@anonympins/fingerprint 0.7.4 → 0.8.0

package/src/php/Tests/DnsCircuitBreakerTest.php

@@ -1,106 +1,106 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\FingerprintEngine;
-use PHPUnit\Framework\TestCase;
-use ReflectionClass;
-
-class DnsCircuitBreakerTest extends TestCase
-{
-    private ReflectionClass $reflection;
-
-    protected function setUp(): void
-    {
-        parent::setUp();
-        $this->reflection = new ReflectionClass(FingerprintEngine::class);
-
-        // Réinitialise l'état statique du disjoncteur avant chaque test
-        $this->setCircuitBreakerState([
-            'state' => 'CLOSED',
-            'failureCount' => 0,
-            'lastStateChange' => 0,
-            'threshold' => 5,
-            'cooldown' => 1, // 1 seconde de cooldown pour accélérer le test
-        ]);
-    }
-
-    private function getCircuitBreakerState(): array
-    {
-        $property = $this->reflection->getProperty('dnsCircuitBreaker');
-        if (PHP_VERSION_ID < 80100) {
-            $property->setAccessible(true);
-        }
-        return $property->getValue();
-    }
-
-    private function setCircuitBreakerState(array $state): void
-    {
-        $property = $this->reflection->getProperty('dnsCircuitBreaker');
-        if (PHP_VERSION_ID < 80100) {
-            $property->setAccessible(true);
-        }
-        $property->setValue(null, $state);
-    }
-
-    private function invokeMethod(string $methodName, array $args = [])
-    {
-        $method = $this->reflection->getMethod($methodName);
-        if (PHP_VERSION_ID < 80100) { // PHP 8.1.0
-            $method->setAccessible(true);
-        }
-        return $method->invokeArgs(null, $args);
-    }
-
-    public function testInitialStateIsClosed(): void
-    {
-        $this->assertTrue($this->invokeMethod('canAttemptDns'));
-        $state = $this->getCircuitBreakerState();
-        $this->assertSame('CLOSED', $state['state']);
-    }
-
-    public function testFailureThresholdTripsBreaker(): void
-    {
-        for ($i = 0; $i < 4; $i++) {
-            $this->invokeMethod('recordDnsFailure');
-            $this->assertTrue($this->invokeMethod('canAttemptDns'));
-            $state = $this->getCircuitBreakerState();
-            $this->assertSame('CLOSED', $state['state']);
-        }
-
-        $this->invokeMethod('recordDnsFailure');
-        $this->assertFalse($this->invokeMethod('canAttemptDns'));
-        $state = $this->getCircuitBreakerState();
-        $this->assertSame('OPEN', $state['state']);
-    }
-
-    public function testCooldownTransitionsToHalfOpen(): void
-    {
-        for ($i = 0; $i < 5; $i++) {
-            $this->invokeMethod('recordDnsFailure');
-        }
-        $this->assertFalse($this->invokeMethod('canAttemptDns'));
-
-        usleep(1100000); // 1.1s
-
-        $this->assertTrue($this->invokeMethod('canAttemptDns'));
-        $state = $this->getCircuitBreakerState();
-        $this->assertSame('HALF-OPEN', $state['state']);
-    }
-
-    public function testSuccessOnHalfOpenResetsBreaker(): void
-    {
-        for ($i = 0; $i < 5; $i++) {
-            $this->invokeMethod('recordDnsFailure');
-        }
-        usleep(1100000);
-        $this->assertTrue($this->invokeMethod('canAttemptDns'));
-
-        $this->invokeMethod('recordDnsSuccess');
-        $state = $this->getCircuitBreakerState();
