@prosopo/provider 4.15.13 → 4.15.15

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -1,474 +1,350 @@
-"use strict";
-const common = require("@prosopo/common");
-const types = require("@prosopo/types");
-const userAccessPolicy = require("@prosopo/user-access-policy");
-const util = require("@prosopo/util");
-const compositeIpAddress = require("../../../compositeIpAddress.cjs");
-require("../../../tasks/index.cjs");
-const devicePlatform = require("../../../utils/devicePlatform.cjs");
-const hashUserAgent = require("../../../utils/hashUserAgent.cjs");
-const hashUserIp = require("../../../utils/hashUserIp.cjs");
-const normalizeRequestIp = require("../../../utils/normalizeRequestIp.cjs");
-const apiToggleMaintenanceModeEndpoint = require("../../admin/apiToggleMaintenanceModeEndpoint.cjs");
-const blacklistRequestInspector = require("../../blacklistRequestInspector.cjs");
-const dnsEventUrl = require("../../dnsEventUrl.cjs");
-const metrics = require("../../metrics.cjs");
-const testSiteKey = require("../../testSiteKey.cjs");
-const maintenanceModeResponses = require("../maintenanceModeResponses.cjs");
-const accessPolicy = require("./accessPolicy.cjs");
-const constants = require("./constants.cjs");
-const decisionMachine = require("./decisionMachine.cjs");
-const decryptSimdReadings = require("./decryptSimdReadings.cjs");
-const honeypotResponse = require("./honeypotResponse.cjs");
-const sessionDedup = require("./sessionDedup.cjs");
-const shortCircuit = require("./shortCircuit.cjs");
-const tasks = require("../../../tasks/tasks.cjs");
-const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
-  try {
-    res.on("finish", () => {
-      req.logger.info(() => ({
-        msg: "Frictionless response finished",
-        data: {
-          status: res.statusCode,
-          path: req.path,
-          method: req.method
-        }
-      }));
-    });
-    const {
-      token,
-      headHash,
-      dapp,
-      user,
-      mode,
-      simdReadings,
-      currentUrl: reportedCurrentUrl,
-      iframeUrl: reportedIframeUrl
-    } = types.GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
-    const currentUrl = util.sanitisePageUrl(reportedCurrentUrl);
-    const iframeUrl = util.sanitisePageUrl(reportedIframeUrl);
-    const isProtect = util.isProtectDeployment(currentUrl, iframeUrl);
-    const normalizedIp = normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
-    const sessionMode = mode === types.ModeEnum.invisible ? types.ModeEnum.invisible : void 0;
-    req.logger.info(() => ({
-      msg: "Frictionless handler entry",
-      data: {
-        token,
-        user,
-        dapp,
-        normalizedIp,
-        ja4: req.ja4,
-        path: req.path,
-        method: req.method,
-        ...sessionMode && { mode: sessionMode }
-      }
-    }));
-    if (apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
-      req.logger.info(() => ({
-        msg: "Maintenance mode active - returning dummy PoW captcha session",
-        data: { dapp, user }
-      }));
-      return res.json(
-        maintenanceModeResponses.buildFrictionlessMaintenanceResponse(
-          types.CaptchaType.pow,
-          env.config.host
-        )
-      );
-    }
-    if (testSiteKey.isReservedTestSiteKey(dapp)) {
-      req.logger.warn(() => ({
-        msg: "Reserved TEST site key - returning invisible PoW session",
-        data: { dapp, user }
-      }));
-      return res.json(
-        maintenanceModeResponses.buildFrictionlessMaintenanceResponse(
-          types.CaptchaType.pow,
-          env.config.host
-        )
-      );
-    }
-    const tasks$1 = new tasks.Tasks(env, req.logger);
-    const userSitekeyIpHash = hashUserIp.hashUserIp(user, normalizedIp, dapp);
