@anonympins/fingerprint 0.7.4 → 0.8.0

package/src/js/tests/fingerprint.builder.test.js

@@ -1,79 +1,77 @@
-import {describe, expect, it} from 'vitest';
-import {FingerprintBuilder} from '../fingerprint.builder.js';
-
-describe('FingerprintBuilder.compare', () => {
-
-    // Empreinte réaliste d'un utilisateur légitime (ex: Chrome sur Windows)
-    // C'est l'empreinte qui serait stockée lors de la première visite.
-    const realisticOriginalFp = new FingerprintBuilder()
-        .add('cvs', 'mock-canvas-data-v1')
-        .add('gpu', 'ANGLE (NVIDIA GeForce RTX 3080 Direct3D11 vs_5_0 ps_5_0)')
-        .add('hw', '16_8_0') // 16 cores, 8GB RAM, no touch
-        .add('os', 'Win32')
-        .add('ua', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36')
-        .add('ja3', '771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513,29-23-24,0')
-        // En-têtes qui peuvent changer lors de la requête de résolution du challenge
-        .add('cookie_keys', '_ga,session,device_id')
-        .add('upgrade', '1')
-        .toString();
-
-    it('should return a similarity score of 1.0 for the same device with minor volatile changes', () => {
-        // Scénario de succès : L'utilisateur résout un challenge.
-        // L'empreinte du solveur est presque identique, mais certains en-têtes "volatils"
-        // (comme la présence de cookies ou 'upgrade-insecure-requests') ont changé ou disparu.
-        // La fonction `compare` est conçue pour ignorer ces clés volatiles.
-        const realisticSolverFp = new FingerprintBuilder()
-            .add('cvs', 'mock-canvas-data-v1') // Identique
-            .add('gpu', 'ANGLE (NVIDIA GeForce RTX 3080 Direct3D11 vs_5_0 ps_5_0)') // Identique
-            .add('hw', '16_8_0') // Identique
-            .add('os', 'Win32') // Identique
-            .add('ua', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36') // Identique
-            .add('ja3', '771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513,29-23-24,0') // Identique
-            // La clé 'cookie_keys' est absente, simulant une requête sans cookies.
-            // La clé 'upgrade' est également absente.
-            .toString();
-
-        const similarity = FingerprintBuilder.compare(realisticOriginalFp, realisticSolverFp);
-
-        // La similarité doit être de 1.0 car toutes les différences concernent des clés volatiles
-        // qui sont ignorées par la comparaison.
-        expect(similarity).toBe(1.0);
-    });
-
-    it('should return a low similarity score for two completely different devices', () => {
-        // Scénario d'échec : Un attaquant a volé le cookie `device_id` et tente de
-        // résoudre un challenge depuis une machine différente (ex: un serveur Linux avec Firefox).
-        const differentSolverFp = new FingerprintBuilder()
-            .add('cvs', 'different-canvas-data') // Différent
-            .add('gpu', 'llvmpipe (LLVM 15.0.7, 256 bits)') // Différent (GPU de VM)
-            .add('hw', '8_4_0') // Différent
-            .add('os', 'Linux x86_64') // Différent
-            .add('ua', 'Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0') // Différent
-            .add('ja3', '771,49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,65281-11-10-35-16-5-13-51-45-43-27-23-17513,29-23-24,0') // Différent (JA3 de Firefox)
-            .toString();
-
-        const similarity = FingerprintBuilder.compare(realisticOriginalFp, differentSolverFp);
-
-        // La similarité doit être très faible (proche de 0) car tous les signaux forts sont différents.
-        expect(similarity).toBeLessThan(0.1);
-    });
-
-    it('should return 0 if one of the fingerprints is null or empty', () => {
-        expect(FingerprintBuilder.compare(realisticOriginalFp, null)).toBe(0);
-        expect(FingerprintBuilder.compare(null, realisticOriginalFp)).toBe(0);
-        expect(FingerprintBuilder.compare(realisticOriginalFp, '')).toBe(0);
-        expect(FingerprintBuilder.compare('', realisticOriginalFp)).toBe(0);
-        expect(FingerprintBuilder.compare(null, null)).toBe(0);
-    });
-
-    it('should handle fingerprints with missing components gracefully', () => {
-        const partialFp = new FingerprintBuilder()
-            .add('ua', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36')
-            .add('os', 'Win32')
-            .toString(); // Manque GPU, canvas, etc.
-
