@prosopo/provider 3.12.14 → 3.13.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # @prosopo/provider
 
+## 3.13.0
+### Minor Changes
+
+- bb5f41c: Context awareness
+
+### Patch Changes
+
+- fdef625: fix maint mode
+- 55a64c6: stop refresh image to pow
+- aa8216a: bump
+- 8ce9205: Change engine requirements
+- 6ac5367: Less drastic reaction to bad sim score
+- b6e98b2: Run npm audit
+- 55a64c6: Persist sessions for user ip combinations
+- Updated dependencies [8ce9205]
+- Updated dependencies [15ae7cf]
+- Updated dependencies [bb5f41c]
+- Updated dependencies [55a64c6]
+- Updated dependencies [8ce9205]
+- Updated dependencies [df79c03]
+- Updated dependencies [8f22479]
+- Updated dependencies [b6e98b2]
+- Updated dependencies [55a64c6]
+  - @prosopo/user-access-policy@3.5.28
+  - @prosopo/types@3.6.0
+  - @prosopo/types-database@4.0.0
+  - @prosopo/database@3.5.0
+  - @prosopo/util@3.2.0
+  - @prosopo/api-express-router@3.0.34
+  - @prosopo/load-balancer@2.8.9
+  - @prosopo/util-crypto@13.5.24
+  - @prosopo/api-route@2.6.30
+  - @prosopo/types-env@2.7.47
+  - @prosopo/datasets@3.0.43
+  - @prosopo/keyring@2.8.36
+  - @prosopo/common@3.1.22
+  - @prosopo/locale@3.1.22
+  - @prosopo/api@3.1.33
+  - @prosopo/env@3.2.22
+  - @prosopo/config@3.1.22
+
 ## 3.12.14
 ### Patch Changes
 

package/dist/api/captcha/getFrictionlessCaptchaChallenge.js

@@ -0,0 +1,338 @@
+import { ProsopoApiError } from "@prosopo/common";
+import { GetFrictionlessCaptchaChallengeRequestBody, ApiParams, CaptchaType } from "@prosopo/types";
+import { flatten, compareBinaryStrings } from "@prosopo/util";
+import { getCompositeIpAddress } from "../../compositeIpAddress.js";
+import { FrictionlessReason, FrictionlessManager } from "../../tasks/frictionless/frictionlessTasks.js";
+import { timestampDecayFunction } from "../../tasks/frictionless/frictionlessTasksUtils.js";
+import "../../tasks/index.js";
+import { hashUserAgent } from "../../utils/hashUserAgent.js";
+import { hashUserIp } from "../../utils/hashUserIp.js";
+import { getMaintenanceMode } from "../admin/apiToggleMaintenanceModeEndpoint.js";
+import { getRequestUserScope } from "../blacklistRequestInspector.js";
+import { Tasks } from "../../tasks/tasks.js";
+const DEFAULT_FRICTIONLESS_THRESHOLD = 0.5;
+const getRoundsFromSimScore = (simScore) => {
+  if (simScore >= 0.9) return 0;
+  if (simScore >= 0.8) return 3;
+  if (simScore >= 0.7) return 4;
+  if (simScore >= 0.6) return 6;
+  if (simScore >= 0.5) return 7;
+  return 8;
+};
+const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
+  try {
+    const tasks = new Tasks(env, req.logger);
+    const { token, headHash, dapp, user } = GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
+    if (getMaintenanceMode()) {
+      req.logger.info(() => ({
+        msg: "Maintenance mode active - storing dummy token and sending PoW captcha",
+        data: { dapp, user }
+      }));
+      return res.json(
+        await tasks.frictionlessManager.sendPowCaptcha({
+          token,
+          score: 0,
+          threshold: 0.5,
+          scoreComponents: {
+            baseScore: 0
+          },
+          providerSelectEntropy: 0,
+          ipAddress: getCompositeIpAddress(req.ip || ""),
+          webView: false,
+          iFrame: false,
+          decryptedHeadHash: ""
+        })
+      );
+    }
+    const existingToken = await tasks.db.getSessionRecordByToken(token);
+    if (existingToken) {
+      req.logger.info(() => ({
+        token: existingToken,
+        msg: "Token has already been used"
+      }));
+      return next(
+        new ProsopoApiError("API.BAD_REQUEST", {
+          context: {
+            code: 400,
+            siteKey: dapp,
+            user
+          },
+          i18n: req.i18n,
+          logger: req.logger
+        })
+      );
+    }
+    const userSitekeyIpHash = hashUserIp(user, req.ip || "", dapp);
+    const existingSession = await tasks.db.getSessionByuserSitekeyIpHash(userSitekeyIpHash);
+    if (existingSession) {
+      req.logger.info(() => ({
+        msg: "Reusing existing session for user-IP-sitekey combination",
+        data: {
+          userSitekeyIpHash,
+          sessionId: existingSession.sessionId,
+          captchaType: existingSession.captchaType
+        }
+      }));
+      return res.json({
