@prosopo/provider 4.15.14 → 4.15.15

package/dist/api/captcha/getPoWCaptchaChallenge.js

@@ -1,202 +1,132 @@
-import { ProsopoApiError } from "@prosopo/common";
-import { GetPowCaptchaChallengeRequestBody, CaptchaType, SimdReadingsStage, ApiParams } from "@prosopo/types";
-import { flatten } from "@prosopo/util";
+import { validateAddr, validateSiteKey } from "../validateAddress.js";
 import { getCompositeIpAddress } from "../../compositeIpAddress.js";
-import "../../tasks/index.js";
-import { normalizeRequestIp } from "../../utils/normalizeRequestIp.js";
-import { getMaintenanceMode } from "../admin/apiToggleMaintenanceModeEndpoint.js";
+import { recordCaptchaIssueError, recordCaptchaIssued } from "../metrics.js";
 import { getRequestUserScope } from "../blacklistRequestInspector.js";
-import { recordCaptchaIssued, recordCaptchaIssueError } from "../metrics.js";
-import { validateSiteKey, validateAddr } from "../validateAddress.js";
-import { buildPowMaintenanceResponse } from "./maintenanceModeResponses.js";
 import { Tasks } from "../../tasks/tasks.js";
-const getPoWCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
-  let parsed;
-  try {
-    parsed = GetPowCaptchaChallengeRequestBody.parse(req.body);
-  } catch (err) {
-    return next(
-      new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-        context: { code: 400, error: err },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  const { user, dapp, sessionId, simdReadings } = parsed;
-  validateSiteKey(dapp);
-  validateAddr(user);
-  if (getMaintenanceMode()) {
-    req.logger.info(() => ({
-      msg: "Maintenance mode active - returning dummy PoW challenge",
-      data: { dapp, user, sessionId }
-    }));
-    return res.json(buildPowMaintenanceResponse(user, dapp));
-  }
-  const tasks = new Tasks(env, req.logger);
-  try {
-    const clientSettings = await tasks.db.getClientRecord(dapp);
-    if (!clientSettings) {
-      return next(
-        new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-          context: { code: 400, siteKey: dapp },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const normalizedIp = normalizeRequestIp(req.ip, req.logger);
-    if (!normalizedIp) {
-      req.logger.warn(() => ({
-        msg: "Request missing IP; geoblocking will be skipped"
-      }));
-    }
-    const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-    const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-    const userScope = getRequestUserScope(
-      flatten(req.headers),
-      req.ja4,
-      normalizedIp,
-      user,
-      void 0,
-      // headHash
-      void 0,
-      // coords
-      countryCode,
-      asn
-    );
-    const userAccessPolicy = (await tasks.powCaptchaManager.getPrioritisedAccessPolicies(
-      userAccessRulesStorage,
-      dapp,
-      userScope
-    )).find((p) => !p.deferToVerify);
-    const {
-      valid,
-      reason,
-      sessionId: validSessionId,
-      powDifficulty
-    } = await tasks.powCaptchaManager.isValidRequest(
-      clientSettings,
-      CaptchaType.pow,
-      env,
-      sessionId,
-      userAccessPolicy,
-      normalizedIp
-    );
-    if (!valid) {
-      return next(
-        new ProsopoApiError(reason || "API.BAD_REQUEST", {
-          context: {
-            code: 400,
-            siteKey: dapp,
-            user
-          },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const origin = req.headers.origin;
-    if (!origin) {
-      return next(
-        new ProsopoApiError("API.BAD_REQUEST", {
-          context: {
-            error: "Origin header not found",
-            code: 400,
-            siteKey: dapp,
-            user
-          },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const difficulty = powDifficulty || userAccessPolicy?.powDifficulty || clientSettings?.settings?.powDifficulty;
-    const challenge = await tasks.powCaptchaManager.getPowCaptchaChallenge(
-      user,
-      dapp,
-      origin,
-      difficulty
-    );
-    if (validSessionId && simdReadings) {
-      await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(
-        validSessionId,
-        simdReadings,
-        SimdReadingsStage.challenge
-      ).catch((updateErr) => {
-        req.logger.warn(() => ({
-          err: updateErr,
-          msg: "Failed to patch session with SIMD readings on PoW challenge"
-        }));
-      });
-    }
-    await tasks.db.storePowCaptchaRecord(
-      challenge.challenge,
-      {
-        requestedAtTimestamp: challenge.requestedAtTimestamp,
-        userAccount: user,
-        dappAccount: dapp
-      },
-      challenge.difficulty,
-      challenge.providerSignature,
-      getCompositeIpAddress(normalizedIp),
-      flatten(req.headers),
-      req.ja4,
-      validSessionId,
-      void 0,
-      void 0,
-      void 0,
-      // Persist the full ipinfo payload — consumers (portal,
-      // anomaly detection, CHECK_IP_INFO backfill) read the
-      // individual flags off this object instead of separate
-      // flat fields.
