@anonympins/fingerprint 0.7.3 → 0.7.5

package/src/js/tests/dynamic-wasm.test.js

@@ -1,78 +1,78 @@
-import { describe, expect, it } from 'vitest';
-import { DynamicWasmGenerator } from '../dynamic-wasm.js';
-
-// Helper function to decode ULEB128 (for verification)
-function decodeULEB128(bytes) {
-    let result = 0;
-    let shift = 0;
-    for (const byte of bytes) {
-        result |= (byte & 0x7f) << shift;
-        if (!(byte & 0x80)) {
-            break;
-        }
-        shift += 7;
-    }
-    return result;
-}
-
-describe('DynamicWasmGenerator', () => {
-    it('should generate a valid WASM module buffer', () => {
-        const constants = { seed: 123, multiplier: 33, adder: 7 };
-        const wasmBuffer = DynamicWasmGenerator.generate(constants);
-
-        // Basic check: ensure it's a Buffer and starts with WASM magic number
-        expect(wasmBuffer).toBeInstanceOf(Buffer);
-        expect(wasmBuffer.slice(0, 4).toString('hex')).toBe('0061736d'); // \0asm
-        expect(wasmBuffer.slice(4, 8).toString('hex')).toBe('01000000'); // Version 1
-
-        // Attempt to compile and instantiate the module to ensure validity
-        let instance;
-        try {
-            const module = new WebAssembly.Module(wasmBuffer);
-            instance = new WebAssembly.Instance(module, {});
-        } catch (e) {
-            // If compilation/instantiation fails, it's an invalid WASM module
-            expect.fail(`Generated WASM module is invalid: ${e.message}`);
-        }
-
-        // Verify the exported hash function exists
-        expect(instance.exports.hash).toBeInstanceOf(Function);
-        expect(instance.exports.memory).toBeInstanceOf(WebAssembly.Memory);
-    });
-
-    it('should produce a consistent hash result with the JS fallback', () => {
-        const constants = { seed: 42, multiplier: 1597334677, adder: 12345 };
-        const testString = "hello world";
-
-        const wasmBuffer = DynamicWasmGenerator.generate(constants);
-        const module = new WebAssembly.Module(wasmBuffer);
-        const instance = new WebAssembly.Instance(module, {});
-        const exports = instance.exports;
-        const memory = exports.memory;
-
-        // Write string to WASM memory
-        const encoder = new TextEncoder();
-        const bytes = encoder.encode(testString);
-        const view = new Uint8Array(memory.buffer);
-        view.set(bytes, 0); // Assuming hash function expects string at address 0
-
-        // Calculate hash using WASM
-        const wasmHash = exports.hash(0, bytes.length);
-
-        // Calculate hash using JS fallback
-        const jsHash = DynamicWasmGenerator.hashJs(testString, constants);
-
-        // The WASM and JS implementations should yield the same result
-        expect(wasmHash).toBe(jsHash);
-    });
-
-    it('should generate different WASM modules for different constants', () => {
-        const constants1 = { seed: 1, multiplier: 2, adder: 3 };
-        const constants2 = { seed: 4, multiplier: 5, adder: 6 };
-
-        const wasmBuffer1 = DynamicWasmGenerator.generate(constants1);
-        const wasmBuffer2 = DynamicWasmGenerator.generate(constants2);
-
-        expect(wasmBuffer1.toString('hex')).not.toBe(wasmBuffer2.toString('hex'));
-    });
+import { describe, expect, it } from 'vitest';
+import { DynamicWasmGenerator } from '../dynamic-wasm.js';
+
+// Helper function to decode ULEB128 (for verification)
+function decodeULEB128(bytes) {
+    let result = 0;
+    let shift = 0;
+    for (const byte of bytes) {
+        result |= (byte & 0x7f) << shift;
+        if (!(byte & 0x80)) {
+            break;
+        }
+        shift += 7;
+    }
+    return result;
+}
+
+describe('DynamicWasmGenerator', () => {
+    it('should generate a valid WASM module buffer', () => {
+        const constants = { seed: 123, multiplier: 33, adder: 7 };
+        const wasmBuffer = DynamicWasmGenerator.generate(constants);
+
+        // Basic check: ensure it's a Buffer and starts with WASM magic number
+        expect(wasmBuffer).toBeInstanceOf(Buffer);
+        expect(wasmBuffer.slice(0, 4).toString('hex')).toBe('0061736d'); // \0asm
+        expect(wasmBuffer.slice(4, 8).toString('hex')).toBe('01000000'); // Version 1
+
+        // Attempt to compile and instantiate the module to ensure validity
+        let instance;
+        try {
+            const module = new WebAssembly.Module(wasmBuffer);
+            instance = new WebAssembly.Instance(module, {});
+        } catch (e) {
+            // If compilation/instantiation fails, it's an invalid WASM module
+            expect.fail(`Generated WASM module is invalid: ${e.message}`);
+        }
+
+        // Verify the exported hash function exists
+        expect(instance.exports.hash).toBeInstanceOf(Function);
+        expect(instance.exports.memory).toBeInstanceOf(WebAssembly.Memory);
+    });
+
+    it('should produce a consistent hash result with the JS fallback', () => {
+        const constants = { seed: 42, multiplier: 1597334677, adder: 12345 };
+        const testString = "hello world";
+
+        const wasmBuffer = DynamicWasmGenerator.generate(constants);
+        const module = new WebAssembly.Module(wasmBuffer);
+        const instance = new WebAssembly.Instance(module, {});
+        const exports = instance.exports;
+        const memory = exports.memory;
+
+        // Write string to WASM memory
+        const encoder = new TextEncoder();
+        const bytes = encoder.encode(testString);
+        const view = new Uint8Array(memory.buffer);
+        view.set(bytes, 0); // Assuming hash function expects string at address 0
+
+        // Calculate hash using WASM
+        const wasmHash = exports.hash(0, bytes.length);
+
+        // Calculate hash using JS fallback
+        const jsHash = DynamicWasmGenerator.hashJs(testString, constants);
+
+        // The WASM and JS implementations should yield the same result
+        expect(wasmHash).toBe(jsHash);
+    });
+
+    it('should generate different WASM modules for different constants', () => {
+        const constants1 = { seed: 1, multiplier: 2, adder: 3 };
+        const constants2 = { seed: 4, multiplier: 5, adder: 6 };
+
+        const wasmBuffer1 = DynamicWasmGenerator.generate(constants1);
+        const wasmBuffer2 = DynamicWasmGenerator.generate(constants2);
+
+        expect(wasmBuffer1.toString('hex')).not.toBe(wasmBuffer2.toString('hex'));
+    });
 });

