@prosopo/provider 3.15.0 → 4.7.2

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -10,14 +10,19 @@ const compositeIpAddress = require("../../compositeIpAddress.cjs");
 const pairs = require("../../pairs.cjs");
 const lang = require("../../rules/lang.cjs");
 const util = require("../../util.cjs");
+const usageCounters = require("../../util/usageCounters.cjs");
 const captchaManager = require("../captchaManager.cjs");
-const frictionlessTasks = require("../frictionless/frictionlessTasks.cjs");
+const decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
+require("../frictionless/frictionlessTasks.cjs");
 const frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
+const evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
 const imgCaptchaTasksUtils = require("./imgCaptchaTasksUtils.cjs");
 class ImgCaptchaManager extends captchaManager.CaptchaManager {
-  constructor(db, pair, config, logger) {
-    super(db, pair, config, logger);
+  constructor(db, pair, config, logger, writeQueue, usageCounters2) {
+    super(db, pair, config, logger, writeQueue);
     this.config = config;
+    this.decisionMachineRunner = new decisionMachineRunner.DecisionMachineRunner(db);
+    this.usageCounters = usageCounters2 ?? null;
   }
   async getCaptchaWithProof(datasetId, solved, size) {
     const captchaDocs = await this.db.getRandomCaptcha(solved, datasetId, size);
@@ -33,7 +38,7 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
     }
     return captchaDocs;
   }
-  async getRandomCaptchasAndRequestHash(datasetId, userAccount, ipAddress, captchaConfig, threshold, sessionId) {
+  async getRandomCaptchasAndRequestHash(datasetId, userAccount, ipAddress, captchaConfig, threshold, sessionId, ipInfo) {
     const dataset = await this.db.getDatasetDetails(datasetId);
     if (!dataset) {
       throw new common.ProsopoEnvError("DATABASE.DATASET_GET_FAILED", {
@@ -74,16 +79,17 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
       this.pair.sign(util$1.stringToHex(requestHash))
     );
     const timeLimit = captchas.map((captcha) => captcha.timeLimitMs || types.DEFAULT_IMAGE_CAPTCHA_TIMEOUT).reduce((a, b) => a + b, 0);
-    const deadlineTs = timeLimit + currentTime;
+    const deadlineDate = new Date(timeLimit + currentTime);
     await this.db.storePendingImageCommitment(
       userAccount,
       requestHash,
       salt,
-      deadlineTs,
-      currentTime,
+      deadlineDate,
+      new Date(currentTime),
       compositeIpAddress.getCompositeIpAddress(ipAddress),
       threshold,
-      sessionId
+      sessionId,
+      ipInfo
     );
     return {
       captchas,
@@ -104,9 +110,22 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
    * @param ipAddress
    * @param headers
    * @param ja4
+   * @param behavioralData
    * @return {Promise<DappUserSolutionResult>} result containing the contract event
    */
-  async dappUserSolution(userAccount, dappAccount, requestHash, captchas, userTimestampSignature, timestamp, providerRequestHashSignature, ipAddress, headers, ja4) {
+  async dappUserSolution(userAccount, dappAccount, requestHash, captchas, userTimestampSignature, timestamp, providerRequestHashSignature, ipAddress, headers, ja4, behavioralData, ipInfo, simdReadings, clientMetaData) {
+    const decodedSimdReadings = simdReadings ? await this.decryptSimdReadingsForAttach(simdReadings) : void 0;
+    const pushSimdAttachIfAny = (sessionId, writes) => {
+      if (decodedSimdReadings) {
+        writes.push(
+          this.recordSessionSimdReadingsIfAbsentWithCache(
+            sessionId,
+            decodedSimdReadings,
+            types.SimdReadingsStage.submit
+          )
+        );
+      }
+    };
     const verification = utilCrypto.signatureVerify(
       util$1.stringToHex(timestamp.toString()),
       userTimestampSignature,
@@ -165,6 +184,47 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
         });
       }
       await this.db.updatePendingImageCommitmentStatus(requestHash);
+      let behavioralDataPacked;
+      let deviceCapability;
+      if (behavioralData) {
+        try {
+          const decryptKeys = [
+            // Process DB keys first, then env var key last as env key will likely be invalid
+            ...await this.getDetectorKeys(),
+            process.env.BOT_DECRYPTION_KEY
+          ];
+          const decryptedData = await this.decryptBehavioralData(
+            behavioralData,
+            decryptKeys
