@anonympins/fingerprint 0.8.0 → 0.8.1

package/src/php/DirectFingerprint.php

@@ -29,24 +29,44 @@ class DirectFingerprint
      */
     public function buildRequestContext(): RequestContext
     {
+        $sanitizeDeep = function ($data) use (&$sanitizeDeep) {
+            if (is_array($data)) {
+                $clean = [];
+                foreach ($data as $k => $v) {
+                    $cleanKey = is_string($k) ? (function_exists('sanitize_text_field') && function_exists('wp_unslash') ? sanitize_text_field(wp_unslash($k)) : trim((string)$k)) : $k;
+                    $clean[$cleanKey] = $sanitizeDeep($v);
+                }
+                return $clean;
+            }
+            if (is_string($data)) {
+                return function_exists('sanitize_text_field') && function_exists('wp_unslash') ? sanitize_text_field(wp_unslash($data)) : trim($data);
+            }
+            return $data;
+        };
+
+        $rawInput = (string)file_get_contents('php://input');
+        $decodedJson = !empty($rawInput) ? json_decode($rawInput, true) : null;
         // phpcs:ignore WordPress.Security.NonceVerification.Missing,WordPress.Security.NonceVerification.Recommended -- Direct WAF inspection firewall before WP core logic
-        $body = $_POST ?: json_decode(file_get_contents('php://input'), true);
-        $headers = function_exists('getallheaders') ? getallheaders() : [];
+        $body = !empty($_POST) ? $sanitizeDeep($_POST) : (is_array($decodedJson) ? $sanitizeDeep($decodedJson) : null);
+        $rawHeaders = function_exists('getallheaders') ? getallheaders() : [];
+        $headers = is_array($rawHeaders) ? $sanitizeDeep($rawHeaders) : [];
 
         $remoteAddr = isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : '127.0.0.1';
         $rawUri = isset($_SERVER['REQUEST_URI']) ? sanitize_text_field(wp_unslash($_SERVER['REQUEST_URI'])) : '/';
         // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Uses wp_parse_url when available
         $path = function_exists('wp_parse_url') ? (string)wp_parse_url($rawUri, PHP_URL_PATH) : (string)parse_url($rawUri, PHP_URL_PATH);
         $serverProtocol = isset($_SERVER['SERVER_PROTOCOL']) ? sanitize_text_field(wp_unslash($_SERVER['SERVER_PROTOCOL'])) : '1.1';
+        // phpcs:ignore WordPress.Security.NonceVerification.Recommended
+        $query = isset($_GET) && is_array($_GET) ? $sanitizeDeep($_GET) : [];
+        $cookies = isset($_COOKIE) && is_array($_COOKIE) ? $sanitizeDeep($_COOKIE) : [];
 
         return new RequestContext(
             $remoteAddr,
             !empty($path) ? $path : '/',
             $headers,
-            // phpcs:ignore WordPress.Security.NonceVerification.Recommended
-            $_GET,
+            $query,
             $body,
-            $_COOKIE,
+            $cookies,
             $serverProtocol
         );
     }

package/src/php/FingerprintEngine.php

@@ -173,11 +173,12 @@ class FingerprintEngine
                     Env::set('ED25519_PUBLIC_KEY', $storedKeys['publicKey']);
                 } elseif (defined('OPENSSL_KEYTYPE_ED25519')) {
                     $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
-                    $pemResult = ChallengeUtils::generateIssuerPemKeys();
-                    $privateKeyPem = $pemResult['privateKey'];
-                    $publicKeyPem = $pemResult['publicKey'];
-                    Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
-                    Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                    if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
+                        $details = openssl_pkey_get_details($pkey);
+                        $publicKeyPem = $details['key'] ?? '';
+                        Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+                        Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                    }
                     update_option('fingerprint_ed25519_keys', [
                         'privateKey' => $privateKeyPem,
                         'publicKey'  => $publicKeyPem,
@@ -227,12 +228,25 @@ class FingerprintEngine
      */
     private static function initStandaloneEd25519Keys(): void
     {
-        $configDir = dirname(__DIR__, 1) . '/config';
-        $persistentKeyPath = $configDir . '/ed25519_key.json';
+        if (function_exists('get_option')) {
+            return; // Managed exclusively via WordPress options in WP runtime
+        }
+
+        if (function_exists('wp_upload_dir') && function_exists('wp_mkdir_p')) {
+            $uploadDir = wp_upload_dir();
+            $configDir = (!empty($uploadDir['basedir']) && is_dir($uploadDir['basedir']))
+                ? $uploadDir['basedir'] . '/anonympins-bot-mitigation-pow'
+                : sys_get_temp_dir();
+        } else {
+            $envKeyDir = Env::get('FINGERPRINT_KEY_DIR');
+            $configDir = !empty($envKeyDir) ? (string)$envKeyDir : sys_get_temp_dir();
+        }
+        $persistentKeyPath = rtrim($configDir, '/\\') . '/ed25519_key.json';
 
