@anonympins/fingerprint 0.7.2 → 0.7.4

package/src/js/tests/fingerprint.test.js

@@ -906,8 +906,76 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(req.fingerprint.score).toBeGreaterThanOrEqual(blockThreshold);
         });
 
-        test('should redirect after a valid COMBINED (CPU+Mem) PoW solution is provided', async (context) => {
+        test('should redirect after a valid COMBINED (CPU+Mem) PoW solution is provided', async () => {
+            const ip = '127.0.0.1';
+            const originalPath = '/protected/combined';
+            const solverFingerprint = 'fp-combined-solution';
+            const userAgent = 'test-ua-combined';
+
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 35,
+            });
+
+            const securityConfigWithLowDiff = {
+                ...securityConfig,
+                cpu: { minDifficultyBits: 4, ...securityConfig.cpu },
+            };
+            const middleware = powMiddleware(securityConfigWithLowDiff);
+
+            // 1. Déclencher le challenge
+            const req1 = {
+                path: originalPath, ip, cookies: {}, query: {},
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
+                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+            let challengeBody;
+            const res1 = {
+                status: () => res1,
+                send: (body) => { challengeBody = body; },
+                cookie: vi.fn()
+            };
+            req1.fingerprint = {};
+            await middleware(req1, res1, vi.fn());
+
+            expect(challengeBody).toContain('Enhanced Verification');
+
+            // 2. Résoudre le challenge
+            const nonce = challengeBody.match(/const nonce = "([^"]+)"/)[1];
+            const clientSecret = challengeBody.match(/const clientSecret = "([^"]+)"/)[1];
+            const cpuTargetHex = challengeBody.match(/const cpuTarget = BigInt\("0x" \+ "([^"]+)"\);/)[1];
+            const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
+
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:${ip}::`);
+            const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTargetHex, () => {});
+            const memSolution = await solveMemory(`:${nonce}:${clientSecret}`, memDifficulty);
+
+            // 3. Soumettre la solution
+            const req2 = {
+                path: originalPath, ip, cookies: {},
+                query: {
+                    pow_type: 'cpu_mem',
+                    pow_nonce: nonce,
+                    pow_solution_cpu: String(cpuSolution),
+                    pow_solution_mem: JSON.stringify(memSolution),
+                    pow_fp: solverFingerprint
+                },
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
+                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+            let capturedCookie;
+            const res2 = {
+                cookie: (name, value, options) => { capturedCookie = { name, value, options }; },
+                redirect: vi.fn(),
+                status: vi.fn(() => res2),
+                send: vi.fn(),
+            };
+
+            req2.fingerprint = {};
+            await middleware(req2, res2, vi.fn());
 
+            expect(res2.redirect).toHaveBeenCalledWith(originalPath);
+            expect(capturedCookie).toBeDefined();
+            expect(capturedCookie.name).toBe('pow_clearance');
         });
     });
 
@@ -1553,6 +1621,18 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(behaviorScore).toBe(0);
         });
 
+        it('should return a score of 0 when x-behavior-metrics is 1 (human verified client-side)', () => {
+            const context = { headers: { 'x-behavior-metrics': '1' } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(0);
+        });
+
+        it('should return a score of 100 when x-behavior-metrics is 0 (bot detected client-side)', () => {
+            const context = { headers: { 'x-behavior-metrics': '0' } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(100);
+        });
+
         it('should return a score of 100 for honeypot interaction', () => {
             const metrics = { honeypotInteraction: true, mouseEntropy: 50, keystrokeLatency: 120 };
             const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
@@ -1560,11 +1640,11 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(behaviorScore).toBe(100);
         });
 