-        $this->assertSame('CLOSED', $state['state']);
-        $this->assertSame(0, $state['failureCount']);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\FingerprintEngine;
+use PHPUnit\Framework\TestCase;
+use ReflectionClass;
+
+class DnsCircuitBreakerTest extends TestCase
+{
+    private ReflectionClass $reflection;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->reflection = new ReflectionClass(FingerprintEngine::class);
+
+        // Reset static circuit breaker state before each test
+        $this->setCircuitBreakerState([
+            'state' => 'CLOSED',
+            'failureCount' => 0,
+            'lastStateChange' => 0,
+            'threshold' => 5,
+            'cooldown' => 1, // 1 second cooldown for faster test execution
+        ]);
+    }
+
+    private function getCircuitBreakerState(): array
+    {
+        $property = $this->reflection->getProperty('dnsCircuitBreaker');
+        if (PHP_VERSION_ID < 80100) {
+            $property->setAccessible(true);
+        }
+        return $property->getValue();
+    }
+
+    private function setCircuitBreakerState(array $state): void
+    {
+        $property = $this->reflection->getProperty('dnsCircuitBreaker');
+        if (PHP_VERSION_ID < 80100) {
+            $property->setAccessible(true);
+        }
+        $property->setValue(null, $state);
+    }
+
+    private function invokeMethod(string $methodName, array $args = [])
+    {
+        $method = $this->reflection->getMethod($methodName);
+        if (PHP_VERSION_ID < 80100) { // PHP 8.1.0
+            $method->setAccessible(true);
+        }
+        return $method->invokeArgs(null, $args);
+    }
+
+    public function testInitialStateIsClosed(): void
+    {
+        $this->assertTrue($this->invokeMethod('canAttemptDns'));
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('CLOSED', $state['state']);
+    }
+
+    public function testFailureThresholdTripsBreaker(): void
+    {
+        for ($i = 0; $i < 4; $i++) {
+            $this->invokeMethod('recordDnsFailure');
+            $this->assertTrue($this->invokeMethod('canAttemptDns'));
+            $state = $this->getCircuitBreakerState();
+            $this->assertSame('CLOSED', $state['state']);
+        }
+
+        $this->invokeMethod('recordDnsFailure');
+        $this->assertFalse($this->invokeMethod('canAttemptDns'));
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('OPEN', $state['state']);
+    }
+
+    public function testCooldownTransitionsToHalfOpen(): void
+    {
+        for ($i = 0; $i < 5; $i++) {
+            $this->invokeMethod('recordDnsFailure');
+        }
+        $this->assertFalse($this->invokeMethod('canAttemptDns'));
+
+        usleep(1100000); // 1.1s
+
+        $this->assertTrue($this->invokeMethod('canAttemptDns'));
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('HALF-OPEN', $state['state']);
+    }
+
+    public function testSuccessOnHalfOpenResetsBreaker(): void
+    {
+        for ($i = 0; $i < 5; $i++) {
+            $this->invokeMethod('recordDnsFailure');
+        }
+        usleep(1100000);
+        $this->assertTrue($this->invokeMethod('canAttemptDns'));
+
+        $this->invokeMethod('recordDnsSuccess');
+        $state = $this->getCircuitBreakerState();
+        $this->assertSame('CLOSED', $state['state']);
+        $this->assertSame(0, $state['failureCount']);
+    }
 }