         if (file_exists($persistentKeyPath)) {
             try {
-                $keys = json_decode((string)file_get_contents($persistentKeyPath), true);
+                $raw = (string)file_get_contents($persistentKeyPath);
+                $keys = json_decode($raw, true);
                 if (isset($keys['privateKey'], $keys['publicKey'])) {
                     Env::set('ED25519_PRIVATE_KEY', $keys['privateKey']);
                     Env::set('ED25519_PUBLIC_KEY', $keys['publicKey']);
@@ -253,11 +267,10 @@ class FingerprintEngine
                             if (function_exists('wp_mkdir_p')) {
                                 wp_mkdir_p($configDir);
                             } else {
-                                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir -- Non-WordPress standalone environment fallback
-                                mkdir($configDir, 0777, true);
+                                @mkdir($configDir, 0700, true);
                             }
                         }
-                        // phpcs:ignore PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite -- Non-WordPress standalone environment fallback
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
                         file_put_contents($persistentKeyPath, json_encode([
                             'privateKey' => $privateKeyPem,
                             'publicKey' => $publicKeyPem
@@ -346,7 +359,13 @@ class FingerprintEngine
      */
     private static function loadBotWhitelist(string $filename, array $fallbackEntries): array
     {
-        $configDir = dirname(__DIR__, 2) . '/config';
+        if (defined('ANONYMPINS_BOT_MITIGATION_DIR')) {
+            $configDir = rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/config';
+        } elseif (is_dir(__DIR__ . '/config')) {
+            $configDir = __DIR__ . '/config';
+        } else {
+            $configDir = __DIR__;
+        }
         $filePath = $configDir . '/' . $filename;
         if (file_exists($filePath)) {
             try {
@@ -876,12 +895,13 @@ class FingerprintEngine
         // --- Computation of the various suspicion scores ---
 
         // Fingerprint inconsistency score (moved here to be with the others)
+        $netProfile = AsnLookupEngine::getInstance()->lookup($context->clientIp);
         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
         $consistencyScore = FingerprintBuilder::compare($deviceData['initialDeviceHash'] ?? '', $currentDeviceHash);
-        $similarityThreshold = (float)($this->securityConfig['similarityThreshold'] ?? 0.72);
+        $similarityThreshold = (float)($this->securityConfig['similarityThreshold'] ?? $netProfile->getInflectionPoint());
         $inconsistencyScore = RequestUtils::calculateAnalogInconsistencyScore($consistencyScore, $similarityThreshold);
 
-        $behavioral = RequestUtils::getBehavioralIndicators($context, $deviceData);
+        $behavioral = RequestUtils::getBehavioralIndicators($context, $deviceData, $netProfile);
 
         // Header anomaly score
         $headerAnomalies = RequestUtils::getHeaderAnomalies($context);
@@ -1272,8 +1292,9 @@ class FingerprintEngine
             return $decision;
         }
 
