@prosopo/provider 4.15.13 → 4.15.15

package/dist/api/captcha/submitPoWCaptchaSolution.js

@@ -1,212 +1,142 @@
-import { ProsopoApiError } from "@prosopo/common";
-import { SubmitPowCaptchaSolutionBody, CaptchaType } from "@prosopo/types";
-import { flatten, getIPAddress } from "@prosopo/util";
+import { validateAddr, validateSiteKey } from "../validateAddress.js";
 import { Tasks } from "../../tasks/tasks.js";
-import { derivePlatform } from "../../utils/devicePlatform.js";
 import { getMaintenanceMode } from "../admin/apiToggleMaintenanceModeEndpoint.js";
+import { derivePlatform } from "../../utils/devicePlatform.js";
 import { resolveTestSiteKeyVerdict } from "../testSiteKey.js";
-import { validateSiteKey, validateAddr } from "../validateAddress.js";
-const submitPoWCaptchaSolution = (env) => async (req, res, next) => {
-  if (getMaintenanceMode()) {
-    req.logger.info(() => ({
-      msg: "Maintenance mode active - returning verified"
-    }));
-    const response = {
-      status: "ok",
-      verified: true
-    };
-    return res.json(response);
-  }
-  let parsed;
-  const tasks = new Tasks(env, req.logger);
-  try {
-    parsed = SubmitPowCaptchaSolutionBody.parse(req.body);
-  } catch (err) {
-    return next(
-      new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-        context: { code: 400, error: err, body: req.body },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  const {
-    challenge,
-    signature,
-    nonce,
-    dapp,
-    user,
-    behavioralData,
-    salt,
-    simdReadings,
-    clientMetaData,
-    fingerprintProof
-  } = parsed;
-  validateSiteKey(dapp);
-  validateAddr(user);
-  const testVerdict = resolveTestSiteKeyVerdict(dapp, req.logger);
-  if (testVerdict !== null) {
-    const response = {
-      status: "ok",
-      verified: testVerdict
-    };
-    return res.json(response);
-  }
-  try {
-    const clientRecord = await tasks.db.getClientRecord(dapp);
-    if (!clientRecord) {
-      return next(
-        new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-          context: { code: 400, siteKey: dapp },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const flatHeaders = flatten(req.headers);
-    const userAgent = req.headers["user-agent"] ?? "";
-    const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-    req.logger.info(() => ({
-      msg: fingerprintProof ? "fingerprintProof detected" : "no fingerprintProof on PoW submission",
-      data: {
-        fingerprintProofPresent: fingerprintProof !== void 0,
-        fingerprintProofBytes: fingerprintProof?.length ?? 0,
-        challenge
-      }
-    }));
-    tasks.powCaptchaManager.setPostPowContext({
-      ip: req.ip || "",
-      countryCode,
-      // `false` here is a placeholder — `runPostPowRouting` overrides
-      // isWebView with the value recorded on the originating session.
-      platform: derivePlatform(userAgent, false),
-      raw: {
-        headers: flatHeaders,
-        userAgent,
-        ...req.ja4 && { ja4: req.ja4 },
-        ...fingerprintProof && { fingerprintProof },
-        ...req.tcpToChelloUs !== void 0 && {
-          tcpToChelloUs: req.tcpToChelloUs
-        },
-        ...req.chelloToHandshakeUs !== void 0 && {
-          chelloToHandshakeUs: req.chelloToHandshakeUs
-        }
-      }
-    });
-    const persistedSolutionTimeout = clientRecord.settings.solutionTimeout;
-    const submitWindowMs = persistedSolutionTimeout ?? clientRecord.settings.verifiedTimeout;
-    const result = await tasks.powCaptchaManager.verifyPowCaptchaSolution(
-      challenge,
-      signature.provider.challenge,
-      nonce,
-      submitWindowMs,
-      signature.user.timestamp,
-      getIPAddress(req.ip || ""),
-      flatHeaders,
-      behavioralData,
-      salt,
-      simdReadings,
-      clientMetaData
-    );
-    if (result.routingOutput) {
-      req.logger.info(() => ({
-        msg: "post-PoW routing decision",
-        data: {
-          routedCaptchaType: result.routingOutput?.captchaType,
-          routingReason: result.routingOutput?.reason,
-          challenge
-        }
-      }));
-    }
-    const escalation = await buildEscalation(tasks, result, challenge, {
-      tcpToChelloUs: req.tcpToChelloUs,
-      chelloToHandshakeUs: req.chelloToHandshakeUs
-    });
-    const response = {
-      status: "ok",
-      // On escalation the user is not done — they still need to clear
-      // the follow-up image/puzzle challenge before we hand them a token.
