@prosopo/provider 4.15.13 → 4.15.15

package/dist/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.js

@@ -1,305 +1,242 @@
-import { ProsopoApiError } from "@prosopo/common";
-import { FrictionlessReason, CaptchaType, ContextType } from "@prosopo/types";
-import { compareBinaryStrings } from "@prosopo/util";
-import { FrictionlessManager } from "../../../tasks/frictionless/frictionlessTasks.js";
+import { recordFrictionlessDecision } from "../../metrics.js";
+import { FrictionlessManager, FrictionlessReason as FrictionlessReason$1 } from "../../../tasks/frictionless/frictionlessTasks.js";
 import { timestampDecayFunction } from "../../../tasks/frictionless/frictionlessTasksUtils.js";
 import { hashUserAgent } from "../../../utils/hashUserAgent.js";
-import { recordFrictionlessDecision } from "../../metrics.js";
-import { determineContextType, getContextThreshold } from "../contextAwareValidation.js";
-import { getRoundsFromSimScore } from "./constants.js";
 import { attachHoneypot } from "./honeypotResponse.js";
-const runDecisionMachine = async (input, handle) => {
-  const {
-    tasks,
-    env,
-    clientRecord,
-    dapp,
-    userSitekeyIpHash,
-    flatHeaders,
-    ipInfo
-  } = input;
-  const { req, res } = handle;
-  let { botScore, scoreComponents } = input;
-  const userAgentMismatchResponse = await runUserAgentMismatchCheck(
-    input,
-    handle
-  );
-  if (userAgentMismatchResponse) return userAgentMismatchResponse;
-  const contextResponse = await runContextAwareValidation(input, handle);
-  if (contextResponse) return contextResponse;
-  const webViewTripped = clientRecord.settings.disallowWebView === true && input.webView === true;
-  if (webViewTripped) {
-    tasks.logger.info(() => ({ msg: "WebView detected" }));
-    const scoreUpdate = tasks.frictionlessManager.scoreIncreaseWebView(
-      input.baseBotScore,
-      botScore,
-      scoreComponents
-    );
-    botScore = scoreUpdate.score;
-    scoreComponents = scoreUpdate.scoreComponents;
-    tasks.frictionlessManager.updateScore(botScore, scoreComponents);
-  }
-  const timestampTripped = FrictionlessManager.timestampTooOld(input.timestamp);
-  if (timestampTripped) {
-    const scoreUpdate = tasks.frictionlessManager.scoreIncreaseTimestamp(
-      input.timestamp,
-      input.baseBotScore,
-      botScore,
-      scoreComponents
-    );
-    botScore = scoreUpdate.score;
-    scoreComponents = scoreUpdate.scoreComponents;
-    tasks.frictionlessManager.updateScore(botScore, scoreComponents);
-  }
-  const autoBanThreshold = clientRecord.settings.autoBanScoreThreshold;
-  if (autoBanThreshold !== void 0 && Number(botScore) >= autoBanThreshold) {
-    req.logger.info(() => ({
-      msg: "Frictionless decision",
-      data: {
-        decision: "auto_ban_score",
-        botScore,
-        autoBanThreshold,
-        token: input.token
-      }
-    }));
-    recordFrictionlessDecision("auto_ban_score");
-    await tasks.frictionlessManager.registerBlockedSession({
-      solvedImagesCount: clientRecord.settings.imageMaxRounds,
-      userSitekeyIpHash,
-      reason: FrictionlessReason.AUTO_BAN_SCORE,
-      siteKey: dapp,
-      ipInfo,
-      headers: flatHeaders
-    });
-    return res.status(401).json({ error: "Unauthorized" });
-  }
-  if (webViewTripped) {
-    req.logger.info(() => ({
-      msg: "Frictionless decision",
-      data: {
-        decision: "webview_detected",
-        captchaType: CaptchaType.image
-      }
-    }));
-    recordFrictionlessDecision("webview_detected");
-    attachHoneypot(res, clientRecord);
-    return res.json(
-      await tasks.frictionlessManager.sendImageCaptcha({
-        solvedImagesCount: Math.min(
-          env.config.captchas.solved.count * 2,
-          clientRecord.settings.imageMaxRounds
-        ),
-        userSitekeyIpHash,
-        reason: FrictionlessReason.WEBVIEW_DETECTED,
-        siteKey: dapp,
-        ipInfo,
-        headers: flatHeaders
-      })
-    );