package/src/js/tests/fingerprint.client.init.test.js

@@ -17,8 +17,14 @@ Object.defineProperty(global, 'document', { value: dom.window.document, writable
 Object.defineProperty(global, 'navigator', { value: dom.window.navigator, writable: true });
 Object.defineProperty(global, 'screen', { value: dom.window.screen, writable: true });
 Object.defineProperty(global, 'performance', { value: dom.window.performance, writable: true });
+if (typeof globalThis.crypto !== 'undefined') {
+    Object.defineProperty(dom.window, 'crypto', { value: globalThis.crypto, writable: true, configurable: true });
+}
+Object.defineProperty(global, 'CustomEvent', { value: dom.window.CustomEvent, writable: true, configurable: true });
+Object.defineProperty(global, 'Event', { value: dom.window.Event, writable: true, configurable: true });
 
 global.fetch = vi.fn(); // Mock global fetch
+window.fetch = (...args) => global.fetch(...args);
 global.Headers = dom.window.Headers;
 global.Request = dom.window.Request;
 global.URL = dom.window.URL;
@@ -45,6 +51,7 @@ describe('ClientLibrary.initializeClient', () => {
         initHoneypotsSpy = vi.spyOn(ClientLibrary, 'initializeHoneypots');
         injectTrapsSpy = vi.spyOn(ClientLibrary, 'injectTrapLinks');
         initFetchSpy = vi.spyOn(ClientLibrary, 'initializeFetch');
+        window.fetch = (...args) => global.fetch(...args);
         injectPhantomTrapsSpy = vi.spyOn(ClientLibrary, 'injectPhantomTraps');
     });
 
