@prosopo/provider 5.0.4 → 5.1.0

package/dist/cjs/tasks/captchaManager.cjs

@@ -438,7 +438,10 @@ var CaptchaManager = class CaptchaManager {
 		return require_checkSpamEmail.checkSpamEmail(email, this.db, this.config, this.logger);
 	}
 	/**
-	* Resolves the IP info to feed to `checkTrafficFilter` and runs the check.
+	* Resolves the IP info to feed to `checkTrafficFilter` and runs the check
+	* at submit time. Only `action: "block"` matches produce `isBlocked:true`;
+	* `action: "challenge"` matches were already applied at request time and
+	* are ignored here.
 	*
 	* - The captcha record already carries the IPInfoResponse from request
 	*   time (ipInfoMiddleware → storeXxxRecord), so by default we reuse it
@@ -448,9 +451,10 @@ var CaptchaManager = class CaptchaManager {
 	*   and may differ from the IP that originally requested the captcha.
 	* - When the session carries a `dnsEvent`, its `peerIp` and `resolverIp`
 	*   are enriched and passed alongside the primary IP.
-	* - `blockAbuser` defaults to true so abusive networks are always
-	*   blocked even when the site hasn't configured a trafficFilter.
-	* - Returns `{ isBlocked: false }` if every filter flag is off, without
+	* - The abuser category defaults to `{action:"block"}` so abusive
+	*   networks are always blocked even when the site hasn't configured a
+	*   trafficFilter.
+	* - Returns `{ isBlocked: false }` if no category is active, without
 	*   consulting the payload at all.
 	*
 	* Callers handle the "blocked" branch themselves (each verify path
@@ -459,10 +463,13 @@ var CaptchaManager = class CaptchaManager {
 	*/
 	async resolveTrafficFilterCheck(env, recordIpInfo, trafficFilter, currentIp, enrichedDnsEvent) {
 		const effective = {
-			blockAbuser: true,
+			abuser: { action: _prosopo_types.TrafficFilterAction.Block },
 			...trafficFilter
 		};
-		if (!Object.values(effective).some((v) => v)) return { isBlocked: false };
+		if (!(effective.vpn !== void 0 || effective.proxy !== void 0 || effective.tor !== void 0 || effective.abuser !== void 0 || effective.datacenter !== void 0 || effective.mobile !== void 0 || effective.satellite !== void 0 || effective.crawler !== void 0)) return {
+			isBlocked: false,
+			matches: []
+		};
 		const ipInfo = currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo;
 		return require_checkTrafficFilter.checkTrafficFilter(ipInfo, effective, require_enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}

package/dist/cjs/tasks/dnsEvent/enrichDnsEvent.cjs

@@ -46,15 +46,17 @@ var extraIpInfosFromEnrichedDnsEvent = (enriched) => {
 *   - client IP is a consumer ISP but resolver is datacenter (compound)
 *
 * When `trafficFilter` is supplied, the datacenter and abuser contributions
-* are gated on the same rules `checkTrafficFilter` uses for the client IP:
+* are gated on the same rules `checkTrafficFilter` uses for the client IP.
+* A category counts here whenever the operator has configured any policy
+* for it (block or challenge) — either intent signals suspicion.
 *
-*   - `blockDatacenter` must be opted in (default off); IPs whose
+*   - datacenter category must be configured; IPs whose
 *     `providerType === "isp"` short-circuit; named allowlist skips
-*   - `blockAbuser` opt-in (default on) with the abuser-score threshold
+*   - abuser category defaults to configured, with the score threshold
 *   - cross-category suppression: VPN / proxy / Tor / crawler IPs that also
 *     carry `isDatacenter=true` are NOT counted as datacenter when the
-*     operator hasn't opted into blocking that more specific category —
-*     mirrors the `datacenterSuppressedByCategory` rule in evaluateIpInfo.
+*     operator hasn't configured that more specific category — mirrors
+*     the `datacenterSuppressedByCategory` rule in evaluateIpInfo.
 *
 * `pathValid` is a protocol signal, not a category — it always contributes
 * regardless of trafficFilter. When `trafficFilter` is omitted, all
@@ -68,16 +70,16 @@ var computeDnsAsymmetry = (enriched, clientIpInfo, trafficFilter) => {
 	const countDc = (ip) => {
 		if (!ip?.isValid || !ip.isDatacenter) return false;
 		if (!trafficFilter) return true;
-		if (trafficFilter.blockDatacenter !== true) return false;
+		if (trafficFilter.datacenter === void 0) return false;
 		if (require_checkTrafficFilter.isDatacenterDenylisted(ip, trafficFilter.datacenterNameDenylist)) return true;
-		if (ip.isVPN && trafficFilter.blockVpn !== true || ip.isProxy && trafficFilter.blockProxy !== true || ip.isTor && trafficFilter.blockTor !== true || ip.isCrawler && trafficFilter.blockCrawler !== true) return false;
+		if (ip.isVPN && trafficFilter.vpn === void 0 || ip.isProxy && trafficFilter.proxy === void 0 || ip.isTor && trafficFilter.tor === void 0 || ip.isCrawler && trafficFilter.crawler === void 0) return false;
 		if (ip.providerType === "isp") return false;
 		return !require_checkTrafficFilter.isDatacenterAllowlisted(ip, trafficFilter.datacenterNameAllowlist);
 	};
 	const countAbuser = (ip) => {
 		if (!ip?.isValid || !ip.isAbuser) return false;
 		if (!trafficFilter) return true;
-		if (trafficFilter.blockAbuser === false) return false;
+		if (trafficFilter.abuser === void 0) return false;
 		const threshold = trafficFilter.abuserScoreThreshold ?? _prosopo_types.trafficFilterAbuserScoreThresholdDefault;
 		return Math.max(ip.abuserScore ?? 0, ip.companyAbuserScore ?? 0) >= threshold;
 	};

