@anonympins/fingerprint 0.8.0 → 0.8.2

package/src/php/FingerprintEngine.php

@@ -173,11 +173,12 @@ class FingerprintEngine
                     Env::set('ED25519_PUBLIC_KEY', $storedKeys['publicKey']);
                 } elseif (defined('OPENSSL_KEYTYPE_ED25519')) {
                     $pkey = openssl_pkey_new(["private_key_type" => OPENSSL_KEYTYPE_ED25519]);
-                    $pemResult = ChallengeUtils::generateIssuerPemKeys();
-                    $privateKeyPem = $pemResult['privateKey'];
-                    $publicKeyPem = $pemResult['publicKey'];
-                    Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
-                    Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                    if ($pkey && openssl_pkey_export($pkey, $privateKeyPem)) {
+                        $details = openssl_pkey_get_details($pkey);
+                        $publicKeyPem = $details['key'] ?? '';
+                        Env::set('ED25519_PRIVATE_KEY', $privateKeyPem);
+                        Env::set('ED25519_PUBLIC_KEY', $publicKeyPem);
+                    }
                     update_option('fingerprint_ed25519_keys', [
                         'privateKey' => $privateKeyPem,
                         'publicKey'  => $publicKeyPem,
@@ -227,12 +228,25 @@ class FingerprintEngine
      */
     private static function initStandaloneEd25519Keys(): void
     {
-        $configDir = dirname(__DIR__, 1) . '/config';
-        $persistentKeyPath = $configDir . '/ed25519_key.json';
+        if (function_exists('get_option')) {
+            return; // Managed exclusively via WordPress options in WP runtime
+        }
+
+        if (function_exists('wp_upload_dir') && function_exists('wp_mkdir_p')) {
+            $uploadDir = wp_upload_dir();
+            $configDir = (!empty($uploadDir['basedir']) && is_dir($uploadDir['basedir']))
+                ? $uploadDir['basedir'] . '/anonympins-bot-mitigation-pow'
+                : sys_get_temp_dir();
+        } else {
+            $envKeyDir = Env::get('FINGERPRINT_KEY_DIR');
+            $configDir = !empty($envKeyDir) ? (string)$envKeyDir : sys_get_temp_dir();
+        }
+        $persistentKeyPath = rtrim($configDir, '/\\') . '/ed25519_key.json';
 
         if (file_exists($persistentKeyPath)) {
             try {
-                $keys = json_decode((string)file_get_contents($persistentKeyPath), true);
+                $raw = (string)file_get_contents($persistentKeyPath);
+                $keys = json_decode($raw, true);
                 if (isset($keys['privateKey'], $keys['publicKey'])) {
                     Env::set('ED25519_PRIVATE_KEY', $keys['privateKey']);
                     Env::set('ED25519_PUBLIC_KEY', $keys['publicKey']);
@@ -253,11 +267,11 @@ class FingerprintEngine
                             if (function_exists('wp_mkdir_p')) {
                                 wp_mkdir_p($configDir);
                             } else {
-                                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir -- Non-WordPress standalone environment fallback
-                                mkdir($configDir, 0777, true);
+                                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir -- Standalone filesystem fallback
+                                @mkdir($configDir, 0700, true);
                             }
                         }
-                        // phpcs:ignore PluginCheck.CodeAnalysis.WriteFile.PluginDirectoryWrite -- Non-WordPress standalone environment fallback
+                        // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents
                         file_put_contents($persistentKeyPath, json_encode([
                             'privateKey' => $privateKeyPem,
                             'publicKey' => $publicKeyPem
@@ -346,7 +360,13 @@ class FingerprintEngine
      */
     private static function loadBotWhitelist(string $filename, array $fallbackEntries): array
     {
-        $configDir = dirname(__DIR__, 2) . '/config';
+        if (defined('ANONYMPINS_BOT_MITIGATION_DIR')) {
+            $configDir = rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/config';
+        } elseif (is_dir(__DIR__ . '/config')) {
+            $configDir = __DIR__ . '/config';
+        } else {
+            $configDir = __DIR__;
+        }
         $filePath = $configDir . '/' . $filename;
         if (file_exists($filePath)) {
             try {
@@ -670,6 +690,21 @@ class FingerprintEngine
      */
     private function checkAllowlists(RequestContext $context): bool
     {
+        // Auto-whitelisting des pairs fédérés
+        $peers = $this->securityConfig['federatedPeers'] ?? [];
+        if (!empty($peers)) {
+            $allowedHosts = array_map(function ($url) {
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Covered by wp_parse_url, Fallback for standalone PHP environments
+                $host = function_exists('wp_parse_url') ? wp_parse_url($url, PHP_URL_HOST) : parse_url($url, PHP_URL_HOST);
+                return !empty($host) ? $host : $url;
+            }, $peers);
+
+            if (in_array($context->clientIp, $allowedHosts, true)) {
+                $this->log("Federated peer auto-whitelisted", ['clientIp' => $context->clientIp]);
+                return true;
+            }
+        }
+
         $whitelisted = false;
         $type = '';
 
