@prosopo/provider 3.15.0 → 4.7.1

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const types = require("@prosopo/types");
+const constants = require("./constants.cjs");
+const honeypotResponse = require("./honeypotResponse.cjs");
+const runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
+  const configuredType = input.clientRecord.settings?.captchaType;
+  if (!configuredType || configuredType === types.CaptchaType.frictionless) {
+    return null;
+  }
+  const sessionParams = {
+    token: input.token,
+    score: 0,
+    threshold: input.clientRecord.settings?.frictionlessThreshold ?? constants.DEFAULT_FRICTIONLESS_THRESHOLD,
+    scoreComponents: { baseScore: 0 },
+    providerSelectEntropy: 0,
+    ipAddress: input.ipAddress,
+    webView: false,
+    iFrame: false,
+    decryptedHeadHash: "",
+    siteKey: input.dapp,
+    ipInfo: input.ipInfo,
+    headers: input.flatHeaders,
+    mode: input.sessionMode,
+    userSitekeyIpHash: input.userSitekeyIpHash
+  };
+  input.logger.info(() => ({
+    msg: "Frictionless decision",
+    data: {
+      requestId: input.requestId,
+      decision: "configured_captcha_type",
+      captchaType: configuredType
+    }
+  }));
+  honeypotResponse.attachHoneypot(res, input.clientRecord);
+  switch (configuredType) {
+    case types.CaptchaType.image:
+      return res.json(
+        await input.tasks.frictionlessManager.sendImageCaptcha({
+          ...sessionParams,
+          solvedImagesCount: Math.min(
+            input.env.config.captchas.solved.count,
+            input.clientRecord.settings.imageMaxRounds
+          )
+        })
+      );
+    case types.CaptchaType.pow:
+      return res.json(
+        await input.tasks.frictionlessManager.sendPowCaptcha(sessionParams)
+      );
+    case types.CaptchaType.puzzle:
+      return res.json(
+        await input.tasks.frictionlessManager.sendPuzzleCaptcha(sessionParams)
+      );
+    default:
+      throw new Error(
+        `Unhandled configured captchaType in /frictionless short-circuit: ${configuredType}`
+      );
+  }
+};
+exports.runConfiguredCaptchaTypeShortCircuit = runConfiguredCaptchaTypeShortCircuit;

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge.cjs

@@ -1,365 +1,3 @@
 "use strict";
-const common = require("@prosopo/common");
-const types = require("@prosopo/types");
-const util = require("@prosopo/util");
-const compositeIpAddress = require("../../compositeIpAddress.cjs");
-const frictionlessTasks = require("../../tasks/frictionless/frictionlessTasks.cjs");
-const frictionlessTasksUtils = require("../../tasks/frictionless/frictionlessTasksUtils.cjs");
-require("../../tasks/index.cjs");
-const hashUserAgent = require("../../utils/hashUserAgent.cjs");
-const hashUserIp = require("../../utils/hashUserIp.cjs");
-const apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
-const blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
-const contextAwareValidation = require("./contextAwareValidation.cjs");
-const tasks = require("../../tasks/tasks.cjs");
-const DEFAULT_FRICTIONLESS_THRESHOLD = 0.5;
-const getRoundsFromSimScore = (simScore) => {
-  if (simScore >= 0.9) return 0;
-  if (simScore >= 0.8) return 3;
-  if (simScore >= 0.7) return 4;
-  if (simScore >= 0.6) return 6;
-  if (simScore >= 0.5) return 7;
-  return 8;
-};
-const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
-  try {
-    const tasks$1 = new tasks.Tasks(env, req.logger);
-    const { token, headHash, dapp, user } = types.GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
-    if (apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
-      req.logger.info(() => ({
-        msg: "Maintenance mode active - storing dummy token and sending PoW captcha",
-        data: { dapp, user }
-      }));
-      return res.json(
-        await tasks$1.frictionlessManager.sendPowCaptcha({
-          token,
-          score: 0,
-          threshold: 0.5,
-          scoreComponents: {
-            baseScore: 0
-          },
-          providerSelectEntropy: 0,
-          ipAddress: compositeIpAddress.getCompositeIpAddress(req.ip || ""),
-          webView: false,
-          iFrame: false,
-          decryptedHeadHash: ""
-        })
-      );
-    }
-    const existingToken = await tasks$1.db.getSessionRecordByToken(token);
-    if (existingToken) {
-      req.logger.info(() => ({
-        token: existingToken,
-        msg: "Token has already been used"
-      }));
-      return next(
-        new common.ProsopoApiError("API.BAD_REQUEST", {
-          context: {
-            code: 400,
-            siteKey: dapp,
