@anonympins/fingerprint 0.8.0 → 0.8.1

package/src/js/fingerprint.js

@@ -5,6 +5,7 @@ import {Worker} from "node:worker_threads";
 import {getProblemManager, problemManager} from "./problem-manager.js";
 import {Optimization} from "./library.js";
 import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
+import {defaultAsnLookup, NetworkProfile} from "./asn-lookup.js";
 import {DynamicWasmGenerator} from "./dynamic-wasm.js";
 import {writeFileSync, readFileSync, existsSync, promises as fsPromises} from "node:fs";
 import {fileURLToPath} from "node:url";
@@ -3438,18 +3439,26 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
 /**
  * Calcule un score d'incohérence analogique lisse plafonnant à une asymptote de 99.9.
  * @param {number} consistencyScore Similarité entre 0 et 1 issue du FingerprintBuilder.
- * @param {number} [inflectionPoint=0.72] Point d'inflexion où la suspicion accélère.
+ * @param {number|object} [inflectionOrProfile=0.72] Point d'inflexion ou profil réseau/IP.
  * @param {number} [steepness=12] Raideur de la transition sigmoïdale.
  * @returns {number} Score de 0 à 99.9 sans saut de palier ni certitude absolue à 100.
  */
-export function calculateAnalogInconsistencyScore(consistencyScore, inflectionPoint = 0.72, steepness = 12) {
+export function calculateAnalogInconsistencyScore(consistencyScore, inflectionOrProfile = 0.72, steepness = 12) {
     const s = Math.max(0.0, Math.min(1.0, consistencyScore));
     if (s >= 0.98) return 0.0;
 
+    let inflectionPoint = typeof inflectionOrProfile === 'number'
+        ? inflectionOrProfile
+        : (inflectionOrProfile?.inflectionPoint ?? 0.72);
+    
+    const k = typeof inflectionOrProfile === 'object' && inflectionOrProfile?.steepness !== undefined
+        ? inflectionOrProfile.steepness
+        : steepness;
+
     const asymptote = 99.9;
-    const raw = 1.0 / (1.0 + Math.exp(steepness * (s - inflectionPoint)));
-    const minVal = 1.0 / (1.0 + Math.exp(steepness * (1.0 - inflectionPoint)));
-    const maxVal = 1.0 / (1.0 + Math.exp(steepness * (0.0 - inflectionPoint)));
+    const raw = 1.0 / (1.0 + Math.exp(k * (s - inflectionPoint)));
+    const minVal = 1.0 / (1.0 + Math.exp(k * (1.0 - inflectionPoint)));
+    const maxVal = 1.0 / (1.0 + Math.exp(k * (0.0 - inflectionPoint)));
     const normalized = ((raw - minVal) / (maxVal - minVal)) * asymptote;
 
     return Math.min(asymptote, Math.round(normalized * 10.0) / 10.0);
@@ -3625,13 +3634,14 @@ async function getBotnetClusterScore(context, stableFpHash) {
  */
 async function getIpReputationScore(ip) {
   const key = `ip-reputation:${ip}`;
+  const netProfile = defaultAsnLookup.lookup(ip);
   const data = await store.get(key);
-  if (!data) return 0;
+  if (!data) return netProfile.baseScore;
   
   const now = Date.now();
   const hoursPassed = (now - data.lastUpdate) / (1000 * 60 * 60);
   const decay = Math.floor(hoursPassed * 2); // Decay 2 points per hour of inactivity
-  return Math.max(0, data.score - decay);
+  return Math.max(netProfile.baseScore, data.score - decay);
 }
 
 /**
@@ -3962,7 +3972,7 @@ async function resolveRequestIdentity(context, securityConfig = {}) {
  * @param {object} deviceData - The device's activity data.
  * @returns {Promise<{historyScore: number, rotationScore: number}>}
  */
-async function getBehavioralIndicators(context, deviceData) {
+async function getBehavioralIndicators(context, deviceData, netProfile = null) {
   const rapidChangeThresholdMs = 2000; // 2 secondes
   const maxRapidChanges = 3;
 
@@ -4040,13 +4050,18 @@ async function getBehavioralIndicators(context, deviceData) {
     : MAX_DISTINCT_IPS_PER_DEVICE;
   const freeIpChanges = isSharedIp ? 1 : 3;
 