@@ -682,6 +717,15 @@ class FingerprintEngine
         } elseif ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
             $whitelisted = true;
             $type = 'host_path_allowlist';
+        } elseif (StoreManager::getStore()->has("federated-whitelist:ip:{$context->clientIp}")) {
+            $whitelisted = true;
+            $type = 'federated_whitelist_ip';
+        } elseif (($subnet = RequestUtils::getIpSubnet($context->clientIp)) && StoreManager::getStore()->has("federated-whitelist:subnet:{$subnet}")) {
+            $whitelisted = true;
+            $type = 'federated_whitelist_subnet';
+        } elseif (($ua = $context->getHeader('user-agent')) && StoreManager::getStore()->has("federated-whitelist:user_agent:{$ua}")) {
+            $whitelisted = true;
+            $type = 'federated_whitelist_user_agent';
         } elseif ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
             $whitelisted = true;
             $type = 'graphql_operation_allowlist';
@@ -876,12 +920,13 @@ class FingerprintEngine
         // --- Computation of the various suspicion scores ---
 
         // Fingerprint inconsistency score (moved here to be with the others)
+        $netProfile = AsnLookupEngine::getInstance()->lookup($context->clientIp);
         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
         $consistencyScore = FingerprintBuilder::compare($deviceData['initialDeviceHash'] ?? '', $currentDeviceHash);
-        $similarityThreshold = (float)($this->securityConfig['similarityThreshold'] ?? 0.72);
+        $similarityThreshold = (float)($this->securityConfig['similarityThreshold'] ?? $netProfile->getInflectionPoint());
         $inconsistencyScore = RequestUtils::calculateAnalogInconsistencyScore($consistencyScore, $similarityThreshold);
 
-        $behavioral = RequestUtils::getBehavioralIndicators($context, $deviceData);
+        $behavioral = RequestUtils::getBehavioralIndicators($context, $deviceData, $netProfile);
 
         // Header anomaly score
         $headerAnomalies = RequestUtils::getHeaderAnomalies($context);
@@ -1272,8 +1317,9 @@ class FingerprintEngine
             return $decision;
         }
 
