@prosopo/procaptcha-frictionless 2.13.1 → 2.13.3

package/src/customDetectBot.ts

@@ -34,11 +34,12 @@ import {
 	takePrefetchedDetector,
 } from "./detectorPrefetch.js";
 
-// Upper bound on the detector-bundle assignment + load probe. The detector
-// lives ONLY in the provider-served pool bundles, so if the provider is
-// slow/unreachable we abandon the probe and signal `detectorUnavailable`, and
-// the provider serves a PoW challenge instead of running detection.
-const ASSIGN_TIMEOUT_MS = 2000;
+// Upper bound on the assign POST, which serves the detector bundle inline
+// (~215 KB gzipped). The hop is always cold — /healthz pins a different
+// hostname, so it pays fresh DNS + TLS + a CORS preflight before the download
+// even starts, measured at 6.7s against staging. Anything tighter silently
+// drops the detector and sends an empty token.
+const ASSIGN_TIMEOUT_MS = 10_000;
 
 // The page(s) the widget is rendered on, reduced to origin + path.
 // Deliberately built from `origin` + `pathname` (never `href`) so the query
@@ -215,8 +216,7 @@ const customDetectBot: BotDetectionFunction = async (
 	// in the provider-served pool: when the provider has a populated pool it
 	// returns the obfuscated detector (each with its own keys + inner cipher)
 	// plus a detectorSessionId. When it cannot (no pool, network, decode, or
-	// timeout) we have NO detector to run — there is no bundled fallback — so we
-	// signal `detectorUnavailable` and the provider serves a PoW challenge.
+	// timeout) we have NO detector to run and there is no bundled fallback.
 	let detectorSessionId: string | undefined;
 	let providerDetect: DetectorType | undefined;
 	try {
@@ -229,27 +229,40 @@ const customDetectBot: BotDetectionFunction = async (
 				ASSIGN_TIMEOUT_MS,
 			));
 		if (assigned.useProviderBundle && assigned.detectorScript) {
+			// Deliberately untimed: this is a local parse + evaluate, so a timer
+			// cannot rescue a stalled main thread — it can only throw away a bundle
+			// we are already holding.
+			providerDetect = await DetectorLoaderFromScript(assigned.detectorScript);
 			detectorSessionId = assigned.detectorSessionId;
-			providerDetect = await withTimeout(
-				DetectorLoaderFromScript(assigned.detectorScript),
-				ASSIGN_TIMEOUT_MS,
-			);
 		}
-	} catch {
+	} catch (err) {
 		// No detector available — fall through to the PoW request below.
+		//
+		// Report it. Falling back is by design, but the reasons are not equal: a
+		// slow network is routine, whereas a bundle that throws on import means
+		// every session on this provider silently degrades to an image captcha
+		// with nothing in the client or provider logs to say why. That failure
+		// mode shipped undetected once already — an obfuscator seed emitted a
+		// bundle that died with "Class constructor X cannot be invoked without
+		// 'new'", and the only way to see it was to reproduce the import by hand.
+		// The catch stays broad; it just no longer hides what it caught.
+		console.error(
+			"Procaptcha: no detector bundle available, falling back to a server-chosen captcha:",
+			err,
+		);
 	}
 
 	const ExtClass = await extClassPromise;
 	const ext = new ExtClass();
 