-    const [decodedSimdReadings, { existingToken, dedup }, clientRecord] = await Promise.all([
-      decryptSimdReadings.decryptIncomingSimdReadings(tasks$1.frictionlessManager, simdReadings),
-      sessionDedup.resolveSessionDedup(tasks$1, token, userSitekeyIpHash, req.logger),
-      tasks$1.db.getClientRecord(dapp)
-    ]);
-    if (existingToken) {
-      req.logger.info(() => ({
-        token: existingToken,
-        msg: "Token has already been used"
-      }));
-      return next(
-        new common.ProsopoApiError("API.BAD_REQUEST", {
-          context: { code: 400, siteKey: dapp, user },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    if (!clientRecord) {
-      return next(
-        new common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-          context: { code: 400, siteKey: dapp },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    if (dedup) {
-      const dedupCountryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-      const dedupAsn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-      const dedupIsMobile = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.isMobile : void 0;
-      const dedupFlatHeaders = util.flatten(req.headers);
-      const dedupUserAgent = String(req.headers["user-agent"] ?? "");
-      const dedupUserScope = blacklistRequestInspector.getRequestUserScope(
-        dedupFlatHeaders,
-        req.ja4,
-        normalizedIp,
-        user,
-        void 0,
-        void 0,
-        dedupCountryCode,
-        dedupAsn
-      );
-      const dedupAccessPolicy = (await tasks$1.frictionlessManager.getPrioritisedAccessPolicies(
-        userAccessRulesStorage,
-        dapp,
-        dedupUserScope
-      )).find((p) => !p.deferToVerify);
-      const dedupConflictsWithPolicy = dedupAccessPolicy !== void 0 && (dedupAccessPolicy.type === userAccessPolicy.AccessPolicyType.Block || dedupAccessPolicy.captchaType !== void 0 && dedupAccessPolicy.captchaType !== dedup.captchaType);
-      const cachedCaptchaType = dedup.captchaType;
-      const dedupRouted = normalizedIp ? await tasks$1.frictionlessManager.applyRoutingMachine(
-        {
-          captchaType: cachedCaptchaType,
-          ...dedup.session.solvedImagesCount !== void 0 && {
-            solvedImagesCount: dedup.session.solvedImagesCount
-          },
-          ...dedup.session.powDifficulty !== void 0 && {
-            powDifficulty: dedup.session.powDifficulty
-          }
-        },
-        {
-          dappAccount: dapp,
-          userAccount: user,
-          ip: normalizedIp,
-          ...dedupCountryCode && { countryCode: dedupCountryCode },
-          score: dedup.session.score,
-          platform: devicePlatform.derivePlatform(
-            dedupUserAgent,
-            dedup.session.webView,
-            {
-              ...typeof dedupIsMobile === "boolean" && {
-                isMobile: dedupIsMobile
-              }
-            }
-          ),
-          raw: {
-            headers: dedupFlatHeaders,
-            userAgent: dedupUserAgent,
-            ...req.ja4 && { ja4: req.ja4 },
-            // Timing values are per-connection so they come from
-            // the current request even in the dedup replay path —
-            // dedup.session was created on a different TCP conn.
-            ...req.tcpToChelloUs !== void 0 && {
-              tcpToChelloUs: req.tcpToChelloUs
-            },
-            ...req.chelloToHandshakeUs !== void 0 && {
-              chelloToHandshakeUs: req.chelloToHandshakeUs
-            },
-            // currentUrl / iframeUrl use the cached session's
-            // values to match the rest of the dedup routing input
-            // (score, webView, captchaType are all pulled from
-            // dedup).
