@prosopo/provider 5.0.5 → 5.1.0

package/dist/api/captcha/trafficFilterRequestTime.d.ts

@@ -0,0 +1,38 @@
+import type { Logger } from "@prosopo/logger";
+import { CaptchaType, type IPInfoResponse, type ITrafficFilter } from "@prosopo/types";
+import type { ClientRecord } from "@prosopo/types-database";
+import type { Response } from "express";
+import type { FrictionlessManager } from "../../tasks/frictionless/frictionlessTasks.js";
+import { type ResolvedChallengePolicy, type TrafficBlockReason } from "../../tasks/spam/checkTrafficFilter.js";
+export type RequestTimeTrafficVerdict = {
+    kind: "pass";
+} | {
+    kind: "block";
+    reason: TrafficBlockReason;
+} | {
+    kind: "challenge";
+    captchaType: CaptchaType | undefined;
+    powDifficulty?: number;
+    solvedImagesCount?: number;
+    puzzleTolerance?: number;
+    sourceCategories: ResolvedChallengePolicy["sourceCategories"];
+};
+export declare const applyTrafficFilterAtRequestTime: (ipInfo: IPInfoResponse | undefined, trafficFilter: Partial<ITrafficFilter> | undefined, logger?: Logger) => RequestTimeTrafficVerdict;
+export type FrictionlessTrafficFilterOutcome = {
+    handled: false;
+} | {
+    handled: true;
+    response: Response;
+};
+export type FrictionlessTrafficFilterInput = {
+    verdict: RequestTimeTrafficVerdict;
+    frictionlessManager: FrictionlessManager;
+    clientRecord: ClientRecord;
+    userSitekeyIpHash: string;
+    dapp: string;
+    ipInfo: IPInfoResponse | undefined;
+    flatHeaders: Record<string, string>;
+    logger: Logger;
+};
+export declare const handleFrictionlessTrafficFilter: (input: FrictionlessTrafficFilterInput, res: Response) => Promise<FrictionlessTrafficFilterOutcome>;
+//# sourceMappingURL=trafficFilterRequestTime.d.ts.map

package/dist/api/captcha/trafficFilterRequestTime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trafficFilterRequestTime.d.ts","sourceRoot":"","sources":["../../../src/api/captcha/trafficFilterRequestTime.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EACN,WAAW,EAEX,KAAK,cAAc,EACnB,KAAK,cAAc,EAEnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EACN,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAGvB,MAAM,wCAAwC,CAAC;AAEhD,MAAM,MAAM,yBAAyB,GAClC;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC7C;IACA,IAAI,EAAE,WAAW,CAAC;IAGlB,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,uBAAuB,CAAC,kBAAkB,CAAC,CAAC;CAC7D,CAAC;AAeL,eAAO,MAAM,+BAA+B,WACnC,cAAc,GAAG,SAAS,iBACnB,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,WACzC,MAAM,KACb,yBAwCF,CAAC;AAEF,MAAM,MAAM,gCAAgC,GACzC;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAClB;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEzC,MAAM,MAAM,8BAA8B,GAAG;IAC5C,OAAO,EAAE,yBAAyB,CAAC;IACnC,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,YAAY,EAAE,YAAY,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC;IACnC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,MAAM,EAAE,MAAM,CAAC;CACf,CAAC;AAUF,eAAO,MAAM,+BAA+B,UACpC,8BAA8B,OAChC,QAAQ,KACX,OAAO,CAAC,gCAAgC,CAgE1C,CAAC"}

