@anonympins/fingerprint 0.8.1 → 0.8.2

package/src/js/fingerprint.js

@@ -3885,9 +3885,27 @@ let store = inMemoryStore;
  * @param {IStore} externalStore - An implementation of the IStore interface.
  */
 export const configureStore = (externalStore) => {
+  if (externalStore && typeof externalStore.has !== 'function' && typeof externalStore.get === 'function') {
+    externalStore.has = async function (key) {
+      const val = await this.get(key);
+      return val !== null && val !== undefined;
+    };
+  }
   store = externalStore;
 };
 
+async function storeHas(key) {
+  if (!store) return false;
+  if (typeof store.has === 'function') {
+    return await store.has(key);
+  }
+  if (typeof store.get === 'function') {
+    const val = await store.get(key);
+    return val !== null && val !== undefined;
+  }
+  return false;
+}
+
 /**
  * Orchestrates request identification using a persistent anchor (cookie)
  * and fingerprint verification.
@@ -4706,7 +4724,7 @@ async function getThreatIntelScore(context, zkpY, threatIntelConfig = {}) {
 
     // 1. Détection déterministe : Clé publique ZKP bannie par consensus fédéré
     if (zkpY) {
-        const isBanned = await store.has(`banned-zkp-y:${zkpY}`);
+        const isBanned = await storeHas(`banned-zkp-y:${zkpY}`);
         if (isBanned) {
             score = 100.0;
             signals.push({
@@ -5252,12 +5270,16 @@ export class FingerprintEngine {
 
       const { clientIp = "unknown", path, cookies = {}, query = {}, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
 
-      if (query.coop_op) {
+      const queryCoopOp = query.coop_op || (typeof requestContext.body === 'object' && requestContext.body ? requestContext.body.coop_op : null);
+      if (queryCoopOp) {
+          const bodyObj = typeof requestContext.body === 'object' && requestContext.body !== null ? requestContext.body : {};
           const coopParams = {
               ...query,
-              signature: requestContext.headers?.['x-federation-signature'] || query.signature,
-              signature_ed25519: requestContext.headers?.['x-federation-signature-ed25519'] || query.signature_ed25519,
-              timestamp: requestContext.headers?.['x-federation-timestamp'] || query.timestamp
+              ...bodyObj,
+              coop_op: queryCoopOp,
+              signature: requestContext.headers?.['x-federation-signature'] || query.signature || bodyObj.signature,
+              signature_ed25519: requestContext.headers?.['x-federation-signature-ed25519'] || query.signature_ed25519 || bodyObj.signature_ed25519,
+              timestamp: requestContext.headers?.['x-federation-timestamp'] || query.timestamp || bodyObj.timestamp
           };
           const result = await handleCooperativeRequest(coopParams, clientIp, this.securityConfig);
           return {
@@ -5387,7 +5409,7 @@ export class FingerprintEngine {
             const parsedToken = parsePrivateAccessToken(rawToken);
             if (parsedToken) {
                 const nonceKey = `pat-nonce:${parsedToken.nonce}`;
-                const isReplayed = await store.has(nonceKey);
+                const isReplayed = await storeHas(nonceKey);
                 if (!isReplayed) {
                     const isValid = verifyPatSignature(parsedToken, patConfig);
                     if (isValid) {
@@ -5415,6 +5437,41 @@ export class FingerprintEngine {
     let whitelisted = false;
     let whitelistType = '';
 
+    // Auto-whitelisting des pairs fédérés
+    const federatedPeers = this.securityConfig.federatedPeers || [];
+    if (federatedPeers.length > 0) {
+      for (const peerUrl of federatedPeers) {
+        try {
+          if (new URL(peerUrl).hostname === clientIp || peerUrl === clientIp) {
+            whitelisted = true;
+            whitelistType = 'federated_peer';
+            break;
+          }
+        } catch (e) {
+          if (peerUrl === clientIp) {
+            whitelisted = true;
+            whitelistType = 'federated_peer';
+            break;
+          }
+        }
+      }
+    }
+
+    if (!whitelisted) {
+      const subnet = getIpSubnet(clientIp);
+      const ua = requestContext.headers?.['user-agent'] || '';
+      if (await storeHas(`federated-whitelist:ip:${clientIp}`)) {
+        whitelisted = true;
+        whitelistType = 'federated_whitelist_ip';
+      } else if (subnet && await storeHas(`federated-whitelist:subnet:${subnet}`)) {
+        whitelisted = true;
+        whitelistType = 'federated_whitelist_subnet';
+      } else if (ua && await storeHas(`federated-whitelist:user_agent:${ua}`)) {
+        whitelisted = true;
+        whitelistType = 'federated_whitelist_user_agent';
+      }
+    }
+
     if (this._isIpInAllowlist(clientIp)) {
       whitelisted = true;
       whitelistType = 'allowlist';
@@ -5912,7 +5969,7 @@ export class FingerprintEngine {
 
