@prosopo/provider 5.13.1 → 5.13.3

package/dist/cjs/api/verify.cjs

@@ -4,6 +4,7 @@ const require_tasks = require("../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("./admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_testSiteKey = require("./testSiteKey.cjs");
 const require_maintenanceModeResponses = require("./captcha/maintenanceModeResponses.cjs");
+const require_requestBodySummary = require("./requestBodySummary.cjs");
 const require_forwardVerify = require("./forwardVerify.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
@@ -89,7 +90,7 @@ function prosopoVerifyRouter(env) {
 				context: {
 					code: 400,
 					error: err,
-					body: req.body
+					body: require_requestBodySummary.summariseRequestBody(req)
 				},
 				i18n: req.i18n,
 				logger: req.logger
@@ -140,7 +141,7 @@ function prosopoVerifyRouter(env) {
 			req.logger.error(() => ({
 				err,
 				msg: "Error in verifyImageCaptchaSolution",
-				data: { body: req.body }
+				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
 				context: {
@@ -174,7 +175,7 @@ function prosopoVerifyRouter(env) {
 				context: {
 					code: 400,
 					error: err,
-					body: req.body
+					body: require_requestBodySummary.summariseRequestBody(req)
 				},
 				i18n: req.i18n,
 				logger: req.logger
@@ -230,7 +231,7 @@ function prosopoVerifyRouter(env) {
 			req.logger.error(() => ({
 				msg: "Error in verifyPowCaptchaSolution",
 				err,
-				data: { body: req.body }
+				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
 				context: {
@@ -263,7 +264,7 @@ function prosopoVerifyRouter(env) {
 				context: {
 					code: 400,
 					error: err,
-					body: req.body
+					body: require_requestBodySummary.summariseRequestBody(req)
 				},
 				i18n: req.i18n,
 				logger: req.logger
@@ -319,7 +320,7 @@ function prosopoVerifyRouter(env) {
 			req.logger.error(() => ({
 				msg: "Error in verifyPuzzleCaptchaSolution",
 				err,
-				data: { body: req.body }
+				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
 				context: {
@@ -352,7 +353,7 @@ function prosopoVerifyRouter(env) {
 				context: {
 					code: 400,
 					error: err,
-					body: req.body
+					body: require_requestBodySummary.summariseRequestBody(req)
 				},
 				i18n: req.i18n,
 				logger: req.logger
@@ -401,7 +402,7 @@ function prosopoVerifyRouter(env) {
 			req.logger.error(() => ({
 				err,
 				msg: "Error in verifyAuthenticatedSession",
-				data: { body: req.body }
+				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
 				context: {