-        const similarity = FingerprintBuilder.compare(realisticOriginalFp, partialFp);
-        expect(similarity).toBeGreaterThan(0);
-        expect(similarity).toBeLessThan(1);
-    });
+import {describe, expect, it} from 'vitest';
+import {FingerprintBuilder} from '../fingerprint.builder.js';
+
+describe('FingerprintBuilder.compare', () => {
+
+    // Realistic fingerprint for a legitimate user (e.g. Chrome on Windows)
+    // Recorded during baseline initial visit.
+    const realisticOriginalFp = new FingerprintBuilder()
+        .add('cvs', 'mock-canvas-data-v1')
+        .add('gpu', 'ANGLE (NVIDIA GeForce RTX 3080 Direct3D11 vs_5_0 ps_5_0)')
+        .add('hw', '16_8_0') // 16 cores, 8GB RAM, no touch
+        .add('os', 'Win32')
+        .add('ua', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36')
+        .add('ja3', '771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513,29-23-24,0')
+        // Volatile headers that may legitimately change during challenge solving
+        .add('cookie_keys', '_ga,session,device_id')
+        .add('upgrade', '1')
+        .toString();
+
+    it('should return a similarity score of 1.0 for the same device with minor volatile changes', () => {
+        // Success scenario: user solves a challenge.
+        // Solver fingerprint is identical except for volatile headers
+        // (such as cookie presence or upgrade-insecure-requests) which compare ignores.
+        const realisticSolverFp = new FingerprintBuilder()
+            .add('cvs', 'mock-canvas-data-v1') // Identique
+            .add('gpu', 'ANGLE (NVIDIA GeForce RTX 3080 Direct3D11 vs_5_0 ps_5_0)') // Identique
+            .add('hw', '16_8_0') // Identique
+            .add('os', 'Win32') // Identique
+            .add('ua', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36') // Identique
+            .add('ja3', '771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513,29-23-24,0') // Identique
+            // 'cookie_keys' is omitted, simulating a request without cookies
+            // 'upgrade' header is also omitted
+            .toString();
+
+        const similarity = FingerprintBuilder.compare(realisticOriginalFp, realisticSolverFp);
+
+        // Similarity remains 1.0 because all differences reside in ignored volatile keys
+        expect(similarity).toBe(1.0);
+    });
+
+    it('should return a low similarity score for two completely different devices', () => {
+        // Failure scenario: attacker steals device_id cookie and attempts
+        // challenge resolution from a different machine (e.g. Linux VM with Firefox).
+        const differentSolverFp = new FingerprintBuilder()
+            .add('cvs', 'different-canvas-data') // Différent
+            .add('gpu', 'llvmpipe (LLVM 15.0.7, 256 bits)') // Différent (GPU de VM)
+            .add('hw', '8_4_0') // Différent
+            .add('os', 'Linux x86_64') // Différent
+            .add('ua', 'Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0') // Différent
+            .add('ja3', '771,49195-49199-52393-52392-49196-49200-49162-49161-49171-49172-156-157-47-53,65281-11-10-35-16-5-13-51-45-43-27-23-17513,29-23-24,0') // Différent (JA3 de Firefox)
+            .toString();
+
+        const similarity = FingerprintBuilder.compare(realisticOriginalFp, differentSolverFp);
+
+        // Similarity should be very low (close to 0) since invariant signals differ
+        expect(similarity).toBeLessThan(0.1);
+    });
+
+    it('should return 0 if one of the fingerprints is null or empty', () => {
+        expect(FingerprintBuilder.compare(realisticOriginalFp, null)).toBe(0);
+        expect(FingerprintBuilder.compare(null, realisticOriginalFp)).toBe(0);
+        expect(FingerprintBuilder.compare(realisticOriginalFp, '')).toBe(0);
+        expect(FingerprintBuilder.compare('', realisticOriginalFp)).toBe(0);
+        expect(FingerprintBuilder.compare(null, null)).toBe(0);
+    });
+
+    it('should handle fingerprints with missing components gracefully', () => {
+        const partialFp = new FingerprintBuilder()
+            .add('ua', 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36')
+            .add('os', 'Win32')
+            .toString(); // Missing GPU, canvas, etc.
+
+        const similarity = FingerprintBuilder.compare(realisticOriginalFp, partialFp);
+        expect(similarity).toBeGreaterThan(0);
+        expect(similarity).toBeLessThan(1);
+    });
 });