+          );
+          if (decryptedData) {
+            this.logger?.info(() => ({
+              msg: "Behavioral analysis completed",
+              data: {
+                userAccount,
+                dappAccount,
+                requestHash,
+                mouseEventsCount: decryptedData.collector1?.length || 0,
+                touchEventsCount: decryptedData.collector2?.length || 0,
+                clickEventsCount: decryptedData.collector3?.length || 0,
+                deviceCapability: decryptedData.deviceCapability
+              }
+            }));
+            behavioralDataPacked = {
+              c1: decryptedData.collector1 || [],
+              c2: decryptedData.collector2 || [],
+              c3: decryptedData.collector3 || [],
+              d: decryptedData.deviceCapability
+            };
+            deviceCapability = decryptedData.deviceCapability;
+          }
+        } catch (error) {
+          this.logger?.error(() => ({
+            msg: "Failed to process behavioral data",
+            err: error
+          }));
+        }
+      }
       const commit = {
         id: commitmentId,
         userAccount,
@@ -179,7 +239,18 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
         ipAddress: compositeIpAddress.getCompositeIpAddress(ipAddress),
         headers,
         sessionId: pendingRecord.sessionId,
-        ja4
+        ja4,
+        ipInfo,
+        pending: false,
+        salt: pendingRecord.salt,
+        requestHash: pendingRecord[types.ApiParams.requestHash],
+        threshold: pendingRecord.threshold,
+        deadlineTimestamp: pendingRecord.deadlineTimestamp,
+        ...behavioralDataPacked && { behavioralDataPacked },
+        ...deviceCapability && { deviceCapability },
+        ...clientMetaData?.hp && {
+          clientMetaData: { hp: clientMetaData.hp }
+        }
       };
       await this.db.storeUserImageCaptchaSolution(receivedCaptchas, commit);
       const solutionRecords = await Promise.all(
@@ -196,12 +267,27 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
         })
       );
       const totalImages = storedCaptchas[0]?.items.length || 0;
-      if (pairs.containsIdenticalPairs(pairs$1)) {
-        await this.db.disapproveDappUserCommitment(
-          commitmentId,
-          "CAPTCHA.INVALID_SOLUTION",
-          pairs$1
-        );
+      if (pairs.containsIdenticalPairs(pairs$1) && process.env.NODE_ENV !== "test") {
+        const writePromises = [
+          this.db.disapproveDappUserCommitment(
+            commitmentId,
+            "CAPTCHA.INVALID_SOLUTION",
+            pairs$1
+          )
+        ];
+        if (pendingRecord.sessionId) {
+          writePromises.push(
+            this.updateSessionRecordWithCache(pendingRecord.sessionId, {
+              userSubmitted: true,
+              result: {
+                status: types.CaptchaStatus.disapproved,
+                reason: types.ResultReason.CAPTCHA_INVALID_SOLUTION
+              }
+            })
+          );
+          pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
+        }
+        await Promise.all(writePromises);
         response = {
           captchas: captchaIds.map((id) => ({
             captchaId: id,
@@ -224,13 +310,40 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
           })),
           verified: true
         };
-        await this.db.approveDappUserCommitment(commitmentId, pairs$1);
+        const writePromises = [
+          this.db.approveDappUserCommitment(commitmentId, pairs$1)
+        ];
+        if (pendingRecord.sessionId) {
+          writePromises.push(
+            this.updateSessionRecordWithCache(pendingRecord.sessionId, {
+              userSubmitted: true,
+              result: { status: types.CaptchaStatus.approved }
+            })
+          );
+          pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
+        }
+        await Promise.all(writePromises);
       } else {
-        await this.db.disapproveDappUserCommitment(
-          commitmentId,
-          "CAPTCHA.INVALID_SOLUTION",
-          pairs$1
-        );
+        const writePromises = [
+          this.db.disapproveDappUserCommitment(
+            commitmentId,
+            "CAPTCHA.INVALID_SOLUTION",
+            pairs$1
+          )
+        ];
+        if (pendingRecord.sessionId) {
+          writePromises.push(
+            this.updateSessionRecordWithCache(pendingRecord.sessionId, {
