@prosopo/provider 3.15.0 → 4.7.1

package/dist/cjs/schedulers/updateSpamEmailDomains.cjs

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const env = require("@prosopo/env");
+const types = require("@prosopo/types");
+const cron = require("cron");
+const updateSpamEmailDomains = require("../tasks/spam/updateSpamEmailDomains.cjs");
+const util = require("../util.cjs");
+async function updateSpamEmailDomainsScheduler(pair, cronSchedule, config) {
+  const env$1 = new env.ProviderEnvironment(config, pair);
+  await env$1.isReady();
+  const job = new cron.CronJob(cronSchedule, async () => {
+    const taskRunning = await util.checkIfTaskIsRunning(
+      types.ScheduledTaskNames.UpdateSpamEmailDomains,
+      env$1.getDb()
+    );
+    env$1.logger.info(() => ({
+      msg: `${types.ScheduledTaskNames.UpdateSpamEmailDomains} task running: ${taskRunning}`,
+      data: { taskRunning }
+    }));
+    if (!taskRunning) {
+      env$1.logger.info(() => ({
+        msg: `${types.ScheduledTaskNames.UpdateSpamEmailDomains} task....`,
+        data: {}
+      }));
+      const spamEmailDomainsUrls = config.spamEmailDomainsUrls || [];
+      if (spamEmailDomainsUrls.length === 0) {
+        env$1.logger.warn(() => ({
+          msg: "No spam email domains URLs configured, skipping update"
+        }));
+        return;
+      }
+      await updateSpamEmailDomains.updateSpamEmailDomains(
+        env$1.getDb(),
+        env$1.logger,
+        spamEmailDomainsUrls
+      ).catch((err) => {
+        env$1.logger.error(() => ({
+          err,
+          msg: "Error updating spam email domains"
+        }));
+      });
+    }
+  });
+  job.start();
+}
+exports.updateSpamEmailDomainsScheduler = updateSpamEmailDomainsScheduler;

package/dist/cjs/services/ipComparison.cjs

@@ -1,8 +1,7 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const geolib = require("geolib");
-const ipInfo = require("./ipInfo.cjs");
-async function compareIPs(ip1, ip2, apiKey, apiUrl) {
+async function compareIPs(ip1, ip2, ipInfoService) {
   try {
     if (!ip1 || !ip2 || typeof ip1 !== "string" || typeof ip2 !== "string") {
       return {
@@ -19,8 +18,8 @@ async function compareIPs(ip1, ip2, apiKey, apiUrl) {
       };
     }
     const [ip1Info, ip2Info] = await Promise.all([
-      ipInfo.getIPInfo(ip1, apiUrl, apiKey),
-      ipInfo.getIPInfo(ip2, apiUrl, apiKey)
+      ipInfoService.lookup(ip1),
+      ipInfoService.lookup(ip2)
     ]);
     if (!ip1Info.isValid && !ip2Info.isValid) {
       return {
@@ -47,12 +46,12 @@ async function compareIPs(ip1, ip2, apiKey, apiUrl) {
         ip2Error: ip2Info.error
       };
     }
-    const determineConnectionType = (ipInfo2) => {
-      if (ipInfo2.isMobile) return "mobile";
-      if (ipInfo2.isDatacenter) return "datacenter";
-      if (ipInfo2.isSatellite) return "satellite";
-      if (ipInfo2.providerType === "isp") return "residential";
-      switch (ipInfo2.providerType) {
+    const determineConnectionType = (ipInfo) => {
+      if (ipInfo.isMobile) return "mobile";
+      if (ipInfo.isDatacenter) return "datacenter";
+      if (ipInfo.isSatellite) return "satellite";
+      if (ipInfo.providerType === "isp") return "residential";
+      switch (ipInfo.providerType) {
         case "hosting":
           return "datacenter";
         case "business":

package/dist/cjs/tasks/captchaManager.cjs

@@ -1,20 +1,125 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const common = require("@prosopo/common");
+const logger = require("@prosopo/logger");
 const types = require("@prosopo/types");
+const userAccessPolicy = require("@prosopo/user-access-policy");
 const blacklistRequestInspector = require("../api/blacklistRequestInspector.cjs");
+const compositeIpAddress = require("../compositeIpAddress.cjs");
+const checkSpamEmail = require("./spam/checkSpamEmail.cjs");
+const checkTrafficFilter = require("./spam/checkTrafficFilter.cjs");
 var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
+const findHardBlockPolicy = (accessPolicies) => {
+  return accessPolicies.find(
+    (policy) => policy.type === userAccessPolicy.AccessPolicyType.Block && !policy.captchaType
+  );
+};
 class CaptchaManager {
-  constructor(db, pair, config, logger) {
+  constructor(db, pair, config, logger$1, writeQueue) {
     this.pair = pair;
     this.db = db;
     this.config = config;
-    this.logger = logger || common.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("tasks/captchaManager.cjs", document.baseURI).href);
+    this.logger = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("tasks/captchaManager.cjs", document.baseURI).href);
+    this.writeQueue = writeQueue ?? null;
+  }
+  /**
+   * Update a session record with cache-first / write-behind semantics:
+   * the Redis cache patch is awaited (so the in-request view of the
+   * session is up-to-date for any subsequent fast-path read), and the
+   * Mongo write is fire-and-forget so the response isn't gated on a
+   * round-trip to Mongo. Matches the `RedisWriteQueue` design where
+   * Redis is the source of truth for the in-flight request and Mongo is
+   * eventually consistent.