-  }
-  if (timestampTripped) {
-    req.logger.info(() => ({
-      msg: "Frictionless decision",
-      data: {
-        decision: "timestamp_too_old",
-        captchaType: CaptchaType.image
-      }
-    }));
-    recordFrictionlessDecision("timestamp_too_old");
-    attachHoneypot(res, clientRecord);
-    return res.json(
-      await tasks.frictionlessManager.sendImageCaptcha({
-        solvedImagesCount: timestampDecayFunction(
-          input.timestamp,
-          input.decryptionFailed,
-          clientRecord.settings.imageMaxRounds
-        ),
-        userSitekeyIpHash,
-        reason: FrictionlessReason.OLD_TIMESTAMP,
-        siteKey: dapp,
-        ipInfo,
-        headers: flatHeaders
-      })
-    );
-  }
-  if (Number(botScore) > input.botThreshold) {
-    req.logger.info(() => ({
-      msg: "Bot score is greater than threshold",
-      data: {
-        botScore,
-        botThreshold: input.botThreshold,
-        token: input.token
-      }
-    }));
-    req.logger.info(() => ({
-      msg: "Frictionless decision",
-      data: {
-        decision: "bot_score_above_threshold",
-        captchaType: CaptchaType.image
-      }
-    }));
-    recordFrictionlessDecision("bot_score_above_threshold");
-    attachHoneypot(res, clientRecord);
-    return res.json(
-      await tasks.frictionlessManager.sendImageCaptcha({
-        solvedImagesCount: Math.min(
-          env.config.captchas.solved.count,
-          clientRecord.settings.imageMaxRounds
-        ),
-        userSitekeyIpHash,
-        reason: FrictionlessReason.BOT_SCORE_ABOVE_THRESHOLD,
-        siteKey: dapp,
-        ipInfo,
-        headers: flatHeaders
-      })
-    );
-  }
-  if (!input.currentUrl) {
-    req.logger.info(() => ({
-      msg: "Frictionless decision",
-      data: {
-        decision: "missing_current_url",
-        captchaType: CaptchaType.image,
-        token: input.token
-      }
-    }));
-    recordFrictionlessDecision("missing_current_url");
-    attachHoneypot(res, clientRecord);
-    return res.json(
-      await tasks.frictionlessManager.sendImageCaptcha({
-        solvedImagesCount: Math.min(
-          env.config.captchas.solved.count,
-          clientRecord.settings.imageMaxRounds
-        ),
-        userSitekeyIpHash,
-        reason: FrictionlessReason.MISSING_CURRENT_URL,
-        siteKey: dapp,
-        ipInfo,
-        headers: flatHeaders
-      })
-    );
-  }
-  req.logger.info(() => ({
-    msg: "Frictionless decision",
-    data: {
-      decision: "default_pow",
-      captchaType: CaptchaType.pow
-    }
-  }));
-  recordFrictionlessDecision("default_pow");
-  attachHoneypot(res, clientRecord);
-  return res.json(
-    await tasks.frictionlessManager.sendPowCaptcha({
-      userSitekeyIpHash,
-      siteKey: dapp,
-      ipInfo,
-      headers: flatHeaders
-    })
-  );
-};
-const runUserAgentMismatchCheck = async (input, handle) => {
-  const { req, res } = handle;
-  const headersUserAgent = req.headers["user-agent"];
-  const headersProsopoUser = req.headers["prosopo-user"];
-  const hashedHeadersUserAgent = headersUserAgent ? hashUserAgent(headersUserAgent) : "";
-  if (hashedHeadersUserAgent === input.userAgent && headersProsopoUser === input.userId) {
-    return null;
-  }
-  req.logger.info(() => ({
-    msg: "User agent or user id does not match",
-    data: {
-      headersUserAgent,
-      hashedHeadersUserAgent,
-      userAgent: input.userAgent,
-      headersProsopoUser,
-      userId: input.userId
-    }
-  }));
-  req.logger.info(() => ({
-    msg: "Frictionless decision",
-    data: {
-      decision: "user_agent_mismatch",
-      captchaType: CaptchaType.image
-    }
-  }));
-  recordFrictionlessDecision("user_agent_mismatch");
-  attachHoneypot(res, input.clientRecord);
-  return res.json(
-    await input.tasks.frictionlessManager.sendImageCaptcha({
-      solvedImagesCount: timestampDecayFunction(
-        input.timestamp,
-        input.decryptionFailed,
