@prosopo/provider 5.0.5 → 5.1.0

package/dist/tests/unit/tasks/spam/checkTrafficFilter.unit.test.js

@@ -1,5 +1,6 @@
+import { CaptchaType, TrafficFilterAction, } from "@prosopo/types";
 import { describe, expect, it } from "vitest";
-import { checkTrafficFilter } from "../../../../tasks/spam/checkTrafficFilter.js";
+import { checkTrafficFilter, resolveChallengePolicy, } from "../../../../tasks/spam/checkTrafficFilter.js";
 const baseInfo = (overrides = {}) => ({
     ip: "1.2.3.4",
     isValid: true,
@@ -13,38 +14,54 @@ const baseInfo = (overrides = {}) => ({
     isCrawler: false,
     ...overrides,
 });
+const block = { action: TrafficFilterAction.Block };
 const allBlocked = {
-    blockVpn: true,
-    blockProxy: true,
-    blockTor: true,
-    blockAbuser: true,
+    vpn: block,
+    proxy: block,
+    tor: block,
+    abuser: block,
     abuserScoreThreshold: 0,
-    blockDatacenter: true,
+    datacenter: block,
     skipExtrasOnValidDnsPath: false,
-    blockMobile: true,
-    blockSatellite: true,
-    blockCrawler: true,
+    mobile: block,
+    satellite: block,
+    crawler: block,
 };
 describe("checkTrafficFilter", () => {
     it("blocks VPN when blockVpn is true", () => {
         const result = checkTrafficFilter(baseInfo({ isVPN: true }), allBlocked);
-        expect(result).toEqual({ isBlocked: true, reason: "API.VPN_BLOCKED" });
+        expect(result).toMatchObject({
+            isBlocked: true,
+            reason: "API.VPN_BLOCKED",
+        });
     });
     it("blocks proxy when blockProxy is true", () => {
         const result = checkTrafficFilter(baseInfo({ isProxy: true }), allBlocked);
-        expect(result).toEqual({ isBlocked: true, reason: "API.PROXY_BLOCKED" });
+        expect(result).toMatchObject({
+            isBlocked: true,
+            reason: "API.PROXY_BLOCKED",
+        });
     });
     it("blocks Tor when blockTor is true", () => {
         const result = checkTrafficFilter(baseInfo({ isTor: true }), allBlocked);
-        expect(result).toEqual({ isBlocked: true, reason: "API.TOR_BLOCKED" });
+        expect(result).toMatchObject({
+            isBlocked: true,
+            reason: "API.TOR_BLOCKED",
+        });
     });
     it("blocks abusive ASN when blockAbuser is true", () => {
         const result = checkTrafficFilter(baseInfo({ isAbuser: true }), allBlocked);
-        expect(result).toEqual({ isBlocked: true, reason: "API.ABUSER_BLOCKED" });
+        expect(result).toMatchObject({
+            isBlocked: true,
+            reason: "API.ABUSER_BLOCKED",
+        });
     });
     it("blocks abuser when score meets threshold", () => {
         const result = checkTrafficFilter(baseInfo({ isAbuser: true, abuserScore: 0.06, companyAbuserScore: 0.03 }), { ...allBlocked, abuserScoreThreshold: 0.05 });
-        expect(result).toEqual({ isBlocked: true, reason: "API.ABUSER_BLOCKED" });
+        expect(result).toMatchObject({
+            isBlocked: true,
+            reason: "API.ABUSER_BLOCKED",
+        });
     });
     it("allows abuser when score is below threshold", () => {
         const result = checkTrafficFilter(baseInfo({
@@ -52,7 +69,7 @@ describe("checkTrafficFilter", () => {
             abuserScore: 0.0052,
             companyAbuserScore: 0.0273,
         }), { ...allBlocked, abuserScoreThreshold: 0.05 });
-        expect(result).toEqual({ isBlocked: false });
+        expect(result).toMatchObject({ isBlocked: false });
     });
     it("uses company abuser score when it is higher than ASN score", () => {
         const result = checkTrafficFilter(baseInfo({
@@ -60,81 +77,93 @@ describe("checkTrafficFilter", () => {
             abuserScore: 0.01,
             companyAbuserScore: 0.08,
         }), { ...allBlocked, abuserScoreThreshold: 0.05 });
-        expect(result).toEqual({ isBlocked: true, reason: "API.ABUSER_BLOCKED" });
+        expect(result).toMatchObject({
+            isBlocked: true,
+            reason: "API.ABUSER_BLOCKED",
+        });
     });
     it("blocks datacenter when blockDatacenter is true", () => {
         const result = checkTrafficFilter(baseInfo({ isDatacenter: true }), allBlocked);
-        expect(result).toEqual({
+        expect(result).toMatchObject({
             isBlocked: true,
             reason: "API.DATACENTER_BLOCKED",
         });
     });
     it("does not block VPN-on-datacenter IPs when blockDatacenter is on but blockVpn is off", () => {
