@prosopo/fingerprint 2.7.57 → 2.7.58

package/src/proof.test.ts

@@ -1,119 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type { UnknownComponents } from "@prosopo/fingerprintjs";
-import { describe, expect, it } from "vitest";
-import {
-	type FingerprintProof,
-	buildFingerprintProofFromComponents,
-	verifyFingerprintProofStructure,
-} from "./proof.js";
-
-const sampleComponents = (): UnknownComponents => ({
-	colorDepth: { value: 24, duration: 1 },
-	cookiesEnabled: { value: true, duration: 1 },
-	hardwareConcurrency: { value: 8, duration: 1 },
-	timezone: { value: "UTC+1", duration: 2 },
-	canvas: {
-		value: { winding: true, geometry: "abc", text: "def" },
-		duration: 3,
-	},
-	languages: { value: [["en-GB"], ["en"]], duration: 1 },
-	broken: { error: new Error("source failed"), duration: 0 },
-});
-
-const HEX_HASH = /^0x[0-9a-f]{64}$/;
-
-const clone = (proof: FingerprintProof): FingerprintProof =>
-	JSON.parse(JSON.stringify(proof)) as FingerprintProof;
-
-describe("fingerprint proof", () => {
-	it("commits to all components and discloses all by default", () => {
-		const proof = buildFingerprintProofFromComponents(sampleComponents());
-		expect(proof.root).toMatch(HEX_HASH);
-		expect(proof.disclosures).toHaveLength(7);
-		const keys = proof.disclosures.map((d) => d.key);
-		// disclosures follow the sorted commitment order
-		expect(keys).toStrictEqual([...keys].sort());
-	});
-
-	it("represents an errored source as an error leaf with no value", () => {
-		const proof = buildFingerprintProofFromComponents(sampleComponents());
-		const broken = proof.disclosures.find((d) => d.key === "broken");
-		expect(broken?.error).toBe(true);
-		expect(broken && "value" in broken).toBe(false);
-	});
-
-	it("verifies a freshly built proof", () => {
-		const proof = buildFingerprintProofFromComponents(sampleComponents());
-		expect(verifyFingerprintProofStructure(proof)).toBe(true);
-	});
-
-	it("verifies a selective disclosure of a subset of components", () => {
-		const proof = buildFingerprintProofFromComponents(sampleComponents(), [
-			"colorDepth",
-			"timezone",
-		]);
-		expect(proof.disclosures).toHaveLength(2);
-		expect(verifyFingerprintProofStructure(proof)).toBe(true);
-		// the root still commits to every component, not just the disclosed ones
-		const full = buildFingerprintProofFromComponents(sampleComponents());
-		expect(proof.root).toBe(full.root);
-	});
-
-	it("skips requested keys that the fingerprint does not contain", () => {
-		const proof = buildFingerprintProofFromComponents(sampleComponents(), [
-			"colorDepth",
-			"doesNotExist",
-		]);
-		expect(proof.disclosures.map((d) => d.key)).toStrictEqual(["colorDepth"]);
-		expect(verifyFingerprintProofStructure(proof)).toBe(true);
-	});
-
-	it("rejects a proof whose disclosed value was tampered with", () => {
-		const proof = clone(
-			buildFingerprintProofFromComponents(sampleComponents()),
-		);
-		const target = proof.disclosures.find((d) => d.key === "colorDepth");
-		if (target === undefined) {
-			throw new Error("expected colorDepth disclosure");
-		}
-		target.value = 32;
-		expect(verifyFingerprintProofStructure(proof)).toBe(false);
-	});
-
-	it("rejects a proof whose root was tampered with", () => {
-		const proof = clone(
-			buildFingerprintProofFromComponents(sampleComponents()),
-		);
-		proof.root = `0x${"0".repeat(64)}`;
-		expect(verifyFingerprintProofStructure(proof)).toBe(false);
-	});
-
-	it("rejects a disclosure carrying a non-sibling leaf's proof", () => {
-		const proof = clone(
-			buildFingerprintProofFromComponents(sampleComponents()),
-		);
-		// `broken` and `timezone` are the first and last leaves in sorted order, so
-		// they are not Merkle siblings — `broken`'s leaf does not appear anywhere in
-		// `timezone`'s proof, so lending it that proof must fail verification.
-		const broken = proof.disclosures.find((d) => d.key === "broken");
-		const timezone = proof.disclosures.find((d) => d.key === "timezone");
-		if (broken === undefined || timezone === undefined) {
-			throw new Error("expected broken and timezone disclosures");
-		}
-		broken.proof = timezone.proof;
-		expect(verifyFingerprintProofStructure(proof)).toBe(false);
-	});
-});