-            user
-          },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const userSitekeyIpHash = hashUserIp.hashUserIp(user, req.ip || "", dapp);
-    const existingSession = await tasks$1.db.getSessionByuserSitekeyIpHash(userSitekeyIpHash);
-    if (existingSession) {
-      req.logger.info(() => ({
-        msg: "Reusing existing session for user-IP-sitekey combination",
-        data: {
-          userSitekeyIpHash,
-          sessionId: existingSession.sessionId,
-          captchaType: existingSession.captchaType
-        }
-      }));
-      return res.json({
-        [types.ApiParams.captchaType]: existingSession.captchaType,
-        [types.ApiParams.sessionId]: existingSession.sessionId,
-        [types.ApiParams.status]: "ok"
-      });
-    }
-    const lScore = tasks$1.frictionlessManager.checkLangRules(
-      req.headers["accept-language"] || ""
-    );
-    const {
-      baseBotScore,
-      timestamp,
-      providerSelectEntropy,
-      userId,
-      userAgent,
-      webView,
-      iFrame,
-      decryptedHeadHash,
-      decryptionFailed
-    } = await tasks$1.frictionlessManager.decryptPayload(token, headHash);
-    req.logger.debug(() => ({
-      msg: "Decrypted payload",
-      data: {
-        baseBotScore,
-        timestamp,
-        providerSelectEntropy,
-        userId,
-        userAgent,
-        webView
-      }
-    }));
-    let botScore = baseBotScore + lScore;
-    const clientRecord = await tasks$1.db.getClientRecord(dapp);
-    if (!clientRecord) {
-      return next(
-        new common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-          context: { code: 400, siteKey: dapp },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const { valid, reason } = await tasks$1.frictionlessManager.isValidRequest(
-      clientRecord,
-      types.CaptchaType.frictionless,
-      env
-    );
-    if (!valid) {
-      return next(
-        new common.ProsopoApiError(reason || "API.BAD_REQUEST", {
-          context: {
-            code: 400,
-            siteKey: dapp,
-            user
-          },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const botThreshold = clientRecord.settings?.frictionlessThreshold || DEFAULT_FRICTIONLESS_THRESHOLD;
-    let scoreComponents = {
-      baseScore: baseBotScore,
-      ...lScore && { lScore }
-    };
-    const ipAddress = compositeIpAddress.getCompositeIpAddress(req.ip || "");
-    tasks$1.frictionlessManager.setSessionParams({
-      token,
-      score: botScore,
-      threshold: botThreshold,
-      scoreComponents,
-      providerSelectEntropy,
-      ipAddress,
-      webView,
-      iFrame,
-      decryptedHeadHash
-    });
-    const userScope = blacklistRequestInspector.getRequestUserScope(
-      util.flatten(req.headers),
-      req.ja4,
-      req.ip,
-      user
-    );
-    const userAccessPolicy = (await tasks$1.frictionlessManager.getPrioritisedAccessPolicies(
-      userAccessRulesStorage,
-      dapp,
-      userScope
-    ))[0];
-    if (userAccessPolicy) {
-      const scoreUpdate = tasks$1.frictionlessManager.scoreIncreaseAccessPolicy(
-        userAccessPolicy,
-        baseBotScore,
-        botScore,
-        scoreComponents
-      );
-      botScore = scoreUpdate.score;
-      scoreComponents = scoreUpdate.scoreComponents;
-      tasks$1.frictionlessManager.updateScore(botScore, scoreComponents);
-      if (userAccessPolicy.captchaType === types.CaptchaType.image) {
-        return res.json(
-          await tasks$1.frictionlessManager.sendImageCaptcha({
-            solvedImagesCount: userAccessPolicy.solvedImagesCount,
-            userSitekeyIpHash,
-            reason: frictionlessTasks.FrictionlessReason.USER_ACCESS_POLICY
-          })
-        );
-      }
-      if (userAccessPolicy.captchaType === types.CaptchaType.pow) {
-        return res.json(
-          await tasks$1.frictionlessManager.sendPowCaptcha({
-            userSitekeyIpHash,
-            reason: frictionlessTasks.FrictionlessReason.USER_ACCESS_POLICY
-          })
-        );
-      }
-    }
-    const headersUserAgent = req.headers["user-agent"];
-    const hashedHeadersUserAgent = headersUserAgent ? hashUserAgent.hashUserAgent(headersUserAgent) : "";
-    const headersProsopoUser = req.headers["prosopo-user"];
-    if (hashedHeadersUserAgent !== userAgent || headersProsopoUser !== userId) {
-      req.logger.info(() => ({
-        msg: "User agent or user id does not match",
-        data: {
-          headersUserAgent,
-          hashedHeadersUserAgent,
-          userAgent,
-          // This is the hashed user agent from the token
