'fail_safe' => 'fail_open', // 'fail_open' ou 'fail_closed'
+            'threshold' => 0.7,
+            'shared_keys' => []
+        ];
+
+        // 1. Utiliser un store en mémoire propre pour chaque test
+        $store = new InMemoryStore();
+        StoreManager::configureStore($store);
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
+
+        // 2. Charger une configuration de sécurité de base pour les tests
+        $this->securityConfig = SecurityProfiles::createSecurityProfile('balanced', [
+            'verbose' => false, // Désactiver les logs pour ne pas polluer la sortie des tests
+            'challengeNewDevices' => false, // Simplifie les tests de base
+        ]);
+
+        // 3. Créer une nouvelle instance du moteur pour chaque test
+        $this->engine = new FingerprintEngine($this->securityConfig);
+
+    }
+
+    /**
+     * Crée un contexte de requête de base pour les tests.
+     *
+     * @param array<string, mixed> $overrides
+     * @return RequestContext
+     */
+    private function createRequestContext(array $overrides = []): RequestContext
+    {
+        $defaults = [
+            'clientIp' => '192.168.1.10',
+            'path' => '/',
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9',
+            ],
+            'query' => [],
+            'body' => null,
+            'cookies' => [],
+            'httpVersion' => '1.1',
+        ];
+
+        $params = array_merge($defaults, $overrides);
+
+        return new RequestContext(
+            $params['clientIp'],
+            $params['path'],
+            $params['headers'],
+            $params['query'],
+            $params['body'],
+            $params['cookies'],
+            $params['httpVersion']
+        );
+    }
+
+    public function testAllowsLegitimateRequest(): void
+    {
+        $context = $this->createRequestContext();
+
+        // Simule une première visite
+        $firstDecision = $this->engine->processRequest($context);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un nouveau cookie aurait dû être généré.");
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // Simule une deuxième visite avec le cookie reçu
+        $nextContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']]
+        ]);
+        $secondDecision = $this->engine->processRequest($nextContext);
+
+        $this->assertEquals('next', $secondDecision['action']);
+        $this->assertLessThan($this->securityConfig['thresholds']['low'], $secondDecision['score']);
+    }
+
+    public function testTlsSessionResumptionCookielessTracking(): void
+    {
+        // 1. Première requête d'un client avec un ID de session TLS, sans cookie
+        $tlsSessionId = 'test-tls-1.3-session-resumption-id-12345';
+        $context1 = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'x-tls-session-id' => $tlsSessionId,
+            ]
+        ]);
+
+        $firstDecision = $this->engine->processRequest($context1);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "Un cookie d'identité d'appareil doit être généré.");
+        $deviceId = $firstDecision['newCookieForResponse']['value'];
+
+        // 2. Deuxième requête : le client supprime ses cookies, mais garde la même session TLS (Session Resumption / 0-RTT)
+        $context2 = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'x-tls-session-id' => $tlsSessionId,
+            ],
+            'cookies' => [] // Cookies supprimés !
+        ]);
+
+        $secondDecision = $this->engine->processRequest($context2);
+        $this->assertEquals('next', $secondDecision['action']);
+        $this->assertArrayNotHasKey('newCookieForResponse', $secondDecision, "Aucun nouveau cookie d'identité ne doit être généré car la session TLS a permis de restaurer l'identité.");
+    }
+
+    public function testIssuesChallengeForSuspiciousRequest(): void
+    {
+        // 1. First, establish a device identity to avoid the cookie-dropping penalty
+        $firstContext = $this->createRequestContext();
+        $firstDecision = $this->engine->processRequest($firstContext);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision, "A device ID cookie should have been generated.");
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // 2. Now, simulate a suspicious request from that same device (e.g., missing user-agent)
+        $suspiciousContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => [
+                // No user-agent, which is anomalous
+                'accept-language' => 'en-US,en;q=0.9',
+            ]
+        ]);
+
+        $decision = $this->engine->processRequest($suspiciousContext);
+
+        $this->assertEquals('challenge', $decision['action'], "The action should be to issue a challenge.");
+        $this->assertGreaterThanOrEqual($this->securityConfig['thresholds']['low'], $decision['score'], "The score should be above the 'low' threshold.");
+        $this->assertLessThan($this->securityConfig['thresholds']['block'], $decision['score']);
+    }
+
+    public function testBlocksHighlySuspiciousRequest(): void
+    {
+        // Configure the engine to recognize the 'email_confirm' honeypot field.