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -74,6 +74,20 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			chelloToHandshakeUs: params.chelloToHandshakeUs
 		};
 	}
+	/**
+	* Record the access rule that matched this request, so every session this
+	* request goes on to write carries it.
+	*
+	* Set separately from `setSessionParams` (which runs before rules are
+	* evaluated) and applied at `createSession` time, so it reaches all the
+	* outcomes a matched rule can lead to: the 401'd block, the auto-ban a
+	* score bump triggered, the captcha type a Restrict rule forced, and the
+	* ordinary decision-machine session a score-only Restrict leaves behind.
+	* Mirrors `updateScore`'s after-the-fact mutation of the same bag.
+	*/
+	setMatchedRule(matchedRule) {
+		if (this.sessionParams) this.sessionParams.matchedRule = matchedRule;
+	}
 	updateScore(score, scoreComponents) {
 		if (this.sessionParams) {
 			this.sessionParams.score = score;
@@ -83,7 +97,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 	checkLangRules(acceptLanguage) {
 		return require_lang.checkLangRules(this.config, acceptLanguage);
 	}
-	async createSession(token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason, blocked, deleted, ipInfo, headers, mode, simdReadings, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, bundleId, currentUrl, tcpToChelloUs, chelloToHandshakeUs, isEscalation, iframeUrl, isProtect, originSessionId, g) {
+	async createSession(token, score, threshold, scoreComponents, ipAddress, captchaType, siteKey, solvedImagesCount, powDifficulty, userSitekeyIpHash, webView = false, iFrame = false, decryptedHeadHash = "", reason, blocked, deleted, ipInfo, headers, mode, simdReadings, entropyMathRandomFingerprint, entropyCryptoFingerprint, entropyWallClockOffsetMs, entropyMathRandomFirst, bundleId, currentUrl, tcpToChelloUs, chelloToHandshakeUs, isEscalation, iframeUrl, isProtect, originSessionId, g, matchedRule) {
 		const sessionRecord = {
 			sessionId: `${getSessionIDPrefix(this.config.host)}-${(0, uuid.v4)()}`,
 			createdAt: /* @__PURE__ */ new Date(),
@@ -120,7 +134,8 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			entropyMathRandomFirst,
 			g,
 			tcpToChelloUs,
-			chelloToHandshakeUs
+			chelloToHandshakeUs,
+			...matchedRule && { matchedRule }
 		};
 		await this.db.storeSessionRecord(sessionRecord);
 		if (this.writeQueue) {
@@ -156,7 +171,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 		const finalSolvedImagesCount = finalCaptchaType === _prosopo_types.CaptchaType.image ? routed.solvedImagesCount ?? effectiveParams.solvedImagesCount : void 0;
 		const finalPowDifficulty = finalCaptchaType === _prosopo_types.CaptchaType.pow ? routed.powDifficulty ?? effectiveParams.powDifficulty : void 0;
 		const blocked = finalCaptchaType === _prosopo_types.CaptchaType.image ? effectiveParams.blocked : void 0;
-		const sessionRecord = await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, finalCaptchaType, effectiveParams.siteKey, finalSolvedImagesCount, finalPowDifficulty, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, effectiveParams.reason, blocked, void 0, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.bundleId, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect, void 0, effectiveParams.g);
+		const sessionRecord = await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, finalCaptchaType, effectiveParams.siteKey, finalSolvedImagesCount, finalPowDifficulty, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, effectiveParams.reason, blocked, void 0, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.bundleId, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect, void 0, effectiveParams.g, effectiveParams.matchedRule);
 		if (this.routingContext && this.usageCounters) this.usageCounters.incrManyAsync(this.routingContext.dappAccount, require_usageCounters.buildAllWindowIncrements("served", finalCaptchaType, this.routingContext.ip, this.routingContext.userAccount));
 		return {
 			[_prosopo_types.ApiParams.captchaType]: finalCaptchaType,
@@ -171,7 +186,7 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			...params
 		};
 		if (!effectiveParams.token || effectiveParams.score === void 0 || effectiveParams.threshold === void 0 || !effectiveParams.scoreComponents || !effectiveParams.ipAddress || effectiveParams.siteKey === void 0) throw new Error("Session parameters must be set before calling registerBlockedSession");
-		await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, _prosopo_types.CaptchaType.image, effectiveParams.siteKey, effectiveParams.solvedImagesCount, void 0, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, effectiveParams.reason, true, true, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.bundleId, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect, void 0, effectiveParams.g);
+		await this.createSession(effectiveParams.token, effectiveParams.score, effectiveParams.threshold, effectiveParams.scoreComponents, effectiveParams.ipAddress, _prosopo_types.CaptchaType.image, effectiveParams.siteKey, effectiveParams.solvedImagesCount, void 0, effectiveParams.userSitekeyIpHash, effectiveParams.webView ?? false, effectiveParams.iFrame ?? false, effectiveParams.decryptedHeadHash, effectiveParams.reason, true, true, effectiveParams.ipInfo, effectiveParams.headers, effectiveParams.mode, effectiveParams.simdReadings, effectiveParams.entropyMathRandomFingerprint, effectiveParams.entropyCryptoFingerprint, effectiveParams.entropyWallClockOffsetMs, effectiveParams.entropyMathRandomFirst, effectiveParams.bundleId, effectiveParams.currentUrl, effectiveParams.tcpToChelloUs, effectiveParams.chelloToHandshakeUs, void 0, effectiveParams.iframeUrl, effectiveParams.isProtect, void 0, effectiveParams.g, effectiveParams.matchedRule);
 	}
 	scoreIncreaseAccessPolicy(accessPolicy, baseBotScore, botScore, scoreComponents) {
 		const accessPolicyPenalty = accessPolicy?.frictionlessScore || this.config.penalties.PENALTY_ACCESS_RULE;