+              userSubmitted: true,
+              result: {
+                status: types.CaptchaStatus.disapproved,
+                reason: types.ResultReason.CAPTCHA_INVALID_SOLUTION
+              }
+            })
+          );
+          pushSimdAttachIfAny(pendingRecord.sessionId, writePromises);
+        }
+        await Promise.all(writePromises);
         response = {
           captchas: captchaIds.map((id) => ({
             captchaId: id,
@@ -277,12 +390,12 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
   /**
    * Validate that a Dapp User is responding to their own pending captcha request
    * @param {string} requestHash
-   * @param {PendingCaptchaRequest} pendingRecord
+   * @param {PendingImageCaptchaRequest} pendingRecord
    * @param {string} userAccount
    * @param {string[]} captchaIds
    */
   async validateDappUserSolutionRequestIsPending(requestHash, pendingRecord, userAccount, captchaIds) {
-    const currentTime = Date.now();
+    const currentTime = /* @__PURE__ */ new Date();
     if (!pendingRecord) {
       this.logger.info(() => ({
         msg: "No pending record found"
@@ -335,20 +448,29 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
     }
     return void 0;
   }
-  async verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, disallowWebView, contextAwareEnabled = false) {
+  async verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, disallowWebView, contextAwareEnabled = false, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false) {
     const solution = await (commitmentId ? this.getDappUserCommitmentById(commitmentId) : this.getDappUserCommitmentByAccount(user, dapp));
     if (!solution) {
       this.logger.debug(() => ({
         msg: "Not verified - no solution found"
       }));
-      return { status: "API.USER_NOT_VERIFIED_NO_SOLUTION", verified: false };
+      return {
+        status: "API.USER_NOT_VERIFIED_NO_SOLUTION",
+        verified: false
+      };
     }
     if (solution.serverChecked) {
-      return { status: "API.USER_ALREADY_VERIFIED", verified: false };
+      return {
+        status: "API.USER_ALREADY_VERIFIED",
+        verified: false
+      };
     }
     await this.db.markDappUserCommitmentsChecked([solution.id]);
     if (solution.result.status === types.CaptchaStatus.disapproved) {
-      return { status: "API.USER_NOT_VERIFIED", verified: false };
+      return {
+        status: solution.result.reason || "API.USER_NOT_VERIFIED",
+        verified: false
+      };
     }
     maxVerifiedTime = maxVerifiedTime || 60 * 1e3;
     const currentTime = Date.now();
@@ -362,35 +484,139 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
         verified: false
       };
     }
+    const commitmentUpdates = {};
+    let failStatus;
+    if (userAccessRulesStorage) {
+      try {
+        const blockPolicy = await this.checkForHardBlock(
+          userAccessRulesStorage,
+          solution,
+          solution.userAccount,
+          solution.headers,
+          solution.coords,
+          solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0
+        );
+        if (blockPolicy) {
+          this.logger.info(() => ({
+            msg: "User blocked by access policy in server image verification",
+            data: {
+              userAccount: solution.userAccount,
+              dappAccount: solution.dappAccount,
+              policy: blockPolicy
+            }
+          }));
+          commitmentUpdates.result = {
+            status: types.CaptchaStatus.disapproved,
+            reason: types.ResultReason.ACCESS_POLICY_BLOCK
+          };
+          failStatus = types.ResultReason.ACCESS_POLICY_BLOCK;
+        }
+      } catch (error) {
+        this.logger.warn(() => ({
+          msg: "Failed to check user access policies in server Image verification",
+          error
+        }));
+      }
+    }
+    if (!failStatus && email && spamEmailDomainCheckingEnabled) {
+      try {
+        const isSpam = await this.checkSpamEmail(email);
+        if (isSpam) {
+          const emailDomain = email.split("@")[1] || "unknown";
+          this.logger.info(() => ({
+            msg: "Spam email domain detected in server image verification",
+            data: { commitmentId, dapp, emailDomain }
+          }));
+          commitmentUpdates.result = {
+            status: types.CaptchaStatus.disapproved,
+            reason: types.ResultReason.SPAM_EMAIL_DOMAIN
+          };
