@prosopo/provider 5.13.2 → 5.13.4

package/dist/tests/unit/utils/tarpitPadding.unit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarpitPadding.unit.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/unit/utils/tarpitPadding.unit.test.ts"],"names":[],"mappings":""}

package/dist/tests/unit/utils/tarpitPadding.unit.test.js

@@ -0,0 +1,99 @@
+import { MAX_PAD_BYTES } from "@prosopo/types";
+import { describe, expect, it, vi } from "vitest";
+import { padResponseMiddleware } from "../../../utils/tarpitPadding.js";
+const makeRes = (padBytes) => {
+    const chunks = [];
+    const headers = {};
+    let ended = false;
+    const jsonMock = vi.fn();
+    const res = {
+        locals: { padBytes },
+        json: jsonMock,
+        setHeader: (name, value) => {
+            headers[name.toLowerCase()] = value;
+        },
+        write: (chunk) => {
+            chunks.push(chunk);
+            return true;
+        },
+        end: () => {
+            ended = true;
+            return res;
+        },
+    };
+    return {
+        res,
+        body: () => chunks.join(""),
+        jsonMock,
+        headers,
+        ended: () => ended,
+    };
+};
+const send = (fake, body) => {
+    const next = vi.fn();
+    padResponseMiddleware({}, fake.res, next);
+    expect(next).toHaveBeenCalled();
+    fake.res.json(body);
+};
+const CHALLENGE = {
+    status: "ok",
+    challenge: "0x1234",
+    difficulty: 9,
+    timestamp: "1764000000000",
+};
+describe("padResponseMiddleware", () => {
+    it("leaves the response untouched when no padding was resolved", () => {
+        const fake = makeRes(undefined);
+        send(fake, CHALLENGE);
+        expect(fake.jsonMock).toHaveBeenCalledWith(CHALLENGE);
+        expect(fake.body()).toBe("");
+    });
+    it("leaves the response untouched for a zero or negative padBytes", () => {
+        for (const padBytes of [0, -1]) {
+            const fake = makeRes(padBytes);
+            send(fake, CHALLENGE);
+            expect(fake.jsonMock).toHaveBeenCalledWith(CHALLENGE);
+            expect(fake.body()).toBe("");
+        }
+    });
+    it("appends the requested padding and keeps every real field", () => {
+        const fake = makeRes(4096);
+        send(fake, CHALLENGE);
+        expect(fake.jsonMock).not.toHaveBeenCalled();
+        const parsed = JSON.parse(fake.body());
+        expect(parsed.pad).toHaveLength(4096);
+        expect(parsed).toMatchObject(CHALLENGE);
+        expect(fake.headers["content-type"]).toBe("application/json; charset=utf-8");
+        expect(fake.ended()).toBe(true);
+    });
+    it("writes the padding before any real field, so a scraper cannot read a prefix and abort", () => {
+        const fake = makeRes(2048);
+        send(fake, CHALLENGE);
+        const body = fake.body();
+        expect(body.indexOf('"pad"')).toBe(1);
+        expect(body.indexOf('"challenge"')).toBeGreaterThan(2048);
+    });
+    it("pads with incompressible bytes", () => {
+        const fake = makeRes(8192);
+        send(fake, CHALLENGE);
+        const pad = JSON.parse(fake.body()).pad;
+        expect(new Set(pad).size).toBeGreaterThan(50);
+    });
+    it("clamps padding to the 5 MiB ceiling so it cannot be used as an amplifier", () => {
+        const fake = makeRes(MAX_PAD_BYTES * 10);
+        send(fake, CHALLENGE);
+        expect(JSON.parse(fake.body()).pad).toHaveLength(MAX_PAD_BYTES);
+    });
+    it("emits valid JSON for a body with no fields", () => {
+        const fake = makeRes(64);
+        send(fake, {});
+        expect(JSON.parse(fake.body()).pad).toHaveLength(64);
+    });
+    it("does not pad a non-object body, which has no fields to splice into", () => {
+        const fake = makeRes(64);
+        send(fake, ["a", "b"]);
+        expect(fake.jsonMock).toHaveBeenCalledWith(["a", "b"]);
+        expect(fake.body()).toBe("");
+    });
+});
+//# sourceMappingURL=tarpitPadding.unit.test.js.map

package/dist/tests/unit/utils/tarpitPadding.unit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarpitPadding.unit.test.js","sourceRoot":"","sources":["../../../../src/tests/unit/utils/tarpitPadding.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAWxE,MAAM,OAAO,GAAG,CAAC,QAAiB,EAAgB,EAAE;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,MAAM,QAAQ,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;IACzB,MAAM,GAAG,GAAG;QACX,MAAM,EAAE,EAAE,QAAQ,EAAE;QACpB,IAAI,EAAE,QAAQ;QACd,SAAS,EAAE,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;YAC1C,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,GAAG,KAAK,CAAC;QACrC,CAAC;QACD,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,IAAI,CAAC;QACb,CAAC;QACD,GAAG,EAAE,GAAG,EAAE;YACT,KAAK,GAAG,IAAI,CAAC;YACb,OAAO,GAAG,CAAC;QACZ,CAAC;KACsB,CAAC;IACzB,OAAO;QACN,GAAG;QACH,IAAI,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,QAAQ;QACR,OAAO;QACP,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK;KAClB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,IAAkB,EAAE,IAAY,EAAQ,EAAE;IACvD,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,EAA6B,CAAC;IAChD,qBAAqB,CAAC,EAAa,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG;IACjB,MAAM,EAAE,IAAI;IACZ,SAAS,EAAE,QAAQ;IACnB,UAAU,EAAE,CAAC;IACb,SAAS,EAAE,eAAe;CAC1B,CAAC;AAEF,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACrE,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAItB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACxE,KAAK,MAAM,QAAQ,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/B,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QACnE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QAEtB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CACxC,iCAAiC,CACjC,CAAC;QACF,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAChG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QAIzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtB,MAAM,GAAG,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;QAChD,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QACnF,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,GAAG,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACtB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACrD,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/utils/tarpitPadding.d.ts