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -14,6 +14,7 @@ let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
 let _prosopo_util_crypto = require("@prosopo/util-crypto");
 let _prosopo_datasets = require("@prosopo/datasets");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 let _polkadot_util = require("@polkadot/util");
 //#region src/tasks/imgCaptcha/imgCaptchaTasks.ts
 var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
@@ -338,6 +339,7 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		}
 		const commitmentUpdates = {};
 		let failStatus;
+		let matchedRule;
 		if (userAccessRulesStorage) try {
 			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, solution, solution.userAccount, solution.headers, solution.coords, solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0, solution.ipInfo?.isValid ? solution.ipInfo.asnNumber : void 0);
 			if (blockPolicy) {
@@ -354,6 +356,7 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 					reason: _prosopo_types.ResultReason.ACCESS_POLICY_BLOCK
 				};
 				failStatus = _prosopo_types.ResultReason.ACCESS_POLICY_BLOCK;
+				matchedRule = (0, _prosopo_user_access_policy.describeMatchedRule)(blockPolicy);
 			}
 		} catch (error) {
 			logger.warn(() => ({
@@ -563,7 +566,8 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		if (solution.sessionId) writePromises.push(this.updateSessionRecordWithCache(solution.sessionId, {
 			serverChecked: true,
 			result: finalResult,
-			...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.image, finalResult) && { blocked: true }
+			...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.image, finalResult) && { blocked: true },
+			...matchedRule && { matchedRule }
 		}, true));
 		if (writePromises.length > 0) await Promise.all(writePromises);
 		return {

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -11,6 +11,7 @@ const require_powTasksUtils = require("./powTasksUtils.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 let _polkadot_util = require("@polkadot/util");
 //#region src/tasks/powCaptcha/powTasks.ts
 var DEFAULT_POW_DIFFICULTY = 4;
@@ -293,6 +294,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		const powRecordUpdates = {};
 		let failResult;
 		let failReason;
+		let matchedRule;
 		const submittedAt = challengeRecord.submittedAtTimestamp;
 		if ((submittedAt instanceof Date ? Date.now() - submittedAt.getTime() : Number.POSITIVE_INFINITY) > timeout) {
 			failResult = {
@@ -316,6 +318,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 					reason: _prosopo_types.ResultReason.ACCESS_POLICY_BLOCK
 				};
 				failReason = "API.ACCESS_POLICY_BLOCK";
+				matchedRule = (0, _prosopo_user_access_policy.describeMatchedRule)(blockPolicy);
 			}
 		} catch (error) {
 			logger.warn(() => ({
@@ -515,7 +518,8 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		if (challengeRecord.sessionId) writePromises.push(this.updateSessionRecordWithCache(challengeRecord.sessionId, {
 			serverChecked: true,
 			result: finalResult,
-			...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.pow, finalResult) && { blocked: true }
+			...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.pow, finalResult) && { blocked: true },
+			...matchedRule && { matchedRule }
 		}, true));
 		if (writePromises.length > 0) await Promise.all(writePromises);
 		if (failReason) return notVerified(failReason);