+   *
+   * Prefer this over `this.db.updateSessionRecord` in any in-request
+   * handler.
+   */
+  async updateSessionRecordWithCache(sessionId, updates, streamToCentral) {
+    if (this.writeQueue) {
+      await this.writeQueue.patchCachedSession(
+        sessionId,
+        updates
+      );
+    }
+    this.scheduleMongoSessionUpdate(sessionId, updates, streamToCentral);
+  }
+  /**
+   * Decrypt with the active detector keys and strip the throwaway
+   * `timestamp` field. Returns `undefined` when no key decrypts.
+   */
+  async decryptSimdReadingsForAttach(simdReadingsCiphertext) {
+    const decryptKeys = [
+      ...await this.getDetectorKeys(),
+      process.env.BOT_DECRYPTION_KEY
+    ];
+    const decrypted = await this.decryptSimdReadings(
+      simdReadingsCiphertext,
+      decryptKeys
+    );
+    if (!decrypted) return void 0;
+    const { timestamp: _ignored, ...readings } = decrypted;
+    return readings;
+  }
+  /** Decrypt + first-hop-wins attach. No-op on decrypt failure. */
+  async decryptAndAttachSimdReadingsIfAbsent(sessionId, simdReadingsCiphertext, stage) {
+    const readings = await this.decryptSimdReadingsForAttach(
+      simdReadingsCiphertext
+    );
+    if (!readings) return;
+    await this.recordSessionSimdReadingsIfAbsentWithCache(
+      sessionId,
+      readings,
+      stage
+    );
+  }
+  /**
+   * First-hop-wins SIMD attach with cache-first / Mongo-deferred
+   * semantics — mirrors `updateSessionRecordWithCache`.
+   */
+  async recordSessionSimdReadingsIfAbsentWithCache(sessionId, readings, stage) {
+    if (this.writeQueue) {
+      await this.writeQueue.patchCachedSimdReadingsIfAbsent(
+        sessionId,
+        readings,
+        stage
+      );
+    }
+    this.scheduleMongoSimdReadingsUpdate(sessionId, readings, stage);
+  }
+  /**
+   * Fire-and-forget Mongo session update. Public so non-Task handlers
+   * (e.g. challenge GETs) can keep request response latency off the
+   * Mongo critical path while still ensuring eventual persistence.
+   */
+  scheduleMongoSessionUpdate(sessionId, updates, streamToCentral) {
+    Promise.resolve(
+      streamToCentral === void 0 ? this.db.updateSessionRecord(sessionId, updates) : this.db.updateSessionRecord(sessionId, updates, streamToCentral)
+    ).catch((err) => {
+      this.logger.warn(() => ({
+        err,
+        msg: "Background Mongo session update failed",
+        data: { sessionId }
+      }));
+    });
+  }
+  /**
+   * Fire-and-forget Mongo SIMD-readings update. Public for the same
+   * reason as `scheduleMongoSessionUpdate`.