-      req.ipInfo
-    );
-    const getPowCaptchaResponse = {
-      [ApiParams.status]: "ok",
-      [ApiParams.challenge]: challenge.challenge,
-      [ApiParams.difficulty]: challenge.difficulty,
-      [ApiParams.timestamp]: challenge.requestedAtTimestamp.toString(),
-      [ApiParams.signature]: {
-        [ApiParams.provider]: {
-          [ApiParams.challenge]: challenge.providerSignature
-        }
-      }
-    };
-    req.logger.info(() => ({
-      msg: "PoW captcha challenge issued",
-      data: {
-        captchaType: CaptchaType.pow,
-        challenge: challenge.challenge,
-        difficulty: challenge.difficulty,
-        user,
-        dapp,
-        session: sessionId
-      }
-    }));
-    recordCaptchaIssued(CaptchaType.pow);
-    return res.json(getPowCaptchaResponse);
-  } catch (err) {
-    recordCaptchaIssueError(CaptchaType.pow);
-    req.logger.error(() => ({
-      err,
-      body: req.body,
-      msg: "Error in PoW captcha challenge request"
-    }));
-    return next(
-      new ProsopoApiError("API.BAD_REQUEST", {
-        context: {
-          code: 500,
-          siteKey: req.body.dapp,
-          user: req.body.user,
-          error: err
-        },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-};
-export {
-  getPoWCaptchaChallenge as default
+import { getMaintenanceMode } from "../admin/apiToggleMaintenanceModeEndpoint.js";
+import { normalizeRequestIp } from "../../utils/normalizeRequestIp.js";
+import { buildPowMaintenanceResponse } from "./maintenanceModeResponses.js";
+import { ProsopoApiError } from "@prosopo/common";
+import { ApiParams, CaptchaType, GetPowCaptchaChallengeRequestBody, SimdReadingsStage } from "@prosopo/types";
+import { flatten } from "@prosopo/util";
+//#region src/api/captcha/getPoWCaptchaChallenge.ts
+var getPoWCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req, res, next) => {
+	let parsed;
+	try {
+		parsed = GetPowCaptchaChallengeRequestBody.parse(req.body);
+	} catch (err) {
+		return next(new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const { user, dapp, sessionId, simdReadings } = parsed;
+	validateSiteKey(dapp);
+	validateAddr(user);
+	if (getMaintenanceMode()) {
+		req.logger.info(() => ({
+			msg: "Maintenance mode active - returning dummy PoW challenge",
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(buildPowMaintenanceResponse(user, dapp));
+	}
+	const tasks = new Tasks(env, req.logger);
+	try {
+		const clientSettings = await tasks.db.getClientRecord(dapp);
+		if (!clientSettings) return next(new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const normalizedIp = normalizeRequestIp(req.ip, req.logger);
+		if (!normalizedIp) req.logger.warn(() => ({ msg: "Request missing IP; geoblocking will be skipped" }));
+		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+		const userScope = getRequestUserScope(flatten(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
+		const userAccessPolicy = (await tasks.powCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)).find((p) => !p.deferToVerify);
+		const { valid, reason, sessionId: validSessionId, powDifficulty } = await tasks.powCaptchaManager.isValidRequest(clientSettings, CaptchaType.pow, env, sessionId, userAccessPolicy, normalizedIp);
+		if (!valid) return next(new ProsopoApiError(reason || "API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const origin = req.headers.origin;
+		if (!origin) return next(new ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				error: "Origin header not found",
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const difficulty = powDifficulty || userAccessPolicy?.powDifficulty || clientSettings?.settings?.powDifficulty;
+		const challenge = await tasks.powCaptchaManager.getPowCaptchaChallenge(user, dapp, origin, difficulty);
+		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, SimdReadingsStage.challenge).catch((updateErr) => {
+			req.logger.warn(() => ({
+				err: updateErr,
+				msg: "Failed to patch session with SIMD readings on PoW challenge"
+			}));
+		});
+		await tasks.db.storePowCaptchaRecord(challenge.challenge, {
+			requestedAtTimestamp: challenge.requestedAtTimestamp,
+			userAccount: user,
+			dappAccount: dapp
+		}, challenge.difficulty, challenge.providerSignature, getCompositeIpAddress(normalizedIp), flatten(req.headers), req.ja4, validSessionId, void 0, void 0, void 0, req.ipInfo);
+		const getPowCaptchaResponse = {
+			[ApiParams.status]: "ok",
+			[ApiParams.challenge]: challenge.challenge,
+			[ApiParams.difficulty]: challenge.difficulty,
+			[ApiParams.timestamp]: challenge.requestedAtTimestamp.toString(),
+			[ApiParams.signature]: { [ApiParams.provider]: { [ApiParams.challenge]: challenge.providerSignature } }
+		};
+		req.logger.info(() => ({
+			msg: "PoW captcha challenge issued",
+			data: {
+				captchaType: CaptchaType.pow,
+				challenge: challenge.challenge,
+				difficulty: challenge.difficulty,
+				user,
+				dapp,
+				session: sessionId
+			}
+		}));
+		recordCaptchaIssued(CaptchaType.pow);
+		return res.json(getPowCaptchaResponse);
+	} catch (err) {
+		recordCaptchaIssueError(CaptchaType.pow);
+		req.logger.error(() => ({
+			err,
+			body: req.body,
+			msg: "Error in PoW captcha challenge request"
+		}));
+		return next(new ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 500,
+				siteKey: req.body.dapp,
+				user: req.body.user,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
 };
+//#endregion
+export { getPoWCaptchaChallenge_default as default };