-        // --- PRIVATE ACCESS TOKENS (PAT / RFC 9505 & Privacy Pass) ZERO-FRICTION BYPASS ---
+        // --- PRIVATE ACCESS TOKENS (PAT / RFC 9578 & Privacy Pass) ZERO-FRICTION CHALLENGE EXEMPTION ---
         $rawPatTokens = RequestUtils::extractPrivateAccessTokens($context);
+        $hasValidPat = false;
         if (!empty($rawPatTokens)) {
             $patConfig = $this->securityConfig['pat'] ?? [];
             foreach ($rawPatTokens as $rawToken) {
@@ -1285,16 +1331,12 @@ class FingerprintEngine
                         if ($isValid) {
                             $nonceTtl = $patConfig['nonceTtl'] ?? 86400;
                             $store->set($nonceKey, true, $nonceTtl);
-                            $this->log('Private Access Token (PAT) cryptographically verified - granting zero-friction bypass', [
+                            $this->log('Private Access Token (PAT) cryptographically verified - challenge exemption enabled', [
                                 'tokenType' => $parsedToken['tokenType'],
                                 'tokenKeyId' => $parsedToken['tokenKeyId']
                             ]);
-                            $decision = [
-                                'action' => 'next',
-                                'score' => 0.0,
-                                'vector' => ['pat_verified' => 100.0, 'privacy_pass' => 100.0]
-                            ];
-                            return $decision;
+                            $hasValidPat = true;
+                            break;
                         }
                     }
                 }
@@ -1365,14 +1407,12 @@ class FingerprintEngine
                                     $isMemValid = true;
                                 } else {
                                     $memSolution = $context->query['pow_solution_mem'] ?? null;
-                                    $isMemValid = ($memSolution !== null && $memSolution !== '')
-                                        ? ChallengeUtils::verifyMemoryPoW(
+                                    $isMemValid = $memSolution !== null && $memSolution !== '' && ChallengeUtils::verifyMemoryPoW(
                                             $powNonce,
                                             (string)$memSolution,
                                             $challengeContext['memDifficulty'] ?? 0,
                                             $challengeContext['clientSecret'] ?? ''
-                                        )
-                                        : false;
+                                        );
                                 }
                                 $isValid = $isValid && $isMemValid;
                             }
@@ -1410,8 +1450,9 @@ class FingerprintEngine
                                 'jsonLastError' => json_last_error_msg()
                             ]);
                             if (json_last_error() === JSON_ERROR_NONE) {
-                                // @phpstan-ignore-next-line - The instance is managed by the singleton
-                                $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
+                                $defaultPath = defined('ANONYMPINS_BOT_MITIGATION_DIR')
+                                    ? rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/config/problems.config.json'
+                                    : (file_exists(__DIR__ . '/config/problems.config.json') ? __DIR__ . '/config/problems.config.json' : null);
                                 $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                                 $problemManager = \Anonympins\Fingerprint\ProblemManager::getInstance($configPath, $store);
                                 // FIX: The solution is directly $workResult, not a sub-property.
@@ -1490,7 +1531,7 @@ class FingerprintEngine
         $deviceId = $context->cookies['device_id'] ?? '';
         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
         $allowRoaming = $this->securityConfig['allowCrossNetworkRoaming'] ?? false;
-        if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie, $deviceId, $currentDeviceHash, $allowRoaming, $zkpProof)) {
+        if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie, $deviceId, $currentDeviceHash, $allowRoaming, $zkpProof) || $hasValidPat) {
             $hasValidTicket = true;
             MetricsManager::incrementCounter('tickets_valid_total');
             // We do not return immediately to allow re-challenging.
@@ -1517,6 +1558,9 @@ class FingerprintEngine
         }
 
         $suspicionVector = $context->preCalculatedVector ?? $this->getSuspicionVector($context, $suspicionVector);
+        if ($hasValidPat) {
+            $suspicionVector['pat_verified'] = 100.0;
+        }
         $finalScore = $context->preCalculatedScore ?? $this->calculateFinalScore($suspicionVector);
         $this->log('Suspicion vector and final score calculated', [
             'finalScore' => round($finalScore, 2),
@@ -1692,7 +1736,9 @@ class FingerprintEngine
 
                 if ($shouldUseUsefulWork) {
                     $this->log('Issuing a useful work challenge', ['finalScore' => $finalScore]);
-                    $defaultPath = dirname(__DIR__, 1) . '/config/problems.config.json';
+                    $defaultPath = defined('ANONYMPINS_BOT_MITIGATION_DIR')
+                        ? rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/config/problems.config.json'
+                        : (file_exists(__DIR__ . '/config/problems.config.json') ? __DIR__ . '/config/problems.config.json' : null);
                     $configPath = $this->securityConfig['usefulWorkConfigPath'] ?? (file_exists($defaultPath) ? $defaultPath : null);
                     $problemManager = ProblemManager::getInstance($configPath, $store);
                     $work = $problemManager->dispatchWork($finalScore);
@@ -1984,6 +2030,56 @@ class FingerprintEngine
         }
     }
 
