@prosopo/provider 4.15.14 → 4.15.15

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.cjs

@@ -1,17 +1,21 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const encoders = require("../../../utils/honeypot/encoders.cjs");
-const phraseBank = require("../../../utils/honeypot/phraseBank.cjs");
-const HONEYPOT_HEADER = "x-prosopo-meta";
-const attachHoneypot = (res, clientRecord) => {
-  const cfg = clientRecord.settings?.honeypot;
-  if (!cfg?.enabled) return;
-  const question = cfg.question ?? phraseBank.getRandomPhrase();
-  if (!question) return;
-  res.setHeader(
-    HONEYPOT_HEADER,
-    encoders.encodeHoneypotQuestion(question, cfg.encodingType)
-  );
+const require_encoders = require("../../../utils/honeypot/encoders.cjs");
+const require_phraseBank = require("../../../utils/honeypot/phraseBank.cjs");
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.ts
+var HONEYPOT_HEADER = "x-prosopo-meta";
+/**
+* Sets the honeypot header on the response when the client has honeypot
+* enabled. Header value is base64-wrapped morse/semaphore so an inspector
+* doesn't immediately recognise the encoding shape. Falls back to a random
+* phrase from the bank when no custom question is configured; no-op when
+* the bank is empty or honeypot is disabled.
+*/
+var attachHoneypot = (res, clientRecord) => {
+	const cfg = clientRecord.settings?.honeypot;
+	if (!cfg?.enabled) return;
+	const question = cfg.question ?? require_phraseBank.getRandomPhrase();
+	if (!question) return;
+	res.setHeader(HONEYPOT_HEADER, require_encoders.encodeHoneypotQuestion(question, cfg.encodingType));
 };
+//#endregion
 exports.HONEYPOT_HEADER = HONEYPOT_HEADER;
 exports.attachHoneypot = attachHoneypot;

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.cjs

@@ -1,28 +1,28 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const resolveSessionDedup = async (tasks, token, userSitekeyIpHash, logger) => {
-  const [existingToken, existingSession] = await Promise.all([
-    tasks.db.getSessionRecordByToken(token),
-    tasks.db.getSessionByuserSitekeyIpHash(userSitekeyIpHash)
-  ]);
-  const dedup = existingSession ? {
-    sessionId: existingSession.sessionId,
-    captchaType: existingSession.captchaType,
-    session: existingSession
-  } : null;
-  if (!dedup && tasks.writeQueue) {
-    const stalePointer = await tasks.writeQueue.getCachedSessionByHash(userSitekeyIpHash);
-    if (stalePointer) {
-      logger.warn(() => ({
-        msg: "Evicting stale Redis dedup pointer",
-        data: { userSitekeyIpHash, staleSessionId: stalePointer }
-      }));
-      await Promise.all([
-        tasks.writeQueue.invalidateCachedSessionByHash(userSitekeyIpHash),
-        tasks.writeQueue.invalidateCachedSession(stalePointer)
-      ]);
-    }
-  }
-  return { existingToken, dedup };
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.ts
+var resolveSessionDedup = async (tasks, token, userSitekeyIpHash, logger) => {
+	const [existingToken, existingSession] = await Promise.all([tasks.db.getSessionRecordByToken(token), tasks.db.getSessionByuserSitekeyIpHash(userSitekeyIpHash)]);
+	const dedup = existingSession ? {
+		sessionId: existingSession.sessionId,
+		captchaType: existingSession.captchaType,
+		session: existingSession
+	} : null;
+	if (!dedup && tasks.writeQueue) {
+		const stalePointer = await tasks.writeQueue.getCachedSessionByHash(userSitekeyIpHash);
+		if (stalePointer) {
+			logger.warn(() => ({
+				msg: "Evicting stale Redis dedup pointer",
+				data: {
+					userSitekeyIpHash,
+					staleSessionId: stalePointer
+				}
+			}));
+			await Promise.all([tasks.writeQueue.invalidateCachedSessionByHash(userSitekeyIpHash), tasks.writeQueue.invalidateCachedSession(stalePointer)]);
+		}
+	}
+	return {
+		existingToken,
+		dedup
+	};
 };
+//#endregion
 exports.resolveSessionDedup = resolveSessionDedup;