                   const threshold = this.securityConfig.federationConsensusThreshold || 3;
                   if (reportedPeers.length >= threshold) {
-                      if (!(await store.has(`banned-zkp-y:${zkpY}`))) {
+                      if (!(await storeHas(`banned-zkp-y:${zkpY}`))) {
                           await store.set(`banned-zkp-y:${zkpY}`, true, 86400 * 30); // Banni pour 30 jours
                       }
                   }
@@ -6459,6 +6516,62 @@ export async function handleCooperativeRequest(params, clientIp = '127.0.0.1', c
         return { status: 'synchronized', banned: false, reportsCount: reportedPeers.length };
     }
 
+    if (op === 'share_whitelist') {
+        const peers = config.federatedPeers || [];
+        if (peers.length > 0) {
+            const allowedIPsAndHosts = peers.map(url => {
+                try { return new URL(url).hostname; } catch(e) { return url; }
+            });
+            if (!allowedIPsAndHosts.includes(clientIp)) {
+                return { error: 'Unauthorized federation sender IP' };
+            }
+        }
+        const entry = params.entry;
+        const entryType = params.entry_type || 'ip'; // ip, subnet, user_agent
+        const sigEd25519 = params.signature_ed25519;
+        const timestampStr = params.timestamp;
+        const ttlStr = params.ttl || '86400';
+
+        if (!entry || !entry.trim() || !sigEd25519 || !timestampStr) {
+            return { error: 'Missing required parameters for share_whitelist' };
+        }
+
+        const trimmedEntry = entry.trim();
+        if (trimmedEntry === '*' || trimmedEntry === '0.0.0.0/0' || trimmedEntry === '::/0') {
+            return { error: 'Permissive wildcard entries are prohibited' };
+        }
+
+        const timestamp = Number(timestampStr);
+        if (isNaN(timestamp) || Math.abs(Date.now() - timestamp) > 300000) {
+            return { error: 'Timestamp expired or clock skew too high' };
+        }
+
+        const publicKey = config.ed25519_public_key || process.env.ED25519_PUBLIC_KEY;
+        if (!publicKey) {
+            return { error: 'Missing public key for asymmetric verification' };
+        }
+
+        const msg = `${timestamp}:whitelist:${entryType}:${trimmedEntry}`;
+        try {
+            const cleanKey = publicKey.replace(/\\n/g, '\n');
+            const isVerified = crypto.verify(
+                null,
+                Buffer.from(msg, 'utf8'),
+                { key: cleanKey, format: 'pem', type: 'spki' },
+                Buffer.from(sigEd25519, 'hex')
+            );
+            if (!isVerified) {
+                return { error: 'Invalid Ed25519 signature for whitelist synchronization' };
+            }
+        } catch (e) {
+            return { error: 'Asymmetric signature verification failed: ' + e.message };
+        }
+
+        const ttl = Math.min(604800, parseInt(ttlStr, 10) || 86400);
+        await store.set(`federated-whitelist:${entryType}:${trimmedEntry}`, true, ttl);
+        return { status: 'whitelist_synchronized', entry: trimmedEntry, entryType, ttl };
+    }
+
     const nodeId = params.node_id || '';
     if (!nodeId) {
         return { error: 'Missing node_id' };
@@ -6600,6 +6713,51 @@ export async function handleCooperativeRequest(params, clientIp = '127.0.0.1', c
     return null;
 }
 
