@prosopo/provider 4.15.13 → 4.15.15

package/dist/api/captcha/getFrictionlessCaptchaChallenge/handler.js

@@ -1,475 +1,349 @@
-import { ProsopoApiError } from "@prosopo/common";
-import { GetFrictionlessCaptchaChallengeRequestBody, ModeEnum, CaptchaType, ApiParams } from "@prosopo/types";
-import { AccessPolicyType } from "@prosopo/user-access-policy";
-import { sanitisePageUrl, isProtectDeployment, flatten } from "@prosopo/util";
+import { buildDnsEventUrl } from "../../dnsEventUrl.js";
 import { getCompositeIpAddress } from "../../../compositeIpAddress.js";
-import "../../../tasks/index.js";
+import { recordBotScore, recordDetectorTriggered, recordFrictionlessDecision } from "../../metrics.js";
+import { getRequestUserScope } from "../../blacklistRequestInspector.js";
+import { Tasks } from "../../../tasks/tasks.js";
+import { getMaintenanceMode } from "../../admin/apiToggleMaintenanceModeEndpoint.js";
 import { derivePlatform } from "../../../utils/devicePlatform.js";
 import { hashUserAgent } from "../../../utils/hashUserAgent.js";
 import { hashUserIp } from "../../../utils/hashUserIp.js";
 import { normalizeRequestIp } from "../../../utils/normalizeRequestIp.js";
-import { getMaintenanceMode } from "../../admin/apiToggleMaintenanceModeEndpoint.js";
-import { getRequestUserScope } from "../../blacklistRequestInspector.js";
-import { buildDnsEventUrl } from "../../dnsEventUrl.js";
-import { recordFrictionlessDecision, recordBotScore, recordDetectorTriggered } from "../../metrics.js";
 import { isReservedTestSiteKey } from "../../testSiteKey.js";
 import { buildFrictionlessMaintenanceResponse } from "../maintenanceModeResponses.js";
+import { attachHoneypot } from "./honeypotResponse.js";
 import { handleAccessPolicy } from "./accessPolicy.js";
-import { DEFAULT_FRICTIONLESS_THRESHOLD } from "./constants.js";
+import "./constants.js";
 import { runDecisionMachine } from "./decisionMachine.js";
 import { decryptIncomingSimdReadings } from "./decryptSimdReadings.js";
-import { attachHoneypot } from "./honeypotResponse.js";
 import { resolveSessionDedup } from "./sessionDedup.js";
 import { runConfiguredCaptchaTypeShortCircuit } from "./shortCircuit.js";
-import { Tasks } from "../../../tasks/tasks.js";
-const getFrictionlessCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
-  try {
-    res.on("finish", () => {
-      req.logger.info(() => ({
-        msg: "Frictionless response finished",
-        data: {
-          status: res.statusCode,
-          path: req.path,
-          method: req.method
-        }
-      }));
-    });
-    const {
-      token,
-      headHash,
-      dapp,
-      user,
-      mode,
-      simdReadings,
-      currentUrl: reportedCurrentUrl,
-      iframeUrl: reportedIframeUrl
-    } = GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
-    const currentUrl = sanitisePageUrl(reportedCurrentUrl);
-    const iframeUrl = sanitisePageUrl(reportedIframeUrl);
-    const isProtect = isProtectDeployment(currentUrl, iframeUrl);
-    const normalizedIp = normalizeRequestIp(req.ip, req.logger);
-    const sessionMode = mode === ModeEnum.invisible ? ModeEnum.invisible : void 0;
-    req.logger.info(() => ({
-      msg: "Frictionless handler entry",
-      data: {
-        token,
-        user,
-        dapp,
-        normalizedIp,
-        ja4: req.ja4,
-        path: req.path,
-        method: req.method,
-        ...sessionMode && { mode: sessionMode }
-      }
-    }));
-    if (getMaintenanceMode()) {
-      req.logger.info(() => ({
-        msg: "Maintenance mode active - returning dummy PoW captcha session",
-        data: { dapp, user }
-      }));
-      return res.json(
-        buildFrictionlessMaintenanceResponse(
