@prosopo/provider 4.15.14 → 4.15.16

package/dist/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.js

@@ -1,17 +1,20 @@
 import { encodeHoneypotQuestion } from "../../../utils/honeypot/encoders.js";
 import { getRandomPhrase } from "../../../utils/honeypot/phraseBank.js";
-const HONEYPOT_HEADER = "x-prosopo-meta";
-const attachHoneypot = (res, clientRecord) => {
-  const cfg = clientRecord.settings?.honeypot;
-  if (!cfg?.enabled) return;
-  const question = cfg.question ?? getRandomPhrase();
-  if (!question) return;
-  res.setHeader(
-    HONEYPOT_HEADER,
-    encodeHoneypotQuestion(question, cfg.encodingType)
-  );
-};
-export {
-  HONEYPOT_HEADER,
-  attachHoneypot
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/honeypotResponse.ts
+var HONEYPOT_HEADER = "x-prosopo-meta";
+/**
+* Sets the honeypot header on the response when the client has honeypot
+* enabled. Header value is base64-wrapped morse/semaphore so an inspector
+* doesn't immediately recognise the encoding shape. Falls back to a random
+* phrase from the bank when no custom question is configured; no-op when
+* the bank is empty or honeypot is disabled.
+*/
+var attachHoneypot = (res, clientRecord) => {
+	const cfg = clientRecord.settings?.honeypot;
+	if (!cfg?.enabled) return;
+	const question = cfg.question ?? getRandomPhrase();
+	if (!question) return;
+	res.setHeader(HONEYPOT_HEADER, encodeHoneypotQuestion(question, cfg.encodingType));
 };
+//#endregion
+export { HONEYPOT_HEADER, attachHoneypot };

package/dist/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.js

@@ -1,28 +1,28 @@
-const resolveSessionDedup = async (tasks, token, userSitekeyIpHash, logger) => {
-  const [existingToken, existingSession] = await Promise.all([
-    tasks.db.getSessionRecordByToken(token),
-    tasks.db.getSessionByuserSitekeyIpHash(userSitekeyIpHash)
-  ]);
-  const dedup = existingSession ? {
-    sessionId: existingSession.sessionId,
-    captchaType: existingSession.captchaType,
-    session: existingSession
-  } : null;
-  if (!dedup && tasks.writeQueue) {
-    const stalePointer = await tasks.writeQueue.getCachedSessionByHash(userSitekeyIpHash);
-    if (stalePointer) {
-      logger.warn(() => ({
-        msg: "Evicting stale Redis dedup pointer",
-        data: { userSitekeyIpHash, staleSessionId: stalePointer }
-      }));
-      await Promise.all([
-        tasks.writeQueue.invalidateCachedSessionByHash(userSitekeyIpHash),
-        tasks.writeQueue.invalidateCachedSession(stalePointer)
-      ]);
-    }
-  }
-  return { existingToken, dedup };
-};
-export {
-  resolveSessionDedup
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/sessionDedup.ts
+var resolveSessionDedup = async (tasks, token, userSitekeyIpHash, logger) => {
+	const [existingToken, existingSession] = await Promise.all([tasks.db.getSessionRecordByToken(token), tasks.db.getSessionByuserSitekeyIpHash(userSitekeyIpHash)]);
+	const dedup = existingSession ? {
+		sessionId: existingSession.sessionId,
+		captchaType: existingSession.captchaType,
+		session: existingSession
+	} : null;
+	if (!dedup && tasks.writeQueue) {
+		const stalePointer = await tasks.writeQueue.getCachedSessionByHash(userSitekeyIpHash);
+		if (stalePointer) {
+			logger.warn(() => ({
+				msg: "Evicting stale Redis dedup pointer",
+				data: {
+					userSitekeyIpHash,
+					staleSessionId: stalePointer
+				}
+			}));
+			await Promise.all([tasks.writeQueue.invalidateCachedSessionByHash(userSitekeyIpHash), tasks.writeQueue.invalidateCachedSession(stalePointer)]);
+		}
+	}
+	return {
+		existingToken,
+		dedup
+	};
 };
+//#endregion
+export { resolveSessionDedup };

