@prosopo/provider 4.12.0 → 4.13.1

package/dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs

@@ -7,6 +7,7 @@ require("../../tasks/index.cjs");
 const normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const metrics = require("../metrics.cjs");
 const validateAddress = require("../validateAddress.cjs");
 const maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const tasks = require("../../tasks/tasks.cjs");
@@ -175,8 +176,10 @@ const getPoWCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res,
         session: sessionId
       }
     }));
+    metrics.recordCaptchaIssued(types.CaptchaType.pow);
     return res.json(getPowCaptchaResponse);
   } catch (err) {
+    metrics.recordCaptchaIssueError(types.CaptchaType.pow);
     req.logger.error(() => ({
       err,
       body: req.body,

package/dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs

@@ -7,6 +7,7 @@ require("../../tasks/index.cjs");
 const normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const metrics = require("../metrics.cjs");
 const validateAddress = require("../validateAddress.cjs");
 const maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const tasks = require("../../tasks/tasks.cjs");
@@ -178,8 +179,10 @@ const getPuzzleCaptchaChallenge = (env, userAccessRulesStorage) => async (req, r
         session: sessionId
       }
     }));
+    metrics.recordCaptchaIssued(types.CaptchaType.puzzle);
     return res.json(getPuzzleCaptchaResponse);
   } catch (err) {
+    metrics.recordCaptchaIssueError(types.CaptchaType.puzzle);
     req.logger.error(() => ({
       err,
       body: req.body,

package/dist/cjs/api/captcha/submitPoWCaptchaSolution.cjs

@@ -1,4 +1,5 @@
 "use strict";
+Object.defineProperties(exports, { __esModule: { value: true }, [Symbol.toStringTag]: { value: "Module" } });
 const common = require("@prosopo/common");
 const types = require("@prosopo/types");
 const util = require("@prosopo/util");
@@ -177,9 +178,16 @@ const buildEscalation = async (tasks2, result, challenge) => {
     originSession.mode,
     originSession.simdReadings
   );
+  if (tasks2.writeQueue) {
+    await tasks2.writeQueue.cacheSessionEscalation(
+      powRecord.sessionId,
+      newSession.sessionId
+    );
+  }
   return {
     captchaType: routed.captchaType,
     sessionId: newSession.sessionId
   };
 };
-module.exports = submitPoWCaptchaSolution;
+exports.buildEscalation = buildEscalation;
+exports.default = submitPoWCaptchaSolution;

package/dist/cjs/api/captcha.cjs

@@ -12,6 +12,9 @@ const submitImageCaptchaSolution = require("./captcha/submitImageCaptchaSolution
 const submitPoWCaptchaSolution = require("./captcha/submitPoWCaptchaSolution.cjs");
 const submitPuzzleCaptchaSolution = require("./captcha/submitPuzzleCaptchaSolution.cjs");
 const handler = require("./captcha/getFrictionlessCaptchaChallenge/handler.cjs");
+const asyncHandler = (handler2) => (req, res, next) => {
+  Promise.resolve().then(() => handler2(req, res, next)).catch(next);
+};
 function prosopoRouter(env) {
   const router = express.Router();
   let userAccessRulesStorage;
@@ -26,41 +29,35 @@ function prosopoRouter(env) {
   }
   router.post(
     types.ClientApiPaths.GetImageCaptchaChallenge,
-    (req, res, next) => getImageCaptchaChallenge(env, userAccessRulesStorage)(req, res, next)
+    asyncHandler(getImageCaptchaChallenge(env, userAccessRulesStorage))
   );
   router.post(
     types.ClientApiPaths.SubmitImageCaptchaSolution,
-    (req, res, next) => submitImageCaptchaSolution(env)(req, res, next)
+    asyncHandler(submitImageCaptchaSolution(env))
   );
   router.post(
     types.ClientApiPaths.GetPowCaptchaChallenge,
-    (req, res, next) => getPoWCaptchaChallenge(env, userAccessRulesStorage)(req, res, next)
+    asyncHandler(getPoWCaptchaChallenge(env, userAccessRulesStorage))
   );
   router.post(
     types.ClientApiPaths.SubmitPowCaptchaSolution,
-    (req, res, next) => submitPoWCaptchaSolution(env)(req, res, next)
+    asyncHandler(submitPoWCaptchaSolution.default(env))
   );
   router.post(
     types.ClientApiPaths.GetFrictionlessCaptchaChallenge,
-    (req, res, next) => handler(env, userAccessRulesStorage)(
-      req,
-      res,
-      next
-    )
+    asyncHandler(handler(env, userAccessRulesStorage))
   );
   router.post(
     types.ClientApiPaths.GetPuzzleCaptchaChallenge,
-    (req, res, next) => getPuzzleCaptchaChallenge(env, userAccessRulesStorage)(req, res, next)
+    asyncHandler(getPuzzleCaptchaChallenge(env, userAccessRulesStorage))
   );
   router.post(
     types.ClientApiPaths.SubmitPuzzleCaptchaSolution,
-    (req, res, next) => submitPuzzleCaptchaSolution(env)(req, res, next)
-  );
-  router.post(
-    types.ClientApiPaths.CheckSpamEmail,
-    (req, res, next) => checkSpamEmail(env)(req, res, next)
+    asyncHandler(submitPuzzleCaptchaSolution(env))
   );
+  router.post(types.ClientApiPaths.CheckSpamEmail, asyncHandler(checkSpamEmail(env)));
   router.use(apiExpressRouter.handleErrors);
   return router;
 }
+exports.asyncHandler = asyncHandler;
 exports.prosopoRouter = prosopoRouter;