-        input.clientRecord.settings.imageMaxRounds
-      ),
-      userSitekeyIpHash: input.userSitekeyIpHash,
-      reason: FrictionlessReason.USER_AGENT_MISMATCH,
-      siteKey: input.dapp,
-      ipInfo: input.ipInfo,
-      headers: input.flatHeaders
-    })
-  );
+import { getRoundsFromSimScore } from "./constants.js";
+import { determineContextType, getContextThreshold } from "../contextAwareValidation.js";
+import { ProsopoApiError } from "@prosopo/common";
+import { CaptchaType, ContextType } from "@prosopo/types";
+import { compareBinaryStrings } from "@prosopo/util";
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/decisionMachine.ts
+var runDecisionMachine = async (input, handle) => {
+	const { tasks, env, clientRecord, dapp, userSitekeyIpHash, flatHeaders, ipInfo } = input;
+	const { req, res } = handle;
+	let { botScore, scoreComponents } = input;
+	const userAgentMismatchResponse = await runUserAgentMismatchCheck(input, handle);
+	if (userAgentMismatchResponse) return userAgentMismatchResponse;
+	const contextResponse = await runContextAwareValidation(input, handle);
+	if (contextResponse) return contextResponse;
+	const webViewTripped = clientRecord.settings.disallowWebView === true && input.webView === true;
+	if (webViewTripped) {
+		tasks.logger.info(() => ({ msg: "WebView detected" }));
+		const scoreUpdate = tasks.frictionlessManager.scoreIncreaseWebView(input.baseBotScore, botScore, scoreComponents);
+		botScore = scoreUpdate.score;
+		scoreComponents = scoreUpdate.scoreComponents;
+		tasks.frictionlessManager.updateScore(botScore, scoreComponents);
+	}
+	const timestampTripped = FrictionlessManager.timestampTooOld(input.timestamp);
+	if (timestampTripped) {
+		const scoreUpdate = tasks.frictionlessManager.scoreIncreaseTimestamp(input.timestamp, input.baseBotScore, botScore, scoreComponents);
+		botScore = scoreUpdate.score;
+		scoreComponents = scoreUpdate.scoreComponents;
+		tasks.frictionlessManager.updateScore(botScore, scoreComponents);
+	}
+	const autoBanThreshold = clientRecord.settings.autoBanScoreThreshold;
+	if (autoBanThreshold !== void 0 && Number(botScore) >= autoBanThreshold) {
+		req.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "auto_ban_score",
+				botScore,
+				autoBanThreshold,
+				token: input.token
+			}
+		}));
+		recordFrictionlessDecision("auto_ban_score");
+		await tasks.frictionlessManager.registerBlockedSession({
+			solvedImagesCount: clientRecord.settings.imageMaxRounds,
+			userSitekeyIpHash,
+			reason: FrictionlessReason$1.AUTO_BAN_SCORE,
+			siteKey: dapp,
+			ipInfo,
+			headers: flatHeaders
+		});
+		return res.status(401).json({ error: "Unauthorized" });
+	}
+	if (webViewTripped) {
+		req.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "webview_detected",
+				captchaType: CaptchaType.image
+			}
+		}));
+		recordFrictionlessDecision("webview_detected");
+		attachHoneypot(res, clientRecord);
+		return res.json(await tasks.frictionlessManager.sendImageCaptcha({
+			solvedImagesCount: Math.min(env.config.captchas.solved.count * 2, clientRecord.settings.imageMaxRounds),
+			userSitekeyIpHash,
+			reason: FrictionlessReason$1.WEBVIEW_DETECTED,
+			siteKey: dapp,
+			ipInfo,
+			headers: flatHeaders
+		}));
+	}
+	if (timestampTripped) {
+		req.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "timestamp_too_old",
+				captchaType: CaptchaType.image
+			}
+		}));
+		recordFrictionlessDecision("timestamp_too_old");
+		attachHoneypot(res, clientRecord);
+		return res.json(await tasks.frictionlessManager.sendImageCaptcha({
+			solvedImagesCount: timestampDecayFunction(input.timestamp, input.decryptionFailed, clientRecord.settings.imageMaxRounds),
+			userSitekeyIpHash,
+			reason: FrictionlessReason$1.OLD_TIMESTAMP,
+			siteKey: dapp,
+			ipInfo,
+			headers: flatHeaders
+		}));
+	}
+	if (Number(botScore) > input.botThreshold) {
+		req.logger.info(() => ({
+			msg: "Bot score is greater than threshold",
+			data: {
+				botScore,