package/dist/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.js

@@ -1,65 +1,44 @@
-import { CaptchaType } from "@prosopo/types";
-import { DEFAULT_FRICTIONLESS_THRESHOLD } from "./constants.js";
 import { attachHoneypot } from "./honeypotResponse.js";
-const runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
-  const configuredType = input.clientRecord.settings?.captchaType;
-  if (!configuredType || configuredType === CaptchaType.frictionless) {
-    return null;
-  }
-  const sessionParams = {
-    token: input.token,
-    score: 0,
-    threshold: input.clientRecord.settings?.frictionlessThreshold ?? DEFAULT_FRICTIONLESS_THRESHOLD,
-    scoreComponents: { baseScore: 0 },
-    ipAddress: input.ipAddress,
-    webView: false,
-    iFrame: false,
-    decryptedHeadHash: "",
-    siteKey: input.dapp,
-    ipInfo: input.ipInfo,
-    headers: input.flatHeaders,
-    mode: input.sessionMode,
-    userSitekeyIpHash: input.userSitekeyIpHash,
-    ...input.tcpToChelloUs !== void 0 && {
-      tcpToChelloUs: input.tcpToChelloUs
-    },
-    ...input.chelloToHandshakeUs !== void 0 && {
-      chelloToHandshakeUs: input.chelloToHandshakeUs
-    }
-  };
-  input.logger.info(() => ({
-    msg: "Frictionless decision",
-    data: {
-      decision: "configured_captcha_type",
-      captchaType: configuredType
-    }
-  }));
-  attachHoneypot(res, input.clientRecord);
-  switch (configuredType) {
-    case CaptchaType.image:
-      return res.json(
-        await input.tasks.frictionlessManager.sendImageCaptcha({
-          ...sessionParams,
-          solvedImagesCount: Math.min(
-            input.env.config.captchas.solved.count,
-            input.clientRecord.settings.imageMaxRounds
-          )
-        })
-      );
-    case CaptchaType.pow:
-      return res.json(
-        await input.tasks.frictionlessManager.sendPowCaptcha(sessionParams)
-      );
-    case CaptchaType.puzzle:
-      return res.json(
-        await input.tasks.frictionlessManager.sendPuzzleCaptcha(sessionParams)
-      );
-    default:
-      throw new Error(
-        `Unhandled configured captchaType in /frictionless short-circuit: ${configuredType}`
-      );
-  }
-};
-export {
-  runConfiguredCaptchaTypeShortCircuit
+import "./constants.js";
+import { CaptchaType } from "@prosopo/types";
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.ts
+var runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
+	const configuredType = input.clientRecord.settings?.captchaType;
+	if (!configuredType || configuredType === CaptchaType.frictionless) return null;
+	const sessionParams = {
+		token: input.token,
+		score: 0,
+		threshold: input.clientRecord.settings?.frictionlessThreshold ?? .5,
+		scoreComponents: { baseScore: 0 },
+		ipAddress: input.ipAddress,
+		webView: false,
+		iFrame: false,
+		decryptedHeadHash: "",
+		siteKey: input.dapp,
+		ipInfo: input.ipInfo,
+		headers: input.flatHeaders,
+		mode: input.sessionMode,
+		userSitekeyIpHash: input.userSitekeyIpHash,
+		...input.tcpToChelloUs !== void 0 && { tcpToChelloUs: input.tcpToChelloUs },
+		...input.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: input.chelloToHandshakeUs }
+	};
+	input.logger.info(() => ({
+		msg: "Frictionless decision",
+		data: {
+			decision: "configured_captcha_type",
+			captchaType: configuredType
+		}
+	}));
+	attachHoneypot(res, input.clientRecord);
+	switch (configuredType) {
+		case CaptchaType.image: return res.json(await input.tasks.frictionlessManager.sendImageCaptcha({
+			...sessionParams,
+			solvedImagesCount: Math.min(input.env.config.captchas.solved.count, input.clientRecord.settings.imageMaxRounds)
+		}));
+		case CaptchaType.pow: return res.json(await input.tasks.frictionlessManager.sendPowCaptcha(sessionParams));
+		case CaptchaType.puzzle: return res.json(await input.tasks.frictionlessManager.sendPuzzleCaptcha(sessionParams));
+		default: throw new Error(`Unhandled configured captchaType in /frictionless short-circuit: ${configuredType}`);
+	}
 };
+//#endregion
+export { runConfiguredCaptchaTypeShortCircuit };