-        // --- PRIVATE ACCESS TOKENS (PAT / RFC 9505 & Privacy Pass) ZERO-FRICTION BYPASS ---
+        // --- PRIVATE ACCESS TOKENS (PAT / RFC 9578 & Privacy Pass) ZERO-FRICTION CHALLENGE EXEMPTION ---
         $rawPatTokens = RequestUtils::extractPrivateAccessTokens($context);
+        $hasValidPat = false;
         if (!empty($rawPatTokens)) {
             $patConfig = $this->securityConfig['pat'] ?? [];
             foreach ($rawPatTokens as $rawToken) {
@@ -1285,16 +1306,12 @@ class FingerprintEngine
                         if ($isValid) {
                             $nonceTtl = $patConfig['nonceTtl'] ?? 86400;
                             $store->set($nonceKey, true, $nonceTtl);
-                            $this->log('Private Access Token (PAT) cryptographically verified - granting zero-friction bypass', [
+                            $this->log('Private Access Token (PAT) cryptographically verified - challenge exemption enabled', [
                                 'tokenType' => $parsedToken['tokenType'],
                                 'tokenKeyId' => $parsedToken['tokenKeyId']
                             ]);
-                            $decision = [
-                                'action' => 'next',
-                                'score' => 0.0,
-                                'vector' => ['pat_verified' => 100.0, 'privacy_pass' => 100.0]
-                            ];
-                            return $decision;
+                            $hasValidPat = true;
+                            break;
                         }
                     }
                 }
@@ -1365,14 +1382,12 @@ class FingerprintEngine
                                     $isMemValid = true;
                                 } else {
                                     $memSolution = $context->query['pow_solution_mem'] ?? null;
-                                    $isMemValid = ($memSolution !== null && $memSolution !== '')
-                                        ? ChallengeUtils::verifyMemoryPoW(
+                                    $isMemValid = $memSolution !== null && $memSolution !== '' && ChallengeUtils::verifyMemoryPoW(
                                             $powNonce,
                                             (string)$memSolution,
                                             $challengeContext['memDifficulty'] ?? 0,
                                             $challengeContext['clientSecret'] ?? ''
-                                        )
-                                        : false;
+                                        );
                                 }
                                 $isValid = $isValid && $isMemValid;
                             }
@@ -1410,8 +1425,9 @@ class FingerprintEngine
                                 'jsonLastError' => json_last_error_msg()
                             ]);
                             if (json_last_error() === JSON_ERROR_NONE) {
-                                // @phpstan-ignore-next-line - The instance is managed by the singleton
-                                $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
+                                $defaultPath = defined('ANONYMPINS_BOT_MITIGATION_DIR')
+                                    ? rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/config/problems.config.json'
+                                    : (file_exists(__DIR__ . '/config/problems.config.json') ? __DIR__ . '/config/problems.config.json' : null);
                                 $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                                 $problemManager = \Anonympins\Fingerprint\ProblemManager::getInstance($configPath, $store);
                                 // FIX: The solution is directly $workResult, not a sub-property.
@@ -1490,7 +1506,7 @@ class FingerprintEngine
         $deviceId = $context->cookies['device_id'] ?? '';
         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
         $allowRoaming = $this->securityConfig['allowCrossNetworkRoaming'] ?? false;
-        if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie, $deviceId, $currentDeviceHash, $allowRoaming, $zkpProof)) {
+        if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie, $deviceId, $currentDeviceHash, $allowRoaming, $zkpProof) || $hasValidPat) {
             $hasValidTicket = true;
             MetricsManager::incrementCounter('tickets_valid_total');
             // We do not return immediately to allow re-challenging.
@@ -1517,6 +1533,9 @@ class FingerprintEngine
         }
 
         $suspicionVector = $context->preCalculatedVector ?? $this->getSuspicionVector($context, $suspicionVector);
+        if ($hasValidPat) {
+            $suspicionVector['pat_verified'] = 100.0;
+        }
         $finalScore = $context->preCalculatedScore ?? $this->calculateFinalScore($suspicionVector);
         $this->log('Suspicion vector and final score calculated', [
             'finalScore' => round($finalScore, 2),
@@ -1692,7 +1711,9 @@ class FingerprintEngine
 
                 if ($shouldUseUsefulWork) {
                     $this->log('Issuing a useful work challenge', ['finalScore' => $finalScore]);
-                    $defaultPath = dirname(__DIR__, 1) . '/config/problems.config.json';
+                    $defaultPath = defined('ANONYMPINS_BOT_MITIGATION_DIR')
+                        ? rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/config/problems.config.json'
+                        : (file_exists(__DIR__ . '/config/problems.config.json') ? __DIR__ . '/config/problems.config.json' : null);
                     $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                     $problemManager = ProblemManager::getInstance($configPath, $store);
                     $work = $problemManager->dispatchWork($finalScore);