+export async function broadcastWhitelistedEntry(entry, entryType = 'ip', ttl = 86400, config = {}) {
+    const peers = config.federatedPeers || [];
+    if (peers.length === 0 || !entry) return;
+
+    const trimmedEntry = entry.trim();
+    if (trimmedEntry === '*' || trimmedEntry === '0.0.0.0/0' || trimmedEntry === '::/0') {
+        throw new Error('Permissive wildcard entries are prohibited');
+    }
+
+    const ed25519Key = process.env.ED25519_PRIVATE_KEY || config.ed25519_private_key;
+    if (!ed25519Key) {
+        throw new Error('ED25519_PRIVATE_KEY is required for federated whitelist broadcast');
+    }
+
+    const ts = Date.now();
+    const msg = `${ts}:whitelist:${entryType}:${trimmedEntry}`;
+    const cleanKey = ed25519Key.replace(/\\n/g, '\n');
+    const signature = crypto.sign(null, Buffer.from(msg, 'utf8'), {
+        key: cleanKey,
+        format: 'pem',
+        type: 'pkcs8'
+    }).toString('hex');
+
+    const boundedTtl = Math.min(604800, parseInt(ttl, 10) || 86400);
+
+    peers.forEach(peerUrl => {
+        const url = `${peerUrl}?coop_op=share_whitelist`;
+        fetch(url, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-Federation-Signature-Ed25519': signature,
+                'X-Federation-Timestamp': String(ts)
+            },
+            body: JSON.stringify({
+                entry: trimmedEntry,
+                entry_type: entryType,
+                ttl: boundedTtl,
+                signature_ed25519: signature,
+                timestamp: ts
+            })
+        }).catch(() => {});
+    });
+}
+
 
 /** @type {Map<number, number>} Cache des TTL optimisés par score de suspicion (clés de 0 à 100 par pas de 10) */
 let optimizedTtlCache = new Map();
@@ -7464,6 +7622,7 @@ export const __internal = {
     findPeerInSubnet,
     handleCooperativeRequest,
     broadcastBannedZkp,
+    broadcastWhitelistedEntry,
     generateIssuerPemKeys,
     getMetric,
     incrementCounter,

package/src/php/Challenge/ChallengeUtils.php

@@ -236,6 +236,31 @@ class ChallengeUtils
         return $activePeers[array_rand($activePeers)];
     }
 
+    public static function verifyEd25519Signature(string $message, string $signatureHex, array $config = []): bool
+    {
+        if (empty($message) || empty($signatureHex)) {
+            return false;
+        }
+        $publicKey = $config['ed25519_public_key'] ?? Env::get('ED25519_PUBLIC_KEY');
+        if (empty($publicKey)) {
+            return false;
+        }
+        try {
+            $cleanKey = str_replace('\n', "\n", $publicKey);
+            $pubKeyObj = openssl_pkey_get_public($cleanKey);
+            if (!$pubKeyObj) {
+                return false;
+            }
+            $sigBytes = hex2bin($signatureHex);
+            if ($sigBytes === false) {
+                return false;
+            }
+            return openssl_verify($message, $sigBytes, $pubKeyObj, null) === 1;
+        } catch (\Throwable $e) {
+            return false;
+        }
+    }
+
     /**
      * Handles cooperative peer-to-peer operations (federation threat intel sharing,
      * node registration, peer discovery, WebRTC signaling, block requests/responses).
@@ -261,7 +286,7 @@ class ChallengeUtils
             $peers = $config['federatedPeers'] ?? [];
             if (!empty($peers)) {
                 $allowedHosts = array_map(function ($url) {
-                    // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url
+                    // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Fallback for standalone PHP environments
                     $host = function_exists('wp_parse_url') ? wp_parse_url($url, PHP_URL_HOST) : parse_url($url, PHP_URL_HOST);
                     return !empty($host) ? $host : $url;
                 }, $peers);
@@ -289,18 +314,8 @@ class ChallengeUtils
             $msg = "{$timestamp}:{$zkpY}";
 
             if (!empty($sigEd25519)) {
-                $publicKey = $config['ed25519_public_key'] ?? Env::get('ED25519_PUBLIC_KEY');
-                if (!$publicKey) {
-                    return ['error' => 'Missing public key for asymmetric verification'];
-                }
-                try {
-                    $cleanKey = str_replace('\n', "\n", $publicKey);
-                    $pubKeyObj = openssl_pkey_get_public($cleanKey);
-                    if (!$pubKeyObj || openssl_verify($msg, hex2bin($sigEd25519), $pubKeyObj, null) !== 1) {
-                        return ['error' => 'Invalid asymmetric federation signature'];
-                    }
-                } catch (\Throwable $e) {
-                    return ['error' => 'Asymmetric signature verification failed'];
+                if (!self::verifyEd25519Signature($msg, $sigEd25519, $config)) {
+                    return ['error' => 'Invalid asymmetric federation signature'];
                 }
             } elseif (!empty($sigHmac)) {
                 $secret = $params['federationSecret'] ?? $config['federationSecret'] ?? self::getPowSecret();
@@ -330,6 +345,51 @@ class ChallengeUtils
             return ['status' => 'synchronized', 'banned' => false, 'reportsCount' => count($reportedPeers)];
         }
 
