@prosopo/provider 3.13.7 → 4.7.1

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -0,0 +1,525 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const util = require("@polkadot/util");
+const common = require("@prosopo/common");
+const types = require("@prosopo/types");
+const util$1 = require("@prosopo/util");
+const compositeIpAddress = require("../../compositeIpAddress.cjs");
+const util$2 = require("../../util.cjs");
+const usageCounters = require("../../util/usageCounters.cjs");
+const captchaManager = require("../captchaManager.cjs");
+const decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+const frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
+const powTasksUtils = require("../powCaptcha/powTasksUtils.cjs");
+const puzzleTasksUtils = require("./puzzleTasksUtils.cjs");
+class PuzzleCaptchaManager extends captchaManager.CaptchaManager {
+  constructor(db, pair, config, logger, usageCounters2) {
+    super(db, pair, config, logger);
+    this.POW_SEPARATOR = types.POW_SEPARATOR;
+    this.decisionMachineRunner = new decisionMachineRunner.DecisionMachineRunner(db);
+    this.usageCounters = usageCounters2 ?? null;
+  }
+  /**
+   * @description Generates a Puzzle Captcha challenge for a given user and dapp
+   *
+   * @param {string} userAccount - user that is solving the captcha
+   * @param {string} dappAccount - dapp that is requesting the captcha
+   * @param origin - not currently used
+   * @param tolerance
+   */
+  async getPuzzleCaptchaChallenge(userAccount, dappAccount, origin, tolerance) {
+    const resolvedTolerance = tolerance ?? types.puzzleToleranceDefault;
+    const requestedAtTimestamp = Date.now();
+    const nonce = Math.floor(Math.random() * 1e6);
+    const challenge = `${requestedAtTimestamp}___${userAccount}___${dappAccount}___${nonce}`;
+    const challengeSignature = util.u8aToHex(this.pair.sign(util.stringToHex(challenge)));
+    const targetX = Math.floor(Math.random() * (280 - 150 + 1)) + 150;
+    const targetY = Math.floor(Math.random() * (170 - 30 + 1)) + 30;
+    const originX = Math.floor(Math.random() * (130 - 20 + 1)) + 20;
+    const originY = Math.floor(Math.random() * (170 - 30 + 1)) + 30;
+    return {
+      challenge,
+      targetX,
+      targetY,
+      originX,
+      originY,
+      tolerance: resolvedTolerance,
+      providerSignature: challengeSignature,
+      requestedAtTimestamp
+    };
+  }
+  /**
+   * @description Verifies a Puzzle Captcha solution for a given user and dapp
+   *
+   * @param {string} challenge - the challenge string
+   * @param {string} providerChallengeSignature - proof that the Provider provided the challenge
+   * @param {number} finalX - the final X coordinate of the puzzle
+   * @param {number} finalY - the final Y coordinate of the puzzle
+   * @param {PuzzleEvent[]} puzzleEvents - the puzzle event trail
+   * @param {number} timeout - the time in milliseconds since the Provider was selected to provide the captcha
+   * @param {string} userTimestampSignature
+   * @param ipAddress
+   * @param headers
+   * @param behavioralData
+   */
+  async verifyPuzzleCaptchaSolution(challenge, providerChallengeSignature, finalX, finalY, puzzleEvents, timeout, userTimestampSignature, ipAddress, headers, behavioralData, salt, simdReadings, clientMetaData) {
+    powTasksUtils.checkPowSignature(
+      challenge,
+      providerChallengeSignature,
+      this.pair.address,
+      types.ApiParams.challenge
+    );
+    const challengeSplit = challenge.split(this.POW_SEPARATOR);
+    const timestamp = Number.parseInt(util$1.at(challengeSplit, 0));
+    const userAccount = util$1.at(challengeSplit, 1);
+    powTasksUtils.checkPowSignature(
+      timestamp.toString(),
+      userTimestampSignature,
+      userAccount,
+      types.ApiParams.timestamp
+    );
+    const challengeRecord = await this.db.getPuzzleCaptchaRecordByChallenge(challenge);
+    if (!challengeRecord) {
+      this.logger.debug(() => ({
+        msg: `No record of this challenge: ${challenge}`