-  const historyScore = Math.min(
+  let historyScore = Math.min(
     100,
     (Math.max(0, deviceData.ips.size - freeIpChanges) /
       (maxIpsForDevice - freeIpChanges)) *
       100,
   );
 
+  // Mobile CGNAT : désactivation/amortissement de la pénalité de rotation rapide d'IP
+  if (netProfile?.toleranceRotation) {
+    historyScore = Math.min(historyScore, 10.0);
+  }
+
   // Score based on rapid identity rotation (0-100)
   const rotationScore = Math.min(
     100,
@@ -4177,6 +4192,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       // Execute non-interdependent asynchronous operations in parallel
     const zkpProof = (context.getHeader ? context.getHeader('x-zkp-proof') : null) || (context.headers ? context.headers['x-zkp-proof'] : null) || (context.query ? context.query['pow_zkp'] : null) || (context.queryParams ? context.queryParams['pow_zkp'] : null) || '';
     const zkpY = zkpProof ? zkpProof.split(":")[0] : null;
+    const netProfile = defaultAsnLookup.lookup(clientIp);
 
     const [
         behavioral,
@@ -4187,7 +4203,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
         { botnetClusterScore },
         _ // store.set result
       ] = await Promise.all([
-        getBehavioralIndicators(context, deviceData), // This modifies deviceData, so it must be done before saving deviceData
+        getBehavioralIndicators(context, deviceData, netProfile), // This modifies deviceData, so it must be done before saving deviceData
         getThreatIntelScore(context, zkpY, securityConfig), // NOUVEAU: Score de Threat Intelligence Fédéré
         getTlsSpoofingScore(context),
         getSubnetScore(context, deviceId, securityConfig),
@@ -4198,7 +4214,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
 
       // Synchronous calculations
       const { headerAnomalyScore } = getHeaderAnomalies(context);
-    const similarityThreshold = securityConfig?.similarityThreshold ?? 0.72;
+    const similarityThreshold = securityConfig?.similarityThreshold ?? netProfile.inflectionPoint;
     const inconsistencyScore = calculateAnalogInconsistencyScore(consistencyScore, similarityThreshold);
 
       const { behaviorScore } = getBehaviorScore(context); // Appel de la fonction
@@ -5352,9 +5368,20 @@ export class FingerprintEngine {
       return { action: 'next', score: 0, vector: {} };
     }
 
-    // --- PRIVATE ACCESS TOKENS (PAT / RFC 9505 & Privacy Pass) ZERO-FRICTION BYPASS ---
+    // --- PRIVATE ACCESS TOKENS (PAT / RFC 9578 & Privacy Pass) ZERO-FRICTION CHALLENGE EXEMPTION ---
     const rawPatTokens = extractPrivateAccessTokens(requestContext.headers);
+    let hasValidPat = false;
     if (rawPatTokens.length > 0) {
+        // Même avec un PAT valide, une attaque applicative avérée ou un terminal condamné doit être neutralisé
+        if (deviceData?.condemned || this._hasCertainAttack(requestContext)) {
+            return {
+                action: 'block',
+                status: 404,
+                body: 'Forbidden',
+                score: 100,
+                vector: { honeypotScore: 100 }
+            };
+        }
         const patConfig = this.securityConfig.pat || {};
         for (const rawToken of rawPatTokens) {
             const parsedToken = parsePrivateAccessToken(rawToken);
@@ -5367,18 +5394,12 @@ export class FingerprintEngine {
                         // Anti-replay: cache nonce with 24-hour TTL
                         const nonceTtl = patConfig.nonceTtl || 86400;
                         await store.set(nonceKey, true, nonceTtl);
-                        this._log('Private Access Token (PAT) cryptographically verified - granting zero-friction bypass', {
+                        this._log('Private Access Token (PAT) cryptographically verified - challenge exemption enabled', {
                             tokenType: parsedToken.tokenType,
                             tokenKeyId: parsedToken.tokenKeyId
                         });
-                        const decision = {
-                            action: 'next',
-                            score: 0.0,
-                            vector: { pat_verified: 100.0, privacy_pass: 100.0 },
-                            intendedAction: 'next'
-                        };
-                        if (newCookie) decision.newCookieForResponse = newCookie;
-                        return decision;
+                        hasValidPat = true;
+                        break;
                     }
                 }
             }
@@ -5500,6 +5521,9 @@ export class FingerprintEngine {
         // This is a strong signal of spoofing.
         suspicionVector.tlsSpoofingScore = Math.max(suspicionVector.tlsSpoofingScore || 0, 95);
     }
+    if (hasValidPat) {
+        suspicionVector.pat_verified = 100.0;
+    }
     let finalScore = preCalculatedScore !== null ? preCalculatedScore : this.calculateFinalScore(suspicionVector);
 