package/dist/api/captcha/trafficFilterRequestTime.js

@@ -0,0 +1,109 @@
+import { checkTrafficFilter, resolveChallengePolicy } from "../../tasks/spam/checkTrafficFilter.js";
+import { CaptchaType, TrafficFilterAction } from "@prosopo/types";
+//#region src/api/captcha/trafficFilterRequestTime.ts
+/**
+* Evaluate the site's `trafficFilter` against the current request's IP info
+* at challenge-request time. Runs before captcha issuance so that a matched
+* `block` policy short-circuits with 401 (no captcha issued, mirroring the
+* `blockMiddleware` semantics) and a matched `challenge` policy hands back
+* an override bundle for the caller to fold into its captcha-type +
+* parameter selection.
+*
+* The verdict is authoritative for the request-time gate. Callers still run
+* `resolveTrafficFilterCheck` at submit time to catch `block` policies that
+* apply to the current (verify-time) IP even when the challenge-time IP
+* passed.
+*/
+var applyTrafficFilterAtRequestTime = (ipInfo, trafficFilter, logger) => {
+	if (!trafficFilter) return { kind: "pass" };
+	const result = checkTrafficFilter(ipInfo, {
+		abuser: { action: TrafficFilterAction.Block },
+		...trafficFilter
+	});
+	if (result.isBlocked) {
+		logger?.info(() => ({
+			msg: "Traffic filter rejected challenge request",
+			data: { reason: result.reason }
+		}));
+		return {
+			kind: "block",
+			reason: result.reason
+		};
+	}
+	const resolved = resolveChallengePolicy(result.matches);
+	if (!resolved) return { kind: "pass" };
+	logger?.info(() => ({
+		msg: "Traffic filter applied challenge overrides",
+		data: {
+			categories: resolved.sourceCategories,
+			captchaType: resolved.captchaType,
+			powDifficulty: resolved.powDifficulty,
+			solvedImagesCount: resolved.solvedImagesCount,
+			puzzleTolerance: resolved.puzzleTolerance
+		}
+	}));
+	return {
+		kind: "challenge",
+		captchaType: resolved.captchaType,
+		powDifficulty: resolved.powDifficulty,
+		solvedImagesCount: resolved.solvedImagesCount,
+		puzzleTolerance: resolved.puzzleTolerance,
+		sourceCategories: resolved.sourceCategories
+	};
+};
+/**
+* Frictionless-flow companion to `applyTrafficFilterAtRequestTime`. When the
+* verdict is `block`, respond 401 and short-circuit. When the verdict is
+* `challenge` and names a concrete captchaType, dispatch to the matching
+* `send{Image,Pow,Puzzle}Captcha` helper with the resolved parameter
+* overrides. Otherwise returns `{ handled: false }` so the caller falls
+* through to the normal decision machine.
+*/
+var handleFrictionlessTrafficFilter = async (input, res) => {
+	const { verdict } = input;
+	if (verdict.kind === "pass") return { handled: false };
+	if (verdict.kind === "block") return {
+		handled: true,
+		response: res.status(401).json({ error: "Unauthorized" })
+	};
+	const baseParams = {
+		userSitekeyIpHash: input.userSitekeyIpHash,
+		siteKey: input.dapp,
+		ipInfo: input.ipInfo,
+		headers: input.flatHeaders
+	};
+	const logDispatch = (captchaType) => {
+		input.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "traffic_filter",
+				captchaType,
+				categories: verdict.sourceCategories
+			}
+		}));
+	};
+	let response;
+	if (verdict.captchaType === CaptchaType.image) {
+		logDispatch(CaptchaType.image);
+		response = await input.frictionlessManager.sendImageCaptcha({
+			...baseParams,
+			solvedImagesCount: verdict.solvedImagesCount ? Math.min(verdict.solvedImagesCount, input.clientRecord.settings.imageMaxRounds) : input.clientRecord.settings.imageMaxRounds
+		});
+	} else if (verdict.captchaType === CaptchaType.pow) {
+		logDispatch(CaptchaType.pow);
+		response = await input.frictionlessManager.sendPowCaptcha({
+			...baseParams,
+			...verdict.powDifficulty !== void 0 && { powDifficulty: verdict.powDifficulty }
+		});
+	} else if (verdict.captchaType === CaptchaType.puzzle) {
+		logDispatch(CaptchaType.puzzle);
+		response = await input.frictionlessManager.sendPuzzleCaptcha(baseParams);
+	}
+	if (response) return {
+		handled: true,
+		response: res.json(response)
+	};
+	return { handled: false };
+};
+//#endregion
+export { applyTrafficFilterAtRequestTime, handleFrictionlessTrafficFilter };