+      }));
+      return false;
+    }
+    let coords;
+    if (salt) {
+      try {
+        const extractedData = util$1.extractData(salt);
+        if (extractedData.length >= 2) {
+          coords = [[[extractedData[0], extractedData[1]]]];
+        }
+      } catch (error) {
+        this.logger.warn(() => ({
+          msg: "Failed to extract coordinates from salt",
+          error,
+          salt
+        }));
+      }
+    }
+    if (challengeRecord.userSubmitted) {
+      this.logger.debug(() => ({
+        msg: `Challenge already submitted: ${challenge}`
+      }));
+      return false;
+    }
+    if (!util$1.verifyRecency(challenge, timeout)) {
+      const timeoutResult = {
+        status: types.CaptchaStatus.disapproved,
+        reason: types.ResultReason.CAPTCHA_INVALID_TIMESTAMP
+      };
+      await this.db.updatePuzzleCaptchaRecordResult(
+        challenge,
+        timeoutResult,
+        false,
+        //serverchecked
+        true,
+        // usersubmitted
+        userTimestampSignature,
+        coords
+      );
+      if (challengeRecord.sessionId) {
+        await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+          userSubmitted: true,
+          result: timeoutResult
+        });
+      }
+      return false;
+    }
+    const correct = puzzleTasksUtils.validatePuzzleSolution(
+      finalX,
+      finalY,
+      challengeRecord.targetX,
+      challengeRecord.targetY,
+      challengeRecord.tolerance
+    );
+    let result = { status: types.CaptchaStatus.approved };
+    if (!correct) {
+      result = {
+        status: types.CaptchaStatus.disapproved,
+        reason: types.ResultReason.CAPTCHA_INVALID_SOLUTION
+      };
+    }
+    if (correct && this.usageCounters) {
+      const dappAccount = util$1.at(challengeSplit, 2);
+      this.usageCounters.incrManyAsync(
+        dappAccount,
+        usageCounters.buildAllWindowIncrements(
+          "solved",
+          types.CaptchaType.puzzle,
+          ipAddress.address,
+          userAccount
+        )
+      );
+    }
+    if (behavioralData) {
+      try {
+        const decryptKeys = [
+          // Process DB keys first, then env var key last as env key will likely be invalid
+          ...await this.getDetectorKeys(),
+          process.env.BOT_DECRYPTION_KEY
+        ];
+        const decryptedData = await this.decryptBehavioralData(
+          behavioralData,
+          decryptKeys
+        );
+        if (decryptedData) {
+          const dappAccount = util$1.at(challengeSplit, 2);
+          this.logger?.info(() => ({
+            msg: "Behavioral analysis completed",
+            data: {
+              userAccount,
+              dappAccount,
+              challenge,
+              mouseEventsCount: decryptedData.collector1?.length || 0,
+              touchEventsCount: decryptedData.collector2?.length || 0,
+              clickEventsCount: decryptedData.collector3?.length || 0,
+              deviceCapability: decryptedData.deviceCapability,
+              captchaResult: correct ? "passed" : "failed"
+            }
+          }));
+          const packedData = {
+            c1: decryptedData.collector1 || [],
+            c2: decryptedData.collector2 || [],
+            c3: decryptedData.collector3 || [],
+            d: decryptedData.deviceCapability
+          };
+          await this.db.updatePuzzleCaptchaRecord(challenge, {
+            behavioralDataPacked: packedData,
+            deviceCapability: decryptedData.deviceCapability,
+            puzzleEvents
+          });
+        }
+      } catch (error) {
+        this.logger?.error(() => ({
+          msg: "Failed to process behavioral data",
+          err: error
+        }));
+      }
+    } else {
+      await this.db.updatePuzzleCaptchaRecord(challenge, {
+        puzzleEvents
+      });
+    }
+    if (clientMetaData?.hp) {
+      await this.db.updatePuzzleCaptchaRecord(challenge, {
+        clientMetaData: { hp: clientMetaData.hp }
+      });
+    }