package/dist/cjs/pairs.cjs

@@ -1,3 +1,4 @@
+let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
 //#region src/pairs.ts
 /** Construct list of pairs from flat list
@@ -20,18 +21,81 @@ var peelCheckboxPrefix = (flat, solutionLengths) => {
 	return { flat };
 };
 /**
-* Check if there are identical pairs in flattened lists of pairs
+* The input method of every coordinate pair embedded in each captcha's salt.
+* A captcha that declares none gets pointer for every pair, which keeps
+* requests from older widgets under the full repeated-position check.
+* Returns `undefined` when a captcha declares a different number of methods
+* than it has pairs: the official widget never sends that.
+* @param flat the coordinates extracted from each captcha's salt
+* @param declared the input methods each captcha declared, if any
+*/
+var resolveInputMethods = (flat, declared) => {
+	const resolved = [];
+	for (const [index, list] of flat.entries()) {
+		const pairCount = list.length / 2;
+		const methods = declared[index];
+		if (methods === void 0) resolved.push(new Array(pairCount).fill(_prosopo_types.InputMethod.pointer));
+		else if (methods.length === pairCount) resolved.push([...methods]);
+		else return;
+	}
+	return resolved;
+};
+/**
+* Give the checkbox's input method its own list, as `peelCheckboxPrefix` does
+* for its coordinates, so the result lines up with the pair lists.
+* @param methods the input methods of each captcha, checkbox first
+*/
+var peelCheckboxInputMethod = (methods) => {
+	const [first, ...rest] = methods;
+	if (first === void 0 || first.length === 0) return methods;
+	return [
+		first.slice(0, 1),
+		first.slice(1),
+		...rest
+	];
+};
+var isKeyboard = (inputMethods, listIndex, pairIndex) => inputMethods?.[listIndex]?.[pairIndex] === _prosopo_types.InputMethod.keyboard;
+/**
+* Whether any keyboard selection carries a pointer position. Keyboard
+* activation has none, and the widget sends (0, 0) for it, so a position here
+* means the request did not come from the widget.
 * @param pairsLists
+* @param inputMethods the same shape as `pairsLists`
 */
-var containsIdenticalPairs = (pairsLists) => {
-	const set = /* @__PURE__ */ new Set();
-	for (const pairList of pairsLists) for (const pair of pairList) {
+var keyboardSelectionHasPosition = (pairsLists, inputMethods) => pairsLists.some((pairList, listIndex) => pairList.some(([x, y], pairIndex) => isKeyboard(inputMethods, listIndex, pairIndex) && (x !== 0 || y !== 0)));
+/**
+* Check whether any pointer position repeats across the lists of pairs. A
+* person selecting the same tile in two rounds almost never lands on the same
+* pixel twice, whereas a script clicking each element's centre does. Keyboard
+* selections have no position and are left out; without `inputMethods` every
+* pair is a pointer selection.
+* @param pairsLists
+* @param inputMethods the same shape as `pairsLists`
+*/
+var containsIdenticalPairs = (pairsLists, inputMethods) => {
+	const seen = /* @__PURE__ */ new Set();
+	for (const [listIndex, pairList] of pairsLists.entries()) for (const [pairIndex, pair] of pairList.entries()) {
+		if (isKeyboard(inputMethods, listIndex, pairIndex)) continue;
 		const coordString = `${(0, _prosopo_util.at)(pair, 0)},${(0, _prosopo_util.at)(pair, 1)}`;
-		set.add(coordString);
+		if (seen.has(coordString)) return true;
+		seen.add(coordString);
 	}
-	return set.size !== pairsLists.flat().flat().length / 2;
+	return false;
 };
+/**
+* Whether the selections point to a script rather than a person: the declared
+* input methods do not line up with the coordinates, a keyboard selection
+* carries a position, or a pointer position repeats.
+* @param pairsLists
+* @param inputMethods the same shape as `pairsLists`, or `undefined` when the
+* declared methods did not line up with the coordinates
+*/
+var selectionsLookScripted = (pairsLists, inputMethods) => inputMethods === void 0 || keyboardSelectionHasPosition(pairsLists, inputMethods) || containsIdenticalPairs(pairsLists, inputMethods);
 //#endregion
 exports.constructPairList = constructPairList;
 exports.containsIdenticalPairs = containsIdenticalPairs;
+exports.keyboardSelectionHasPosition = keyboardSelectionHasPosition;
+exports.peelCheckboxInputMethod = peelCheckboxInputMethod;
 exports.peelCheckboxPrefix = peelCheckboxPrefix;
+exports.resolveInputMethods = resolveInputMethods;
+exports.selectionsLookScripted = selectionsLookScripted;

package/dist/cjs/tasks/captchaManager.cjs

@@ -294,6 +294,21 @@ var CaptchaManager = class CaptchaManager {
 			}
 			sessionId = resolvedSessionId;
 			if (this.writeQueue) await Promise.all([this.writeQueue.invalidateCachedSession(sessionId), sessionRecord.userSitekeyIpHash ? this.writeQueue.invalidateCachedSessionByHash(sessionRecord.userSitekeyIpHash) : Promise.resolve()]);
+			if (sessionRecord.siteKey !== void 0 && sessionRecord.siteKey !== clientSettings.account) {
+				this.logger.warn(() => ({
+					msg: "Session was issued for a different site key",
+					data: {
+						account: clientSettings.account,
+						sessionId,
+						sessionSiteKey: sessionRecord.siteKey
+					}
+				}));
+				return {
+					valid: false,
+					reason: _prosopo_types.ResultReason.CAPTCHA_NO_SESSION_FOUND,
+					type: requestedCaptchaType
+				};
+			}
 			if (currentIP) {
 				const ipValidation = await this.validateSessionIP(sessionRecord, currentIP, env);
 				if (!ipValidation.valid) return {

package/dist/cjs/tasks/frictionless/frictionlessTasks.cjs

@@ -217,7 +217,10 @@ var FrictionlessManager = class extends require_captchaManager.CaptchaManager {
 			verified: false,
 			status: "API.CLIENT_SESSION_MISMATCH"
 		};
-		await this.db.updateSessionRecord(sessionId, { serverChecked: true });
+		if (!await this.db.claimSessionServerCheck(sessionId)) return {
+			verified: false,
+			status: "API.USER_ALREADY_VERIFIED"
+		};
 		return {
 			verified: true,
 			status: "API.USER_VERIFIED"