-	// No provider detector ⇒ no detection is possible. Request a PoW challenge
-	// directly: send no token and the detectorUnavailable flag so the provider
-	// serves PoW rather than attempting to score an absent payload.
+	// No provider detector ⇒ no detection is possible, so there is nothing to
+	// send. The request goes out with an empty token and the provider decides
+	// what to serve; the client gets no say in that.
 	if (providerDetect === undefined) {
 		const userAccount = await ext.getAccount(config);
 		const { currentUrl: fallbackUrl, iframeUrl: fallbackIframeUrl } =
 			getCurrentPageUrls();
-		const powCaptcha = await withTimeout(
+		const captcha = await withTimeout(
 			providerApi.getFrictionlessCaptcha(
 				undefined,
 				undefined,
@@ -258,15 +271,14 @@ const customDetectBot: BotDetectionFunction = async (
 				config.mode,
 				undefined,
 				undefined,
-				true,
 				fallbackUrl,
 				fallbackIframeUrl,
 			),
 			10000,
 		);
-		if (powCaptcha.dns_url) {
+		if (captcha.dns_url) {
 			try {
-				void fetch(powCaptcha.dns_url, {
+				void fetch(captcha.dns_url, {
 					method: "GET",
 					mode: "no-cors",
 					credentials: "omit",
@@ -278,13 +290,13 @@ const customDetectBot: BotDetectionFunction = async (
 			}
 		}
 		return {
-			captchaType: powCaptcha.captchaType,
-			sessionId: powCaptcha.sessionId,
+			captchaType: captcha.captchaType,
+			sessionId: captcha.sessionId,
 			provider: provider,
-			status: powCaptcha.status,
+			status: captcha.status,
 			userAccount: userAccount,
-			error: powCaptcha.error,
-			hp: powCaptcha.hp,
+			error: captcha.error,
+			hp: captcha.hp,
 		};
 	}
 
@@ -311,7 +323,6 @@ const customDetectBot: BotDetectionFunction = async (
 		config.mode,
 		undefined,
 		detectorSessionId,
-		undefined,
 		currentUrl,
 		iframeUrl,
 	);