-          CaptchaType.pow,
-          env.config.host
-        )
-      );
-    }
-    if (isReservedTestSiteKey(dapp)) {
-      req.logger.warn(() => ({
-        msg: "Reserved TEST site key - returning invisible PoW session",
-        data: { dapp, user }
-      }));
-      return res.json(
-        buildFrictionlessMaintenanceResponse(
-          CaptchaType.pow,
-          env.config.host
-        )
-      );
-    }
-    const tasks = new Tasks(env, req.logger);
-    const userSitekeyIpHash = hashUserIp(user, normalizedIp, dapp);
-    const [decodedSimdReadings, { existingToken, dedup }, clientRecord] = await Promise.all([
-      decryptIncomingSimdReadings(tasks.frictionlessManager, simdReadings),
-      resolveSessionDedup(tasks, token, userSitekeyIpHash, req.logger),
-      tasks.db.getClientRecord(dapp)
-    ]);
-    if (existingToken) {
-      req.logger.info(() => ({
-        token: existingToken,
-        msg: "Token has already been used"
-      }));
-      return next(
-        new ProsopoApiError("API.BAD_REQUEST", {
-          context: { code: 400, siteKey: dapp, user },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    if (!clientRecord) {
-      return next(
-        new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-          context: { code: 400, siteKey: dapp },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    if (dedup) {
-      const dedupCountryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-      const dedupAsn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-      const dedupIsMobile = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.isMobile : void 0;
-      const dedupFlatHeaders = flatten(req.headers);
-      const dedupUserAgent = String(req.headers["user-agent"] ?? "");
-      const dedupUserScope = getRequestUserScope(
-        dedupFlatHeaders,
-        req.ja4,
-        normalizedIp,
-        user,
-        void 0,
-        void 0,
-        dedupCountryCode,
-        dedupAsn
-      );
-      const dedupAccessPolicy = (await tasks.frictionlessManager.getPrioritisedAccessPolicies(
-        userAccessRulesStorage,
-        dapp,
-        dedupUserScope
-      )).find((p) => !p.deferToVerify);
-      const dedupConflictsWithPolicy = dedupAccessPolicy !== void 0 && (dedupAccessPolicy.type === AccessPolicyType.Block || dedupAccessPolicy.captchaType !== void 0 && dedupAccessPolicy.captchaType !== dedup.captchaType);
-      const cachedCaptchaType = dedup.captchaType;
-      const dedupRouted = normalizedIp ? await tasks.frictionlessManager.applyRoutingMachine(
-        {
-          captchaType: cachedCaptchaType,
-          ...dedup.session.solvedImagesCount !== void 0 && {
-            solvedImagesCount: dedup.session.solvedImagesCount
-          },
-          ...dedup.session.powDifficulty !== void 0 && {
-            powDifficulty: dedup.session.powDifficulty
-          }
-        },
-        {
-          dappAccount: dapp,
-          userAccount: user,
-          ip: normalizedIp,
-          ...dedupCountryCode && { countryCode: dedupCountryCode },
-          score: dedup.session.score,
-          platform: derivePlatform(
-            dedupUserAgent,
-            dedup.session.webView,
-            {
-              ...typeof dedupIsMobile === "boolean" && {
-                isMobile: dedupIsMobile
-              }
-            }
-          ),
-          raw: {
-            headers: dedupFlatHeaders,
-            userAgent: dedupUserAgent,
-            ...req.ja4 && { ja4: req.ja4 },
-            // Timing values are per-connection so they come from
-            // the current request even in the dedup replay path —
-            // dedup.session was created on a different TCP conn.