package/src/php/Tests/FingerprintClientTest.php

@@ -1,71 +1,71 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\FingerprintClient;
-use PHPUnit\Framework\TestCase;
-
-class FingerprintClientTest extends TestCase
-{
-    public function testDefaultConfigurationIncludesWasmAndDefaultPath(): void
-    {
-        $client = new FingerprintClient('/js/fingerprint.client.js');
-        $scriptTag = $client->getScriptTag();
-
-        // Vérifie que le script principal est présent
-        $this->assertStringContainsString('src="/js/fingerprint.client.js"', $scriptTag);
-
-        // Vérifie les configurations WASM par défaut dans l'objet sérialisé pour le JS
-        $this->assertStringContainsString('"wasm":true', $scriptTag);
-        $this->assertStringContainsString('"wasmPath":"\/fp.js"', $scriptTag);
-        $this->assertStringContainsString('wasmScript.src = config.wasmPath;', $scriptTag);
-    }
-
-    public function testWasmCanBeOverriddenOrDisabled(): void
-    {
-        $client = new FingerprintClient('/js/fingerprint.client.js', [
-            'wasm' => false,
-            'wasmPath' => '/custom/path/to/wasm.js'
-        ]);
-        $scriptTag = $client->getScriptTag();
-
-        // Vérifie que les surcharges sont correctement prises en compte
-        $this->assertStringContainsString('"wasm":false', $scriptTag);
-        $this->assertStringContainsString('"wasmPath":"\/custom\/path\/to\/wasm.js"', $scriptTag);
-    }
-
-    public function testGenerateHoneypotFieldAddsFieldToConfig(): void
-    {
-        $client = new FingerprintClient('/js/fingerprint.client.js');
-        
-        $honeypotFieldHtml = $client->generateHoneypotField('confirm_email_trap');
-        
-        // Vérifie le code HTML du champ Honeypot
-        $this->assertStringContainsString('name="confirm_email_trap"', $honeypotFieldHtml);
-        $this->assertStringContainsString('tabindex="-1"', $honeypotFieldHtml);
-        
-        // Vérifie que le champ s'enregistre dynamiquement dans la configuration JS finale
-        $scriptTag = $client->getScriptTag();
-        $this->assertStringContainsString('"honeypots":["confirm_email_trap"]', $scriptTag);
-    }
-
-    public function testNonceIsGeneratedAndAppliedToScripts(): void
-    {
-        $client = new FingerprintClient('/js/fingerprint.client.js');
-        $nonce = $client->getNonce();
-        
-        // Vérifie que le nonce est généré correctement (32 caractères hexa)
-        $this->assertNotNull($nonce);
-        $this->assertEquals(32, strlen($nonce));
-        
-        $scriptTag = $client->getScriptTag();
-        
-        // Le nonce doit être présent sur la balise script HTML
-        $this->assertStringContainsString('nonce="' . $nonce . '"', $scriptTag);
-        
-        // Et configuré dynamiquement lors de l'injection du script de chargement WASM
-        $this->assertStringContainsString('wasmScript.nonce = \'' . $nonce . '\'', $scriptTag);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\FingerprintClient;
+use PHPUnit\Framework\TestCase;
+
+class FingerprintClientTest extends TestCase
+{
+    public function testDefaultConfigurationIncludesWasmAndDefaultPath(): void
+    {
+        $client = new FingerprintClient('/js/fingerprint.client.js');
+        $scriptTag = $client->getScriptTag();
+
+        // Verify main script tag is present
+        $this->assertStringContainsString('src="/js/fingerprint.client.js"', $scriptTag);
+
+        // Verify default WASM configuration serialized for JS runtime
+        $this->assertStringContainsString('"wasm":true', $scriptTag);
+        $this->assertStringContainsString('"wasmPath":"\/fp.js"', $scriptTag);
+        $this->assertStringContainsString('wasmScript.src = config.wasmPath;', $scriptTag);
+    }
+
+    public function testWasmCanBeOverriddenOrDisabled(): void
+    {
+        $client = new FingerprintClient('/js/fingerprint.client.js', [
+            'wasm' => false,
+            'wasmPath' => '/custom/path/to/wasm.js'
+        ]);
+        $scriptTag = $client->getScriptTag();
+
+        // Verify configuration overrides are properly applied
+        $this->assertStringContainsString('"wasm":false', $scriptTag);
+        $this->assertStringContainsString('"wasmPath":"\/custom\/path\/to\/wasm.js"', $scriptTag);
+    }
+
+    public function testGenerateHoneypotFieldAddsFieldToConfig(): void
+    {
+        $client = new FingerprintClient('/js/fingerprint.client.js');
+        
+        $honeypotFieldHtml = $client->generateHoneypotField('confirm_email_trap');
+        
+        // Verify HTML markup of the honeypot field
+        $this->assertStringContainsString('name="confirm_email_trap"', $honeypotFieldHtml);
+        $this->assertStringContainsString('tabindex="-1"', $honeypotFieldHtml);
+        
+        // Verify field dynamically registers with client-side configuration
+        $scriptTag = $client->getScriptTag();
+        $this->assertStringContainsString('"honeypots":["confirm_email_trap"]', $scriptTag);
+    }
+
+    public function testNonceIsGeneratedAndAppliedToScripts(): void
+    {
+        $client = new FingerprintClient('/js/fingerprint.client.js');
+        $nonce = $client->getNonce();
+        
+        // Verify nonce generation format (32 hex characters)
+        $this->assertNotNull($nonce);
+        $this->assertEquals(32, strlen($nonce));
+        
+        $scriptTag = $client->getScriptTag();
+        
+        // Nonce must be attached to HTML script tag
+        $this->assertStringContainsString('nonce="' . $nonce . '"', $scriptTag);
+        
+        // And dynamically set during WASM loader script injection
+        $this->assertStringContainsString('wasmScript.nonce = \'' . $nonce . '\'', $scriptTag);
+    }
 }