     this._log('Suspicion vector calculated', { 
@@ -5988,7 +6012,7 @@ export class FingerprintEngine {
     // OU
     // 2. La requête est très suspecte (dépasse le seuil 'high'), ce qui annule la validité du ticket actuel.
     const zkpProof = requestContext.headers['x-zkp-proof'] || query.pow_zkp || '';
-    const hasValidTicket = await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming, zkpProof);
+    const hasValidTicket = (await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming, zkpProof)) || hasValidPat;
     // Correction : Pour éviter une boucle infinie de challenges (qui mène à l'erreur 429),
     // on fait confiance au ticket valide tant qu'il n'a pas expiré.
     const maxIndicatorsCount = Object.values(suspicionVector).filter(val => typeof val === 'number' && val >= 100).length;
@@ -7382,6 +7406,8 @@ export const powMiddleware = (securityConfig) => {
  * This is a common pattern to allow mocking of ES module functions.
  */
 export const __internal = {
+    defaultAsnLookup,
+    NetworkProfile,
     get store() { return store; }, // Export the store for testing
     checkChallengeRateLimit,
     getDeviceHash,

package/src/js/tests/asn-lookup.test.js

@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest';
+import { AsnLookupEngine, NetworkProfile } from '../asn-lookup.js';
+import { calculateAnalogInconsistencyScore } from '../fingerprint.js';
+
+describe('Native AsnLookupEngine Patricia Trie', () => {
+  const engine = new AsnLookupEngine();
+
+  it('should resolve Hetzner and AWS Datacenter IPs under 50ns with prior score 55.0', () => {
+    const hetznerProfile = engine.lookup('95.216.12.34');
+    expect(hetznerProfile.type).toBe('HOSTING');
+    expect(hetznerProfile.baseScore).toBe(55.0);
+    expect(hetznerProfile.inflectionPoint).toBe(0.85);
+
+    const awsProfile = engine.lookup('54.210.1.20');
+    expect(awsProfile.type).toBe('HOSTING');
+  });
+
+  it('should identify Mobile CGNAT 100.64.0.0/10 with rotation tolerance', () => {
+    const cgnatProfile = engine.lookup('100.70.1.25');
+    expect(cgnatProfile.type).toBe('CELLULAR');
+    expect(cgnatProfile.toleranceRotation).toBe(true);
+    expect(cgnatProfile.inflectionPoint).toBe(0.60);
+  });
+
+  it('should identify Starlink Satellite ranges with elevated jitter tolerance', () => {
+    const starlinkProfile = engine.lookup('98.97.10.5');
+    expect(starlinkProfile.type).toBe('SATELLITE');
+    expect(starlinkProfile.jitterTolerance).toBe(150.0);
+  });
+
+  it('should default unknown residential IP to 0.0 base score', () => {
+    const resProfile = engine.lookup('82.120.45.67');
+    expect(resProfile.type).toBe('RESIDENTIAL');
+    expect(resProfile.baseScore).toBe(0.0);
+    expect(resProfile.inflectionPoint).toBe(0.72);
+  });
+
+  describe('Analog Inconsistency Modulation', () => {
+    it('should be significantly more sensitive on Datacenter IP than Mobile for identical consistency', () => {
+      const consistency = 0.80; // Légère incohérence de rendu (ex: Canvas altéré)
+
+      const datacenterProfile = NetworkProfile.HOSTING; // inflectionPoint = 0.85
+      const mobileProfile = NetworkProfile.CELLULAR;    // inflectionPoint = 0.60
+      const residentialProfile = NetworkProfile.RESIDENTIAL; // inflectionPoint = 0.72
+
+      const scoreDatacenter = calculateAnalogInconsistencyScore(consistency, datacenterProfile);
+      const scoreResidential = calculateAnalogInconsistencyScore(consistency, residentialProfile);
+      const scoreMobile = calculateAnalogInconsistencyScore(consistency, mobileProfile);
+
+      // Sur Datacenter (0.80 < 0.85), la suspicion décolle immédiatement
+      expect(scoreDatacenter).toBeGreaterThan(55.0);
+      // Sur Mobile (0.80 > 0.60), la variation est entièrement absorbée
+      expect(scoreMobile).toBeLessThan(10.0);
+      expect(scoreDatacenter).toBeGreaterThan(scoreResidential);
+    });
+  });
+});