package/src/tests/customDetectBotAssignTimeout.test.ts

@@ -0,0 +1,180 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/**
+ * A slow detector assignment must still be used. Under the old 2000 ms cap on
+ * both the assign POST and the blob import, a cold-connection assign (measured
+ * at 6.7s against staging: fresh DNS + TLS + CORS preflight before ~215 KB of
+ * bundle) blew the deadline, the surrounding catch swallowed it, and the
+ * frictionless POST went out with an empty token and no detectorSessionId.
+ */
+
+import type { AssignDetectorBundleResponse } from "@prosopo/types";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+// `vi.mock` is hoisted; share state via `vi.hoisted` so the factories can
+// reference the same spies the tests assert against.
+const mocks = vi.hoisted(() => ({
+	getFrictionlessCaptcha: vi.fn(),
+	getProcaptchaRandomActiveProvider: vi.fn(),
+	assignDetectorBundle: vi.fn(),
+	detectorLoaderFromScript: vi.fn(),
+	detect: vi.fn(),
+}));
+
+vi.mock("@prosopo/api", () => ({
+	// customDetectBot does `new ProviderApi(...)`, so the implementation has to
+	// be constructible — an arrow function has no [[Construct]] slot.
+	ProviderApi: vi.fn(function () {
+		return {
+			getFrictionlessCaptcha: mocks.getFrictionlessCaptcha,
+			assignDetectorBundle: mocks.assignDetectorBundle,
+		};
+	}),
+}));
+
+vi.mock("@prosopo/procaptcha-common", () => ({
+	ExtensionLoader: vi.fn(async () => {
+		return class FakeExtension {
+			getAccount() {
+				return Promise.resolve({
+					account: { address: "5FakeUserAccountAddress" },
+				});
+			}
+		};
+	}),
+	getProcaptchaRandomActiveProvider: mocks.getProcaptchaRandomActiveProvider,
+	pickIpMode: vi.fn(() => undefined),
+}));
+
+vi.mock("../detectorLoader.js", () => ({
+	DetectorLoaderFromScript: mocks.detectorLoaderFromScript,
+}));
+
+import customDetectBot from "../customDetectBot.js";
+
+const baseConfig = {
+	account: { address: "5CcNvLUdiXFpzKDMjThGLSK9rhWHA1H4EF3zrgkpkjAdqmuP" },
+	defaultEnvironment: "staging" as const,
+	web2: true,
+	mode: "visible" as const,
+} as unknown as Parameters<typeof customDetectBot>[0];
+
+const assignResponse: AssignDetectorBundleResponse = {
+	useProviderBundle: true,
+	detectorSessionId: "det-5cad2419-43c0-41b7-a9b8-0117767624bc",
+	detectorScript: "SELF_CONTAINED_ESM",
+	status: "ok",
+};
+
+const detectionResult = {
+	token: "ENCRYPTED_TOKEN",
+	encryptHeadHash: "ENCRYPTED_HEAD_HASH",
+	userAccount: { account: { address: "5FakeUserAccountAddress" } },
+	shadowDomCleanup: () => undefined,
+};
+
+const captchaResponse = {
+	captchaType: "pow",
+	sessionId: "SID",
+	status: "ok",
+};
+
+// The measured cold-connection assign against staging.
+const SLOW_MS = 6700;
+
+const resolveAfter = <T>(ms: number, value: T): Promise<T> =>
+	new Promise<T>((resolve) => {
+		setTimeout(() => resolve(value), ms);
+	});
+
+// The token the frictionless POST was actually called with (first positional
+// arg of `getFrictionlessCaptcha`).
+const postedToken = (): string | undefined => {
+	const call = mocks.getFrictionlessCaptcha.mock.calls[0];
+	return call?.[0] as string | undefined;
+};
+
+const postedDetectorSessionId = (): string | undefined => {
+	const call = mocks.getFrictionlessCaptcha.mock.calls[0];
+	return call?.[6] as string | undefined;
+};
+
+beforeEach(() => {
+	vi.useFakeTimers();
+	mocks.getFrictionlessCaptcha.mockReset();
+	mocks.getProcaptchaRandomActiveProvider.mockReset();
+	mocks.assignDetectorBundle.mockReset();
+	mocks.detectorLoaderFromScript.mockReset();
+	mocks.detect.mockReset();
+
+	mocks.getProcaptchaRandomActiveProvider.mockResolvedValue({
+		providerAccount: "dns-routed",
+		provider: { url: "https://staging-pronode3.prosopo.io" },
+	});
+	mocks.detect.mockResolvedValue(detectionResult);
+	mocks.detectorLoaderFromScript.mockResolvedValue(mocks.detect);
+	mocks.assignDetectorBundle.mockResolvedValue(assignResponse);
+	mocks.getFrictionlessCaptcha.mockResolvedValue(captchaResponse);
+});
+
+afterEach(() => {
+	vi.useRealTimers();
+});
+
+const runDetection = async (): Promise<void> => {
+	const pending = customDetectBot(baseConfig, undefined, () => undefined);
+	await vi.advanceTimersByTimeAsync(SLOW_MS + 1000);
+	await pending;
+};
+
+describe("customDetectBot detector-assignment deadline", () => {
+	it("uses a bundle whose assign POST is slow", async () => {
+		mocks.assignDetectorBundle.mockImplementation(() =>
+			resolveAfter(SLOW_MS, assignResponse),
+		);
+
+		await runDetection();
+
+		expect(mocks.detectorLoaderFromScript).toHaveBeenCalledWith(
+			assignResponse.detectorScript,
+		);
+		expect(postedToken()).toBe("ENCRYPTED_TOKEN");
+		expect(postedDetectorSessionId()).toBe(assignResponse.detectorSessionId);
+	});
+
+	it("uses a bundle whose blob import is slow", async () => {
+		mocks.detectorLoaderFromScript.mockImplementation(() =>
+			resolveAfter(SLOW_MS, mocks.detect),
+		);
+
+		await runDetection();
+
+		expect(postedToken()).toBe("ENCRYPTED_TOKEN");
+		expect(postedDetectorSessionId()).toBe(assignResponse.detectorSessionId);
+	});
+
+	it("still sends an empty token when the provider has no bundle to assign", async () => {
+		mocks.assignDetectorBundle.mockResolvedValue({
+			useProviderBundle: false,
+			status: "ok",
+		} satisfies AssignDetectorBundleResponse);
+
+		await runDetection();
+
+		expect(mocks.detectorLoaderFromScript).not.toHaveBeenCalled();
+		expect(postedToken()).toBeUndefined();
+		expect(postedDetectorSessionId()).toBeUndefined();
+	});
+});