package/src/php/Tests/PowTest.php

@@ -1,40 +1,38 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\Config\SecurityProfiles;
-use Anonympins\Fingerprint\FingerprintEngine;
-use Anonympins\Fingerprint\ProblemManager;
-use Anonympins\Fingerprint\Store\InMemoryStore;
-use Anonympins\Fingerprint\Store\StoreManager;
-use PHPUnit\Framework\TestCase;
-
-class PowTest extends TestCase
-{
-    private FingerprintEngine $engine;
-
-    protected function setUp(): void
-    {
-        // 1. Configurer un store en mémoire pour l'isolation des tests.
-        $store = new InMemoryStore();
-        StoreManager::configureStore($store);
-
-        // 2. Initialiser le ProblemManager avec une configuration et un store valides.
-        // C'est l'étape cruciale qui manquait.
-        $configPath = dirname(__FILE__) . '/config/problems.config.json';
-        ProblemManager::getInstance($configPath, $store);
-
-        // 3. Créer l'instance du moteur.
-        $this->engine = new FingerprintEngine(SecurityProfiles::createSecurityProfile('balanced'));
-    }
-
-    public function testGetProblemsIsExposedForTesting(): void
-    {
-        // Cette méthode appelle ProblemManager::getInstance() en interne.
-        // Grâce au setUp(), l'instance est déjà initialisée et le test passe.
-        $problems = $this->engine->getProblems();
-        $this->assertIsArray($problems);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\Config\SecurityProfiles;
+use Anonympins\Fingerprint\FingerprintEngine;
+use Anonympins\Fingerprint\ProblemManager;
+use Anonympins\Fingerprint\Store\InMemoryStore;
+use Anonympins\Fingerprint\Store\StoreManager;
+use PHPUnit\Framework\TestCase;
+
+class PowTest extends TestCase
+{
+    private FingerprintEngine $engine;
+
+    protected function setUp(): void
+    {
+        // 1. Configure an in-memory store for test isolation.
+        $store = new InMemoryStore();
+        StoreManager::configureStore($store);
+
+        // 2. Initialize ProblemManager with a valid configuration and store.
+        $configPath = dirname(__FILE__) . '/config/problems.config.json';
+        ProblemManager::getInstance($configPath, $store);
+
+        // 3. Create engine instance.
+        $this->engine = new FingerprintEngine(SecurityProfiles::createSecurityProfile('balanced'));
+    }
+
+    public function testGetProblemsIsExposedForTesting(): void
+    {
+        // Calls ProblemManager::getInstance() internally; setUp() ensures valid initialization.
+        $problems = $this->engine->getProblems();
+        $this->assertIsArray($problems);
+    }
 }