+    public function broadcastWhitelist(string $entry, string $entryType = 'ip', int $ttl = 86400): void
+    {
+        $peers = $this->securityConfig['federatedPeers'] ?? [];
+        if (empty($peers)) return;
+
+        $cleanEntry = trim($entry);
+        if ($cleanEntry === '*' || $cleanEntry === '0.0.0.0/0' || $cleanEntry === '::/0') {
+            throw new \InvalidArgumentException('Permissive wildcard entries are prohibited');
+        }
+        if ($cleanEntry === '') {
+            return;
+        }
+
+        $boundedTtl = min(604800, max(60, $ttl));
+        $ts = (int)(microtime(true) * 1000);
+        $msg = "{$ts}:whitelist:{$entryType}:{$cleanEntry}";
+
+        $privateKey = Env::get('ED25519_PRIVATE_KEY');
+        if (!$privateKey) {
+            throw new \RuntimeException('ED25519_PRIVATE_KEY is required for federated whitelist broadcast');
+        }
+
+        $signature = '';
+        try {
+            $cleanKey = str_replace('\n', "\n", $privateKey);
+            $pkeyObj = openssl_pkey_get_private($cleanKey);
+            if ($pkeyObj && openssl_sign($msg, $sigBytes, $pkeyObj, null)) {
+                $signature = bin2hex($sigBytes);
+            }
+        } catch (\Throwable $e) {
+            return;
+        }
+        if (empty($signature)) return;
+
+        foreach ($peers as $peerUrl) {
+            $this->asyncPost($peerUrl . '?coop_op=share_whitelist', [
+                'entry' => $cleanEntry,
+                'entry_type' => $entryType,
+                'signature_ed25519' => $signature,
+                'timestamp' => $ts,
+                'ttl' => $boundedTtl,
+            ]);
+        }
+    }
+
+    public function broadcastWhitelistedEntry(string $entry, string $entryType = 'ip', int $ttl = 86400): void
+    {
+        $this->broadcastWhitelist($entry, $entryType, $ttl);
+    }
+
     /**
      * Sends an asynchronous HTTP POST request to a given URL with the given
      * parameters (JSON-encoded). Uses non-blocking stream sockets with a short

package/src/php/NetworkProfile.php

@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint;
+
+/**
+ * Profils de connectivité réseau et paramètres de modulation pour le scoring analogique.
+ */
+class NetworkProfile
+{
+    public const RESIDENTIAL = 'RESIDENTIAL';
+    public const CELLULAR = 'CELLULAR';
+    public const SATELLITE = 'SATELLITE';
+    public const HOSTING = 'HOSTING';
+    public const ANONYMIZER = 'ANONYMIZER';
+
+    private string $type;
+    private float $baseScore;
+    private float $inflectionPoint;
+    private bool $toleranceRotation;
+    private float $jitterTolerance;
+
+    public function __construct(
+        string $type,
+        float $baseScore,
+        float $inflectionPoint,
+        bool $toleranceRotation,
+        float $jitterTolerance
+    ) {
+        $this->type = $type;
+        $this->baseScore = $baseScore;
+        $this->inflectionPoint = $inflectionPoint;
+        $this->toleranceRotation = $toleranceRotation;
+        $this->jitterTolerance = $jitterTolerance;
+    }
+
+    public function getType(): string { return $this->type; }
+    public function getBaseScore(): float { return $this->baseScore; }
+    public function getInflectionPoint(): float { return $this->inflectionPoint; }
+    public function isToleranceRotation(): bool { return $this->toleranceRotation; }
+    public function getJitterTolerance(): float { return $this->jitterTolerance; }
+
+    public static function residential(): self
+    {
+        return new self(self::RESIDENTIAL, 0.0, 0.72, false, 60.0);
+    }
+
+    public static function cellular(): self
+    {
+        return new self(self::CELLULAR, 10.0, 0.60, true, 80.0);
+    }
+
+    public static function satellite(): self
+    {
+        return new self(self::SATELLITE, 15.0, 0.68, false, 150.0);
+    }
+
+    public static function hosting(): self
+    {
+        return new self(self::HOSTING, 55.0, 0.85, false, 30.0);
+    }
+
+    public static function anonymizer(): self
+    {
+        return new self(self::ANONYMIZER, 85.0, 0.90, false, 40.0);
+    }
+}

