@prosopo/provider 4.15.14 → 4.15.16

package/dist/cjs/api/blacklistRequestInspector.cjs

@@ -1,391 +1,303 @@
-"use strict";
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const node_crypto = require("node:crypto");
-const types = require("@prosopo/types");
-const userAccessPolicy = require("@prosopo/user-access-policy");
-const compositeIpAddress = require("../compositeIpAddress.cjs");
-const hardBlockVerdictCache = require("./hardBlockVerdictCache.cjs");
-const metrics = require("./metrics.cjs");
-const getRequestUserScope = (requestHeaders, ja4, ip, user, headHash, coords, countryCode, asn) => {
-  const userAgent = requestHeaders["user-agent"] ? requestHeaders["user-agent"].toString() : void 0;
-  return {
-    ...user && { userId: user },
-    ...ja4 && { ja4Hash: ja4 },
-    ...userAgent && { userAgent },
-    ...ip && { ip },
-    ...headHash && { headHash },
-    ...coords && { coords },
-    ...countryCode && { countryCode },
-    ...typeof asn === "number" && { asn },
-    // Always populated (even "unknown") — derived from the request UA, not
-    // trusted from a client hint. Present unconditionally so an OS
-    // allow-list (block everything not on the list) still matches requests
-    // whose UA we can't classify.
-    os: userAccessPolicy.classifyOs(userAgent)
-  };
+const require_compositeIpAddress = require("../compositeIpAddress.cjs");
+const require_hardBlockVerdictCache = require("./hardBlockVerdictCache.cjs");
+const require_metrics = require("./metrics.cjs");
+let _prosopo_types = require("@prosopo/types");
+let node_crypto = require("node:crypto");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
+//#region src/api/blacklistRequestInspector.ts
+var getRequestUserScope = (requestHeaders, ja4, ip, user, headHash, coords, countryCode, asn) => {
+	const userAgent = requestHeaders["user-agent"] ? requestHeaders["user-agent"].toString() : void 0;
+	return {
+		...user && { userId: user },
+		...ja4 && { ja4Hash: ja4 },
+		...userAgent && { userAgent },
+		...ip && { ip },
+		...headHash && { headHash },
+		...coords && { coords },
+		...countryCode && { countryCode },
+		...typeof asn === "number" && { asn },
+		os: (0, _prosopo_user_access_policy.classifyOs)(userAgent)
+	};
 };
-const SCALAR_USER_SCOPE_FIELDS = [
-  "userId",
-  "ja4Hash",
-  "headersHash",
-  "userAgentHash",
-  "headHash",
-  "coords",
-  "countryCode",
-  "asn",
-  "os"
+var SCALAR_USER_SCOPE_FIELDS = [
+	"userId",
+	"ja4Hash",
+	"headersHash",
+	"userAgentHash",
+	"headHash",
+	"coords",
+	"countryCode",
+	"asn",
+	"os"
 ];
-const deriveRuleType = (rule) => {
-  const fields = [];
-  for (const f of SCALAR_USER_SCOPE_FIELDS) {
-    if (rule[f] !== void 0) {
-      fields.push(f);
-    }
-  }
-  if (rule.numericIp !== void 0) {
-    fields.push("ip");
-  } else if (rule.numericIpMaskMin !== void 0 && rule.numericIpMaskMax !== void 0) {
-    fields.push("ipMask");
-  }
-  return fields;
+var deriveRuleType = (rule) => {
+	const fields = [];
+	for (const f of SCALAR_USER_SCOPE_FIELDS) if (rule[f] !== void 0) fields.push(f);
+	if (rule.numericIp !== void 0) fields.push("ip");
+	else if (rule.numericIpMaskMin !== void 0 && rule.numericIpMaskMax !== void 0) fields.push("ipMask");
+	return fields;
 };
-const sanitizeRequestHeaders = (headers) => {
