@prosopo/cli 3.8.6 → 3.8.8

package/.turbo/turbo-build$colon$cjs.log

@@ -1,5 +1,5 @@
 
-> @prosopo/cli@3.8.6 build:cjs
+> @prosopo/cli@3.8.8 build:cjs
 > NODE_ENV=${NODE_ENV:-development}; vite build --config vite.cjs.config.ts --mode $NODE_ENV
 
 ViteCommonJSConfig: .
@@ -27,7 +27,8 @@ ViteCommonJSConfig: .
     '/home/runner/work/captcha/captcha/packages/captcha-severity/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json'
+    '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/web-bot-auth/tsconfig.json'
   ]
 }
 {
@@ -54,7 +55,8 @@ ViteCommonJSConfig: .
     '@prosopo/captcha-severity',
     '@prosopo/datasets',
     '@prosopo/load-balancer',
-    '@prosopo/puzzle-assets'
+    '@prosopo/puzzle-assets',
+    '@prosopo/web-bot-auth'
   ]
 }
 The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
@@ -81,10 +83,10 @@ dist/cjs/reloader.cjs                              1.87 kB │ gzip: 0.76 kB
 dist/cjs/commands/migrateAbuserScoreThreshold.cjs  2.17 kB │ gzip: 0.90 kB
 dist/cjs/argv.cjs                                  2.30 kB │ gzip: 0.66 kB
 dist/cjs/start.cjs                                 2.45 kB │ gzip: 0.84 kB
-dist/cjs/commands/siteKeyRegisterApi.cjs           3.70 kB │ gzip: 1.19 kB
-dist/cjs/commands/siteKeyRegister.cjs              4.06 kB │ gzip: 1.22 kB
+dist/cjs/commands/siteKeyRegisterApi.cjs           3.77 kB │ gzip: 1.20 kB
+dist/cjs/commands/siteKeyRegister.cjs              4.13 kB │ gzip: 1.24 kB
 dist/cjs/prosopo.config.cjs                        4.63 kB │ gzip: 1.47 kB
-dist/cjs/RateLimiter.cjs                           5.58 kB │ gzip: 0.89 kB
+dist/cjs/RateLimiter.cjs                           5.78 kB │ gzip: 0.92 kB
 
 [EMPTY_IMPORT_META] `import.meta` may not be a valid syntax with the `cjs` output format.
     ╭─[ src/prosopo.config.ts:56:21 ]
@@ -94,4 +96,4 @@ dist/cjs/RateLimiter.cjs                           5.58 kB │ gzip: 0.89 kB
     │                             ╰─────── This `import.meta` will be replaced with an empty object (`{}`) automatically. If this is desired, you can suppress this warning by adding `transform.define: { 'import.meta': {} }`. If `import.meta` needs to be kept as-is, you need to set the output format to `esm`.
 ────╯
 
-✓ built in 64ms
+✓ built in 60ms

package/.turbo/turbo-build$colon$tsc.log

@@ -1,8 +1,8 @@
 
-> @prosopo/cli@3.8.6 build:tsc
+> @prosopo/cli@3.8.8 build:tsc
 > tsc --build --verbose
 
-1:16:13 PM - Projects in this build: 
+11:41:41 AM - Projects in this build: 
     * ../../dev/config/tsconfig.json
     * ../locale/tsconfig.json
     * ../util/tsconfig.json
@@ -26,61 +26,64 @@
     * ../datasets/tsconfig.json
     * ../load-balancer/tsconfig.json
     * ../puzzle-assets/tsconfig.json
+    * ../web-bot-auth/tsconfig.json
     * ../provider/tsconfig.json
     * ../../dev/workspace/tsconfig.json
     * tsconfig.json
 