+				botThreshold: input.botThreshold,
+				token: input.token
+			}
+		}));
+		req.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "bot_score_above_threshold",
+				captchaType: CaptchaType.image
+			}
+		}));
+		recordFrictionlessDecision("bot_score_above_threshold");
+		attachHoneypot(res, clientRecord);
+		return res.json(await tasks.frictionlessManager.sendImageCaptcha({
+			solvedImagesCount: Math.min(env.config.captchas.solved.count, clientRecord.settings.imageMaxRounds),
+			userSitekeyIpHash,
+			reason: FrictionlessReason$1.BOT_SCORE_ABOVE_THRESHOLD,
+			siteKey: dapp,
+			ipInfo,
+			headers: flatHeaders
+		}));
+	}
+	if (!input.currentUrl) {
+		req.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "missing_current_url",
+				captchaType: CaptchaType.image,
+				token: input.token
+			}
+		}));
+		recordFrictionlessDecision("missing_current_url");
+		attachHoneypot(res, clientRecord);
+		return res.json(await tasks.frictionlessManager.sendImageCaptcha({
+			solvedImagesCount: Math.min(env.config.captchas.solved.count, clientRecord.settings.imageMaxRounds),
+			userSitekeyIpHash,
+			reason: FrictionlessReason$1.MISSING_CURRENT_URL,
+			siteKey: dapp,
+			ipInfo,
+			headers: flatHeaders
+		}));
+	}
+	req.logger.info(() => ({
+		msg: "Frictionless decision",
+		data: {
+			decision: "default_pow",
+			captchaType: CaptchaType.pow
+		}
+	}));
+	recordFrictionlessDecision("default_pow");
+	attachHoneypot(res, clientRecord);
+	return res.json(await tasks.frictionlessManager.sendPowCaptcha({
+		userSitekeyIpHash,
+		siteKey: dapp,
+		ipInfo,
+		headers: flatHeaders
+	}));
 };
-const runContextAwareValidation = async (input, handle) => {
-  const { tasks, clientRecord, dapp, user } = input;
-  const { req, res, next } = handle;
-  if (!clientRecord.settings.contextAware?.enabled) return null;
-  const contexts = clientRecord.settings.contextAware?.contexts || {};
-  const hasDefault = contexts[ContextType.Default] !== void 0;
-  const hasWebview = contexts[ContextType.Webview] !== void 0;
-  let contextType;
-  if (hasDefault && hasWebview) {
-    contextType = determineContextType(input.webView);
-  } else if (hasDefault) {
-    contextType = ContextType.Default;
-  } else if (hasWebview) {
-    contextType = ContextType.Webview;
-  }
-  if (!contextType) return null;
-  const clientEntropy = await tasks.frictionlessManager.getClientContextEntropy(
-    clientRecord.account,
-    contextType
-  );
-  if (!clientEntropy) return null;
-  if (!input.decryptedHeadHash) {
-    tasks.logger.info(() => ({
-      msg: "No decryptedHeadHash in session for context aware client"
-    }));
-    return next(
-      new ProsopoApiError("API.BAD_REQUEST", {
-        context: { code: 400, siteKey: dapp, user },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  const threshold = getContextThreshold(clientRecord.settings, contextType);
-  const sim = compareBinaryStrings(input.decryptedHeadHash, clientEntropy);
-  if (sim >= threshold) return null;
-  req.logger.info(() => ({
-    msg: "Frictionless decision",
-    data: {
-      decision: "context_aware_failed",
-      captchaType: CaptchaType.image,
-      sim,
-      threshold
-    }
-  }));
-  recordFrictionlessDecision("context_aware_failed");
-  attachHoneypot(res, clientRecord);
-  return res.json(
-    await tasks.frictionlessManager.sendImageCaptcha({
-      solvedImagesCount: Math.min(
-        getRoundsFromSimScore(sim),
-        clientRecord.settings.imageMaxRounds
-      ),
-      userSitekeyIpHash: input.userSitekeyIpHash,
-      reason: FrictionlessReason.CONTEXT_AWARE_VALIDATION_FAILED,
-      siteKey: dapp,
-      ipInfo: input.ipInfo,
-      headers: input.flatHeaders
-    })
-  );
+var runUserAgentMismatchCheck = async (input, handle) => {
+	const { req, res } = handle;
+	const headersUserAgent = req.headers["user-agent"];
+	const headersProsopoUser = req.headers["prosopo-user"];
+	const hashedHeadersUserAgent = headersUserAgent ? hashUserAgent(headersUserAgent) : "";