-            ...req.tcpToChelloUs !== void 0 && {
-              tcpToChelloUs: req.tcpToChelloUs
-            },
-            ...req.chelloToHandshakeUs !== void 0 && {
-              chelloToHandshakeUs: req.chelloToHandshakeUs
-            },
-            // currentUrl / iframeUrl use the cached session's
-            // values to match the rest of the dedup routing input
-            // (score, webView, captchaType are all pulled from
-            // dedup).
-            ...dedup.session.currentUrl && {
-              currentUrl: dedup.session.currentUrl
-            },
-            ...dedup.session.iframeUrl && {
-              iframeUrl: dedup.session.iframeUrl
-            }
-          }
-        }
-      ) : { captchaType: cachedCaptchaType };
-      const dedupConflictsWithRouting = dedupRouted.captchaType !== cachedCaptchaType;
-      if (dedupConflictsWithPolicy || dedupConflictsWithRouting) {
-        req.logger.info(() => ({
-          msg: "Evicting reused session: cached captchaType conflicts with access policy or routing machine",
-          data: {
-            userSitekeyIpHash,
-            sessionId: dedup.sessionId,
-            cachedCaptchaType: dedup.captchaType,
-            ...dedupConflictsWithPolicy && {
-              policyType: dedupAccessPolicy?.type,
-              policyCaptchaType: dedupAccessPolicy?.captchaType
-            },
-            ...dedupConflictsWithRouting && {
-              routedCaptchaType: dedupRouted.captchaType
-            }
-          }
-        }));
-        await tasks.db.checkAndRemoveSession(dedup.sessionId);
-        await Promise.all([
-          tasks.writeQueue?.invalidateCachedSession(dedup.sessionId) ?? Promise.resolve(),
-          tasks.writeQueue?.invalidateCachedSessionByHash(
-            userSitekeyIpHash
-          ) ?? Promise.resolve()
-        ]);
-      } else {
-        req.logger.info(() => ({
-          msg: "Reusing existing session for user-IP-sitekey combination",
-          data: {
-            userSitekeyIpHash,
-            sessionId: dedup.sessionId,
-            captchaType: dedup.captchaType
-          }
-        }));
-        req.logger.info(() => ({
-          msg: "Frictionless decision",
-          data: {
-            decision: "reuse_session",
-            captchaType: dedup.captchaType,
-            sessionId: dedup.sessionId
-          }
-        }));
-        recordFrictionlessDecision("reuse_session");
-        attachHoneypot(res, clientRecord);
-        return res.json({
-          [ApiParams.captchaType]: dedup.captchaType,
-          [ApiParams.sessionId]: dedup.sessionId,
-          [ApiParams.status]: "ok",
-          dns_url: buildDnsEventUrl(dedup.sessionId)
-        });
-      }
-    }
-    const ipAddress = getCompositeIpAddress(normalizedIp);
-    const flatHeaders = flatten(req.headers);
-    const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-    const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-    const shortCircuitResponse = await runConfiguredCaptchaTypeShortCircuit(
-      {
-        tasks,
-        env,
-        clientRecord,
-        token,
-        dapp,
-        ipAddress,
-        ipInfo: req.ipInfo,
-        flatHeaders,
-        sessionMode,
-        userSitekeyIpHash,
-        logger: req.logger,
-        ...req.tcpToChelloUs !== void 0 && {
-          tcpToChelloUs: req.tcpToChelloUs
-        },
-        ...req.chelloToHandshakeUs !== void 0 && {
-          chelloToHandshakeUs: req.chelloToHandshakeUs
-        }
-      },
-      res
-    );
-    if (shortCircuitResponse) return shortCircuitResponse;
-    const lScore = tasks.frictionlessManager.checkLangRules(