package/dist/api/captcha/getFrictionlessCaptchaChallenge.js

@@ -1,4 +1,2 @@
-import { default as default2 } from "./getFrictionlessCaptchaChallenge/handler.js";
-export {
-  default2 as default
-};
+import handler_default from "./getFrictionlessCaptchaChallenge/handler.js";
+export { handler_default as default };

package/dist/api/captcha/getImageCaptchaChallenge.js

@@ -1,210 +1,139 @@
-import { ProsopoApiError } from "@prosopo/common";
-import { parseCaptchaAssets } from "@prosopo/datasets";
-import { CaptchaRequestBody, CaptchaType, imageMaxRoundsDefault, SimdReadingsStage, ApiParams } from "@prosopo/types";
-import { getIPAddress, flatten } from "@prosopo/util";
-import "../../tasks/index.js";
-import { normalizeRequestIp } from "../../utils/normalizeRequestIp.js";
-import { getMaintenanceMode } from "../admin/apiToggleMaintenanceModeEndpoint.js";
+import { validateAddr, validateSiteKey } from "../validateAddress.js";
+import { recordCaptchaIssueError, recordCaptchaIssued } from "../metrics.js";
 import { getRequestUserScope } from "../blacklistRequestInspector.js";
-import { recordCaptchaIssued, recordCaptchaIssueError } from "../metrics.js";
-import { validateSiteKey, validateAddr } from "../validateAddress.js";
-import { buildImageMaintenanceResponse } from "./maintenanceModeResponses.js";
 import { Tasks } from "../../tasks/tasks.js";
-const getImageCaptchaChallenge = (env, userAccessRulesStorage) => async (req, res, next) => {
-  let parsed;
-  const normalizedIp = normalizeRequestIp(req.ip, req.logger);
-  if (!normalizedIp) {
-    return next(
-      new ProsopoApiError("API.BAD_REQUEST", {
-        context: { code: 400, error: "IP address not found" },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  const ipAddress = getIPAddress(normalizedIp);
-  try {
-    parsed = CaptchaRequestBody.parse(req.body);
-  } catch (err) {
-    return next(
-      new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-        context: { code: 400, error: err },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  const {
-    datasetId: clientDatasetId,
-    user,
-    dapp,
-    sessionId,
-    simdReadings
-  } = parsed;
-  const datasetId = clientDatasetId ?? env.datasetId;
-  if (!datasetId) {
-    return next(
-      new ProsopoApiError("API.BAD_REQUEST", {
-        context: {
-          code: 400,
-          error: "No dataset available. Please upload a dataset first."
-        },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-  validateSiteKey(dapp);
-  validateAddr(user);
-  if (getMaintenanceMode()) {
-    req.logger.info(() => ({
-      msg: "Maintenance mode active - returning dummy image challenge",
-      data: { dapp, user, sessionId }
-    }));
-    return res.json(buildImageMaintenanceResponse());
-  }
-  const tasks = new Tasks(env, req.logger);
-  try {
-    const clientRecord = await tasks.db.getClientRecord(dapp);
-    if (!clientRecord) {
-      return next(
-        new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-          context: { code: 400, siteKey: dapp },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-    const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-    const userScope = getRequestUserScope(
-      flatten(req.headers),
-      req.ja4,
-      normalizedIp,
-      user,
-      void 0,
-      // headHash
-      void 0,
-      // coords
-      countryCode,
-      asn
-    );
-    const userAccessPolicy = (await tasks.imgCaptchaManager.getPrioritisedAccessPolicies(
-      userAccessRulesStorage,
-      dapp,
-      userScope
-    )).find((p) => !p.deferToVerify);
-    const {
-      valid,
-      reason,
-      sessionId: validSessionId,
-      solvedImagesCount
-    } = await tasks.imgCaptchaManager.isValidRequest(
-      clientRecord,
-      CaptchaType.image,
