@prosopo/provider 4.12.0 → 4.13.1

package/dist/cjs/api/admin/apiClearAllCountersEndpoint.cjs

@@ -8,7 +8,7 @@ class ApiClearAllCountersEndpoint {
     this.usageCounters = usageCounters;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", "");
+    logger$1 = logger$1 ? logger$1.with({}, "admin:counters:clear-all") : logger.getLogger("info", "provider:admin:counters:clear-all");
     const dappAccount = args.dapp;
     const scope = dappAccount ?? "all";
     try {

package/dist/cjs/api/admin/apiDnsEventEndpoint.cjs

@@ -4,7 +4,6 @@ const apiRoute = require("@prosopo/api-route");
 const logger = require("@prosopo/logger");
 const types = require("@prosopo/types");
 const enrichDnsEvent = require("../../tasks/dnsEvent/enrichDnsEvent.cjs");
-var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
 const dnsEventToFields = (event) => {
   if (event.kind === "dns") {
     return { resolverIp: event.src_ip };
@@ -23,7 +22,7 @@ class ApiDnsEventEndpoint {
     this.ipInfoService = ipInfoService;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/admin/apiDnsEventEndpoint.cjs", document.baseURI).href);
+    logger$1 = logger$1 ? logger$1.with({}, "admin:dns-event:ingest") : logger.getLogger("info", "provider:admin:dns-event:ingest");
     const { events } = args;
     let stored = 0;
     let errors = 0;

package/dist/cjs/api/admin/apiGetAllDecisionMachinesEndpoint.cjs

@@ -9,7 +9,7 @@ class ApiGetAllDecisionMachinesEndpoint {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", "");
+    logger$1 = logger$1 ? logger$1.with({}, "admin:decision-machines:get-all") : logger.getLogger("info", "provider:admin:decision-machines:get-all");
     try {
       logger$1.info(() => ({
         msg: "Getting all decision machines"

package/dist/cjs/api/admin/apiGetDecisionMachineEndpoint.cjs

@@ -8,7 +8,7 @@ class ApiGetDecisionMachineEndpoint {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", "");
+    logger$1 = logger$1 ? logger$1.with({}, "admin:decision-machine:get") : logger.getLogger("info", "provider:admin:decision-machine:get");
     try {
       const { id } = args;
       logger$1.info(() => ({

package/dist/cjs/api/admin/apiRegisterSiteKeyEndpoint.cjs

@@ -3,14 +3,13 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const apiRoute = require("@prosopo/api-route");
 const logger = require("@prosopo/logger");
 const types = require("@prosopo/types");
-var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
 class ApiRegisterSiteKeyEndpoint {
   constructor(clientTaskManager) {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
     const { siteKey, tier, settings } = args;
-    logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/admin/apiRegisterSiteKeyEndpoint.cjs", document.baseURI).href);
+    logger$1 = logger$1 ? logger$1.with({}, "admin:site-key:register") : logger.getLogger("info", "provider:admin:site-key:register");
     const temp = settings || types.ClientSettingsSchema.parse({});
     logger$1.info(() => ({ data: { siteKey }, msg: "`Registering site key" }));
     await this.clientTaskManager.registerSiteKey(siteKey, tier, temp);

package/dist/cjs/api/admin/apiRegisterSiteKeysEndpoint.cjs

@@ -3,13 +3,12 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const apiRoute = require("@prosopo/api-route");
 const logger = require("@prosopo/logger");
 const types = require("@prosopo/types");
-var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
 class ApiRegisterSiteKeysEndpoint {
   constructor(clientTaskManager) {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/admin/apiRegisterSiteKeysEndpoint.cjs", document.baseURI).href);
+    logger$1 = logger$1 ? logger$1.with({}, "admin:site-keys:register") : logger.getLogger("info", "provider:admin:site-keys:register");
     logger$1.info(() => ({
       data: { count: args.length },
       msg: "Registering site keys"

package/dist/cjs/api/admin/apiRemoveAllDecisionMachinesEndpoint.cjs

@@ -9,7 +9,7 @@ class ApiRemoveAllDecisionMachinesEndpoint {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", "");
+    logger$1 = logger$1 ? logger$1.with({}, "admin:decision-machines:remove-all") : logger.getLogger("info", "provider:admin:decision-machines:remove-all");
     try {
       logger$1.info(() => ({
         msg: "Removing all decision machines"