+   */
+  scheduleMongoSimdReadingsUpdate(sessionId, readings, stage) {
+    Promise.resolve(
+      this.db.recordSessionSimdReadingsIfAbsent(sessionId, readings, stage)
+    ).catch((err) => {
+      this.logger.warn(() => ({
+        err,
+        msg: "Background Mongo SIMD-readings update failed",
+        data: { sessionId, stage }
+      }));
+    });
   }
   async validateSessionIP(sessionRecord, currentIP, env) {
     return { valid: true };
   }
-  async isValidRequest(clientSettings, requestedCaptchaType, env, sessionId, userAccessPolicy, currentIP) {
+  async isValidRequest(clientSettings, requestedCaptchaType, env, sessionId, userAccessPolicy2, currentIP) {
     this.logger.debug(() => ({
       msg: "Validating request",
       data: {
@@ -22,89 +127,98 @@ class CaptchaManager {
         sessionId
       }
     }));
-    if (userAccessPolicy && userAccessPolicy.captchaType !== requestedCaptchaType) {
+    if (userAccessPolicy2 && userAccessPolicy2.captchaType !== requestedCaptchaType) {
       this.logger.warn(() => ({
         msg: "Invalid captcha type for user access policy",
         data: {
           account: clientSettings.account,
-          captchaType: userAccessPolicy.captchaType
+          captchaType: userAccessPolicy2.captchaType
         }
       }));
       return {
         valid: false,
-        reason: "API.INCORRECT_CAPTCHA_TYPE",
+        reason: types.ResultReason.INCORRECT_CAPTCHA_TYPE,
         type: requestedCaptchaType
       };
     }
     if (sessionId) {
-      if (clientSettings?.settings?.captchaType === types.CaptchaType.frictionless) {
-        const sessionRecord = await this.db.checkAndRemoveSession(sessionId);
-        if (!sessionRecord) {
-          this.logger.warn(() => ({
-            msg: "No frictionless session found",
-            data: {
-              account: clientSettings.account,
-              sessionId
-            }
-          }));
-          return {
-            valid: false,
-            reason: "CAPTCHA.NO_SESSION_FOUND",
-            type: requestedCaptchaType
-          };
-        }
-        if (currentIP) {
-          const ipValidation = await this.validateSessionIP(
-            sessionRecord,
-            currentIP,
-            env
-          );
-          if (!ipValidation.valid) {
-            return {
-              valid: false,
-              reason: ipValidation.reason,
-              type: requestedCaptchaType
-            };
+      const cachedBeforeRemove = this.writeQueue ? await this.writeQueue.getCachedSession(sessionId) : null;
+      const cachedHash = typeof cachedBeforeRemove?.userSitekeyIpHash === "string" ? cachedBeforeRemove.userSitekeyIpHash : void 0;
+      await Promise.all([
+        this.writeQueue?.invalidateCachedSession(sessionId),
+        cachedHash ? this.writeQueue?.invalidateCachedSessionByHash(cachedHash) : Promise.resolve()
+      ]);
+      const sessionRecord = await this.db.checkAndRemoveSession(sessionId);
+      if (!sessionRecord) {
+        this.logger.warn(() => ({
+          msg: "No session found",
+          data: {
+            account: clientSettings.account,
+            sessionId
           }
+        }));
+        if (this.writeQueue) {
+          const cachedHash2 = typeof cachedBeforeRemove?.userSitekeyIpHash === "string" ? cachedBeforeRemove.userSitekeyIpHash : void 0;
+          await Promise.all([
+            this.writeQueue.invalidateCachedSession(sessionId),
+            cachedHash2 ? this.writeQueue.invalidateCachedSessionByHash(cachedHash2) : Promise.resolve()
+          ]);
         }
-        if (sessionRecord.captchaType !== requestedCaptchaType) {
-          this.logger.warn(() => ({
-            msg: "Invalid frictionless request",
-            data: {
-              account: clientSettings.account,
-              sessionId
-            }
-          }));
+        return {
+          valid: false,
+          reason: types.ResultReason.CAPTCHA_NO_SESSION_FOUND,