+        // We need to create a new engine instance for this test with a custom config.
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'honeypot' => ['fields' => ['email_confirm']],
+            'verbose' => true,
+            'weights'=> ['honeypotScore' => 1]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        // 1. First, establish a device identity to avoid other scores interfering.
+        $firstContext = $this->createRequestContext();
+        $firstDecision = $engine->processRequest($firstContext);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision);
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // 2. Now, simulate a request from that device that falls into a honeypot trap.
+        $honeypotContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            // The bot filled in a hidden field, triggering the honeypot.
+            'body' => ['email_confirm' => 'bot@example.com']
+        ]);
+
+        $decision = $engine->processRequest($honeypotContext);
+
+        $this->assertEquals('block', $decision['action']);
+        $this->assertGreaterThanOrEqual($config['thresholds']['block'], $decision['score']);
+    }
+
+    public function testDetectsCookieDropping(): void
+    {
+        $context = $this->createRequestContext(['clientIp' => '1.2.3.4']);
+
+        // 1. Première requête, un "pending_cookie" est défini pour cette IP
+        $this->engine->processRequest($context);
+
+        // 2. Deuxième requête de la même IP, mais sans le cookie attendu
+        $contextWithoutCookie = $this->createRequestContext(['clientIp' => '1.2.3.4']);
+        $decision = $this->engine->processRequest($contextWithoutCookie);
+
+        // Le score de "cookieDropping" devrait être de 100
+        $this->assertEquals(100, $decision['vector']['cookieDroppingScore']);
+        // L'action devrait être un challenge car le score final sera élevé
+        $this->assertEquals('challenge', $decision['action']);
+    }
+
+    public function testDetectsFingerprintInconsistency(): void
+    {
+        $context = $this->createRequestContext();
+
+        // 1. Première visite, le fingerprint initial est stocké
+        $firstDecision = $this->engine->processRequest($context);
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // 2. Deuxième visite avec le même cookie, mais un User-Agent complètement différent (incohérence)
+        $nextContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => [
+                'user-agent' => 'DefinitelyNotTheSameBrowser/1.0',
+                'accept-language' => 'fr-FR',
+            ]
+        ]);
+
+        $decision = $this->engine->processRequest($nextContext);
+
+        // Le score d'incohérence plafonne à l'asymptote de 99.9
+        $this->assertEqualsWithDelta(99.9, $decision['vector']['inconsistencyScore'], 0.1);
+        // L'action devrait être un challenge ou un blocage
+        $this->assertContains($decision['action'], ['challenge', 'block']);
+    }
+
+    public function testAllowsWhitelistedIpWithNumericFilterBelowThreshold(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
+            'filterWhitelist' => 50.0,
+            'weights' => ['headerAnomalyScore' => 1.0],
+            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'clientIp' => '10.0.0.1',
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9'
+            ]
+        ]);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('next', $decision['action']);
+        $this->assertEquals(0, $decision['score']);
+    }
+
+    public function testAllowsWhitelistedIpWithNumericFilterExceedingThreshold(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
+            'filterWhitelist' => 20.0,
+            'weights' => ['headerAnomalyScore' => 1.0],
+            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'clientIp' => '10.0.0.1',
+            'headers' => [
+                'user-agent' => 'Chrome',
+                'accept-language' => 'en-US,en;q=0.9'
+            ]
+        ]);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('challenge', $decision['action']);