package/dist/cjs/api/domainMiddleware.cjs

@@ -7,6 +7,7 @@ const utilCrypto = require("@prosopo/util-crypto");
 const zod = require("zod");
 require("../tasks/index.cjs");
 const apiToggleMaintenanceModeEndpoint = require("./admin/apiToggleMaintenanceModeEndpoint.cjs");
+const metrics = require("./metrics.cjs");
 const testSiteKey = require("./testSiteKey.cjs");
 const tasks = require("../tasks/tasks.cjs");
 const domainMiddleware = (env) => {
@@ -37,6 +38,7 @@ const domainMiddleware = (env) => {
         throw invalidSiteKeyError(req.i18n, siteKey, req.logger);
       }
       if (testSiteKey.isReservedTestSiteKey(siteKey)) {
+        metrics.recordDomainValidation("test_key");
         next();
         return;
       }
@@ -58,6 +60,7 @@ const domainMiddleware = (env) => {
       for (const candidate of candidateOrigins) {
         for (const domain of allowedDomains) {
           if (tasks$1.clientTaskManager.domainPatternMatcher(candidate, domain)) {
+            metrics.recordDomainValidation("allowed");
             next();
             return;
           }
@@ -65,6 +68,7 @@ const domainMiddleware = (env) => {
       }
       throw unauthorizedOriginError(req.i18n, origin, req.logger);
     } catch (err) {
+      metrics.recordDomainValidation("rejected");
       if (err instanceof common.ProsopoApiError || err instanceof zod.ZodError || err instanceof SyntaxError) {
         apiExpressRouter.handleErrors(err, req, res, next);
       } else {

package/dist/cjs/api/forwardVerify.cjs

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const api = require("@prosopo/api");
+const loadBalancer = require("@prosopo/load-balancer");
+function normalizeProviderUrl(url) {
+  try {
+    const parsed = new URL(url);
+    parsed.hostname = parsed.hostname.replace(/^(ipv4|ipv6)\./, "");
+    return parsed.toString().replace(/\/$/, "");
+  } catch {
+    return url.replace(/\/$/, "");
+  }
+}
+async function forwardVerifyIfNotIssuer(args) {
+  const { env, logger, path, providerUrl, dapp, user, body, alreadyForwarded } = args;
+  if (alreadyForwarded) {
+    return null;
+  }
+  if (!providerUrl) {
+    return null;
+  }
+  let providers;
+  try {
+    providers = await loadBalancer.getProviders(env.defaultEnvironment);
+  } catch (error) {
+    logger.warn(() => ({
+      msg: "Failed to load provider list; verifying locally",
+      err: error instanceof Error ? error : new Error(String(error)),
+      data: { providerUrl }
+    }));
+    return null;
+  }
+  const normalizedProviderUrl = normalizeProviderUrl(providerUrl);
+  const issuer = providers.find(
+    (provider) => normalizeProviderUrl(provider.url) === normalizedProviderUrl
+  );
+  if (!issuer) {
+    logger.warn(() => ({
+      msg: "Token providerUrl is not a known provider; verifying locally",
+      data: { providerUrl }
+    }));
+    return null;
+  }
+  if (env.pair?.address && issuer.address === env.pair.address) {
+    return null;
+  }
+  logger.info(() => ({
+    msg: "Forwarding verify request to issuing provider",
+    data: { providerUrl, path, dapp }
+  }));
+  const providerApi = new api.ProviderApi(issuer.url, dapp);
+  return providerApi.forwardVerify(path, body, user);
+}
+exports.forwardVerifyIfNotIssuer = forwardVerifyIfNotIssuer;