package/dist/cjs/api/admin/apiRemoveDecisionMachineEndpoint.cjs

@@ -8,7 +8,7 @@ class ApiRemoveDecisionMachineEndpoint {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", "");
+    logger$1 = logger$1 ? logger$1.with({}, "admin:decision-machine:remove") : logger.getLogger("info", "provider:admin:decision-machine:remove");
     try {
       const { id } = args;
       logger$1.info(() => ({

package/dist/cjs/api/admin/apiRemoveDetectorKeyEndpoint.cjs

@@ -3,16 +3,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const apiRoute = require("@prosopo/api-route");
 const logger = require("@prosopo/logger");
 const types = require("@prosopo/types");
-var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
 class ApiRemoveDetectorKeyEndpoint {
   constructor(clientTaskManager) {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/admin/apiRemoveDetectorKeyEndpoint.cjs", document.baseURI).href);
+    logger$1 = logger$1 ? logger$1.with({}, "admin:detector-key:remove") : logger.getLogger("info", "provider:admin:detector-key:remove");
     try {
       const { detectorKey, expirationInSeconds } = args;
-      logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/admin/apiRemoveDetectorKeyEndpoint.cjs", document.baseURI).href);
       logger$1.info(() => ({ msg: "Removing detector key" }));
       await this.clientTaskManager.removeDetectorKey(
         detectorKey,

package/dist/cjs/api/admin/apiRemoveSiteKeyEndpoint.cjs

@@ -3,13 +3,12 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const apiRoute = require("@prosopo/api-route");
 const logger = require("@prosopo/logger");
 const types = require("@prosopo/types");
-var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
 class ApiRemoveSiteKeyEndpoint {
   constructor(clientTaskManager) {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/admin/apiRemoveSiteKeyEndpoint.cjs", document.baseURI).href);
+    logger$1 = logger$1 ? logger$1.with({}, "admin:site-key:remove") : logger.getLogger("info", "provider:admin:site-key:remove");
     try {
       const { siteKey } = args;
       logger$1.info(() => ({ data: { siteKey }, msg: "Removing site key" }));

package/dist/cjs/api/admin/apiRemoveSiteKeysEndpoint.cjs

@@ -3,13 +3,12 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const apiRoute = require("@prosopo/api-route");
 const logger = require("@prosopo/logger");
 const types = require("@prosopo/types");
-var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
 class ApiRemoveSiteKeysEndpoint {
   constructor(clientTaskManager) {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/admin/apiRemoveSiteKeysEndpoint.cjs", document.baseURI).href);
+    logger$1 = logger$1 ? logger$1.with({}, "admin:site-keys:remove") : logger.getLogger("info", "provider:admin:site-keys:remove");
     try {
       logger$1.info(() => ({
         data: { count: args.length },

package/dist/cjs/api/admin/apiToggleMaintenanceModeEndpoint.cjs

@@ -3,7 +3,7 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const apiRoute = require("@prosopo/api-route");
 const logger = require("@prosopo/logger");
 const types = require("@prosopo/types");
-var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
+const metrics = require("../metrics.cjs");
 function getMaintenanceMode() {
   return process.env.MAINTENANCE_MODE?.toLowerCase() === "true";
 }
@@ -13,13 +13,14 @@ function setMaintenanceMode(enabled) {
 class ApiToggleMaintenanceModeEndpoint {
   async processRequest(args, logger$1) {
     const { enabled } = args;
-    logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/admin/apiToggleMaintenanceModeEndpoint.cjs", document.baseURI).href);
+    logger$1 = logger$1 ? logger$1.with({}, "admin:maintenance:toggle") : logger.getLogger("info", "provider:admin:maintenance:toggle");
     const previousMode = getMaintenanceMode();
     logger$1.info(() => ({
       data: { enabled, previous: previousMode },
       msg: "Toggling maintenance mode"
     }));
     setMaintenanceMode(enabled);
+    metrics.setMaintenanceModeGauge(enabled);
     const currentMode = getMaintenanceMode();
     logger$1.info(() => ({
       data: { enabled: currentMode },

package/dist/cjs/api/admin/apiUpdateDecisionMachineEndpoint.cjs

@@ -8,7 +8,7 @@ class ApiUpdateDecisionMachineEndpoint {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", "");
+    logger$1 = logger$1 ? logger$1.with({}, "admin:decision-machine:update") : logger.getLogger("info", "provider:admin:decision-machine:update");
     try {
       const {
         decisionMachineScope,