-        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isVPN: true }), { ...allBlocked, blockVpn: false });
-        expect(result).toEqual({ isBlocked: false });
+        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isVPN: true }), { ...allBlocked, vpn: undefined });
+        expect(result).toMatchObject({ isBlocked: false });
     });
     it("does not block proxy-on-datacenter IPs when blockDatacenter is on but blockProxy is off", () => {
-        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isProxy: true }), { ...allBlocked, blockProxy: false });
-        expect(result).toEqual({ isBlocked: false });
+        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isProxy: true }), { ...allBlocked, proxy: undefined });
+        expect(result).toMatchObject({ isBlocked: false });
     });
     it("does not block Tor-on-datacenter IPs when blockDatacenter is on but blockTor is off", () => {
-        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isTor: true }), { ...allBlocked, blockTor: false });
-        expect(result).toEqual({ isBlocked: false });
+        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isTor: true }), { ...allBlocked, tor: undefined });
+        expect(result).toMatchObject({ isBlocked: false });
     });
     it("does not block crawler-on-datacenter IPs when blockDatacenter is on but blockCrawler is off", () => {
-        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isCrawler: true }), { ...allBlocked, blockCrawler: false });
-        expect(result).toEqual({ isBlocked: false });
+        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isCrawler: true }), { ...allBlocked, crawler: undefined });
+        expect(result).toMatchObject({ isBlocked: false });
     });
     it("still blocks raw datacenter (non-VPN) IPs when blockDatacenter is on and blockVpn is off", () => {
-        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isVPN: false }), { ...allBlocked, blockVpn: false });
-        expect(result).toEqual({
+        const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isVPN: false }), { ...allBlocked, vpn: undefined });
+        expect(result).toMatchObject({
             isBlocked: true,
             reason: "API.DATACENTER_BLOCKED",
         });
     });
     it("blocks VPN-on-datacenter IPs as VPN when both filters are enabled", () => {
         const result = checkTrafficFilter(baseInfo({ isDatacenter: true, isVPN: true }), allBlocked);
-        expect(result).toEqual({ isBlocked: true, reason: "API.VPN_BLOCKED" });
+        expect(result).toMatchObject({
+            isBlocked: true,
+            reason: "API.VPN_BLOCKED",
+        });
     });
     it("blocks mobile when blockMobile is true", () => {
         const result = checkTrafficFilter(baseInfo({ isMobile: true }), allBlocked);
-        expect(result).toEqual({ isBlocked: true, reason: "API.MOBILE_BLOCKED" });
+        expect(result).toMatchObject({
+            isBlocked: true,
+            reason: "API.MOBILE_BLOCKED",
+        });
     });
     it("blocks satellite when blockSatellite is true", () => {
         const result = checkTrafficFilter(baseInfo({ isSatellite: true }), allBlocked);
-        expect(result).toEqual({
+        expect(result).toMatchObject({
             isBlocked: true,
             reason: "API.SATELLITE_BLOCKED",
         });
     });
     it("blocks crawler when blockCrawler is true", () => {
         const result = checkTrafficFilter(baseInfo({ isCrawler: true }), allBlocked);
-        expect(result).toEqual({ isBlocked: true, reason: "API.CRAWLER_BLOCKED" });
+        expect(result).toMatchObject({
+            isBlocked: true,
+            reason: "API.CRAWLER_BLOCKED",
+        });
     });
     it("allows traffic when all filters are disabled", () => {
         const result = checkTrafficFilter(baseInfo({ isVPN: true }), {
-            blockVpn: false,
-            blockProxy: false,
-            blockTor: false,
-            blockAbuser: false,
-            blockDatacenter: false,
-            blockMobile: false,
-            blockSatellite: false,
-            blockCrawler: false,
-        });
-        expect(result).toEqual({ isBlocked: false });
+            vpn: undefined,
+            proxy: undefined,
+            tor: undefined,
+            abuser: undefined,
+            datacenter: undefined,
+            mobile: undefined,
+            satellite: undefined,
+            crawler: undefined,
