@anonympins/fingerprint 0.7.5 → 0.8.1

package/src/php/WordPress/package.php

@@ -3,8 +3,8 @@
 declare(strict_types=1);
 
 /**
- * Script d'empaquetage automatique du plugin WordPress.
- * Copie les classes du moteur PHP, les assets JS et génère un ZIP prêt à être installé.
+ * Automated packaging script for the WordPress plugin.
+ * Copies PHP engine classes, JS assets, and creates an installation-ready ZIP archive.
  *
  * Usage:
  *   php src/php/WordPress/package.php
@@ -20,13 +20,13 @@ $phpSrcDir = $rootDir . '/src/php';
 $jsSrcDir = $rootDir . '/src/js';
 $wpDir = $phpSrcDir . '/WordPress';
 $distDir = $rootDir . '/public';
-$pluginSlug = 'fingerprint-anti-bot';
+$pluginSlug = 'anonympins-bot-mitigation-pow';
 $buildDir = $distDir . '/' . $pluginSlug;
 $zipFile = $distDir . '/' . $pluginSlug . '.zip';
 
-echo "==> Début du packaging du plugin WordPress...\n";
+echo "==> Packaging WordPress plugin...\n";
 
-// 1. Nettoyage du répertoire de build précédent
+// 1. Clean previous build directory
 if (is_dir($buildDir)) {
     $iterator = new RecursiveIteratorIterator(
         new RecursiveDirectoryIterator($buildDir, FilesystemIterator::SKIP_DOTS),
@@ -44,115 +44,104 @@ if (file_exists($zipFile)) {
 @mkdir($buildDir . '/src', 0777, true);
 @mkdir($buildDir . '/assets', 0777, true);
 @mkdir($buildDir . '/languages', 0777, true);
+@mkdir($buildDir . '/config', 0777, true);
+
+// 2. Copy main WordPress plugin files
+copy($wpDir . '/anonympins-bot-mitigation-pow.php', $buildDir . '/anonympins-bot-mitigation-pow.php');
+copy($wpDir . '/WpDbStore.php', $buildDir . '/WpDbStore.php');
+if (file_exists($wpDir . '/readme.txt')) {
+    copy($wpDir . '/readme.txt', $buildDir . '/readme.txt');
+}
+
+// 2.b Compile and copy language files (PO -> MO)
+$languagesDir = $wpDir . '/languages';
+if (is_dir($languagesDir)) {
+    $poFiles = glob($languagesDir . '/*.po') ?: [];
+    foreach ($poFiles as $poFile) {
+        $filename = basename($poFile);
+        copy($poFile, $buildDir . '/languages/' . $filename);
+
+        $moFile = preg_replace('/\.po$/', '.mo', $poFile);
+        // Compile PO to binary MO if missing or outdated
+        if (!file_exists($moFile) || filemtime($poFile) > filemtime($moFile)) {
+            compilePoToMo($poFile, $moFile);
+        }
+        if (file_exists($moFile)) {
+            copy($moFile, $buildDir . '/languages/' . basename($moFile));
+        }
+    }
+}
 