+	if (hashedHeadersUserAgent === input.userAgent && headersProsopoUser === input.userId) return null;
+	req.logger.info(() => ({
+		msg: "User agent or user id does not match",
+		data: {
+			headersUserAgent,
+			hashedHeadersUserAgent,
+			userAgent: input.userAgent,
+			headersProsopoUser,
+			userId: input.userId
+		}
+	}));
+	req.logger.info(() => ({
+		msg: "Frictionless decision",
+		data: {
+			decision: "user_agent_mismatch",
+			captchaType: CaptchaType.image
+		}
+	}));
+	recordFrictionlessDecision("user_agent_mismatch");
+	attachHoneypot(res, input.clientRecord);
+	return res.json(await input.tasks.frictionlessManager.sendImageCaptcha({
+		solvedImagesCount: timestampDecayFunction(input.timestamp, input.decryptionFailed, input.clientRecord.settings.imageMaxRounds),
+		userSitekeyIpHash: input.userSitekeyIpHash,
+		reason: FrictionlessReason$1.USER_AGENT_MISMATCH,
+		siteKey: input.dapp,
+		ipInfo: input.ipInfo,
+		headers: input.flatHeaders
+	}));
 };
-export {
-  runDecisionMachine
+var runContextAwareValidation = async (input, handle) => {
+	const { tasks, clientRecord, dapp, user } = input;
+	const { req, res, next } = handle;
+	if (!clientRecord.settings.contextAware?.enabled) return null;
+	const contexts = clientRecord.settings.contextAware?.contexts || {};
+	const hasDefault = contexts[ContextType.Default] !== void 0;
+	const hasWebview = contexts[ContextType.Webview] !== void 0;
+	let contextType;
+	if (hasDefault && hasWebview) contextType = determineContextType(input.webView);
+	else if (hasDefault) contextType = ContextType.Default;
+	else if (hasWebview) contextType = ContextType.Webview;
+	if (!contextType) return null;
+	const clientEntropy = await tasks.frictionlessManager.getClientContextEntropy(clientRecord.account, contextType);
+	if (!clientEntropy) return null;
+	if (!input.decryptedHeadHash) {
+		tasks.logger.info(() => ({ msg: "No decryptedHeadHash in session for context aware client" }));
+		return next(new ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const threshold = getContextThreshold(clientRecord.settings, contextType);
+	const sim = compareBinaryStrings(input.decryptedHeadHash, clientEntropy);
+	if (sim >= threshold) return null;
+	req.logger.info(() => ({
+		msg: "Frictionless decision",
+		data: {
+			decision: "context_aware_failed",
+			captchaType: CaptchaType.image,
+			sim,
+			threshold
+		}
+	}));
+	recordFrictionlessDecision("context_aware_failed");
+	attachHoneypot(res, clientRecord);
+	return res.json(await tasks.frictionlessManager.sendImageCaptcha({
+		solvedImagesCount: Math.min(getRoundsFromSimScore(sim), clientRecord.settings.imageMaxRounds),
+		userSitekeyIpHash: input.userSitekeyIpHash,
+		reason: FrictionlessReason$1.CONTEXT_AWARE_VALIDATION_FAILED,
+		siteKey: dapp,
+		ipInfo: input.ipInfo,
+		headers: input.flatHeaders
+	}));
 };
+//#endregion
+export { runDecisionMachine };

package/dist/api/captcha/getFrictionlessCaptchaChallenge/decryptSimdReadings.js

@@ -1,14 +1,11 @@
-const decryptIncomingSimdReadings = async (manager, encrypted) => {
-  if (!encrypted) return void 0;
-  const decryptKeys = [
-    ...await manager.getDetectorKeys(),
-    process.env.BOT_DECRYPTION_KEY
-  ];
-  const decrypted = await manager.decryptSimdReadings(encrypted, decryptKeys);
-  if (!decrypted) return void 0;
-  const { timestamp: _ignored, ...readings } = decrypted;
-  return readings;
-};
-export {
-  decryptIncomingSimdReadings
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/decryptSimdReadings.ts
+var decryptIncomingSimdReadings = async (manager, encrypted) => {
+	if (!encrypted) return void 0;
+	const decryptKeys = [...await manager.getDetectorKeys(), process.env.BOT_DECRYPTION_KEY];
+	const decrypted = await manager.decryptSimdReadings(encrypted, decryptKeys);
+	if (!decrypted) return void 0;
+	const { timestamp: _ignored, ...readings } = decrypted;
+	return readings;
 };
+//#endregion
+export { decryptIncomingSimdReadings };