+        if ($op === 'share_whitelist') {
+            $peers = $config['federatedPeers'] ?? [];
+            if (!empty($peers)) {
+                $allowedHosts = array_map(function ($url) {
+                    // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Fallback for standalone PHP environments
+                    $host = function_exists('wp_parse_url') ? wp_parse_url($url, PHP_URL_HOST) : parse_url($url, PHP_URL_HOST);
+                    return !empty($host) ? $host : $url;
+                }, $peers);
+
+                if (!in_array($clientIp, $allowedHosts, true)) {
+                    return ['error' => 'Unauthorized federation sender IP'];
+                }
+            }
+
+            $entry = $params['entry'] ?? '';
+            $entryType = $params['entry_type'] ?? 'ip';
+            $headers = function_exists('getallheaders') ? array_change_key_case(getallheaders(), CASE_LOWER) : [];
+            $sigEd25519 = $params['signature_ed25519'] ?? $headers['x-federation-signature-ed25519'] ?? self::getSanitizedServerVar('HTTP_X_FEDERATION_SIGNATURE_ED25519', '');
+            $timestamp = (int)($params['timestamp'] ?? $headers['x-federation-timestamp'] ?? self::getSanitizedServerVar('HTTP_X_FEDERATION_TIMESTAMP', 0));
+            $ttl = (int)($params['ttl'] ?? 86400);
+
+            $cleanEntry = trim($entry);
+            if ($cleanEntry === '' || empty($sigEd25519) || empty($timestamp)) {
+                return ['error' => 'Missing required parameters for share_whitelist'];
+            }
+
+            if ($cleanEntry === '*' || $cleanEntry === '0.0.0.0/0' || $cleanEntry === '::/0') {
+                return ['error' => 'Permissive wildcard entries are prohibited'];
+            }
+
+            $now = (int)(microtime(true) * 1000);
+            if (abs($now - $timestamp) > 300000) {
+                return ['error' => 'Timestamp expired or clock skew too high'];
+            }
+
+            $msg = "{$timestamp}:whitelist:{$entryType}:{$cleanEntry}";
+            if (!self::verifyEd25519Signature($msg, $sigEd25519, $config)) {
+                return ['error' => 'Invalid Ed25519 signature for whitelist synchronization'];
+            }
+
+            $boundedTtl = min(604800, max(60, $ttl));
+            $store->set("federated-whitelist:{$entryType}:{$cleanEntry}", true, $boundedTtl);
+            return ['status' => 'whitelist_synchronized', 'entry' => $cleanEntry, 'entryType' => $entryType, 'ttl' => $boundedTtl];
+        }
+
         $nodeId = $params['node_id'] ?? '';
         if (empty($nodeId)) {
             return ['error' => 'Missing node_id'];
@@ -645,15 +705,32 @@ class ChallengeUtils
                 if (function_exists('wp_mkdir_p')) {
                     wp_mkdir_p($outDir);
                 } else {
+                    // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir -- Standalone filesystem fallback
                     mkdir($outDir, 0755, true);
                 }
             }
             $privateKeyPath = rtrim($outDir, '/\\') . '/' . $privName;
             $publicKeyPath = rtrim($outDir, '/\\') . '/' . $pubName;
-            file_put_contents($privateKeyPath, $privateKeyPem);
-            @chmod($privateKeyPath, 0600);
-            file_put_contents($publicKeyPath, $publicKeyPem);
-            @chmod($publicKeyPath, 0644);
+
+            global $wp_filesystem;
+            if (empty($wp_filesystem) && defined('ABSPATH')) {
+                require_once ABSPATH . 'wp-admin/includes/file.php';
+                WP_Filesystem();
+            }
+
+            if (!empty($wp_filesystem) && is_object($wp_filesystem)) {
+                $wp_filesystem->put_contents($privateKeyPath, $privateKeyPem, 0600);
+                $wp_filesystem->put_contents($publicKeyPath, $publicKeyPem, 0644);
+            } else {
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- Standalone filesystem fallback
+                file_put_contents($privateKeyPath, $privateKeyPem);
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_chmod -- Standalone filesystem fallback
+                @chmod($privateKeyPath, 0600);
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents -- Standalone filesystem fallback
+                file_put_contents($publicKeyPath, $publicKeyPem);
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_chmod -- Standalone filesystem fallback
+                @chmod($publicKeyPath, 0644);
+            }
         }
 
         return [
@@ -1372,7 +1449,7 @@ class ChallengeUtils
             . '}' . "\n"
             . 'solve();';
 