 /**
- * Compile un fichier .po gettext en binaire .mo compatible WordPress.
+ * Minimal native PHP PO -> binary gettext MO compiler
  */
-function compilePoToMo(string $poFile, string $moFile): bool {
-    if (!file_exists($poFile)) return false;
-    $content = file_get_contents($poFile);
-    if ($content === false) return false;
-
+function compilePoToMo(string $poPath, string $moPath): void {
+    $content = (string)file_get_contents($poPath);
+    $pattern = '/msgid\s+("(?:[^"\\\\]|\\\\.)*")\s+msgstr\s+("(?:[^"\\\\]|\\\\.)*")/s';
+    if (!preg_match_all($pattern, $content, $matches, PREG_SET_ORDER)) {
+        return;
+    }
     $entries = [];
-    $currentMsgId = null;
-    $currentMsgStr = null;
-    $lines = explode("\n", str_replace(["\r\n", "\r"], "\n", $content));
-    $state = '';
-
-    foreach ($lines as $line) {
-        $line = trim($line);
-        if ($line === '' || str_starts_with($line, '#')) continue;
-        if (preg_match('/^msgid\s+"(.*)"$/', $line, $m)) {
-            if ($currentMsgId !== null && $currentMsgStr !== null) {
-                $entries[$currentMsgId] = $currentMsgStr;
-            }
-            $currentMsgId = stripcslashes($m[1]);
-            $currentMsgStr = null;
-            $state = 'msgid';
-        } elseif (preg_match('/^msgstr\s+"(.*)"$/', $line, $m)) {
-            $currentMsgStr = stripcslashes($m[1]);
-            $state = 'msgstr';
-        } elseif (preg_match('/^"(.*)"$/', $line, $m)) {
-            if ($state === 'msgid') {
-                $currentMsgId .= stripcslashes($m[1]);
-            } elseif ($state === 'msgstr') {
-                $currentMsgStr .= stripcslashes($m[1]);
-            }
+    foreach ($matches as $m) {
+        $orig = stripcslashes(substr($m[1], 1, -1));
+        $trans = stripcslashes(substr($m[2], 1, -1));
+        if ($orig !== '' && $trans !== '') {
+            $entries[$orig] = $trans;
         }
     }
-    if ($currentMsgId !== null && $currentMsgStr !== null) {
-        $entries[$currentMsgId] = $currentMsgStr;
-    }
-
     ksort($entries);
     $count = count($entries);
-    $originals = '';
-    $translations = '';
-    $origTable = [];
-    $transTable = [];
-
-    $headerSize = 28;
-    $tablesSize = $count * 8 * 2;
-    $curOffset = $headerSize + $tablesSize;
-
+    $originalsTable = '';
+    $translationsTable = '';
+    $origOffsets = [];
+    $transOffsets = [];
+    $headerLength = 28 + ($count * 8) * 2;
+    $currentOffset = $headerLength;
     foreach ($entries as $orig => $trans) {
-        $origLen = strlen($orig);
-        $origTable[] = ['len' => $origLen, 'off' => $curOffset + strlen($originals)];
-        $originals .= $orig . "\0";
+        $origOffsets[] = ['len' => strlen($orig), 'off' => $currentOffset];
+        $currentOffset += strlen($orig) + 1;
     }
-
-    $transOffset = $curOffset + strlen($originals);
     foreach ($entries as $orig => $trans) {
-        $transLen = strlen($trans);
-        $transTable[] = ['len' => $transLen, 'off' => $transOffset + strlen($translations)];
-        $translations .= $trans . "\0";
-    }
-
-    $mo = pack('V*',
-        0x950412de, // Magic Number
-        0,          // Revision
-        $count,     // Number of strings
-        28,         // Offset of table with original string lengths and offsets
-        28 + ($count * 8), // Offset of table with translation string lengths and offsets
-        0, 0        // Hash table size and offset
-    );
-
-    foreach ($origTable as $t) {
-        $mo .= pack('VV', $t['len'], $t['off']);
-    }
-    foreach ($transTable as $t) {
-        $mo .= pack('VV', $t['len'], $t['off']);
+        $transOffsets[] = ['len' => strlen($trans), 'off' => $currentOffset];
+        $currentOffset += strlen($trans) + 1;
     }
-    $mo .= $originals . $translations;
-    return file_put_contents($moFile, $mo) !== false;
+    $binary = pack('V7', 0x950412de, 0, $count, 28, 28 + ($count * 8), 0, 0);
+    foreach ($origOffsets as $o) { $binary .= pack('V2', $o['len'], $o['off']); }
+    foreach ($transOffsets as $t) { $binary .= pack('V2', $t['len'], $t['off']); }
+    foreach ($entries as $orig => $trans) { $binary .= $orig . "\0"; }
+    foreach ($entries as $orig => $trans) { $binary .= $trans . "\0"; }
+    file_put_contents($moPath, $binary);
 }
 
-// 2. Copie des fichiers principaux du plugin WordPress
-copy($wpDir . '/fingerprint-anti-bot.php', $buildDir . '/fingerprint-anti-bot.php');
-copy($wpDir . '/WpDbStore.php', $buildDir . '/WpDbStore.php');
-if (file_exists($wpDir . '/readme.txt')) {
-    copy($wpDir . '/readme.txt', $buildDir . '/readme.txt');
-}
-
-// 3. Copie des assets clients nécessaires (solveur PoW)
+// 3. Copy required client assets (PoW solver and client bundle without external CDN)
 $solverSource = $jsSrcDir . '/pow.solver.inline.js';
 if (file_exists($solverSource)) {
-    copy($solverSource, $buildDir . '/assets/pow.solver.inline.js');
+    $solverContent = (string)file_get_contents($solverSource);
+    // Neutralize remote CDN scripts prohibited by WordPress.org guidelines
+    $solverContent = str_replace(
+        ["'https://cdn.jsdelivr.net/npm/onnxruntime-web/dist/ort.min.js'", "'https://cdn.jsdelivr.net/npm/@tensorflow/tfjs/dist/tf.min.js'"],
+        ["''", "''"],
+        $solverContent
+    );
+    file_put_contents($buildDir . '/assets/pow.solver.inline.js', $solverContent);
+}
+$clientSource = file_exists($jsSrcDir . '/fingerprint.client.obfuscated.js')
+    ? $jsSrcDir . '/fingerprint.client.obfuscated.js'
+    : $jsSrcDir . '/fingerprint.client.js';
+if (file_exists($clientSource)) {
+    copy($clientSource, $buildDir . '/assets/fingerprint.client.js');
 }
 