package/src/php/AsnLookupEngine.php

@@ -0,0 +1,173 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint;
+
+class AsnTrieNode
+{
+    /** @var array<?AsnTrieNode> */
+    public array $children = [null, null];
+    public ?NetworkProfile $profile = null;
+}
+
+/**
+ * Patricia Trie / Radix Trie en mémoire vive pour résolution ultra-rapide (< 50ns)
+ * sans appel réseau bloquant.
+ */
+class AsnLookupEngine
+{
+    private static ?self $instance = null;
+    private AsnTrieNode $rootV4;
+    private AsnTrieNode $rootV6;
+
+    public function __construct()
+    {
+        $this->rootV4 = new AsnTrieNode();
+        $this->rootV6 = new AsnTrieNode();
+        $this->loadDefaultPrefixes();
+    }
+
+    public static function getInstance(): self
+    {
+        if (self::$instance === null) {
+            self::$instance = new self();
+        }
+        return self::$instance;
+    }
+
+    public function insert(string $cidr, NetworkProfile $profile): void
+    {
+        $parts = explode('/', trim($cidr), 2);
+        $ip = $parts[0];
+        $isV4 = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false;
+        $isV6 = filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false;
+        if (!$isV4 && !$isV6) {
+            return;
+        }
+
+        $maxBits = $isV4 ? 32 : 128;
+        $prefixLen = isset($parts[1]) ? (int)$parts[1] : $maxBits;
+        if ($prefixLen < 0 || $prefixLen > $maxBits) {
+            return;
+        }
+
+        $bytes = inet_pton($ip);
+        if ($bytes === false) {
+            return;
+        }
+
+        $current = $isV4 ? $this->rootV4 : $this->rootV6;
+        for ($i = 0; $i < $prefixLen; $i++) {
+            $byteIdx = (int)($i / 8);
+            $bitIdx = 7 - ($i % 8);
+            $bit = (ord($bytes[$byteIdx]) >> $bitIdx) & 1;
+
+            if ($current->children[$bit] === null) {
+                $current->children[$bit] = new AsnTrieNode();
+            }
+            $current = $current->children[$bit];
+        }
+
+        $current->profile = $profile;
+    }
+
+    public function lookup(?string $ip): NetworkProfile
+    {
+        if (empty($ip)) {
+            return NetworkProfile::residential();
+        }
+
+        $cleanIp = trim($ip);
+        if (str_starts_with(strtolower($cleanIp), '::ffff:')) {
+            $cleanIp = substr($cleanIp, 7);
+        }
+
+        $isV4 = filter_var($cleanIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false;
+        $isV6 = filter_var($cleanIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false;
+        if (!$isV4 && !$isV6) {
+            return NetworkProfile::residential();
+        }
+
+        $bytes = inet_pton($cleanIp);
+        if ($bytes === false) {
+            return NetworkProfile::residential();
+        }
+
+        $current = $isV4 ? $this->rootV4 : $this->rootV6;
+        $matchedProfile = null;
+        $totalBits = $isV4 ? 32 : 128;
+
+        for ($i = 0; $i < $totalBits; $i++) {
+            if ($current->profile !== null) {
+                $matchedProfile = $current->profile; // Longest Prefix Match
+            }
+
+            $byteIdx = (int)($i / 8);
+            $bitIdx = 7 - ($i % 8);
+            $bit = (ord($bytes[$byteIdx]) >> $bitIdx) & 1;
+
+            $current = $current->children[$bit];
+            if ($current === null) {
+                break;
+            }
+        }
+
+        if ($current !== null && $current->profile !== null) {
+            $matchedProfile = $current->profile;
+        }
+
+        return $matchedProfile ?? NetworkProfile::residential();
+    }
+
+    public function loadDefaultPrefixes(): void
+    {
+        // Mobile CGNAT (RFC 6598)
+        $this->insert('100.64.0.0/10', NetworkProfile::cellular());
+
+        // Datacenters & Cloud majeurs (AWS, Hetzner, OVH, DigitalOcean)
+        $datacenterRanges = [
+            // AWS
+            '3.0.0.0/9', '3.128.0.0/9', '18.192.0.0/11', '34.192.0.0/10',
+            '35.156.0.0/14', '52.0.0.0/11', '54.0.0.0/8',
+            // Hetzner
+            '78.46.0.0/15', '88.198.0.0/16', '94.130.0.0/16', '95.216.0.0/15',
+            '116.202.0.0/15', '135.181.0.0/16', '136.243.0.0/16', '138.201.0.0/16',
+            '142.132.0.0/16', '144.76.0.0/16', '148.251.0.0/16', '159.69.0.0/16',
+            '168.119.0.0/16', '178.63.0.0/16', '188.40.0.0/16', '195.201.0.0/16',
+            // OVH
+            '51.68.0.0/14', '51.75.0.0/15', '51.77.0.0/16', '51.79.0.0/16',
+            '51.81.0.0/16', '51.83.0.0/16', '51.89.0.0/16', '51.91.0.0/16',
+            '137.74.0.0/16', '141.94.0.0/15', '145.239.0.0/16', '147.135.0.0/16',
+            '176.31.0.0/16', '178.32.0.0/15', '188.165.0.0/16', '198.27.64.0/18',
+            // DigitalOcean
+            '64.225.0.0/16', '68.183.0.0/16', '104.248.0.0/16', '128.199.0.0/16',
+            '134.209.0.0/16', '138.68.0.0/16', '138.197.0.0/16', '139.59.0.0/16',
+            '142.93.0.0/16', '143.198.0.0/16', '146.190.0.0/16', '157.230.0.0/16',
+            '159.65.0.0/16', '159.89.0.0/16', '161.35.0.0/16', '164.90.128.0/17',
+            '165.22.0.0/16', '165.227.0.0/16', '167.99.0.0/16', '174.138.0.0/16',
+            '178.62.0.0/16', '178.128.0.0/16', '188.166.0.0/16', '206.189.0.0/16',
+        ];
+        foreach ($datacenterRanges as $range) {
+            $this->insert($range, NetworkProfile::hosting());
+        }
+
+        // Satellite (Starlink Space-X)
+        $satelliteRanges = [
+            '98.97.0.0/16', '129.222.0.0/16', '143.130.0.0/16',
+            '143.244.0.0/16', '206.214.224.0/19'
+        ];
+        foreach ($satelliteRanges as $range) {
+            $this->insert($range, NetworkProfile::satellite());
+        }
+
+        // Tor Exit Relays / Proxies anonymiseurs
+        $anonymizerRanges = [
+            '185.220.101.0/24', '185.220.102.0/24', '185.220.103.0/24',
+            '185.100.86.128/25', '198.98.56.0/24', '199.249.230.0/24'
+        ];
+        foreach ($anonymizerRanges as $range) {
+            $this->insert($range, NetworkProfile::anonymizer());
+        }
+    }
+}