@@ -144,4 +151,105 @@ describe('ClientLibrary.initializeClient', () => {
         expect(initFetchSpy).toHaveBeenCalledWith(config.fetch.targetDomains);
     });
 
+    it('should abort challenge retry loop when maxRetries is reached', async () => {
+        const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => {});
+        const mockResponse = {
+            status: 404,
+            headers: new Headers({ 'content-type': 'application/json' }),
+            bodyUsed: false,
+            json: vi.fn().mockResolvedValue({
+                challenge: { type: 'cpu_target', nonce: 'nonce-1', cpuTarget: '0000ffff' }
+            }),
+            clone() { return this; }
+        };
+
+        const result = await ClientLibrary.solveChallengeAndRetry(
+            mockResponse,
+            'http://localhost/api/data',
+            { _powRetryCount: 3 },
+            3
+        );
+
+        expect(result).toBe(mockResponse);
+        expect(mockResponse.json).not.toHaveBeenCalled();
+        expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('Challenge retry limit reached (3)'));
+    });
+
+    it('should inject phantom traps within closed shadow root and fire trigger on interaction', () => {
+        const onTriggerSpy = vi.spyOn(ClientLibrary, 'onHoneypotTrigger');
+        let capturedShadow = null;
+        const origAttachShadow = dom.window.Element.prototype.attachShadow;
+        vi.spyOn(dom.window.Element.prototype, 'attachShadow').mockImplementation(function (init) {
+            capturedShadow = origAttachShadow.call(this, init);
+            return capturedShadow;
+        });
+
+        // Ensure document.body exists
+        document.body.innerHTML = '';
+
+        ClientLibrary.injectPhantomTraps();
+
+        const host = document.body.lastElementChild;
+        expect(host).not.toBeNull();
+        expect(host.getAttribute('aria-hidden')).toBe('true');
+        // Under closed mode, host.shadowRoot is inaccessible (null) from external callers
+        expect(host.shadowRoot).toBeNull();
+        expect(capturedShadow).not.toBeNull();
+
+        // Dispatch events on attached phantom elements inside closed shadow root
+        const link = capturedShadow.querySelector('a');
+        expect(link).not.toBeNull();
+        link.dispatchEvent(new Event('focus'));
+        expect(onTriggerSpy).toHaveBeenCalled();
+    });
+
+    it('should inject trap links within closed shadow root and trigger on honeypot click', () => {
+        const onTriggerSpy = vi.spyOn(ClientLibrary, 'onHoneypotTrigger');
+        let capturedShadow = null;
+        const origAttachShadow = dom.window.Element.prototype.attachShadow;
+        vi.spyOn(dom.window.Element.prototype, 'attachShadow').mockImplementation(function (init) {
+            capturedShadow = origAttachShadow.call(this, init);
+            return capturedShadow;
+        });
+
+        document.body.innerHTML = '';
+
+        ClientLibrary.injectTrapLinks(['/trap-url-1', '/trap-url-2']);
+
+        const host = document.body.lastElementChild;
+        expect(host).not.toBeNull();
+        expect(host.getAttribute('aria-hidden')).toBe('true');
+        expect(host.shadowRoot).toBeNull(); // Closed Shadow DOM verification
+        expect(capturedShadow).not.toBeNull();
+
+        const link = capturedShadow.querySelector('a');
+        expect(link).not.toBeNull();
+        link.dispatchEvent(new Event('click'));
+        expect(onTriggerSpy).toHaveBeenCalled();
+    });
+
+    it('should initialize honeypot form inputs within closed shadow root', () => {
+        const onTriggerSpy = vi.spyOn(ClientLibrary, 'onHoneypotTrigger');
+        let capturedShadow = null;
+        const origAttachShadow = dom.window.Element.prototype.attachShadow;
+        vi.spyOn(dom.window.Element.prototype, 'attachShadow').mockImplementation(function (init) {
+            capturedShadow = origAttachShadow.call(this, init);
+            return capturedShadow;
+        });
+
+        document.body.innerHTML = '';
+
+        ClientLibrary.initializeHoneypots(['bot_field_trap']);
+
+        const host = document.body.lastElementChild;
+        expect(host).not.toBeNull();
+        expect(host.getAttribute('aria-hidden')).toBe('true');
+        expect(host.shadowRoot).toBeNull();
+        expect(capturedShadow).not.toBeNull();
+
+        const input = capturedShadow.querySelector('input');
+        expect(input).not.toBeNull();
+        input.dispatchEvent(new Event('input'));
+        expect(onTriggerSpy).toHaveBeenCalled();
+    });
 });