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -11,6 +11,7 @@ const require_puzzleTasksUtils = require("./puzzleTasksUtils.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 let _polkadot_util = require("@polkadot/util");
 //#region src/tasks/puzzleCaptcha/puzzleTasks.ts
 var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
@@ -126,6 +127,7 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			const dappAccount = (0, _prosopo_util.at)(challengeSplit, 2);
 			this.usageCounters.incrManyAsync(dappAccount, require_usageCounters.buildAllWindowIncrements("solved", _prosopo_types.CaptchaType.puzzle, ipAddress.address, userAccount));
 		}
+		await this.db.updatePuzzleCaptchaRecord(challenge, { puzzleEvents });
 		if (behavioralData) try {
 			const bundle = await this.resolveBundleBySessionId(challengeRecord.sessionId);
 			const decryptedData = await this.decryptBehavioralData(behavioralData, bundle);
@@ -152,8 +154,7 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				};
 				await this.db.updatePuzzleCaptchaRecord(challenge, {
 					behavioralDataPacked: packedData,
-					deviceCapability: decryptedData.deviceCapability,
-					puzzleEvents
+					deviceCapability: decryptedData.deviceCapability
 				});
 			}
 		} catch (error) {
@@ -162,7 +163,6 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				err: error
 			}));
 		}
-		else await this.db.updatePuzzleCaptchaRecord(challenge, { puzzleEvents });
 		if (clientMetaData?.hp) await this.db.updatePuzzleCaptchaRecord(challenge, { clientMetaData: { hp: clientMetaData.hp } });
 		await this.db.updatePuzzleCaptchaRecordResult(challenge, result, false, true, userTimestampSignature, coords);
 		if (challengeRecord.sessionId) {
@@ -260,7 +260,8 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
 					serverChecked: true,
 					result: blockedResult,
-					...isBlocked && { blocked: true }
+					...isBlocked && { blocked: true },
+					matchedRule: (0, _prosopo_user_access_policy.describeMatchedRule)(blockPolicy)
 				});
 				return notVerifiedResponse;
 			}