-      req.headers["accept-language"] || ""
-    );
-    const userScope = getRequestUserScope(
-      flatten(req.headers),
-      req.ja4,
-      normalizedIp,
-      user,
-      void 0,
-      void 0,
-      countryCode,
-      asn
-    );
-    const [decryptedPayload, validation, accessPolicies] = await Promise.all([
-      tasks.frictionlessManager.decryptPayload(token, headHash),
-      tasks.frictionlessManager.isValidRequest(
-        clientRecord,
-        CaptchaType.frictionless,
-        env
-      ),
-      tasks.frictionlessManager.getPrioritisedAccessPolicies(
-        userAccessRulesStorage,
-        dapp,
-        userScope
-      )
-    ]);
-    const {
-      baseBotScore: rawBaseBotScore,
-      timestamp: rawTimestamp,
-      userId: rawUserId,
-      userAgent: rawUserAgent,
-      webView,
-      iFrame,
-      decryptedHeadHash,
-      decryptionFailed: rawDecryptionFailed,
-      triggeredDetectors,
-      shadowDomPenalty,
-      entropyMathRandomFingerprint,
-      entropyCryptoFingerprint,
-      entropyWallClockOffsetMs,
-      entropyMathRandomFirst
-    } = decryptedPayload;
-    const detectorOverride = process.env.PROSOPO_TEST_FRICTIONLESS_DETECTOR_OVERRIDE === "1";
-    const baseBotScore = detectorOverride ? 0 : rawBaseBotScore;
-    const timestamp = detectorOverride ? Date.now() : rawTimestamp;
-    const userId = detectorOverride ? req.headers["prosopo-user"] : rawUserId;
-    const userAgent = detectorOverride ? hashUserAgent(req.headers["user-agent"] ?? "") : rawUserAgent;
-    const decryptionFailed = detectorOverride ? false : rawDecryptionFailed;
-    req.logger.debug(() => ({
-      msg: "Decrypted payload",
-      data: {
-        baseBotScore,
-        timestamp,
-        userId,
-        userAgent,
-        webView,
-        ...detectorOverride && { detectorOverride: true }
-      }
-    }));
-    let botScore = baseBotScore + lScore;
-    const { valid, reason } = validation;
-    if (!valid) {
-      return next(
-        new ProsopoApiError(reason || "API.BAD_REQUEST", {
-          context: { code: 400, siteKey: dapp, user },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    recordBotScore(botScore);
-    if (triggeredDetectors && triggeredDetectors.length > 0) {
-      recordDetectorTriggered(triggeredDetectors);
-    }
-    const botThreshold = clientRecord.settings?.frictionlessThreshold || DEFAULT_FRICTIONLESS_THRESHOLD;
-    let scoreComponents = {
-      baseScore: baseBotScore,
-      ...lScore && { lScore },
-      ...triggeredDetectors && triggeredDetectors.length > 0 && { triggeredDetectors },
-      ...shadowDomPenalty !== void 0 && { shadowDomPenalty }
-    };
-    tasks.frictionlessManager.setSessionParams({
-      token,
-      score: botScore,
-      threshold: botThreshold,
-      scoreComponents,
-      ipAddress,
-      webView,
-      iFrame,
-      decryptedHeadHash,
-      siteKey: dapp,
-      ...currentUrl && { currentUrl },
-      ...iframeUrl && { iframeUrl },
-      ...isProtect && { isProtect: true },
-      ipInfo: req.ipInfo,
-      headers: flatHeaders,
-      mode: sessionMode,
-      ...decodedSimdReadings && { simdReadings: decodedSimdReadings },
-      ...entropyMathRandomFingerprint !== void 0 && {
-        entropyMathRandomFingerprint
-      },
-      ...entropyCryptoFingerprint !== void 0 && {
-        entropyCryptoFingerprint
-      },
-      ...entropyWallClockOffsetMs !== void 0 && {
-        entropyWallClockOffsetMs
-      },
-      ...entropyMathRandomFirst !== void 0 && {
-        entropyMathRandomFirst
-      },
-      ...req.tcpToChelloUs !== void 0 && {
-        tcpToChelloUs: req.tcpToChelloUs
