@prosopo/provider 3.15.0 → 4.7.1

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -3,9 +3,13 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const loadBalancer = require("@prosopo/load-balancer");
 const types = require("@prosopo/types");
 const uuid = require("uuid");
+const dnsEventUrl = require("../../api/dnsEventUrl.cjs");
 const lang = require("../../rules/lang.cjs");
+const usageCounters = require("../../util/usageCounters.cjs");
 const captchaManager = require("../captchaManager.cjs");
+const decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const getBotScore = require("../detection/getBotScore.cjs");
+const routingMachine = require("./routingMachine.cjs");
 const getDefaultEntropy = () => {
   if (process.env.PROSOPO_ENTROPY) {
     const parsed = Number.parseInt(process.env.PROSOPO_ENTROPY);
@@ -20,19 +24,24 @@ const DEFAULT_ENTROPY = getDefaultEntropy();
 const getSessionIDPrefix = (host) => {
   return host ? host.replace(".prosopo.io", "") : "local";
 };
-var FrictionlessReason = /* @__PURE__ */ ((FrictionlessReason2) => {
-  FrictionlessReason2["CONTEXT_AWARE_VALIDATION_FAILED"] = "CONTEXT_AWARE_VALIDATION_FAILED";
-  FrictionlessReason2["USER_ACCESS_POLICY"] = "USER_ACCESS_POLICY";
-  FrictionlessReason2["USER_AGENT_MISMATCH"] = "USER_AGENT_MISMATCH";
-  FrictionlessReason2["OLD_TIMESTAMP"] = "OLD_TIMESTAMP";
-  FrictionlessReason2["BOT_SCORE_ABOVE_THRESHOLD"] = "BOT_SCORE_ABOVE_THRESHOLD";
-  FrictionlessReason2["WEBVIEW_DETECTED"] = "WEBVIEW_DETECTED";
-  return FrictionlessReason2;
-})(FrictionlessReason || {});
 class FrictionlessManager extends captchaManager.CaptchaManager {
-  constructor(db, pair, config, logger) {
-    super(db, pair, config, logger);
+  constructor(db, pair, config, logger, writeQueue, decisionMachineRunner$1, usageCounters2) {
+    super(db, pair, config, logger, writeQueue);
     this.config = config;
+    this.decisionMachineRunner = decisionMachineRunner$1 ?? new decisionMachineRunner.DecisionMachineRunner(db);
+    this.usageCounters = usageCounters2 ?? null;
+  }
+  /**
+   * Provide the routing-machine context for this request. When set, the
+   * frictionless flow's send*Captcha calls will (a) invoke the routing
+   * machine to potentially override the baseline captcha type, and (b) emit
+   * fire-and-forget served-counter writes after the session is created.
+   *
+   * Not called on maintenance-mode or configured-captchaType short-circuit
+   * paths — those skip routing entirely.
+   */
+  setRoutingContext(ctx) {
+    this.routingContext = ctx;
   }
   setSessionParams(params) {
     this.sessionParams = {
@@ -44,7 +53,12 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
       ipAddress: params.ipAddress,
       webView: params.webView ?? false,
       iFrame: params.iFrame ?? false,
-      decryptedHeadHash: params.decryptedHeadHash
+      decryptedHeadHash: params.decryptedHeadHash,
+      siteKey: params.siteKey,
+      ipInfo: params.ipInfo,
+      headers: params.headers,
+      mode: params.mode,
+      simdReadings: params.simdReadings
     };
   }
   updateScore(score, scoreComponents) {
@@ -56,7 +70,7 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
   checkLangRules(acceptLanguage) {
     return lang.checkLangRules(this.config, acceptLanguage);
   }
-  async createSession(token, score, threshold, scoreComponents, providerSelectEntropy, ipAddress, captchaType, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason) {
+  async createSession(token, score, threshold, scoreComponents, providerSelectEntropy, ipAddress, captchaType, siteKey, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason, blocked, deleted, ipInfo, headers, mode, simdReadings) {
     const sessionRecord = {
       sessionId: `${getSessionIDPrefix(this.config.host)}-${uuid.v4()}`,
       createdAt: /* @__PURE__ */ new Date(),
@@ -67,15 +81,43 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
       providerSelectEntropy,
       ipAddress,
       captchaType,
+      mode,
       solvedImagesCount,
       powDifficulty,
       userSitekeyIpHash,
       webView,
       iFrame,
       decryptedHeadHash,
-      reason
+      reason,
+      siteKey,
+      blocked,
+      deleted,
+      ipInfo,
+      headers,
+      simdReadings,
+      // Tag the arrival stage when the readings actually came in on
+      // this hop. Absence of readings → absence of stage.