+    await this.db.updatePuzzleCaptchaRecordResult(
+      challenge,
+      result,
+      false,
+      true,
+      userTimestampSignature,
+      coords
+    );
+    if (challengeRecord.sessionId) {
+      const linkedSessionId = challengeRecord.sessionId;
+      await this.updateSessionRecordWithCache(linkedSessionId, {
+        userSubmitted: true,
+        result
+      });
+      if (simdReadings) {
+        await this.decryptAndAttachSimdReadingsIfAbsent(
+          linkedSessionId,
+          simdReadings,
+          types.SimdReadingsStage.submit
+        );
+      }
+    }
+    return correct;
+  }
+  /**
+   * @description Verifies a Puzzle Captcha for a given user and dapp. This is called by the server to verify the user's solution
+   * and update the record in the database to show that the user has solved the captcha
+   *
+   * @param {string} dappAccount - the dapp that is requesting the captcha
+   * @param {string} challenge - the challenge string
+   * @param {number} timeout - the time in milliseconds since the Provider was selected to provide the captcha
+   * @param env - provider environment
+   * @param ip - optional IP address for validation
+   * @param userAccessRulesStorage - storage for querying user access policies
+   * @param email
+   * @param spamEmailDomainCheckingEnabled
+   * @param trafficFilter
+   * @param storeMetadata - when true, persists the dapp-server-provided
+   *   `email` on the captcha record for spam-rate analysis.
+   */
+  async serverVerifyPuzzleCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, trafficFilter, storeMetadata = false) {
+    const notVerifiedResponse = { verified: false };
+    const challengeRecord = await this.db.getPuzzleCaptchaRecordByChallenge(challenge);
+    if (!challengeRecord) {
+      this.logger.debug(() => ({
+        msg: `No record of this challenge: ${challenge}`
+      }));
+      return notVerifiedResponse;
+    }
+    if (challengeRecord.result.status !== types.CaptchaStatus.approved) {
+      throw new common.ProsopoApiError("CAPTCHA.INVALID_SOLUTION", {
+        context: {
+          failedFuncName: this.serverVerifyPuzzleCaptchaSolution.name,
+          challenge
+        }
+      });
+    }
+    if (challengeRecord.serverChecked) return notVerifiedResponse;
+    const challengeDappAccount = challengeRecord.dappAccount;
+    if (dappAccount !== challengeDappAccount) {
+      throw new common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", {
+        context: {
+          failedFuncName: this.serverVerifyPuzzleCaptchaSolution.name,
+          dappAccount,
+          challengeDappAccount
+        }
+      });
+    }
+    await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
+      serverChecked: true,
+      lastUpdatedTimestamp: /* @__PURE__ */ new Date()
+    });
+    const recent = util$1.verifyRecency(challenge, timeout);
+    if (!recent) {
+      const disapprovedResult = {
+        status: types.CaptchaStatus.disapproved,
+        reason: types.ResultReason.TIMESTAMP_TOO_OLD
+      };
+      await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
+        result: disapprovedResult
+      });
+      if (challengeRecord.sessionId) {
+        await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+          serverChecked: true,
+          result: disapprovedResult
+        });
+      }
+      return notVerifiedResponse;
+    }
+    if (userAccessRulesStorage) {
+      try {
+        const blockPolicy = await this.checkForHardBlock(
+          userAccessRulesStorage,
+          challengeRecord,
+          challengeRecord.userAccount,
+          challengeRecord.headers,
+          challengeRecord.coords,
+          challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0
+        );
+        if (blockPolicy) {
+          this.logger.info(() => ({
+            msg: "User blocked by access policy in server puzzle verification",
+            data: {
+              challenge,
+              userAccount: challengeRecord.userAccount,