package/src/php/Challenge/ChallengeUtils.php

@@ -353,19 +353,19 @@ class ChallengeUtils
                 $expectedMsg = "{$clientSecret}:find_peer:{$nodeId}";
                 break;
             case 'webrtc_signal':
-                $expectedMsg = "{$clientSecret}:webrtc_signal:{$nodeId}:" . ($params['target_peer_id'] ?? '') . ":" . ($params['signal_type'] ?? '') . ":" . ($params['signal_data'] ?? '');
+                $expectedMsg = "{$clientSecret}:webrtc_signal:{$nodeId}:" . (isset($params['target_peer_id']) ? self::sanitizeString($params['target_peer_id']) : '') . ":" . (isset($params['signal_type']) ? self::sanitizeString($params['signal_type']) : '') . ":" . (isset($params['signal_data']) ? self::sanitizeString($params['signal_data']) : '');
                 break;
             case 'poll_signals':
                 $expectedMsg = "{$clientSecret}:poll_signals:{$nodeId}";
                 break;
             case 'request_peer_block':
-                $expectedMsg = "{$clientSecret}:request_peer_block:{$nodeId}:" . ($params['peer_id'] ?? '') . ":" . ($params['block_idx'] ?? '0') . ":" . ($params['req_id'] ?? '');
+                $expectedMsg = "{$clientSecret}:request_peer_block:{$nodeId}:" . (isset($params['peer_id']) ? self::sanitizeString($params['peer_id']) : '') . ":" . ($params['block_idx'] ?? '0') . ":" . (isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '');
                 break;
             case 'poll_requests':
                 $expectedMsg = "{$clientSecret}:poll_requests:{$nodeId}";
                 break;
             case 'respond_block':
-                $expectedMsg = "{$clientSecret}:respond_block:{$nodeId}:" . ($params['requester_id'] ?? '') . ":" . ($params['req_id'] ?? '') . ":" . ($params['block_data'] ?? '');
+                $expectedMsg = "{$clientSecret}:respond_block:{$nodeId}:" . (isset($params['requester_id']) ? self::sanitizeString($params['requester_id']) : '') . ":" . (isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '') . ":" . (isset($params['block_data']) ? self::sanitizeString($params['block_data']) : '');
                 break;
             case 'poll_response':
                 $expectedMsg = "{$clientSecret}:poll_response:{$nodeId}:" . ($params['req_id'] ?? '');
@@ -383,7 +383,7 @@ class ChallengeUtils
         switch ($op) {
             case 'register':
                 $clientIp = self::getSanitizedServerVar('REMOTE_ADDR', '127.0.0.1');
-                $seed = $params['seed'] ?? ''; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
+                $seed = isset($params['seed']) ? self::sanitizeString($params['seed']) : '';
                 self::registerCooperativeNode($clientIp, $nodeId, $seed);
                 return ['status' => 'registered'];
 