-// 4. Copie et compilation des fichiers de traduction i18n (FR / DE / EN)
-$langSourceDir = $wpDir . '/languages';
-if (is_dir($langSourceDir)) {
-    foreach (glob($langSourceDir . '/*.po') as $poFile) {
-        $baseName = basename($poFile);
-        copy($poFile, $buildDir . '/languages/' . $baseName);
-        $moTarget = $buildDir . '/languages/' . preg_replace('/\.po$/', '.mo', $baseName);
-        compilePoToMo($poFile, $moTarget);
-        compilePoToMo($poFile, $langSourceDir . '/' . preg_replace('/\.po$/', '.mo', $baseName));
+// 3.b Copy problem/bot configuration assets
+$configSourceDir = $rootDir . '/config';
+if (is_dir($configSourceDir)) {
+    $configFiles = glob($configSourceDir . '/*.json') ?: [];
+    foreach ($configFiles as $cfgFile) {
+        copy($cfgFile, $buildDir . '/config/' . basename($cfgFile));
     }
 }
 
-// 5. Copie récursive de la bibliothèque PHP (src/php -> build/src), en excluant les dossiers de dev
+// 4. Recursively copy PHP library (src/php -> build/src), excluding dev folders
 $excludeDirs = ['WordPress', 'Tests', 'bin'];
 $phpIterator = new RecursiveIteratorIterator(
     new RecursiveDirectoryIterator($phpSrcDir, FilesystemIterator::SKIP_DOTS),
@@ -177,9 +166,9 @@ foreach ($phpIterator as $item) {
     }
 }
 
-echo "==> Fichiers copiés dans {$buildDir}\n";
+echo "==> Files copied to {$buildDir}\n";
 
-// 5. Création de l'archive ZIP
+// 5. Create ZIP archive
 $zip = new ZipArchive();
 if ($zip->open($zipFile, ZipArchive::CREATE | ZipArchive::OVERWRITE) !== true) {
     fwrite(STDERR, "Erreur : Impossible de créer le fichier {$zipFile}\n");
@@ -194,7 +183,7 @@ $distIterator = new RecursiveIteratorIterator(
 foreach ($distIterator as $file) {
     if (!$file->isDir()) {
         $filePath = $file->getPathname();
-        // Préserve le préfixe du dossier racine dans le ZIP : fingerprint-anti-bot/...
+        // Preserve plugin root directory prefix in archive: anonympins-bot-mitigation-pow/...
         $relativePath = $pluginSlug . '/' . substr($filePath, strlen($buildDir) + 1);
         $zip->addFile($filePath, str_replace('\\', '/', $relativePath));
     }
@@ -216,6 +205,6 @@ function removeDirectory(string $dir): void
 $zip->close();
 removeDirectory($buildDir);
 $sizeKb = round(filesize($zipFile) / 1024, 2);
-echo "==> Archive ZIP générée avec succès :\n";
-echo "    Fichier : {$zipFile} ({$sizeKb} Ko)\n";
-echo "    Prêt à être installé via wp-admin ou déployé en production !\n";
+echo "==> ZIP archive generated successfully:\n";
+echo "    File: {$zipFile} ({$sizeKb} KB)\n";
+echo "    Ready to be installed via wp-admin or deployed to production.\n";

package/src/php/WordPress/readme.txt

@@ -1,10 +1,10 @@
-=== Fingerprint Anti-Bot & Proof-of-Work ===
+=== Anonympins Bot Mitigation with Proof-of-Work ===
 Contributors: anonympins
 Tags: bot protection, security, proof of work, firewall, anti scraping
 Requires at least: 5.9
-Tested up to: 7.1
+Tested up to: 6.7
 Requires PHP: 8.0
-Stable tag: 0.7.5
+Stable tag: 0.8.1
 License: MIT
 License URI: https://opensource.org/licenses/MIT
 