package/src/proof.ts

@@ -1,182 +0,0 @@
-// Copyright 2021-2026 Prosopo (UK) Ltd.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-import type { Component, UnknownComponents } from "@prosopo/fingerprintjs";
-import type { MerkleProof } from "@prosopo/types";
-import { hexHash } from "@prosopo/util-crypto";
-import {
-	buildMerkleLayers,
-	merkleProofFromLayers,
-	merkleRootFromLayers,
-	verifyMerkleProof,
-} from "./merkle.js";
-
-export const FINGERPRINT_PROOF_VERSION = 1;
-
-/**
- * The fixed set of components the client discloses in a proof of fingerprint.
- * Disclosing every component (the previous default) made the proof enormous —
- * each disclosure carries a full Merkle path and its raw value, and components
- * like webgl/audio/fonts have very large values. Selective disclosure keeps the
- * commitment (`root`) over the whole component set while only these cheap,
- * stable scalar components carry a path + value, shrinking the payload ~10x.
- *
- * The provider-side validator's bounds MUST be a subset of these keys: a bounded
- * key that isn't disclosed would always fail validation as `missing:<key>`.
- */
-export const FINGERPRINT_DISCLOSURE_KEYS: readonly string[] = [
-	"colorDepth",
-	"cookiesEnabled",
-	"sessionStorage",
-	"localStorage",
-	"timezone",
-	"hardwareConcurrency",
-	"languages",
-	"architecture",
-];
-
-/**
- * A single disclosed fingerprint component: its raw value (or an error flag)
- * together with the Merkle proof that it belongs to the committed root. The
- * value is left as `unknown` because each FingerprintJS source produces a
- * different shape (string / number / boolean / array / object); the proof
- * validator is responsible for bounding it.
- */
-export interface FingerprintLeafDisclosure {
-	key: string;
-	value?: unknown;
-	error?: boolean;
-	proof: MerkleProof;
-}
-
-/**
- * A proof of fingerprint: a commitment (`root`) to the whole, deterministically
- * ordered set of FingerprintJS components, plus a selective disclosure of some
- * of those components. It lets a verifier check that the disclosed values were
- * part of one coherent, genuinely-constructed fingerprint without the client
- * being able to mix-and-match values across requests.
- */
-export interface FingerprintProof {
-	v: number;
-	root: string;
-	disclosures: FingerprintLeafDisclosure[];
-}
-
-// Escape a component key exactly as FingerprintJS does in its canonical string,
-// so a leaf can never be forged by shifting a `:`/`|` between key and value.
-const escapeKey = (key: string): string => key.replace(/([:|\\])/g, "\\$1");
-
-// Canonical per-component leaf content. Mirrors one segment of FingerprintJS'
-// `componentsToCanonicalString`, so the leaf commits to exactly the value the
-// visitorId hash is derived from.
-const componentLeafContent = (
-	key: string,
-	component: Component<unknown>,
-): string => {
-	const serialized =
-		"error" in component ? "error" : JSON.stringify(component.value);
-	return `${escapeKey(key)}:${serialized}`;
-};
-
-const disclosureLeafContent = (
-	disclosure: FingerprintLeafDisclosure,
-): string => {
-	const serialized = disclosure.error
-		? "error"
-		: JSON.stringify(disclosure.value);
-	return `${escapeKey(disclosure.key)}:${serialized}`;
-};
-
-export const leafHashForContent = (content: string): string => hexHash(content);
-
-/**
- * Build a {@link FingerprintProof} from an already-resolved FingerprintJS
- * components map. The commitment always covers every component (in sorted key
- * order); `discloseKeys` selects which components are revealed (defaulting to
- * all). Keys that are not present in the fingerprint are skipped — a validator
- * should treat an expected-but-absent disclosure as a failure.
- */
-export const buildFingerprintProofFromComponents = (
-	components: UnknownComponents,
-	discloseKeys?: readonly string[],
-): FingerprintProof => {
-	const keys = Object.keys(components).sort();
-	if (keys.length === 0) {
-		throw new Error("fingerprint proof: no components to commit to");
-	}
-
-	const leafHashes = keys.map((key) => {
-		const component = components[key];
-		if (component === undefined) {
-			throw new Error(`fingerprint proof: missing component ${key}`);
-		}
-		return leafHashForContent(componentLeafContent(key, component));
-	});
-
-	const layers = buildMerkleLayers(leafHashes);
-	const root = merkleRootFromLayers(layers);
-
-	const disclose = discloseKeys ?? keys;
-	const disclosures: FingerprintLeafDisclosure[] = [];
-	for (const key of disclose) {
-		const index = keys.indexOf(key);
-		if (index === -1) {
-			continue;
-		}
-		const component = components[key];
-		const leafHash = leafHashes[index];
-		if (component === undefined || leafHash === undefined) {
-			continue;
-		}
-		const proof = merkleProofFromLayers(layers, leafHash);
-		disclosures.push(
-			"error" in component
-				? { key, error: true, proof }
-				: { key, value: component.value, proof },
-		);
-	}
-
-	return { v: FINGERPRINT_PROOF_VERSION, root, disclosures };
-};
-
-/**
- * Structural verification of a proof: every disclosed `(key, value)` re-hashes
- * to a leaf that is proven to belong to the single committed `root`. This is
- * the non-secret half of validation — the value-bounding rules live in the
- * provider-side (closed-source) validator and are layered on top of this.
- */
-export const verifyFingerprintProofStructure = (
-	proof: FingerprintProof,
-): boolean => {
-	if (proof.v !== FINGERPRINT_PROOF_VERSION) {
-		return false;
-	}
-	if (typeof proof.root !== "string" || proof.disclosures.length === 0) {
-		return false;
-	}
-	for (const disclosure of proof.disclosures) {
-		const leafHash = leafHashForContent(disclosureLeafContent(disclosure));
-		if (!verifyMerkleProof(leafHash, disclosure.proof)) {
-			return false;
-		}
-		const rootLayer = disclosure.proof[disclosure.proof.length - 1];
-		if (rootLayer === undefined || rootLayer[0] !== proof.root) {
-			return false;
-		}
-	}
-	return true;
-};
-
-export const encodeFingerprintProof = (proof: FingerprintProof): string =>
-	JSON.stringify(proof);