+        });
+        expect(result).toMatchObject({ isBlocked: false });
     });
     it("allows residential IPs through", () => {
         const result = checkTrafficFilter(baseInfo(), allBlocked);
-        expect(result).toEqual({ isBlocked: false });
+        expect(result).toMatchObject({ isBlocked: false });
     });
     it("allows through if IP info is missing entirely", () => {
         const result = checkTrafficFilter(undefined, allBlocked);
-        expect(result).toEqual({ isBlocked: false });
+        expect(result).toMatchObject({ isBlocked: false });
     });
     it("allows through if IP info is invalid", () => {
         const result = checkTrafficFilter({ isValid: false, error: "lookup failed", ip: "1.2.3.4" }, allBlocked);
-        expect(result).toEqual({ isBlocked: false });
+        expect(result).toMatchObject({ isBlocked: false });
     });
     describe("extraIpInfos", () => {
         const cleanPrimary = baseInfo({ ip: "192.0.2.1" });
@@ -142,7 +171,7 @@ describe("checkTrafficFilter", () => {
             const result = checkTrafficFilter(cleanPrimary, allBlocked, [
                 baseInfo({ ip: "198.51.100.10", isDatacenter: true }),
             ]);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -155,13 +184,13 @@ describe("checkTrafficFilter", () => {
                     abuserScore: 95,
                 }),
             ]);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.ABUSER_BLOCKED",
             });
         });
         it("applies VPN-datacenter suppression to extra IPs when blockVpn is off", () => {
-            const noVpnBlock = { ...allBlocked, blockVpn: false };
+            const noVpnBlock = { ...allBlocked, vpn: undefined };
             const result = checkTrafficFilter(cleanPrimary, noVpnBlock, [
                 baseInfo({
                     ip: "198.51.100.10",
@@ -169,10 +198,10 @@ describe("checkTrafficFilter", () => {
                     isDatacenter: true,
                 }),
             ]);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("still blocks a datacenter extra that is not a VPN when blockVpn is off", () => {
-            const noVpnBlock = { ...allBlocked, blockVpn: false };
+            const noVpnBlock = { ...allBlocked, vpn: undefined };
             const result = checkTrafficFilter(cleanPrimary, noVpnBlock, [
                 baseInfo({
                     ip: "198.51.100.10",
@@ -180,22 +209,22 @@ describe("checkTrafficFilter", () => {
                     isDatacenter: true,
                 }),
             ]);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
         });
         it("does apply VPN-datacenter suppression to the primary IP", () => {
-            const noVpnBlock = { ...allBlocked, blockVpn: false };
+            const noVpnBlock = { ...allBlocked, vpn: undefined };
             const result = checkTrafficFilter(baseInfo({ isVPN: true, isDatacenter: true }), noVpnBlock);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("allows through when extra IPs are clean", () => {
             const result = checkTrafficFilter(cleanPrimary, allBlocked, [
                 baseInfo({ ip: "8.8.8.8" }),
                 baseInfo({ ip: "1.1.1.1" }),
             ]);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("ignores undefined / invalid entries in the extras list", () => {
             const result = checkTrafficFilter(cleanPrimary, allBlocked, [
@@ -203,7 +232,7 @@ describe("checkTrafficFilter", () => {
                 { isValid: false, error: "lookup failed", ip: "1.2.3.4" },
                 baseInfo({ ip: "198.51.100.10", isDatacenter: true }),
             ]);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -212,23 +241,26 @@ describe("checkTrafficFilter", () => {
             const result = checkTrafficFilter(baseInfo({ isTor: true }), allBlocked, [
                 baseInfo({ ip: "198.51.100.10", isDatacenter: true }),
             ]);
-            expect(result).toEqual({ isBlocked: true, reason: "API.TOR_BLOCKED" });
+            expect(result).toMatchObject({
+                isBlocked: true,
+                reason: "API.TOR_BLOCKED",
+            });
         });
         it("does not check the crawler flag on extra IPs even when blockCrawler is on", () => {
             const result = checkTrafficFilter(cleanPrimary, allBlocked, [
                 baseInfo({ ip: "8.8.8.8", isCrawler: true }),