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -124,10 +124,16 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			const { checkbox: checkboxCoordPair, flat } = require_pairs.peelCheckboxPrefix(rawFlat, receivedCaptchas.map((c) => c.solution.length));
 			const shapePairs = flat.map((list) => require_pairs.constructPairList(list));
 			const pairs = checkboxCoordPair ? [[checkboxCoordPair], ...shapePairs] : shapePairs;
+			const rawInputMethods = require_pairs.resolveInputMethods(rawFlat, receivedCaptchas.map((c) => c.inputMethods));
+			const inputMethods = rawInputMethods && checkboxCoordPair ? require_pairs.peelCheckboxInputMethod(rawInputMethods) : rawInputMethods;
+			const inputMethodsDeclared = receivedCaptchas.some((c) => c.inputMethods !== void 0);
 			const { tree, commitmentId } = require_imgCaptchaTasksUtils.buildTreeAndGetCommitmentId(receivedCaptchas);
 			const datasetId = (0, _prosopo_util.at)(storedCaptchas, 0).datasetId;
 			if (!datasetId) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.ID_MISMATCH", { context: { failedFuncName: this.dappUserSolution.name } });
-			await this.db.updatePendingImageCommitmentStatus(requestHash);
+			if (!await this.db.updatePendingImageCommitmentStatus(requestHash)) {
+				this.logger.info(() => ({ msg: "Request hash already consumed by a concurrent submission" }));
+				return response;
+			}
 			let behavioralDataPacked;
 			let deviceCapability;
 			if (behavioralData) try {
@@ -185,7 +191,8 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				deadlineTimestamp: pendingRecord.deadlineTimestamp,
 				...behavioralDataPacked && { behavioralDataPacked },
 				...deviceCapability && { deviceCapability },
-				...storedClientMetaData && { clientMetaData: storedClientMetaData }
+				...storedClientMetaData && { clientMetaData: storedClientMetaData },
+				...inputMethodsDeclared && inputMethods && { inputMethods }
 			};
 			await this.db.storeUserImageCaptchaSolution(receivedCaptchas, commit);
 			const solutionRecords = await Promise.all(storedCaptchas.map(async (captcha) => {
@@ -194,7 +201,7 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				return solutionRecord;
 			}));
 			const totalImages = storedCaptchas[0]?.items.length || 0;
-			if (require_pairs.containsIdenticalPairs(pairs) && process.env.NODE_ENV !== "test") {
+			if (require_pairs.selectionsLookScripted(pairs, inputMethods) && process.env.NODE_ENV !== "test") {
 				const writePromises = [this.db.disapproveDappUserCommitment(commitmentId, "CAPTCHA.INVALID_SOLUTION", pairs)];
 				if (pendingRecord.sessionId) {
 					writePromises.push(this.updateSessionRecordWithCache(pendingRecord.sessionId, {
@@ -219,9 +226,9 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			}
 			if ((0, _prosopo_datasets.compareCaptchaSolutions)(receivedCaptchas, solutionRecords, totalImages, pendingRecord.threshold)) {
 				response = {
-					captchas: captchaIds.map((id) => ({
+					captchas: captchaIds.map((id, index) => ({
 						captchaId: id,
-						proof: tree.proof(id)
+						proof: tree.proof((0, _prosopo_util.at)(tree.leaves, index).hash)
 					})),
 					verified: true
 				};
@@ -335,7 +342,11 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			verified: false,
 			...solution.sessionId && { sessionId: solution.sessionId }
 		};
-		await this.db.markDappUserCommitmentsChecked([solution.id]);
+		if (await this.db.markDappUserCommitmentsChecked([solution.id]) === 0) return {
+			status: "API.USER_ALREADY_VERIFIED",
+			verified: false,
+			...solution.sessionId && { sessionId: solution.sessionId }
+		};
 		if (solution.result.status === _prosopo_types.CaptchaStatus.disapproved) return {
 			status: solution.result.reason || "API.USER_NOT_VERIFIED",
 			verified: false,