-      verified: escalation ? false : result.verified,
-      ...escalation && { escalation }
-    };
-    return res.json(response);
-  } catch (err) {
-    req.logger.error(() => ({
-      err,
-      body: req.body,
-      msg: "Error in PoW captcha solution submission"
-    }));
-    return next(
-      new ProsopoApiError("API.BAD_REQUEST", {
-        context: {
-          code: 500,
-          siteKey: req.body.dapp,
-          error: err
-        },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-};
-const buildEscalation = async (tasks, result, challenge, handshakeTiming) => {
-  if (!result.verified || !result.routingOutput) return void 0;
-  const routedType = result.routingOutput.captchaType;
-  if (routedType !== CaptchaType.image && routedType !== CaptchaType.puzzle) {
-    return void 0;
-  }
-  const powRecord = await tasks.db.getPowCaptchaRecordByChallenge(challenge);
-  if (!powRecord?.sessionId) return void 0;
-  const originSession = await tasks.db.getSessionRecordBySessionId(
-    powRecord.sessionId
-  );
-  if (!originSession) return void 0;
-  const routed = result.routingOutput;
-  const selectionReason = routed.reason ?? originSession.reason;
-  const newSession = await tasks.frictionlessManager.createSession(
-    originSession.token,
-    originSession.score,
-    originSession.threshold,
-    originSession.scoreComponents,
-    originSession.ipAddress,
-    routed.captchaType,
-    originSession.siteKey ?? powRecord.dappAccount,
-    routed.captchaType === CaptchaType.image ? routed.solvedImagesCount ?? originSession.solvedImagesCount : void 0,
-    void 0,
-    originSession.userSitekeyIpHash,
-    originSession.webView,
-    originSession.iFrame,
-    originSession.decryptedHeadHash,
-    selectionReason,
-    void 0,
-    void 0,
-    originSession.ipInfo,
-    originSession.headers,
-    originSession.mode,
-    originSession.simdReadings,
-    originSession.entropyMathRandomFingerprint,
-    originSession.entropyCryptoFingerprint,
-    originSession.entropyWallClockOffsetMs,
-    originSession.entropyMathRandomFirst,
-    originSession.currentUrl,
-    handshakeTiming?.tcpToChelloUs,
-    handshakeTiming?.chelloToHandshakeUs,
-    true,
-    originSession.iframeUrl,
-    originSession.isProtect
-  );
-  if (tasks.writeQueue) {
-    await tasks.writeQueue.cacheSessionEscalation(
-      powRecord.sessionId,
-      newSession.sessionId
-    );
-  }
-  return {
-    captchaType: routed.captchaType,
-    sessionId: newSession.sessionId
-  };
+import { ProsopoApiError } from "@prosopo/common";
+import { CaptchaType, SubmitPowCaptchaSolutionBody } from "@prosopo/types";
+import { flatten, getIPAddress } from "@prosopo/util";
+//#region src/api/captcha/submitPoWCaptchaSolution.ts
+var submitPoWCaptchaSolution_default = (env) => async (req, res, next) => {
+	if (getMaintenanceMode()) {
+		req.logger.info(() => ({ msg: "Maintenance mode active - returning verified" }));
+		return res.json({
+			status: "ok",
+			verified: true
+		});
+	}
+	let parsed;
+	const tasks = new Tasks(env, req.logger);
+	try {
+		parsed = SubmitPowCaptchaSolutionBody.parse(req.body);
+	} catch (err) {
+		return next(new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err,
+				body: req.body
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const { challenge, signature, nonce, dapp, user, behavioralData, salt, simdReadings, clientMetaData, fingerprintProof } = parsed;
+	validateSiteKey(dapp);
+	validateAddr(user);
+	const testVerdict = resolveTestSiteKeyVerdict(dapp, req.logger);
+	if (testVerdict !== null) {
+		const response = {
+			status: "ok",
+			verified: testVerdict
+		};
+		return res.json(response);
+	}
+	try {
+		const clientRecord = await tasks.db.getClientRecord(dapp);
+		if (!clientRecord) return next(new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const flatHeaders = flatten(req.headers);
+		const userAgent = req.headers["user-agent"] ?? "";
+		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+		req.logger.info(() => ({
+			msg: fingerprintProof ? "fingerprintProof detected" : "no fingerprintProof on PoW submission",
+			data: {
+				fingerprintProofPresent: fingerprintProof !== void 0,
+				fingerprintProofBytes: fingerprintProof?.length ?? 0,
+				challenge
+			}
+		}));
+		tasks.powCaptchaManager.setPostPowContext({
+			ip: req.ip || "",
+			countryCode,
+			platform: derivePlatform(userAgent, false),
+			raw: {
+				headers: flatHeaders,
+				userAgent,
+				...req.ja4 && { ja4: req.ja4 },