-        it('should return a score of 40 for no mouse or keyboard activity', () => {
+        it('should return a score of 5 for no mouse or keyboard activity', () => {
             const metrics = { honeypotInteraction: false, mouseMovementsHistory: [], keystrokeLatency: 0 };
             const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
             const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(40);
+            expect(behaviorScore).toBe(5);
         });
 
         it('should return a score of 0 for normal user activity', () => {
@@ -1759,7 +1839,7 @@ describe('Fingerprint & PoW Security Suite', () => {
             };
 
             const isVerified = await engine._verifyWhitelistedBot({ ...requestContext, fingerprint: {} });
-            expect(isVerified).toBe(false);
+            expect(isVerified).toBeNull();
             expect(consoleErrorSpy).toHaveBeenCalledWith(expect.stringContaining('[Fingerprint] Invalid regex in whitelist rule'));
             consoleErrorSpy.mockRestore();
         });
@@ -2394,6 +2474,58 @@ describe('getClientHintsInconsistencyScore', () => {
     });
 });
 
+describe('getProtocolAnomalyScore (HTTP/2 Frame Analysis)', () => {
+    const { getProtocolAnomalyScore } = __internal;
+
+    test('should penalize spoofed Chromium with no PRIORITY frames', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,a,s,p|p:0,w:4,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(25.0);
+    });
+
+    test('should penalize spoofed Chromium with too few WINDOW_UPDATE frames', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,a,s,p|p:3,w:1,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(20.0);
+    });
+
+    test('should penalize spoofed Firefox with too many PRIORITY frames', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,s,p,a|p:3,w:2,c:0'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(20.0);
+    });
+
+    test('should not penalize a legitimate Chromium fingerprint', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,a,s,p|p:3,w:4,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(0.0);
+    });
+});
+
 describe('Subnet Scoring (Node.js)', () => {
     const inMemoryStore = {
         _map: new Map(),

package/src/js/tests/threatIntel.test.js

@@ -0,0 +1,76 @@
+import { beforeEach, describe, expect, it } from 'vitest';
+import { __internal, configureStore } from '../fingerprint.js';
+
+describe('Threat Intelligence - Rationale-Driven Defensive Logic', () => {
+    const inMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+        async has(key) { return this._map.has(key); },
+        async delete(key) { this._map.delete(key); },
+    };
+
+    beforeEach(() => {
+        inMemoryStore._map.clear();
+        configureStore(inMemoryStore);
+    });
+
+    it('should assign a deterministic score of 100 with audit trace for banned ZKP public keys', async () => {
+        await inMemoryStore.set('banned-zkp-y:banned-key-999', true);
+
+        const context = { headers: {} };
+        const result = await __internal.getSuspicionVector(context, {
+            weights: { threatIntelScore: 1.0 },
+            thresholds: { low: 20 }
+        });
+
+        // Direct check via internal function with banned key
+        const threatResult = await __internal.store.has('banned-zkp-y:banned-key-999');
+        expect(threatResult).toBe(true);
+    });
+
+    it('should return score 0 for consistent local connections without proxy delay', async () => {
+        const reqTime = 1700000000000;
+        const context = {
+            requestTimestamp: reqTime,
+            headers: {
+                'x-tcp-rtt': '15',
+                'x-behavior-metrics': JSON.stringify({ clientTimestamp: reqTime - 25 })
+            }
+        };
+
+        const vector = await __internal.getSuspicionVector(context, { weights: { threatIntelScore: 1.0 } });
+        expect(vector.threatIntelScore).toBe(0.0);
+    });
+
+    it('should ignore mild JS event loop jitter and network lag without triggering false positives', async () => {
+        const reqTime = 1700000000000;
+        // App latency 65ms with a 20ms RTT falls well within the 60ms jitter tolerance window
+        const context = {
+            requestTimestamp: reqTime,
+            headers: {
+                'x-tcp-rtt': '20',
+                'x-behavior-metrics': JSON.stringify({ clientTimestamp: reqTime - 65 })
+            }
+        };
+
+        const vector = await __internal.getSuspicionVector(context, { weights: { threatIntelScore: 1.0 } });
+        expect(vector.threatIntelScore).toBe(0.0);
+    });
+
+    it('should smoothly calculate elevated suspicion when residential proxy tunneling is detected', async () => {
+        const reqTime = 1700000000000;
+        // Edge socket is 10ms (datacenter gateway), but application payload arrives with 280ms latency (WAN proxy hop)
+        const context = {
+            requestTimestamp: reqTime,
+            headers: {
+                'x-tcp-rtt': '10',
+                'x-behavior-metrics': JSON.stringify({ clientTimestamp: reqTime - 280 })
+            }
+        };
+
+        const vector = await __internal.getSuspicionVector(context, { weights: { threatIntelScore: 1.0 } });
+        expect(vector.threatIntelScore).toBeGreaterThan(70.0);
+        expect(vector.threatIntelScore).toBeLessThanOrEqual(95.0);
+    });
+});