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -75,6 +75,10 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			this.logger.debug(() => ({ msg: `No record of this challenge: ${challenge}` }));
 			return { verified: false };
 		}
+		if (challengeRecord.userSubmitted) {
+			this.logger.debug(() => ({ msg: `Challenge already submitted: ${challenge}` }));
+			return { verified: false };
+		}
 		const difficulty = challengeRecord.difficulty;
 		let coords;
 		let saltDecodeError;
@@ -314,7 +318,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			dappAccount,
 			challengeDappAccount
 		} });
-		await this.db.markDappUserPoWCommitmentsChecked([challengeRecord.challenge]);
+		if (await this.db.markDappUserPoWCommitmentsChecked([challengeRecord.challenge]) === 0) return notVerified("API.USER_ALREADY_VERIFIED", challengeRecord.sessionId);
 		const powRecordUpdates = {};
 		let failResult;
 		let failReason;

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -229,10 +229,7 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			dappAccount,
 			challengeDappAccount
 		} });
-		await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
-			serverChecked: true,
-			lastUpdatedTimestamp: /* @__PURE__ */ new Date()
-		});
+		if (!await this.db.markPuzzleCaptchaRecordChecked(challengeRecord.challenge)) return notVerifiedResponse;
 		const submittedAt = challengeRecord.submittedAtTimestamp;
 		if ((submittedAt instanceof Date ? Date.now() - submittedAt.getTime() : Number.POSITIVE_INFINITY) > timeout) {
 			const disapprovedResult = {

package/dist/cjs/tasks/spam/checkTrafficFilter.cjs

@@ -165,6 +165,16 @@ var resolveChallengePolicy = (matches) => {
 		sourceCategories: challenges.map((m) => m.category)
 	};
 };
+/**
+* Largest `padBytes` across all matched categories, block or challenge. A
+* blocked category still resolves to a deferred challenge at request time, so
+* padding it burns the caller's bandwidth on the way to being blocked.
+*/
+var resolvePadBytes = (matches) => {
+	let padBytes;
+	for (const m of matches) if (m.policy.padBytes !== void 0) padBytes = padBytes === void 0 ? m.policy.padBytes : Math.max(padBytes, m.policy.padBytes);
+	return padBytes;
+};
 //#endregion
 exports.categoryToReason = categoryToReason;
 exports.checkTrafficFilter = checkTrafficFilter;
@@ -172,3 +182,4 @@ exports.isDatacenterAllowlisted = isDatacenterAllowlisted;
 exports.isDatacenterDenylisted = isDatacenterDenylisted;
 exports.isEffectivelyDatacenter = isEffectivelyDatacenter;
 exports.resolveChallengePolicy = resolveChallengePolicy;
+exports.resolvePadBytes = resolvePadBytes;

package/dist/cjs/tasks/tasks.cjs

@@ -10,16 +10,11 @@ let _prosopo_common = require("@prosopo/common");
 let _prosopo_database = require("@prosopo/database");
 let _prosopo_logger = require("@prosopo/logger");
 //#region src/tasks/tasks.ts
-/**
-* Singleton write queue manager.
-* Ensures only one flush timer exists across all Tasks instances.
-*/
 var globalWriteQueue = null;
-var flushStarted = false;
 /**
 * @description Tasks that are shared by the API and CLI
 */
-var Tasks = class Tasks {
+var Tasks = class {
 	constructor(env, logger) {
 		this.env = env;
 		this.config = env.config;
@@ -57,43 +52,12 @@ var Tasks = class Tasks {
 		try {
 			const redisConnection = this.db.getRedisConnection();
 			globalWriteQueue = new _prosopo_database.RedisWriteQueue(redisConnection, this.logger);
-			if (!flushStarted) {
-				flushStarted = true;
-				const db = this.db;
-				const logger = this.logger;
-				globalWriteQueue.startPeriodicFlush(async (queue) => {
-					await Tasks.flushWriteQueue(queue, db, logger);
-				}, 1e4);
-			}
 			return globalWriteQueue;
 		} catch {
 			this.logger.debug(() => ({ msg: "Redis not available for write queue - falling back to direct writes" }));
 			return null;
 		}
 	}
-	/**
-	* Flush queued session records from Redis to MongoDB in bulk.
-	* Called periodically by the write queue timer.
-	*
-	* Note: PoW challenge and pending image commitment records are written
-	* directly to MongoDB (not queued) because verification endpoints need
-	* to read them immediately after creation. Session records are safe to
-	* queue because they are not read in the immediate request path.
-	*/
-	static async flushWriteQueue(queue, db, logger) {
-		const sessionRecords = await queue.drainSessionRecords();
-		if (sessionRecords.length > 0) {
-			logger.info(() => ({ msg: `Flushing ${sessionRecords.length} queued session records to MongoDB` }));
-			for (const { record } of sessionRecords) try {
-				await db.storeSessionRecord(record);
-			} catch (error) {
-				logger.error(() => ({
-					msg: "Failed to flush queued session record",
-					err: error
-				}));
-			}
-		}
-	}
 	setLogger(logger) {
 		this.logger = logger;
 		this.powCaptchaManager.logger = logger;