package/dist/cjs/tasks/spam/checkTrafficFilter.cjs

@@ -1,5 +1,16 @@
 let _prosopo_types = require("@prosopo/types");
-//#region src/tasks/spam/checkTrafficFilter.ts
+var CATEGORY_TO_REASON = {
+	vpn: _prosopo_types.ResultReason.VPN_BLOCKED,
+	proxy: _prosopo_types.ResultReason.PROXY_BLOCKED,
+	tor: _prosopo_types.ResultReason.TOR_BLOCKED,
+	abuser: _prosopo_types.ResultReason.ABUSER_BLOCKED,
+	datacenter: _prosopo_types.ResultReason.DATACENTER_BLOCKED,
+	mobile: _prosopo_types.ResultReason.MOBILE_BLOCKED,
+	satellite: _prosopo_types.ResultReason.SATELLITE_BLOCKED,
+	crawler: _prosopo_types.ResultReason.CRAWLER_BLOCKED
+};
+var categoryToReason = (category) => CATEGORY_TO_REASON[category];
+var isActive = (policy) => policy !== void 0;
 var matchesDatacenterNameList = (ipInfo, list) => {
 	if (!list || list.length === 0) return false;
 	const candidates = [];
@@ -18,65 +29,43 @@ var matchesDatacenterNameList = (ipInfo, list) => {
 };
 var isDatacenterAllowlisted = (ipInfo, allowlist) => matchesDatacenterNameList(ipInfo, allowlist);
 var isDatacenterDenylisted = (ipInfo, denylist) => matchesDatacenterNameList(ipInfo, denylist);
+var push = (matches, category, policy) => {
+	if (policy) matches.push({
+		category,
+		policy
+	});
+};
 var evaluateIpInfo = (ipInfo, trafficFilter, isDnsExtra = false) => {
-	if (!ipInfo || !ipInfo.isValid) return { isBlocked: false };
-	if (trafficFilter.blockVpn && ipInfo.isVPN) return {
-		isBlocked: true,
-		reason: _prosopo_types.ResultReason.VPN_BLOCKED
-	};
-	if (trafficFilter.blockProxy && ipInfo.isProxy) return {
-		isBlocked: true,
-		reason: _prosopo_types.ResultReason.PROXY_BLOCKED
-	};
-	if (trafficFilter.blockTor && ipInfo.isTor) return {
-		isBlocked: true,
-		reason: _prosopo_types.ResultReason.TOR_BLOCKED
-	};
-	if ((trafficFilter.blockAbuser ?? true) && ipInfo.isAbuser) {
+	const matches = [];
+	if (!ipInfo || !ipInfo.isValid) return matches;
+	if (isActive(trafficFilter.vpn) && ipInfo.isVPN) push(matches, "vpn", trafficFilter.vpn);
+	if (isActive(trafficFilter.proxy) && ipInfo.isProxy) push(matches, "proxy", trafficFilter.proxy);
+	if (isActive(trafficFilter.tor) && ipInfo.isTor) push(matches, "tor", trafficFilter.tor);
+	if (isActive(trafficFilter.abuser) && ipInfo.isAbuser) {
 		const threshold = trafficFilter.abuserScoreThreshold ?? _prosopo_types.trafficFilterAbuserScoreThresholdDefault;
-		if (Math.max(ipInfo.abuserScore ?? 0, ipInfo.companyAbuserScore ?? 0) >= threshold) return {
-			isBlocked: true,
-			reason: _prosopo_types.ResultReason.ABUSER_BLOCKED
-		};
+		if (Math.max(ipInfo.abuserScore ?? 0, ipInfo.companyAbuserScore ?? 0) >= threshold) push(matches, "abuser", trafficFilter.abuser);
 	}
-	const datacenterSuppressedByCategory = ipInfo.isVPN && !trafficFilter.blockVpn || ipInfo.isProxy && !trafficFilter.blockProxy || ipInfo.isTor && !trafficFilter.blockTor || ipInfo.isCrawler && !trafficFilter.blockCrawler;
-	if (trafficFilter.blockDatacenter && ipInfo.isDatacenter) {
-		if (isDatacenterDenylisted(ipInfo, trafficFilter.datacenterNameDenylist)) return {
-			isBlocked: true,
-			reason: _prosopo_types.ResultReason.DATACENTER_BLOCKED
-		};
-		if (ipInfo.providerType !== "isp" && !datacenterSuppressedByCategory && !isDatacenterAllowlisted(ipInfo, trafficFilter.datacenterNameAllowlist)) return {
-			isBlocked: true,
-			reason: _prosopo_types.ResultReason.DATACENTER_BLOCKED
-		};
+	const datacenterSuppressedByCategory = ipInfo.isVPN && !isActive(trafficFilter.vpn) || ipInfo.isProxy && !isActive(trafficFilter.proxy) || ipInfo.isTor && !isActive(trafficFilter.tor) || ipInfo.isCrawler && !isActive(trafficFilter.crawler);
+	if (isActive(trafficFilter.datacenter) && ipInfo.isDatacenter) {
+		if (isDatacenterDenylisted(ipInfo, trafficFilter.datacenterNameDenylist)) push(matches, "datacenter", trafficFilter.datacenter);
+		else if (ipInfo.providerType !== "isp" && !datacenterSuppressedByCategory && !isDatacenterAllowlisted(ipInfo, trafficFilter.datacenterNameAllowlist)) push(matches, "datacenter", trafficFilter.datacenter);
 	}
-	if (trafficFilter.blockMobile && ipInfo.isMobile) return {
-		isBlocked: true,
-		reason: _prosopo_types.ResultReason.MOBILE_BLOCKED
-	};
-	if (trafficFilter.blockSatellite && ipInfo.isSatellite) return {
-		isBlocked: true,
-		reason: _prosopo_types.ResultReason.SATELLITE_BLOCKED
-	};
-	if (!isDnsExtra && trafficFilter.blockCrawler && ipInfo.isCrawler) return {
-		isBlocked: true,
-		reason: _prosopo_types.ResultReason.CRAWLER_BLOCKED
-	};
-	return { isBlocked: false };
+	if (isActive(trafficFilter.mobile) && ipInfo.isMobile) push(matches, "mobile", trafficFilter.mobile);
+	if (isActive(trafficFilter.satellite) && ipInfo.isSatellite) push(matches, "satellite", trafficFilter.satellite);
+	if (!isDnsExtra && isActive(trafficFilter.crawler) && ipInfo.isCrawler) push(matches, "crawler", trafficFilter.crawler);
+	return matches;
 };
 /**
-* Checks whether a request should be blocked based on traffic filter
-* settings and the request's already-resolved IP info (attached to
-* `req.ipInfo` by `ipInfoMiddleware`). Each filter (VPN, proxy, Tor,
-* abuser, etc.) is evaluated independently. A missing or invalid
-* `ipInfo` falls back to "not blocked" so an outage in the upstream
-* service can't block all traffic.
+* Evaluate trafficFilter against the request's IPs and return every category
+* that matched (with the operator's policy for that category). Each match
+* carries the policy `action` — `block` fires at submit time; `challenge`
+* fires at request time to override captcha type + params.
 *
-* Cross-filter rule: the datacenter rule is suppressed when the IP
-* carries a more specific category the operator has left unblocked —
-* VPN, proxy, Tor, or crawler. All four legitimately sit on datacenter