package/src/php/ProblemManager.php

@@ -36,8 +36,18 @@ class ProblemManager
     {
         if (self::$instance === null) {
             if ($configPath === null) {
-                $defaultPath = dirname(__DIR__, 2) . '/config/problems.config.json';
-                $configPath = file_exists($defaultPath) ? $defaultPath : null;
+                $candidateDirs = [];
+                if (defined('ANONYMPINS_BOT_MITIGATION_DIR')) {
+                    $candidateDirs[] = rtrim(ANONYMPINS_BOT_MITIGATION_DIR, '/\\') . '/config';
+                }
+                $candidateDirs[] = __DIR__ . '/config';
+                foreach ($candidateDirs as $dir) {
+                    $p = $dir . '/problems.config.json';
+                    if (file_exists($p)) {
+                        $configPath = $p;
+                        break;
+                    }
+                }
             }
             // Error if accessed before initialization
             if ($configPath === null || $store === null) {

package/src/php/Tests/AsnLookupTest.php

@@ -0,0 +1,61 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\AsnLookupEngine;
+use Anonympins\Fingerprint\NetworkProfile;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class AsnLookupTest extends TestCase
+{
+    private AsnLookupEngine $engine;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+        $this->engine = AsnLookupEngine::getInstance();
+    }
+
+    public function testDatacenterResolutionAndPriorScore(): void
+    {
+        $hetzner = $this->engine->lookup('95.216.12.34');
+        $this->assertSame('HOSTING', $hetzner->getType());
+        $this->assertSame(55.0, $hetzner->getBaseScore());
+        $this->assertSame(0.85, $hetzner->getInflectionPoint());
+        $this->assertFalse($hetzner->isToleranceRotation());
+
+        $aws = $this->engine->lookup('54.210.1.20');
+        $this->assertSame('HOSTING', $aws->getType());
+        $this->assertSame(55.0, $aws->getBaseScore());
+    }
+
+    public function testMobileCgnatResolution(): void
+    {
+        $cgnat = $this->engine->lookup('100.70.1.25');
+        $this->assertSame('CELLULAR', $cgnat->getType());
+        $this->assertSame(10.0, $cgnat->getBaseScore());
+        $this->assertSame(0.60, $cgnat->getInflectionPoint());
+        $this->assertTrue($cgnat->isToleranceRotation());
+    }
+
+    public function testStarlinkSatelliteResolution(): void
+    {
+        $starlink = $this->engine->lookup('98.97.10.5');
+        $this->assertSame('SATELLITE', $starlink->getType());
+        $this->assertSame(15.0, $starlink->getBaseScore());
+        $this->assertSame(150.0, $starlink->getJitterTolerance());
+    }
+
+    public function testAnalogInconsistencyModulation(): void
+    {
+        $consistency = 0.80; // Incohérence légère de rendu
+        $scoreDatacenter = RequestUtils::calculateAnalogInconsistencyScore($consistency, NetworkProfile::hosting());
+        $scoreMobile = RequestUtils::calculateAnalogInconsistencyScore($consistency, NetworkProfile::cellular());
+
+        $this->assertGreaterThan(55.0, $scoreDatacenter, 'Sur Datacenter (0.80 < 0.85), la suspicion décolle au-dessus de 55.0');
+        $this->assertLessThan(10.0, $scoreMobile, 'Sur Mobile (0.80 > 0.60), la variation est entièrement absorbée (< 10.0)');
+    }
+}

package/src/php/Tests/FingerprintEngineTest.php

@@ -303,11 +303,12 @@ class FingerprintEngineTest extends TestCase
             $this->markTestSkipped('Ed25519 is not supported in this PHP/OpenSSL environment.');
         }
 
-        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        $configDir = sys_get_temp_dir() . '/anonympins-test-keys-' . time();
         if (!is_dir($configDir)) {
             mkdir($configDir, 0777, true);
         }
         $keyPath = $configDir . '/ed25519_key.json';
+        Env::set('FINGERPRINT_KEY_DIR', $configDir);
 