-      env,
-      sessionId,
-      userAccessPolicy,
-      normalizedIp
-    );
-    if (!valid) {
-      return next(
-        new ProsopoApiError(reason || "API.BAD_REQUEST", {
-          context: {
-            code: 400,
-            siteKey: dapp,
-            user
-          },
-          i18n: req.i18n,
-          logger: req.logger
-        })
-      );
-    }
-    const captchaConfig = {
-      solved: {
-        count: Math.min(
-          solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count,
-          clientRecord.settings.imageMaxRounds ?? imageMaxRoundsDefault
-        )
-      },
-      unsolved: {
-        count: userAccessPolicy?.unsolvedImagesCount || env.config.captchas.unsolved.count
-      }
-    };
-    if (validSessionId && simdReadings) {
-      await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(
-        validSessionId,
-        simdReadings,
-        SimdReadingsStage.challenge
-      ).catch((updateErr) => {
-        req.logger.warn(() => ({
-          err: updateErr,
-          msg: "Failed to patch session with SIMD readings on image challenge"
-        }));
-      });
-    }
-    const taskData = await tasks.imgCaptchaManager.getRandomCaptchasAndRequestHash(
-      datasetId,
-      user,
-      ipAddress,
-      captchaConfig,
-      clientRecord.settings.imageThreshold ?? 0.8,
-      validSessionId,
-      // Persist the full ipinfo payload — consumers read
-      // individual flags off this object instead of separate
-      // flat fields.
-      req.ipInfo
-    );
-    const captchaResponse = {
-      [ApiParams.status]: "ok",
-      [ApiParams.captchas]: taskData.captchas.map((captcha) => ({
-        ...captcha,
-        target: req.t(`TARGET.${captcha.target}`),
-        items: captcha.items.map(
-          (item) => parseCaptchaAssets(item, env.assetsResolver)
-        )
-      })),
-      [ApiParams.requestHash]: taskData.requestHash,
-      [ApiParams.timestamp]: taskData.timestamp.toString(),
-      [ApiParams.signature]: {
-        [ApiParams.provider]: {
-          [ApiParams.requestHash]: taskData.signedRequestHash
-        }
-      }
-    };
-    req.logger.info(() => ({
-      msg: "Image captcha challenge issued",
-      data: {
-        captchaType: CaptchaType.image,
-        requestHash: taskData.requestHash,
-        solvedImagesCount: captchaConfig.solved.count,
-        user,
-        dapp,
-        sessionId
-      }
-    }));
-    recordCaptchaIssued(CaptchaType.image);
-    return res.json(captchaResponse);
-  } catch (err) {
-    recordCaptchaIssueError(CaptchaType.image);
-    req.logger.error(() => ({
-      err,
-      data: req.params,
-      msg: "Error in image captcha challenge request"
-    }));
-    return next(
-      new ProsopoApiError("API.BAD_REQUEST", {
-        context: {
-          error: err,
-          code: 500,
-          params: req.params
-        },
-        i18n: req.i18n,
-        logger: req.logger
-      })
-    );
-  }
-};
-export {
-  getImageCaptchaChallenge as default
+import { getMaintenanceMode } from "../admin/apiToggleMaintenanceModeEndpoint.js";
+import { normalizeRequestIp } from "../../utils/normalizeRequestIp.js";
+import { buildImageMaintenanceResponse } from "./maintenanceModeResponses.js";
+import { ProsopoApiError } from "@prosopo/common";
+import { ApiParams, CaptchaRequestBody, CaptchaType, SimdReadingsStage, imageMaxRoundsDefault } from "@prosopo/types";
+import { flatten, getIPAddress } from "@prosopo/util";
+import { parseCaptchaAssets } from "@prosopo/datasets";
+//#region src/api/captcha/getImageCaptchaChallenge.ts
+var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req, res, next) => {
+	let parsed;
+	const normalizedIp = normalizeRequestIp(req.ip, req.logger);