+          type: requestedCaptchaType
+        };
+      }
+      if (this.writeQueue) {
+        await Promise.all([
+          this.writeQueue.invalidateCachedSession(sessionId),
+          sessionRecord.userSitekeyIpHash ? this.writeQueue.invalidateCachedSessionByHash(
+            sessionRecord.userSitekeyIpHash
+          ) : Promise.resolve()
+        ]);
+      }
+      if (currentIP) {
+        const ipValidation = await this.validateSessionIP(
+          sessionRecord,
+          currentIP,
+          env
+        );
+        if (!ipValidation.valid) {
           return {
             valid: false,
-            reason: "CAPTCHA.NO_SESSION_FOUND",
+            reason: ipValidation.reason,
             type: requestedCaptchaType
           };
         }
-        return {
-          valid: true,
-          sessionId: sessionRecord.sessionId,
-          type: requestedCaptchaType,
-          ...sessionRecord.powDifficulty && {
-            powDifficulty: sessionRecord.powDifficulty
-          },
-          ...sessionRecord.solvedImagesCount && {
-            solvedImagesCount: sessionRecord.solvedImagesCount
+      }
+      if (sessionRecord.captchaType !== requestedCaptchaType) {
+        this.logger.warn(() => ({
+          msg: "Session captcha type does not match requested type",
+          data: {
+            account: clientSettings.account,
+            sessionId,
+            sessionCaptchaType: sessionRecord.captchaType,
+            requestedCaptchaType
           }
+        }));
+        return {
+          valid: false,
+          reason: types.ResultReason.INCORRECT_CAPTCHA_TYPE,
+          type: requestedCaptchaType
         };
       }
-      this.logger.warn(() => ({
-        msg: "Invalid frictionless request",
-        data: {
-          account: clientSettings.account,
-          sessionId,
-          settingsCaptchaType: clientSettings?.settings?.captchaType
-        }
-      }));
       return {
-        valid: false,
-        reason: "API.INCORRECT_CAPTCHA_TYPE",
-        type: requestedCaptchaType
+        valid: true,
+        sessionId: sessionRecord.sessionId,
+        type: requestedCaptchaType,
+        ...sessionRecord.powDifficulty && {
+          powDifficulty: sessionRecord.powDifficulty
+        },
+        ...sessionRecord.solvedImagesCount && {
+          solvedImagesCount: sessionRecord.solvedImagesCount
+        },
+        ipInfo: sessionRecord.ipInfo
       };
     }
     if (clientSettings?.settings?.captchaType !== requestedCaptchaType) {
@@ -118,13 +232,13 @@ class CaptchaManager {
       }));
       return {
         valid: false,
-        reason: "API.INCORRECT_CAPTCHA_TYPE",
+        reason: types.ResultReason.INCORRECT_CAPTCHA_TYPE,
         type: requestedCaptchaType
       };
     }
     return { valid: true, type: requestedCaptchaType };
   }
-  getVerificationResponse(verified, clientRecord, translateFn, score) {
+  getVerificationResponse(verified, clientRecord, translateFn, score, reason) {
     return {
       status: translateFn(
         verified ? "API.USER_VERIFIED" : "API.USER_NOT_VERIFIED"
@@ -132,6 +246,9 @@ class CaptchaManager {
       [types.ApiParams.verified]: verified,
       ...CaptchaManager.canClientSeeScore(clientRecord.tier, score) && {
         [types.ApiParams.score]: score
+      },
+      ...!verified && clientRecord.tier !== types.Tier.Free && reason && {
+        [types.ApiParams.reason]: reason
       }
     };
   }
@@ -145,6 +262,161 @@ class CaptchaManager {
   async getDetectorKeys() {
     return await this.db.getDetectorKeys();
   }
+  /**
+   * Decrypt the catcher's WASM SIMD CPU fingerprint readings via the
+   * obfuscated `decodeSimd.js` bundle (source lives in the private
+   * @prosopo/catcher repo). Mirrors `decryptBehavioralData`: tries each
+   * detector key in turn (loaded by the caller, with the env-var key as
+   * fallback). Returns null when no key works so the caller can drop
+   * the field rather than fail the whole request.