package/dist/api/captcha/trafficFilterRequestTime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trafficFilterRequestTime.js","sourceRoot":"","sources":["../../../src/api/captcha/trafficFilterRequestTime.ts"],"names":[],"mappings":"AAeA,OAAO,EACN,WAAW,EAIX,mBAAmB,GACnB,MAAM,gBAAgB,CAAC;AAIxB,OAAO,EAGN,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,wCAAwC,CAAC;AA6BhD,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAC9C,MAAkC,EAClC,aAAkD,EAClD,MAAe,EACa,EAAE;IAC9B,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAG5C,MAAM,SAAS,GAA4B;QAC1C,MAAM,EAAE,EAAE,MAAM,EAAE,mBAAmB,CAAC,KAAK,EAAE;QAC7C,GAAG,aAAa;KAChB,CAAC;IAEF,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACnB,GAAG,EAAE,2CAA2C;YAChD,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;SAC/B,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEvC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACnB,GAAG,EAAE,4CAA4C;QACjD,IAAI,EAAE;YACL,UAAU,EAAE,QAAQ,CAAC,gBAAgB;YACrC,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;YAC7C,eAAe,EAAE,QAAQ,CAAC,eAAe;SACzC;KACD,CAAC,CAAC,CAAC;IAEJ,OAAO;QACN,IAAI,EAAE,WAAW;QACjB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,aAAa,EAAE,QAAQ,CAAC,aAAa;QACrC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;KAC3C,CAAC;AACH,CAAC,CAAC;AAyBF,MAAM,CAAC,MAAM,+BAA+B,GAAG,KAAK,EACnD,KAAqC,EACrC,GAAa,EAC+B,EAAE;IAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAEvD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO;YACN,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;SACzD,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG;QAClB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,OAAO,EAAE,KAAK,CAAC,IAAI;QACnB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,KAAK,CAAC,WAAW;KAC1B,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,WAAwB,EAAQ,EAAE;QACtD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACxB,GAAG,EAAE,uBAAuB;YAC5B,IAAI,EAAE;gBACL,QAAQ,EAAE,gBAAgB;gBAC1B,WAAW;gBACX,UAAU,EAAE,OAAO,CAAC,gBAAgB;aACpC;SACD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,IAAI,QAAoD,CAAC;IACzD,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;QAC/C,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC/B,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,CAAC;YAC3D,GAAG,UAAU;YACb,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC3C,CAAC,CAAC,IAAI,CAAC,GAAG,CACR,OAAO,CAAC,iBAAiB,EACzB,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc,CAC1C;gBACF,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,cAAc;SAC7C,CAAC,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC,GAAG,EAAE,CAAC;QACpD,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC7B,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,cAAc,CAAC;YACzD,GAAG,UAAU;YACb,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI;gBAC1C,aAAa,EAAE,OAAO,CAAC,aAAa;aACpC,CAAC;SACF,CAAC,CAAC;IACJ,CAAC;SAAM,IAAI,OAAO,CAAC,WAAW,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACvD,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAChC,QAAQ,GAAG,MAAM,KAAK,CAAC,mBAAmB,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC1E,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxD,CAAC;IAOD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC,CAAC"}

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -10,6 +10,7 @@ const require_hashUserIp = require("../../../utils/hashUserIp.cjs");
 const require_normalizeRequestIp = require("../../../utils/normalizeRequestIp.cjs");
 const require_testSiteKey = require("../../testSiteKey.cjs");
 const require_maintenanceModeResponses = require("../maintenanceModeResponses.cjs");
+const require_trafficFilterRequestTime = require("../trafficFilterRequestTime.cjs");
 const require_honeypotResponse = require("./honeypotResponse.cjs");
 const require_accessPolicy = require("./accessPolicy.cjs");
 require("./constants.cjs");
@@ -313,6 +314,18 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 		if (accessPolicyOutcome.handled) return accessPolicyOutcome.response;
 		botScore = accessPolicyOutcome.botScore;
 		scoreComponents = accessPolicyOutcome.scoreComponents;
+		const trafficFilterVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientRecord.settings?.trafficFilter, req.logger);
+		const trafficFilterOutcome = await require_trafficFilterRequestTime.handleFrictionlessTrafficFilter({
+			verdict: trafficFilterVerdict,
+			frictionlessManager: tasks.frictionlessManager,
+			clientRecord,
+			userSitekeyIpHash,
+			dapp,
+			ipInfo: req.ipInfo,
+			flatHeaders,
+			logger: req.logger
+		}, res);
+		if (trafficFilterOutcome.handled) return trafficFilterOutcome.response;
 		return await require_decisionMachine.runDecisionMachine({
 			tasks,
 			env,