package/src/js/tests/fingerprint.client.init.test.js

@@ -21,6 +21,7 @@ if (typeof globalThis.crypto !== 'undefined') {
     Object.defineProperty(dom.window, 'crypto', { value: globalThis.crypto, writable: true, configurable: true });
 }
 Object.defineProperty(global, 'CustomEvent', { value: dom.window.CustomEvent, writable: true, configurable: true });
+Object.defineProperty(global, 'Event', { value: dom.window.Event, writable: true, configurable: true });
 
 global.fetch = vi.fn(); // Mock global fetch
 window.fetch = (...args) => global.fetch(...args);
@@ -174,4 +175,81 @@ describe('ClientLibrary.initializeClient', () => {
         expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('Challenge retry limit reached (3)'));
     });
 
+    it('should inject phantom traps within closed shadow root and fire trigger on interaction', () => {
+        const onTriggerSpy = vi.spyOn(ClientLibrary, 'onHoneypotTrigger');
+        let capturedShadow = null;
+        const origAttachShadow = dom.window.Element.prototype.attachShadow;
+        vi.spyOn(dom.window.Element.prototype, 'attachShadow').mockImplementation(function (init) {
+            capturedShadow = origAttachShadow.call(this, init);
+            return capturedShadow;
+        });
+
+        // Ensure document.body exists
+        document.body.innerHTML = '';
+
+        ClientLibrary.injectPhantomTraps();
+
+        const host = document.body.lastElementChild;
+        expect(host).not.toBeNull();
+        expect(host.getAttribute('aria-hidden')).toBe('true');
+        // Under closed mode, host.shadowRoot is inaccessible (null) from external callers
+        expect(host.shadowRoot).toBeNull();
+        expect(capturedShadow).not.toBeNull();
+
+        // Dispatch events on attached phantom elements inside closed shadow root
+        const link = capturedShadow.querySelector('a');
+        expect(link).not.toBeNull();
+        link.dispatchEvent(new Event('focus'));
+        expect(onTriggerSpy).toHaveBeenCalled();
+    });
+
+    it('should inject trap links within closed shadow root and trigger on honeypot click', () => {
+        const onTriggerSpy = vi.spyOn(ClientLibrary, 'onHoneypotTrigger');
+        let capturedShadow = null;
+        const origAttachShadow = dom.window.Element.prototype.attachShadow;
+        vi.spyOn(dom.window.Element.prototype, 'attachShadow').mockImplementation(function (init) {
+            capturedShadow = origAttachShadow.call(this, init);
+            return capturedShadow;
+        });
+
+        document.body.innerHTML = '';
+
+        ClientLibrary.injectTrapLinks(['/trap-url-1', '/trap-url-2']);
+
+        const host = document.body.lastElementChild;
+        expect(host).not.toBeNull();
+        expect(host.getAttribute('aria-hidden')).toBe('true');
+        expect(host.shadowRoot).toBeNull(); // Closed Shadow DOM verification
+        expect(capturedShadow).not.toBeNull();
+
+        const link = capturedShadow.querySelector('a');
+        expect(link).not.toBeNull();
+        link.dispatchEvent(new Event('click'));
+        expect(onTriggerSpy).toHaveBeenCalled();
+    });
+
+    it('should initialize honeypot form inputs within closed shadow root', () => {
+        const onTriggerSpy = vi.spyOn(ClientLibrary, 'onHoneypotTrigger');
+        let capturedShadow = null;
+        const origAttachShadow = dom.window.Element.prototype.attachShadow;
+        vi.spyOn(dom.window.Element.prototype, 'attachShadow').mockImplementation(function (init) {
+            capturedShadow = origAttachShadow.call(this, init);
+            return capturedShadow;
+        });
+
+        document.body.innerHTML = '';
+
+        ClientLibrary.initializeHoneypots(['bot_field_trap']);
+
+        const host = document.body.lastElementChild;
+        expect(host).not.toBeNull();
+        expect(host.getAttribute('aria-hidden')).toBe('true');
+        expect(host.shadowRoot).toBeNull();
+        expect(capturedShadow).not.toBeNull();
+
+        const input = capturedShadow.querySelector('input');
+        expect(input).not.toBeNull();
+        input.dispatchEvent(new Event('input'));
+        expect(onTriggerSpy).toHaveBeenCalled();
+    });
 });