-          headersProsopoUser,
-          userId
-        }
-      }));
-      return res.json(
-        await tasks$1.frictionlessManager.sendImageCaptcha({
-          solvedImagesCount: frictionlessTasksUtils.timestampDecayFunction(
-            timestamp,
-            decryptionFailed
-          ),
-          userSitekeyIpHash,
-          reason: frictionlessTasks.FrictionlessReason.USER_AGENT_MISMATCH
-        })
-      );
-    }
-    if (clientRecord.settings.contextAware?.enabled) {
-      const contexts = clientRecord.settings.contextAware?.contexts || {};
-      const hasDefault = contexts[types.ContextType.Default] !== void 0;
-      const hasWebview = contexts[types.ContextType.Webview] !== void 0;
-      let contextType;
-      if (hasDefault && hasWebview) {
-        contextType = contextAwareValidation.determineContextType(webView);
-      } else if (hasDefault) {
-        contextType = types.ContextType.Default;
-      } else if (hasWebview) {
-        contextType = types.ContextType.Webview;
-      } else {
-        contextType = void 0;
-      }
-      if (contextType) {
-        const clientEntropy = await tasks$1.frictionlessManager.getClientContextEntropy(
-          clientRecord.account,
-          contextType
-        );
-        if (clientEntropy) {
-          if (!decryptedHeadHash) {
-            tasks$1.logger.info(() => ({
-              msg: "No decryptedHeadHash in session for context aware client"
-            }));
-            return next(
-              new common.ProsopoApiError("API.BAD_REQUEST", {
-                context: {
-                  code: 400,
-                  siteKey: dapp,
-                  user
-                },
-                i18n: req.i18n,
-                logger: req.logger
-              })
-            );
-          }
-          const threshold = contextAwareValidation.getContextThreshold(
-            clientRecord.settings,
-            contextType
-          );
-          const sim = util.compareBinaryStrings(decryptedHeadHash, clientEntropy);
-          const isValidContext = sim >= threshold;
-          if (!isValidContext) {
-            return res.json(
-              await tasks$1.frictionlessManager.sendImageCaptcha({
-                solvedImagesCount: getRoundsFromSimScore(sim),
-                userSitekeyIpHash,
-                reason: frictionlessTasks.FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED
-              })
-            );
-          }
-        }
-      }
-    }
-    if (clientRecord.settings.disallowWebView && webView) {
-      tasks$1.logger.info(() => ({
-        msg: "WebView detected"
-      }));
-      const scoreUpdate = tasks$1.frictionlessManager.scoreIncreaseWebView(
-        baseBotScore,
-        botScore,
-        scoreComponents
-      );
-      botScore = scoreUpdate.score;
-      scoreComponents = scoreUpdate.scoreComponents;
-      tasks$1.frictionlessManager.updateScore(botScore, scoreComponents);
-      return res.json(
-        await tasks$1.frictionlessManager.sendImageCaptcha({
-          solvedImagesCount: env.config.captchas.solved.count * 2,
-          userSitekeyIpHash,
-          reason: frictionlessTasks.FrictionlessReason.WEBVIEW_DETECTED
-        })
-      );
-    }
-    if (frictionlessTasks.FrictionlessManager.timestampTooOld(timestamp)) {
-      const scoreUpdate = tasks$1.frictionlessManager.scoreIncreaseTimestamp(
-        timestamp,
-        baseBotScore,
-        botScore,
-        scoreComponents
-      );
-      botScore = scoreUpdate.score;
-      scoreComponents = scoreUpdate.scoreComponents;
-      tasks$1.frictionlessManager.updateScore(botScore, scoreComponents);
-      return res.json(
-        await tasks$1.frictionlessManager.sendImageCaptcha({
-          solvedImagesCount: frictionlessTasksUtils.timestampDecayFunction(
-            timestamp,
-            decryptionFailed
-          ),
-          userSitekeyIpHash,
-          reason: frictionlessTasks.FrictionlessReason.OLD_TIMESTAMP
-        })
-      );
-    }
-    const hostVerified = await tasks$1.frictionlessManager.hostVerified(
-      providerSelectEntropy
-    );
-    if (!hostVerified.verified) {
-      const scoreUpdate = tasks$1.frictionlessManager.scoreIncreaseUnverifiedHost(
-        hostVerified.domain,
-        baseBotScore,
-        botScore,
-        scoreComponents
-      );
-      botScore = scoreUpdate.score;
-      scoreComponents = scoreUpdate.scoreComponents;
-      tasks$1.frictionlessManager.updateScore(botScore, scoreComponents);
-    }
-    if (Number(botScore) > botThreshold) {