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -5,6 +5,7 @@ const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
+const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
@@ -83,8 +84,19 @@ var getImageCaptchaChallenge_default = (env, userAccessRulesStorage) => async (r
 			i18n: req.i18n,
 			logger: req.logger
 		}));
+		const trafficVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientRecord.settings?.trafficFilter, req.logger);
+		if (trafficVerdict.kind === "block") return next(new _prosopo_common.ProsopoApiError(trafficVerdict.reason, {
+			context: {
+				code: 401,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const trafficSolvedImagesCount = trafficVerdict.kind === "challenge" ? trafficVerdict.solvedImagesCount : void 0;
 		const captchaConfig = {
-			solved: { count: Math.min(solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count, clientRecord.settings.imageMaxRounds ?? _prosopo_types.imageMaxRoundsDefault) },
+			solved: { count: Math.min(trafficSolvedImagesCount || solvedImagesCount || userAccessPolicy?.solvedImagesCount || env.config.captchas.solved.count, clientRecord.settings.imageMaxRounds ?? _prosopo_types.imageMaxRoundsDefault) },
 			unsolved: { count: userAccessPolicy?.unsolvedImagesCount || env.config.captchas.unsolved.count }
 		};
 		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {

package/dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs

@@ -6,6 +6,7 @@ const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
+const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
@@ -77,7 +78,17 @@ var getPoWCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req
 			i18n: req.i18n,
 			logger: req.logger
 		}));
-		const difficulty = powDifficulty || userAccessPolicy?.powDifficulty || clientSettings?.settings?.powDifficulty;
+		const trafficVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientSettings.settings?.trafficFilter, req.logger);
+		if (trafficVerdict.kind === "block") return next(new _prosopo_common.ProsopoApiError(trafficVerdict.reason, {
+			context: {
+				code: 401,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const difficulty = (trafficVerdict.kind === "challenge" ? trafficVerdict.powDifficulty : void 0) || powDifficulty || userAccessPolicy?.powDifficulty || clientSettings?.settings?.powDifficulty;
 		const challenge = await tasks.powCaptchaManager.getPowCaptchaChallenge(user, dapp, origin, difficulty);
 		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {
 			req.logger.warn(() => ({

package/dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs

@@ -6,6 +6,7 @@ const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
+const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
@@ -77,7 +78,17 @@ var getPuzzleCaptchaChallenge_default = (env, userAccessRulesStorage) => async (
 			i18n: req.i18n,
 			logger: req.logger
 		}));
-		const tolerance = clientSettings?.settings?.puzzleTolerance;
+		const trafficVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientSettings.settings?.trafficFilter, req.logger);
+		if (trafficVerdict.kind === "block") return next(new _prosopo_common.ProsopoApiError(trafficVerdict.reason, {
+			context: {
+				code: 401,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const tolerance = (trafficVerdict.kind === "challenge" ? trafficVerdict.puzzleTolerance : void 0) ?? clientSettings?.settings?.puzzleTolerance;
 		const challenge = await tasks.puzzleCaptchaManager.getPuzzleCaptchaChallenge(user, dapp, origin, tolerance);
 		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {
 			req.logger.warn(() => ({