             ]);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("still blocks the crawler flag on the primary IP when an extra is present", () => {
             const result = checkTrafficFilter(baseInfo({ isCrawler: true }), allBlocked, [baseInfo({ ip: "8.8.8.8" })]);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.CRAWLER_BLOCKED",
             });
         });
         it("applies proxy-datacenter suppression to extra IPs when blockProxy is off", () => {
-            const noProxyBlock = { ...allBlocked, blockProxy: false };
+            const noProxyBlock = { ...allBlocked, proxy: undefined };
             const result = checkTrafficFilter(cleanPrimary, noProxyBlock, [
                 baseInfo({
                     ip: "198.51.100.10",
@@ -236,10 +268,10 @@ describe("checkTrafficFilter", () => {
                     isDatacenter: true,
                 }),
             ]);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("applies Tor-datacenter suppression to extra IPs when blockTor is off", () => {
-            const noTorBlock = { ...allBlocked, blockTor: false };
+            const noTorBlock = { ...allBlocked, tor: undefined };
             const result = checkTrafficFilter(cleanPrimary, noTorBlock, [
                 baseInfo({
                     ip: "198.51.100.10",
@@ -247,12 +279,12 @@ describe("checkTrafficFilter", () => {
                     isDatacenter: true,
                 }),
             ]);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("applies crawler-datacenter suppression to extra IPs when blockCrawler is off", () => {
             const noCrawlerBlock = {
                 ...allBlocked,
-                blockCrawler: false,
+                crawler: undefined,
             };
             const result = checkTrafficFilter(cleanPrimary, noCrawlerBlock, [
                 baseInfo({
@@ -261,7 +293,7 @@ describe("checkTrafficFilter", () => {
                     isDatacenter: true,
                 }),
             ]);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
     });
     describe("datacenterNameAllowlist", () => {
@@ -270,7 +302,7 @@ describe("checkTrafficFilter", () => {
                 isDatacenter: true,
                 datacenterName: "iCloud Private Relay",
             }), { ...allBlocked, datacenterNameAllowlist: ["iCloud Private Relay"] });
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("matches the allowlist case-insensitively and ignores whitespace", () => {
             const result = checkTrafficFilter(baseInfo({
@@ -280,11 +312,11 @@ describe("checkTrafficFilter", () => {
                 ...allBlocked,
                 datacenterNameAllowlist: ["icloud private relay"],
             });
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("still blocks datacenter IPs whose name does not match", () => {
             const result = checkTrafficFilter(baseInfo({ isDatacenter: true, datacenterName: "Amazon AWS" }), { ...allBlocked, datacenterNameAllowlist: ["iCloud Private Relay"] });
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -294,7 +326,7 @@ describe("checkTrafficFilter", () => {
                 ...allBlocked,
                 datacenterNameAllowlist: ["iCloud Private Relay"],
             });
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -304,7 +336,7 @@ describe("checkTrafficFilter", () => {
                 isDatacenter: true,
                 datacenterName: "iCloud Private Relay",
             }), allBlocked);
-            expect(missing).toEqual({
+            expect(missing).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -312,7 +344,7 @@ describe("checkTrafficFilter", () => {
                 isDatacenter: true,
                 datacenterName: "iCloud Private Relay",
             }), { ...allBlocked, datacenterNameAllowlist: [] });
-            expect(empty).toEqual({
+            expect(empty).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -323,7 +355,7 @@ describe("checkTrafficFilter", () => {
                 isDatacenter: true,
                 datacenterName: "iCloud Private Relay",
             }), { ...allBlocked, datacenterNameAllowlist: ["iCloud Private Relay"] });
-            expect(torResult).toEqual({
+            expect(torResult).toMatchObject({
                 isBlocked: true,
                 reason: "API.TOR_BLOCKED",
             });
@@ -332,7 +364,7 @@ describe("checkTrafficFilter", () => {
                 isDatacenter: true,