-      req.logger.info(() => ({
-        msg: "Bot score is greater than threshold",
-        data: {
-          botScore,
-          botThreshold,
-          token
-        }
-      }));
-      return res.json(
-        await tasks$1.frictionlessManager.sendImageCaptcha({
-          solvedImagesCount: env.config.captchas.solved.count,
-          userSitekeyIpHash,
-          reason: frictionlessTasks.FrictionlessReason.BOT_SCORE_ABOVE_THRESHOLD
-        })
-      );
-    }
-    return res.json(
-      await tasks$1.frictionlessManager.sendPowCaptcha({
-        userSitekeyIpHash
-      })
-    );
-  } catch (err) {
-    req.logger.error(() => ({
-      err,
-      msg: "Error in frictionless captcha challenge"
-    }));
-    return next(
-      new common.ProsopoApiError("API.BAD_REQUEST", {
-        context: { code: 400, error: err },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-};
-module.exports = getFrictionlessCaptchaChallenge;
+const handler = require("./getFrictionlessCaptchaChallenge/handler.cjs");
+module.exports = handler;

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -4,13 +4,15 @@ const datasets = require("@prosopo/datasets");
 const types = require("@prosopo/types");
 const util = require("@prosopo/util");
 require("../../tasks/index.cjs");
+const normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
 const validateAddress = require("../validateAddress.cjs");
 const tasks = require("../../tasks/tasks.cjs");
 const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
   const tasks$1 = new tasks.Tasks(env, req.logger);
   let parsed;
-  if (!req.ip) {
+  const normalizedIp = normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
+  if (!normalizedIp) {
     return next(
       new common.ProsopoApiError("API.BAD_REQUEST", {
         context: { code: 400, error: "IP address not found" },
@@ -19,7 +21,7 @@ const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, re
       })
     );
   }
-  const ipAddress = util.getIPAddress(req.ip || "");
+  const ipAddress = util.getIPAddress(normalizedIp);
   try {
     parsed = types.CaptchaRequestBody.parse(req.body);
   } catch (err) {
@@ -31,7 +33,7 @@ const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, re
       })
     );
   }
-  const { datasetId, user, dapp, sessionId } = parsed;
+  const { datasetId, user, dapp, sessionId, simdReadings } = parsed;
   validateAddress.validateSiteKey(dapp);
   validateAddress.validateAddr(user);
   try {
@@ -45,11 +47,17 @@ const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, re
         })
       );
     }
+    const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
     const userScope = blacklistRequestInspector.getRequestUserScope(
       util.flatten(req.headers),
       req.ja4,
-      req.ip,
-      user
+      normalizedIp,
+      user,
+      void 0,
+      // headHash
+      void 0,
+      // coords
+      countryCode
     );
     const userAccessPolicy = (await tasks$1.imgCaptchaManager.getPrioritisedAccessPolicies(
       userAccessRulesStorage,
@@ -67,7 +75,7 @@ const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, re
       env,
       sessionId,
       userAccessPolicy,
-      req.ip
+      normalizedIp
     );
     if (!valid) {
       return next(
@@ -84,19 +92,38 @@ const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, re
     }
     const captchaConfig = {
       solved: {
-        count: solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count
+        count: Math.min(
+          solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count,
+          clientRecord.settings.imageMaxRounds ?? types.imageMaxRoundsDefault
+        )
       },
       unsolved: {
         count: userAccessPolicy?.unsolvedImagesCount || env.config.captchas.unsolved.count
       }
     };
+    if (validSessionId && simdReadings) {
+      await tasks$1.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(
+        validSessionId,
+        simdReadings,
+        types.SimdReadingsStage.challenge
+      ).catch((updateErr) => {
+        req.logger.warn(() => ({
+          err: updateErr,
+          msg: "Failed to patch session with SIMD readings on image challenge"
+        }));
+      });
+    }
     const taskData = await tasks$1.imgCaptchaManager.getRandomCaptchasAndRequestHash(
       datasetId,
       user,
       ipAddress,
       captchaConfig,
       clientRecord.settings.imageThreshold ?? 0.8,
-      validSessionId
+      validSessionId,
+      // Persist the full ipinfo payload — consumers read
+      // individual flags off this object instead of separate
+      // flat fields.