package/dist/cjs/api/admin/apiUpdateDetectorKeyEndpoint.cjs

@@ -8,10 +8,9 @@ class ApiUpdateDetectorKeyEndpoint {
     this.clientTaskManager = clientTaskManager;
   }
   async processRequest(args, logger$1) {
-    logger$1 = logger$1 || logger.getLogger("info", "");
+    logger$1 = logger$1 ? logger$1.with({}, "admin:detector-key:update") : logger.getLogger("info", "provider:admin:detector-key:update");
     try {
       const { detectorKey } = args;
-      logger$1 = logger$1 || logger.getLogger("info", "");
       logger$1.info(() => ({ msg: "Updating detector key" }));
       const activeDetectorKeys = await this.clientTaskManager.updateDetectorKey(detectorKey);
       logger$1.info(() => ({

package/dist/cjs/api/blacklistRequestInspector.cjs

@@ -4,6 +4,7 @@ const node_crypto = require("node:crypto");
 const types = require("@prosopo/types");
 const userAccessPolicy = require("@prosopo/user-access-policy");
 const compositeIpAddress = require("../compositeIpAddress.cjs");
+const metrics = require("./metrics.cjs");
 const getRequestUserScope = (requestHeaders, ja4, ip, user, headHash, coords, countryCode, asn) => {
   const userAgent = requestHeaders["user-agent"] ? requestHeaders["user-agent"].toString() : void 0;
   return {
@@ -145,7 +146,7 @@ class BlacklistRequestInspector {
       request.ipInfo
     );
     if (shouldAbortRequest) {
-      res.status(401).json({ error: "Unauthorized" });
+      res.status(403).json({ error: "Forbidden" });
       return;
     }
     next();
@@ -163,6 +164,7 @@ class BlacklistRequestInspector {
         },
         msg: "Request without IP"
       }));
+      metrics.recordBlockedRequest("no_ip");
       return true;
     }
     await this.environmentReadinessWaiter();
@@ -205,6 +207,7 @@ class BlacklistRequestInspector {
       const accessPolicy = enforceable[0];
       const isBlock = userAccessPolicy.AccessPolicyType.Block === accessPolicy.type;
       if (isBlock) {
+        metrics.recordBlockedRequest("access_policy");
         this.recordBlockDecision(
           accessPolicy,
           {
@@ -226,14 +229,15 @@ class BlacklistRequestInspector {
         err,
         msg: "Block Middleware Error"
       }));
+      metrics.recordBlockedRequest("error");
       return true;
     }
   }
   /**
    * Emit a structured log line and (if a DB is wired) persist a synthetic
-   * Session record for the request we're about to 401. Fire-and-forget on
+   * Session record for the request we're about to block (403). Fire-and-forget on
    * the Mongo side — the structured log line is the source of truth and
-   * the 401 response is never delayed by a persistence failure.
+   * the 403 response is never delayed by a persistence failure.
    *
    * Carries the matched rule's identity (hash + ruleType + description)
    * so the Traffic page can surface "what's blocking traffic for this

package/dist/cjs/api/captcha/checkSpamEmail.cjs

@@ -1,18 +1,32 @@
 "use strict";
 const common = require("@prosopo/common");
+const types = require("@prosopo/types");
 const util = require("@prosopo/util");
 const zod = require("zod");
 require("../../tasks/index.cjs");
 const checkSpamEmail$1 = require("../../tasks/spam/checkSpamEmail.cjs");
 const apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const metrics = require("../metrics.cjs");
 const tasks = require("../../tasks/tasks.cjs");
 const CheckSpamEmailRequestBody = zod.object({
-  email: zod.string(),
-  dapp: zod.string()
+  email: types.safeLine(types.INPUT_LIMITS.EMAIL),
+  dapp: types.safeLine(types.INPUT_LIMITS.ID)
 });
 const checkSpamEmail = (env) => async (req, res, next) => {
+  let email;
+  let dapp;
+  try {
+    ({ email, dapp } = CheckSpamEmailRequestBody.parse(req.body));
+  } catch (err) {
+    return next(
+      new common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+        context: { code: 400, error: err },
+        i18n: req.i18n,
+        logger: req.logger
+      })
+    );
+  }
   try {
-    const { email, dapp } = CheckSpamEmailRequestBody.parse(req.body);
     const emailDomain = util.extractDomainFromEmail(email);
     req.logger.info(() => ({
       msg: "Check spam email handler entry",
@@ -66,6 +80,7 @@ const checkSpamEmail = (env) => async (req, res, next) => {
         isSpam
       }
     }));
+    metrics.recordSpamEmail(isSpam ? "spam" : "ham");
     return res.json({
       isSpam,
       emailDomain