-1:16:14 PM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/webpack/webpack.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../../dev/config/tsconfig.json' is up to date because newest input '../../dev/config/src/vite/vite.backend.config.ts' is older than output '../../dev/config/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../locale/tsconfig.json' is up to date because newest input '../locale/src/translationKey.ts' is older than output '../locale/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../util/tsconfig.json' is up to date because newest input '../util/src/url.ts' is older than output '../util/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../util-crypto/tsconfig.json' is up to date because newest input '../util-crypto/src/types.ts' is older than output '../util-crypto/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../types/tsconfig.json' is up to date because newest input '../types/src/types.test-d.ts' is older than output '../types/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/tests/apiHarness.ts' is older than output '../api/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../api/tsconfig.json' is up to date because newest input '../api/src/index.ts' is older than output '../api/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../logger/tsconfig.json' is up to date because newest input '../logger/src/index.ts' is older than output '../logger/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/utils/batches.ts' is older than output '../common/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../common/tsconfig.json' is up to date because newest input '../common/src/error.ts' is older than output '../common/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../dotenv/tsconfig.json' is up to date because newest input '../dotenv/src/env.ts' is older than output '../dotenv/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../dotenv/tsconfig.json' is up to date because newest input '../dotenv/src/env.ts' is older than output '../dotenv/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/IpInfoService.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../ipinfo/tsconfig.json' is up to date because newest input '../ipinfo/src/types.ts' is older than output '../ipinfo/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../api-route/tsconfig.json' is up to date because newest input '../api-route/src/apiRoutes.ts' is older than output '../api-route/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../redis-client/tsconfig.json' is up to date because newest input '../redis-client/src/index.ts' is older than output '../redis-client/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../user-access-policy/tsconfig.json' is up to date because newest input '../user-access-policy/src/transformRule.ts' is older than output '../user-access-policy/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/types.test-d.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../types-database/tsconfig.json' is up to date because newest input '../types-database/src/types/schemas.test.ts' is older than output '../types-database/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/unit/captchaLabel.unit.test.ts' is older than output '../database/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../database/tsconfig.json' is up to date because newest input '../database/src/tests/mongoGlobalSetup.ts' is older than output '../database/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/keyring/keyring.test.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../keyring/tsconfig.json' is up to date because newest input '../keyring/src/index.ts' is older than output '../keyring/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/env.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
+11:41:41 AM - Project '../types-env/tsconfig.json' is up to date because newest input '../types-env/src/index.ts' is older than output '../types-env/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/index.ts' is older than output '../env/tsconfig.tsbuildinfo'
+11:41:42 AM - Project '../env/tsconfig.json' is up to date because newest input '../env/src/env.ts' is older than output '../env/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/errorHandler.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
+11:41:42 AM - Project '../api-express-router/tsconfig.json' is up to date because newest input '../api-express-router/src/tests/unit/apiExpressDefaultEndpointAdapter.unit.test.ts' is older than output '../api-express-router/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
+11:41:42 AM - Project '../captcha-severity/tsconfig.json' is up to date because newest input '../captcha-severity/src/index.test.ts' is older than output '../captcha-severity/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/dataset.unit.test.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
+11:41:42 AM - Project '../datasets/tsconfig.json' is up to date because newest input '../datasets/src/tests/mocks/data/captchas.ts' is older than output '../datasets/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
+11:41:42 AM - Project '../load-balancer/tsconfig.json' is up to date because newest input '../load-balancer/src/balancer.ts' is older than output '../load-balancer/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/background.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
+11:41:42 AM - Project '../puzzle-assets/tsconfig.json' is up to date because newest input '../puzzle-assets/src/types.ts' is older than output '../puzzle-assets/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../provider/tsconfig.json' is up to date because newest input '../provider/src/util.ts' is older than output '../provider/tsconfig.tsbuildinfo'
+11:41:42 AM - Project '../web-bot-auth/tsconfig.json' is up to date because newest input '../web-bot-auth/src/base64.ts' is older than output '../web-bot-auth/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project '../../dev/workspace/tsconfig.json' is up to date because newest input '../../dev/workspace/src/index.ts' is older than output '../../dev/workspace/tsconfig.tsbuildinfo'
+11:41:42 AM - Project '../provider/tsconfig.json' is up to date because newest input '../provider/src/utils/devicePlatform.ts' is older than output '../provider/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+11:41:42 AM - Project '../../dev/workspace/tsconfig.json' is up to date because newest input '../../dev/workspace/src/index.ts' is older than output '../../dev/workspace/tsconfig.tsbuildinfo'
 