package/src/js/tests/fingerprint.test.js

@@ -906,8 +906,76 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(req.fingerprint.score).toBeGreaterThanOrEqual(blockThreshold);
         });
 
-        test('should redirect after a valid COMBINED (CPU+Mem) PoW solution is provided', async (context) => {
+        test('should redirect after a valid COMBINED (CPU+Mem) PoW solution is provided', async () => {
+            const ip = '127.0.0.1';
+            const originalPath = '/protected/combined';
+            const solverFingerprint = 'fp-combined-solution';
+            const userAgent = 'test-ua-combined';
+
+            vi.spyOn(__internal, 'getSuspicionVector').mockResolvedValue({
+                historyScore: 35,
+            });
+
+            const securityConfigWithLowDiff = {
+                ...securityConfig,
+                cpu: { minDifficultyBits: 4, ...securityConfig.cpu },
+            };
+            const middleware = powMiddleware(securityConfigWithLowDiff);
+
+            // 1. Déclencher le challenge
+            const req1 = {
+                path: originalPath, ip, cookies: {}, query: {},
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
+                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+            let challengeBody;
+            const res1 = {
+                status: () => res1,
+                send: (body) => { challengeBody = body; },
+                cookie: vi.fn()
+            };
+            req1.fingerprint = {};
+            await middleware(req1, res1, vi.fn());
+
+            expect(challengeBody).toContain('Enhanced Verification');
 
+            // 2. Résoudre le challenge
+            const nonce = challengeBody.match(/const nonce = "([^"]+)"/)[1];
+            const clientSecret = challengeBody.match(/const clientSecret = "([^"]+)"/)[1];
+            const cpuTargetHex = challengeBody.match(/const cpuTarget = BigInt\("0x" \+ "([^"]+)"\);/)[1];
+            const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
+
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:${ip}::`);
+            const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTargetHex, () => {});
+            const memSolution = await solveMemory(`:${nonce}:${clientSecret}`, memDifficulty);
+
+            // 3. Soumettre la solution
+            const req2 = {
+                path: originalPath, ip, cookies: {},
+                query: {
+                    pow_type: 'cpu_mem',
+                    pow_nonce: nonce,
+                    pow_solution_cpu: String(cpuSolution),
+                    pow_solution_mem: JSON.stringify(memSolution),
+                    pow_fp: solverFingerprint
+                },
+                headers: { 'user-agent': userAgent, 'x-device-fingerprint': solverFingerprint },
+                rawHeaders: ['User-Agent', userAgent], httpVersion: '1.1'
+            };
+            let capturedCookie;
+            const res2 = {
+                cookie: (name, value, options) => { capturedCookie = { name, value, options }; },
+                redirect: vi.fn(),
+                status: vi.fn(() => res2),
+                send: vi.fn(),
+            };
+
+            req2.fingerprint = {};
+            await middleware(req2, res2, vi.fn());
+
+            expect(res2.redirect).toHaveBeenCalledWith(originalPath);
+            expect(capturedCookie).toBeDefined();
+            expect(capturedCookie.name).toBe('pow_clearance');
         });
     });
 