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs

@@ -1,65 +1,44 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const types = require("@prosopo/types");
-const constants = require("./constants.cjs");
-const honeypotResponse = require("./honeypotResponse.cjs");
-const runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
-  const configuredType = input.clientRecord.settings?.captchaType;
-  if (!configuredType || configuredType === types.CaptchaType.frictionless) {
-    return null;
-  }
-  const sessionParams = {
-    token: input.token,
-    score: 0,
-    threshold: input.clientRecord.settings?.frictionlessThreshold ?? constants.DEFAULT_FRICTIONLESS_THRESHOLD,
-    scoreComponents: { baseScore: 0 },
-    ipAddress: input.ipAddress,
-    webView: false,
-    iFrame: false,
-    decryptedHeadHash: "",
-    siteKey: input.dapp,
-    ipInfo: input.ipInfo,
-    headers: input.flatHeaders,
-    mode: input.sessionMode,
-    userSitekeyIpHash: input.userSitekeyIpHash,
-    ...input.tcpToChelloUs !== void 0 && {
-      tcpToChelloUs: input.tcpToChelloUs
-    },
-    ...input.chelloToHandshakeUs !== void 0 && {
-      chelloToHandshakeUs: input.chelloToHandshakeUs
-    }
-  };
-  input.logger.info(() => ({
-    msg: "Frictionless decision",
-    data: {
-      decision: "configured_captcha_type",
-      captchaType: configuredType
-    }
-  }));
-  honeypotResponse.attachHoneypot(res, input.clientRecord);
-  switch (configuredType) {
-    case types.CaptchaType.image:
-      return res.json(
-        await input.tasks.frictionlessManager.sendImageCaptcha({
-          ...sessionParams,
-          solvedImagesCount: Math.min(
-            input.env.config.captchas.solved.count,
-            input.clientRecord.settings.imageMaxRounds
-          )
-        })
-      );
-    case types.CaptchaType.pow:
-      return res.json(
-        await input.tasks.frictionlessManager.sendPowCaptcha(sessionParams)
-      );
-    case types.CaptchaType.puzzle:
-      return res.json(
-        await input.tasks.frictionlessManager.sendPuzzleCaptcha(sessionParams)
-      );
-    default:
-      throw new Error(
-        `Unhandled configured captchaType in /frictionless short-circuit: ${configuredType}`
-      );
-  }
+const require_honeypotResponse = require("./honeypotResponse.cjs");
+require("./constants.cjs");
+let _prosopo_types = require("@prosopo/types");
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.ts
+var runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
+	const configuredType = input.clientRecord.settings?.captchaType;
+	if (!configuredType || configuredType === _prosopo_types.CaptchaType.frictionless) return null;
+	const sessionParams = {
+		token: input.token,
+		score: 0,
+		threshold: input.clientRecord.settings?.frictionlessThreshold ?? .5,
+		scoreComponents: { baseScore: 0 },
+		ipAddress: input.ipAddress,
+		webView: false,
+		iFrame: false,
+		decryptedHeadHash: "",
+		siteKey: input.dapp,
+		ipInfo: input.ipInfo,
+		headers: input.flatHeaders,
+		mode: input.sessionMode,
+		userSitekeyIpHash: input.userSitekeyIpHash,
+		...input.tcpToChelloUs !== void 0 && { tcpToChelloUs: input.tcpToChelloUs },
+		...input.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: input.chelloToHandshakeUs }
+	};
+	input.logger.info(() => ({
+		msg: "Frictionless decision",
+		data: {
+			decision: "configured_captcha_type",
+			captchaType: configuredType
+		}
+	}));
+	require_honeypotResponse.attachHoneypot(res, input.clientRecord);
+	switch (configuredType) {
+		case _prosopo_types.CaptchaType.image: return res.json(await input.tasks.frictionlessManager.sendImageCaptcha({
+			...sessionParams,
+			solvedImagesCount: Math.min(input.env.config.captchas.solved.count, input.clientRecord.settings.imageMaxRounds)
+		}));
+		case _prosopo_types.CaptchaType.pow: return res.json(await input.tasks.frictionlessManager.sendPowCaptcha(sessionParams));
+		case _prosopo_types.CaptchaType.puzzle: return res.json(await input.tasks.frictionlessManager.sendPuzzleCaptcha(sessionParams));
+		default: throw new Error(`Unhandled configured captchaType in /frictionless short-circuit: ${configuredType}`);
+	}
 };
+//#endregion
 exports.runConfiguredCaptchaTypeShortCircuit = runConfiguredCaptchaTypeShortCircuit;

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge.cjs

@@ -1,3 +1,2 @@
-"use strict";
-const handler = require("./getFrictionlessCaptchaChallenge/handler.cjs");
-module.exports = handler;
+const require_handler = require("./getFrictionlessCaptchaChallenge/handler.cjs");
+exports.default = require_handler.default;