+	if (!normalizedIp) return next(new ProsopoApiError("API.BAD_REQUEST", {
+		context: {
+			code: 400,
+			error: "IP address not found"
+		},
+		i18n: req.i18n,
+		logger: req.logger
+	}));
+	const ipAddress = getIPAddress(normalizedIp);
+	try {
+		parsed = CaptchaRequestBody.parse(req.body);
+	} catch (err) {
+		return next(new ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const { datasetId: clientDatasetId, user, dapp, sessionId, simdReadings } = parsed;
+	const datasetId = clientDatasetId ?? env.datasetId;
+	if (!datasetId) return next(new ProsopoApiError("API.BAD_REQUEST", {
+		context: {
+			code: 400,
+			error: "No dataset available. Please upload a dataset first."
+		},
+		i18n: req.i18n,
+		logger: req.logger
+	}));
+	validateSiteKey(dapp);
+	validateAddr(user);
+	if (getMaintenanceMode()) {
+		req.logger.info(() => ({
+			msg: "Maintenance mode active - returning dummy image challenge",
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(buildImageMaintenanceResponse());
+	}
+	const tasks = new Tasks(env, req.logger);
+	try {
+		const clientRecord = await tasks.db.getClientRecord(dapp);
+		if (!clientRecord) return next(new ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+		const userScope = getRequestUserScope(flatten(req.headers), req.ja4, normalizedIp, user, void 0, void 0, countryCode, asn);
+		const userAccessPolicy = (await tasks.imgCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope)).find((p) => !p.deferToVerify);
+		const { valid, reason, sessionId: validSessionId, solvedImagesCount } = await tasks.imgCaptchaManager.isValidRequest(clientRecord, CaptchaType.image, env, sessionId, userAccessPolicy, normalizedIp);
+		if (!valid) return next(new ProsopoApiError(reason || "API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const captchaConfig = {
+			solved: { count: Math.min(solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count, clientRecord.settings.imageMaxRounds ?? imageMaxRoundsDefault) },
+			unsolved: { count: userAccessPolicy?.unsolvedImagesCount || env.config.captchas.unsolved.count }
+		};
+		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, SimdReadingsStage.challenge).catch((updateErr) => {
+			req.logger.warn(() => ({
+				err: updateErr,
+				msg: "Failed to patch session with SIMD readings on image challenge"
+			}));
+		});
+		const taskData = await tasks.imgCaptchaManager.getRandomCaptchasAndRequestHash(datasetId, user, ipAddress, captchaConfig, clientRecord.settings.imageThreshold ?? .8, validSessionId, req.ipInfo);
+		const captchaResponse = {
+			[ApiParams.status]: "ok",
+			[ApiParams.captchas]: taskData.captchas.map((captcha) => ({
+				...captcha,
+				target: req.t(`TARGET.${captcha.target}`),
+				items: captcha.items.map((item) => parseCaptchaAssets(item, env.assetsResolver))
+			})),
+			[ApiParams.requestHash]: taskData.requestHash,
+			[ApiParams.timestamp]: taskData.timestamp.toString(),
+			[ApiParams.signature]: { [ApiParams.provider]: { [ApiParams.requestHash]: taskData.signedRequestHash } }
+		};
+		req.logger.info(() => ({
+			msg: "Image captcha challenge issued",
+			data: {
+				captchaType: CaptchaType.image,
+				requestHash: taskData.requestHash,
+				solvedImagesCount: captchaConfig.solved.count,
+				user,
+				dapp,
+				sessionId
+			}
+		}));
+		recordCaptchaIssued(CaptchaType.image);
+		return res.json(captchaResponse);
+	} catch (err) {
+		recordCaptchaIssueError(CaptchaType.image);
+		req.logger.error(() => ({
+			err,
+			data: req.params,
+			msg: "Error in image captcha challenge request"
+		}));
+		return next(new ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				error: err,
+				code: 500,
+				params: req.params
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
 };
+//#endregion
+export { getImageCaptchaChallenge_default as default };