+              dappAccount,
+              policy: blockPolicy
+            }
+          }));
+          const blockedResult = {
+            status: types.CaptchaStatus.disapproved,
+            reason: types.ResultReason.ACCESS_POLICY_BLOCK
+          };
+          await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
+            result: blockedResult
+          });
+          if (challengeRecord.sessionId) {
+            await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+              serverChecked: true,
+              result: blockedResult
+            });
+          }
+          return notVerifiedResponse;
+        }
+      } catch (error) {
+        this.logger.warn(() => ({
+          msg: "Failed to check user access policies in server puzzle verification",
+          error
+        }));
+      }
+    }
+    if (email && spamEmailDomainCheckingEnabled) {
+      try {
+        const isSpam = await this.checkSpamEmail(email);
+        if (isSpam) {
+          const emailDomain = email.split("@")[1] || "unknown";
+          this.logger.info(() => ({
+            msg: "Spam email domain detected in server puzzle verification",
+            data: { challenge, dappAccount, emailDomain }
+          }));
+          await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
+            result: {
+              status: types.CaptchaStatus.disapproved,
+              reason: types.ResultReason.SPAM_EMAIL_DOMAIN
+            }
+          });
+          return notVerifiedResponse;
+        }
+      } catch (error) {
+        this.logger.warn(() => ({
+          msg: "Failed to check spam email domain in server puzzle verification",
+          error
+        }));
+      }
+    }
+    {
+      const check = await this.resolveTrafficFilterCheck(
+        env,
+        challengeRecord.ipInfo,
+        trafficFilter,
+        ip
+      );
+      if (check.isBlocked) {
+        this.logger.info(() => ({
+          msg: "Traffic filter rejected request in puzzle verification",
+          data: { challenge, dappAccount, ip, reason: check.reason }
+        }));
+        const blockedResult = {
+          status: types.CaptchaStatus.disapproved,
+          reason: check.reason
+        };
+        await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
+          result: blockedResult
+        });
+        if (challengeRecord.sessionId) {
+          await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+            serverChecked: true,
+            result: blockedResult
+          });
+        }
+        return notVerifiedResponse;
+      }
+    }
+    if (storeMetadata && email) {
+      await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
+        metadata: { email }
+      });
+    }
+    if (ip) {
+      const challengeIpAddress = compositeIpAddress.getIpAddressFromComposite(
+        challengeRecord.ipAddress
+      );
+      const clientRecord = await this.db.getClientRecord(dappAccount);
+      const ipValidationRules = clientRecord?.settings?.ipValidationRules;
+      await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
+        providedIp: compositeIpAddress.getCompositeIpAddress(ip)
+      });
+      if (ipValidationRules?.enabled === true) {
+        const ipValidation = await util$2.deepValidateIpAddress(
+          ip,
+          challengeIpAddress,
+          this.logger,
+          env.ipInfoService,
+          ipValidationRules
+        );
+        if (!ipValidation.isValid) {
+          this.logger.error(() => ({
+            msg: "IP validation failed for puzzle captcha",
+            data: {
+              ip,
+              challengeIp: challengeIpAddress.address,
+              error: ipValidation.errorMessage,
+              distanceKm: ipValidation.distanceKm
+            }
+          }));
+          const ipFailResult = {
+            status: types.CaptchaStatus.disapproved,
+            reason: types.ResultReason.FAILED_IP_VALIDATION
+          };
+          await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