+          failStatus = types.ResultReason.SPAM_EMAIL_DOMAIN;
+        }
+      } catch (error) {
+        this.logger.warn(() => ({
+          msg: "Failed to check spam email domain in server image verification",
+          error
+        }));
+      }
+    }
+    if (!failStatus && spamFilter?.enabled && spamFilter.emailRules?.enabled && email) {
+      const result = evaluateEmailSpamRules.evaluateEmailSpamRules(email, spamFilter.emailRules);
+      if (result.isSpam) {
+        this.logger.info(() => ({
+          msg: "Spam filter rejected email in image verification",
+          data: { commitmentId, dapp, reason: result.reason }
+        }));
+        commitmentUpdates.result = {
+          status: types.CaptchaStatus.disapproved,
+          reason: types.ResultReason.SPAM_EMAIL_RULE
+        };
+        failStatus = types.ResultReason.SPAM_EMAIL_RULE;
+      }
+    }
+    if (!failStatus) {
+      const check = await this.resolveTrafficFilterCheck(
+        env,
+        solution.ipInfo,
+        trafficFilter,
+        ip
+      );
+      if (check.isBlocked) {
+        this.logger.info(() => ({
+          msg: "Traffic filter rejected request",
+          data: { commitmentId, dapp, ip, reason: check.reason }
+        }));
+        commitmentUpdates.result = {
+          status: types.CaptchaStatus.disapproved,
+          reason: check.reason
+        };
+        failStatus = check.reason;
+      }
+    }
+    if (storeMetadata && email) {
+      commitmentUpdates.metadata = { email };
+    }
     if (ip) {
       const solutionIpAddress = compositeIpAddress.getIpAddressFromComposite(solution.ipAddress);
       const clientRecord = await this.db.getClientRecord(dapp);
       const ipValidationRules = clientRecord?.settings?.ipValidationRules;
-      await this.db.updateDappUserCommitment(solution.id, {
-        providedIp: compositeIpAddress.getCompositeIpAddress(ip)
-      });
-      const ipValidation = await util.deepValidateIpAddress(
-        ip,
-        solutionIpAddress,
-        this.logger,
-        env.config.ipApi.apiKey,
-        env.config.ipApi.baseUrl,
-        ipValidationRules
-      );
-      if (!ipValidation.isValid) {
-        this.logger.error(() => ({
-          msg: "IP validation failed for image captcha",
-          data: {
-            ip,
-            solutionIp: solutionIpAddress.address,
-            error: ipValidation.errorMessage,
-            distanceKm: ipValidation.distanceKm
-          }
-        }));
-        return { status: "API.USER_NOT_VERIFIED", verified: false };
+      commitmentUpdates.providedIp = compositeIpAddress.getCompositeIpAddress(ip);
+      if (!failStatus && ipValidationRules?.enabled === true) {
+        const ipValidation = await util.deepValidateIpAddress(
+          ip,
+          solutionIpAddress,
+          this.logger,
+          env.ipInfoService,
+          ipValidationRules
+        );
+        if (!ipValidation.isValid) {
+          this.logger.error(() => ({
+            msg: "IP validation failed for image captcha",
+            data: {
+              ip,
+              solutionIp: solutionIpAddress.address,
+              error: ipValidation.errorMessage,
+              distanceKm: ipValidation.distanceKm
+            }
+          }));
+          failStatus = types.ResultReason.FAILED_IP_VALIDATION;
+        }
       }
     }
-    const isApproved = solution.result.status === types.CaptchaStatus.approved;
+    let isApproved = !failStatus && solution.result.status === types.CaptchaStatus.approved;
+    let failureStatus = failStatus || types.ResultReason.USER_NOT_VERIFIED;
+    if (!failStatus && solution.result.status === types.CaptchaStatus.approved && this.usageCounters) {
+      const ipValue = ip ?? "";
+      this.usageCounters.incrManyAsync(
+        solution.dappAccount,
+        usageCounters.buildAllWindowIncrements(
+          "solved",
+          types.CaptchaType.image,
+          ipValue,
+          solution.userAccount
+        )
+      );
+    }
     let score;
     if (solution.sessionId) {
       const sessionRecord = await this.db.getSessionRecordBySessionId(
@@ -404,21 +630,108 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
             score
           }
         }));
-        if (disallowWebView === true && (sessionRecord.scoreComponents.webView || 0) > 0) {
+        if (!failStatus && disallowWebView === true && (sessionRecord.webView === true || (sessionRecord.scoreComponents.webView || 0) > 0)) {