+				...fingerprintProof && { fingerprintProof },
+				...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
+				...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs }
+			}
+		});
+		const submitWindowMs = clientRecord.settings.solutionTimeout ?? clientRecord.settings.verifiedTimeout;
+		const result = await tasks.powCaptchaManager.verifyPowCaptchaSolution(challenge, signature.provider.challenge, nonce, submitWindowMs, signature.user.timestamp, getIPAddress(req.ip || ""), flatHeaders, behavioralData, salt, simdReadings, clientMetaData);
+		if (result.routingOutput) req.logger.info(() => ({
+			msg: "post-PoW routing decision",
+			data: {
+				routedCaptchaType: result.routingOutput?.captchaType,
+				routingReason: result.routingOutput?.reason,
+				challenge
+			}
+		}));
+		const escalation = await buildEscalation(tasks, result, challenge, {
+			tcpToChelloUs: req.tcpToChelloUs,
+			chelloToHandshakeUs: req.chelloToHandshakeUs
+		});
+		const response = {
+			status: "ok",
+			verified: escalation ? false : result.verified,
+			...escalation && { escalation }
+		};
+		return res.json(response);
+	} catch (err) {
+		req.logger.error(() => ({
+			err,
+			body: req.body,
+			msg: "Error in PoW captcha solution submission"
+		}));
+		return next(new ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 500,
+				siteKey: req.body.dapp,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
 };
-export {
-  buildEscalation,
-  submitPoWCaptchaSolution as default
+/**
+* Translate the routing-machine output into an escalation by minting a fresh
+* session of the chosen captcha type, carrying forward the originating
+* session's risk profile (score, headers, IP, etc.). Returns undefined when
+* the router decided to keep the user on PoW (i.e. no escalation needed).
+*
+* Exported for unit testing only — the handler above is the production entry
+* point.
+*/
+var buildEscalation = async (tasks, result, challenge, handshakeTiming) => {
+	if (!result.verified || !result.routingOutput) return void 0;
+	const routedType = result.routingOutput.captchaType;
+	if (routedType !== CaptchaType.image && routedType !== CaptchaType.puzzle) return;
+	const powRecord = await tasks.db.getPowCaptchaRecordByChallenge(challenge);
+	if (!powRecord?.sessionId) return void 0;
+	const originSession = await tasks.db.getSessionRecordBySessionId(powRecord.sessionId);
+	if (!originSession) return void 0;
+	const routed = result.routingOutput;
+	const selectionReason = routed.reason ?? originSession.reason;
+	const newSession = await tasks.frictionlessManager.createSession(originSession.token, originSession.score, originSession.threshold, originSession.scoreComponents, originSession.ipAddress, routed.captchaType, originSession.siteKey ?? powRecord.dappAccount, routed.captchaType === CaptchaType.image ? routed.solvedImagesCount ?? originSession.solvedImagesCount : void 0, void 0, originSession.userSitekeyIpHash, originSession.webView, originSession.iFrame, originSession.decryptedHeadHash, selectionReason, void 0, void 0, originSession.ipInfo, originSession.headers, originSession.mode, originSession.simdReadings, originSession.entropyMathRandomFingerprint, originSession.entropyCryptoFingerprint, originSession.entropyWallClockOffsetMs, originSession.entropyMathRandomFirst, originSession.currentUrl, handshakeTiming?.tcpToChelloUs, handshakeTiming?.chelloToHandshakeUs, true, originSession.iframeUrl, originSession.isProtect);
+	if (tasks.writeQueue) await tasks.writeQueue.cacheSessionEscalation(powRecord.sessionId, newSession.sessionId);
+	return {
+		captchaType: routed.captchaType,
+		sessionId: newSession.sessionId
+	};
 };
+//#endregion
+export { buildEscalation, submitPoWCaptchaSolution_default as default };

package/dist/api/captcha/submitPuzzleCaptchaSolution.js

@@ -1,109 +1,77 @@
-import { ProsopoApiError } from "@prosopo/common";
-import { SubmitPuzzleCaptchaSolutionBody } from "@prosopo/types";
-import { getIPAddress, flatten } from "@prosopo/util";
+import { validateAddr, validateSiteKey } from "../validateAddress.js";
 import { Tasks } from "../../tasks/tasks.js";
 import { getMaintenanceMode } from "../admin/apiToggleMaintenanceModeEndpoint.js";
 import { resolveTestSiteKeyVerdict } from "../testSiteKey.js";
-import { validateSiteKey, validateAddr } from "../validateAddress.js";
-const submitPuzzleCaptchaSolution = (env) => async (req, res, next) => {
-  if (getMaintenanceMode()) {
-    req.logger.info(() => ({
-      msg: "Maintenance mode active - returning verified"