-1:16:14 PM - Building project '/home/runner/work/captcha/captcha/packages/cli/tsconfig.json'...
+11:41:42 AM - Project 'tsconfig.json' is out of date because output file 'tsconfig.tsbuildinfo' does not exist
+
+11:41:42 AM - Building project '/home/runner/work/captcha/captcha/packages/cli/tsconfig.json'...
 

package/.turbo/turbo-build.log

@@ -1,9 +1,9 @@
 
-> @prosopo/cli@3.8.6 build
+> @prosopo/cli@3.8.8 build
 > npm run build:cross-env -- --mode ${NODE_ENV:-development}
 
 
-> @prosopo/cli@3.8.6 build:cross-env
+> @prosopo/cli@3.8.8 build:cross-env
 > vite build --config vite.esm.config.ts --mode production
 
 ViteEsmConfig: .
@@ -31,7 +31,8 @@ ViteEsmConfig: .
     '/home/runner/work/captcha/captcha/packages/captcha-severity/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/datasets/tsconfig.json',
     '/home/runner/work/captcha/captcha/packages/load-balancer/tsconfig.json',
-    '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json'
+    '/home/runner/work/captcha/captcha/packages/puzzle-assets/tsconfig.json',
+    '/home/runner/work/captcha/captcha/packages/web-bot-auth/tsconfig.json'
   ]
 }
 {
@@ -58,7 +59,8 @@ ViteEsmConfig: .
     '@prosopo/captcha-severity',
     '@prosopo/datasets',
     '@prosopo/load-balancer',
-    '@prosopo/puzzle-assets'
+    '@prosopo/puzzle-assets',
+    '@prosopo/web-bot-auth'
   ]
 }
 The plugin "vite-tsconfig-paths" is detected. Vite now supports tsconfig paths resolution natively via the resolve.tsconfigPaths option. You can remove the plugin and set resolve.tsconfigPaths: true in your Vite config instead.
@@ -85,9 +87,9 @@ dist/reloader.js                              1.62 kB │ gzip: 0.69 kB
 dist/argv.js                                  1.98 kB │ gzip: 0.59 kB
 dist/commands/migrateAbuserScoreThreshold.js  2.11 kB │ gzip: 0.89 kB
 dist/start.js                                 2.23 kB │ gzip: 0.82 kB
-dist/commands/siteKeyRegisterApi.js           3.63 kB │ gzip: 1.19 kB
-dist/commands/siteKeyRegister.js              3.91 kB │ gzip: 1.22 kB
+dist/commands/siteKeyRegisterApi.js           3.71 kB │ gzip: 1.21 kB
+dist/commands/siteKeyRegister.js              3.99 kB │ gzip: 1.24 kB
 dist/prosopo.config.js                        4.49 kB │ gzip: 1.48 kB
-dist/RateLimiter.js                           5.16 kB │ gzip: 0.89 kB
+dist/RateLimiter.js                           5.35 kB │ gzip: 0.92 kB
 