@@ -1553,6 +1621,18 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(behaviorScore).toBe(0);
         });
 
+        it('should return a score of 0 when x-behavior-metrics is 1 (human verified client-side)', () => {
+            const context = { headers: { 'x-behavior-metrics': '1' } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(0);
+        });
+
+        it('should return a score of 100 when x-behavior-metrics is 0 (bot detected client-side)', () => {
+            const context = { headers: { 'x-behavior-metrics': '0' } };
+            const { behaviorScore } = getBehaviorScore(context);
+            expect(behaviorScore).toBe(100);
+        });
+
         it('should return a score of 100 for honeypot interaction', () => {
             const metrics = { honeypotInteraction: true, mouseEntropy: 50, keystrokeLatency: 120 };
             const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
@@ -1560,11 +1640,11 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(behaviorScore).toBe(100);
         });
 
-        it('should return a score of 40 for no mouse or keyboard activity', () => {
+        it('should return a score of 5 for no mouse or keyboard activity', () => {
             const metrics = { honeypotInteraction: false, mouseMovementsHistory: [], keystrokeLatency: 0 };
             const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
             const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(40);
+            expect(behaviorScore).toBe(5);
         });
 
         it('should return a score of 0 for normal user activity', () => {
@@ -2394,6 +2474,58 @@ describe('getClientHintsInconsistencyScore', () => {
     });
 });
 
+describe('getProtocolAnomalyScore (HTTP/2 Frame Analysis)', () => {
+    const { getProtocolAnomalyScore } = __internal;
+
+    test('should penalize spoofed Chromium with no PRIORITY frames', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,a,s,p|p:0,w:4,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(25.0);
+    });
+
+    test('should penalize spoofed Chromium with too few WINDOW_UPDATE frames', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,a,s,p|p:3,w:1,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(20.0);
+    });
+
+    test('should penalize spoofed Firefox with too many PRIORITY frames', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,s,p,a|p:3,w:2,c:0'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(20.0);
+    });
+
+    test('should not penalize a legitimate Chromium fingerprint', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:256|m,a,s,p|p:3,w:4,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
+        expect(protocolAnomalyScore).toBe(0.0);
+    });
+});
+
 describe('Subnet Scoring (Node.js)', () => {
     const inMemoryStore = {
         _map: new Map(),
@@ -3068,4 +3200,22 @@ describe('IP Registration and Filtering', () => {
             expect(process.env.ED25519_PUBLIC_KEY).toBe(dummyKeys.publicKey);
         });
     });
+
+    describe('Closed-Shadow DOM Honeypot Traps (Feature 19)', () => {
+        it('should generate closed declarative shadow DOM trap container for trap URLs', () => {
+            const trapUrls = ['/trap-1', '/trap-2'];
+            const markup = __internal.generateClosedShadowTraps(trapUrls);
+
+            expect(markup).toContain('aria-hidden="true"');
+            expect(markup).toContain('shadowrootmode="closed"');
+            expect(markup).toContain('shadowroot="closed"');
+            expect(markup).toContain('href="/trap-1"');
+            expect(markup).toContain('href="/trap-2"');
+        });
+
+        it('should return an empty string if trapUrls array is empty or invalid', () => {
+            expect(__internal.generateClosedShadowTraps([])).toBe('');
+            expect(__internal.generateClosedShadowTraps(null)).toBe('');
+        });
+    });
 });