-  const out = {};
-  for (const [k, v] of Object.entries(headers)) {
-    if (typeof v === "string") {
-      out[k] = v;
-    } else if (Array.isArray(v)) {
-      out[k] = v.map((x) => String(x)).join(", ");
-    }
-  }
-  return out;
+var sanitizeRequestHeaders = (headers) => {
+	const out = {};
+	for (const [k, v] of Object.entries(headers)) if (typeof v === "string") out[k] = v;
+	else if (Array.isArray(v)) out[k] = v.map((x) => String(x)).join(", ");
+	return out;
 };
-const ruleHasIpConstraint = (rule) => rule.numericIp !== void 0 || rule.numericIpMaskMin !== void 0 && rule.numericIpMaskMax !== void 0;
-const ruleIpMatchesRequest = (rule, requestIp) => {
-  if (!ruleHasIpConstraint(rule)) {
-    return true;
-  }
-  if (requestIp === void 0) {
-    return false;
-  }
-  if (rule.numericIp !== void 0) {
-    return requestIp === rule.numericIp;
-  }
-  return requestIp >= rule.numericIpMaskMin && requestIp <= rule.numericIpMaskMax;
+var ruleHasIpConstraint = (rule) => rule.numericIp !== void 0 || rule.numericIpMaskMin !== void 0 && rule.numericIpMaskMax !== void 0;
+var ruleIpMatchesRequest = (rule, requestIp) => {
+	if (!ruleHasIpConstraint(rule)) return true;
+	if (requestIp === void 0) return false;
+	if (rule.numericIp !== void 0) return requestIp === rule.numericIp;
+	return requestIp >= rule.numericIpMaskMin && requestIp <= rule.numericIpMaskMax;
 };
-const ruleApplies = (rule, request, requestClientId) => {
-  if (rule.clientId !== void 0 && rule.clientId !== requestClientId) {
-    return false;
-  }
-  for (const field of SCALAR_USER_SCOPE_FIELDS) {
-    const ruleValue = rule[field];
-    if (ruleValue === void 0) {
-      continue;
-    }
-    if (ruleValue !== request[field]) {
-      return false;
-    }
-  }
-  return ruleIpMatchesRequest(rule, request.numericIp);
+var ruleApplies = (rule, request, requestClientId) => {
+	if (rule.clientId !== void 0 && rule.clientId !== requestClientId) return false;
+	for (const field of SCALAR_USER_SCOPE_FIELDS) {
+		const ruleValue = rule[field];
+		if (ruleValue === void 0) continue;
+		if (ruleValue !== request[field]) return false;
+	}
+	return ruleIpMatchesRequest(rule, request.numericIp);
 };
-const ruleSpecificity = (rule, requestClientId) => {
-  let score = 0;
-  if (rule.clientId !== void 0 && rule.clientId === requestClientId) {
-    score += 1;
-  }
-  for (const field of SCALAR_USER_SCOPE_FIELDS) {
-    if (rule[field] !== void 0) {
-      score += 1;
-    }
-  }
-  if (ruleHasIpConstraint(rule)) {
-    score += 1;
-  }
-  return score;
+var ruleSpecificity = (rule, requestClientId) => {
+	let score = 0;
+	if (rule.clientId !== void 0 && rule.clientId === requestClientId) score += 1;
+	for (const field of SCALAR_USER_SCOPE_FIELDS) if (rule[field] !== void 0) score += 1;
+	if (ruleHasIpConstraint(rule)) score += 1;
+	return score;
 };
-const CAPTCHA_TYPE_HARSHNESS = {
-  [types.CaptchaType.image]: 30,
-  [types.CaptchaType.puzzle]: 20,
-  [types.CaptchaType.pow]: 10,
-  // Frictionless isn't a routing target for Restrict rules but include it
-  // so the Record is total over CaptchaType — keeps the type-checker honest
-  // if the enum grows. Restrict-with-frictionless wouldn't make operational
-  // sense and ranks at the bottom of the captcha tiers if it ever appears.