+        [ApiParams.captchaType]: existingSession.captchaType,
+        [ApiParams.sessionId]: existingSession.sessionId,
+        [ApiParams.status]: "ok"
+      });
+    }
+    const lScore = tasks.frictionlessManager.checkLangRules(
+      req.headers["accept-language"] || ""
+    );
+    const {
+      baseBotScore,
+      timestamp,
+      providerSelectEntropy,
+      userId,
+      userAgent,
+      webView,
+      iFrame,
+      decryptedHeadHash
+    } = await tasks.frictionlessManager.decryptPayload(token, headHash);
+    req.logger.debug(() => ({
+      msg: "Decrypted payload",
+      data: {
+        baseBotScore,
+        timestamp,
+        providerSelectEntropy,
+        userId,
+        userAgent,
+        webView
+      }
+    }));
+    let botScore = baseBotScore + lScore;
+    const clientRecord = await tasks.db.getClientRecord(dapp);
+    if (!clientRecord) {
+      return next(
+        new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+          context: { code: 400, siteKey: dapp },
+          i18n: req.i18n,
+          logger: req.logger
+        })
+      );
+    }
+    const { valid, reason } = await tasks.frictionlessManager.isValidRequest(
+      clientRecord,
+      CaptchaType.frictionless,
+      env
+    );
+    if (!valid) {
+      return next(
+        new ProsopoApiError(reason || "API.BAD_REQUEST", {
+          context: {
+            code: 400,
+            siteKey: dapp,
+            user
+          },
+          i18n: req.i18n,
+          logger: req.logger
+        })
+      );
+    }
+    const botThreshold = clientRecord.settings?.frictionlessThreshold || DEFAULT_FRICTIONLESS_THRESHOLD;
+    let scoreComponents = {
+      baseScore: baseBotScore,
+      ...lScore && { lScore }
+    };
+    const ipAddress = getCompositeIpAddress(req.ip || "");
+    tasks.frictionlessManager.setSessionParams({
+      token,
+      score: botScore,
+      threshold: botThreshold,
+      scoreComponents,
+      providerSelectEntropy,
+      ipAddress,
+      webView,
+      iFrame,
+      decryptedHeadHash
+    });
+    const userScope = getRequestUserScope(
+      flatten(req.headers),
+      req.ja4,
+      req.ip,
+      user
+    );
+    const userAccessPolicy = (await tasks.frictionlessManager.getPrioritisedAccessPolicies(
+      userAccessRulesStorage,
+      dapp,
+      userScope
+    ))[0];
+    const headersUserAgent = req.headers["user-agent"];
+    const hashedHeadersUserAgent = headersUserAgent ? hashUserAgent(headersUserAgent) : "";
+    const headersProsopoUser = req.headers["prosopo-user"];
+    if (hashedHeadersUserAgent !== userAgent || headersProsopoUser !== userId) {
+      req.logger.info(() => ({
+        msg: "User agent or user id does not match",
+        data: {
+          headersUserAgent,
+          hashedHeadersUserAgent,
+          userAgent,
+          // This is the hashed user agent from the token
+          headersProsopoUser,
+          userId
+        }
+      }));
+      return res.json(
+        await tasks.frictionlessManager.sendImageCaptcha({
+          solvedImagesCount: timestampDecayFunction(timestamp),
+          userSitekeyIpHash,
+          reason: FrictionlessReason.USER_AGENT_MISMATCH
+        })
+      );
+    }
+    if (userAccessPolicy) {
+      const scoreUpdate = tasks.frictionlessManager.scoreIncreaseAccessPolicy(
+        userAccessPolicy,
+        baseBotScore,
+        botScore,
+        scoreComponents
+      );
+      botScore = scoreUpdate.score;
+      scoreComponents = scoreUpdate.scoreComponents;
+      tasks.frictionlessManager.updateScore(botScore, scoreComponents);
+      if (userAccessPolicy.captchaType === CaptchaType.image) {
+        return res.json(
+          await tasks.frictionlessManager.sendImageCaptcha({
+            solvedImagesCount: userAccessPolicy.solvedImagesCount,
+            userSitekeyIpHash,
+            reason: FrictionlessReason.USER_ACCESS_POLICY
+          })
+        );
+      }
+      if (userAccessPolicy.captchaType === CaptchaType.pow) {
+        return res.json(
+          await tasks.frictionlessManager.sendPowCaptcha({
+            userSitekeyIpHash,
+            reason: FrictionlessReason.USER_ACCESS_POLICY
+          })
+        );
+      }
+    }
+    if (clientRecord.settings.contextAware?.enabled) {