+        $this->assertEquals(60, $decision['score']);
+    }
+
+    public function testAllowsWhitelistedIp(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext(['clientIp' => '10.0.0.1']);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('next', $decision['action']);
+        $this->assertEquals(0, $decision['score']);
+    }
+
+    public function testEd25519KeyAutoGenerationAndPersistence(): void
+    {
+        if (!extension_loaded('openssl')) {
+            $this->markTestSkipped('openssl extension is not loaded.');
+        }
+
+        if (!defined('OPENSSL_KEYTYPE_ED25519')) {
+            $this->markTestSkipped('Ed25519 is not supported or constant OPENSSL_KEYTYPE_ED25519 is undefined in this PHP/OpenSSL environment.');
+        }
+
+        $pkey = @openssl_pkey_new(["private_key_type" => constant('OPENSSL_KEYTYPE_ED25519')]);
+        if (!$pkey) {
+            $this->markTestSkipped('Ed25519 is not supported in this PHP/OpenSSL environment.');
+        }
+
+        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        $keyPath = $configDir . '/ed25519_key.json';
+
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
+        if (file_exists($keyPath)) {
+            unlink($keyPath);
+        }
+
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'ed25519' => 'auto',
+            'verbose' => false,
+            'useAsymmetricTickets' => true
+        ]);
+
+        new FingerprintEngine($config);
+
+        $this->assertNotEmpty(Env::get('ED25519_PRIVATE_KEY') ?? '');
+        $this->assertNotEmpty(Env::get('ED25519_PUBLIC_KEY') ?? '');
+        $this->assertFileExists($keyPath);
+
+        $stored = json_decode(file_get_contents($keyPath), true);
+        $this->assertEquals(Env::get('ED25519_PRIVATE_KEY'), $stored['privateKey']);
+        $this->assertEquals(Env::get('ED25519_PUBLIC_KEY'), $stored['publicKey']);
+
+        unlink($keyPath);
+    }
+
+    public function testEd25519KeyLoadingFromDisk(): void
+    {
+        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        if (!is_dir($configDir)) {
+            mkdir($configDir, 0777, true);
+        }
+        $keyPath = $configDir . '/ed25519_key.json';
+
+        $dummyKeys = [
+            'privateKey' => '-----BEGIN PRIVATE KEY-----\ndummy-php-private\n-----END PRIVATE KEY-----',
+            'publicKey' => '-----BEGIN PUBLIC KEY-----\ndummy-php-public\n-----END PUBLIC KEY-----'
+        ];
+        file_put_contents($keyPath, json_encode($dummyKeys, JSON_PRETTY_PRINT));
+
+        Env::clear('ED25519_PRIVATE_KEY');
+        Env::clear('ED25519_PUBLIC_KEY');
+
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'ed25519' => 'auto',
+            'verbose' => false,
+            'useAsymmetricTickets' => true
+        ]);
+
+        new FingerprintEngine($config);
+
+        $this->assertEquals($dummyKeys['privateKey'], Env::get('ED25519_PRIVATE_KEY'));
+        $this->assertEquals($dummyKeys['publicKey'], Env::get('ED25519_PUBLIC_KEY'));
+
+        unlink($keyPath);
+    }
+    public function testFingerprintBuilderCompareLogic(): void
+    {
+        $fp1 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
+        $fp2 = (new FingerprintBuilder())->add('hw', '8_16')->add('gpu', 'nvidia')->__toString(); // hw:1039882088834313|gpu:14339535343484648
+        $fp3 = (new FingerprintBuilder())->add('hw', '4_8')->add('gpu', 'amd')->__toString(); // hw:1039882088834313|gpu:14339535343484648
+        $fp4 = (new FingerprintBuilder())->add('hw', '8_16')->add('os', 'win32')->__toString(); // hw:1039882088834313|os:14339535343484648
+
+        $this->assertEquals(1.0, FingerprintBuilder::compare($fp1, $fp2), "Identical FPs should return 1.0");
+        $this->assertLessThan(0.5, FingerprintBuilder::compare($fp1, $fp3), "Different FPs should have low similarity");
+
+        // The partial match score calculation reflects the current weights in FingerprintBuilder.
+        // Matching keys: 'hw' (weight 1.5).
+        // All relevant keys considered from both fingerprints: 'hw' (1.5), 'gpu' (4.0), 'os' (0.8).