package/src/php/Tests/QuicFingerprintTest.php

@@ -1,54 +1,116 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\RequestContext;
-use Anonympins\Fingerprint\Utils\RequestUtils;
-use PHPUnit\Framework\TestCase;
-
-class QuicFingerprintTest extends TestCase
-{
-    public function testGetProtocolAnomalyScoreReturnsZeroIfNoFp(): void
-    {
-        $context = $this->createMock(RequestContext::class);
-        $context->method('getHeader')->willReturn(null);
-        $res = RequestUtils::getProtocolAnomalyScore($context);
-        $this->assertEquals(0.0, $res['protocolAnomalyScore']);
-    }
-
-    public function testGetProtocolAnomalyScoreDetectsSpoofedChrome(): void
-    {
-        $context = $this->createMock(RequestContext::class);
-        $context->method('getHeader')->willReturnCallback(function($name) {
-            if ($name === 'user-agent') {
-                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
-            }
-            if ($name === 'x-quic-fp') {
-                return '1;1=65536,4=50;i=0';
-            }
-            return null;
-        });
-
-        $res = RequestUtils::getProtocolAnomalyScore($context);
-        $this->assertEquals(100.0, $res['protocolAnomalyScore']);
-    }
-
-    public function testGetProtocolAnomalyScoreAllowsLegitChrome(): void
-    {
-        $context = $this->createMock(RequestContext::class);
-        $context->method('getHeader')->willReturnCallback(function($name) {
-            if ($name === 'user-agent') {
-                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
-            }
-            if ($name === 'x-quic-fp') {
-                return '1;1=1572864,4=100;u=2,i';
-            }
-            return null;
-        });
-
-        $res = RequestUtils::getProtocolAnomalyScore($context);
-        $this->assertEquals(0.0, $res['protocolAnomalyScore']);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class QuicFingerprintTest extends TestCase
+{
+    public function testGetProtocolAnomalyScoreReturnsZeroIfNoFp(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturn(null);
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertEquals(0.0, $res['protocolAnomalyScore']);
+    }
+
+    public function testGetProtocolAnomalyScoreDetectsSpoofedChrome(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+            }
+            if ($name === 'x-quic-fp') {
+                return '1;1=65536,4=50;i=0';
+            }
+            return null;
+        });
+
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertEquals(100.0, $res['protocolAnomalyScore']);
+    }
+
+    public function testGetProtocolAnomalyScoreAllowsLegitChrome(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+            }
+            if ($name === 'x-quic-fp') {
+                return '1;1=1572864,4=100;u=2,i';
+            }
+            return null;
+        });
+
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertEquals(0.0, $res['protocolAnomalyScore']);
+    }
+
+    public function testRfc9218PriorityWithoutIncrementalFlag(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+            if ($name === 'x-quic-fp') return '1;1=1572864,4=100;u=2'; // Manque le drapeau 'i'
+            return null;
+        });
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertEquals(40.0, $res['quicAnomalyScore']);
+    }
+
+    public function testCompressionRatioPenalty(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+            if ($name === 'x-compression-info') return 'req_count:5,hpack_ratio:0.2';
+            return null;
+        });
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertEquals(40.0, $res['http2AnomalyScore']);
+    }
+
+    public function testRfc9218UrgencyOutOfRange(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+            if ($name === 'x-quic-fp') return '1;1=1572864,4=100;u=9,i';
+            return null;
+        });
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertGreaterThanOrEqual(50.0, $res['quicAnomalyScore']);
+    }
+
+    public function testHttp2DefaultGoScraperDependencyTree(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+            if ($name === 'x-http2-fingerprint') return 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:16|m,a,s,p|p:3,w:4,c:1';
+            return null;
+        });
+        $context->httpVersion = '2.0';
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertGreaterThanOrEqual(55.0, $res['http2AnomalyScore']);
+    }
+
+    public function testScraperWithZeroDynamicTableEntries(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+            if ($name === 'x-compression-info') return 'req_count:5,dynamic_table_entries:0';
+            return null;
+        });
+        $context->httpVersion = '2.0';
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertGreaterThanOrEqual(45.0, $res['http2AnomalyScore']);
+    }
 }

package/src/php/Tests/ThreatIntelTest.php

@@ -61,4 +61,38 @@ class ThreatIntelTest extends TestCase
         $this->assertGreaterThan(75.0, $score);
         $this->assertLessThanOrEqual(95.0, $score);
     }
+
+    public function testDifferentialPrivacyDecoyInjectionAndTimestampNoise(): void
+    {
+        $config = [
+            'federatedPeers' => ['https://peer1.example.com'],
+            'federationSecret' => 'test-secret-key-32-chars-long!!',
+            'differentialPrivacy' => [
+                'enabled' => true,
+                'epsilon' => 1.0,
+                'dummyRate' => 1.0 // Force decoy injection for test
+            ]
+        ];
+
+        $postedCalls = [];
+        $engineSub = new class($config, $postedCalls) extends \Anonympins\Fingerprint\FingerprintEngine {
+            public array $calls = [];
+            public function __construct(array $cfg, array &$callsRef) {
+                $this->calls = &$callsRef;
+                parent::__construct($cfg);
+            }
+            protected function asyncPost(string $url, array $params): void {
+                $this->calls[] = ['url' => $url, 'params' => $params];
+            }
+        };
+
+        $refSub = new \ReflectionClass($engineSub);
+        $broadcastMethod = $refSub->getMethod('broadcastBannedZkp');
+        $broadcastMethod->setAccessible(true);
+
+        $realZkpY = 'realzkpykey12345';
+        $broadcastMethod->invoke($engineSub, $realZkpY);
+
+        $this->assertCount(2, $postedCalls, 'Should broadcast both real and decoy keys');
+    }
 }