                 datacenterName: "iCloud Private Relay",
             }), { ...allBlocked, datacenterNameAllowlist: ["iCloud Private Relay"] });
-            expect(vpnResult).toEqual({
+            expect(vpnResult).toMatchObject({
                 isBlocked: true,
                 reason: "API.VPN_BLOCKED",
             });
@@ -345,28 +377,28 @@ describe("checkTrafficFilter", () => {
                     datacenterName: "iCloud Private Relay",
                 }),
             ]);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("matches the allowlist against providerName when datacenterName is absent", () => {
             const result = checkTrafficFilter(baseInfo({
                 isDatacenter: true,
                 providerName: "iCloud Private Relay",
             }), { ...allBlocked, datacenterNameAllowlist: ["iCloud Private Relay"] });
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("matches the allowlist against asnOrganization when neither datacenterName nor providerName carries the operator", () => {
             const result = checkTrafficFilter(baseInfo({
                 isDatacenter: true,
                 asnOrganization: "Cloudflare, Inc.",
             }), { ...allBlocked, datacenterNameAllowlist: ["Cloudflare, Inc."] });
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("still blocks datacenter IPs that carry none of the three name fields", () => {
             const result = checkTrafficFilter(baseInfo({ isDatacenter: true }), {
                 ...allBlocked,
                 datacenterNameAllowlist: ["iCloud Private Relay"],
             });
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -380,18 +412,18 @@ describe("checkTrafficFilter", () => {
                 providerName: "afrihost.co.za",
                 asnOrganization: "AFRIHOST SP (PTY) LTD",
             }), allBlocked);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("still blocks datacenter IPs when providerType is 'hosting'", () => {
             const result = checkTrafficFilter(baseInfo({ isDatacenter: true, providerType: "hosting" }), allBlocked);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
         });
         it("still blocks datacenter IPs when providerType is missing", () => {
             const result = checkTrafficFilter(baseInfo({ isDatacenter: true }), allBlocked);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -402,7 +434,7 @@ describe("checkTrafficFilter", () => {
                 isDatacenter: true,
                 providerType: "isp",
             }), allBlocked);
-            expect(torResult).toEqual({
+            expect(torResult).toMatchObject({
                 isBlocked: true,
                 reason: "API.TOR_BLOCKED",
             });
@@ -411,7 +443,7 @@ describe("checkTrafficFilter", () => {
                 isDatacenter: true,
                 providerType: "isp",
             }), allBlocked);
-            expect(vpnResult).toEqual({
+            expect(vpnResult).toMatchObject({
                 isBlocked: true,
                 reason: "API.VPN_BLOCKED",
             });
@@ -424,7 +456,7 @@ describe("checkTrafficFilter", () => {
                     providerType: "isp",
                 }),
             ]);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
     });
     describe("datacenterNameDenylist", () => {
@@ -437,7 +469,7 @@ describe("checkTrafficFilter", () => {
                 ...allBlocked,
                 datacenterNameDenylist: ["proxy-lease-provider"],
             });
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -451,7 +483,7 @@ describe("checkTrafficFilter", () => {
                 ...allBlocked,
                 datacenterNameDenylist: ["proxy-lease-provider"],
             });
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -465,7 +497,7 @@ describe("checkTrafficFilter", () => {
                 ...allBlocked,
                 datacenterNameDenylist: ["proxy-lease-provider"],
             });
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -479,7 +511,7 @@ describe("checkTrafficFilter", () => {
                 ...allBlocked,
                 datacenterNameDenylist: ["Proxy Lease Ltd"],
             });
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -493,7 +525,7 @@ describe("checkTrafficFilter", () => {
                 datacenterNameAllowlist: ["shared-name"],
                 datacenterNameDenylist: ["shared-name"],
             });