package/src/js/tests/threatIntel.test.js

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it } from 'vitest';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
 import { __internal, configureStore } from '../fingerprint.js';
 
 describe('Threat Intelligence - Rationale-Driven Defensive Logic', () => {
@@ -73,4 +73,43 @@ describe('Threat Intelligence - Rationale-Driven Defensive Logic', () => {
         expect(vector.threatIntelScore).toBeGreaterThan(70.0);
         expect(vector.threatIntelScore).toBeLessThanOrEqual(95.0);
     });
+
+    it('should broadcast banned ZKP with differential privacy (perturbed timestamps and decoy injection)', async () => {
+        const calls = [];
+        const originalFetch = globalThis.fetch;
+        globalThis.fetch = vi.fn(async (url, init) => {
+            calls.push({ url, init });
+            return { ok: true, json: async () => ({ status: 'synchronized' }) };
+        });
+
+        const config = {
+            federatedPeers: ['https://peer1.example.com', 'https://peer2.example.com'],
+            federationSecret: 'test-secret-key-32-chars-long!!',
+            differentialPrivacy: {
+                enabled: true,
+                epsilon: 1.0,
+                dummyRate: 1.0 // Force decoy generation for deterministic testing
+            }
+        };
+
+        const realZkpY = 'deadbeef12345678';
+        await __internal.broadcastBannedZkp(realZkpY, config);
+
+        // Should broadcast to 2 peers with real key + 2 peers with decoy key
+        expect(calls.length).toBe(4);
+
+        const bodies = calls.map(c => JSON.parse(c.init.body));
+        const zkpYs = bodies.map(b => b.zkpY);
+
+        expect(zkpYs).toContain(realZkpY);
+        const decoyKey = zkpYs.find(k => k !== realZkpY);
+        expect(decoyKey).toBeDefined();
+        expect(decoyKey).not.toBe(realZkpY);
+
+        for (const call of calls) {
+            const timestamp = Number(call.init.headers['X-Federation-Timestamp']);
+            expect(timestamp).toBeGreaterThan(0);
+        }
+        globalThis.fetch = originalFetch;
+    });
 });

package/src/php/Challenge/ChallengeUtils.php

@@ -605,6 +605,11 @@ class ChallengeUtils
 
             if (!$expiry || (int)floor(microtime(true) * 1000) > (int)$expiry) {
                 return false;
+            }
+            if (!empty($ticketData['greenlist']) || str_starts_with((string)$storedDeviceHash, 'webauthn:greenlist:')) {
+                if (empty($deviceId) || $deviceId === $storedDeviceId) {
+                    return true;
+                }
             }
                 if ($storedDeviceHash && str_starts_with($storedDeviceHash, 'zkp:')) {
                     $expectedY = explode(':', $storedDeviceHash, 2)[1] ?? '';
@@ -644,6 +649,11 @@ class ChallengeUtils
             if (!$expiry || (int)floor(microtime(true) * 1000) > (int)$expiry) {
                 $store->delete("ticket:{$ticket}");
                 return false;
+            }
+            if (!empty($ticketData['greenlist']) || str_starts_with((string)$storedDeviceHash, 'webauthn:greenlist:')) {
+                if (empty($deviceId) || $deviceId === $storedDeviceId) {
+                    return true;
+                }
             }
                 if ($storedDeviceHash && str_starts_with($storedDeviceHash, 'zkp:')) {
                     $expectedY = explode(':', $storedDeviceHash, 2)[1] ?? '';
@@ -789,39 +799,38 @@ class ChallengeUtils
     /**
      * Vérifie le limiteur de débit Token Bucket pour les demandes de challenge d'un sous-réseau.
      */
-    public static function checkChallengeRateLimit(string $clientIp): bool
+    public static function checkChallengeRateLimit(string $clientIp, float $capacity = 5.0, float $refillRate = 0.1): bool
     {
-        $subnet = RequestUtils::getIpSubnet($clientIp);
-        if ($subnet === null) {
-            return false;
-        }
+        $subnet = RequestUtils::getIpSubnet($clientIp) ?? $clientIp;
 