-      },
-      ...req.chelloToHandshakeUs !== void 0 && {
-        chelloToHandshakeUs: req.chelloToHandshakeUs
-      }
-    });
-    const ipInfoMobile = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.isMobile : void 0;
-    const safeUserAgent = userAgent ?? "";
-    tasks.frictionlessManager.setRoutingContext({
-      dappAccount: dapp,
-      userAccount: user,
-      ip: normalizedIp,
-      countryCode,
-      score: botScore,
-      platform: derivePlatform(safeUserAgent, webView, {
-        ...typeof ipInfoMobile === "boolean" && { isMobile: ipInfoMobile }
-      }),
-      raw: {
-        headers: flatHeaders,
-        userAgent: safeUserAgent,
-        ...req.ja4 && { ja4: req.ja4 },
-        ...req.tcpToChelloUs !== void 0 && {
-          tcpToChelloUs: req.tcpToChelloUs
-        },
-        ...req.chelloToHandshakeUs !== void 0 && {
-          chelloToHandshakeUs: req.chelloToHandshakeUs
-        },
-        ...currentUrl && { currentUrl },
-        ...iframeUrl && { iframeUrl }
-      }
-    });
-    const userAccessPolicy = accessPolicies.find((p) => !p.deferToVerify);
-    const accessPolicyOutcome = await handleAccessPolicy(
-      {
-        tasks,
-        clientRecord,
-        userAccessPolicy,
-        baseBotScore,
-        botScore,
-        scoreComponents,
-        userSitekeyIpHash,
-        dapp,
-        ipInfo: req.ipInfo,
-        flatHeaders,
-        logger: req.logger,
-        userScope
-      },
-      res
-    );
-    if (accessPolicyOutcome.handled) return accessPolicyOutcome.response;
-    botScore = accessPolicyOutcome.botScore;
-    scoreComponents = accessPolicyOutcome.scoreComponents;
-    return await runDecisionMachine(
-      {
-        tasks,
-        env,
-        clientRecord,
-        dapp,
-        user,
-        userSitekeyIpHash,
-        flatHeaders,
-        ipInfo: req.ipInfo,
-        timestamp,
-        decryptionFailed,
-        userAgent,
-        userId,
-        webView,
-        decryptedHeadHash,
-        baseBotScore,
-        botScore,
-        scoreComponents,
-        token,
-        botThreshold,
-        currentUrl,
-        iframeUrl
-      },
-      { req, res, next }
-    );
-  } catch (err) {
-    req.logger.error(() => ({
-      err,
-      msg: "Error in frictionless captcha challenge"
-    }));
-    return next(
-      new ProsopoApiError("API.BAD_REQUEST", {
-        context: { code: 400, error: err },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-};
-export {
-  getFrictionlessCaptchaChallenge as default
+import { ProsopoApiError } from "@prosopo/common";
+import { ApiParams, CaptchaType, GetFrictionlessCaptchaChallengeRequestBody, ModeEnum } from "@prosopo/types";
+import { flatten, isProtectDeployment, sanitisePageUrl } from "@prosopo/util";
+import { AccessPolicyType } from "@prosopo/user-access-policy";
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/handler.ts
+var handler_default = (env, userAccessRulesStorage) => async (req, res, next) => {
+	try {
+		res.on("finish", () => {
+			req.logger.info(() => ({
+				msg: "Frictionless response finished",
+				data: {
+					status: res.statusCode,
+					path: req.path,
+					method: req.method
+				}
+			}));
+		});
+		const { token, headHash, dapp, user, mode, simdReadings, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl } = GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
+		const currentUrl = sanitisePageUrl(reportedCurrentUrl);
+		const iframeUrl = sanitisePageUrl(reportedIframeUrl);
+		const isProtect = isProtectDeployment(currentUrl, iframeUrl);
+		const normalizedIp = normalizeRequestIp(req.ip, req.logger);