package/dist/cjs/api/captcha/trafficFilterRequestTime.cjs

@@ -0,0 +1,111 @@
+const require_checkTrafficFilter = require("../../tasks/spam/checkTrafficFilter.cjs");
+let _prosopo_types = require("@prosopo/types");
+//#region src/api/captcha/trafficFilterRequestTime.ts
+/**
+* Evaluate the site's `trafficFilter` against the current request's IP info
+* at challenge-request time. Runs before captcha issuance so that a matched
+* `block` policy short-circuits with 401 (no captcha issued, mirroring the
+* `blockMiddleware` semantics) and a matched `challenge` policy hands back
+* an override bundle for the caller to fold into its captcha-type +
+* parameter selection.
+*
+* The verdict is authoritative for the request-time gate. Callers still run
+* `resolveTrafficFilterCheck` at submit time to catch `block` policies that
+* apply to the current (verify-time) IP even when the challenge-time IP
+* passed.
+*/
+var applyTrafficFilterAtRequestTime = (ipInfo, trafficFilter, logger) => {
+	if (!trafficFilter) return { kind: "pass" };
+	const effective = {
+		abuser: { action: _prosopo_types.TrafficFilterAction.Block },
+		...trafficFilter
+	};
+	const result = require_checkTrafficFilter.checkTrafficFilter(ipInfo, effective);
+	if (result.isBlocked) {
+		logger?.info(() => ({
+			msg: "Traffic filter rejected challenge request",
+			data: { reason: result.reason }
+		}));
+		return {
+			kind: "block",
+			reason: result.reason
+		};
+	}
+	const resolved = require_checkTrafficFilter.resolveChallengePolicy(result.matches);
+	if (!resolved) return { kind: "pass" };
+	logger?.info(() => ({
+		msg: "Traffic filter applied challenge overrides",
+		data: {
+			categories: resolved.sourceCategories,
+			captchaType: resolved.captchaType,
+			powDifficulty: resolved.powDifficulty,
+			solvedImagesCount: resolved.solvedImagesCount,
+			puzzleTolerance: resolved.puzzleTolerance
+		}
+	}));
+	return {
+		kind: "challenge",
+		captchaType: resolved.captchaType,
+		powDifficulty: resolved.powDifficulty,
+		solvedImagesCount: resolved.solvedImagesCount,
+		puzzleTolerance: resolved.puzzleTolerance,
+		sourceCategories: resolved.sourceCategories
+	};
+};
+/**
+* Frictionless-flow companion to `applyTrafficFilterAtRequestTime`. When the
+* verdict is `block`, respond 401 and short-circuit. When the verdict is
+* `challenge` and names a concrete captchaType, dispatch to the matching
+* `send{Image,Pow,Puzzle}Captcha` helper with the resolved parameter
+* overrides. Otherwise returns `{ handled: false }` so the caller falls
+* through to the normal decision machine.
+*/
+var handleFrictionlessTrafficFilter = async (input, res) => {
+	const { verdict } = input;
+	if (verdict.kind === "pass") return { handled: false };
+	if (verdict.kind === "block") return {
+		handled: true,
+		response: res.status(401).json({ error: "Unauthorized" })
+	};
+	const baseParams = {
+		userSitekeyIpHash: input.userSitekeyIpHash,
+		siteKey: input.dapp,
+		ipInfo: input.ipInfo,
+		headers: input.flatHeaders
+	};
+	const logDispatch = (captchaType) => {
+		input.logger.info(() => ({
+			msg: "Frictionless decision",
+			data: {
+				decision: "traffic_filter",
+				captchaType,
+				categories: verdict.sourceCategories
+			}
+		}));
+	};
+	let response;
+	if (verdict.captchaType === _prosopo_types.CaptchaType.image) {
+		logDispatch(_prosopo_types.CaptchaType.image);
+		response = await input.frictionlessManager.sendImageCaptcha({
+			...baseParams,
+			solvedImagesCount: verdict.solvedImagesCount ? Math.min(verdict.solvedImagesCount, input.clientRecord.settings.imageMaxRounds) : input.clientRecord.settings.imageMaxRounds
+		});
+	} else if (verdict.captchaType === _prosopo_types.CaptchaType.pow) {
+		logDispatch(_prosopo_types.CaptchaType.pow);
+		response = await input.frictionlessManager.sendPowCaptcha({
+			...baseParams,
+			...verdict.powDifficulty !== void 0 && { powDifficulty: verdict.powDifficulty }
+		});
+	} else if (verdict.captchaType === _prosopo_types.CaptchaType.puzzle) {
+		logDispatch(_prosopo_types.CaptchaType.puzzle);
+		response = await input.frictionlessManager.sendPuzzleCaptcha(baseParams);
+	}
+	if (response) return {
+		handled: true,
+		response: res.json(response)
+	};
+	return { handled: false };
+};
+//#endregion
+exports.applyTrafficFilterAtRequestTime = applyTrafficFilterAtRequestTime;
+exports.handleFrictionlessTrafficFilter = handleFrictionlessTrafficFilter;