package/dist/cjs/utils/tarpitPadding.cjs

@@ -0,0 +1,23 @@
+let _prosopo_types = require("@prosopo/types");
+//#region src/utils/tarpitPadding.ts
+var POOL = (0, require("node:crypto").randomBytes)(Math.ceil(_prosopo_types.MAX_PAD_BYTES * 3 / 4)).toString("base64");
+var clampPadBytes = (padBytes) => padBytes && padBytes > 0 ? Math.min(Math.floor(padBytes), _prosopo_types.MAX_PAD_BYTES) : 0;
+var streamWithPad = (res, body, n) => {
+	const offset = Math.floor(Math.random() * (POOL.length - n + 1));
+	const rest = JSON.stringify(body);
+	res.setHeader("content-type", "application/json; charset=utf-8");
+	res.write("{\"pad\":\"");
+	res.write(POOL.slice(offset, offset + n));
+	res.write(`",${rest.slice(1)}`);
+	return res.end();
+};
+var padResponseMiddleware = (_req, res, next) => {
+	const originalJson = res.json.bind(res);
+	res.json = (body) => {
+		const n = clampPadBytes(res.locals.padBytes);
+		return n === 0 ? originalJson(body) : streamWithPad(res, body, n);
+	};
+	next();
+};
+//#endregion
+exports.padResponseMiddleware = padResponseMiddleware;

package/dist/pairs.d.ts

@@ -1,7 +1,12 @@
+import { InputMethod } from "@prosopo/types";
 export declare const constructPairList: (list: number[]) => [number, number][];
 export declare const peelCheckboxPrefix: (flat: number[][], solutionLengths: number[]) => {
     checkbox?: [number, number];
     flat: number[][];
 };
-export declare const containsIdenticalPairs: (pairsLists: [number, number][][]) => boolean;
+export declare const resolveInputMethods: (flat: number[][], declared: (readonly InputMethod[] | undefined)[]) => InputMethod[][] | undefined;
+export declare const peelCheckboxInputMethod: (methods: InputMethod[][]) => InputMethod[][];
+export declare const keyboardSelectionHasPosition: (pairsLists: [number, number][][], inputMethods: InputMethod[][]) => boolean;
+export declare const containsIdenticalPairs: (pairsLists: [number, number][][], inputMethods?: InputMethod[][]) => boolean;
+export declare const selectionsLookScripted: (pairsLists: [number, number][][], inputMethods: InputMethod[][] | undefined) => boolean;
 //# sourceMappingURL=pairs.d.ts.map

package/dist/pairs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pairs.d.ts","sourceRoot":"","sources":["../src/pairs.ts"],"names":[],"mappings":"AAmBA,eAAO,MAAM,iBAAiB,SAAU,MAAM,EAAE,KAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAWlE,CAAC;AAEF,eAAO,MAAM,kBAAkB,SACxB,MAAM,EAAE,EAAE,mBACC,MAAM,EAAE,KACvB;IAAE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;CAYjD,CAAC;AAMF,eAAO,MAAM,sBAAsB,eAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,YActE,CAAC"}
+{"version":3,"file":"pairs.d.ts","sourceRoot":"","sources":["../src/pairs.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAM7C,eAAO,MAAM,iBAAiB,SAAU,MAAM,EAAE,KAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAWlE,CAAC;AAEF,eAAO,MAAM,kBAAkB,SACxB,MAAM,EAAE,EAAE,mBACC,MAAM,EAAE,KACvB;IAAE,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAA;CAYjD,CAAC;AAWF,eAAO,MAAM,mBAAmB,SACzB,MAAM,EAAE,EAAE,YACN,CAAC,SAAS,WAAW,EAAE,GAAG,SAAS,CAAC,EAAE,KAC9C,WAAW,EAAE,EAAE,GAAG,SAgBpB,CAAC;AAOF,eAAO,MAAM,uBAAuB,YAC1B,WAAW,EAAE,EAAE,KACtB,WAAW,EAAE,EAMf,CAAC;AAeF,eAAO,MAAM,4BAA4B,eAC5B,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,gBAClB,WAAW,EAAE,EAAE,KAC3B,OAMD,CAAC;AAWH,eAAO,MAAM,sBAAsB,eACtB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,iBACjB,WAAW,EAAE,EAAE,KAC5B,OAeF,CAAC;AAUF,eAAO,MAAM,sBAAsB,eACtB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,gBAClB,WAAW,EAAE,EAAE,GAAG,SAAS,KACvC,OAG8C,CAAC"}