-            ...dedup.session.currentUrl && {
-              currentUrl: dedup.session.currentUrl
-            },
-            ...dedup.session.iframeUrl && {
-              iframeUrl: dedup.session.iframeUrl
-            }
-          }
-        }
-      ) : { captchaType: cachedCaptchaType };
-      const dedupConflictsWithRouting = dedupRouted.captchaType !== cachedCaptchaType;
-      if (dedupConflictsWithPolicy || dedupConflictsWithRouting) {
-        req.logger.info(() => ({
-          msg: "Evicting reused session: cached captchaType conflicts with access policy or routing machine",
-          data: {
-            userSitekeyIpHash,
-            sessionId: dedup.sessionId,
-            cachedCaptchaType: dedup.captchaType,
-            ...dedupConflictsWithPolicy && {
-              policyType: dedupAccessPolicy?.type,
-              policyCaptchaType: dedupAccessPolicy?.captchaType
-            },
-            ...dedupConflictsWithRouting && {
-              routedCaptchaType: dedupRouted.captchaType
-            }
-          }
-        }));
-        await tasks$1.db.checkAndRemoveSession(dedup.sessionId);
-        await Promise.all([
-          tasks$1.writeQueue?.invalidateCachedSession(dedup.sessionId) ?? Promise.resolve(),
-          tasks$1.writeQueue?.invalidateCachedSessionByHash(
-            userSitekeyIpHash
-          ) ?? Promise.resolve()
-        ]);
-      } else {
-        req.logger.info(() => ({
-          msg: "Reusing existing session for user-IP-sitekey combination",
-          data: {
-            userSitekeyIpHash,
-            sessionId: dedup.sessionId,
-            captchaType: dedup.captchaType
-          }
-        }));
-        req.logger.info(() => ({
-          msg: "Frictionless decision",
-          data: {
-            decision: "reuse_session",
-            captchaType: dedup.captchaType,
-            sessionId: dedup.sessionId
-          }
-        }));
-        metrics.recordFrictionlessDecision("reuse_session");
-        honeypotResponse.attachHoneypot(res, clientRecord);
-        return res.json({
-          [types.ApiParams.captchaType]: dedup.captchaType,
-          [types.ApiParams.sessionId]: dedup.sessionId,
-          [types.ApiParams.status]: "ok",
-          dns_url: dnsEventUrl.buildDnsEventUrl(dedup.sessionId)
-        });
-      }
-    }
-    const ipAddress = compositeIpAddress.getCompositeIpAddress(normalizedIp);
-    const flatHeaders = util.flatten(req.headers);
-    const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-    const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-    const shortCircuitResponse = await shortCircuit.runConfiguredCaptchaTypeShortCircuit(
-      {
-        tasks: tasks$1,
-        env,
-        clientRecord,
-        token,
-        dapp,
-        ipAddress,
-        ipInfo: req.ipInfo,
-        flatHeaders,
-        sessionMode,
-        userSitekeyIpHash,
-        logger: req.logger,
-        ...req.tcpToChelloUs !== void 0 && {
-          tcpToChelloUs: req.tcpToChelloUs
-        },
-        ...req.chelloToHandshakeUs !== void 0 && {
-          chelloToHandshakeUs: req.chelloToHandshakeUs
-        }
-      },
-      res
-    );
-    if (shortCircuitResponse) return shortCircuitResponse;
-    const lScore = tasks$1.frictionlessManager.checkLangRules(
-      req.headers["accept-language"] || ""
-    );
-    const userScope = blacklistRequestInspector.getRequestUserScope(
-      util.flatten(req.headers),
-      req.ja4,
-      normalizedIp,
-      user,
-      void 0,
-      void 0,
-      countryCode,
-      asn
-    );
-    const [decryptedPayload, validation, accessPolicies] = await Promise.all([
-      tasks$1.frictionlessManager.decryptPayload(token, headHash),
-      tasks$1.frictionlessManager.isValidRequest(
-        clientRecord,
-        types.CaptchaType.frictionless,
-        env
-      ),
-      tasks$1.frictionlessManager.getPrioritisedAccessPolicies(