-  [types.CaptchaType.frictionless]: 0
+var CAPTCHA_TYPE_HARSHNESS = {
+	[_prosopo_types.CaptchaType.image]: 30,
+	[_prosopo_types.CaptchaType.puzzle]: 20,
+	[_prosopo_types.CaptchaType.pow]: 10,
+	[_prosopo_types.CaptchaType.frictionless]: 0
 };
-const ruleHarshness = (rule) => {
-  if (rule.type === userAccessPolicy.AccessPolicyType.Block) {
-    return Number.MAX_SAFE_INTEGER;
-  }
-  if (rule.captchaType === void 0) {
-    return 0;
-  }
-  const base = CAPTCHA_TYPE_HARSHNESS[rule.captchaType];
-  const rounds = rule.solvedImagesCount ?? 0;
-  return base + rounds;
+var ruleHarshness = (rule) => {
+	if (rule.type === _prosopo_user_access_policy.AccessPolicyType.Block) return Number.MAX_SAFE_INTEGER;
+	if (rule.captchaType === void 0) return 0;
+	return CAPTCHA_TYPE_HARSHNESS[rule.captchaType] + (rule.solvedImagesCount ?? 0);
 };
-const rankCandidateRules = (rules, request, requestClientId) => rules.filter((rule) => ruleApplies(rule, request, requestClientId)).sort((a, b) => {
-  const specDelta = ruleSpecificity(b, requestClientId) - ruleSpecificity(a, requestClientId);
-  if (specDelta !== 0) {
-    return specDelta;
-  }
-  return ruleHarshness(b) - ruleHarshness(a);
+/**
+* Rank the candidate rules a single Redis query returned. A rule "applies" iff
+* every populated field on the rule equals the corresponding request field
+* (IP fields use range semantics).
+*
+* Ordering: specificity DESC primary, harshness DESC as the equal-specificity
+* tiebreaker (issue #3713). The most specific applicable rule wins; on tie,
+* the harshest matching rule wins — Block > Restrict[image, rounds DESC] >
+* Restrict[puzzle] > Restrict[pow]. Client-scoped rules outrank global rules
+* of equal user-scope specificity.
+*/
+var rankCandidateRules = (rules, request, requestClientId) => rules.filter((rule) => ruleApplies(rule, request, requestClientId)).sort((a, b) => {
+	const specDelta = ruleSpecificity(b, requestClientId) - ruleSpecificity(a, requestClientId);
+	if (specDelta !== 0) return specDelta;
+	return ruleHarshness(b) - ruleHarshness(a);
 });
-const verdictCache = new hardBlockVerdictCache.HardBlockVerdictCache();
-const getVerdictCache = () => verdictCache;
-const REQUEST_MEMO_SYMBOL = Symbol.for("prosopo.accessRuleRequestMemo");
-const getOrCreateRequestMemo = (requestMemoHost) => {
-  let memo = requestMemoHost[REQUEST_MEMO_SYMBOL];
-  if (memo === void 0) {
-    memo = /* @__PURE__ */ new Map();
-    requestMemoHost[REQUEST_MEMO_SYMBOL] = memo;
-  }
-  return memo;
+/**
+* Fetch the access rules that apply to a request, most specific first.
+*
+* Evolution of this lookup:
+*
+*  - Original: 2 × (2^n − 1) `FT.SEARCH` round trips, one per non-empty
+*    subset of the populated user-scope fields × {clientId, undefined}.
+*    n=6 fields ⇒ 126 RTTs per request.
+*  - #2657 (greedy): one OR-of-fields `FT.SEARCH`, JS-side rank picks
+*    the most-specific. 1 RTT but pulled hundreds of irrelevant hashes
+*    every request.
+*  - #2689 / 3.6.38: greedy + FT.AGGREGATE+CURSOR to defeat the silent
+*    1000-cap truncation. Tipped CPU into 125% peg in production.
+*  - 3.6.38.1 hotfix: reverted to greedy + FT.SEARCH (this file's old
+*    shape with the truncation bug back).
+*  - Now (this fix): strict-match query so every returned candidate
+*    actually applies, with specificity ranked server-side via
+*    FT.AGGREGATE+APPLY+SORTBY+LIMIT in the storage layer. Node receives
+*    at most 20 already-ranked rules — no JS sort needed for
+*    correctness, but `rankCandidateRules` is kept as defence so any
+*    mismatch between the Redis-side score and the JS semantics surfaces
+*    as ordering rather than letting traffic through.