package/src/js/tests/fingerprint.client.test.js

@@ -7,12 +7,12 @@ import ClientLibrary from '../fingerprint.client.js';
 
 describe('ClientLibrary WASM Integration', () => {
     beforeEach(() => {
-        // Réinitialise le cache et les mocks avant chaque test
+        // Reset cache and spies before each test
         ClientLibrary._resetCache();
         vi.spyOn(console, 'log').mockImplementation(() => {});
         vi.spyOn(console, 'warn').mockImplementation(() => {});
 
-        // Supprime les mocks globaux pour éviter les fuites entre les tests
+        // Remove global mocks to prevent leakage across tests
         delete window.createFingerprintModule;
     });
 
@@ -21,28 +21,27 @@ describe('ClientLibrary WASM Integration', () => {
     });
 
     it('should successfully load WASM module and switch hasher', async () => {
-        // 1. Simuler un module WASM fonctionnel
+        // 1. Mock functional WASM module
         const mockWasmModule = {
-            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
+            _hash_string: vi.fn((str) => 99999), // Distinct mock hash value
             _malloc: vi.fn().mockReturnValue(0),
             HEAPU8: new Uint8Array(4096)
         };
 
-        // 2. Simuler le chargement du script et l'initialisation du module
-        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
+        // 2. Mock script loading and module factory
         window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
 
-        // On simule l'injection du script en appelant directement `onload`
+        // Mock script element injection with direct onload callback
         vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            // Simule le chargement réussi du script
+            // Simulate successful script load
             script.onload();
             return script;
         });
 
-        // 3. Appeler la fonction d'initialisation
+        // 3. Initialize WASM module
         await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
 
-        // 4. Vérifier que le hasher a été remplacé
+        // 4. Verify hasher was switched
         const wasmHash = ClientLibrary._hasher("test");
         expect(wasmHash).toBe(99999);
         expect(mockWasmModule._hash_string).toHaveBeenCalledWith(0);
@@ -50,16 +49,16 @@ describe('ClientLibrary WASM Integration', () => {
     });
 
     it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
-        // 1. Simuler un échec de chargement du script
+        // 1. Simulate script loading failure
         vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
             script.onerror(new Error('Script loading failed'));
             return script;
         });
 
-        // 2. Appeler la fonction d'initialisation
+        // 2. Initialize WASM module
         await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
 
-        // 3. Vérifier que le hasher est toujours l'implémentation JS
+        // 3. Verify hasher falls back to JS implementation
         const jsHash = ClientLibrary._hasher("test");
         const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
         