+      req.ipInfo
     );
     const captchaResponse = {
       [types.ApiParams.status]: "ok",

package/dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs

@@ -4,8 +4,11 @@ const types = require("@prosopo/types");
 const util = require("@prosopo/util");
 const compositeIpAddress = require("../../compositeIpAddress.cjs");
 require("../../tasks/index.cjs");
+const normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
+const apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
 const validateAddress = require("../validateAddress.cjs");
+const maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const tasks = require("../../tasks/tasks.cjs");
 const getPoWCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
   let parsed;
@@ -22,9 +25,16 @@ const getPoWCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res,
       })
     );
   }
-  const { user, dapp, sessionId } = parsed;
+  const { user, dapp, sessionId, simdReadings } = parsed;
   validateAddress.validateSiteKey(dapp);
   validateAddress.validateAddr(user);
+  if (apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+    req.logger.info(() => ({
+      msg: "Maintenance mode active - returning dummy PoW challenge",
+      data: { dapp, user, sessionId }
+    }));
+    return res.json(maintenanceModeResponses.buildPowMaintenanceResponse(user, dapp));
+  }
   try {
     const clientSettings = await tasks$1.db.getClientRecord(dapp);
     if (!clientSettings) {
@@ -36,11 +46,23 @@ const getPoWCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res,
         })
       );
     }
+    const normalizedIp = normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
+    if (!normalizedIp) {
+      req.logger.warn(() => ({
+        msg: "Request missing IP; geoblocking will be skipped"
+      }));
+    }
+    const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
     const userScope = blacklistRequestInspector.getRequestUserScope(
       util.flatten(req.headers),
       req.ja4,
-      req.ip,
-      user
+      normalizedIp,
+      user,
+      void 0,
+      // headHash
+      void 0,
+      // coords
+      countryCode
     );
     const userAccessPolicy = (await tasks$1.powCaptchaManager.getPrioritisedAccessPolicies(
       userAccessRulesStorage,
@@ -58,7 +80,7 @@ const getPoWCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res,
       env,
       sessionId,
       userAccessPolicy,
-      req.ip
+      normalizedIp
     );
     if (!valid) {
       return next(
@@ -95,6 +117,18 @@ const getPoWCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res,
       origin,
       difficulty
     );
+    if (validSessionId && simdReadings) {
+      await tasks$1.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(
+        validSessionId,
+        simdReadings,
+        types.SimdReadingsStage.challenge
+      ).catch((updateErr) => {
+        req.logger.warn(() => ({
+          err: updateErr,
+          msg: "Failed to patch session with SIMD readings on PoW challenge"
+        }));
+      });
+    }
     await tasks$1.db.storePowCaptchaRecord(
       challenge.challenge,
       {
@@ -104,10 +138,18 @@ const getPoWCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res,
       },
       challenge.difficulty,
       challenge.providerSignature,
-      compositeIpAddress.getCompositeIpAddress(req.ip || ""),
+      compositeIpAddress.getCompositeIpAddress(normalizedIp),
       util.flatten(req.headers),
       req.ja4,
-      validSessionId
+      validSessionId,
+      void 0,
+      void 0,
+      void 0,
+      // Persist the full ipinfo payload — consumers (portal,
+      // anomaly detection, CHECK_IP_INFO backfill) read the
+      // individual flags off this object instead of separate
+      // flat fields.
+      req.ipInfo
     );
     const getPowCaptchaResponse = {
       [types.ApiParams.status]: "ok",