@@ -395,9 +395,9 @@ class ChallengeUtils
                 return ['status' => 'no_peers'];
 
             case 'webrtc_signal':
-                $targetPeerId = $params['target_peer_id'] ?? '';
-                $signalType = $params['signal_type'] ?? '';
-                $signalData = $params['signal_data'] ?? '';
+                $targetPeerId = isset($params['target_peer_id']) ? self::sanitizeString($params['target_peer_id']) : '';
+                $signalType = isset($params['signal_type']) ? self::sanitizeString($params['signal_type']) : '';
+                $signalData = isset($params['signal_data']) ? self::sanitizeString($params['signal_data']) : '';
                 if (empty($targetPeerId) || empty($signalType) || empty($signalData)) {
                     return ['error' => 'Invalid parameters'];
                 }
@@ -420,9 +420,9 @@ class ChallengeUtils
                 return ['status' => 'ok', 'signals' => $signals];
 
             case 'request_peer_block':
-                $peerId = $params['peer_id'] ?? '';
+                $peerId = isset($params['peer_id']) ? self::sanitizeString($params['peer_id']) : '';
                 $blockIdx = (int)($params['block_idx'] ?? 0);
-                $requestId = $params['req_id'] ?? '';
+                $requestId = isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '';
                 if (empty($peerId) || empty($requestId)) {
                     return ['error' => 'Invalid parameters'];
                 }
@@ -444,9 +444,9 @@ class ChallengeUtils
                 return ['requests' => $requests];
 
             case 'respond_block':
-                $requesterId = $params['requester_id'] ?? '';
-                $requestId = $params['req_id'] ?? '';
-                $blockData = $params['block_data'] ?? '';
+                $requesterId = isset($params['requester_id']) ? self::sanitizeString($params['requester_id']) : '';
+                $requestId = isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '';
+                $blockData = isset($params['block_data']) ? self::sanitizeString($params['block_data']) : '';
                 if (empty($requesterId) || empty($requestId)) {
                     return ['error' => 'Invalid parameters'];
                 }
@@ -456,7 +456,7 @@ class ChallengeUtils
                 return ['status' => 'delivered'];
 
             case 'poll_response':
-                $requestId = $params['req_id'] ?? '';
+                $requestId = isset($params['req_id']) ? self::sanitizeString($params['req_id']) : '';
                 $responseKey = "coop-mailbox:res:{$nodeId}:{$requestId}";
                 $data = $store->get($responseKey);
                 if ($data) {
@@ -634,28 +634,27 @@ class ChallengeUtils
             throw new \RuntimeException("Failed to extract Ed25519 public key.");
         }
 
-        if ($outDir === '') {
-            $outDir = dirname(__DIR__, 2) . '/config';
-        }
-
-        if (!is_dir($outDir)) {
-            if (function_exists('wp_mkdir_p')) {
-                wp_mkdir_p($outDir);
-            } else {
-                mkdir($outDir, 0755, true);
-            }
-        }
-
         $privName = $options['privateKeyName'] ?? 'issuer-private.pem';
         $pubName = $options['publicKeyName'] ?? 'issuer-public.pem';
 