package/src/php/NetworkProfile.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint;
+
+/**
+ * Profils de connectivité réseau et paramètres de modulation pour le scoring analogique.
+ */
+class NetworkProfile
+{
+    public const RESIDENTIAL = 'RESIDENTIAL';
+    public const CELLULAR = 'CELLULAR';
+    public const SATELLITE = 'SATELLITE';
+    public const HOSTING = 'HOSTING';
+    public const ANONYMIZER = 'ANONYMIZER';
+
+    private string $type;
+    private float $baseScore;
+    private float $inflectionPoint;
+    private bool $toleranceRotation;
+    private float $jitterTolerance;
+
+    public function __construct(
+        string $type,
+        float $baseScore,
+        float $inflectionPoint,
+        bool $toleranceRotation,
+        float $jitterTolerance
+    ) {
+        $this->type = $type;
+        $this->baseScore = $baseScore;
+        $this->inflectionPoint = $inflectionPoint;
+        $this->toleranceRotation = $toleranceRotation;
+        $this->jitterTolerance = $jitterTolerance;
+    }
+
+    public function getType(): string { return $this->type; }
+    public function getBaseScore(): float { return $this->baseScore; }
+    public function getInflectionPoint(): float { return $this->inflectionPoint; }
+    public function isToleranceRotation(): bool { return $this->toleranceRotation; }
+    public function getJitterTolerance(): float { return $this->jitterTolerance; }
+
+    public static function residential(): self
+    {
+        return new self(self::RESIDENTIAL, 0.0, 0.72, false, 60.0);
+    }
+
+    public static function cellular(): self
+    {
+        return new self(self::CELLULAR, 10.0, 0.60, true, 80.0);
+    }
+
+    public static function satellite(): self
+    {
+        return new self(self::SATELLITE, 15.0, 0.68, false, 150.0);
+    }
+
+    public static function hosting(): self
+    {
+        return new self(self::HOSTING, 55.0, 0.85, false, 30.0);
+    }
+
+    public static function anonymizer(): self
+    {
+        return new self(self::ANONYMIZER, 85.0, 0.90, false, 40.0);
+    }
+}

package/src/php/ProblemManager.php

@@ -36,8 +36,18 @@ class ProblemManager
     {
         if (self::$instance === null) {
             if ($configPath === null) {
-                $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
-                $configPath = file_exists($defaultPath) ? $defaultPath : null;
+                $candidateDirs = [];
+                if (defined('ANONYMPINS_BOT_MITIGATION_DIR')) {
+                    $candidateDirs[] = rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/config';
+                }
+                $candidateDirs[] = __DIR__ . '/config';
+                foreach ($candidateDirs as $dir) {
+                    $p = $dir . '/problems.config.json';
+                    if (file_exists($p)) {
+                        $configPath = $p;
+                        break;
+                    }
+                }
             }
             // Error if accessed before initialization
             if ($configPath === null || $store === null) {