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -506,7 +538,7 @@ describe("checkTrafficFilter", () => {
                 ...allBlocked,
                 datacenterNameDenylist: ["proxy-lease-provider"],
             });
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("does not fire when blockDatacenter is off", () => {
             const result = checkTrafficFilter(baseInfo({
@@ -515,10 +547,10 @@ describe("checkTrafficFilter", () => {
                 datacenterName: "proxy-lease-provider",
             }), {
                 ...allBlocked,
-                blockDatacenter: false,
+                datacenter: undefined,
                 datacenterNameDenylist: ["proxy-lease-provider"],
             });
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("preserves legacy behaviour when denylist is missing or empty", () => {
             const missing = checkTrafficFilter(baseInfo({
@@ -526,13 +558,13 @@ describe("checkTrafficFilter", () => {
                 providerType: "isp",
                 datacenterName: "some-isp",
             }), allBlocked);
-            expect(missing).toEqual({ isBlocked: false });
+            expect(missing).toMatchObject({ isBlocked: false });
             const empty = checkTrafficFilter(baseInfo({
                 isDatacenter: true,
                 providerType: "isp",
                 datacenterName: "some-isp",
             }), { ...allBlocked, datacenterNameDenylist: [] });
-            expect(empty).toEqual({ isBlocked: false });
+            expect(empty).toMatchObject({ isBlocked: false });
         });
         it("still lets earlier category rules fire before the datacenter check", () => {
             const result = checkTrafficFilter(baseInfo({
@@ -544,7 +576,7 @@ describe("checkTrafficFilter", () => {
                 ...allBlocked,
                 datacenterNameDenylist: ["proxy-lease-provider"],
             });
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.TOR_BLOCKED",
             });
@@ -561,7 +593,7 @@ describe("checkTrafficFilter", () => {
                     datacenterName: "proxy-lease-provider",
                 }),
             ]);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -576,7 +608,7 @@ describe("checkTrafficFilter", () => {
                     asnOrganization: "Cloudflare, Inc.",
                 }),
             ], true);
-            expect(result).toEqual({ isBlocked: false });
+            expect(result).toMatchObject({ isBlocked: false });
         });
         it("still evaluates extras when the setting is off, even if pathValid is true", () => {
             const result = checkTrafficFilter(baseInfo({ ip: "192.0.2.1" }), { ...allBlocked, skipExtrasOnValidDnsPath: false }, [
@@ -586,7 +618,7 @@ describe("checkTrafficFilter", () => {
                     asnOrganization: "Cloudflare, Inc.",
                 }),
             ], true);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -599,7 +631,7 @@ describe("checkTrafficFilter", () => {
                     asnOrganization: "Cloudflare, Inc.",
                 }),
             ], false);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -612,7 +644,7 @@ describe("checkTrafficFilter", () => {
                     asnOrganization: "Cloudflare, Inc.",
                 }),
             ], undefined);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
@@ -622,11 +654,153 @@ describe("checkTrafficFilter", () => {
                 isDatacenter: true,
                 datacenterName: "Amazon AWS",
             }), { ...allBlocked, skipExtrasOnValidDnsPath: true }, [], true);
-            expect(result).toEqual({
+            expect(result).toMatchObject({
                 isBlocked: true,
                 reason: "API.DATACENTER_BLOCKED",
             });
         });
     });
 });
+describe("resolveChallengePolicy", () => {
+    const challenge = (category, policy) => ({ category, policy });
+    it("returns undefined when there are no challenge matches", () => {
+        expect(resolveChallengePolicy([])).toBeUndefined();
+        expect(resolveChallengePolicy([
+            challenge("vpn", { action: TrafficFilterAction.Block }),
+        ])).toBeUndefined();
+    });
+    it("returns the sole challenge policy verbatim when only one matches", () => {
+        const resolved = resolveChallengePolicy([
+            challenge("vpn", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.pow,
+                powDifficulty: 7,
+            }),