package/dist/cjs/api/headerCheckMiddleware.cjs

@@ -19,10 +19,13 @@ const headerCheckMiddleware = (env) => {
       validateAddress.validateAddr(user, void 0, req.logger);
       req.user = user;
       req.siteKey = siteKey;
-      req.logger = req.logger.with({
-        user,
-        siteKey
-      });
+      req.logger = req.logger.with(
+        {
+          user,
+          siteKey
+        },
+        "header-check"
+      );
       next();
     } catch (err) {
       return apiExpressRouter.handleErrors(err, req, res, next);

package/dist/cjs/api/ja4.cjs

@@ -0,0 +1,203 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const node_crypto = require("node:crypto");
+const RECORD_HEADER_LENGTH = 5;
+const HANDSHAKE_HEADER_LENGTH = 4;
+const HANDSHAKE_RECORD_TYPE = 22;
+const HANDSHAKE_MESSAGE_TYPE = 1;
+const EXT_SERVER_NAME = 0;
+const EXT_SIGNATURE_ALGORITHMS = 13;
+const EXT_ALPN = 16;
+const EXT_SUPPORTED_VERSIONS = 43;
+function isGrease(id) {
+  return (id & 3855) === 2570 && id >> 8 === (id & 255);
+}
+function hash12(input) {
+  return node_crypto.createHash("sha256").update(input).digest("hex").slice(0, 12);
+}
+function formatIdList(ids) {
+  return ids.map((id) => id.toString(16).padStart(4, "0")).join(",");
+}
+function alpnChar(b) {
+  if (b >= 48 && b <= 57 || // 0-9
+  b >= 65 && b <= 90 || // A-Z
+  b >= 97 && b <= 122) {
+    return String.fromCharCode(b);
+  }
+  return b.toString(16).padStart(2, "0");
+}
+function alpnFirstLast(protocol) {
+  const first = protocol.length > 0 ? alpnChar(protocol.readUInt8(0)) : "0";
+  const last = protocol.length > 1 ? alpnChar(protocol.readUInt8(protocol.length - 1)) : "0";
+  return [first, last];
+}
+function tlsVersionStr(version) {
+  switch (version) {
+    case 769:
+      return "10";
+    case 770:
+      return "11";
+    case 771:
+      return "12";
+    case 772:
+      return "13";
+    default:
+      return "00";
+  }
+}
+class Ja4ParseError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "Ja4ParseError";
+  }
+}
+function calculateJa4(data) {
+  let offset = 0;
+  if (data.length < RECORD_HEADER_LENGTH + HANDSHAKE_HEADER_LENGTH) {
+    throw new Ja4ParseError("ClientHello too short");
+  }
+  const recordType = data.readUInt8(offset);
+  offset += 1;
+  if (recordType !== HANDSHAKE_RECORD_TYPE) {
+    throw new Ja4ParseError(
+      `Invalid record type: 0x${recordType.toString(16)}`
+    );
+  }
+  offset += 2;
+  const recordLen = data.readUInt16BE(offset);
+  offset += 2;
+  if (data.length < RECORD_HEADER_LENGTH + recordLen) {
+    throw new Ja4ParseError("Record length exceeds buffer");
+  }
+  data = data.subarray(0, RECORD_HEADER_LENGTH + recordLen);
+  if (data.length < RECORD_HEADER_LENGTH + HANDSHAKE_HEADER_LENGTH) {
+    throw new Ja4ParseError("Record too short for handshake header");
+  }
+  const msgType = data.readUInt8(offset);
+  offset += 1;
+  if (msgType !== HANDSHAKE_MESSAGE_TYPE) {
+    throw new Ja4ParseError(
+      `Not a ClientHello: handshake type 0x${msgType.toString(16)}`
+    );
+  }
+  const msgLen = data.readUIntBE(offset, 3);
+  offset += 3;
+  if (data.length - offset < msgLen) {
+    throw new Ja4ParseError("Handshake message length exceeds record");
+  }
+  data = data.subarray(0, offset + msgLen);
+  if (data.length - offset < 35) {
+    throw new Ja4ParseError("ClientHello body too short");
+  }
+  let clientVersion = data.readUInt16BE(offset);
+  offset += 2;
+  offset += 32;
+  const sessionIdLen = data.readUInt8(offset);
+  offset += 1;
+  if (data.length - offset < sessionIdLen) {
+    throw new Ja4ParseError("Truncated at session ID");
+  }
+  offset += sessionIdLen;
+  if (data.length - offset < 2) {
+    throw new Ja4ParseError("Truncated at cipher suites length");
+  }
+  const cipherSuitesLen = data.readUInt16BE(offset);
+  offset += 2;
+  if (data.length - offset < cipherSuitesLen) {
+    throw new Ja4ParseError("Truncated at cipher suites");