package/dist/pairs.js

@@ -1,3 +1,4 @@
+import { InputMethod } from "@prosopo/types";
 import { at } from "@prosopo/util";
 //#region src/pairs.ts
 /** Construct list of pairs from flat list
@@ -20,16 +21,75 @@ var peelCheckboxPrefix = (flat, solutionLengths) => {
 	return { flat };
 };
 /**
-* Check if there are identical pairs in flattened lists of pairs
+* The input method of every coordinate pair embedded in each captcha's salt.
+* A captcha that declares none gets pointer for every pair, which keeps
+* requests from older widgets under the full repeated-position check.
+* Returns `undefined` when a captcha declares a different number of methods
+* than it has pairs: the official widget never sends that.
+* @param flat the coordinates extracted from each captcha's salt
+* @param declared the input methods each captcha declared, if any
+*/
+var resolveInputMethods = (flat, declared) => {
+	const resolved = [];
+	for (const [index, list] of flat.entries()) {
+		const pairCount = list.length / 2;
+		const methods = declared[index];
+		if (methods === void 0) resolved.push(new Array(pairCount).fill(InputMethod.pointer));
+		else if (methods.length === pairCount) resolved.push([...methods]);
+		else return;
+	}
+	return resolved;
+};
+/**
+* Give the checkbox's input method its own list, as `peelCheckboxPrefix` does
+* for its coordinates, so the result lines up with the pair lists.
+* @param methods the input methods of each captcha, checkbox first
+*/
+var peelCheckboxInputMethod = (methods) => {
+	const [first, ...rest] = methods;
+	if (first === void 0 || first.length === 0) return methods;
+	return [
+		first.slice(0, 1),
+		first.slice(1),
+		...rest
+	];
+};
+var isKeyboard = (inputMethods, listIndex, pairIndex) => inputMethods?.[listIndex]?.[pairIndex] === InputMethod.keyboard;
+/**
+* Whether any keyboard selection carries a pointer position. Keyboard
+* activation has none, and the widget sends (0, 0) for it, so a position here
+* means the request did not come from the widget.
 * @param pairsLists
+* @param inputMethods the same shape as `pairsLists`
 */
-var containsIdenticalPairs = (pairsLists) => {
-	const set = /* @__PURE__ */ new Set();
-	for (const pairList of pairsLists) for (const pair of pairList) {
+var keyboardSelectionHasPosition = (pairsLists, inputMethods) => pairsLists.some((pairList, listIndex) => pairList.some(([x, y], pairIndex) => isKeyboard(inputMethods, listIndex, pairIndex) && (x !== 0 || y !== 0)));
+/**
+* Check whether any pointer position repeats across the lists of pairs. A
+* person selecting the same tile in two rounds almost never lands on the same
+* pixel twice, whereas a script clicking each element's centre does. Keyboard
+* selections have no position and are left out; without `inputMethods` every
+* pair is a pointer selection.
+* @param pairsLists
+* @param inputMethods the same shape as `pairsLists`
+*/
+var containsIdenticalPairs = (pairsLists, inputMethods) => {
+	const seen = /* @__PURE__ */ new Set();
+	for (const [listIndex, pairList] of pairsLists.entries()) for (const [pairIndex, pair] of pairList.entries()) {
+		if (isKeyboard(inputMethods, listIndex, pairIndex)) continue;
 		const coordString = `${at(pair, 0)},${at(pair, 1)}`;
-		set.add(coordString);
+		if (seen.has(coordString)) return true;
+		seen.add(coordString);
 	}
-	return set.size !== pairsLists.flat().flat().length / 2;
+	return false;
 };
+/**
+* Whether the selections point to a script rather than a person: the declared
+* input methods do not line up with the coordinates, a keyboard selection
+* carries a position, or a pointer position repeats.
+* @param pairsLists
+* @param inputMethods the same shape as `pairsLists`, or `undefined` when the
+* declared methods did not line up with the coordinates
+*/
+var selectionsLookScripted = (pairsLists, inputMethods) => inputMethods === void 0 || keyboardSelectionHasPosition(pairsLists, inputMethods) || containsIdenticalPairs(pairsLists, inputMethods);
 //#endregion
-export { constructPairList, containsIdenticalPairs, peelCheckboxPrefix };
+export { constructPairList, containsIdenticalPairs, keyboardSelectionHasPosition, peelCheckboxInputMethod, peelCheckboxPrefix, resolveInputMethods, selectionsLookScripted };