-        userAccessRulesStorage,
-        dapp,
-        userScope
-      )
-    ]);
-    const {
-      baseBotScore: rawBaseBotScore,
-      timestamp: rawTimestamp,
-      userId: rawUserId,
-      userAgent: rawUserAgent,
-      webView,
-      iFrame,
-      decryptedHeadHash,
-      decryptionFailed: rawDecryptionFailed,
-      triggeredDetectors,
-      shadowDomPenalty,
-      entropyMathRandomFingerprint,
-      entropyCryptoFingerprint,
-      entropyWallClockOffsetMs,
-      entropyMathRandomFirst
-    } = decryptedPayload;
-    const detectorOverride = process.env.PROSOPO_TEST_FRICTIONLESS_DETECTOR_OVERRIDE === "1";
-    const baseBotScore = detectorOverride ? 0 : rawBaseBotScore;
-    const timestamp = detectorOverride ? Date.now() : rawTimestamp;
-    const userId = detectorOverride ? req.headers["prosopo-user"] : rawUserId;
-    const userAgent = detectorOverride ? hashUserAgent.hashUserAgent(req.headers["user-agent"] ?? "") : rawUserAgent;
-    const decryptionFailed = detectorOverride ? false : rawDecryptionFailed;
-    req.logger.debug(() => ({
-      msg: "Decrypted payload",
-      data: {
-        baseBotScore,
-        timestamp,
-        userId,
-        userAgent,
-        webView,
-        ...detectorOverride && { detectorOverride: true }
-      }
-    }));
-    let botScore = baseBotScore + lScore;
-    const { valid, reason } = validation;
-    if (!valid) {
-      return next(
-        new common.ProsopoApiError(reason || "API.BAD_REQUEST", {
-          context: { code: 400, siteKey: dapp, user },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    metrics.recordBotScore(botScore);
-    if (triggeredDetectors && triggeredDetectors.length > 0) {
-      metrics.recordDetectorTriggered(triggeredDetectors);
-    }
-    const botThreshold = clientRecord.settings?.frictionlessThreshold || constants.DEFAULT_FRICTIONLESS_THRESHOLD;
-    let scoreComponents = {
-      baseScore: baseBotScore,
-      ...lScore && { lScore },
-      ...triggeredDetectors && triggeredDetectors.length > 0 && { triggeredDetectors },
-      ...shadowDomPenalty !== void 0 && { shadowDomPenalty }
-    };
-    tasks$1.frictionlessManager.setSessionParams({
-      token,
-      score: botScore,
-      threshold: botThreshold,
-      scoreComponents,
-      ipAddress,
-      webView,
-      iFrame,
-      decryptedHeadHash,
-      siteKey: dapp,
-      ...currentUrl && { currentUrl },
-      ...iframeUrl && { iframeUrl },
-      ...isProtect && { isProtect: true },
-      ipInfo: req.ipInfo,
-      headers: flatHeaders,
-      mode: sessionMode,
-      ...decodedSimdReadings && { simdReadings: decodedSimdReadings },
-      ...entropyMathRandomFingerprint !== void 0 && {
-        entropyMathRandomFingerprint
-      },
-      ...entropyCryptoFingerprint !== void 0 && {
-        entropyCryptoFingerprint
-      },
-      ...entropyWallClockOffsetMs !== void 0 && {
-        entropyWallClockOffsetMs
-      },
-      ...entropyMathRandomFirst !== void 0 && {
-        entropyMathRandomFirst
-      },
-      ...req.tcpToChelloUs !== void 0 && {
-        tcpToChelloUs: req.tcpToChelloUs
-      },
-      ...req.chelloToHandshakeUs !== void 0 && {
-        chelloToHandshakeUs: req.chelloToHandshakeUs
-      }
-    });
-    const ipInfoMobile = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.isMobile : void 0;
-    const safeUserAgent = userAgent ?? "";
-    tasks$1.frictionlessManager.setRoutingContext({
-      dappAccount: dapp,
-      userAccount: user,
-      ip: normalizedIp,
-      countryCode,
-      score: botScore,
-      platform: devicePlatform.derivePlatform(safeUserAgent, webView, {
-        ...typeof ipInfoMobile === "boolean" && { isMobile: ipInfoMobile }
-      }),
-      raw: {
-        headers: flatHeaders,
-        userAgent: safeUserAgent,
-        ...req.ja4 && { ja4: req.ja4 },
-        ...req.tcpToChelloUs !== void 0 && {
