@prosopo/provider 4.11.0 → 4.11.2

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -62,11 +62,6 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         )
       );
     }
-    const tasks$1 = new tasks.Tasks(env, req.logger);
-    const decodedSimdReadings = await decryptSimdReadings.decryptIncomingSimdReadings(
-      tasks$1.frictionlessManager,
-      simdReadings
-    );
     if (testSiteKey.isReservedTestSiteKey(dapp)) {
       req.logger.warn(() => ({
         msg: "Reserved TEST site key - returning invisible PoW session",
@@ -79,13 +74,13 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         )
       );
     }
+    const tasks$1 = new tasks.Tasks(env, req.logger);
     const userSitekeyIpHash = hashUserIp.hashUserIp(user, normalizedIp, dapp);
-    const { existingToken, dedup } = await sessionDedup.resolveSessionDedup(
-      tasks$1,
-      token,
-      userSitekeyIpHash,
-      req.logger
-    );
+    const [decodedSimdReadings, { existingToken, dedup }, clientRecord] = await Promise.all([
+      decryptSimdReadings.decryptIncomingSimdReadings(tasks$1.frictionlessManager, simdReadings),
+      sessionDedup.resolveSessionDedup(tasks$1, token, userSitekeyIpHash, req.logger),
+      tasks$1.db.getClientRecord(dapp)
+    ]);
     if (existingToken) {
       req.logger.info(() => ({
         token: existingToken,
@@ -99,7 +94,6 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         })
       );
     }
-    const clientRecord = await tasks$1.db.getClientRecord(dapp);
     if (!clientRecord) {
       return next(
         new common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
@@ -160,6 +154,29 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
     const lScore = tasks$1.frictionlessManager.checkLangRules(
       req.headers["accept-language"] || ""
     );
+    const userScope = blacklistRequestInspector.getRequestUserScope(
+      util.flatten(req.headers),
+      req.ja4,
+      normalizedIp,
+      user,
+      void 0,
+      void 0,
+      countryCode,
+      asn
+    );
+    const [decryptedPayload, validation, accessPolicies] = await Promise.all([
+      tasks$1.frictionlessManager.decryptPayload(token, headHash),
+      tasks$1.frictionlessManager.isValidRequest(
+        clientRecord,
+        types.CaptchaType.frictionless,
+        env
+      ),
+      tasks$1.frictionlessManager.getPrioritisedAccessPolicies(
+        userAccessRulesStorage,
+        dapp,
+        userScope
+      )
+    ]);
     const {
       baseBotScore,
       timestamp,
@@ -172,7 +189,7 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
       decryptionFailed,
       triggeredDetectors,
       shadowDomPenalty
-    } = await tasks$1.frictionlessManager.decryptPayload(token, headHash);
+    } = decryptedPayload;
     req.logger.debug(() => ({
       msg: "Decrypted payload",
       data: {
@@ -185,11 +202,7 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
       }
     }));
     let botScore = baseBotScore + lScore;
-    const { valid, reason } = await tasks$1.frictionlessManager.isValidRequest(
-      clientRecord,
-      types.CaptchaType.frictionless,
-      env
-    );
+    const { valid, reason } = validation;
     if (!valid) {
       return next(
         new common.ProsopoApiError(reason || "API.BAD_REQUEST", {
@@ -239,21 +252,7 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         ...req.ja4 && { ja4: req.ja4 }
       }
     });
-    const userScope = blacklistRequestInspector.getRequestUserScope(
-      util.flatten(req.headers),
-      req.ja4,
-      normalizedIp,
-      user,
-      void 0,
-      void 0,
-      countryCode,
-      asn
-    );
-    const userAccessPolicy = (await tasks$1.frictionlessManager.getPrioritisedAccessPolicies(
-      userAccessRulesStorage,
-      dapp,
-      userScope
-    ))[0];
+    const userAccessPolicy = accessPolicies[0];
     const accessPolicyOutcome = await accessPolicy.handleAccessPolicy(
       {
         tasks: tasks$1,

package/dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs

@@ -40,7 +40,8 @@ const submitPoWCaptchaSolution = (env) => async (req, res, next) => {
     behavioralData,
     salt,
     simdReadings,
-    clientMetaData
+    clientMetaData,
+    fingerprintProof
   } = parsed;
   validateAddress.validateSiteKey(dapp);
   validateAddress.validateAddr(user);
@@ -66,6 +67,14 @@ const submitPoWCaptchaSolution = (env) => async (req, res, next) => {
     const flatHeaders = util.flatten(req.headers);
     const userAgent = req.headers["user-agent"] ?? "";
     const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+    req.logger.info(() => ({
+      msg: fingerprintProof ? "fingerprintProof detected" : "no fingerprintProof on PoW submission",
+      data: {
+        fingerprintProofPresent: fingerprintProof !== void 0,
+        fingerprintProofBytes: fingerprintProof?.length ?? 0,
+        challenge
+      }
+    }));
     tasks$1.powCaptchaManager.setPostPowContext({
       ip: req.ip || "",
       countryCode,
@@ -75,7 +84,8 @@ const submitPoWCaptchaSolution = (env) => async (req, res, next) => {
       raw: {
         headers: flatHeaders,
         userAgent,
-        ...req.ja4 && { ja4: req.ja4 }
+        ...req.ja4 && { ja4: req.ja4 },
+        ...fingerprintProof && { fingerprintProof }
       }
     });
     const persistedSolutionTimeout = clientRecord.settings.solutionTimeout;
@@ -93,6 +103,16 @@ const submitPoWCaptchaSolution = (env) => async (req, res, next) => {
       simdReadings,
       clientMetaData
     );
+    if (result.routingOutput) {
+      req.logger.info(() => ({
+        msg: "post-PoW routing decision",
+        data: {
+          routedCaptchaType: result.routingOutput?.captchaType,
+          routingReason: result.routingOutput?.reason,
+          challenge
+        }
+      }));
+    }
     const escalation = await buildEscalation(tasks$1, result, challenge);
     const response = {
       status: "ok",
@@ -134,6 +154,7 @@ const buildEscalation = async (tasks2, result, challenge) => {
   );
   if (!originSession) return void 0;
   const routed = result.routingOutput;
+  const selectionReason = routed.reason ?? originSession.reason;
   const newSession = await tasks2.frictionlessManager.createSession(
     originSession.token,
     originSession.score,
@@ -149,7 +170,7 @@ const buildEscalation = async (tasks2, result, challenge) => {
     originSession.webView,
     originSession.iFrame,
     originSession.decryptedHeadHash,
-    originSession.reason,
+    selectionReason,
     void 0,
     void 0,
     originSession.ipInfo,