         Env::clear('ED25519_PRIVATE_KEY');
         Env::clear('ED25519_PUBLIC_KEY');
@@ -338,11 +339,12 @@ class FingerprintEngineTest extends TestCase
 
     public function testEd25519KeyLoadingFromDisk(): void
     {
-        $configDir = dirname(__FILE__, 3) . '/config'; // Match engine's behavior
+        $configDir = sys_get_temp_dir() . '/anonympins-test-keys-' . time();
         if (!is_dir($configDir)) {
             mkdir($configDir, 0777, true);
         }
         $keyPath = $configDir . '/ed25519_key.json';
+        Env::set('FINGERPRINT_KEY_DIR', $configDir);
 
         $dummyKeys = [
             'privateKey' => '-----BEGIN PRIVATE KEY-----\ndummy-php-private\n-----END PRIVATE KEY-----',

package/src/php/Utils/Env.php

@@ -21,10 +21,15 @@ class Env
         }
         // phpcs:disable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash -- Environment and server variables may contain raw cryptographic keys.
         if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
-            return $_ENV[$key];
+            $envVal = function_exists('wp_unslash') ? wp_unslash($_ENV[$key]) : $_ENV[$key];
+            return is_string($envVal) ? (function_exists('sanitize_textarea_field') ? sanitize_textarea_field($envVal) : $envVal) : $envVal;
         }
         if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
-            return $_SERVER[$key];
+            $serverVal = function_exists('wp_unslash') ? wp_unslash($_SERVER[$key]) : $_SERVER[$key];
+            if (is_string($serverVal)) {
+                return function_exists('sanitize_textarea_field') ? sanitize_textarea_field($serverVal) : $serverVal;
+            }
+            return $serverVal;
         }
         // phpcs:enable WordPress.Security.ValidatedSanitizedInput.InputNotSanitized,WordPress.Security.ValidatedSanitizedInput.MissingUnslash
         $val = getenv($key);

package/src/php/Utils/RequestUtils.php

@@ -9,6 +9,8 @@ use Anonympins\Fingerprint\FingerprintBuilder;
 use Anonympins\Fingerprint\Optimization\Optimization;
 use Anonympins\Fingerprint\RequestContext;
 use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\AsnLookupEngine;
+use Anonympins\Fingerprint\NetworkProfile;
 
 /**
  * Classe utilitaire pour l'analyse des requêtes et le calcul des scores de suspicion.
@@ -314,6 +316,7 @@ class RequestUtils
 
         $claimedBrowserInfo = self::parseUserAgent($ua);
         $claimedBrowser = $claimedBrowserInfo['browser'] ?? null;
+        $tlsSpoofingScore = 0.0;
 
         if (empty($claimedBrowser) || empty($ua)) {
             return ['tlsSpoofingScore' => 0.0];
@@ -365,7 +368,7 @@ class RequestUtils
         $echExpected = $context->getHeader('x-ech-expected') === 'true' || !empty($outerSni);
 
         if (!empty($outerSni) && !empty($host) && strcasecmp($outerSni, $host) !== 0 && !$hasEch) {
-            return ['tlsSpoofingScore' => max($tlsSpoofingScore ?? 0.0, 60.0)];
+            return ['tlsSpoofingScore' => max($tlsSpoofingScore, 60.0)];
         }
 
         $browserVer = (int)($claimedBrowserInfo['version'] ?? 0);
@@ -374,7 +377,7 @@ class RequestUtils
             ($claimedBrowser === 'Firefox' && $browserVer >= 118)
         );
         if ($context->isHttps && $isModernEchBrowser && $echExpected && !$hasEch) {
-            return ['tlsSpoofingScore' => max($tlsSpoofingScore ?? 0.0, 55.0)];
+            return ['tlsSpoofingScore' => max($tlsSpoofingScore, 55.0)];
         }
 