           this.logger.info(() => ({
             msg: "Disallowing webview access - user not verified"
           }));
-          return { status: "API.USER_NOT_VERIFIED", verified: false };
+          commitmentUpdates.result = {
+            status: types.CaptchaStatus.disapproved,
+            reason: types.ResultReason.DISALLOWED_WEBVIEW
+          };
+          failStatus = types.ResultReason.DISALLOWED_WEBVIEW;
+          isApproved = false;
+          failureStatus = types.ResultReason.DISALLOWED_WEBVIEW;
         }
-        if (contextAwareEnabled && sessionRecord.reason === frictionlessTasks.FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED) {
+        if (contextAwareEnabled && sessionRecord.reason === types.FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED) {
           this.logger.info(() => ({
             msg: "Context aware validation failed"
           }));
         }
       }
     }
+    if (isApproved) {
+      const decisionInput = {
+        userAccount: solution.userAccount,
+        dappAccount: solution.dappAccount,
+        captchaResult: "passed",
+        headers: solution.headers,
+        captchaType: types.CaptchaType.image,
+        countryCode: solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0
+      };
+      try {
+        const decision = await this.decisionMachineRunner.decide(
+          decisionInput,
+          this.logger
+        );
+        if (decision.decision === types.DecisionMachineDecision.Deny) {
+          const dmReason = decision.reason || types.ResultReason.CAPTCHA_DECISION_MACHINE_DENIED;
+          this.logger?.info(() => ({
+            msg: "Decision machine denied user verification",
+            data: {
+              commitmentId,
+              reason: decision.reason
+            }
+          }));
+          commitmentUpdates.result = {
+            status: types.CaptchaStatus.disapproved,
+            reason: dmReason
+          };
+          isApproved = false;
+          failureStatus = dmReason;
+        }
+      } catch (error) {
+        this.logger?.error(() => ({
+          msg: "Failed to process decision machine",
+          err: error
+        }));
+      }
+    }
+    const writePromises = [];
+    const sideUpdates = {};
+    if (commitmentUpdates.providedIp) {
+      sideUpdates.providedIp = commitmentUpdates.providedIp;
+    }
+    if (commitmentUpdates.metadata) {
+      sideUpdates.metadata = commitmentUpdates.metadata;
+    }
+    if (Object.keys(sideUpdates).length > 0) {
+      writePromises.push(
+        this.db.updateDappUserCommitment(solution.id, sideUpdates)
+      );
+    }
+    if (commitmentId) {
+      if (isApproved) {
+        writePromises.push(this.db.approveDappUserCommitment(commitmentId));
+      } else if (commitmentUpdates.result) {
+        writePromises.push(
+          this.db.disapproveDappUserCommitment(
+            commitmentId,
+            commitmentUpdates.result.reason
+          )
+        );
+      }
+    }
+    const finalResult = isApproved ? { status: types.CaptchaStatus.approved } : commitmentUpdates.result || {
+      status: types.CaptchaStatus.disapproved,
+      reason: failureStatus
+    };
+    if (solution.sessionId) {
+      writePromises.push(
+        this.updateSessionRecordWithCache(
+          solution.sessionId,
+          {
+            serverChecked: true,
+            result: finalResult
+          },
+          true
+        )
+      );
+    }
+    if (writePromises.length > 0) {
+      await Promise.all(writePromises);
+    }
     return {
-      status: isApproved ? "API.USER_VERIFIED" : "API.USER_NOT_VERIFIED",
+      status: isApproved ? types.ResultReason.USER_VERIFIED : failureStatus,
       verified: isApproved,
       commitmentId: solution.id.toString(),
       ...score && { score }
@@ -427,13 +740,14 @@ class ImgCaptchaManager extends captchaManager.CaptchaManager {
   checkLangRules(acceptLanguage) {
     return lang.checkLangRules(this.config, acceptLanguage);
   }
-  getVerificationResponse(verified, clientRecord, translateFn, score, commitmentId) {
+  getVerificationResponse(verified, clientRecord, translateFn, score, commitmentId, reason) {
     return {
       ...super.getVerificationResponse(
         verified,
         clientRecord,
         translateFn,
-        score
+        score,
+        reason
       ),
       ...commitmentId && {
         [types.ApiParams.commitmentId]: commitmentId