-* infrastructure, so "block datacenters" (a scraping rule) shouldn't
-* catch them out the back door. Applies to primary and DNS extras.
+* Cross-category rule: the datacenter category is suppressed when the IP
+* carries a more specific category the operator has not configured — VPN,
+* proxy, Tor, or crawler. All four legitimately sit on datacenter
+* infrastructure, so "datacenter" (a scraping rule) shouldn't catch them
+* out the back door.
 *
 * Extras-only rule: the crawler check is skipped on DNS extras. Public
 * DNS resolvers share IP space with search crawlers.
@@ -84,40 +73,77 @@ var evaluateIpInfo = (ipInfo, trafficFilter, isDnsExtra = false) => {
 * The datacenter rule also honours `datacenterNameAllowlist`: consumer
 * relays route through datacenter ranges and are reported as
 * `is_datacenter=true` by upstream but the exiting users are real humans.
-* Operators can list the datacenter, provider, or ASN organisation names
-* they want to allow through — see `isDatacenterAllowlisted`.
 *
 * The datacenter rule also short-circuits when upstream classifies the
-* provider as an ISP (`providerType === "isp"`). Consumer ISPs like
-* Afrihost, Comcast, or BT are sometimes flagged `is_datacenter=true` by
-* upstream heuristics — usually because part of the ASN hosts B2B or
-* hosting services — but the eyeball ranges behind those ASNs carry
-* ordinary end-users. The ISP categorisation is stronger evidence of
-* consumer traffic than the datacenter boolean.
+* provider as an ISP (`providerType === "isp"`). Consumer ISPs are
+* sometimes flagged `is_datacenter=true` upstream, but the ranges behind
+* those ASNs carry ordinary end-users.
 *
 * The ISP short-circuit and the allowlist are both overridden by
-* `datacenterNameDenylist`: if the IP's `datacenterName`, `providerName`,
-* or `asnOrganization` matches a denylist entry, the block fires. This
-* lets operators opt named providers (for example IP-leasing platforms
-* whose ranges are announced from carrier ASNs but exit as proxy pools)
-* back into the datacenter rule.
+* `datacenterNameDenylist`.
 *
 * When `trafficFilter.skipExtrasOnValidDnsPath` is on and the catcher
 * confirmed the DNS path matched the connection path (`pathValid: true`),
-* the extras evaluation is skipped. This stops public-DoH resolver IPs
-* from tripping the datacenter rule for ordinary users.
+* the extras evaluation is skipped.
+*
+* The `isBlocked` verdict is set when at least one match has
+* `action === "block"`, with `reason` naming that category. Callers that
+* only care about challenges can inspect `matches` directly and use
+* `resolveChallengePolicy` to combine them.
 */
 var checkTrafficFilter = (ipInfo, trafficFilter, extraIpInfos, dnsPathValid) => {
-	const primary = evaluateIpInfo(ipInfo, trafficFilter);
-	if (primary.isBlocked) return primary;
-	if (trafficFilter.skipExtrasOnValidDnsPath && dnsPathValid === true) return { isBlocked: false };
-	for (const extra of extraIpInfos ?? []) {
-		const result = evaluateIpInfo(extra, trafficFilter, true);
-		if (result.isBlocked) return result;
+	const matches = [];
+	matches.push(...evaluateIpInfo(ipInfo, trafficFilter));
+	if (!(trafficFilter.skipExtrasOnValidDnsPath && dnsPathValid === true)) for (const extra of extraIpInfos ?? []) matches.push(...evaluateIpInfo(extra, trafficFilter, true));
+	const firstBlock = matches.find((m) => m.policy.action === _prosopo_types.TrafficFilterAction.Block);
+	if (firstBlock) return {
+		isBlocked: true,
+		reason: categoryToReason(firstBlock.category),
+		matches
+	};
+	return {
+		isBlocked: false,
+		matches
+	};
+};
+var CAPTCHA_TYPE_RANK = {
+	[_prosopo_types.CaptchaType.image]: 4,
+	[_prosopo_types.CaptchaType.puzzle]: 3,
+	[_prosopo_types.CaptchaType.pow]: 2,
+	[_prosopo_types.CaptchaType.frictionless]: 1
+};
+var rankCaptchaType = (t) => t === void 0 ? 0 : CAPTCHA_TYPE_RANK[t] ?? 0;
+/**
+* Combine the `challenge` matches into a single effective policy: pick the
+* strictest captcha type, then take the hardest params (max difficulty,
+* max image count, min puzzle tolerance). `block` matches are ignored —
+* callers should short-circuit on the top-level `isBlocked` verdict
+* first. Returns undefined when there are no challenge matches.
+*/
+var resolveChallengePolicy = (matches) => {
+	const challenges = matches.filter((m) => m.policy.action === _prosopo_types.TrafficFilterAction.Challenge);
+	if (challenges.length === 0) return void 0;
+	let winningCaptchaType;
+	for (const m of challenges) if (rankCaptchaType(m.policy.captchaType) > rankCaptchaType(winningCaptchaType)) winningCaptchaType = m.policy.captchaType;
+	let powDifficulty;
+	let solvedImagesCount;
+	let puzzleTolerance;
+	for (const m of challenges) {
+		if (m.policy.powDifficulty !== void 0) powDifficulty = powDifficulty === void 0 ? m.policy.powDifficulty : Math.max(powDifficulty, m.policy.powDifficulty);
+		if (m.policy.solvedImagesCount !== void 0) solvedImagesCount = solvedImagesCount === void 0 ? m.policy.solvedImagesCount : Math.max(solvedImagesCount, m.policy.solvedImagesCount);
+		if (m.policy.puzzleTolerance !== void 0) puzzleTolerance = puzzleTolerance === void 0 ? m.policy.puzzleTolerance : Math.min(puzzleTolerance, m.policy.puzzleTolerance);
 	}
-	return { isBlocked: false };
+	return {
+		captchaType: winningCaptchaType,
+		powDifficulty,
+		solvedImagesCount,
+		puzzleTolerance,
+		sourceCategories: challenges.map((m) => m.category)
+	};
 };
 //#endregion
+exports.categoryToReason = categoryToReason;
 exports.checkTrafficFilter = checkTrafficFilter;
 exports.isDatacenterAllowlisted = isDatacenterAllowlisted;
 exports.isDatacenterDenylisted = isDatacenterDenylisted;
+exports.resolveChallengePolicy = resolveChallengePolicy;