@@ -12,20 +12,22 @@ High-performance client-side anti-bot protection and Proof-of-Work challenge ver
 
 == Description ==
 
-Fingerprint Anti-Bot is a high-performance, privacy-friendly bot mitigation engine for WordPress. It combines behavioral telemetry, TLS/HTTP2/QUIC transport inspection (JA3, JA4), passive TCP/IP stack analysis, and asynchronous Proof-of-Work (PoW) verification.
+Anonympins Bot Mitigation with Proof-of-Work is a high-performance, privacy-friendly bot mitigation engine for WordPress. It combines behavioral telemetry, TLS/HTTP2/QUIC transport inspection (JA3, JA4), passive TCP/IP stack analysis, and asynchronous Proof-of-Work (PoW) verification.
 
 = Features =
 * Transparent protection against scrapers, credential stuffers, and inventory scalpers.
 * Multi-layered behavioral analysis (mouse, keystrokes, touch dynamics).
 * Cryptographic Proof-of-Work challenges (CPU and Memory bound) without third-party CAPTCHA cookies or trackers.
 * Prometheus-compatible metrics endpoint for monitoring and observability.
+* Dedicated Sandbox / Dry-Run mode with IP targeting for testing without blocking legitimate traffic.
 * Tailored security profiles for Frontend, Admin Area (wp-login), and REST API endpoints.
+* Real-time suspicion vector inspection via Server-Sent Events (SSE), REST telemetry, and DOM CustomEvents.
 
 == Installation ==
 
-1. Upload the plugin files to the `/wp-content/plugins/fingerprint-anti-bot` directory, or install the plugin through the WordPress plugins screen directly.
+1. Upload the plugin files to the `/wp-content/plugins/anonympins-bot-mitigation-pow` directory, or install the plugin through the WordPress plugins screen directly.
 2. Activate the plugin through the 'Plugins' screen in WordPress.
-3. Navigate to **Settings -> Fingerprint Anti-Bot** to review security profiles, threshold adjustments, and Prometheus metrics.
+3. Navigate to **Settings -> Anonympins Bot Mitigation** to review security profiles, threshold adjustments, and Prometheus metrics.
 
 == Frequently Asked Questions ==
 
@@ -34,3 +36,23 @@ No. All evaluations, challenges, and validations occur directly on your WordPres
 
 = Is HTTPS required? =
 HTTPS is strongly recommended. Under unencrypted HTTP, modern browsers disable the Web Cryptography API (`crypto.subtle`), which reduces challenge verification performance.
+
+= How do I scrape the Prometheus metrics endpoint? =
+Metrics can be accessed in standard Prometheus text exposition format via:
+1. The REST API endpoint: `GET /wp-json/fingerprint/v1/metrics` (Requires `manage_options` permission or a custom authorization callback hooked into the `fingerprint_metrics_access` filter).
+2. Direct path endpoint: `GET /metrics` (Evaluated in early execution lifecycle; filterable with `fingerprint_metrics_authorization`).
+3. The admin dashboard: **Settings -> Anonympins Bot Mitigation -> Prometheus Stream**.
+
+= How can I monitor incoming request suspicion scores in real time? =
+Under **Settings -> Anonympins Bot Mitigation -> Sandbox / Test Mode**, the plugin provides real-time observability interfaces for all challenged visitors across the website:
+
+1. **Server-Sent Events (SSE)**:
+`GET /wp-json/fingerprint/v1/sandbox/sse`
+Streams timestamped telemetry objects containing `id`, `timestamp`, `ip`, `uri`, `action`, `suspicionScore`, and `suspicionVector` for every challenged visitor.
+
+2. **REST Telemetry Polling**:
+`GET /wp-json/fingerprint/v1/sandbox/telemetry`
+Returns the latest list and evaluated challenge payloads across all visitors in JSON format.
+
+3. **Client-side JavaScript event**:
+Every page emits a DOM `CustomEvent('fingerprint:suspicion')` and sets `window.__FINGERPRINT_VECTOR__` when Sandbox mode is active or when an administrator is authenticated.

package/src/php/bin/auto-tune.php

@@ -32,7 +32,7 @@ use Anonympins\Fingerprint\Optimization\Optimization;
 use Anonympins\Fingerprint\Store\StoreManager;
 use Anonympins\Fingerprint\Utils\RequestUtils;
 
-// 1. Récupération des arguments CLI
+// 1. Retrieve CLI arguments
 $configPath = $argv[1] ?? null;
 if (!$configPath) {
     echo "Usage: php auto-tune.php [path_to_security-config.json]\n";