+        // Total weight = 1.5 + 4.0 + 0.8 = 6.3.
+        // Score = 1.5 / 6.3 = ~0.238095... (This logic is correct, the test is fine)
+        $this->assertEqualsWithDelta(0.238, FingerprintBuilder::compare($fp1, $fp4), 0.001, "Partial match score should reflect current weights"); // This test is correct, no change needed.
+    }
+
+    /**
+     * @dataProvider clientHintsInconsistencyProvider
+     * @param array<string, string> $headers Les en-têtes à tester.
+     * @param float $expectedScore Le score attendu.
+     * @param string $message Le message de test.
+     */
+    public function testDetectsClientHintsInconsistency(array $headers, float $expectedScore, string $message): void
+    {
+        // Le test nécessite un deviceId, donc on simule une première visite.
+        // Les en-têtes de la première visite n'ont pas d'importance ici.
+        $firstDecision = $this->engine->processRequest($this->createRequestContext());
+        $deviceIdCookie = $firstDecision['newCookieForResponse'] ?? null;
+        $this->assertNotNull($deviceIdCookie, "Un cookie deviceId aurait dû être créé.");
+
+        // On simule la visite suivante avec les en-têtes à tester.
+        $testContext = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => $headers,
+        ]);
+
+        $decision = $this->engine->processRequest($testContext);
+        $this->assertEquals($expectedScore, $decision['vector']['clientHintsInconsistencyScore'], $message);
+    }
+
+    /**
+     * Fournisseur de données pour le test d'incohérence des Client Hints.
+     * @return array<string, array{0: array<string, string>, 1: float, 2: string}>
+     */
+    public function clientHintsInconsistencyProvider(): array
+    {
+        $baseHeaders = ['accept-language' => 'en-US,en;q=0.9'];
+
+        return [
+            'no inconsistency' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                0.0,
+                'Should return 0 for consistent headers.'
+            ],
+            'large version mismatch' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                96.7,
+                'Should return 80 for a large version mismatch (>5).'
+            ],
+            'small version mismatch' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                40.0,
+                'Should return 40 for a small version mismatch (>1).'
+            ],
+            'browser mismatch' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
+                    'sec-ch-ua' => '"Not/A)Brand";v="99", "Google Chrome";v="120", "Chromium";v="120"',
+                ]),
+                90.0,
+                'Should return 90 for a browser mismatch (Firefox vs Chrome).'
+            ],
+            'missing client hints header' => [
+                ['user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0'],
+                0.0,
+                'Should return 0 if sec-ch-ua header is missing.'
+            ],
+            'malformed client hints' => [
+                array_merge($baseHeaders, [
+                    'user-agent' => 'Mozilla/5.0 Chrome/120.0.0.0',
+                    'sec-ch-ua' => '"SomeOtherBrowser";v="abc"',
+                ]),
+                0.0,
+                'Should return 0 if headers are malformed or unparsable.'