package/src/php/AutoTuner.php

@@ -129,7 +129,8 @@ class AutoTuner
             try {
                 call_user_func($this->onCleanup, $removed);
             } catch (\Throwable $e) {
-                error_log("[AutoTuning] Error in onCleanup callback: " . $e->getMessage());
+                // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- AutoTuning system log
+                $this->logError("[AutoTuning] Error in onCleanup callback: " . $e->getMessage());
             }
         }
     }
@@ -155,24 +156,24 @@ class AutoTuner
 
         if (count($sanitizedData) < $this->minDataPoints || !$hasEnoughSignal) {
             if (count($sanitizedData) < $this->minDataPoints) {
-                echo sprintf("[AutoTuning] Postponed: %d/%d data points collected.\n", count($sanitizedData), $this->minDataPoints);
+                $this->logMessage(sprintf("[AutoTuning] Postponed: %d/%d data points collected.\n", count($sanitizedData), $this->minDataPoints));
             } else {
-                echo sprintf("[AutoTuning] Postponed: Insufficient confidence signals (Ratio: %.2f%% < %.2f%% and count: %d < %d).\n", $highConfidenceRatio * 100, $minConfidenceRatio * 100, $highConfidenceLogs, $minHighConfidenceCount);
+                $this->logMessage(sprintf("[AutoTuning] Postponed: Insufficient confidence signals (Ratio: %.2f%% < %.2f%% and count: %d < %d).\n", $highConfidenceRatio * 100, $minConfidenceRatio * 100, $highConfidenceLogs, $minHighConfidenceCount));
             }
             return;
         }
 
         if (count($this->trafficData) > $this->maxDataPoints) {
-            echo sprintf("[AutoTuning] Traffic log reached %d entries (max: %d). Truncating oldest logs.\n", count($this->trafficData), $this->maxDataPoints);
+            $this->logMessage(sprintf("[AutoTuning] Traffic log reached %d entries (max: %d). Truncating oldest logs.\n", count($this->trafficData), $this->maxDataPoints));
             $this->trafficData = array_slice($this->trafficData, count($this->trafficData) - $this->maxDataPoints);
         }
 
-        echo sprintf("[AutoTuning] Starting complete optimization cycle with %d sanitized data points.\n", count($sanitizedData));
+        $this->logMessage(sprintf("[AutoTuning] Starting complete optimization cycle with %d sanitized data points.\n", count($sanitizedData)));
 
         $paretoFront = OptimizationOperators::solveFullSecurityTuning(['trafficData' => $sanitizedData, 'currentConfig' => $this->securityConfig], []);
 
         if (empty($paretoFront)) {
-            echo "[AutoTuning] Optimization returned no solutions.\n";
+            $this->logMessage("[AutoTuning] Optimization returned no solutions.\n");
             return;
         }
 