-    }));
-    const response = {
-      status: "ok",
-      verified: true
-    };
-    return res.json(response);
-  }
-  let parsed;
-  const tasks = new Tasks(env, req.logger);
-  try {
-    parsed = SubmitPuzzleCaptchaSolutionBody.parse(req.body);
-  } catch (err) {
-    return next(
-      new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-        context: { code: 400, error: err, body: req.body },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  const {
-    challenge,
-    signature,
-    finalX,
-    finalY,
-    puzzleEvents,
-    dapp,
-    user,
-    behavioralData,
-    salt,
-    simdReadings,
-    clientMetaData
-  } = parsed;
-  validateSiteKey(dapp);
-  validateAddr(user);
-  const testVerdict = resolveTestSiteKeyVerdict(dapp, req.logger);
-  if (testVerdict !== null) {
-    const response = {
-      status: "ok",
-      verified: testVerdict
-    };
-    return res.json(response);
-  }
-  try {
-    const clientRecord = await tasks.db.getClientRecord(dapp);
-    if (!clientRecord) {
-      return next(
-        new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-          context: { code: 400, siteKey: dapp },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const persistedSolutionTimeout = clientRecord.settings.solutionTimeout;
-    const submitWindowMs = persistedSolutionTimeout ?? clientRecord.settings.verifiedTimeout;
-    const verified = await tasks.puzzleCaptchaManager.verifyPuzzleCaptchaSolution(
-      challenge,
-      signature.provider.challenge,
-      finalX,
-      finalY,
-      puzzleEvents,
-      submitWindowMs,
-      signature.user.timestamp,
-      getIPAddress(req.ip || ""),
-      flatten(req.headers),
-      behavioralData,
-      salt,
-      simdReadings,
-      clientMetaData
-    );
-    const response = {
-      status: "ok",
-      verified
-    };
-    return res.json(response);
-  } catch (err) {
-    req.logger.error(() => ({
-      err,
-      body: req.body,
-      msg: "Error in puzzle captcha solution submission"
-    }));
-    return next(
-      new ProsopoApiError("API.BAD_REQUEST", {
-        context: {
-          code: 500,
-          siteKey: req.body.dapp,
-          error: err
-        },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-};
-export {
-  submitPuzzleCaptchaSolution as default
+import { ProsopoApiError } from "@prosopo/common";
+import { SubmitPuzzleCaptchaSolutionBody } from "@prosopo/types";
+import { flatten, getIPAddress } from "@prosopo/util";
+//#region src/api/captcha/submitPuzzleCaptchaSolution.ts
+var submitPuzzleCaptchaSolution_default = (env) => async (req, res, next) => {
+	if (getMaintenanceMode()) {
+		req.logger.info(() => ({ msg: "Maintenance mode active - returning verified" }));
+		return res.json({
+			status: "ok",
+			verified: true
+		});
+	}
+	let parsed;
+	const tasks = new Tasks(env, req.logger);
+	try {
+		parsed = SubmitPuzzleCaptchaSolutionBody.parse(req.body);
+	} catch (err) {
+		return next(new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err,
+				body: req.body
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const { challenge, signature, finalX, finalY, puzzleEvents, dapp, user, behavioralData, salt, simdReadings, clientMetaData } = parsed;
+	validateSiteKey(dapp);
+	validateAddr(user);
+	const testVerdict = resolveTestSiteKeyVerdict(dapp, req.logger);
+	if (testVerdict !== null) {
+		const response = {
+			status: "ok",
+			verified: testVerdict
+		};
+		return res.json(response);
+	}
+	try {
+		const clientRecord = await tasks.db.getClientRecord(dapp);
+		if (!clientRecord) return next(new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const submitWindowMs = clientRecord.settings.solutionTimeout ?? clientRecord.settings.verifiedTimeout;
+		const response = {
+			status: "ok",
+			verified: await tasks.puzzleCaptchaManager.verifyPuzzleCaptchaSolution(challenge, signature.provider.challenge, finalX, finalY, puzzleEvents, submitWindowMs, signature.user.timestamp, getIPAddress(req.ip || ""), flatten(req.headers), behavioralData, salt, simdReadings, clientMetaData)
+		};
+		return res.json(response);
+	} catch (err) {
+		req.logger.error(() => ({
+			err,
+			body: req.body,
+			msg: "Error in puzzle captcha solution submission"
+		}));
+		return next(new ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 500,
+				siteKey: req.body.dapp,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
 };
+//#endregion
+export { submitPuzzleCaptchaSolution_default as default };