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/accessPolicy.cjs

@@ -11,11 +11,10 @@ const handleAccessPolicy = async (input, res) => {
       scoreComponents: input.scoreComponents
     };
   }
-  const { tasks, clientRecord, userAccessPolicy, logger, requestId } = input;
+  const { tasks, clientRecord, userAccessPolicy, logger } = input;
   logger.info(() => ({
     msg: "User access policy matched",
     data: {
-      requestId,
       policy: userAccessPolicy,
       captchaType: userAccessPolicy.captchaType,
       userScope: input.userScope
@@ -34,7 +33,6 @@ const handleAccessPolicy = async (input, res) => {
     logger.info(() => ({
       msg: "Frictionless decision",
       data: {
-        requestId,
         decision: "block",
         captchaType: types.CaptchaType.image
       }
@@ -57,7 +55,6 @@ const handleAccessPolicy = async (input, res) => {
     logger.info(() => ({
       msg: "Frictionless decision",
       data: {
-        requestId,
         decision: "auto_ban_score",
         botScore,
         autoBanThreshold,
@@ -88,7 +85,6 @@ const handleAccessPolicy = async (input, res) => {
     logger.info(() => ({
       msg: "Frictionless decision",
       data: {
-        requestId,
         decision: "user_access_policy",
         captchaType: types.CaptchaType.image
       }
@@ -111,7 +107,6 @@ const handleAccessPolicy = async (input, res) => {
     logger.info(() => ({
       msg: "Frictionless decision",
       data: {
-        requestId,
         decision: "user_access_policy",
         captchaType: types.CaptchaType.pow
       }
@@ -128,7 +123,6 @@ const handleAccessPolicy = async (input, res) => {
     logger.info(() => ({
       msg: "Frictionless decision",
       data: {
-        requestId,
         decision: "user_access_policy",
         captchaType: types.CaptchaType.puzzle
       }

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.cjs

@@ -6,6 +6,7 @@ const util = require("@prosopo/util");
 const frictionlessTasks = require("../../../tasks/frictionless/frictionlessTasks.cjs");
 const frictionlessTasksUtils = require("../../../tasks/frictionless/frictionlessTasksUtils.cjs");
 const hashUserAgent = require("../../../utils/hashUserAgent.cjs");
+const metrics = require("../../metrics.cjs");
 const contextAwareValidation = require("../contextAwareValidation.cjs");
 const constants = require("./constants.cjs");
 const honeypotResponse = require("./honeypotResponse.cjs");
@@ -57,13 +58,13 @@ const runDecisionMachine = async (input, handle) => {
     req.logger.info(() => ({
       msg: "Frictionless decision",
       data: {
-        requestId: req.requestId,
         decision: "auto_ban_score",
         botScore,
         autoBanThreshold,
         token: input.token
       }
     }));
+    metrics.recordFrictionlessDecision("auto_ban_score");
     await tasks.frictionlessManager.registerBlockedSession({
       solvedImagesCount: clientRecord.settings.imageMaxRounds,
       userSitekeyIpHash,
@@ -78,11 +79,11 @@ const runDecisionMachine = async (input, handle) => {
     req.logger.info(() => ({
       msg: "Frictionless decision",
       data: {
-        requestId: req.requestId,
         decision: "webview_detected",
         captchaType: types.CaptchaType.image
       }
     }));
+    metrics.recordFrictionlessDecision("webview_detected");
     honeypotResponse.attachHoneypot(res, clientRecord);
     return res.json(
       await tasks.frictionlessManager.sendImageCaptcha({
@@ -102,11 +103,11 @@ const runDecisionMachine = async (input, handle) => {
     req.logger.info(() => ({
       msg: "Frictionless decision",
       data: {
-        requestId: req.requestId,
         decision: "timestamp_too_old",
         captchaType: types.CaptchaType.image
       }
     }));
+    metrics.recordFrictionlessDecision("timestamp_too_old");
     honeypotResponse.attachHoneypot(res, clientRecord);
     return res.json(
       await tasks.frictionlessManager.sendImageCaptcha({
@@ -135,11 +136,11 @@ const runDecisionMachine = async (input, handle) => {
     req.logger.info(() => ({
       msg: "Frictionless decision",
       data: {
-        requestId: req.requestId,
         decision: "bot_score_above_threshold",
         captchaType: types.CaptchaType.image
       }
     }));
+    metrics.recordFrictionlessDecision("bot_score_above_threshold");
     honeypotResponse.attachHoneypot(res, clientRecord);
     return res.json(
       await tasks.frictionlessManager.sendImageCaptcha({
@@ -158,11 +159,11 @@ const runDecisionMachine = async (input, handle) => {
   req.logger.info(() => ({
     msg: "Frictionless decision",
     data: {
-      requestId: req.requestId,
       decision: "default_pow",
       captchaType: types.CaptchaType.pow
     }
   }));
+  metrics.recordFrictionlessDecision("default_pow");
   honeypotResponse.attachHoneypot(res, clientRecord);
   return res.json(
     await tasks.frictionlessManager.sendPowCaptcha({
@@ -194,11 +195,11 @@ const runUserAgentMismatchCheck = async (input, handle) => {
   req.logger.info(() => ({
     msg: "Frictionless decision",
     data: {
-      requestId: req.requestId,
       decision: "user_agent_mismatch",
       captchaType: types.CaptchaType.image
     }
   }));
+  metrics.recordFrictionlessDecision("user_agent_mismatch");
   honeypotResponse.attachHoneypot(res, input.clientRecord);
   return res.json(
     await input.tasks.frictionlessManager.sendImageCaptcha({
@@ -254,13 +255,13 @@ const runContextAwareValidation = async (input, handle) => {
   req.logger.info(() => ({
     msg: "Frictionless decision",
     data: {
-      requestId: req.requestId,
       decision: "context_aware_failed",
       captchaType: types.CaptchaType.image,
       sim,
       threshold
     }
   }));
+  metrics.recordFrictionlessDecision("context_aware_failed");
   honeypotResponse.attachHoneypot(res, clientRecord);
   return res.json(
     await tasks.frictionlessManager.sendImageCaptcha({