-          tcpToChelloUs: req.tcpToChelloUs
-        },
-        ...req.chelloToHandshakeUs !== void 0 && {
-          chelloToHandshakeUs: req.chelloToHandshakeUs
-        },
-        ...currentUrl && { currentUrl },
-        ...iframeUrl && { iframeUrl }
-      }
-    });
-    const userAccessPolicy$1 = accessPolicies.find((p) => !p.deferToVerify);
-    const accessPolicyOutcome = await accessPolicy.handleAccessPolicy(
-      {
-        tasks: tasks$1,
-        clientRecord,
-        userAccessPolicy: userAccessPolicy$1,
-        baseBotScore,
-        botScore,
-        scoreComponents,
-        userSitekeyIpHash,
-        dapp,
-        ipInfo: req.ipInfo,
-        flatHeaders,
-        logger: req.logger,
-        userScope
-      },
-      res
-    );
-    if (accessPolicyOutcome.handled) return accessPolicyOutcome.response;
-    botScore = accessPolicyOutcome.botScore;
-    scoreComponents = accessPolicyOutcome.scoreComponents;
-    return await decisionMachine.runDecisionMachine(
-      {
-        tasks: tasks$1,
-        env,
-        clientRecord,
-        dapp,
-        user,
-        userSitekeyIpHash,
-        flatHeaders,
-        ipInfo: req.ipInfo,
-        timestamp,
-        decryptionFailed,
-        userAgent,
-        userId,
-        webView,
-        decryptedHeadHash,
-        baseBotScore,
-        botScore,
-        scoreComponents,
-        token,
-        botThreshold,
-        currentUrl,
-        iframeUrl
-      },
-      { req, res, next }
-    );
-  } catch (err) {
-    req.logger.error(() => ({
-      err,
-      msg: "Error in frictionless captcha challenge"
-    }));
-    return next(
-      new common.ProsopoApiError("API.BAD_REQUEST", {
-        context: { code: 400, error: err },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
+const require_dnsEventUrl = require("../../dnsEventUrl.cjs");
+const require_compositeIpAddress = require("../../../compositeIpAddress.cjs");
+const require_metrics = require("../../metrics.cjs");
+const require_blacklistRequestInspector = require("../../blacklistRequestInspector.cjs");
+const require_tasks = require("../../../tasks/tasks.cjs");
+const require_apiToggleMaintenanceModeEndpoint = require("../../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_devicePlatform = require("../../../utils/devicePlatform.cjs");
+const require_hashUserAgent = require("../../../utils/hashUserAgent.cjs");
+const require_hashUserIp = require("../../../utils/hashUserIp.cjs");
+const require_normalizeRequestIp = require("../../../utils/normalizeRequestIp.cjs");
+const require_testSiteKey = require("../../testSiteKey.cjs");
+const require_maintenanceModeResponses = require("../maintenanceModeResponses.cjs");
+const require_honeypotResponse = require("./honeypotResponse.cjs");
+const require_accessPolicy = require("./accessPolicy.cjs");
+require("./constants.cjs");
+const require_decisionMachine = require("./decisionMachine.cjs");
+const require_decryptSimdReadings = require("./decryptSimdReadings.cjs");
+const require_sessionDedup = require("./sessionDedup.cjs");
+const require_shortCircuit = require("./shortCircuit.cjs");
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/handler.ts
+var handler_default = (env, userAccessRulesStorage) => async (req, res, next) => {
+	try {
+		res.on("finish", () => {
+			req.logger.info(() => ({
+				msg: "Frictionless response finished",
+				data: {
+					status: res.statusCode,
+					path: req.path,
+					method: req.method
+				}
+			}));
+		});
+		const { token, headHash, dapp, user, mode, simdReadings, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl } = _prosopo_types.GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
+		const currentUrl = (0, _prosopo_util.sanitisePageUrl)(reportedCurrentUrl);
+		const iframeUrl = (0, _prosopo_util.sanitisePageUrl)(reportedIframeUrl);
+		const isProtect = (0, _prosopo_util.isProtectDeployment)(currentUrl, iframeUrl);