+		const sessionMode = mode === ModeEnum.invisible ? ModeEnum.invisible : void 0;
+		req.logger.info(() => ({
+			msg: "Frictionless handler entry",
+			data: {
+				token,
+				user,
+				dapp,
+				normalizedIp,
+				ja4: req.ja4,
+				path: req.path,
+				method: req.method,
+				...sessionMode && { mode: sessionMode }
+			}
+		}));
+		if (getMaintenanceMode()) {
+			req.logger.info(() => ({
+				msg: "Maintenance mode active - returning dummy PoW captcha session",
+				data: {
+					dapp,
+					user
+				}
+			}));
+			return res.json(buildFrictionlessMaintenanceResponse(CaptchaType.pow, env.config.host));
+		}
+		if (isReservedTestSiteKey(dapp)) {
+			req.logger.warn(() => ({
+				msg: "Reserved TEST site key - returning invisible PoW session",
+				data: {
+					dapp,
+					user
+				}
+			}));
+			return res.json(buildFrictionlessMaintenanceResponse(CaptchaType.pow, env.config.host));
+		}
+		const tasks = new Tasks(env, req.logger);
+		const userSitekeyIpHash = hashUserIp(user, normalizedIp, dapp);
+		const [decodedSimdReadings, { existingToken, dedup }, clientRecord] = await Promise.all([
+			decryptIncomingSimdReadings(tasks.frictionlessManager, simdReadings),
+			resolveSessionDedup(tasks, token, userSitekeyIpHash, req.logger),
+			tasks.db.getClientRecord(dapp)
+		]);
+		if (existingToken) {
+			req.logger.info(() => ({
+				token: existingToken,
+				msg: "Token has already been used"
+			}));
+			return next(new ProsopoApiError("API.BAD_REQUEST", {
+				context: {
+					code: 400,
+					siteKey: dapp,
+					user
+				},
+				i18n: req.i18n,
+				logger: req.logger
+			}));
+		}
+		if (!clientRecord) return next(new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		if (dedup) {
+			const dedupCountryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+			const dedupAsn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+			const dedupIsMobile = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.isMobile : void 0;
+			const dedupFlatHeaders = flatten(req.headers);
+			const dedupUserAgent = String(req.headers["user-agent"] ?? "");
+			const dedupUserScope = getRequestUserScope(dedupFlatHeaders, req.ja4, normalizedIp, user, void 0, void 0, dedupCountryCode, dedupAsn);
+			const dedupAccessPolicy = (await tasks.frictionlessManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, dedupUserScope)).find((p) => !p.deferToVerify);
+			const dedupConflictsWithPolicy = dedupAccessPolicy !== void 0 && (dedupAccessPolicy.type === AccessPolicyType.Block || dedupAccessPolicy.captchaType !== void 0 && dedupAccessPolicy.captchaType !== dedup.captchaType);
+			const cachedCaptchaType = dedup.captchaType;
+			const dedupRouted = normalizedIp ? await tasks.frictionlessManager.applyRoutingMachine({
+				captchaType: cachedCaptchaType,
+				...dedup.session.solvedImagesCount !== void 0 && { solvedImagesCount: dedup.session.solvedImagesCount },
+				...dedup.session.powDifficulty !== void 0 && { powDifficulty: dedup.session.powDifficulty }
+			}, {
+				dappAccount: dapp,
+				userAccount: user,
+				ip: normalizedIp,
+				...dedupCountryCode && { countryCode: dedupCountryCode },
+				score: dedup.session.score,
+				platform: derivePlatform(dedupUserAgent, dedup.session.webView, { ...typeof dedupIsMobile === "boolean" && { isMobile: dedupIsMobile } }),
+				raw: {
+					headers: dedupFlatHeaders,
+					userAgent: dedupUserAgent,
+					...req.ja4 && { ja4: req.ja4 },
+					...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
+					...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs },
+					...dedup.session.currentUrl && { currentUrl: dedup.session.currentUrl },
+					...dedup.session.iframeUrl && { iframeUrl: dedup.session.iframeUrl }