package/src/php/Tests/AsnLookupTest.php

@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\AsnLookupEngine;
+use Anonympins\Fingerprint\NetworkProfile;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class AsnLookupTest extends TestCase
+{
+    private AsnLookupEngine $engine;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->engine = AsnLookupEngine::getInstance();
+    }
+
+    public function testDatacenterResolutionAndPriorScore(): void
+    {
+        $hetzner = $this->engine->lookup('95.216.12.34');
+        $this->assertSame('HOSTING', $hetzner->getType());
+        $this->assertSame(55.0, $hetzner->getBaseScore());
+        $this->assertSame(0.85, $hetzner->getInflectionPoint());
+        $this->assertFalse($hetzner->isToleranceRotation());
+
+        $aws = $this->engine->lookup('54.210.1.20');
+        $this->assertSame('HOSTING', $aws->getType());
+        $this->assertSame(55.0, $aws->getBaseScore());
+    }
+
+    public function testMobileCgnatResolution(): void
+    {
+        $cgnat = $this->engine->lookup('100.70.1.25');
+        $this->assertSame('CELLULAR', $cgnat->getType());
+        $this->assertSame(10.0, $cgnat->getBaseScore());
+        $this->assertSame(0.60, $cgnat->getInflectionPoint());
+        $this->assertTrue($cgnat->isToleranceRotation());
+    }
+
+    public function testStarlinkSatelliteResolution(): void
+    {
+        $starlink = $this->engine->lookup('98.97.10.5');
+        $this->assertSame('SATELLITE', $starlink->getType());
+        $this->assertSame(15.0, $starlink->getBaseScore());
+        $this->assertSame(150.0, $starlink->getJitterTolerance());
+    }
+
+    public function testAnalogInconsistencyModulation(): void
+    {
+        $consistency = 0.80; // Incohérence légère de rendu
+        $scoreDatacenter = RequestUtils::calculateAnalogInconsistencyScore($consistency, NetworkProfile::hosting());
+        $scoreMobile = RequestUtils::calculateAnalogInconsistencyScore($consistency, NetworkProfile::cellular());
+
+        $this->assertGreaterThan(55.0, $scoreDatacenter, 'Sur Datacenter (0.80 < 0.85), la suspicion décolle au-dessus de 55.0');
+        $this->assertLessThan(10.0, $scoreMobile, 'Sur Mobile (0.80 > 0.60), la variation est entièrement absorbée (< 10.0)');
+    }
+}

package/src/php/Tests/FingerprintEngineTest.php

@@ -303,11 +303,12 @@ class FingerprintEngineTest extends TestCase
             $this->markTestSkipped('Ed25519 is not supported in this PHP/OpenSSL environment.');
         }
 
-        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        $configDir = sys_get_temp_dir() . '/anonympins-test-keys-' . time();
         if (!is_dir($configDir)) {
             mkdir($configDir, 0777, true);
         }
         $keyPath = $configDir . '/ed25519_key.json';
+        Env::set('FINGERPRINT_KEY_DIR', $configDir);
 
         Env::clear('ED25519_PRIVATE_KEY');
         Env::clear('ED25519_PUBLIC_KEY');
@@ -338,11 +339,12 @@ class FingerprintEngineTest extends TestCase
 
     public function testEd25519KeyLoadingFromDisk(): void
     {
-        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        $configDir = sys_get_temp_dir() . '/anonympins-test-keys-' . time();
         if (!is_dir($configDir)) {
             mkdir($configDir, 0777, true);
         }
         $keyPath = $configDir . '/ed25519_key.json';
+        Env::set('FINGERPRINT_KEY_DIR', $configDir);
 
         $dummyKeys = [
             'privateKey' => '-----BEGIN PRIVATE KEY-----\ndummy-php-private\n-----END PRIVATE KEY-----',

package/src/php/Utils/Env.php

@@ -21,10 +21,15 @@ class Env
         }
         // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Environment and server variables may contain raw cryptographic keys.
         if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
-            return $_ENV[$key];
+            $envVal = function_exists('wp_unslash') ? wp_unslash($_ENV[$key]) : $_ENV[$key];
+            return is_string($envVal) ? (function_exists('sanitize_textarea_field') ? sanitize_textarea_field($envVal) : $envVal) : $envVal;
         }
         if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
-            return $_SERVER[$key];
+            $serverVal = function_exists('wp_unslash') ? wp_unslash($_SERVER[$key]) : $_SERVER[$key];
+            if (is_string($serverVal)) {
+                return function_exists('sanitize_textarea_field') ? sanitize_textarea_field($serverVal) : $serverVal;
+            }
+            return $serverVal;
         }
         // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash
         $val = getenv($key);

package/src/php/Utils/RequestUtils.php

@@ -9,6 +9,8 @@ use Anonympins\Fingerprint\FingerprintBuilder;
 use Anonympins\Fingerprint\Optimization\Optimization;
 use Anonympins\Fingerprint\RequestContext;
 use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\AsnLookupEngine;
+use Anonympins\Fingerprint\NetworkProfile;
 