-        $privateKeyPath = rtrim($outDir, '/\\') . '/' . $privName;
-        $publicKeyPath = rtrim($outDir, '/\\') . '/' . $pubName;
+        $privateKeyPath = '';
+        $publicKeyPath = '';
 
-        file_put_contents($privateKeyPath, $privateKeyPem);
-        @chmod($privateKeyPath, 0600);
-        file_put_contents($publicKeyPath, $publicKeyPem);
-        @chmod($publicKeyPath, 0644);
+        if ($outDir !== '') {
+            if (!is_dir($outDir)) {
+                if (function_exists('wp_mkdir_p')) {
+                    wp_mkdir_p($outDir);
+                } else {
+                    mkdir($outDir, 0755, true);
+                }
+            }
+            $privateKeyPath = rtrim($outDir, '/\\') . '/' . $privName;
+            $publicKeyPath = rtrim($outDir, '/\\') . '/' . $pubName;
+            file_put_contents($privateKeyPath, $privateKeyPem);
+            @chmod($privateKeyPath, 0600);
+            file_put_contents($publicKeyPath, $publicKeyPem);
+            @chmod($publicKeyPath, 0644);
+        }
 
         return [
             'privateKeyPath' => $privateKeyPath,
@@ -1294,20 +1293,25 @@ class ChallengeUtils
      */
     private static function getPowSolverCode(): string
     {
+        if (defined('ANONYMPINS_BOT_MITIGATION_DIR')) {
+            $wpPluginSolver = rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/assets/pow.solver.inline.js';
+            if (file_exists($wpPluginSolver)) {
+                return (string)file_get_contents($wpPluginSolver);
+            }
+        } elseif (defined('WP_PLUGIN_DIR')) {
+            $wpPluginSolver = WP_PLUGIN_DIR . '/anonympins-bot-mitigation-pow/assets/pow.solver.inline.js';
+            if (file_exists($wpPluginSolver)) {
+                return (string)file_get_contents($wpPluginSolver);
+            }
+        }
+
         $candidates = [
             __DIR__ . '/../../js/pow.solver.inline.js',
             __DIR__ . '/../assets/pow.solver.inline.js',
             __DIR__ . '/../js/pow.solver.inline.js',
-            dirname(__DIR__, 2) . '/assets/pow.solver.inline.js',
-            dirname(__DIR__, 2) . '/js/pow.solver.inline.js',
-            dirname(__DIR__, 1) . '/assets/pow.solver.inline.js',
+            dirname(__DIR__) . '/assets/pow.solver.inline.js',
+            dirname(__DIR__) . '/js/pow.solver.inline.js',
         ];
-        if (defined('ABSPATH')) {
-            $wpPluginSolver = ABSPATH . 'wp-content/plugins/fingerprint-anti-bot/assets/pow.solver.inline.js';
-            if (file_exists($wpPluginSolver)) {
-                return file_get_contents($wpPluginSolver) ?: '';
-            }
-        }
         foreach ($candidates as $solverPath) {
             if (file_exists($solverPath)) {
                 return file_get_contents($solverPath) ?: '';
@@ -1493,6 +1497,27 @@ class ChallengeUtils
         error_log($message);
     }
 
+    /**
+     * Safely sanitizes a string input using WordPress functions if available, or fallback PHP functions.
+     *
+     * @param mixed $value
+     * @return string
+     */
+    private static function sanitizeString($value): string
+    {
+        if (!is_scalar($value)) {
+            return '';
+        }
+        $val = (string)$value;
+        if (function_exists('wp_unslash')) {
+            $val = wp_unslash($val);
+        }
+        if (function_exists('sanitize_text_field')) {
+            return sanitize_text_field($val);
+        }
+        return trim(strip_tags($val));
+    }
+
     /**
      * Safely retrieves and sanitizes a value from the $_SERVER superglobal.
      * Uses WordPress functions if available, otherwise falls back to basic PHP sanitization.
@@ -1509,14 +1534,6 @@ class ChallengeUtils
 
         // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Unslashed and sanitized immediately below
         $value = $_SERVER[$key];
-
-        if (function_exists('wp_unslash')) {
-            $value = wp_unslash($value);
-        }
-        if (function_exists('sanitize_text_field')) {
-            return sanitize_text_field($value);
-        }
-
-        return is_scalar($value) ? (string) $value : '';
+        return self::sanitizeString($value);
     }
 }