+				}
+			}) : { captchaType: cachedCaptchaType };
+			const dedupConflictsWithRouting = dedupRouted.captchaType !== cachedCaptchaType;
+			if (dedupConflictsWithPolicy || dedupConflictsWithRouting) {
+				req.logger.info(() => ({
+					msg: "Evicting reused session: cached captchaType conflicts with access policy or routing machine",
+					data: {
+						userSitekeyIpHash,
+						sessionId: dedup.sessionId,
+						cachedCaptchaType: dedup.captchaType,
+						...dedupConflictsWithPolicy && {
+							policyType: dedupAccessPolicy?.type,
+							policyCaptchaType: dedupAccessPolicy?.captchaType
+						},
+						...dedupConflictsWithRouting && { routedCaptchaType: dedupRouted.captchaType }
+					}
+				}));
+				await tasks.db.checkAndRemoveSession(dedup.sessionId);
+				await Promise.all([tasks.writeQueue?.invalidateCachedSession(dedup.sessionId) ?? Promise.resolve(), tasks.writeQueue?.invalidateCachedSessionByHash(userSitekeyIpHash) ?? Promise.resolve()]);
+			} else {
+				req.logger.info(() => ({
+					msg: "Reusing existing session for user-IP-sitekey combination",
+					data: {
+						userSitekeyIpHash,
+						sessionId: dedup.sessionId,
+						captchaType: dedup.captchaType
+					}
+				}));
+				req.logger.info(() => ({
+					msg: "Frictionless decision",
+					data: {
+						decision: "reuse_session",
+						captchaType: dedup.captchaType,
+						sessionId: dedup.sessionId
+					}
+				}));
+				recordFrictionlessDecision("reuse_session");
+				attachHoneypot(res, clientRecord);
+				return res.json({
+					[ApiParams.captchaType]: dedup.captchaType,
+					[ApiParams.sessionId]: dedup.sessionId,
+					[ApiParams.status]: "ok",
+					dns_url: buildDnsEventUrl(dedup.sessionId)
+				});
+			}
+		}
+		const ipAddress = getCompositeIpAddress(normalizedIp);
+		const flatHeaders = flatten(req.headers);
+		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+		const shortCircuitResponse = await runConfiguredCaptchaTypeShortCircuit({
+			tasks,
+			env,
+			clientRecord,
+			token,
+			dapp,
+			ipAddress,
+			ipInfo: req.ipInfo,
+			flatHeaders,
+			sessionMode,
+			userSitekeyIpHash,
+			logger: req.logger,
+			...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
+			...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs }
+		}, res);
+		if (shortCircuitResponse) return shortCircuitResponse;
+		const lScore = tasks.frictionlessManager.checkLangRules(req.headers["accept-language"] || "");
+		const userScope = getRequestUserScope(flatten(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
+		const [decryptedPayload, validation, accessPolicies] = await Promise.all([
+			tasks.frictionlessManager.decryptPayload(token, headHash),
+			tasks.frictionlessManager.isValidRequest(clientRecord, CaptchaType.frictionless, env),
+			tasks.frictionlessManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)
+		]);
+		const { baseBotScore: rawBaseBotScore, timestamp: rawTimestamp, userId: rawUserId, userAgent: rawUserAgent, webView, iFrame, decryptedHeadHash, decryptionFailed: rawDecryptionFailed, triggeredDetectors, shadowDomPenalty, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst } = decryptedPayload;
+		const detectorOverride = process.env.PROSOPO_TEST_FRICTIONLESS_DETECTOR_OVERRIDE === "1";
+		const baseBotScore = detectorOverride ? 0 : rawBaseBotScore;
+		const timestamp = detectorOverride ? Date.now() : rawTimestamp;
+		const userId = detectorOverride ? req.headers["prosopo-user"] : rawUserId;
+		const userAgent = detectorOverride ? hashUserAgent(req.headers["user-agent"] ?? "") : rawUserAgent;
+		const decryptionFailed = detectorOverride ? false : rawDecryptionFailed;