package/tsconfig.cjs.json

@@ -1,21 +0,0 @@
-{
-	"extends": "../../tsconfig.cjs.json",
-	"compilerOptions": {
-		"rootDir": "./src",
-		"outDir": "./dist/cjs"
-	},
-	"include": [
-		"./src/**/*.ts",
-		"./src/**/*.json",
-		"./src/**/*.d.ts",
-		"./src/**/*.tsx"
-	],
-	"references": [
-		{
-			"path": "../../dev/config/tsconfig.cjs.json"
-		},
-		{
-			"path": "../fingerprintjs"
-		}
-	]
-}

package/tsconfig.json

@@ -1,28 +0,0 @@
-{
-	"extends": "../../tsconfig.esm.json",
-	"compilerOptions": {
-		"rootDir": "./src",
-		"outDir": "./dist"
-	},
-	"include": [
-		"src",
-		"src/**/*.json",
-		"src/**/*.ts",
-		"src/**/*.tsx",
-		"src/**/*.d.ts"
-	],
-	"references": [
-		{
-			"path": "../../dev/config/tsconfig.json"
-		},
-		{
-			"path": "../fingerprintjs"
-		},
-		{
-			"path": "../types"
-		},
-		{
-			"path": "../util-crypto"
-		}
-	]
-}