@@ -68,7 +67,7 @@ describe('ClientLibrary WASM Integration', () => {
     });
 
     it('should gracefully fall back if WASM module does not export _hash_string', async () => {
-        // 1. Simuler un module WASM malformé (sans la fonction attendue)
+        // 1. Simulate malformed WASM module missing required export
         const mockWasmModule = {};
         window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
 
@@ -77,14 +76,14 @@ describe('ClientLibrary WASM Integration', () => {
             return script;
         });
 
-        // 2. Appeler la fonction d'initialisation
+        // 2. Initialize WASM module
         await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
 
-        // 3. Vérifier le fallback
+        // 3. Verify fallback
         const jsHash = ClientLibrary._hasher("test");
         const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
         expect(jsHash).toBe(originalJsHash); 
-        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
+        // Verify both generic error log and specific missing export cause
         expect(console.warn).toHaveBeenCalledWith(
             expect.stringContaining('WASM module failed to load'), 
             expect.objectContaining({ message: 'WASM module did not export _hash_string.' })

package/src/js/tests/fingerprint.test.js

@@ -1621,18 +1621,6 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(behaviorScore).toBe(0);
         });
 
-        it('should return a score of 0 when x-behavior-metrics is 1 (human verified client-side)', () => {
-            const context = { headers: { 'x-behavior-metrics': '1' } };
-            const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(0);
-        });
-
-        it('should return a score of 100 when x-behavior-metrics is 0 (bot detected client-side)', () => {
-            const context = { headers: { 'x-behavior-metrics': '0' } };
-            const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(100);
-        });
-
         it('should return a score of 100 for honeypot interaction', () => {
             const metrics = { honeypotInteraction: true, mouseEntropy: 50, keystrokeLatency: 120 };
             const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
@@ -3199,5 +3187,42 @@ describe('IP Registration and Filtering', () => {
             expect(process.env.ED25519_PRIVATE_KEY).toBe(dummyKeys.privateKey);
             expect(process.env.ED25519_PUBLIC_KEY).toBe(dummyKeys.publicKey);
         });
+
+        it('should generate issuer PEM files directly via generateIssuerPemKeys', async () => {
+            const fs = await import('node:fs');
+            const os = await import('node:os');
+            const path = await import('node:path');
+            const tempDir = path.join(os.tmpdir(), `fp-issuer-keys-${Date.now()}`);
+
+            try {
+                const keys = fingerprint.generateIssuerPemKeys(tempDir);
+                expect(keys.privateKeyPath).toContain('issuer-private.pem');
+                expect(keys.publicKeyPath).toContain('issuer-public.pem');
+                expect(keys.privateKey).toContain('-----BEGIN PRIVATE KEY-----');
+                expect(keys.publicKey).toContain('-----BEGIN PUBLIC KEY-----');
+                expect(fs.existsSync(keys.privateKeyPath)).toBe(true);
+                expect(fs.existsSync(keys.publicKeyPath)).toBe(true);
+            } finally {
+                fs.rmSync(tempDir, { recursive: true, force: true });
+            }
+        });
+    });
+
+    describe('Closed-Shadow DOM Honeypot Traps (Feature 19)', () => {
+        it('should generate closed declarative shadow DOM trap container for trap URLs', () => {
+            const trapUrls = ['/trap-1', '/trap-2'];
+            const markup = __internal.generateClosedShadowTraps(trapUrls);
+
+            expect(markup).toContain('aria-hidden="true"');
+            expect(markup).toContain('shadowrootmode="closed"');
+            expect(markup).toContain('shadowroot="closed"');
+            expect(markup).toContain('href="/trap-1"');
+            expect(markup).toContain('href="/trap-2"');
+        });
+
+        it('should return an empty string if trapUrls array is empty or invalid', () => {
+            expect(__internal.generateClosedShadowTraps([])).toBe('');
+            expect(__internal.generateClosedShadowTraps(null)).toBe('');
+        });
     });
 });