+*/
+var verdictCache = new require_hardBlockVerdictCache.HardBlockVerdictCache();
+var getVerdictCache = () => verdictCache;
+var REQUEST_MEMO_SYMBOL = Symbol.for("prosopo.accessRuleRequestMemo");
+var getOrCreateRequestMemo = (requestMemoHost) => {
+	let memo = requestMemoHost[REQUEST_MEMO_SYMBOL];
+	if (memo === void 0) {
+		memo = /* @__PURE__ */ new Map();
+		requestMemoHost[REQUEST_MEMO_SYMBOL] = memo;
+	}
+	return memo;
 };
-const getPrioritisedAccessRule = async (userAccessRulesStorage, userScope, clientId, options) => {
-  const parsedUserScope = userAccessPolicy.userScopeInput.parse(userScope);
-  const blockOnly = options?.blockOnly ?? false;
-  const skipCache = options?.skipCache ?? false;
-  const requestMemoHost = options?.requestMemoHost;
-  const cacheKey = hardBlockVerdictCache.hardBlockCacheKey(clientId, parsedUserScope, blockOnly);
-  const requestMemo = requestMemoHost ? getOrCreateRequestMemo(requestMemoHost) : void 0;
-  if (requestMemo !== void 0) {
-    const memoHit = requestMemo.get(cacheKey);
-    if (memoHit !== void 0) {
-      return memoHit;
-    }
-  }
-  const filter = {
-    ...clientId && {
-      policyScope: {
-        clientId
-      }
-    },
-    policyScopeMatch: userAccessPolicy.FilterScopeMatch.Greedy,
-    userScope: parsedUserScope,
-    userScopeMatch: userAccessPolicy.FilterScopeMatch.Greedy,
-    ...blockOnly && { blockOnly: true }
-  };
-  const compute = async () => {
-    const candidates = await userAccessRulesStorage.findRules(
-      filter,
-      true,
-      // matchingFieldsOnly — engages the split-query hot path
-      true
-    );
-    return rankCandidateRules(candidates, parsedUserScope, clientId);
-  };
-  let ranked;
-  if (skipCache) {
-    ranked = await compute();
-  } else {
-    ranked = await verdictCache.getOrCompute(cacheKey, compute);
-  }
-  requestMemo?.set(cacheKey, ranked);
-  return ranked;
+var getPrioritisedAccessRule = async (userAccessRulesStorage, userScope, clientId, options) => {
+	const parsedUserScope = _prosopo_user_access_policy.userScopeInput.parse(userScope);
+	const blockOnly = options?.blockOnly ?? false;
+	const skipCache = options?.skipCache ?? false;
+	const requestMemoHost = options?.requestMemoHost;
+	const cacheKey = require_hardBlockVerdictCache.hardBlockCacheKey(clientId, parsedUserScope, blockOnly);
+	const requestMemo = requestMemoHost ? getOrCreateRequestMemo(requestMemoHost) : void 0;
+	if (requestMemo !== void 0) {
+		const memoHit = requestMemo.get(cacheKey);
+		if (memoHit !== void 0) return memoHit;
+	}
+	const filter = {
+		...clientId && { policyScope: { clientId } },
+		policyScopeMatch: _prosopo_user_access_policy.FilterScopeMatch.Greedy,
+		userScope: parsedUserScope,
+		userScopeMatch: _prosopo_user_access_policy.FilterScopeMatch.Greedy,
+		...blockOnly && { blockOnly: true }
+	};
+	const compute = async () => {
+		return rankCandidateRules(await userAccessRulesStorage.findRules(filter, true, true), parsedUserScope, clientId);
+	};
+	let ranked;
+	if (skipCache) ranked = await compute();
+	else ranked = await verdictCache.getOrCompute(cacheKey, compute);
+	requestMemo?.set(cacheKey, ranked);
+	return ranked;
 };
-class BlacklistRequestInspector {
-  constructor(userAccessRulesStorage, environmentReadinessWaiter, db) {
-    this.userAccessRulesStorage = userAccessRulesStorage;
-    this.environmentReadinessWaiter = environmentReadinessWaiter;
-    this.db = db;
-  }
-  async abortRequestForBlockedUsers(request, res, next) {
-    const rawIp = request.ip || "";
-    request.logger.debug(() => ({
-      data: { ja4: request.ja4 }
-    }));
-    const shouldAbortRequest = await this.shouldAbortRequest(
-      request.url,
-      rawIp,
-      request.ja4,
-      request.headers,
-      request.body,
-      request.logger,
-      request.ipInfo,
-      // Share the per-request memo so a downstream captcha task
-      // hitting checkForHardBlock in the same request reuses this
-      // lookup rather than re-querying Redis.