+            result: ipFailResult
+          });
+          if (challengeRecord.sessionId) {
+            await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+              serverChecked: true,
+              result: ipFailResult
+            });
+          }
+          return notVerifiedResponse;
+        }
+      }
+    }
+    let score;
+    if (challengeRecord.sessionId) {
+      const sessionRecord = await this.db.getSessionRecordBySessionId(
+        challengeRecord.sessionId
+      );
+      if (sessionRecord) {
+        score = frictionlessTasksUtils.computeFrictionlessScore(sessionRecord?.scoreComponents);
+        this.logger.info(() => ({
+          data: {
+            scoreComponents: { ...sessionRecord?.scoreComponents || {} },
+            score
+          }
+        }));
+      }
+    }
+    try {
+      const decisionInput = {
+        userAccount: challengeRecord.userAccount,
+        dappAccount: challengeRecord.dappAccount,
+        captchaResult: "passed",
+        headers: challengeRecord.headers,
+        captchaType: types.CaptchaType.puzzle,
+        behavioralDataPacked: challengeRecord.behavioralDataPacked,
+        deviceCapability: challengeRecord.deviceCapability,
+        countryCode: challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0
+      };
+      const decision = await this.decisionMachineRunner.decide(
+        decisionInput,
+        this.logger
+      );
+      if (decision.decision === types.DecisionMachineDecision.Deny) {
+        this.logger.info(() => ({
+          msg: "Decision machine denied puzzle captcha in server verification",
+          data: {
+            challenge,
+            userAccount: challengeRecord.userAccount,
+            dappAccount,
+            reason: decision.reason,
+            score: decision.score,
+            tags: decision.tags
+          }
+        }));
+        const dmResult = {
+          status: types.CaptchaStatus.disapproved,
+          reason: decision.reason || types.ResultReason.CAPTCHA_DECISION_MACHINE_DENIED
+        };
+        await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
+          result: dmResult
+        });
+        if (challengeRecord.sessionId) {
+          await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+            serverChecked: true,
+            result: dmResult
+          });
+        }
+        return notVerifiedResponse;
+      }
+      this.logger.debug(() => ({
+        msg: "Decision machine allowed puzzle captcha",
+        data: {
+          challenge,
+          reason: decision.reason,
+          score: decision.score,
+          tags: decision.tags
+        }
+      }));
+    } catch (error) {
+      this.logger?.error(() => ({
+        msg: "Failed to run decision machine in server puzzle verification",
+        err: error
+      }));
+    }
+    if (challengeRecord.sessionId) {
+      await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
+        serverChecked: true,
+        result: { status: types.CaptchaStatus.approved }
+      });
+    }
+    return { verified: true, ...score ? { score } : {} };
+  }
+}
+exports.PuzzleCaptchaManager = PuzzleCaptchaManager;

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasksUtils.cjs

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const validatePuzzleSolution = (finalX, finalY, targetX, targetY, tolerance) => {
+  const distance = Math.sqrt((finalX - targetX) ** 2 + (finalY - targetY) ** 2);
+  return distance <= tolerance;
+};
+exports.validatePuzzleSolution = validatePuzzleSolution;

package/dist/cjs/tasks/spam/checkSpamEmail.cjs

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const util = require("@prosopo/util");
+const dns = require("../../utils/dns.cjs");
+function extractDomain(urlOrDomain) {
+  try {
+    const url = new URL(
+      urlOrDomain.startsWith("http") ? urlOrDomain : `https://${urlOrDomain}`
+    );
+    return url.hostname;
+  } catch {
+    return urlOrDomain;
+  }
+}
+async function checkSpamEmail(email, db, config, logger) {