+      ...simdReadings && {
+        simdReadingsStage: types.SimdReadingsStage.frictionless
+      }
     };
     await this.db.storeSessionRecord(sessionRecord);
+    if (this.writeQueue) {
+      const cacheData = sessionRecord;
+      const cachePromises = [
+        this.writeQueue.cacheSession(sessionRecord.sessionId, cacheData)
+      ];
+      if (userSitekeyIpHash) {
+        cachePromises.push(
+          this.writeQueue.cacheSessionByHash(
+            userSitekeyIpHash,
+            sessionRecord.sessionId
+          )
+        );
+      }
+      await Promise.all(cachePromises).catch(() => {
+      });
+    }
     return sessionRecord;
   }
   async hostVerified(entropy) {
@@ -84,25 +126,54 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
       entropy
     );
     const domain = new URL(chosen.provider.url).hostname;
+    const configDomain = this.config.host.indexOf("http") > -1 ? new URL(this.config.host).hostname : this.config.host;
     this.logger.info(() => ({
       data: { entropy, host: this.config.host, domain }
     }));
-    if (domain !== this.config.host) {
+    if (domain !== configDomain) {
       this.logger.info(() => ({
         msg: "Host mismatch",
-        data: { expected: this.config.host, got: domain, entropy }
+        data: { expected: configDomain, got: domain, entropy }
       }));
       return { verified: false, domain };
     }
     return { verified: true, domain };
   }
   async sendImageCaptcha(params) {
+    return this.sendCaptcha(types.CaptchaType.image, params);
+  }
+  async sendPowCaptcha(params) {
+    return this.sendCaptcha(types.CaptchaType.pow, params);
+  }
+  async sendPuzzleCaptcha(params) {
+    return this.sendCaptcha(types.CaptchaType.puzzle, params);
+  }
+  // Shared body for the three concrete `send*Captcha` helpers. Each helper is
+  // kept as its own thin wrapper so call-sites read clearly, but session
+  // validation and the createSession invocation only live in one place.
+  async sendCaptcha(captchaType, params) {
     const effectiveParams = { ...this.sessionParams, ...params };
-    if (!effectiveParams.token || effectiveParams.score === void 0 || effectiveParams.threshold === void 0 || !effectiveParams.scoreComponents || effectiveParams.providerSelectEntropy === void 0 || !effectiveParams.ipAddress) {
+    if (!effectiveParams.token || effectiveParams.score === void 0 || effectiveParams.threshold === void 0 || !effectiveParams.scoreComponents || effectiveParams.providerSelectEntropy === void 0 || !effectiveParams.ipAddress || effectiveParams.siteKey === void 0) {
       throw new Error(
-        "Session parameters must be set before calling sendImageCaptcha"
+        `Session parameters must be set before sending a ${captchaType} captcha`
       );
     }
+    const baseline = {
+      captchaType,
+      solvedImagesCount: captchaType === types.CaptchaType.image ? effectiveParams.solvedImagesCount : void 0,
+      powDifficulty: captchaType === types.CaptchaType.pow ? effectiveParams.powDifficulty : void 0
+    };
+    const routed = this.routingContext ? await routingMachine.applyRouter(
+      this.decisionMachineRunner,
+      this.usageCounters,
+      baseline,
+      this.routingContext,
+      this.logger
+    ) : baseline;
+    const finalCaptchaType = routed.captchaType;
+    const finalSolvedImagesCount = finalCaptchaType === types.CaptchaType.image ? routed.solvedImagesCount ?? effectiveParams.solvedImagesCount : void 0;
+    const finalPowDifficulty = finalCaptchaType === types.CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
+    const blocked = finalCaptchaType === types.CaptchaType.image ? effectiveParams.blocked : void 0;
     const sessionRecord = await this.createSession(
       effectiveParams.token,
       effectiveParams.score,
@@ -110,49 +181,70 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
       effectiveParams.scoreComponents,
       effectiveParams.providerSelectEntropy,
       effectiveParams.ipAddress,
-      types.CaptchaType.image,
-      effectiveParams.solvedImagesCount,
-      void 0,
+      finalCaptchaType,
+      effectiveParams.siteKey,
+      finalSolvedImagesCount,
+      finalPowDifficulty,
       effectiveParams.userSitekeyIpHash,
       effectiveParams.webView ?? false,
       effectiveParams.iFrame ?? false,