-      request
-    );
-    if (shouldAbortRequest) {
-      res.status(403).json({ error: "Forbidden" });
-      return;
-    }
-    next();
-  }
-  async shouldAbortRequest(requestedRoute, rawIp, ja4, requestHeaders, requestBody, logger, ipInfo, requestMemoHost) {
-    if (this.isApiUnrelatedRoute(requestedRoute)) {
-      return false;
-    }
-    if (!rawIp) {
-      logger.info(() => ({
-        data: {
-          requestedRoute,
-          requestHeaders,
-          requestBody
-        },
-        msg: "Request without IP"
-      }));
-      metrics.recordBlockedRequest("no_ip");
-      return true;
-    }
-    await this.environmentReadinessWaiter();
-    try {
-      const { userId, clientId } = this.extractIdsFromRequest(
-        requestHeaders,
-        requestBody
-      );
-      const countryCode = ipInfo?.isValid ? ipInfo.countryCode : void 0;
-      const asn = ipInfo?.isValid ? ipInfo.asnNumber : void 0;
-      const accessPolicies = await getPrioritisedAccessRule(
-        this.userAccessRulesStorage,
-        getRequestUserScope(
-          requestHeaders,
-          ja4,
-          rawIp,
-          userId,
-          void 0,
-          // headHash
-          void 0,
-          // coords
-          countryCode,
-          asn
-        ),
-        clientId,
-        // Request-time middleware only ever fires on Block policies
-        // (Restrict rules flow through and let the captcha-creation
-        // path decorate the response). Restrict the Redis-side
-        // candidate pool so the SERVER_SIDE_RANK_TOP_N cap can't
-        // crowd out hard-block rules in clients with dense Restrict
-        // rule populations.
-        { blockOnly: true, requestMemoHost }
-      );
-      const enforceable = (accessPolicies ?? []).filter(
-        (p) => !p.deferToVerify
-      );
-      if (enforceable.length === 0 || !enforceable[0]) {
-        return false;
-      }
-      const accessPolicy = enforceable[0];
-      const isBlock = userAccessPolicy.AccessPolicyType.Block === accessPolicy.type;
-      if (isBlock) {
-        metrics.recordBlockedRequest("access_policy");
-        this.recordBlockDecision(
-          accessPolicy,
-          {
-            userId,
-            clientId,
-            rawIp,
-            ja4,
-            requestHeaders,
-            ipInfo,
-            countryCode,
-            asn
-          },
-          logger
-        );
-      }
-      return isBlock;
-    } catch (err) {
-      logger.error(() => ({
-        err,
-        msg: "Block Middleware Error"
-      }));
-      metrics.recordBlockedRequest("error");
-      return true;
-    }
-  }
-  /**
-   * Emit a structured log line and (if a DB is wired) persist a synthetic
-   * Session record for the request we're about to block (403). Fire-and-forget on
-   * the Mongo side — the structured log line is the source of truth and
-   * the 403 response is never delayed by a persistence failure.
-   *
-   * Carries the matched rule's identity (hash + ruleType + description)
-   * so the Traffic page can surface "what's blocking traffic for this
-   * site" without re-reading the rules collection.
-   */
-  recordBlockDecision(accessPolicy, ctx, logger) {
-    const ruleHash = userAccessPolicy.makeAccessRuleHash(accessPolicy);
-    const ruleType = deriveRuleType(accessPolicy);
-    const ruleDescription = accessPolicy.description;
-    const userAgent = typeof ctx.requestHeaders["user-agent"] === "string" ? ctx.requestHeaders["user-agent"] : void 0;
-    logger.info(() => ({
-      msg: "Access policy block",
-      data: {
-        ruleHash,
-        ruleType,
-        ruleDescription,
-        policyType: accessPolicy.type,
-        clientId: ctx.clientId,
-        userScope: {
-          userId: ctx.userId,
-          ja4: ctx.ja4,
-          ip: ctx.rawIp,
-          userAgent,
-          countryCode: ctx.countryCode,
-          asn: ctx.asn,
-          os: userAccessPolicy.classifyOs(userAgent)
-        }
-      }
-    }));
-    if (!this.db) {
-      return;
-    }
-    const ipAddress = ctx.rawIp ? compositeIpAddress.getCompositeIpAddress(ctx.rawIp) : void 0;
-    if (!ipAddress) {
-      return;
-    }
-    const headers = sanitizeRequestHeaders(ctx.requestHeaders);
-    const session = {
-      sessionId: `blocked-${node_crypto.randomUUID()}`,
-      createdAt: /* @__PURE__ */ new Date(),
-      // Sentinel values for schema-required fields the blocked request
-      // never reached the point of populating.