+      const clientEntropy = await tasks.frictionlessManager.getClientEntropy(
+        clientRecord.account
+      );
+      if (clientEntropy) {
+        if (!decryptedHeadHash) {
+          tasks.logger.info(() => ({
+            msg: "No decryptedHeadHash in session for context aware client"
+          }));
+          return next(
+            new ProsopoApiError("API.BAD_REQUEST", {
+              context: {
+                code: 400,
+                siteKey: dapp,
+                user
+              },
+              i18n: req.i18n,
+              logger: req.logger
+            })
+          );
+        }
+        const sim = compareBinaryStrings(decryptedHeadHash, clientEntropy);
+        const isValidContext = sim >= clientRecord.settings.contextAware.threshold;
+        if (!isValidContext) {
+          return res.json(
+            await tasks.frictionlessManager.sendImageCaptcha({
+              solvedImagesCount: getRoundsFromSimScore(sim),
+              userSitekeyIpHash,
+              reason: FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED
+            })
+          );
+        }
+      }
+    }
+    if (clientRecord.settings.disallowWebView && webView) {
+      tasks.logger.info(() => ({
+        msg: "WebView detected"
+      }));
+      const scoreUpdate = tasks.frictionlessManager.scoreIncreaseWebView(
+        baseBotScore,
+        botScore,
+        scoreComponents
+      );
+      botScore = scoreUpdate.score;
+      scoreComponents = scoreUpdate.scoreComponents;
+      tasks.frictionlessManager.updateScore(botScore, scoreComponents);
+      return res.json(
+        await tasks.frictionlessManager.sendImageCaptcha({
+          solvedImagesCount: env.config.captchas.solved.count * 2,
+          userSitekeyIpHash,
+          reason: FrictionlessReason.WEBVIEW_DETECTED
+        })
+      );
+    }
+    if (FrictionlessManager.timestampTooOld(timestamp)) {
+      const scoreUpdate = tasks.frictionlessManager.scoreIncreaseTimestamp(
+        timestamp,
+        baseBotScore,
+        botScore,
+        scoreComponents
+      );
+      botScore = scoreUpdate.score;
+      scoreComponents = scoreUpdate.scoreComponents;
+      tasks.frictionlessManager.updateScore(botScore, scoreComponents);
+      return res.json(
+        await tasks.frictionlessManager.sendImageCaptcha({
+          solvedImagesCount: timestampDecayFunction(timestamp),
+          userSitekeyIpHash,
+          reason: FrictionlessReason.OLD_TIMESTAMP
+        })
+      );
+    }
+    const hostVerified = await tasks.frictionlessManager.hostVerified(
+      providerSelectEntropy
+    );
+    if (!hostVerified.verified) {
+      const scoreUpdate = tasks.frictionlessManager.scoreIncreaseUnverifiedHost(
+        hostVerified.domain,
+        baseBotScore,
+        botScore,
+        scoreComponents
+      );
+      botScore = scoreUpdate.score;
+      scoreComponents = scoreUpdate.scoreComponents;
+      tasks.frictionlessManager.updateScore(botScore, scoreComponents);
+    }
+    if (Number(botScore) > botThreshold) {
+      req.logger.info(() => ({
+        msg: "Bot score is greater than threshold",
+        data: {
+          botScore,
+          botThreshold,
+          token
+        }
+      }));
+      return res.json(
+        await tasks.frictionlessManager.sendImageCaptcha({
+          solvedImagesCount: env.config.captchas.solved.count,
+          userSitekeyIpHash,
+          reason: FrictionlessReason.BOT_SCORE_ABOVE_THRESHOLD
+        })
+      );
+    }
+    return res.json(
+      await tasks.frictionlessManager.sendPowCaptcha({
+        userSitekeyIpHash
+      })
+    );
+  } catch (err) {
+    req.logger.error(() => ({
+      err,
+      msg: "Error in frictionless captcha challenge"
+    }));
+    return next(
+      new ProsopoApiError("API.BAD_REQUEST", {
+        context: { code: 400, error: err },
+        i18n: req.i18n,
+        logger: req.logger
+      })
+    );
+  }
+};
+export {
+  getFrictionlessCaptchaChallenge as default
+};

package/dist/api/captcha/getImageCaptchaChallenge.js

@@ -0,0 +1,150 @@
+import { ProsopoApiError } from "@prosopo/common";
+import { parseCaptchaAssets } from "@prosopo/datasets";
+import { CaptchaRequestBody, CaptchaType, ApiParams } from "@prosopo/types";