+   */
+  async decryptSimdReadings(encryptedData, decryptKeys) {
+    const decryptSimdReadings = (await Promise.resolve().then(() => require("./detection/decodeSimd.cjs"))).default;
+    const validKeys = decryptKeys.filter((k) => k);
+    if (validKeys.length === 0) {
+      this.logger?.error(() => ({
+        msg: "No decryption keys provided for SIMD readings"
+      }));
+      return null;
+    }
+    for (const [keyIndex, key] of validKeys.entries()) {
+      try {
+        return await decryptSimdReadings(encryptedData, key);
+      } catch (err) {
+        this.logger?.debug(() => ({
+          msg: "Failed to decrypt SIMD readings with key, trying next",
+          data: {
+            keyIndex: keyIndex + 1,
+            totalKeys: validKeys.length,
+            err
+          }
+        }));
+      }
+    }
+    this.logger?.warn(() => ({
+      msg: "Failed to decrypt SIMD readings with all available keys",
+      data: { totalKeysAttempted: validKeys.length }
+    }));
+    return null;
+  }
+  async decryptBehavioralData(encryptedData, decryptKeys) {
+    const decryptBehavioralData = (await Promise.resolve().then(() => require("./detection/decodeBehavior.cjs"))).default;
+    const validKeys = decryptKeys.filter((k) => k);
+    if (validKeys.length === 0) {
+      this.logger?.error(() => ({
+        msg: "No decryption keys provided for behavioral data"
+      }));
+      return null;
+    }
+    for (const [keyIndex, key] of validKeys.entries()) {
+      try {
+        this.logger?.debug(() => ({
+          msg: "Attempting to decrypt behavioral data",
+          data: {
+            keyIndex: keyIndex + 1,
+            totalKeys: validKeys.length
+          }
+        }));
+        const result = await decryptBehavioralData(encryptedData, key);
+        this.logger?.info(() => ({
+          msg: "Behavioral data decrypted successfully",
+          data: {
+            keyIndex: keyIndex + 1,
+            c1Length: result.collector1?.length || 0,
+            c2Length: result.collector2?.length || 0,
+            c3Length: result.collector3?.length || 0,
+            deviceCapability: result.deviceCapability
+          }
+        }));
+        return result;
+      } catch (error) {
+        this.logger?.debug(() => ({
+          msg: "Failed to decrypt with key, trying next",
+          data: {
+            keyIndex: keyIndex + 1,
+            totalKeys: validKeys.length,
+            err: error
+          }
+        }));
+      }
+    }
+    this.logger?.error(() => ({
+      msg: "Failed to decrypt behavioral data with all available keys",
+      data: {
+        totalKeysAttempted: validKeys.length
+      }
+    }));
+    return null;
+  }
+  /**
+   * Checks if a user should be hard blocked based on access policies
+   * Only checks for Block policies without captchaType
+   *
+   * @returns The blocking policy if user should be blocked, undefined otherwise
+   */
+  async checkForHardBlock(userAccessRulesStorage, challengeRecord, userAccount, headers, coords, countryCode) {
+    let headHash;
+    if (challengeRecord.sessionId) {
+      const sessionRecord = await this.db.getSessionRecordBySessionId(
+        challengeRecord.sessionId
+      );
+      headHash = sessionRecord?.decryptedHeadHash;
+    }
+    const coordsString = coords ? JSON.stringify(coords) : void 0;
+    const ipAddressRecord = compositeIpAddress.getIpAddressFromComposite(
+      challengeRecord.ipAddress
+    );
+    const userScope = blacklistRequestInspector.getRequestUserScope(
+      headers,
+      challengeRecord.ja4,
+      ipAddressRecord.address,
+      userAccount,
+      headHash,
+      coordsString,
+      countryCode
+    );
+    const accessPolicies = await this.getPrioritisedAccessPolicies(
+      userAccessRulesStorage,
+      challengeRecord.dappAccount,
+      userScope
+    );
+    return findHardBlockPolicy(accessPolicies);
+  }
+  /**
+   * Checks if the provided email address has a domain in the spam email domain list.
+   * Returns true if the email domain is spam (i.e. should be blocked), false otherwise.
+   * Handles formats: user@domain.com, @domain.com, domain.com
+   */
+  async checkSpamEmail(email) {
+    return checkSpamEmail.checkSpamEmail(email, this.db, this.config, this.logger);
+  }
+  /**
+   * Resolves the IP info to feed to `checkTrafficFilter` and runs the check.
+   *
+   * - The captcha record already carries the IPInfoResponse from request
+   *   time (ipInfoMiddleware → storeXxxRecord), so by default we reuse it
+   *   instead of hitting the sidecar again.
+   * - If the dapp's server passed up the end user's current IP via the
+   *   verify call, look that up fresh — it's the "now" IP for filtering
+   *   and may differ from the IP that originally requested the captcha.
+   * - `blockAbuser` defaults to true so abusive networks are always
+   *   blocked even when the site hasn't configured a trafficFilter.
+   * - Returns `{ isBlocked: false }` if every filter flag is off, without
+   *   consulting the payload at all.
+   *
+   * Callers handle the "blocked" branch themselves (each verify path
+   * updates record / session state differently); this helper just returns
+   * the verdict.
+   */
+  async resolveTrafficFilterCheck(env, recordIpInfo, trafficFilter, currentIp) {
+    const effective = { blockAbuser: true, ...trafficFilter };
+    const hasAny = Object.values(effective).some((v) => v);
+    if (!hasAny) {
+      return { isBlocked: false };
+    }
+    const ipInfo = currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo;
+    return checkTrafficFilter.checkTrafficFilter(ipInfo, effective);
+  }
   static canClientSeeScore(tier, score) {
     return score && tier && tier !== types.Tier.Free;
   }