+		req.logger.debug(() => ({
+			msg: "Decrypted payload",
+			data: {
+				baseBotScore,
+				timestamp,
+				userId,
+				userAgent,
+				webView,
+				...detectorOverride && { detectorOverride: true }
+			}
+		}));
+		let botScore = baseBotScore + lScore;
+		const { valid, reason } = validation;
+		if (!valid) return next(new ProsopoApiError(reason || "API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		recordBotScore(botScore);
+		if (triggeredDetectors && triggeredDetectors.length > 0) recordDetectorTriggered(triggeredDetectors);
+		const botThreshold = clientRecord.settings?.frictionlessThreshold || .5;
+		let scoreComponents = {
+			baseScore: baseBotScore,
+			...lScore && { lScore },
+			...triggeredDetectors && triggeredDetectors.length > 0 && { triggeredDetectors },
+			...shadowDomPenalty !== void 0 && { shadowDomPenalty }
+		};
+		tasks.frictionlessManager.setSessionParams({
+			token,
+			score: botScore,
+			threshold: botThreshold,
+			scoreComponents,
+			ipAddress,
+			webView,
+			iFrame,
+			decryptedHeadHash,
+			siteKey: dapp,
+			...currentUrl && { currentUrl },
+			...iframeUrl && { iframeUrl },
+			...isProtect && { isProtect: true },
+			ipInfo: req.ipInfo,
+			headers: flatHeaders,
+			mode: sessionMode,
+			...decodedSimdReadings && { simdReadings: decodedSimdReadings },
+			...entropyMathRandomFingerprint !== void 0 && { entropyMathRandomFingerprint },
+			...entropyCryptoFingerprint !== void 0 && { entropyCryptoFingerprint },
+			...entropyWallClockOffsetMs !== void 0 && { entropyWallClockOffsetMs },
+			...entropyMathRandomFirst !== void 0 && { entropyMathRandomFirst },
+			...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
+			...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs }
+		});
+		const ipInfoMobile = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.isMobile : void 0;
+		const safeUserAgent = userAgent ?? "";
+		tasks.frictionlessManager.setRoutingContext({
+			dappAccount: dapp,
+			userAccount: user,
+			ip: normalizedIp,
+			countryCode,
+			score: botScore,
+			platform: derivePlatform(safeUserAgent, webView, { ...typeof ipInfoMobile === "boolean" && { isMobile: ipInfoMobile } }),
+			raw: {
+				headers: flatHeaders,
+				userAgent: safeUserAgent,
+				...req.ja4 && { ja4: req.ja4 },
+				...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
+				...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs },
+				...currentUrl && { currentUrl },
+				...iframeUrl && { iframeUrl }
+			}
+		});
+		const accessPolicyOutcome = await handleAccessPolicy({
+			tasks,
+			clientRecord,
+			userAccessPolicy: accessPolicies.find((p) => !p.deferToVerify),
+			baseBotScore,
+			botScore,
+			scoreComponents,
+			userSitekeyIpHash,
+			dapp,
+			ipInfo: req.ipInfo,
+			flatHeaders,
+			logger: req.logger,
+			userScope
+		}, res);
+		if (accessPolicyOutcome.handled) return accessPolicyOutcome.response;
+		botScore = accessPolicyOutcome.botScore;
+		scoreComponents = accessPolicyOutcome.scoreComponents;
+		return await runDecisionMachine({
+			tasks,
+			env,
+			clientRecord,
+			dapp,
+			user,
+			userSitekeyIpHash,
+			flatHeaders,
+			ipInfo: req.ipInfo,
+			timestamp,
+			decryptionFailed,
+			userAgent,
+			userId,
+			webView,
+			decryptedHeadHash,
+			baseBotScore,
+			botScore,
+			scoreComponents,
+			token,
+			botThreshold,
+			currentUrl,
+			iframeUrl
+		}, {
+			req,
+			res,
+			next
+		});
+	} catch (err) {
+		req.logger.error(() => ({
+			err,
+			msg: "Error in frictionless captcha challenge"
+		}));
+		return next(new ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
 };
+//#endregion
+export { handler_default as default };