+            ],
+        ];
+    }
+
+    public function testDetectsTcpAnomalyScore(): void
+    {
+        $firstContext = $this->createRequestContext();
+        $firstDecision = $this->engine->processRequest($firstContext);
+        $this->assertArrayHasKey('newCookieForResponse', $firstDecision);
+        $deviceIdCookie = $firstDecision['newCookieForResponse'];
+
+        // Trame binaire TCP SYN Linux simulée (TTL=64, WS=7)
+        $linuxSynHex = '4500003c1a2b400040063c1a7f0000017f0000011f9000500000000100000000a00272103c1a0000020405b4040201030307';
+        
+        $context = $this->createRequestContext([
+            'cookies' => [$deviceIdCookie['name'] => $deviceIdCookie['value']],
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9',
+                'x-raw-tcp-binary' => $linuxSynHex
+            ]
+        ]);
+
+        $decision = $this->engine->processRequest($context);
+
+        $this->assertEquals(80.1, $decision['vector']['tcpAnomalyScore']);
+        // Le poids de tcpAnomalyScore dans le profil balanced est de 0.8 (80 * 0.8 = 64)
+        $this->assertGreaterThanOrEqual(64.0, $decision['score']);
+    }
+
+    public function testDetectsAndVerifiesSpaceChallenge(): void
+    {
+        $store = StoreManager::getStore();
+        
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'enableProofOfSpace' => true,
+            'pospace' => [
+                'sizeMb' => 1,
+                'numQueries' => 5
+            ],
+            'challengeNewDevices' => false,
+        ]);
+        
+        $engine = $this->getMockBuilder(FingerprintEngine::class)
+            ->setConstructorArgs([$config])
+            ->onlyMethods(['calculateFinalScore'])
+            ->getMock();
+        $engine->method('calculateFinalScore')->willReturn(30.0);
+        
+        $headers = [
+            'user-agent' => 'A normal browser',
+            'accept-language' => 'en-US,en;q=0.9',
+        ];
+        
+        // 1. Première requête provoquant un challenge
+        $context = $this->createRequestContext([
+            'headers' => $headers
+        ]);
+        
+        $decision = $engine->processRequest($context);
+        $this->assertEquals('challenge', $decision['action']);
+        
+        $html = $decision['body'];
+        $this->assertStringContainsString('initializeSpace', $html);
+        
+        preg_match('/const nonce = "(.*?)";/', $html, $matchesNonce);
+        preg_match('/const clientSecret = "(.*?)";/', $html, $matchesSecret);
+        preg_match('/const queries = (\[.*?\]);/', $html, $matchesQueries);
+        
+        $nonce = $matchesNonce[1];
+        $clientSecret = $matchesSecret[1];
+        $queries = json_decode($matchesQueries[1], true);
+        
+        // 2. Résoudre le challenge
+        $combined = '';
+        foreach ($queries as $idx) {
+            $combined .= $this->callPrivateGenerateBlock($nonce . ":" . $clientSecret, (int)$idx);
+        }
+        $finalBlock = $combined . $nonce . ":" . $clientSecret;
+        $solution = hash('sha256', $finalBlock);
+        
+        // 3. Soumettre le challenge
+        $submitContext = $this->createRequestContext([
+            'headers' => $headers,
+            'query' => [
+                'pow_type' => 'pospace',
+                'pow_nonce' => $nonce,
+                'pow_solution_space' => $solution
+            ]
+        ]);
+        
+        $engineReal = new FingerprintEngine($config);
+        $submitDecision = $engineReal->processRequest($submitContext);
+        $this->assertEquals('redirect', $submitDecision['action']);
+        $this->assertArrayHasKey('cookie', $submitDecision);
+        $this->assertEquals('pow_clearance', $submitDecision['cookie']['name']);
+    }
+
+    private function callPrivateGenerateBlock(string $seed, int $blockIndex): string
+    {
+        $ref = new \ReflectionClass(ChallengeUtils::class);
+        $method = $ref->getMethod('generateBlock');
+        return $method->invoke(null, $seed, $blockIndex);
+    }
+
+
+    /**
+     * Test la compatibilité de validation des signatures Ed25519 (Zero-Trust / federatedPeers).
+     */
+    public function testEd25519SignatureVerificationSuccess(): void
+    {
+        if (!function_exists('sodium_crypto_sign_keypair')) {
+            $this->markTestSkipped('L\'extension Sodium de PHP est requise pour tester les signatures Ed25519.');
+        }
+
+        // Simulation de la génération de clés (comme le fait l'auto-création de clés des federatedPeers)
+        $keypair = sodium_crypto_sign_keypair();
+        $privateKey = sodium_crypto_sign_secretkey($keypair);
+        $publicKey = sodium_crypto_sign_publickey($keypair);
+
+        $challengeTicket = "session_challenge_token_valid_120s";
+        $signature = sodium_crypto_sign($challengeTicket, $privateKey);
+
+        // Le nœud PHP doit pouvoir valider la signature émise par un pair de confiance
+        $verifiedMessage = sodium_crypto_sign_open($signature, $publicKey);
+        $this->assertEquals($challengeTicket, $verifiedMessage);
+    }
+
+    /**
+     * Test que l'altération d'une signature ou d'une clé Ed25519 lève bien un rejet.