       effectiveParams.decryptedHeadHash,
-      effectiveParams.reason
+      effectiveParams.reason,
+      blocked,
+      void 0,
+      effectiveParams.ipInfo,
+      effectiveParams.headers,
+      effectiveParams.mode,
+      effectiveParams.simdReadings
     );
+    if (this.routingContext && this.usageCounters) {
+      this.usageCounters.incrManyAsync(
+        this.routingContext.dappAccount,
+        usageCounters.buildAllWindowIncrements(
+          "served",
+          finalCaptchaType,
+          this.routingContext.ip,
+          this.routingContext.userAccount
+        )
+      );
+    }
     return {
-      [types.ApiParams.captchaType]: types.CaptchaType.image,
+      [types.ApiParams.captchaType]: finalCaptchaType,
       [types.ApiParams.sessionId]: sessionRecord.sessionId,
-      [types.ApiParams.status]: "ok"
+      [types.ApiParams.status]: "ok",
+      dns_url: dnsEventUrl.buildDnsEventUrl(sessionRecord.sessionId)
     };
   }
-  async sendPowCaptcha(params) {
+  async registerBlockedSession(params) {
     const effectiveParams = { ...this.sessionParams, ...params };
-    if (!effectiveParams.token || effectiveParams.score === void 0 || effectiveParams.threshold === void 0 || !effectiveParams.scoreComponents || effectiveParams.providerSelectEntropy === void 0 || !effectiveParams.ipAddress) {
+    if (!effectiveParams.token || effectiveParams.score === void 0 || effectiveParams.threshold === void 0 || !effectiveParams.scoreComponents || effectiveParams.providerSelectEntropy === void 0 || !effectiveParams.ipAddress || effectiveParams.siteKey === void 0) {
       throw new Error(
-        "Session parameters must be set before calling sendPowCaptcha"
+        "Session parameters must be set before calling registerBlockedSession"
       );
     }
-    const sessionRecord = await this.createSession(
+    await this.createSession(
       effectiveParams.token,
       effectiveParams.score,
       effectiveParams.threshold,
       effectiveParams.scoreComponents,
       effectiveParams.providerSelectEntropy,
       effectiveParams.ipAddress,
-      types.CaptchaType.pow,
+      types.CaptchaType.image,
+      effectiveParams.siteKey,
+      effectiveParams.solvedImagesCount,
       void 0,
-      effectiveParams.powDifficulty,
       effectiveParams.userSitekeyIpHash,
       effectiveParams.webView ?? false,
       effectiveParams.iFrame ?? false,
       effectiveParams.decryptedHeadHash,
-      effectiveParams.reason
+      effectiveParams.reason,
+      true,
+      true,
+      effectiveParams.ipInfo,
+      effectiveParams.headers,
+      effectiveParams.mode,
+      effectiveParams.simdReadings
     );
-    return {
-      [types.ApiParams.captchaType]: types.CaptchaType.pow,
-      [types.ApiParams.sessionId]: sessionRecord.sessionId,
-      [types.ApiParams.status]: "ok"
-    };
   }
   scoreIncreaseAccessPolicy(accessPolicy, baseBotScore, botScore, scoreComponents) {
     const accessPolicyPenalty = accessPolicy?.frictionlessScore || this.config.penalties.PENALTY_ACCESS_RULE;
@@ -253,6 +345,7 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
     let iFrame;
     let decryptedHeadHash = "";
     let decryptionFailed = false;
+    let triggeredDetectors;
     for (const [keyIndex, key] of decryptKeys.entries()) {
       try {
         this.logger.info(() => ({
@@ -270,6 +363,7 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
         const u = decrypted.userAgent;
         const w = decrypted.isWebView;
         const i = decrypted.isIframe;
+        const td = decrypted.triggeredDetectors;
         this.logger.debug(() => ({
           msg: "Successfully decrypted score",
           data: {
@@ -280,7 +374,8 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
             userId: a,
             userAgent: u,
             webView: w,
-            iFrame: i
+            iFrame: i,
+            triggeredDetectors: td
           }
         }));
         baseBotScore = s;
@@ -290,6 +385,7 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
         userAgent = u;
         webView = w;
         iFrame = i;
+        triggeredDetectors = td;
         break;
       } catch (err) {
         if (keyIndex === decryptKeys.length - 1) {
@@ -304,9 +400,9 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
         }
       }