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -1,6 +1,7 @@
 "use strict";
 const common = require("@prosopo/common");
 const types = require("@prosopo/types");
+const userAccessPolicy = require("@prosopo/user-access-policy");
 const util = require("@prosopo/util");
 const compositeIpAddress = require("../../../compositeIpAddress.cjs");
 require("../../../tasks/index.cjs");
@@ -10,6 +11,7 @@ const normalizeRequestIp = require("../../../utils/normalizeRequestIp.cjs");
 const apiToggleMaintenanceModeEndpoint = require("../../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const blacklistRequestInspector = require("../../blacklistRequestInspector.cjs");
 const dnsEventUrl = require("../../dnsEventUrl.cjs");
+const metrics = require("../../metrics.cjs");
 const testSiteKey = require("../../testSiteKey.cjs");
 const maintenanceModeResponses = require("../maintenanceModeResponses.cjs");
 const accessPolicy = require("./accessPolicy.cjs");
@@ -26,7 +28,6 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
       req.logger.info(() => ({
         msg: "Frictionless response finished",
         data: {
-          requestId: req.requestId,
           status: res.statusCode,
           path: req.path,
           method: req.method
@@ -39,7 +40,6 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
     req.logger.info(() => ({
       msg: "Frictionless handler entry",
       data: {
-        requestId: req.requestId,
         token,
         user,
         dapp,
@@ -104,30 +104,68 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
       );
     }
     if (dedup) {
-      req.logger.info(() => ({
-        msg: "Reusing existing session for user-IP-sitekey combination",
-        data: {
-          userSitekeyIpHash,
-          sessionId: dedup.sessionId,
-          captchaType: dedup.captchaType
-        }
-      }));
-      req.logger.info(() => ({
-        msg: "Frictionless decision",
-        data: {
-          requestId: req.requestId,
-          decision: "reuse_session",
-          captchaType: dedup.captchaType,
-          sessionId: dedup.sessionId
-        }
-      }));
-      honeypotResponse.attachHoneypot(res, clientRecord);
-      return res.json({
-        [types.ApiParams.captchaType]: dedup.captchaType,
-        [types.ApiParams.sessionId]: dedup.sessionId,
-        [types.ApiParams.status]: "ok",
-        dns_url: dnsEventUrl.buildDnsEventUrl(dedup.sessionId)
-      });
+      const dedupCountryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+      const dedupAsn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+      const dedupUserScope = blacklistRequestInspector.getRequestUserScope(
+        util.flatten(req.headers),
+        req.ja4,
+        normalizedIp,
+        user,
+        void 0,
+        void 0,
+        dedupCountryCode,
+        dedupAsn
+      );
+      const dedupAccessPolicy = (await tasks$1.frictionlessManager.getPrioritisedAccessPolicies(
+        userAccessRulesStorage,
+        dapp,
+        dedupUserScope
+      ))[0];
+      const dedupConflictsWithPolicy = dedupAccessPolicy !== void 0 && (dedupAccessPolicy.type === userAccessPolicy.AccessPolicyType.Block || dedupAccessPolicy.captchaType !== void 0 && dedupAccessPolicy.captchaType !== dedup.captchaType);
+      if (dedupConflictsWithPolicy) {
+        req.logger.info(() => ({
+          msg: "Evicting reused session: cached captchaType conflicts with access policy",
+          data: {
+            userSitekeyIpHash,
+            sessionId: dedup.sessionId,
+            cachedCaptchaType: dedup.captchaType,
+            policyType: dedupAccessPolicy.type,
+            policyCaptchaType: dedupAccessPolicy.captchaType
+          }
+        }));
+        await tasks$1.db.checkAndRemoveSession(dedup.sessionId);
+        await Promise.all([