 /**
  * Classe utilitaire pour l'analyse des requêtes et le calcul des scores de suspicion.
@@ -1021,7 +1023,7 @@ class RequestUtils
      * @param array<string, mixed> $deviceData
      * @return array{'historyScore': float, 'rotationScore': float}
      */
-    public static function getBehavioralIndicators(RequestContext $context, array &$deviceData): array
+    public static function getBehavioralIndicators(RequestContext $context, array &$deviceData, ?NetworkProfile $netProfile = null): array
     {
         $now = time() * 1000;
         $clientIp = $context->clientIp;
@@ -1089,6 +1091,11 @@ class RequestUtils
         $maxIpsPerDevice = 15;
         $freeIpChanges = 3;
         $historyScore = min(100.0, (max(0, count($deviceData['ips']) - $freeIpChanges) / $maxIpsPerDevice) * 100);
+        
+        // Mobile CGNAT : désactivation/amortissement de la pénalité de rotation rapide d'IP
+        if ($netProfile !== null && $netProfile->isToleranceRotation()) {
+            $historyScore = min($historyScore, 10.0);
+        }
         // Score de rotation basé sur les changements rapides de fingerprint
         $rotationScore = min(100.0, (($deviceData['rapidChangeCount'] ?? 0) / $maxRapidChanges) * 100);
 
@@ -1858,18 +1865,20 @@ class RequestUtils
      */
     public static function getIpReputationScore(string $ip): float
     {
+        $profile = AsnLookupEngine::getInstance()->lookup($ip);
+        $baseScore = $profile->getBaseScore();
         $store = StoreManager::getStore();
         $key = "ip-reputation:{$ip}";
         $data = $store->get($key);
         if ($data === null) {
-            return 0.0;
+            return $baseScore;
         }
 
         $now = time();
         $hoursPassed = ($now - $data['lastUpdate']) / 3600;
         $decay = (int)floor($hoursPassed * 2); // Décroissance de 2 points par heure
 
-        return (float)max(0.0, $data['score'] - $decay);
+        return (float)max($baseScore, $data['score'] - $decay);
     }
 
     /**
@@ -2693,13 +2702,21 @@ class RequestUtils
     /**
      * Calcule un score d'incohérence analogique et lisse plafonnant à 99.9 max.
      */
-    public static function calculateAnalogInconsistencyScore(float $consistencyScore, float $inflectionPoint = 0.72, float $steepness = 12.0): float
+    public static function calculateAnalogInconsistencyScore(float $consistencyScore, $inflectionOrProfile = 0.72, float $steepness = 12.0): float
     {
         $s = max(0.0, min(1.0, $consistencyScore));
         if ($s >= 0.98) {
             return 0.0;
         }
 
+        if ($inflectionOrProfile instanceof NetworkProfile) {
+            $inflectionPoint = $inflectionOrProfile->getInflectionPoint();
+        } elseif (is_array($inflectionOrProfile)) {
+            $inflectionPoint = (float)($inflectionOrProfile['inflectionPoint'] ?? $inflectionOrProfile['inflection_point'] ?? 0.72);
+        } else {
+            $inflectionPoint = (float)$inflectionOrProfile;
+        }
+
         $asymptote = 99.9;
         $raw = 1.0 / (1.0 + exp($steepness * ($s - $inflectionPoint)));
         $minVal = 1.0 / (1.0 + exp($steepness * (1.0 - $inflectionPoint)));

package/src/php/WordPress/WpDbStore.php

@@ -156,4 +156,31 @@ class WpDbStore implements IStore
         );
         return is_numeric($deleted) ? (int)$deleted : 0;
     }
+
+    /**
+     * Returns the total number of records currently stored.
+     */
+    public function getTotalCount(): int
+    {
+        if (!$this->db || !method_exists($this->db, 'get_var')) {
+            return 0;
+        }
+        $count = $this->db->get_var("SELECT COUNT(*) FROM `{$this->table}`");
+        return is_numeric($count) ? (int)$count : 0;
+    }
+
+    /**
+     * Returns the number of expired records awaiting cron deletion.
+     */
+    public function getExpiredCount(): int
+    {
+        if (!$this->db || !method_exists($this->db, 'get_var') || !method_exists($this->db, 'prepare')) {
+            return 0;
+        }
+        $now = time();
+        $count = $this->db->get_var(
+            $this->db->prepare("SELECT COUNT(*) FROM `{$this->table}` WHERE expires_at IS NOT NULL AND expires_at < %d", $now)
+        );
+        return is_numeric($count) ? (int)$count : 0;
+    }
 }