+  }
+  if (cipherSuitesLen % 2 !== 0) {
+    throw new Ja4ParseError("Cipher suites length is not a multiple of 2");
+  }
+  const cipherSuites = [];
+  for (let i = 0; i < cipherSuitesLen; i += 2) {
+    cipherSuites.push(data.readUInt16BE(offset + i));
+  }
+  offset += cipherSuitesLen;
+  if (data.length - offset < 1) {
+    throw new Ja4ParseError("Truncated at compression methods");
+  }
+  const compressionLen = data.readUInt8(offset);
+  offset += 1;
+  if (data.length - offset < compressionLen) {
+    throw new Ja4ParseError("Truncated at compression methods data");
+  }
+  offset += compressionLen;
+  if (data.length - offset < 2) {
+    throw new Ja4ParseError("Truncated at extensions length");
+  }
+  const extensionsLen = data.readUInt16BE(offset);
+  offset += 2;
+  if (data.length - offset < extensionsLen) {
+    throw new Ja4ParseError("Truncated at extensions");
+  }
+  const extIds = [];
+  const sigAlgorithms = [];
+  const alpnProtocols = [];
+  let extOffset = offset;
+  const extEnd = offset + extensionsLen;
+  while (extOffset + 4 <= extEnd) {
+    const extId = data.readUInt16BE(extOffset);
+    extOffset += 2;
+    const extLen = data.readUInt16BE(extOffset);
+    extOffset += 2;
+    if (extOffset + extLen > extEnd) break;
+    const extData = data.subarray(extOffset, extOffset + extLen);
+    extOffset += extLen;
+    extIds.push(extId);
+    if (extId === EXT_SUPPORTED_VERSIONS) {
+      if (extData.length >= 1) {
+        const listLen = extData.readUInt8(0);
+        let best = 0;
+        for (let i = 1; i + 1 < extData.length && i + 1 <= listLen; i += 2) {
+          const v = extData.readUInt16BE(i);
+          if (!isGrease(v) && v > best) best = v;
+        }
+        if (best > 0) clientVersion = best;
+      }
+    } else if (extId === EXT_SIGNATURE_ALGORITHMS) {
+      if (extData.length >= 2) {
+        const algLen = extData.readUInt16BE(0);
+        for (let i = 2; i + 1 < extData.length && i + 1 < algLen + 2; i += 2) {
+          const alg = extData.readUInt16BE(i);
+          if (!isGrease(alg)) sigAlgorithms.push(alg);
+        }
+      }
+    } else if (extId === EXT_ALPN) {
+      if (extData.length >= 2) {
+        const listLen = extData.readUInt16BE(0);
+        const listEnd = Math.min(extData.length, 2 + listLen);
+        let alpnOff = 2;
+        while (alpnOff < listEnd) {
+          const protoLen = extData.readUInt8(alpnOff);
+          alpnOff += 1;
+          if (alpnOff + protoLen > listEnd) break;
+          alpnProtocols.push(extData.subarray(alpnOff, alpnOff + protoLen));
+          alpnOff += protoLen;
+        }
+      }
+    }
+  }
+  const versionStr = tlsVersionStr(clientVersion);
+  const sni = extIds.includes(EXT_SERVER_NAME) ? "d" : "i";
+  const firstAlpn = alpnProtocols[0];
+  const [alpnFirst, alpnLast] = firstAlpn ? alpnFirstLast(firstAlpn) : ["0", "0"];
+  const nonGreaseCiphers = cipherSuites.filter((c) => !isGrease(c));
+  const nonGreaseExts = extIds.filter((e) => !isGrease(e));
+  const cipherCount = Math.min(99, nonGreaseCiphers.length).toString().padStart(2, "0");
+  const extCount = Math.min(99, nonGreaseExts.length).toString().padStart(2, "0");
+  const firstChunk = `t${versionStr}${sni}${cipherCount}${extCount}${alpnFirst}${alpnLast}`;
+  const sortedCiphers = [...nonGreaseCiphers].sort((a, b) => a - b);
+  const cipherHash = hash12(formatIdList(sortedCiphers));
+  const filteredExts = nonGreaseExts.filter(
+    (e) => e !== EXT_SERVER_NAME && e !== EXT_ALPN
+  );
+  const sortedExts = [...filteredExts].sort((a, b) => a - b);
+  const extStr = formatIdList(sortedExts);
+  const sigAlgStr = formatIdList(sigAlgorithms);
+  const extHashInput = sigAlgStr.length > 0 ? `${extStr}_${sigAlgStr}` : extStr;
+  const extHash = hash12(extHashInput);
+  return `${firstChunk}_${cipherHash}_${extHash}`;
+}
+exports.Ja4ParseError = Ja4ParseError;
+exports.calculateJa4 = calculateJa4;