         return ['tlsSpoofingScore' => 0.0];
@@ -1021,7 +1024,7 @@ class RequestUtils
      * @param array<string, mixed> $deviceData
      * @return array{'historyScore': float, 'rotationScore': float}
      */
-    public static function getBehavioralIndicators(RequestContext $context, array &$deviceData): array
+    public static function getBehavioralIndicators(RequestContext $context, array &$deviceData, ?NetworkProfile $netProfile = null): array
     {
         $now = time() * 1000;
         $clientIp = $context->clientIp;
@@ -1089,6 +1092,11 @@ class RequestUtils
         $maxIpsPerDevice = 15;
         $freeIpChanges = 3;
         $historyScore = min(100.0, (max(0, count($deviceData['ips']) - $freeIpChanges) / $maxIpsPerDevice) * 100);
+        
+        // Mobile CGNAT : désactivation/amortissement de la pénalité de rotation rapide d'IP
+        if ($netProfile !== null && $netProfile->isToleranceRotation()) {
+            $historyScore = min($historyScore, 10.0);
+        }
         // Score de rotation basé sur les changements rapides de fingerprint
         $rotationScore = min(100.0, (($deviceData['rapidChangeCount'] ?? 0) / $maxRapidChanges) * 100);
 
@@ -1858,18 +1866,20 @@ class RequestUtils
      */
     public static function getIpReputationScore(string $ip): float
     {
+        $profile = AsnLookupEngine::getInstance()->lookup($ip);
+        $baseScore = $profile->getBaseScore();
         $store = StoreManager::getStore();
         $key = "ip-reputation:{$ip}";
         $data = $store->get($key);
         if ($data === null) {
-            return 0.0;
+            return $baseScore;
         }
 
         $now = time();
         $hoursPassed = ($now - $data['lastUpdate']) / 3600;
         $decay = (int)floor($hoursPassed * 2); // Décroissance de 2 points par heure
 
-        return (float)max(0.0, $data['score'] - $decay);
+        return (float)max($baseScore, $data['score'] - $decay);
     }
 
     /**
@@ -2693,13 +2703,21 @@ class RequestUtils
     /**
      * Calcule un score d'incohérence analogique et lisse plafonnant à 99.9 max.
      */
-    public static function calculateAnalogInconsistencyScore(float $consistencyScore, float $inflectionPoint = 0.72, float $steepness = 12.0): float
+    public static function calculateAnalogInconsistencyScore(float $consistencyScore, $inflectionOrProfile = 0.72, float $steepness = 12.0): float
     {
         $s = max(0.0, min(1.0, $consistencyScore));
         if ($s >= 0.98) {
             return 0.0;
         }
 
+        if ($inflectionOrProfile instanceof NetworkProfile) {
+            $inflectionPoint = $inflectionOrProfile->getInflectionPoint();
+        } elseif (is_array($inflectionOrProfile)) {
+            $inflectionPoint = (float)($inflectionOrProfile['inflectionPoint'] ?? $inflectionOrProfile['inflection_point'] ?? 0.72);
+        } else {
+            $inflectionPoint = (float)$inflectionOrProfile;
+        }
+
         $asymptote = 99.9;
         $raw = 1.0 / (1.0 + exp($steepness * ($s - $inflectionPoint)));
         $minVal = 1.0 / (1.0 + exp($steepness * (1.0 - $inflectionPoint)));

package/src/php/WordPress/WpDbStore.php

@@ -156,4 +156,31 @@ class WpDbStore implements IStore
         );
         return is_numeric($deleted) ? (int)$deleted : 0;
     }
+
+    /**
+     * Returns the total number of records currently stored.
+     */
+    public function getTotalCount(): int
+    {
+        if (!$this->db || !method_exists($this->db, 'get_var')) {
+            return 0;
+        }
+        $count = $this->db->get_var("SELECT COUNT(*) FROM `{$this->table}`");
+        return is_numeric($count) ? (int)$count : 0;
+    }
+
+    /**
+     * Returns the number of expired records awaiting cron deletion.
+     */
+    public function getExpiredCount(): int
+    {
+        if (!$this->db || !method_exists($this->db, 'get_var') || !method_exists($this->db, 'prepare')) {
+            return 0;
+        }
+        $now = time();
+        $count = $this->db->get_var(
+            $this->db->prepare("SELECT COUNT(*) FROM `{$this->table}` WHERE expires_at IS NOT NULL AND expires_at < %d", $now)
+        );
+        return is_numeric($count) ? (int)$count : 0;
+    }
 }