-      token: "",
-      score: 1,
-      threshold: 0,
-      scoreComponents: { baseScore: 1 },
-      captchaType: types.CaptchaType.frictionless,
-      webView: false,
-      iFrame: false,
-      decryptedHeadHash: "",
-      // Real data the inspector did collect.
-      siteKey: ctx.clientId,
-      ipAddress,
-      ipInfo: ctx.ipInfo,
-      headers,
-      reason: types.FrictionlessReason.ACCESS_POLICY_BLOCK,
-      result: {
-        status: types.CaptchaStatus.disapproved,
-        reason: types.ResultReason.ACCESS_POLICY_BLOCK
-      },
-      // Rule identity — the whole point of writing this record.
-      ruleHash,
-      ruleType,
-      ruleDescription
-      // blocked + deleted are stamped inside storeBlockedSession so
-      // the synthetic record is unmistakably a block-middleware
-      // artefact and can never be picked up by the captcha flow.
-    };
-    void this.db.storeBlockedSession(session);
-  }
-  isApiUnrelatedRoute(url) {
-    return !url.includes(types.ApiPrefix);
-  }
-  extractIdsFromRequest(requestHeaders, requestBody) {
-    const userId = this.getObjectValue(requestHeaders, "Prosopo-User") || this.getObjectValue(requestBody, "user");
-    const clientId = this.getObjectValue(requestHeaders, "Prosopo-Site-Key") || this.getObjectValue(requestBody, "dapp");
-    return {
-      userId: "string" === typeof userId ? userId : void 0,
-      clientId: "string" === typeof clientId ? clientId : void 0
-    };
-  }
-  getObjectValue(object, key) {
-    return object[key];
-  }
-}
+var BlacklistRequestInspector = class {
+	constructor(userAccessRulesStorage, environmentReadinessWaiter, db) {
+		this.userAccessRulesStorage = userAccessRulesStorage;
+		this.environmentReadinessWaiter = environmentReadinessWaiter;
+		this.db = db;
+	}
+	async abortRequestForBlockedUsers(request, res, next) {
+		const rawIp = request.ip || "";
+		request.logger.debug(() => ({ data: { ja4: request.ja4 } }));
+		if (await this.shouldAbortRequest(request.url, rawIp, request.ja4, request.headers, request.body, request.logger, request.ipInfo, request)) {
+			res.status(403).json({ error: "Forbidden" });
+			return;
+		}
+		next();
+	}
+	async shouldAbortRequest(requestedRoute, rawIp, ja4, requestHeaders, requestBody, logger, ipInfo, requestMemoHost) {
+		if (this.isApiUnrelatedRoute(requestedRoute)) return false;
+		if (!rawIp) {
+			logger.info(() => ({
+				data: {
+					requestedRoute,
+					requestHeaders,
+					requestBody
+				},
+				msg: "Request without IP"
+			}));
+			require_metrics.recordBlockedRequest("no_ip");
+			return true;
+		}
+		await this.environmentReadinessWaiter();
+		try {
+			const { userId, clientId } = this.extractIdsFromRequest(requestHeaders, requestBody);
+			const countryCode = ipInfo?.isValid ? ipInfo.countryCode : void 0;
+			const asn = ipInfo?.isValid ? ipInfo.asnNumber : void 0;
+			const enforceable = (await getPrioritisedAccessRule(this.userAccessRulesStorage, getRequestUserScope(requestHeaders, ja4, rawIp, userId, void 0, void 0, countryCode, asn), clientId, {
+				blockOnly: true,
+				requestMemoHost
+			}) ?? []).filter((p) => !p.deferToVerify);
+			if (enforceable.length === 0 || !enforceable[0]) return false;
+			const accessPolicy = enforceable[0];
+			const isBlock = _prosopo_user_access_policy.AccessPolicyType.Block === accessPolicy.type;
+			if (isBlock) {
+				require_metrics.recordBlockedRequest("access_policy");
+				this.recordBlockDecision(accessPolicy, {
+					userId,
+					clientId,
+					rawIp,
+					ja4,
+					requestHeaders,
+					ipInfo,
+					countryCode,
+					asn
+				}, logger);
+			}
+			return isBlock;
+		} catch (err) {
+			logger.error(() => ({
+				err,
+				msg: "Block Middleware Error"
+			}));
+			require_metrics.recordBlockedRequest("error");
+			return true;
+		}
+	}
+	/**
+	* Emit a structured log line and (if a DB is wired) persist a synthetic
+	* Session record for the request we're about to block (403). Fire-and-forget on
+	* the Mongo side — the structured log line is the source of truth and
+	* the 403 response is never delayed by a persistence failure.