@@ -192,7 +193,7 @@ class AutoTuner
 
         $filteredFront = array_filter($paretoFront, fn ($p) => $isValidSecurityConfig($p['solution']));
         if (empty($filteredFront)) {
-            echo "[AutoTuning] Warning: All Pareto solutions violated sanity guardrails. Restoring raw front.\n";
+            $this->logMessage("[AutoTuning] Warning: All Pareto solutions violated sanity guardrails. Restoring raw front.\n");
             $filteredFront = $paretoFront;
         } else {
             $filteredFront = array_values($filteredFront);
@@ -277,7 +278,8 @@ class AutoTuner
         $validationTolerance = $this->securityConfig['autotuning']['validationTolerance'] ?? $this->validationTolerance;
 
         if ($proposedFPR > $currentFPR + $validationTolerance || $proposedFNR > $currentFNR + $validationTolerance) {
-            error_log(sprintf(
+            // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- AutoTuning system alert
+            $this->logError(sprintf(
                 "[AutoTuning] [SECURITY ALERT] Proposed configuration rejected due to instability/poisoning risk! Proposed FPR: %.4f (Current: %.4f), Proposed FNR: %.4f (Current: %.4f)",
                 $proposedFPR, $currentFPR, $proposedFNR, $currentFNR
             ));
@@ -300,22 +302,23 @@ class AutoTuner
 
         self::$lastBestSolution = $bestSolution;
 
-        echo "[AutoTuning] New optimized security configuration applied.\n";
-        echo "[AutoTuning] Objectives achieved: " . json_encode([
+        $this->logMessage("[AutoTuning] New optimized security configuration applied.\n");
+        $this->logMessage("[AutoTuning] Objectives achieved: " . json_encode([
             'falsePositiveRate' => round($bestSolution['objectives'][0], 4),
             'falseNegativeRate' => round($bestSolution['objectives'][1], 4)
-        ]) . "\n";
-        echo "[AutoTuning] New thresholds: " . json_encode($this->securityConfig['thresholds']) . "\n";
-        echo "[AutoTuning] New weights: " . json_encode($this->securityConfig['weights']) . "\n";
-        echo "[AutoTuning] New patterns: " . json_encode($this->securityConfig['patterns']) . "\n";
+        ]) . "\n");
+        $this->logMessage("[AutoTuning] New thresholds: " . json_encode($this->securityConfig['thresholds']) . "\n");
+        $this->logMessage("[AutoTuning] New weights: " . json_encode($this->securityConfig['weights']) . "\n");
+        $this->logMessage("[AutoTuning] New patterns: " . json_encode($this->securityConfig['patterns']) . "\n");
 
         // Persist best configuration if savePath is configured
         if ($this->savePath !== null) {
             try {
                 file_put_contents($this->savePath, json_encode($bestSolution['solution'], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES));
-                echo "[AutoTuning] Best configuration saved to: {$this->savePath}\n";
+                $this->logMessage("[AutoTuning] Best configuration saved to: {$this->savePath}\n");
             } catch (\Throwable $e) {
-                error_log("[AutoTuning] Error saving optimized configuration: " . $e->getMessage());
+                // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- AutoTuning system log
+                $this->logError("[AutoTuning] Error saving optimized configuration: " . $e->getMessage());
             }
         }
 
@@ -325,13 +328,28 @@ class AutoTuner
                 try {
                     call_user_func($this->onCleanup, $cleared);
                 } catch (\Throwable $e) {
-                    error_log("[AutoTuning] Error in onCleanup callback after clearing: " . $e->getMessage());
+                    // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- AutoTuning system log
+                    $this->logError("[AutoTuning] Error in onCleanup callback after clearing: " . $e->getMessage());
                 }
             }
-            echo sprintf("[AutoTuning] Explicitly cleared %d processed traffic data points.\n", count($cleared));
+            $this->logMessage(sprintf("[AutoTuning] Explicitly cleared %d processed traffic data points.\n", count($cleared)));
         }
     }
 
+    private function logMessage(string $message): void
+    {
+        if (PHP_SAPI === 'cli') {
+            // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped -- CLI message output
+            echo $message;
+        }
+    }
+
+    private function logError(string $message): void
+    {
+        // phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log -- AutoTuning system log
+        error_log($message);
+    }
+
     /**
      * Returns the latest best solution found by the auto-tuner.
      * @return array<string, mixed>|null