package/dist/pairs.js.map

@@ -1 +1 @@
-{"version":3,"file":"pairs.js","sourceRoot":"","sources":["../src/pairs.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAKnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAc,EAAsB,EAAE;IAEvE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,IAAgB,EAChB,eAAyB,EAC2B,EAAE;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAqB,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AACjB,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAAgC,EAAE,EAAE;IAC1E,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAE9B,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACtB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YACtB,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACtB,CAAC;IACF,CAAC;IAGD,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACzD,CAAC,CAAC"}
+{"version":3,"file":"pairs.js","sourceRoot":"","sources":["../src/pairs.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,EAAE,EAAE,MAAM,eAAe,CAAC;AAKnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,IAAc,EAAsB,EAAE;IAEvE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,IAAgB,EAChB,eAAyB,EAC2B,EAAE;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,CAAC;IACjB,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,GAAG,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAqB,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AACjB,CAAC,CAAC;AAWF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAClC,IAAgB,EAChB,QAAgD,EAClB,EAAE;IAChC,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,CAAC,IAAI,CACZ,IAAI,KAAK,CAAc,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAC3D,CAAC;QACH,CAAC;aAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACP,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACtC,OAAwB,EACN,EAAE;IACpB,MAAM,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACjC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,OAAO,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAClB,YAAyC,EACzC,SAAiB,EACjB,SAAiB,EACP,EAAE,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,WAAW,CAAC,QAAQ,CAAC;AAS9E,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC3C,UAAgC,EAChC,YAA6B,EACnB,EAAE,CACZ,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CACvC,QAAQ,CAAC,IAAI,CACZ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CACrB,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACvE,CACD,CAAC;AAWH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACrC,UAAgC,EAChC,YAA8B,EACpB,EAAE;IACZ,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,UAAU,CAAC,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;gBACpD,SAAS;YACV,CAAC;YACD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACrC,UAAgC,EAChC,YAAyC,EAC/B,EAAE,CACZ,YAAY,KAAK,SAAS;IAC1B,4BAA4B,CAAC,UAAU,EAAE,YAAY,CAAC;IACtD,sBAAsB,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC"}