package/dist/cjs/api/ja4Middleware.cjs

@@ -1,14 +1,12 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const node_stream = require("node:stream");
 const apiExpressRouter = require("@prosopo/api-express-router");
 const logger = require("@prosopo/logger");
 const utilCrypto = require("@prosopo/util-crypto");
-const readTlsClientHello = require("read-tls-client-hello");
-var _documentCurrentScript = typeof document !== "undefined" ? document.currentScript : null;
+const ja4 = require("./ja4.cjs");
 const DEFAULT_JA4 = "ja4";
 const getJA4 = async (headers, logger$1) => {
-  logger$1 = logger$1 || logger.getLogger("info", typeof document === "undefined" ? require("url").pathToFileURL(__filename).href : _documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === "SCRIPT" && _documentCurrentScript.src || new URL("api/ja4Middleware.cjs", document.baseURI).href);
+  logger$1 = logger$1 || logger.getLogger("info", "provider:ja4");
   if (process.env.NODE_ENV === "development") {
     return {
       ja4PlusFingerprint: `${DEFAULT_JA4}${utilCrypto.randomAsHex().slice(28, 32)}`
@@ -16,7 +14,6 @@ const getJA4 = async (headers, logger$1) => {
   }
   try {
     const xTlsClientHello = (headers["x-tls-clienthello"] || "").toString();
-    const xTlsVersion = (headers["x-tls-version"] || "").toString().toLowerCase();
     const clientHelloBuffer = Buffer.from(xTlsClientHello, "base64");
     logger$1.debug(() => ({
       msg: "ClientHello First Bytes:",
@@ -28,17 +25,7 @@ const getJA4 = async (headers, logger$1) => {
       }));
       return { ja4PlusFingerprint: DEFAULT_JA4 };
     }
-    logger$1.debug(() => ({
-      msg: "Headers TLS Version:",
-      data: { xTlsVersion }
-    }));
-    const readableStream = new node_stream.Readable({
-      read() {
-        this.push(clientHelloBuffer);
-      }
-    });
-    const clientHello = await readTlsClientHello.readTlsClientHello(readableStream);
-    const ja4PlusFingerprint = readTlsClientHello.calculateJa4FromHelloData(clientHello);
+    const ja4PlusFingerprint = ja4.calculateJa4(clientHelloBuffer);
     return { ja4PlusFingerprint };
   } catch (e) {
     logger$1.error(() => ({
@@ -52,11 +39,14 @@ const ja4Middleware = (env) => {
   return async (req, res, next) => {
     try {
       req.logger.debug(() => ({ data: { url: req.url } }));
-      const ja4 = await getJA4(req.headers, req.logger);
-      req.ja4 = ja4.ja4PlusFingerprint || "";
-      req.logger = req.logger.with({
-        ja4: req.ja4
-      });
+      const ja42 = await getJA4(req.headers, req.logger);
+      req.ja4 = ja42.ja4PlusFingerprint || "";
+      req.logger = req.logger.with(
+        {
+          ja4: req.ja4
+        },
+        "ja4"
+      );
       next();
     } catch (err) {
       return apiExpressRouter.handleErrors(err, req, res, next);