package/dist/tasks/captchaManager.d.ts

@@ -4,7 +4,7 @@ import { type Logger } from "@prosopo/logger";
 import { type CaptchaType, type EnrichedDnsEvent, type IPInfoResponse, type ITrafficFilter, type KeyringPair, type ProsopoConfigOutput, type RequestHeaders, type Session, type SimdReadingsStage, Tier, type UserCommitment } from "@prosopo/types";
 import type { ClientRecord, IProviderDatabase, IUserDataSlim, PoWCaptchaRecord, PuzzleCaptchaRecord } from "@prosopo/types-database";
 import type { ProviderEnvironment } from "@prosopo/types-env";
-import { type AccessPolicy, type AccessRulesStorage, type UserScope, type UserScopeRecord } from "@prosopo/user-access-policy";
+import { type AccessPolicy, type AccessRule, type AccessRulesStorage, type UserScope, type UserScopeRecord } from "@prosopo/user-access-policy";
 import type { BehavioralDataResult } from "./detection/decodeBehavior.js";
 import type { SimdReadingsResult } from "./detection/decodeSimd.js";
 import { type TrafficCheckResult } from "./spam/checkTrafficFilter.js";
@@ -48,7 +48,7 @@ export declare class CaptchaManager {
     getPrioritisedAccessPolicies(userAccessRulesStorage: AccessRulesStorage, clientId: string, userScope: UserScope | UserScopeRecord, options?: {
         blockOnly?: boolean;
         requestMemoHost?: object;
-    }): Promise<import("@prosopo/user-access-policy").AccessRule[]>;
+    }): Promise<AccessRule[]>;
     resolveBundleById(bundleId?: string | null): PoolBundleDecrypt | undefined;
     resolveBundleByDetectorSession(detectorSessionId?: string): Promise<(PoolBundleDecrypt & {
         bundleId: string;
@@ -56,7 +56,7 @@ export declare class CaptchaManager {
     resolveBundleBySessionId(sessionId?: string): Promise<PoolBundleDecrypt | undefined>;
     decryptSimdReadings(encryptedData: string, bundle: PoolBundleDecrypt | undefined): Promise<SimdReadingsResult | null>;
     decryptBehavioralData(encryptedData: string, bundle: PoolBundleDecrypt | undefined): Promise<BehavioralDataResult | null>;
-    checkForHardBlock(userAccessRulesStorage: AccessRulesStorage, challengeRecord: PoWCaptchaRecord | PuzzleCaptchaRecord | UserCommitment, userAccount: string, headers: RequestHeaders, coords?: [number, number][][], countryCode?: string, asn?: number): Promise<AccessPolicy | undefined>;
+    checkForHardBlock(userAccessRulesStorage: AccessRulesStorage, challengeRecord: PoWCaptchaRecord | PuzzleCaptchaRecord | UserCommitment, userAccount: string, headers: RequestHeaders, coords?: [number, number][][], countryCode?: string, asn?: number): Promise<AccessRule | undefined>;
     checkSpamEmail(email: string): Promise<boolean>;
     resolveTrafficFilterCheck(env: ProviderEnvironment, recordIpInfo: IPInfoResponse | undefined, trafficFilter: Partial<ITrafficFilter> | undefined, currentIp?: string, enrichedDnsEvent?: EnrichedDnsEvent): Promise<TrafficCheckResult>;
     static canClientSeeScore(tier: Tier, score?: number): boolean | 0 | undefined;

