@prosopo/provider 5.0.1 → 5.0.4

package/dist/cjs/tasks/captchaManager.cjs

@@ -71,6 +71,53 @@ var CaptchaManager = class CaptchaManager {
 		return readings;
 	}
 	/**
+	* Read a session and, if it's an escalation missing one of the
+	* inherently-origin-populated fields, walk to `originSessionId` and fill
+	* the gap. Intended for the decision-machine input read path only —
+	* `simdReadings`, `dnsEvent`, `entropyMathRandomFingerprint` etc. are
+	* populated on the origin session (SIMD via pow-submit's fire-and-forget
+	* attach; DNS via the sidecar's origin-TLS-scoped patch) and don't
+	* automatically end up on the escalation record because
+	* `buildEscalation` reads the origin from Mongo before the async writes
+	* settle. Rather than duplicating the origin's state onto every
+	* escalation at write time, keep the origin as the source of truth and
+	* fall back to it at read time.
+	*
+	* Fields intentionally NOT walked:
+	*   - captchaType / sessionId / score / threshold / scoreComponents /
+	*     ipAddress / ipInfo / headers — these describe the escalation
+	*     itself and must never be overridden by the origin.
+	*   - Anything already present on the escalation — first-write wins.
+	*
+	* Non-escalation sessions and escalations without `originSessionId`
+	* (older records) fall through as no-op.
+	*/
+	async getSessionRecordWithOriginFallback(sessionId) {
+		const session = await this.db.getSessionRecordBySessionId(sessionId);
+		if (!session) return void 0;
+		if (!session.originSessionId) return session;
+		const needsSimd = session.simdReadings === void 0 || session.simdReadings === null;
+		const needsDns = session.dnsEvent === void 0 || session.dnsEvent === null;
+		const needsEntropyMath = session.entropyMathRandomFingerprint === void 0;
+		const needsEntropyCrypto = session.entropyCryptoFingerprint === void 0;
+		const needsEntropyWall = session.entropyWallClockOffsetMs === void 0;
+		const needsEntropyFirst = session.entropyMathRandomFirst === void 0;
+		const needsG = session.g === void 0;
+		if (!needsSimd && !needsDns && !needsEntropyMath && !needsEntropyCrypto && !needsEntropyWall && !needsEntropyFirst && !needsG) return session;
+		const origin = await this.db.getSessionRecordBySessionId(session.originSessionId);
+		if (!origin) return session;
+		return {
+			...session,
+			...needsSimd && origin.simdReadings && { simdReadings: origin.simdReadings },
+			...needsDns && origin.dnsEvent && { dnsEvent: origin.dnsEvent },
+			...needsEntropyMath && origin.entropyMathRandomFingerprint !== void 0 && { entropyMathRandomFingerprint: origin.entropyMathRandomFingerprint },
+			...needsEntropyCrypto && origin.entropyCryptoFingerprint !== void 0 && { entropyCryptoFingerprint: origin.entropyCryptoFingerprint },
+			...needsEntropyWall && origin.entropyWallClockOffsetMs !== void 0 && { entropyWallClockOffsetMs: origin.entropyWallClockOffsetMs },
+			...needsEntropyFirst && origin.entropyMathRandomFirst !== void 0 && { entropyMathRandomFirst: origin.entropyMathRandomFirst },
+			...needsG && origin.g !== void 0 && { g: origin.g }
+		};
+	}
+	/**
 	* Decrypt + first-hop-wins attach. Resolves the session's detector pool
 	* bundle (promoted onto the session record at frictionless time) to decrypt.
 	* No-op on decrypt failure / no bundle.
@@ -130,20 +177,6 @@ var CaptchaManager = class CaptchaManager {
 				sessionId
 			}
 		}));
-		if (userAccessPolicy?.captchaType !== void 0 && userAccessPolicy.captchaType !== requestedCaptchaType) {
-			this.logger.warn(() => ({
-				msg: "Invalid captcha type for user access policy",
-				data: {
-					account: clientSettings.account,
-					captchaType: userAccessPolicy.captchaType
-				}
-			}));
-			return {
-				valid: false,
-				reason: _prosopo_types.ResultReason.INCORRECT_CAPTCHA_TYPE,
-				type: requestedCaptchaType
-			};
-		}
 		if (sessionId) {
 			const cachedBeforeRemove = this.writeQueue ? await this.writeQueue.getCachedSession(sessionId) : null;
 			const cachedHash = typeof cachedBeforeRemove?.userSitekeyIpHash === "string" ? cachedBeforeRemove.userSitekeyIpHash : void 0;
@@ -246,6 +279,21 @@ var CaptchaManager = class CaptchaManager {
 				ipInfo: sessionRecord.ipInfo
 			};
 		}
+		if (userAccessPolicy?.captchaType !== void 0 && userAccessPolicy.captchaType !== requestedCaptchaType) {
+			this.logger.warn(() => ({
+				msg: "Invalid captcha type for user access policy (sessionless)",
+				data: {
+					account: clientSettings.account,
+					captchaType: userAccessPolicy.captchaType,
+					requestedCaptchaType
+				}
+			}));
+			return {
+				valid: false,
+				reason: _prosopo_types.ResultReason.INCORRECT_CAPTCHA_TYPE,
+				type: requestedCaptchaType
+			};
+		}
 		if (clientSettings?.settings?.captchaType !== requestedCaptchaType) {
 			this.logger.warn(() => ({
 				msg: `Invalid ${requestedCaptchaType} request`,