+import { getIPAddress, flatten } from "@prosopo/util";
+import "../../tasks/index.js";
+import { getRequestUserScope } from "../blacklistRequestInspector.js";
+import { validateSiteKey, validateAddr } from "../validateAddress.js";
+import { Tasks } from "../../tasks/tasks.js";
+const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
+  const tasks = new Tasks(env, req.logger);
+  let parsed;
+  if (!req.ip) {
+    return next(
+      new ProsopoApiError("API.BAD_REQUEST", {
+        context: { code: 400, error: "IP address not found" },
+        i18n: req.i18n,
+        logger: req.logger
+      })
+    );
+  }
+  const ipAddress = getIPAddress(req.ip || "");
+  try {
+    parsed = CaptchaRequestBody.parse(req.body);
+  } catch (err) {
+    return next(
+      new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+        context: { code: 400, error: err },
+        i18n: req.i18n,
+        logger: req.logger
+      })
+    );
+  }
+  const { datasetId, user, dapp, sessionId } = parsed;
+  validateSiteKey(dapp);
+  validateAddr(user);
+  try {
+    const clientRecord = await tasks.db.getClientRecord(dapp);
+    if (!clientRecord) {
+      return next(
+        new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+          context: { code: 400, siteKey: dapp },
+          i18n: req.i18n,
+          logger: req.logger
+        })
+      );
+    }
+    const userScope = getRequestUserScope(
+      flatten(req.headers),
+      req.ja4,
+      req.ip,
+      user
+    );
+    const userAccessPolicy = (await tasks.imgCaptchaManager.getPrioritisedAccessPolicies(
+      userAccessRulesStorage,
+      dapp,
+      userScope
+    ))[0];
+    const {
+      valid,
+      reason,
+      sessionId: validSessionId,
+      solvedImagesCount
+    } = await tasks.imgCaptchaManager.isValidRequest(
+      clientRecord,
+      CaptchaType.image,
+      env,
+      sessionId,
+      userAccessPolicy,
+      req.ip
+    );
+    if (!valid) {
+      return next(
+        new ProsopoApiError(reason || "API.BAD_REQUEST", {
+          context: {
+            code: 400,
+            siteKey: dapp,
+            user
+          },
+          i18n: req.i18n,
+          logger: req.logger
+        })
+      );
+    }
+    const captchaConfig = {
+      solved: {
+        count: solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count
+      },
+      unsolved: {
+        count: userAccessPolicy?.unsolvedImagesCount || env.config.captchas.unsolved.count
+      }
+    };
+    const taskData = await tasks.imgCaptchaManager.getRandomCaptchasAndRequestHash(
+      datasetId,
+      user,
+      ipAddress,
+      captchaConfig,
+      clientRecord.settings.imageThreshold ?? 0.8,
+      validSessionId
+    );
+    const captchaResponse = {
+      [ApiParams.status]: "ok",
+      [ApiParams.captchas]: taskData.captchas.map((captcha) => ({
+        ...captcha,
+        target: req.t(`TARGET.${captcha.target}`),
+        items: captcha.items.map(
+          (item) => parseCaptchaAssets(item, env.assetsResolver)
+        )
+      })),
+      [ApiParams.requestHash]: taskData.requestHash,
+      [ApiParams.timestamp]: taskData.timestamp.toString(),
+      [ApiParams.signature]: {
+        [ApiParams.provider]: {
+          [ApiParams.requestHash]: taskData.signedRequestHash
+        }
+      }
+    };
+    req.logger.info(() => ({
+      msg: "Image captcha challenge issued",
+      data: {
+        captchaType: CaptchaType.image,
+        requestHash: taskData.requestHash,
+        solvedImagesCount: captchaConfig.solved.count,
+        user,
+        dapp,
+        sessionId
+      }
+    }));
+    return res.json(captchaResponse);
+  } catch (err) {
+    req.logger.error(() => ({
+      err,
+      data: req.params,
+      msg: "Error in image captcha challenge request"
+    }));
+    return next(
+      new ProsopoApiError("API.BAD_REQUEST", {
+        context: {
+          error: err,
+          code: 500,
+          params: req.params
+        },
+        i18n: req.i18n,
+        logger: req.logger
+      })
+    );
+  }
+};
+export {
+  getImageCaptchaChallenge as default
+};

package/dist/api/captcha/getPoWCaptchaChallenge.js

@@ -0,0 +1,156 @@
+import { ProsopoApiError } from "@prosopo/common";
+import { GetPowCaptchaChallengeRequestBody, CaptchaType, ApiParams } from "@prosopo/types";