package/dist/tasks/captchaManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EAEJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAQrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IAMpB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAkCD,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAgC/C,kCAAkC,CAC9C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAmD3B,wBAAwB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC;QACV,WAAW,CAAC,EAAE,oBAAoB,CAAC;QACnC,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KAC5C,CAAC;IA+DW,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAmSF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;;;;;;;IAoBb,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EAGtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAGpB,eAAe,CAAC,EAAE,OAAO,CAAC;QAK1B,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAgBF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAsBpE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IA6BlE,OAAO,CAAC,2BAA2B;IAgB7B,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAuCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GAIV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IA0D5B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IA4C9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;CAG7D"}
+{"version":3,"file":"captchaManager.d.ts","sourceRoot":"","sources":["../../src/tasks/captchaManager.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,KAAK,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAEN,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,cAAc,EAEnB,KAAK,OAAO,EACZ,KAAK,iBAAiB,EACtB,IAAI,EAEJ,KAAK,cAAc,EACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EACN,KAAK,YAAY,EAEjB,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,MAAM,6BAA6B,CAAC;AAQrC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAIpE,OAAO,EACN,KAAK,kBAAkB,EAEvB,MAAM,8BAA8B,CAAC;AAStC,MAAM,WAAW,iBAAiB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IAMpB,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAkCD,qBAAa,cAAc;IAC1B,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,iBAAiB,CAAC;IACtB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,GAAG,IAAI,CAAC;gBAGlC,EAAE,EAAE,iBAAiB,EACrB,IAAI,EAAE,WAAW,EACjB,MAAM,EAAE,mBAAmB,EAC3B,MAAM,CAAC,EAAE,MAAM,EACf,UAAU,CAAC,EAAE,eAAe,GAAG,IAAI;IAqBvB,4BAA4B,CACxC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,OAAO,CAAC,IAAI,CAAC;IAkBH,4BAA4B,CACxC,sBAAsB,EAAE,MAAM,EAC9B,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,SAAS,CAAC;IAgC/C,kCAAkC,CAC9C,SAAS,EAAE,MAAM,GACf,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAmD3B,wBAAwB,CACpC,SAAS,EAAE,MAAM,GAAG,SAAS,EAC7B,QAAQ,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC;QACV,WAAW,CAAC,EAAE,oBAAoB,CAAC;QACnC,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KAC5C,CAAC;IA+DW,oCAAoC,CAChD,SAAS,EAAE,MAAM,EACjB,sBAAsB,EAAE,MAAM,EAC9B,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAkBH,0CAA0C,CACtD,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,OAAO,CAAC,IAAI,CAAC;IAgBT,0BAA0B,CAChC,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EACzB,eAAe,CAAC,EAAE,OAAO,GACvB,IAAI;IAqBA,+BAA+B,CACrC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,EAC9C,KAAK,EAAE,iBAAiB,GACtB,IAAI;IAYD,iBAAiB,CACtB,aAAa,EAAE,OAAO,EACtB,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,mBAAmB,GACtB,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC;IAMjD,cAAc,CACnB,cAAc,EAAE,YAAY,GAAG,aAAa,EAC5C,oBAAoB,EAAE,WAAW,EACjC,GAAG,EAAE,mBAAmB,EACxB,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,YAAY,EAC/B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QACV,KAAK,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,cAAc,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,WAAW,CAAC;QAClB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAI3B,MAAM,CAAC,EAAE,cAAc,CAAC;KACxB,CAAC;IAyTF,uBAAuB,CACtB,QAAQ,EAAE,OAAO,EACjB,YAAY,EAAE,YAAY,EAC1B,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,EACpC,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM;;;;;;;IAoBb,4BAA4B,CACjC,sBAAsB,EAAE,kBAAkB,EAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,SAAS,GAAG,eAAe,EAGtC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACtC,OAAO,CAAC,EAAE;QACT,SAAS,CAAC,EAAE,OAAO,CAAC;QAGpB,eAAe,CAAC,EAAE,OAAO,CAAC;QAK1B,eAAe,CAAC,EAAE,MAAM,CAAC;KACzB;IAgBF,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,iBAAiB,GAAG,SAAS;IAsBpE,8BAA8B,CACnC,iBAAiB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,CAAC,iBAAiB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,SAAS,CAAC;IA6BlE,OAAO,CAAC,2BAA2B;IAgB7B,wBAAwB,CAC7B,SAAS,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;IAsBnC,mBAAmB,CACxB,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAsB/B,qBAAqB,CAC1B,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACnC,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAuCjC,iBAAiB,CACtB,sBAAsB,EAAE,kBAAkB,EAC1C,eAAe,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,cAAc,EACxE,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,cAAc,EACvB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAC7B,WAAW,CAAC,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE,MAAM,GAIV,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IA0D5B,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4B/C,yBAAyB,CAC9B,GAAG,EAAE,mBAAmB,EACxB,YAAY,EAAE,cAAc,GAAG,SAAS,EACxC,aAAa,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,EAClD,SAAS,CAAC,EAAE,MAAM,EAClB,gBAAgB,CAAC,EAAE,gBAAgB,GACjC,OAAO,CAAC,kBAAkB,CAAC;IA4C9B,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO;CAG7D"}

package/dist/tasks/captchaManager.js

@@ -294,6 +294,21 @@ var CaptchaManager = class CaptchaManager {
 			}
 			sessionId = resolvedSessionId;
 			if (this.writeQueue) await Promise.all([this.writeQueue.invalidateCachedSession(sessionId), sessionRecord.userSitekeyIpHash ? this.writeQueue.invalidateCachedSessionByHash(sessionRecord.userSitekeyIpHash) : Promise.resolve()]);
+			if (sessionRecord.siteKey !== void 0 && sessionRecord.siteKey !== clientSettings.account) {
+				this.logger.warn(() => ({
+					msg: "Session was issued for a different site key",
+					data: {
+						account: clientSettings.account,
+						sessionId,
+						sessionSiteKey: sessionRecord.siteKey
+					}
+				}));
+				return {
+					valid: false,
+					reason: ResultReason.CAPTCHA_NO_SESSION_FOUND,
+					type: requestedCaptchaType
+				};
+			}
 			if (currentIP) {
 				const ipValidation = await this.validateSessionIP(sessionRecord, currentIP, env);
 				if (!ipValidation.valid) return {