-        return "<html><head><title>Security Check</title></head><body style=\"font-family:sans-serif; text-align:center; padding-top:50px;\"><h1>Security Check (Level 2)</h1><p>We are verifying your storage allocation. This may take a few seconds on first load.</p><div id=\"loader\" style=\"margin:20px;\">⚙️ Initializing storage space...</div><script>{$solverCode}</script><script>{$challengeScript}</script></body></html>";
+        return "<html><head><title>Security check</title></head><body style=\"font-family:sans-serif; text-align:center; padding-top:50px;\"><h1>Security check (level 2)</h1><p>We are verifying your storage allocation. This may take a few seconds on first load.</p><div id=\"loader\" style=\"margin:20px;\">⚙️ Initializing storage space...</div><script>{$solverCode}</script><script>{$challengeScript}</script></body></html>";
     }
 
     /**
@@ -1471,7 +1548,7 @@ class ChallengeUtils
             . '}' . "\n"
             . 'solve();';
 
-        $htmlTemplate = '<html><head><title>Advanced Security Check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced Verification... (Level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script><!-- FINGERPRINT_TRAPS --></body></html>';
+        $htmlTemplate = '<html><head><title>Advanced security check</title></head><body style="font-family:sans-serif; text-align:center; padding-top:50px;"><h1>Enhanced verification... (level 2)</h1><p>Your activity requires an additional security check. This may take a few moments.</p><div id="loader" style="margin:20px;">⚙️ Initializing combined verification...</div><script><!-- FINGERPRINT_SOLVER_SCRIPT --></script><script><!-- FINGERPRINT_CHALLENGE_SCRIPT --></script><!-- FINGERPRINT_TRAPS --></body></html>';
         $customTemplatePath = $securityConfig['challengePagePath'] ?? null;
 
         if ($customTemplatePath && file_exists($customTemplatePath)) {
@@ -1515,6 +1592,10 @@ class ChallengeUtils
         if (function_exists('sanitize_text_field')) {
             return sanitize_text_field($val);
         }
+        if (function_exists('wp_strip_all_tags')) {
+            return trim(wp_strip_all_tags($val));
+        }
+        // phpcs:ignore WordPress.WP.AlternativeFunctions.strip_tags_strip_tags -- Standalone fallback when running outside WordPress
         return trim(strip_tags($val));
     }
 

package/src/php/FingerprintEngine.php

@@ -267,6 +267,7 @@ class FingerprintEngine
                             if (function_exists('wp_mkdir_p')) {
                                 wp_mkdir_p($configDir);
                             } else {
+                                // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_mkdir -- Standalone filesystem fallback
                                 @mkdir($configDir, 0700, true);
                             }
                         }
@@ -689,6 +690,21 @@ class FingerprintEngine
      */
     private function checkAllowlists(RequestContext $context): bool
     {
+        // Auto-whitelisting des pairs fédérés
+        $peers = $this->securityConfig['federatedPeers'] ?? [];
+        if (!empty($peers)) {
+            $allowedHosts = array_map(function ($url) {
+                // phpcs:ignore WordPress.WP.AlternativeFunctions.parse_url_parse_url -- Covered by wp_parse_url, Fallback for standalone PHP environments
+                $host = function_exists('wp_parse_url') ? wp_parse_url($url, PHP_URL_HOST) : parse_url($url, PHP_URL_HOST);
+                return !empty($host) ? $host : $url;
+            }, $peers);
+
+            if (in_array($context->clientIp, $allowedHosts, true)) {
+                $this->log("Federated peer auto-whitelisted", ['clientIp' => $context->clientIp]);
+                return true;
+            }
+        }
+
         $whitelisted = false;
         $type = '';
 