+          tasks$1.writeQueue?.invalidateCachedSession(dedup.sessionId) ?? Promise.resolve(),
+          tasks$1.writeQueue?.invalidateCachedSessionByHash(
+            userSitekeyIpHash
+          ) ?? Promise.resolve()
+        ]);
+      } else {
+        req.logger.info(() => ({
+          msg: "Reusing existing session for user-IP-sitekey combination",
+          data: {
+            userSitekeyIpHash,
+            sessionId: dedup.sessionId,
+            captchaType: dedup.captchaType
+          }
+        }));
+        req.logger.info(() => ({
+          msg: "Frictionless decision",
+          data: {
+            decision: "reuse_session",
+            captchaType: dedup.captchaType,
+            sessionId: dedup.sessionId
+          }
+        }));
+        metrics.recordFrictionlessDecision("reuse_session");
+        honeypotResponse.attachHoneypot(res, clientRecord);
+        return res.json({
+          [types.ApiParams.captchaType]: dedup.captchaType,
+          [types.ApiParams.sessionId]: dedup.sessionId,
+          [types.ApiParams.status]: "ok",
+          dns_url: dnsEventUrl.buildDnsEventUrl(dedup.sessionId)
+        });
+      }
     }
     const ipAddress = compositeIpAddress.getCompositeIpAddress(normalizedIp);
     const flatHeaders = util.flatten(req.headers);
@@ -145,7 +183,6 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         flatHeaders,
         sessionMode,
         userSitekeyIpHash,
-        requestId: req.requestId,
         logger: req.logger
       },
       res
@@ -214,6 +251,10 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         })
       );
     }
+    metrics.recordBotScore(botScore);
+    if (triggeredDetectors && triggeredDetectors.length > 0) {
+      metrics.recordDetectorTriggered(triggeredDetectors);
+    }
     const botThreshold = clientRecord.settings?.frictionlessThreshold || constants.DEFAULT_FRICTIONLESS_THRESHOLD;
     let scoreComponents = {
       baseScore: baseBotScore,
@@ -265,12 +306,12 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         ...req.ja4 && { ja4: req.ja4 }
       }
     });
-    const userAccessPolicy = accessPolicies[0];
+    const userAccessPolicy$1 = accessPolicies[0];
     const accessPolicyOutcome = await accessPolicy.handleAccessPolicy(
       {
         tasks: tasks$1,
         clientRecord,
-        userAccessPolicy,
+        userAccessPolicy: userAccessPolicy$1,
         baseBotScore,
         botScore,
         scoreComponents,
@@ -278,7 +319,6 @@ const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (
         dapp,
         ipInfo: req.ipInfo,
         flatHeaders,
-        requestId: req.requestId,
         logger: req.logger,
         userScope
       },

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs

@@ -26,7 +26,6 @@ const runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
   input.logger.info(() => ({
     msg: "Frictionless decision",
     data: {
-      requestId: input.requestId,
       decision: "configured_captcha_type",
       captchaType: configuredType
     }

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -7,6 +7,7 @@ require("../../tasks/index.cjs");
 const normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const metrics = require("../metrics.cjs");
 const validateAddress = require("../validateAddress.cjs");
 const maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const tasks = require("../../tasks/tasks.cjs");
@@ -183,8 +184,10 @@ const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, re
         sessionId
       }
     }));
+    metrics.recordCaptchaIssued(types.CaptchaType.image);
     return res.json(captchaResponse);
   } catch (err) {
+    metrics.recordCaptchaIssueError(types.CaptchaType.image);
     req.logger.error(() => ({
       err,
       data: req.params,