     }
-    const baseBotScoreUndefined = baseBotScore === void 0;
-    const timestampUndefined = timestamp === void 0;
-    const providerSelectEntropyUndefined = providerSelectEntropy === void 0;
+    const baseBotScoreUndefined = baseBotScore === void 0 || Number.isNaN(baseBotScore);
+    const timestampUndefined = timestamp === void 0 || Number.isNaN(timestamp);
+    const providerSelectEntropyUndefined = providerSelectEntropy === void 0 || Number.isNaN(providerSelectEntropy);
     const undefinedCount = Number(baseBotScoreUndefined) + Number(timestampUndefined) + Number(providerSelectEntropyUndefined);
     if (undefinedCount > 0) {
       this.logger.error(() => ({
@@ -341,13 +437,17 @@ class FrictionlessManager extends captchaManager.CaptchaManager {
       webView: webView || false,
       iFrame: iFrame || false,
       decryptedHeadHash,
-      decryptionFailed
+      decryptionFailed,
+      triggeredDetectors
     };
   }
   async getClientContextEntropy(siteKey, contextType) {
     return this.db.getClientContextEntropy(siteKey, contextType);
   }
 }
+Object.defineProperty(exports, "FrictionlessReason", {
+  enumerable: true,
+  get: () => types.FrictionlessReason
+});
 exports.DEFAULT_ENTROPY = DEFAULT_ENTROPY;
 exports.FrictionlessManager = FrictionlessManager;
-exports.FrictionlessReason = FrictionlessReason;

package/dist/cjs/tasks/frictionless/frictionlessTasksUtils.cjs

@@ -8,22 +8,25 @@ const computeFrictionlessScore = (scoreComponents) => {
     ).toFixed(2)
   );
 };
-const timestampDecayFunction = (timestamp, decryptionFailed) => {
+const timestampDecayFunction = (timestamp, decryptionFailed, imageMaxRounds) => {
   if (decryptionFailed) {
-    return 6;
+    return Math.min(imageMaxRounds, 6);
   }
   const max = (/* @__PURE__ */ new Date()).getTime();
   if (max - timestamp > 36e5) {
-    return 12;
+    return Math.min(imageMaxRounds, 12);
   }
   const min = 1e3;
   const age = max - timestamp;
   const decay = Math.log10(2e3) / max;
   const bigScore = max * (1 - (1 - Math.exp(decay * age) ** 24));
-  return Math.max(
-    2,
-    Math.round(
-      (Math.log(bigScore) - Math.log(min)) / (Math.log(max) - Math.log(min)) * 2.5
+  return Math.min(
+    imageMaxRounds,
+    Math.max(
+      2,
+      Math.round(
+        (Math.log(bigScore) - Math.log(min)) / (Math.log(max) - Math.log(min)) * 2.5
+      )
     )
   );
 };

package/dist/cjs/tasks/frictionless/routingMachine.cjs

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const applyRouter = async (runner, counters, baseline, ctx, logger, phase = "route") => {
+  try {
+    const partial = {
+      phase,
+      dappAccount: ctx.dappAccount,
+      userAccount: ctx.userAccount,
+      ip: ctx.ip,
+      countryCode: ctx.countryCode,
+      baseline,
+      score: ctx.score,
+      platform: ctx.platform,
+      raw: ctx.raw
+    };
+    const specs = await runner.getRequiredCounters(partial, logger);
+    let counterMap = {};
+    if (specs.length > 0) {
+      if (!counters) {
+        logger.warn(() => ({
+          msg: "Routing machine requires counters but UsageCounters is unavailable; falling back to baseline",
+          data: { dappAccount: ctx.dappAccount }
+        }));
+        return baseline;
+      }
+      const reads = specsToReads(specs, ctx);
+      const fetched = await counters.batchGet(ctx.dappAccount, reads);
+      if (!fetched) {
+        logger.warn(() => ({
+          msg: "Counter batch fetch failed; falling back to baseline",
+          data: { dappAccount: ctx.dappAccount }
+        }));
+        return baseline;
+      }
+      counterMap = fetched;
+    }
+    const input = { ...partial, counters: counterMap };
+    const output = await runner.route(input, logger);
+    return output ?? baseline;
+  } catch (error) {
+    logger.error(() => ({
+      msg: "applyRouter threw, falling back to baseline",
+      err: error,
+      data: { dappAccount: ctx.dappAccount }
+    }));
+    return baseline;
+  }
+};
+const specsToReads = (specs, ctx) => {
+  const out = [];
+  for (const spec of specs) {
+    const value = spec.dimension === "ip" ? ctx.ip : spec.dimension === "userAccount" ? ctx.userAccount : void 0;
+    if (value === void 0) continue;
+    out.push({ spec, value });
+  }
+  return out;
+};
+exports.applyRouter = applyRouter;