         $store = StoreManager::getStore();
         $key = "rate-limit:{$subnet}";
-        $rateLimitData = $store->get($key) ?? [
-            'tokens' => 5.0,
-            'lastRefill' => microtime(true)
-        ];
-
-        $capacity = 5.0;
-        $refillRate = 0.1; // 1 token toutes les 10 secondes
         $now = microtime(true);
 
-        $elapsed = $now - $rateLimitData['lastRefill'];
-        $tokens = min($capacity, $rateLimitData['tokens'] + $elapsed * $refillRate);
+        $rateLimitData = $store->get($key);
+        if (!is_array($rateLimitData) || !isset($rateLimitData['tokens'], $rateLimitData['lastRefill'])) {
+            $rateLimitData = [
+                'tokens' => $capacity,
+                'lastRefill' => $now
+            ];
+        }
+
+        $elapsed = max(0.0, $now - (float)$rateLimitData['lastRefill']);
+        $tokens = min($capacity, (float)$rateLimitData['tokens'] + $elapsed * $refillRate);
+        $ttl = (int)max(60, ceil($capacity / max(0.1, $refillRate)));
 
         if ($tokens < 1.0) {
             $store->set($key, [
                 'tokens' => $tokens,
                 'lastRefill' => $now
-            ], 60);
+            ], $ttl);
             return false;
         }
 
         $store->set($key, [
             'tokens' => $tokens - 1.0,
             'lastRefill' => $now
-        ], 60);
+        ], $ttl);
 
         return true;
     }

package/src/php/Config/SecurityProfiles.php

@@ -43,6 +43,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 0.8,
                 'protocolAnomalyScore' => 0.8, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
                 'renderingAnomalyScore' => 0.8, // NEW: Anomalie de rendu
+                'mtuAnomalyScore' => 0.9, // NOUVEAU: Poids pour l'anomalie MTU/fragmentation
                 'ipReputationScore' => 0.5, // NOUVEAU: Poids pour la réputation IP
                 'virtualizationScore' => 0.8,
             ],
@@ -97,6 +98,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 1.0, // NEW: Anomalie de pile TCP/IP
                 'protocolAnomalyScore' => 1.0, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
                 'renderingAnomalyScore' => 1.0, // NEW: Anomalie de rendu
+                'mtuAnomalyScore' => 0.9,
 
             ],
             'thresholds' => ['low' => 10, 'medium' => 35, 'high' => 65, 'block' => 90],
@@ -149,6 +151,7 @@ class SecurityProfiles
                 'botnetClusterScore' => 0.7, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
                 'protocolAnomalyScore' => 0.8, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
+                'mtuAnomalyScore' => 0.9,
 
             ],
             'thresholds' => ['low' => 25, 'medium' => 50, 'high' => 80, 'block' => 95],
@@ -205,6 +208,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 0.5, // NEW: Anomalie de pile TCP/IP
                 'protocolAnomalyScore' => 0.5, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
                 'renderingAnomalyScore' => 0.5, // NEW: Anomalie de rendu
+                'mtuAnomalyScore' => 0.9,
 
             ],
             'thresholds' => ['low' => 25, 'medium' => 55, 'high' => 80, 'block' => 95],
@@ -259,6 +263,7 @@ class SecurityProfiles
                 'tcpAnomalyScore' => 0.9, // NEW: Anomalie de pile TCP/IP
                 'protocolAnomalyScore' => 0.9, // NEW: Anomalie de protocole (HTTP/2 et QUIC)
                 'renderingAnomalyScore' => 0.9, // NEW: Anomalie de rendu
+                'mtuAnomalyScore' => 0.9,
 
             ],
             'thresholds' => ['low' => 15, 'medium' => 40, 'high' => 70, 'block' => 90],