+		const normalizedIp = require_normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
+		const sessionMode = mode === _prosopo_types.ModeEnum.invisible ? _prosopo_types.ModeEnum.invisible : void 0;
+		req.logger.info(() => ({
+			msg: "Frictionless handler entry",
+			data: {
+				token,
+				user,
+				dapp,
+				normalizedIp,
+				ja4: req.ja4,
+				path: req.path,
+				method: req.method,
+				...sessionMode && { mode: sessionMode }
+			}
+		}));
+		if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+			req.logger.info(() => ({
+				msg: "Maintenance mode active - returning dummy PoW captcha session",
+				data: {
+					dapp,
+					user
+				}
+			}));
+			return res.json(require_maintenanceModeResponses.buildFrictionlessMaintenanceResponse(_prosopo_types.CaptchaType.pow, env.config.host));
+		}
+		if (require_testSiteKey.isReservedTestSiteKey(dapp)) {
+			req.logger.warn(() => ({
+				msg: "Reserved TEST site key - returning invisible PoW session",
+				data: {
+					dapp,
+					user
+				}
+			}));
+			return res.json(require_maintenanceModeResponses.buildFrictionlessMaintenanceResponse(_prosopo_types.CaptchaType.pow, env.config.host));
+		}
+		const tasks = new require_tasks.Tasks(env, req.logger);
+		const userSitekeyIpHash = require_hashUserIp.hashUserIp(user, normalizedIp, dapp);
+		const [decodedSimdReadings, { existingToken, dedup }, clientRecord] = await Promise.all([
+			require_decryptSimdReadings.decryptIncomingSimdReadings(tasks.frictionlessManager, simdReadings),
+			require_sessionDedup.resolveSessionDedup(tasks, token, userSitekeyIpHash, req.logger),
+			tasks.db.getClientRecord(dapp)
+		]);
+		if (existingToken) {
+			req.logger.info(() => ({
+				token: existingToken,
+				msg: "Token has already been used"
+			}));
+			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+				context: {
+					code: 400,
+					siteKey: dapp,
+					user
+				},
+				i18n: req.i18n,
+				logger: req.logger
+			}));
+		}
+		if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		if (dedup) {
+			const dedupCountryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+			const dedupAsn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+			const dedupIsMobile = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.isMobile : void 0;
+			const dedupFlatHeaders = (0, _prosopo_util.flatten)(req.headers);
+			const dedupUserAgent = String(req.headers["user-agent"] ?? "");
+			const dedupUserScope = require_blacklistRequestInspector.getRequestUserScope(dedupFlatHeaders, req.ja4, normalizedIp, user, void 0, void 0, dedupCountryCode, dedupAsn);
+			const dedupAccessPolicy = (await tasks.frictionlessManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, dedupUserScope)).find((p) => !p.deferToVerify);
+			const dedupConflictsWithPolicy = dedupAccessPolicy !== void 0 && (dedupAccessPolicy.type === _prosopo_user_access_policy.AccessPolicyType.Block || dedupAccessPolicy.captchaType !== void 0 && dedupAccessPolicy.captchaType !== dedup.captchaType);
+			const cachedCaptchaType = dedup.captchaType;
+			const dedupRouted = normalizedIp ? await tasks.frictionlessManager.applyRoutingMachine({
+				captchaType: cachedCaptchaType,
+				...dedup.session.solvedImagesCount !== void 0 && { solvedImagesCount: dedup.session.solvedImagesCount },
+				...dedup.session.powDifficulty !== void 0 && { powDifficulty: dedup.session.powDifficulty }
+			}, {
+				dappAccount: dapp,
+				userAccount: user,
+				ip: normalizedIp,
+				...dedupCountryCode && { countryCode: dedupCountryCode },
+				score: dedup.session.score,
+				platform: require_devicePlatform.derivePlatform(dedupUserAgent, dedup.session.webView, { ...typeof dedupIsMobile === "boolean" && { isMobile: dedupIsMobile } }),
+				raw: {
+					headers: dedupFlatHeaders,
+					userAgent: dedupUserAgent,
+					...req.ja4 && { ja4: req.ja4 },
+					...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