-✓ built in 62ms
+✓ built in 57ms

package/CHANGELOG.md

@@ -1,5 +1,55 @@
 # @prosopo/cli
 
+## 3.8.8
+### Patch Changes
+
+- af267c2: Web Bot Auth verifier and an authenticated frictionless flow for pre-verified agents.
+  
+  **`@prosopo/web-bot-auth`** — a new package: an RFC 9421 HTTP Message Signatures verifier built on `@noble/curves/ed25519`, with no Cloudflare dependency. It parses `Signature-Agent` in both its bare-string and dictionary forms, resolves the signer's JWKS at `/.well-known/http-message-signatures-directory` honouring the response's cache-control TTL, and verifies the Ed25519 signature over the RFC 9421 signature base.
+  
+  **Provider fast path.** `/captcha/frictionless` returns `captchaType: authenticated` when a non-`deferToVerify` `AccessPolicyType.Allow` rule matches the request's user scope, and writes a session with `serverChecked: false`, `agent: true` and the issuing IP frozen for verify-time binding. Decrypt, bot score and the decision machine are all skipped. A verified `Signature-Agent` is one way to qualify — the userScope gains a `webBotAuthAgent` field, set only when signature verification succeeded so a rule scoped to a signer can never be matched by a spoofed header — but an IP CIDR, JA4, user agent, ASN or country rule qualifies the same way. A `Block` or `Restrict` on the same match set always wins, because severity outranks Allow.
+  
+  **`/client/authenticated/verify`.** A separate router with mandatory IP binding — the operator must forward the client IP (`API.AUTHENTICATED_IP_REQUIRED`) and it must match the one the session was issued to (`API.AUTHENTICATED_IP_MISMATCH`), so a leaked token cannot be replayed from elsewhere. Single use is enforced through `serverChecked`, and `captchaType` is checked so an ordinary captcha token cannot be redeemed on this route. `clientSessionId` correlation goes through the same `isClientSessionMismatch` helper as pow / image / puzzle, so the authenticated path cannot drift from the others.
+  
+  **Surface.** `AccessPolicyType.Allow` and `CaptchaType.authenticated`; `webBotAuthAgent` on the user scope (indexed, normalised at parse time to a lowercase scheme+host with no trailing slash); `Session.agent` / `Session.webBotAuthAgent` for the Traffic view's "pre-verified pass" filter; `submitAuthenticatedCaptchaVerify` on `ProviderApi` and the matching branch in `@prosopo/server.verifyProvider`; `AuthenticatedBadge` and a dispatch branch in `procaptcha-frictionless`.
+  
+  Three fixes the new end-to-end coverage turned up, each of which broke the flow outright:
+  
+  - `ipMatchesSession` compared the operator's parsed IP against the session's composite halves with `===`. A session read back from Mongo carries BSON (`Decimal128`, or `Long` on pre-migration records), not the `bigint` the type claims, so the comparison was false for every session that had been through the database — every legitimate redemption was rejected as `API.AUTHENTICATED_IP_MISMATCH`. Both halves are now normalised before comparison, and an unparseable half fails closed rather than defaulting to `0n`, so garbage still cannot match garbage.
+  - `serverChecked` was never written onto the authenticated session, so "never set" and "consumed" were distinguishable only by an absence. It is now written as `false` at issuance.
+  - `serverChecked` was missing from `SESSION_PROJECTION`. Left out, the single-use check reads `undefined` and an authenticated token verifies an unlimited number of times.
+- Updated dependencies [929d99b]
+- Updated dependencies [934fa5d]
+- Updated dependencies [27f525e]
+- Updated dependencies [a0c87c7]
+- Updated dependencies [af267c2]
+  - @prosopo/types@5.8.0
+  - @prosopo/provider@5.9.0
+  - @prosopo/api@4.2.0
+  - @prosopo/env@3.6.53
+  - @prosopo/keyring@2.9.86
+
+## 3.8.7
+### Patch Changes
+
+- 162f591: Make the MaxMind fallback answer lookups instead of silently failing all of them.
+  
+  `MaxMindBackend` was configured with `cityDbPath` pointing at `GeoLite2-Country.mmdb` (`MAXMIND_DB_PATH`), and only ever called `city()`. `Reader.open()` accepts any valid `.mmdb`, so the reader opened, `isAvailable()` reported `true`, and the backend advertised itself as a working fallback — but `city()` checks `metadata.databaseType` and throws `BadMethodCallError` against a Country database. The throw was swallowed at `debug` level, `asnReader` was never configured because nothing read a path for it, and every lookup fell through to `{ isValid: false, error: "No MaxMind data available for IP" }`.
+  
+  The failure was invisible for as long as ipapi.is was up, because `IpInfoService` only reaches MaxMind when the ipapi.is lookup fails. When the self-hosted ipapi.is sidecar went down on five production provider nodes, IP lookups did not degrade to MaxMind — they failed outright, and `compareIPs` returned "Failed to lookup both IP addresses" for every request whose challenge IP differed from its solution IP.
+  
+  Three changes:
+  
+  - `MaxMindBackend` latches the database kind on the first `BadMethodCallError` and uses `country()` from then on, so a Country database yields country and country code rather than nothing. The latch means the rejection is constructed once per process, not once per request, and a genuine City database never pays for a second lookup. The mismatch is logged once at `warn` with the offending path, because silent degradation is what let this sit unnoticed.
+  - `maxmindAsnDbPath` is read from `MAXMIND_ASN_DB_PATH`. The image has downloaded `GeoLite2-ASN.mmdb` alongside City and Country since the Dockerfile was written, but nothing ever opened it, so the fallback could not name a provider or an AS number.
+  - `deepValidateIpAddress` logs `ip1Error` and `ip2Error` alongside the top-level comparison error. "Failed to lookup both IP addresses" on its own does not distinguish an IP that is absent from the database from a backend that is down, and diagnosing the difference meant going onto the host.
+  
+  Deployments should also point `MAXMIND_DB_PATH` at `GeoLite2-City.mmdb`, which the image already ships: country-level data is enough for geoblocking but carries no coordinates, so the IP distance rule cannot run against it.
+- Updated dependencies [162f591]
+- Updated dependencies [9149dff]
+  - @prosopo/provider@5.8.1
+  - @prosopo/env@3.6.52
+
 ## 3.8.6
 ### Patch Changes
 