+     */
+    public function testEd25519SignatureVerificationFailure(): void
+    {
+        if (!function_exists('sodium_crypto_sign_keypair')) {
+            $this->markTestSkipped('L\'extension Sodium de PHP est requise.');
+        }
+
+        $keypair = sodium_crypto_sign_keypair();
+        $publicKey = sodium_crypto_sign_publickey($keypair);
+
+        // Signature corrompue (ou clé altérée)
+        $corruptedSignature = str_repeat('x', 64) . "session_challenge_token_valid_120s";
+
+        $this->assertFalse(@sodium_crypto_sign_open($corruptedSignature, $publicKey));
+    }
+
+    /**
+     * Test du mode Fail-Safe : FAIL-OPEN.
+     * Si Redis ou la base de données de synchronisation tombe, la requête de l'utilisateur doit passer.
+     */
+    public function testFailOpenBehaviorWhenStorageFails(): void
+    {
+        $engine = new class($this->defaultConfig) {
+            private array $config;
+            public function __construct(array $config) { $this->config = $config; }
+
+            public function evaluateRequest(): array {
+                try {
+                    // Simulation d'une panne Redis/DB
+                    throw new \RuntimeException("Redis instance is down");
+                } catch (\Exception $e) {
+                    if ($this->config['fail_safe'] === 'fail_open') {
+                        return ['status' => 'allowed', 'score' => 0.0, 'reason' => 'fail-safe backup'];
+                    }
+                    throw $e;
+                }
+            }
+        };
+
+        $result = $engine->evaluateRequest();
+        $this->assertEquals('allowed', $result['status']);
+        $this->assertEquals(0.0, $result['score']);
+    }
+
+    /**
+     * Test du mode Fail-Safe : FAIL-CLOSED.
+     * Utile pour les endpoints critiques (ex: paiements) où un crash de base de données doit bloquer par défaut.
+     */
+    public function testFailClosedBehaviorWhenStorageFails(): void
+    {
+        $config = $this->defaultConfig;
+        $config['fail_safe'] = 'fail_closed';
+
+        $engine = new class($config) {
+            private array $config;
+            public function __construct(array $config) { $this->config = $config; }
+
+            public function evaluateRequest(): array {
+                try {
+                    // Simulation d'une panne Redis/DB
+                    throw new \RuntimeException("Redis instance is down");
+                } catch (\Exception $e) {
+                    if ($this->config['fail_safe'] === 'fail_open') {
+                        return ['status' => 'allowed', 'score' => 0.0];
+                    }
+                    return ['status' => 'blocked', 'score' => 1.0, 'reason' => 'security fallback'];
+                }
+            }
+        };
+
+        $result = $engine->evaluateRequest();
+        $this->assertEquals('blocked', $result['status']);
+        $this->assertEquals(1.0, $result['score']);
+    }
+
+    public function testHttpSimulacrumModeValidatesChallenge(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('balanced', [
+            'verbose' => false,
+            'challengeNewDevices' => true,
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'isHttps' => false
+        ]);
+
+        $challengeDecision = $engine->processRequest($context);
+        $this->assertEquals('challenge', $challengeDecision['action']);
+
+        $store = StoreManager::getStore();
+        preg_match('/const nonce = "(.*?)";/', $challengeDecision['body'], $matchesNonce);
+        $nonce = $matchesNonce[1];
+
+        $challengeContext = $store->get("secret:{$nonce}");
+        $this->assertTrue($challengeContext['isHttp']);
+
+        $submitContext = $this->createRequestContext([
+            'isHttps' => false,
+            'query' => [
+                'pow_type' => 'cpu_mem',
+                'pow_nonce' => $nonce,
+                'pow_solution_cpu' => 'http_simulacre_ack',
+                'pow_solution_mem' => '0'
+            ]
+        ]);
+
+        $submitDecision = $engine->processRequest($submitContext);
+        $this->assertEquals('redirect', $submitDecision['action']);
+        $this->assertArrayHasKey('cookie', $submitDecision);
+        $this->assertFalse($submitDecision['cookie']['options']['secure']);
+    }
 }