+					...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs },
+					...dedup.session.currentUrl && { currentUrl: dedup.session.currentUrl },
+					...dedup.session.iframeUrl && { iframeUrl: dedup.session.iframeUrl }
+				}
+			}) : { captchaType: cachedCaptchaType };
+			const dedupConflictsWithRouting = dedupRouted.captchaType !== cachedCaptchaType;
+			if (dedupConflictsWithPolicy || dedupConflictsWithRouting) {
+				req.logger.info(() => ({
+					msg: "Evicting reused session: cached captchaType conflicts with access policy or routing machine",
+					data: {
+						userSitekeyIpHash,
+						sessionId: dedup.sessionId,
+						cachedCaptchaType: dedup.captchaType,
+						...dedupConflictsWithPolicy && {
+							policyType: dedupAccessPolicy?.type,
+							policyCaptchaType: dedupAccessPolicy?.captchaType
+						},
+						...dedupConflictsWithRouting && { routedCaptchaType: dedupRouted.captchaType }
+					}
+				}));
+				await tasks.db.checkAndRemoveSession(dedup.sessionId);
+				await Promise.all([tasks.writeQueue?.invalidateCachedSession(dedup.sessionId) ?? Promise.resolve(), tasks.writeQueue?.invalidateCachedSessionByHash(userSitekeyIpHash) ?? Promise.resolve()]);
+			} else {
+				req.logger.info(() => ({
+					msg: "Reusing existing session for user-IP-sitekey combination",
+					data: {
+						userSitekeyIpHash,
+						sessionId: dedup.sessionId,
+						captchaType: dedup.captchaType
+					}
+				}));
+				req.logger.info(() => ({
+					msg: "Frictionless decision",
+					data: {
+						decision: "reuse_session",
+						captchaType: dedup.captchaType,
+						sessionId: dedup.sessionId
+					}
+				}));
+				require_metrics.recordFrictionlessDecision("reuse_session");
+				require_honeypotResponse.attachHoneypot(res, clientRecord);
+				return res.json({
+					[_prosopo_types.ApiParams.captchaType]: dedup.captchaType,
+					[_prosopo_types.ApiParams.sessionId]: dedup.sessionId,
+					[_prosopo_types.ApiParams.status]: "ok",
+					dns_url: require_dnsEventUrl.buildDnsEventUrl(dedup.sessionId)
+				});
+			}
+		}
+		const ipAddress = require_compositeIpAddress.getCompositeIpAddress(normalizedIp);
+		const flatHeaders = (0, _prosopo_util.flatten)(req.headers);
+		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+		const shortCircuitResponse = await require_shortCircuit.runConfiguredCaptchaTypeShortCircuit({
+			tasks,
+			env,
+			clientRecord,
+			token,
+			dapp,
+			ipAddress,
+			ipInfo: req.ipInfo,
+			flatHeaders,
+			sessionMode,
+			userSitekeyIpHash,
+			logger: req.logger,
+			...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
+			...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs }
+		}, res);
+		if (shortCircuitResponse) return shortCircuitResponse;
+		const lScore = tasks.frictionlessManager.checkLangRules(req.headers["accept-language"] || "");
+		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
+		const [decryptedPayload, validation, accessPolicies] = await Promise.all([
+			tasks.frictionlessManager.decryptPayload(token, headHash),
+			tasks.frictionlessManager.isValidRequest(clientRecord, _prosopo_types.CaptchaType.frictionless, env),
+			tasks.frictionlessManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)
+		]);
+		const { baseBotScore: rawBaseBotScore, timestamp: rawTimestamp, userId: rawUserId, userAgent: rawUserAgent, webView, iFrame, decryptedHeadHash, decryptionFailed: rawDecryptionFailed, triggeredDetectors, shadowDomPenalty, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst } = decryptedPayload;
+		const detectorOverride = process.env.PROSOPO_TEST_FRICTIONLESS_DETECTOR_OVERRIDE === "1";
+		const baseBotScore = detectorOverride ? 0 : rawBaseBotScore;
+		const timestamp = detectorOverride ? Date.now() : rawTimestamp;
+		const userId = detectorOverride ? req.headers["prosopo-user"] : rawUserId;