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -1,209 +1,139 @@
-"use strict";
-const common = require("@prosopo/common");
-const datasets = require("@prosopo/datasets");
-const types = require("@prosopo/types");
-const util = require("@prosopo/util");
-require("../../tasks/index.cjs");
-const normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
-const apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
-const blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
-const metrics = require("../metrics.cjs");
-const validateAddress = require("../validateAddress.cjs");
-const maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
-const tasks = require("../../tasks/tasks.cjs");
-const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
-  let parsed;
-  const normalizedIp = normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
-  if (!normalizedIp) {
-    return next(
-      new common.ProsopoApiError("API.BAD_REQUEST", {
-        context: { code: 400, error: "IP address not found" },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  const ipAddress = util.getIPAddress(normalizedIp);
-  try {
-    parsed = types.CaptchaRequestBody.parse(req.body);
-  } catch (err) {
-    return next(
-      new common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-        context: { code: 400, error: err },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  const {
-    datasetId: clientDatasetId,
-    user,
-    dapp,
-    sessionId,
-    simdReadings
-  } = parsed;
-  const datasetId = clientDatasetId ?? env.datasetId;
-  if (!datasetId) {
-    return next(
-      new common.ProsopoApiError("API.BAD_REQUEST", {
-        context: {
-          code: 400,
-          error: "No dataset available. Please upload a dataset first."
-        },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  validateAddress.validateSiteKey(dapp);
-  validateAddress.validateAddr(user);
-  if (apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
-    req.logger.info(() => ({
-      msg: "Maintenance mode active - returning dummy image challenge",
-      data: { dapp, user, sessionId }
-    }));
-    return res.json(maintenanceModeResponses.buildImageMaintenanceResponse());
-  }
-  const tasks$1 = new tasks.Tasks(env, req.logger);
-  try {
-    const clientRecord = await tasks$1.db.getClientRecord(dapp);
-    if (!clientRecord) {
-      return next(
-        new common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-          context: { code: 400, siteKey: dapp },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-    const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-    const userScope = blacklistRequestInspector.getRequestUserScope(
-      util.flatten(req.headers),
-      req.ja4,
-      normalizedIp,
-      user,
-      void 0,
-      // headHash
-      void 0,
-      // coords
-      countryCode,
-      asn
-    );
-    const userAccessPolicy = (await tasks$1.imgCaptchaManager.getPrioritisedAccessPolicies(
-      userAccessRulesStorage,
-      dapp,
-      userScope
-    )).find((p) => !p.deferToVerify);
-    const {
-      valid,
-      reason,
-      sessionId: validSessionId,
-      solvedImagesCount
-    } = await tasks$1.imgCaptchaManager.isValidRequest(
-      clientRecord,
-      types.CaptchaType.image,
-      env,
-      sessionId,
-      userAccessPolicy,
-      normalizedIp
-    );
-    if (!valid) {
-      return next(
-        new common.ProsopoApiError(reason || "API.BAD_REQUEST", {
-          context: {
-            code: 400,
-            siteKey: dapp,
-            user
-          },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const captchaConfig = {
-      solved: {
-        count: Math.min(
-          solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count,
-          clientRecord.settings.imageMaxRounds ?? types.imageMaxRoundsDefault
-        )
-      },
-      unsolved: {
-        count: userAccessPolicy?.unsolvedImagesCount || env.config.captchas.unsolved.count
-      }
-    };
-    if (validSessionId && simdReadings) {
-      await tasks$1.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(
-        validSessionId,
-        simdReadings,
-        types.SimdReadingsStage.challenge
-      ).catch((updateErr) => {
-        req.logger.warn(() => ({
-          err: updateErr,
-          msg: "Failed to patch session with SIMD readings on image challenge"
-        }));
-      });
-    }
-    const taskData = await tasks$1.imgCaptchaManager.getRandomCaptchasAndRequestHash(
-      datasetId,
-      user,
-      ipAddress,
-      captchaConfig,
-      clientRecord.settings.imageThreshold ?? 0.8,
-      validSessionId,
-      // Persist the full ipinfo payload — consumers read
-      // individual flags off this object instead of separate
-      // flat fields.
-      req.ipInfo
-    );
-    const captchaResponse = {
-      [types.ApiParams.status]: "ok",
-      [types.ApiParams.captchas]: taskData.captchas.map((captcha) => ({
-        ...captcha,
-        target: req.t(`TARGET.${captcha.target}`),
-        items: captcha.items.map(
-          (item) => datasets.parseCaptchaAssets(item, env.assetsResolver)
-        )
-      })),
-      [types.ApiParams.requestHash]: taskData.requestHash,
-      [types.ApiParams.timestamp]: taskData.timestamp.toString(),
-      [types.ApiParams.signature]: {
-        [types.ApiParams.provider]: {
-          [types.ApiParams.requestHash]: taskData.signedRequestHash