@@ -0,0 +1,3 @@
+import type { NextFunction, Request, Response } from "express";
+export declare const padResponseMiddleware: (_req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=tarpitPadding.d.ts.map

package/dist/utils/tarpitPadding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarpitPadding.d.ts","sourceRoot":"","sources":["../../src/utils/tarpitPadding.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAuB/D,eAAO,MAAM,qBAAqB,SAC3B,OAAO,OACR,QAAQ,QACP,YAAY,KAChB,IAYF,CAAC"}

package/dist/utils/tarpitPadding.js

@@ -0,0 +1,25 @@
+import { MAX_PAD_BYTES } from "@prosopo/types";
+import { randomBytes } from "node:crypto";
+//#region src/utils/tarpitPadding.ts
+var POOL = randomBytes(Math.ceil(MAX_PAD_BYTES * 3 / 4)).toString("base64");
+var clampPadBytes = (padBytes) => padBytes && padBytes > 0 ? Math.min(Math.floor(padBytes), MAX_PAD_BYTES) : 0;
+var streamWithPad = (res, body, n) => {
+	const offset = Math.floor(Math.random() * (POOL.length - n + 1));
+	const fields = JSON.stringify(body).slice(1, -1);
+	res.setHeader("content-type", "application/json; charset=utf-8");
+	res.write("{\"pad\":\"");
+	res.write(POOL.slice(offset, offset + n));
+	res.write(fields ? `",${fields}}` : "\"}");
+	return res.end();
+};
+var isPlainObject = (body) => typeof body === "object" && body !== null && !Array.isArray(body);
+var padResponseMiddleware = (_req, res, next) => {
+	const originalJson = res.json.bind(res);
+	res.json = (body) => {
+		const n = clampPadBytes(res.locals.padBytes);
+		return n === 0 || !isPlainObject(body) ? originalJson(body) : streamWithPad(res, body, n);
+	};
+	next();
+};
+//#endregion
+export { padResponseMiddleware };

package/dist/utils/tarpitPadding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarpitPadding.js","sourceRoot":"","sources":["../../src/utils/tarpitPadding.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAEhF,MAAM,aAAa,GAAG,CAAC,QAA4B,EAAU,EAAE,CAC9D,QAAQ,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9E,MAAM,aAAa,GAAG,CAAC,GAAa,EAAE,IAAY,EAAE,CAAS,EAAY,EAAE;IAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAIjE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACjD,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACjE,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACtB,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,IAAa,EAAkB,EAAE,CACvD,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACpC,IAAa,EACb,GAAa,EACb,IAAkB,EACX,EAAE;IACT,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAY,EAAY,EAAE;QACrC,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAI7C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YACrC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;YACpB,CAAC,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,IAAI,EAAE,CAAC;AACR,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/provider",
-	"version": "5.13.2",
+	"version": "5.13.4",
 	"author": "PROSOPO LIMITED <info@prosopo.io>",
 	"license": "Apache-2.0",
 	"type": "module",
@@ -24,17 +24,17 @@
 	"dependencies": {
 		"@noble/hashes": "2.4.0",
 		"@polkadot/util": "14.0.3",
-		"@prosopo/api": "4.3.6",
-		"@prosopo/api-express-router": "3.1.96",
+		"@prosopo/api": "4.3.7",
+		"@prosopo/api-express-router": "3.1.98",
 		"@prosopo/api-route": "2.6.61",
 		"@prosopo/captcha-severity": "1.1.2",
 		"@prosopo/common": "3.1.60",
-		"@prosopo/database": "4.1.0",
-		"@prosopo/datasets": "3.1.92",
-		"@prosopo/env": "3.6.65",
-		"@prosopo/ipinfo": "0.4.11",
-		"@prosopo/keyring": "2.9.98",
-		"@prosopo/load-balancer": "2.11.2",
+		"@prosopo/database": "4.1.2",
+		"@prosopo/datasets": "3.1.93",
+		"@prosopo/env": "3.6.67",
+		"@prosopo/ipinfo": "0.4.12",
+		"@prosopo/keyring": "2.9.99",
+		"@prosopo/load-balancer": "2.11.3",
 		"@prosopo/locale": "3.6.1",
 		"@prosopo/logger": "2.1.1",
 		"@prosopo/native-ja4": "0.0.7",
@@ -42,10 +42,10 @@
 		"@prosopo/native-puzzle": "0.1.0",
 		"@prosopo/puzzle-assets": "0.1.4",
 		"@prosopo/redis-client": "1.0.38",
-		"@prosopo/types": "5.11.0",
-		"@prosopo/types-database": "5.7.0",
-		"@prosopo/types-env": "2.11.11",
-		"@prosopo/user-access-policy": "3.14.12",
+		"@prosopo/types": "5.11.1",
+		"@prosopo/types-database": "5.7.2",
+		"@prosopo/types-env": "2.11.13",
+		"@prosopo/user-access-policy": "3.14.13",
 		"@prosopo/util": "3.3.12",
 		"@prosopo/util-crypto": "13.5.33",
 		"@prosopo/web-bot-auth": "0.1.3",
@@ -77,7 +77,7 @@
 		"tslib": "2.7.0",
 		"tsx": "4.20.3",
 		"typescript": "5.6.2",
-		"undici": "6.28.0",
+		"undici": "6.29.0",
 		"vite": "8.1.5",
 		"vitest": "4.1.11"
 	},