+		const userAgent = detectorOverride ? require_hashUserAgent.hashUserAgent(req.headers["user-agent"] ?? "") : rawUserAgent;
+		const decryptionFailed = detectorOverride ? false : rawDecryptionFailed;
+		req.logger.debug(() => ({
+			msg: "Decrypted payload",
+			data: {
+				baseBotScore,
+				timestamp,
+				userId,
+				userAgent,
+				webView,
+				...detectorOverride && { detectorOverride: true }
+			}
+		}));
+		let botScore = baseBotScore + lScore;
+		const { valid, reason } = validation;
+		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		require_metrics.recordBotScore(botScore);
+		if (triggeredDetectors && triggeredDetectors.length > 0) require_metrics.recordDetectorTriggered(triggeredDetectors);
+		const botThreshold = clientRecord.settings?.frictionlessThreshold || .5;
+		let scoreComponents = {
+			baseScore: baseBotScore,
+			...lScore && { lScore },
+			...triggeredDetectors && triggeredDetectors.length > 0 && { triggeredDetectors },
+			...shadowDomPenalty !== void 0 && { shadowDomPenalty }
+		};
+		tasks.frictionlessManager.setSessionParams({
+			token,
+			score: botScore,
+			threshold: botThreshold,
+			scoreComponents,
+			ipAddress,
+			webView,
+			iFrame,
+			decryptedHeadHash,
+			siteKey: dapp,
+			...currentUrl && { currentUrl },
+			...iframeUrl && { iframeUrl },
+			...isProtect && { isProtect: true },
+			ipInfo: req.ipInfo,
+			headers: flatHeaders,
+			mode: sessionMode,
+			...decodedSimdReadings && { simdReadings: decodedSimdReadings },
+			...entropyMathRandomFingerprint !== void 0 && { entropyMathRandomFingerprint },
+			...entropyCryptoFingerprint !== void 0 && { entropyCryptoFingerprint },
+			...entropyWallClockOffsetMs !== void 0 && { entropyWallClockOffsetMs },
+			...entropyMathRandomFirst !== void 0 && { entropyMathRandomFirst },
+			...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
+			...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs }
+		});
+		const ipInfoMobile = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.isMobile : void 0;
+		const safeUserAgent = userAgent ?? "";
+		tasks.frictionlessManager.setRoutingContext({
+			dappAccount: dapp,
+			userAccount: user,
+			ip: normalizedIp,
+			countryCode,
+			score: botScore,
+			platform: require_devicePlatform.derivePlatform(safeUserAgent, webView, { ...typeof ipInfoMobile === "boolean" && { isMobile: ipInfoMobile } }),
+			raw: {
+				headers: flatHeaders,
+				userAgent: safeUserAgent,
+				...req.ja4 && { ja4: req.ja4 },
+				...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
+				...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs },
+				...currentUrl && { currentUrl },
+				...iframeUrl && { iframeUrl }
+			}
+		});
+		const userAccessPolicy = accessPolicies.find((p) => !p.deferToVerify);
+		const accessPolicyOutcome = await require_accessPolicy.handleAccessPolicy({
+			tasks,
+			clientRecord,
+			userAccessPolicy,
+			baseBotScore,
+			botScore,
+			scoreComponents,
+			userSitekeyIpHash,
+			dapp,
+			ipInfo: req.ipInfo,
+			flatHeaders,
+			logger: req.logger,
+			userScope
+		}, res);
+		if (accessPolicyOutcome.handled) return accessPolicyOutcome.response;
+		botScore = accessPolicyOutcome.botScore;
+		scoreComponents = accessPolicyOutcome.scoreComponents;
+		return await require_decisionMachine.runDecisionMachine({
+			tasks,
+			env,
+			clientRecord,
+			dapp,
+			user,
+			userSitekeyIpHash,
+			flatHeaders,
+			ipInfo: req.ipInfo,
+			timestamp,
+			decryptionFailed,
+			userAgent,
+			userId,
+			webView,
+			decryptedHeadHash,
+			baseBotScore,
+			botScore,
+			scoreComponents,
+			token,
+			botThreshold,
+			currentUrl,
+			iframeUrl
+		}, {
+			req,
+			res,
+			next
+		});
+	} catch (err) {
+		req.logger.error(() => ({
+			err,
+			msg: "Error in frictionless captcha challenge"
+		}));
+		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
 };
-module.exports = getFrictionlessCaptchaChallenge;
+//#endregion
+exports.default = handler_default;