package/dist/cjs/tasks/captchaManager.cjs

@@ -438,7 +438,10 @@ var CaptchaManager = class CaptchaManager {
 		return require_checkSpamEmail.checkSpamEmail(email, this.db, this.config, this.logger);
 	}
 	/**
-	* Resolves the IP info to feed to `checkTrafficFilter` and runs the check.
+	* Resolves the IP info to feed to `checkTrafficFilter` and runs the check
+	* at submit time. Only `action: "block"` matches produce `isBlocked:true`;
+	* `action: "challenge"` matches were already applied at request time and
+	* are ignored here.
 	*
 	* - The captcha record already carries the IPInfoResponse from request
 	*   time (ipInfoMiddleware → storeXxxRecord), so by default we reuse it
@@ -448,9 +451,10 @@ var CaptchaManager = class CaptchaManager {
 	*   and may differ from the IP that originally requested the captcha.
 	* - When the session carries a `dnsEvent`, its `peerIp` and `resolverIp`
 	*   are enriched and passed alongside the primary IP.
-	* - `blockAbuser` defaults to true so abusive networks are always
-	*   blocked even when the site hasn't configured a trafficFilter.
-	* - Returns `{ isBlocked: false }` if every filter flag is off, without
+	* - The abuser category defaults to `{action:"block"}` so abusive
+	*   networks are always blocked even when the site hasn't configured a
+	*   trafficFilter.
+	* - Returns `{ isBlocked: false }` if no category is active, without
 	*   consulting the payload at all.
 	*
 	* Callers handle the "blocked" branch themselves (each verify path
@@ -459,10 +463,13 @@ var CaptchaManager = class CaptchaManager {
 	*/
 	async resolveTrafficFilterCheck(env, recordIpInfo, trafficFilter, currentIp, enrichedDnsEvent) {
 		const effective = {
-			blockAbuser: true,
+			abuser: { action: _prosopo_types.TrafficFilterAction.Block },
 			...trafficFilter
 		};
-		if (!Object.values(effective).some((v) => v)) return { isBlocked: false };
+		if (!(effective.vpn !== void 0 || effective.proxy !== void 0 || effective.tor !== void 0 || effective.abuser !== void 0 || effective.datacenter !== void 0 || effective.mobile !== void 0 || effective.satellite !== void 0 || effective.crawler !== void 0)) return {
+			isBlocked: false,
+			matches: []
+		};
 		const ipInfo = currentIp ? await env.ipInfoService.lookup(currentIp) : recordIpInfo;
 		return require_checkTrafficFilter.checkTrafficFilter(ipInfo, effective, require_enrichDnsEvent.extraIpInfosFromEnrichedDnsEvent(enrichedDnsEvent), enrichedDnsEvent?.pathValid);
 	}