package/dist/RateLimiter.d.ts

@@ -103,6 +103,10 @@ export declare const getRateLimitConfig: () => {
         windowMs: string | undefined;
         limit: string | undefined;
     };
+    "/v1/prosopo/provider/client/authenticated/verify": {
+        windowMs: string | undefined;
+        limit: string | undefined;
+    };
     "/v1/prosopo/provider/admin/dns/event": {
         windowMs: string | undefined;
         limit: string | undefined;

package/dist/RateLimiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../src/RateLimiter.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuH9B,CAAC"}
+{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../src/RateLimiter.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2H9B,CAAC"}

package/dist/RateLimiter.js

@@ -106,6 +106,10 @@ var getRateLimitConfig = () => {
 			windowMs: process.env.PROSOPO_VERIFY_PUZZLE_CAPTCHA_SOLUTION_WINDOW,
 			limit: process.env.PROSOPO_VERIFY_PUZZLE_CAPTCHA_SOLUTION_LIMIT
 		},
+		[ClientApiPaths.VerifyAuthenticatedSession]: {
+			windowMs: process.env.PROSOPO_VERIFY_AUTHENTICATED_SESSION_WINDOW,
+			limit: process.env.PROSOPO_VERIFY_AUTHENTICATED_SESSION_LIMIT
+		},
 		[AdminApiPaths.DnsEvent]: {
 			windowMs: process.env.PROSOPO_DNS_EVENT_WINDOW,
 			limit: process.env.PROSOPO_DNS_EVENT_LIMIT