package/dist/tasks/captchaManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EACJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAOrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;CACpB;AAkCD,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAgC/C,kCAAkC,CAC9C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IA8DlB,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAmSF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;;;;;;IAkBV,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAKpB,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAeF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAepE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAa5D,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAwB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAyCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GACV,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC;IA+C9B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAwB/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IAmB9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM;CAGnD"}
+{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EAEJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAOrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;CACpB;AAkCD,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAgC/C,kCAAkC,CAC9C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IA8DlB,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAmSF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM;;;;;;IAkBV,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAKpB,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAeF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAepE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IAa5D,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAwB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAyCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GAIV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IA+C5B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IA8B9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM;CAGnD"}

package/dist/tasks/captchaManager.js

@@ -5,7 +5,7 @@ import { checkTrafficFilter } from "./spam/checkTrafficFilter.js";
 import { extraIpInfosFromEnrichedDnsEvent } from "./dnsEvent/enrichDnsEvent.js";
 import { checkSpamEmail } from "./spam/checkSpamEmail.js";
 import { getLogger } from "@prosopo/logger";
-import { ApiParams, ResultReason, Tier } from "@prosopo/types";
+import { ApiParams, ResultReason, Tier, TrafficFilterAction } from "@prosopo/types";
 import { AccessPolicyType } from "@prosopo/user-access-policy";
 //#region src/tasks/captchaManager.ts
 /**
@@ -438,7 +438,10 @@ var CaptchaManager = class CaptchaManager {
 		return checkSpamEmail(email, this.db, this.config, this.logger);
 	}
 	/**
-	* Resolves the IP info to feed to `checkTrafficFilter` and runs the check.
+	* Resolves the IP info to feed to `checkTrafficFilter` and runs the check
+	* at submit time. Only `action: "block"` matches produce `isBlocked:true`;
+	* `action: "challenge"` matches were already applied at request time and
+	* are ignored here.
 	*
 	* - The captcha record already carries the IPInfoResponse from request
 	*   time (ipInfoMiddleware → storeXxxRecord), so by default we reuse it
@@ -448,9 +451,10 @@ var CaptchaManager = class CaptchaManager {
 	*   and may differ from the IP that originally requested the captcha.
 	* - When the session carries a `dnsEvent`, its `peerIp` and `resolverIp`
 	*   are enriched and passed alongside the primary IP.
-	* - `blockAbuser` defaults to true so abusive networks are always
-	*   blocked even when the site hasn't configured a trafficFilter.
-	* - Returns `{ isBlocked: false }` if every filter flag is off, without
+	* - The abuser category defaults to `{action:"block"}` so abusive
+	*   networks are always blocked even when the site hasn't configured a
+	*   trafficFilter.
+	* - Returns `{ isBlocked: false }` if no category is active, without
 	*   consulting the payload at all.
 	*
 	* Callers handle the "blocked" branch themselves (each verify path
@@ -459,10 +463,13 @@ var CaptchaManager = class CaptchaManager {
 	*/
 	async resolveTrafficFilterCheck(env, recordIpInfo, trafficFilter, currentIp, enrichedDnsEvent) {
 		const effective = {
-			blockAbuser: true,
+			abuser: { action: TrafficFilterAction.Block },
 			...trafficFilter
 		};
-		if (!Object.values(effective).some((v) => v)) return { isBlocked: false };
+		if (!(effective.vpn !== void 0 || effective.proxy !== void 0 || effective.tor !== void 0 || effective.abuser !== void 0 || effective.datacenter !== void 0 || effective.mobile !== void 0 || effective.satellite !== void 0 || effective.crawler !== void 0)) return {
+			isBlocked: false,
+			matches: []
+		};
 		return checkTrafficFilter(currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo, effective, extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}
 	static canClientSeeScore(tier, score) {