+        ]);
+        expect(resolved).toEqual({
+            captchaType: CaptchaType.pow,
+            powDifficulty: 7,
+            solvedImagesCount: undefined,
+            puzzleTolerance: undefined,
+            sourceCategories: ["vpn"],
+        });
+    });
+    it("picks image over puzzle over pow when multiple categories name a captchaType", () => {
+        const resolved = resolveChallengePolicy([
+            challenge("vpn", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.pow,
+            }),
+            challenge("proxy", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.puzzle,
+            }),
+            challenge("datacenter", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.image,
+            }),
+        ]);
+        expect(resolved?.captchaType).toBe(CaptchaType.image);
+    });
+    it("picks puzzle over pow when no image challenge is present", () => {
+        const resolved = resolveChallengePolicy([
+            challenge("vpn", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.pow,
+            }),
+            challenge("proxy", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.puzzle,
+            }),
+        ]);
+        expect(resolved?.captchaType).toBe(CaptchaType.puzzle);
+    });
+    it("takes the highest pow difficulty across challenge matches", () => {
+        const resolved = resolveChallengePolicy([
+            challenge("vpn", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.pow,
+                powDifficulty: 4,
+            }),
+            challenge("proxy", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.pow,
+                powDifficulty: 9,
+            }),
+            challenge("datacenter", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.pow,
+                powDifficulty: 6,
+            }),
+        ]);
+        expect(resolved?.powDifficulty).toBe(9);
+    });
+    it("takes the highest image count across challenge matches", () => {
+        const resolved = resolveChallengePolicy([
+            challenge("vpn", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.image,
+                solvedImagesCount: 3,
+            }),
+            challenge("datacenter", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.image,
+                solvedImagesCount: 8,
+            }),
+        ]);
+        expect(resolved?.solvedImagesCount).toBe(8);
+    });
+    it("takes the lowest puzzle tolerance across challenge matches (stricter accuracy)", () => {
+        const resolved = resolveChallengePolicy([
+            challenge("vpn", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.puzzle,
+                puzzleTolerance: 40,
+            }),
+            challenge("datacenter", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.puzzle,
+                puzzleTolerance: 15,
+            }),
+        ]);
+        expect(resolved?.puzzleTolerance).toBe(15);
+    });
+    it("ignores block matches when combining challenge params", () => {
+        const resolved = resolveChallengePolicy([
+            challenge("vpn", { action: TrafficFilterAction.Block }),
+            challenge("proxy", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.pow,
+                powDifficulty: 5,
+            }),
+        ]);
+        expect(resolved?.sourceCategories).toEqual(["proxy"]);
+        expect(resolved?.powDifficulty).toBe(5);
+    });
+    it("leaves fields undefined when no matched policy sets them", () => {
+        const resolved = resolveChallengePolicy([
+            challenge("vpn", {
+                action: TrafficFilterAction.Challenge,
+                captchaType: CaptchaType.image,
+            }),
+        ]);
+        expect(resolved).toEqual({
+            captchaType: CaptchaType.image,
+            powDifficulty: undefined,
+            solvedImagesCount: undefined,
+            puzzleTolerance: undefined,
+            sourceCategories: ["vpn"],
+        });
+    });
+    it("keeps captchaType undefined when no matched policy specifies one (falls through to site default)", () => {
+        const resolved = resolveChallengePolicy([
+            challenge("vpn", {
+                action: TrafficFilterAction.Challenge,
+                powDifficulty: 7,
+            }),
+        ]);
+        expect(resolved?.captchaType).toBeUndefined();
+        expect(resolved?.powDifficulty).toBe(7);
+    });
+});
 //# sourceMappingURL=checkTrafficFilter.unit.test.js.map