package/dist/RateLimiter.js.map

@@ -1 +1 @@
-{"version":3,"file":"RateLimiter.js","sourceRoot":"","sources":["../src/RateLimiter.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,EAAE;IACtC,OAAO;QACN,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;YAChE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,yCAAyC;SAC5D;QACD,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE;YACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wCAAwC;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,uCAAuC;SAC1D;QACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;YAC5C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,4CAA4C;YAClE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,2CAA2C;SAC9D;QACD,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;YAChE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,yCAAyC;SAC5D;QACD,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;YAChE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,yCAAyC;SAC5D;QACD,CAAC,cAAc,CAAC,8BAA8B,CAAC,EAAE;YAChD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iDAAiD;YACvE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gDAAgD;SACnE;QACD,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE;YAChC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;YACrD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;SACjD;QACD,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC;YACxD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;SACpD;QACD,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE;YACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC;YACzD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC;SACrD;QACD,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE;YAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;YACvD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;SACnD;QACD,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE;YAChC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;YACtD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;SAClD;QACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE;YACjC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;YACvD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;SACnD;QACD,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE;YAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;YACpD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;SAChD;QACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE;YAC/B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;YACrD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;SACjD;QACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC;YAC5D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC;SACxD;QACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC;YAC5D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC;SACxD;QACD,CAAC,cAAc,CAAC,+BAA+B,CAAC,EAAE;YACjD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,uCAAuC;YAC7D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC;SACzD;QACD,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC;YACzD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC;SACrD;QACD,CAAC,aAAa,CAAC,sBAAsB,CAAC,EAAE;YACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wCAAwC;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,uCAAuC;SAC1D;QACD,CAAC,aAAa,CAAC,yBAAyB,CAAC,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,2CAA2C;YACjE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;SAC7D;QACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC;YAC5D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC;SACxD;QACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE;YACjC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;YACvD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;SACnD;QACD,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;YAC3B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;SAC5C;QACD,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE;YAC3C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,2CAA2C;YACjE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;SAC7D;QACD,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAAE;YAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6CAA6C;YACnE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,4CAA4C;SAC/D;QACD,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAAE;YAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6CAA6C;YACnE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,4CAA4C;SAC/D;QACD,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;YACzB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAC9C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;SAC1C;QACD,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC;YAC3D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,oCAAoC;SACvD;QACD,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE;YACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oCAAoC;YAC1D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC;SACtD;KACD,CAAC;AACH,CAAC,CAAC"}
+{"version":3,"file":"RateLimiter.js","sourceRoot":"","sources":["../src/RateLimiter.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAE/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,EAAE;IACtC,OAAO;QACN,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;YAChE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,yCAAyC;SAC5D;QACD,CAAC,cAAc,CAAC,sBAAsB,CAAC,EAAE;YACxC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wCAAwC;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,uCAAuC;SAC1D;QACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;YAC5C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,4CAA4C;YAClE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,2CAA2C;SAC9D;QACD,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;YAChE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,yCAAyC;SAC5D;QACD,CAAC,cAAc,CAAC,wBAAwB,CAAC,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;YAChE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,yCAAyC;SAC5D;QACD,CAAC,cAAc,CAAC,8BAA8B,CAAC,EAAE;YAChD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iDAAiD;YACvE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gDAAgD;SACnE;QACD,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE;YAChC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;YACrD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;SACjD;QACD,CAAC,cAAc,CAAC,iBAAiB,CAAC,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC;YACxD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;SACpD;QACD,CAAC,cAAc,CAAC,kBAAkB,CAAC,EAAE;YACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC;YACzD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC;SACrD;QACD,CAAC,cAAc,CAAC,gBAAgB,CAAC,EAAE;YAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;YACvD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;SACnD;QACD,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE;YAChC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;YACtD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;SAClD;QACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE;YACjC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;YACvD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;SACnD;QACD,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE;YAC9B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;YACpD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,6BAA6B;SAChD;QACD,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE;YAC/B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,+BAA+B;YACrD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,8BAA8B;SACjD;QACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC;YAC5D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC;SACxD;QACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC;YAC5D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC;SACxD;QACD,CAAC,cAAc,CAAC,+BAA+B,CAAC,EAAE;YACjD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,uCAAuC;YAC7D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC;SACzD;QACD,CAAC,aAAa,CAAC,kBAAkB,CAAC,EAAE;YACnC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC;YACzD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,kCAAkC;SACrD;QACD,CAAC,aAAa,CAAC,sBAAsB,CAAC,EAAE;YACvC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wCAAwC;YAC9D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,uCAAuC;SAC1D;QACD,CAAC,aAAa,CAAC,yBAAyB,CAAC,EAAE;YAC1C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,2CAA2C;YACjE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;SAC7D;QACD,CAAC,aAAa,CAAC,qBAAqB,CAAC,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,sCAAsC;YAC5D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC;SACxD;QACD,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE;YACjC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;YACvD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC;SACnD;QACD,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;YAC3B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,0BAA0B;YAChD,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;SAC5C;QACD,CAAC,cAAc,CAAC,yBAAyB,CAAC,EAAE;YAC3C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,2CAA2C;YACjE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;SAC7D;QACD,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAAE;YAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6CAA6C;YACnE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,4CAA4C;SAC/D;QACD,CAAC,cAAc,CAAC,2BAA2B,CAAC,EAAE;YAC7C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,6CAA6C;YACnE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,4CAA4C;SAC/D;QACD,CAAC,cAAc,CAAC,0BAA0B,CAAC,EAAE;YAC5C,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,2CAA2C;YACjE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,0CAA0C;SAC7D;QACD,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE;YACzB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,wBAAwB;YAC9C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB;SAC1C;QACD,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE;YACtC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,qCAAqC;YAC3D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,oCAAoC;SACvD;QACD,CAAC,aAAa,CAAC,mBAAmB,CAAC,EAAE;YACpC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,oCAAoC;YAC1D,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC;SACtD;KACD,CAAC;AACH,CAAC,CAAC"}