@@ -701,6 +717,15 @@ class FingerprintEngine
         } elseif ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
             $whitelisted = true;
             $type = 'host_path_allowlist';
+        } elseif (StoreManager::getStore()->has("federated-whitelist:ip:{$context->clientIp}")) {
+            $whitelisted = true;
+            $type = 'federated_whitelist_ip';
+        } elseif (($subnet = RequestUtils::getIpSubnet($context->clientIp)) && StoreManager::getStore()->has("federated-whitelist:subnet:{$subnet}")) {
+            $whitelisted = true;
+            $type = 'federated_whitelist_subnet';
+        } elseif (($ua = $context->getHeader('user-agent')) && StoreManager::getStore()->has("federated-whitelist:user_agent:{$ua}")) {
+            $whitelisted = true;
+            $type = 'federated_whitelist_user_agent';
         } elseif ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
             $whitelisted = true;
             $type = 'graphql_operation_allowlist';
@@ -2005,6 +2030,56 @@ class FingerprintEngine
         }
     }
 
+    public function broadcastWhitelist(string $entry, string $entryType = 'ip', int $ttl = 86400): void
+    {
+        $peers = $this->securityConfig['federatedPeers'] ?? [];
+        if (empty($peers)) return;
+
+        $cleanEntry = trim($entry);
+        if ($cleanEntry === '*' || $cleanEntry === '0.0.0.0/0' || $cleanEntry === '::/0') {
+            throw new \InvalidArgumentException('Permissive wildcard entries are prohibited');
+        }
+        if ($cleanEntry === '') {
+            return;
+        }
+
+        $boundedTtl = min(604800, max(60, $ttl));
+        $ts = (int)(microtime(true) * 1000);
+        $msg = "{$ts}:whitelist:{$entryType}:{$cleanEntry}";
+
+        $privateKey = Env::get('ED25519_PRIVATE_KEY');
+        if (!$privateKey) {
+            throw new \RuntimeException('ED25519_PRIVATE_KEY is required for federated whitelist broadcast');
+        }
+
+        $signature = '';
+        try {
+            $cleanKey = str_replace('\n', "\n", $privateKey);
+            $pkeyObj = openssl_pkey_get_private($cleanKey);
+            if ($pkeyObj && openssl_sign($msg, $sigBytes, $pkeyObj, null)) {
+                $signature = bin2hex($sigBytes);
+            }
+        } catch (\Throwable $e) {
+            return;
+        }
+        if (empty($signature)) return;
+
+        foreach ($peers as $peerUrl) {
+            $this->asyncPost($peerUrl . '?coop_op=share_whitelist', [
+                'entry' => $cleanEntry,
+                'entry_type' => $entryType,
+                'signature_ed25519' => $signature,
+                'timestamp' => $ts,
+                'ttl' => $boundedTtl,
+            ]);
+        }
+    }
+
+    public function broadcastWhitelistedEntry(string $entry, string $entryType = 'ip', int $ttl = 86400): void
+    {
+        $this->broadcastWhitelist($entry, $entryType, $ttl);
+    }
+
     /**
      * Sends an asynchronous HTTP POST request to a given URL with the given
      * parameters (JSON-encoded). Uses non-blocking stream sockets with a short

package/src/php/Utils/RequestUtils.php

@@ -316,6 +316,7 @@ class RequestUtils
 
         $claimedBrowserInfo = self::parseUserAgent($ua);
         $claimedBrowser = $claimedBrowserInfo['browser'] ?? null;
+        $tlsSpoofingScore = 0.0;
 
         if (empty($claimedBrowser) || empty($ua)) {
             return ['tlsSpoofingScore' => 0.0];
@@ -367,7 +368,7 @@ class RequestUtils
         $echExpected = $context->getHeader('x-ech-expected') === 'true' || !empty($outerSni);
 
         if (!empty($outerSni) && !empty($host) && strcasecmp($outerSni, $host) !== 0 && !$hasEch) {
-            return ['tlsSpoofingScore' => max($tlsSpoofingScore ?? 0.0, 60.0)];
+            return ['tlsSpoofingScore' => max($tlsSpoofingScore, 60.0)];
         }
 
         $browserVer = (int)($claimedBrowserInfo['version'] ?? 0);
@@ -376,7 +377,7 @@ class RequestUtils
             ($claimedBrowser === 'Firefox' && $browserVer >= 118)
         );
         if ($context->isHttps && $isModernEchBrowser && $echExpected && !$hasEch) {
-            return ['tlsSpoofingScore' => max($tlsSpoofingScore ?? 0.0, 55.0)];
+            return ['tlsSpoofingScore' => max($tlsSpoofingScore, 55.0)];
         }
 
         return ['tlsSpoofingScore' => 0.0];