+	*
+	* Carries the matched rule's identity (hash + ruleType + description)
+	* so the Traffic page can surface "what's blocking traffic for this
+	* site" without re-reading the rules collection.
+	*/
+	recordBlockDecision(accessPolicy, ctx, logger) {
+		const ruleHash = (0, _prosopo_user_access_policy.makeAccessRuleHash)(accessPolicy);
+		const ruleType = deriveRuleType(accessPolicy);
+		const ruleDescription = accessPolicy.description;
+		const userAgent = typeof ctx.requestHeaders["user-agent"] === "string" ? ctx.requestHeaders["user-agent"] : void 0;
+		logger.info(() => ({
+			msg: "Access policy block",
+			data: {
+				ruleHash,
+				ruleType,
+				ruleDescription,
+				policyType: accessPolicy.type,
+				clientId: ctx.clientId,
+				userScope: {
+					userId: ctx.userId,
+					ja4: ctx.ja4,
+					ip: ctx.rawIp,
+					userAgent,
+					countryCode: ctx.countryCode,
+					asn: ctx.asn,
+					os: (0, _prosopo_user_access_policy.classifyOs)(userAgent)
+				}
+			}
+		}));
+		if (!this.db) return;
+		const ipAddress = ctx.rawIp ? require_compositeIpAddress.getCompositeIpAddress(ctx.rawIp) : void 0;
+		if (!ipAddress) return;
+		const headers = sanitizeRequestHeaders(ctx.requestHeaders);
+		const session = {
+			sessionId: `blocked-${(0, node_crypto.randomUUID)()}`,
+			createdAt: /* @__PURE__ */ new Date(),
+			token: "",
+			score: 1,
+			threshold: 0,
+			scoreComponents: { baseScore: 1 },
+			captchaType: _prosopo_types.CaptchaType.frictionless,
+			webView: false,
+			iFrame: false,
+			decryptedHeadHash: "",
+			siteKey: ctx.clientId,
+			ipAddress,
+			ipInfo: ctx.ipInfo,
+			headers,
+			reason: _prosopo_types.FrictionlessReason.ACCESS_POLICY_BLOCK,
+			result: {
+				status: _prosopo_types.CaptchaStatus.disapproved,
+				reason: _prosopo_types.ResultReason.ACCESS_POLICY_BLOCK
+			},
+			ruleHash,
+			ruleType,
+			ruleDescription
+		};
+		this.db.storeBlockedSession(session);
+	}
+	isApiUnrelatedRoute(url) {
+		return !url.includes(_prosopo_types.ApiPrefix);
+	}
+	extractIdsFromRequest(requestHeaders, requestBody) {
+		const userId = this.getObjectValue(requestHeaders, "Prosopo-User") || this.getObjectValue(requestBody, "user");
+		const clientId = this.getObjectValue(requestHeaders, "Prosopo-Site-Key") || this.getObjectValue(requestBody, "dapp");
+		return {
+			userId: "string" === typeof userId ? userId : void 0,
+			clientId: "string" === typeof clientId ? clientId : void 0
+		};
+	}
+	getObjectValue(object, key) {
+		return object[key];
+	}
+};
+//#endregion
 exports.BlacklistRequestInspector = BlacklistRequestInspector;
 exports.getPrioritisedAccessRule = getPrioritisedAccessRule;
 exports.getRequestUserScope = getRequestUserScope;