package/dist/cjs/tasks/dnsEvent/enrichDnsEvent.cjs

@@ -46,15 +46,17 @@ var extraIpInfosFromEnrichedDnsEvent = (enriched) => {
 *   - client IP is a consumer ISP but resolver is datacenter (compound)
 *
 * When `trafficFilter` is supplied, the datacenter and abuser contributions
-* are gated on the same rules `checkTrafficFilter` uses for the client IP:
+* are gated on the same rules `checkTrafficFilter` uses for the client IP.
+* A category counts here whenever the operator has configured any policy
+* for it (block or challenge) — either intent signals suspicion.
 *
-*   - `blockDatacenter` must be opted in (default off); IPs whose
+*   - datacenter category must be configured; IPs whose
 *     `providerType === "isp"` short-circuit; named allowlist skips
-*   - `blockAbuser` opt-in (default on) with the abuser-score threshold
+*   - abuser category defaults to configured, with the score threshold
 *   - cross-category suppression: VPN / proxy / Tor / crawler IPs that also
 *     carry `isDatacenter=true` are NOT counted as datacenter when the
-*     operator hasn't opted into blocking that more specific category —
-*     mirrors the `datacenterSuppressedByCategory` rule in evaluateIpInfo.
+*     operator hasn't configured that more specific category — mirrors
+*     the `datacenterSuppressedByCategory` rule in evaluateIpInfo.
 *
 * `pathValid` is a protocol signal, not a category — it always contributes
 * regardless of trafficFilter. When `trafficFilter` is omitted, all
@@ -68,16 +70,16 @@ var computeDnsAsymmetry = (enriched, clientIpInfo, trafficFilter) => {
 	const countDc = (ip) => {
 		if (!ip?.isValid || !ip.isDatacenter) return false;
 		if (!trafficFilter) return true;
-		if (trafficFilter.blockDatacenter !== true) return false;
+		if (trafficFilter.datacenter === void 0) return false;
 		if (require_checkTrafficFilter.isDatacenterDenylisted(ip, trafficFilter.datacenterNameDenylist)) return true;
-		if (ip.isVPN && trafficFilter.blockVpn !== true || ip.isProxy && trafficFilter.blockProxy !== true || ip.isTor && trafficFilter.blockTor !== true || ip.isCrawler && trafficFilter.blockCrawler !== true) return false;
+		if (ip.isVPN && trafficFilter.vpn === void 0 || ip.isProxy && trafficFilter.proxy === void 0 || ip.isTor && trafficFilter.tor === void 0 || ip.isCrawler && trafficFilter.crawler === void 0) return false;
 		if (ip.providerType === "isp") return false;
 		return !require_checkTrafficFilter.isDatacenterAllowlisted(ip, trafficFilter.datacenterNameAllowlist);
 	};
 	const countAbuser = (ip) => {
 		if (!ip?.isValid || !ip.isAbuser) return false;
 		if (!trafficFilter) return true;
-		if (trafficFilter.blockAbuser === false) return false;
+		if (trafficFilter.abuser === void 0) return false;
 		const threshold = trafficFilter.abuserScoreThreshold ?? _prosopo_types.trafficFilterAbuserScoreThresholdDefault;
 		return Math.max(ip.abuserScore ?? 0, ip.companyAbuserScore ?? 0) >= threshold;
 	};

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -127,6 +127,7 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			const dappAccount = (0, _prosopo_util.at)(challengeSplit, 2);
 			this.usageCounters.incrManyAsync(dappAccount, require_usageCounters.buildAllWindowIncrements("solved", _prosopo_types.CaptchaType.puzzle, ipAddress.address, userAccount));
 		}
+		await this.db.updatePuzzleCaptchaRecord(challenge, { puzzleEvents });
 		if (behavioralData) try {
 			const bundle = await this.resolveBundleBySessionId(challengeRecord.sessionId);
 			const decryptedData = await this.decryptBehavioralData(behavioralData, bundle);
@@ -153,8 +154,7 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				};
 				await this.db.updatePuzzleCaptchaRecord(challenge, {
 					behavioralDataPacked: packedData,
-					deviceCapability: decryptedData.deviceCapability,
-					puzzleEvents
+					deviceCapability: decryptedData.deviceCapability
 				});
 			}
 		} catch (error) {
@@ -163,7 +163,6 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				err: error
 			}));
 		}
-		else await this.db.updatePuzzleCaptchaRecord(challenge, { puzzleEvents });
 		if (clientMetaData?.hp) await this.db.updatePuzzleCaptchaRecord(challenge, { clientMetaData: { hp: clientMetaData.hp } });
 		await this.db.updatePuzzleCaptchaRecordResult(challenge, result, false, true, userTimestampSignature, coords);
 		if (challengeRecord.sessionId) {