+  const normalizedDomain = util.extractDomainFromEmail(email);
+  if (!normalizedDomain) {
+    return true;
+  }
+  try {
+    const record = await db.getSpamEmailDomain(normalizedDomain);
+    if (record !== null && record !== void 0) {
+      return true;
+    }
+  } catch (error) {
+    logger.warn(() => ({
+      msg: "Failed to check spam email domain",
+      error
+    }));
+    return false;
+  }
+  const domainValidation = util.validateDomainForOutboundRequest(normalizedDomain);
+  if (!domainValidation.isValid) {
+    logger.warn(() => ({
+      msg: "Email domain failed SSRF validation, rejecting",
+      domain: normalizedDomain,
+      reason: domainValidation.reason
+    }));
+    return true;
+  }
+  let dnsCheckResult = null;
+  try {
+    dnsCheckResult = await dns.runDnsChecks(normalizedDomain, {
+      dnsServers: config?.dnsServers
+    });
+  } catch (error) {
+    logger.warn(() => ({
+      msg: "Failed to run DNS checks",
+      error,
+      domain: normalizedDomain
+    }));
+    return false;
+  }
+  if (dnsCheckResult.redirectResult.tlsError) {
+    logger.warn(() => ({
+      msg: "Email domain has TLS error",
+      domain: normalizedDomain
+    }));
+    return true;
+  }
+  if (dnsCheckResult.redirectResult.redirectUrl) {
+    const redirectUrl = dnsCheckResult.redirectResult.redirectUrl;
+    const redirectDomain = extractDomain(redirectUrl).toLowerCase().trim();
+    logger.info(() => ({
+      msg: "Email domain has HTTP redirect",
+      domain: normalizedDomain,
+      redirectDomain
+    }));
+    try {
+      const record = await db.getSpamEmailDomain(redirectDomain);
+      if (record !== null && record !== void 0) {
+        return true;
+      }
+    } catch (error) {
+      logger.warn(() => ({
+        msg: "Failed to check spam email domain for redirect",
+        error,
+        redirectDomain
+      }));
+      return false;
+    }
+  } else if (dnsCheckResult.cnameResult && dnsCheckResult.cnameResult.length > 0) {
+    const firstCname = dnsCheckResult.cnameResult[0];
+    if (!firstCname) {
+      logger.warn(() => ({
+        msg: "CNAME result array has undefined element",
+        domain: normalizedDomain
+      }));
+      return false;
+    }
+    const cnameDomain = firstCname.replace(/\.$/, "").toLowerCase().trim();
+    logger.info(() => ({
+      msg: "Email domain has CNAME",
+      domain: normalizedDomain,
+      cnameDomain
+    }));
+    try {
+      const record = await db.getSpamEmailDomain(cnameDomain);
+      if (record !== null && record !== void 0) {
+        return true;
+      }
+    } catch (error) {
+      logger.warn(() => ({
+        msg: "Failed to check spam email domain for CNAME",
+        error,
+        cnameDomain
+      }));
+      return false;
+    }
+  } else if (dnsCheckResult.mxRecordResult && dnsCheckResult.mxRecordResult.length > 0) {
+    const firstMxRecord = dnsCheckResult.mxRecordResult[0];
+    if (!firstMxRecord || !firstMxRecord.exchange) {
+      logger.warn(() => ({
+        msg: "MX record result array has undefined element or exchange",
+        domain: normalizedDomain
+      }));
+      return false;
+    }
+    const mxDomain = firstMxRecord.exchange.replace(/\.$/, "").toLowerCase().trim();
+    logger.info(() => ({
+      msg: "Email domain has MX record",
+      domain: normalizedDomain,
+      mxDomain,
+      priority: firstMxRecord.priority
+    }));
+    try {
+      const record = await db.getSpamEmailDomain(mxDomain);
+      if (record !== null && record !== void 0) {
+        logger.warn(() => ({
+          msg: "Email domain MX record points to spam domain",
+          domain: normalizedDomain,
+          mxDomain
+        }));
+        return true;
+      }
+    } catch (error) {
+      logger.warn(() => ({
+        msg: "Failed to check spam email domain for MX record",
+        error,
+        mxDomain
+      }));
+      return false;
+    }
+  }
+  return false;
+}
+exports.checkSpamEmail = checkSpamEmail;