+import { flatten } from "@prosopo/util";
+import { getCompositeIpAddress } from "../../compositeIpAddress.js";
+import "../../tasks/index.js";
+import { getRequestUserScope } from "../blacklistRequestInspector.js";
+import { validateSiteKey, validateAddr } from "../validateAddress.js";
+import { Tasks } from "../../tasks/tasks.js";
+const getPoWCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
+  let parsed;
+  const tasks = new Tasks(env);
+  tasks.setLogger(req.logger);
+  try {
+    parsed = GetPowCaptchaChallengeRequestBody.parse(req.body);
+  } catch (err) {
+    return next(
+      new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+        context: { code: 400, error: err },
+        i18n: req.i18n,
+        logger: req.logger
+      })
+    );
+  }
+  const { user, dapp, sessionId } = parsed;
+  validateSiteKey(dapp);
+  validateAddr(user);
+  try {
+    const clientSettings = await tasks.db.getClientRecord(dapp);
+    if (!clientSettings) {
+      return next(
+        new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+          context: { code: 400, siteKey: dapp },
+          i18n: req.i18n,
+          logger: req.logger
+        })
+      );
+    }
+    const userScope = getRequestUserScope(
+      flatten(req.headers),
+      req.ja4,
+      req.ip,
+      user
+    );
+    const userAccessPolicy = (await tasks.powCaptchaManager.getPrioritisedAccessPolicies(
+      userAccessRulesStorage,
+      dapp,
+      userScope
+    ))[0];
+    const {
+      valid,
+      reason,
+      sessionId: validSessionId,
+      powDifficulty
+    } = await tasks.powCaptchaManager.isValidRequest(
+      clientSettings,
+      CaptchaType.pow,
+      env,
+      sessionId,
+      userAccessPolicy,
+      req.ip
+    );
+    if (!valid) {
+      return next(
+        new ProsopoApiError(reason || "API.BAD_REQUEST", {
+          context: {
+            code: 400,
+            siteKey: dapp,
+            user
+          },
+          i18n: req.i18n,
+          logger: req.logger
+        })
+      );
+    }
+    const origin = req.headers.origin;
+    if (!origin) {
+      return next(
+        new ProsopoApiError("API.BAD_REQUEST", {
+          context: {
+            error: "Origin header not found",
+            code: 400,
+            siteKey: dapp,
+            user
+          },
+          i18n: req.i18n,
+          logger: req.logger
+        })
+      );
+    }
+    const difficulty = powDifficulty || userAccessPolicy?.powDifficulty || clientSettings?.settings?.powDifficulty;
+    const challenge = await tasks.powCaptchaManager.getPowCaptchaChallenge(
+      user,
+      dapp,
+      origin,
+      difficulty
+    );
+    await tasks.db.storePowCaptchaRecord(
+      challenge.challenge,
+      {
+        requestedAtTimestamp: challenge.requestedAtTimestamp,
+        userAccount: user,
+        dappAccount: dapp
+      },
+      challenge.difficulty,
+      challenge.providerSignature,
+      getCompositeIpAddress(req.ip || ""),
+      flatten(req.headers),
+      req.ja4,
+      validSessionId
+    );
+    const getPowCaptchaResponse = {
+      [ApiParams.status]: "ok",
+      [ApiParams.challenge]: challenge.challenge,
+      [ApiParams.difficulty]: challenge.difficulty,
+      [ApiParams.timestamp]: challenge.requestedAtTimestamp.toString(),
+      [ApiParams.signature]: {
+        [ApiParams.provider]: {
+          [ApiParams.challenge]: challenge.providerSignature
+        }
+      }
+    };
+    req.logger.info(() => ({
+      msg: "PoW captcha challenge issued",
+      data: {
+        captchaType: CaptchaType.pow,
+        challenge: challenge.challenge,
+        difficulty: challenge.difficulty,
+        user,
+        dapp,
+        session: sessionId
+      }
+    }));
+    return res.json(getPowCaptchaResponse);
+  } catch (err) {
+    req.logger.error(() => ({
+      err,
+      body: req.body,
+      msg: "Error in PoW captcha challenge request"
+    }));
+    return next(
+      new ProsopoApiError("API.BAD_REQUEST", {
+        context: {
+          code: 500,
+          siteKey: req.body.dapp,
+          user: req.body.user,
+          error: err
+        },
+        i18n: req.i18n,
+        logger: req.logger
+      })
+    );
+  }
+};
+export {
+  getPoWCaptchaChallenge as default
+};