-        }
-      }
-    };
-    req.logger.info(() => ({
-      msg: "Image captcha challenge issued",
-      data: {
-        captchaType: types.CaptchaType.image,
-        requestHash: taskData.requestHash,
-        solvedImagesCount: captchaConfig.solved.count,
-        user,
-        dapp,
-        sessionId
-      }
-    }));
-    metrics.recordCaptchaIssued(types.CaptchaType.image);
-    return res.json(captchaResponse);
-  } catch (err) {
-    metrics.recordCaptchaIssueError(types.CaptchaType.image);
-    req.logger.error(() => ({
-      err,
-      data: req.params,
-      msg: "Error in image captcha challenge request"
-    }));
-    return next(
-      new common.ProsopoApiError("API.BAD_REQUEST", {
-        context: {
-          error: err,
-          code: 500,
-          params: req.params
-        },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
+const require_validateAddress = require("../validateAddress.cjs");
+const require_metrics = require("../metrics.cjs");
+const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const require_tasks = require("../../tasks/tasks.cjs");
+const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
+const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+let _prosopo_datasets = require("@prosopo/datasets");
+//#region src/api/captcha/getImageCaptchaChallenge.ts
+var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req, res, next) => {
+	let parsed;
+	const normalizedIp = require_normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
+	if (!normalizedIp) return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+		context: {
+			code: 400,
+			error: "IP address not found"
+		},
+		i18n: req.i18n,
+		logger: req.logger
+	}));
+	const ipAddress = (0, _prosopo_util.getIPAddress)(normalizedIp);
+	try {
+		parsed = _prosopo_types.CaptchaRequestBody.parse(req.body);
+	} catch (err) {
+		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const { datasetId: clientDatasetId, user, dapp, sessionId, simdReadings } = parsed;
+	const datasetId = clientDatasetId ?? env.datasetId;
+	if (!datasetId) return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+		context: {
+			code: 400,
+			error: "No dataset available. Please upload a dataset first."
+		},
+		i18n: req.i18n,
+		logger: req.logger
+	}));
+	require_validateAddress.validateSiteKey(dapp);
+	require_validateAddress.validateAddr(user);
+	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+		req.logger.info(() => ({
+			msg: "Maintenance mode active - returning dummy image challenge",
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(require_maintenanceModeResponses.buildImageMaintenanceResponse());
+	}
+	const tasks = new require_tasks.Tasks(env, req.logger);
+	try {
+		const clientRecord = await tasks.db.getClientRecord(dapp);
+		if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
+		const userAccessPolicy = (await tasks.imgCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)).find((p) => !p.deferToVerify);
+		const { valid, reason, sessionId: validSessionId, solvedImagesCount } = await tasks.imgCaptchaManager.isValidRequest(clientRecord, _prosopo_types.CaptchaType.image, env, sessionId, userAccessPolicy, normalizedIp);
+		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const captchaConfig = {
+			solved: { count: Math.min(solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count, clientRecord.settings.imageMaxRounds ?? _prosopo_types.imageMaxRoundsDefault) },
+			unsolved: { count: userAccessPolicy?.unsolvedImagesCount || env.config.captchas.unsolved.count }
+		};
+		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {
+			req.logger.warn(() => ({
+				err: updateErr,
+				msg: "Failed to patch session with SIMD readings on image challenge"
+			}));
+		});
+		const taskData = await tasks.imgCaptchaManager.getRandomCaptchasAndRequestHash(datasetId, user, ipAddress, captchaConfig, clientRecord.settings.imageThreshold ?? .8, validSessionId, req.ipInfo);
+		const captchaResponse = {
+			[_prosopo_types.ApiParams.status]: "ok",
+			[_prosopo_types.ApiParams.captchas]: taskData.captchas.map((captcha) => ({
+				...captcha,
+				target: req.t(`TARGET.${captcha.target}`),
+				items: captcha.items.map((item) => (0, _prosopo_datasets.parseCaptchaAssets)(item, env.assetsResolver))
+			})),
+			[_prosopo_types.ApiParams.requestHash]: taskData.requestHash,
+			[_prosopo_types.ApiParams.timestamp]: taskData.timestamp.toString(),
+			[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.requestHash]: taskData.signedRequestHash } }
+		};
+		req.logger.info(() => ({
+			msg: "Image captcha challenge issued",
+			data: {
+				captchaType: _prosopo_types.CaptchaType.image,
+				requestHash: taskData.requestHash,
+				solvedImagesCount: captchaConfig.solved.count,
+				user,
+				dapp,
+				sessionId
+			}
+		}));
+		require_metrics.recordCaptchaIssued(_prosopo_types.CaptchaType.image);
+		return res.json(captchaResponse);
+	} catch (err) {
+		require_metrics.recordCaptchaIssueError(_prosopo_types.CaptchaType.image);
+		req.logger.error(() => ({
+			err,
+			data: req.params,
+			msg: "Error in image captcha challenge request"
+		}));
+		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				error: err,
+				code: 500,
+				params: req.params
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
 };
-module.exports = getImageCaptchaChallenge;
+//#endregion
+exports.default = getImageCaptchaChallenge_default;