@prosopo/provider 5.14.0 → 5.16.0

package/dist/cjs/api/verify.cjs

@@ -3,13 +3,13 @@ const require_metrics = require("./metrics.cjs");
 const require_tasks = require("../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("./admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_testSiteKey = require("./testSiteKey.cjs");
-const require_maintenanceModeResponses = require("./captcha/maintenanceModeResponses.cjs");
 const require_requestBodySummary = require("./requestBodySummary.cjs");
+const require_maintenanceModeResponses = require("./captcha/maintenanceModeResponses.cjs");
 const require_forwardVerify = require("./forwardVerify.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
-let _prosopo_util_crypto = require("@prosopo/util-crypto");
 let _prosopo_api_express_router = require("@prosopo/api-express-router");
+let _prosopo_util_crypto = require("@prosopo/util-crypto");
 let express = require("express");
 express = require_runtime.__toESM(express, 1);
 let _prosopo_api = require("@prosopo/api");
@@ -28,7 +28,9 @@ var deriveVerifySource = (body) => {
 var VERIFY_PATH_TYPE = {
 	[_prosopo_types.ClientApiPaths.VerifyImageCaptchaSolutionDapp]: _prosopo_types.CaptchaType.image,
 	[_prosopo_types.ClientApiPaths.VerifyPowCaptchaSolution]: _prosopo_types.CaptchaType.pow,
-	[_prosopo_types.ClientApiPaths.VerifyPuzzleCaptchaSolution]: _prosopo_types.CaptchaType.puzzle
+	[_prosopo_types.ClientApiPaths.VerifyPuzzleCaptchaSolution]: _prosopo_types.CaptchaType.puzzle,
+	[_prosopo_types.ClientApiPaths.VerifyAudioCaptchaSolution]: _prosopo_types.CaptchaType.audio,
+	[_prosopo_types.ClientApiPaths.VerifyIconOrderCaptchaSolution]: _prosopo_types.CaptchaType.iconOrder
 };
 var decodeTokenOr400 = (token, i18n, logger, next) => {
 	try {
@@ -61,6 +63,105 @@ var dappSignatureError = (signature, message, pair, req) => {
 	}
 };
 /**
+* Verifies a dapp's token for an interactive captcha type as approved or not.
+* The body carries the token, the dapp's signature over it, and optional
+* `ip`, `email` and `clientSessionId`.
+*/
+var interactiveVerifyHandler = ({ env, userAccessRulesStorage, path, label, handlerName, manager }) => async (req, res, next) => {
+	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+		req.logger.info(() => ({ msg: `Maintenance mode active - returning verified for ${label} captcha verification` }));
+		const verificationResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
+		return res.json(verificationResponse);
+	}
+	let parsed;
+	try {
+		parsed = _prosopo_types.ServerPuzzleCaptchaVerifyRequestBody.parse(req.body);
+	} catch (err) {
+		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err,
+				body: require_requestBodySummary.summariseRequestBody(req)
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	try {
+		const { token, dappSignature, ip, email, clientSessionId } = parsed;
+		const decoded = decodeTokenOr400(token, req.i18n, req.logger, next);
+		if (decoded === null) return;
+		const { dapp, user, timestamp, challenge, providerUrl } = decoded;
+		const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
+		if (testVerdict !== null) {
+			const verificationResponse = {
+				status: "ok",
+				verified: testVerdict
+			};
+			return res.json(verificationResponse);
+		}
+		const forwarded = await require_forwardVerify.forwardVerifyIfNotIssuer({
+			env,
+			logger: req.logger,
+			path,
+			providerUrl,
+			dapp,
+			user,
+			body: parsed,
+			alreadyForwarded: req.headers[_prosopo_api.VERIFY_FORWARDED_HEADER] !== void 0
+		});
+		if (forwarded) return res.json(forwarded);
+		const tasks = new require_tasks.Tasks(env, req.logger);
+		(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
+		(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
+		const clientRecord = await tasks.db.getClientRecord(dapp);
+		if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		if (!challenge) {
+			const unverifiedResponse = {
+				status: req.i18n.t("API.USER_NOT_VERIFIED"),
+				[_prosopo_types.ApiParams.verified]: false
+			};
+			return res.json(unverifiedResponse);
+		}
+		const dappPair = env.keyring.addFromAddress(dapp);
+		const signatureError = dappSignatureError(dappSignature, timestamp.toString(), dappPair, req);
+		if (signatureError) return next(signatureError);
+		if (require_apiToggleMaintenanceModeEndpoint.isSiteKeyInMaintenanceMode(dapp)) {
+			req.logger.info(() => ({
+				msg: "Site key in maintenance mode - returning verified",
+				data: { siteKey: dapp }
+			}));
+			const maintenanceResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
+			return res.json(maintenanceResponse);
+		}
+		const captchaManager = manager(tasks);
+		const { verified, score, sessionId } = await captchaManager.serverVerifyInteractiveCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId);
+		const verificationResponse = captchaManager.getVerificationResponse(verified, clientRecord, req.i18n.t, score, void 0, sessionId);
+		return res.json(verificationResponse);
+	} catch (err) {
+		req.logger.error(() => ({
+			msg: `Error in ${handlerName}`,
+			err,
+			data: { body: require_requestBodySummary.summariseRequestBody(req) }
+		}));
+		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 500,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+};
+/**
 * Returns a router connected to the database which can interact with the Proposo protocol
 *
 * @return {Router} - A middleware router that can interact with the Prosopo protocol
@@ -166,6 +267,14 @@ function prosopoVerifyRouter(env) {
 			const keyPair = env.keyring.addFromAddress(dapp);
 			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), keyPair, req);
 			if (signatureError) return next(signatureError);
+			if (require_apiToggleMaintenanceModeEndpoint.isSiteKeyInMaintenanceMode(dapp)) {
+				req.logger.info(() => ({
+					msg: "Site key in maintenance mode - returning verified",
+					data: { siteKey: dapp }
+				}));
+				const maintenanceResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
+				return res.json(maintenanceResponse);
+			}
 			const response = await tasks.imgCaptchaManager.verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, clientRecord.settings.disallowWebView, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId);
 			req.logger.debug(() => ({ data: { response } }));
 			const verificationResponse = tasks.imgCaptchaManager.getVerificationResponse(response[_prosopo_types.ApiParams.verified], clientRecord, req.i18n.t, response[_prosopo_types.ApiParams.score], response[_prosopo_types.ApiParams.commitmentId], response[_prosopo_types.ApiParams.status], response[_prosopo_types.ApiParams.sessionId]);
@@ -260,6 +369,14 @@ function prosopoVerifyRouter(env) {
 			const dappPair = env.keyring.addFromAddress(dapp);
 			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), dappPair, req);
 			if (signatureError) return next(signatureError);
+			if (require_apiToggleMaintenanceModeEndpoint.isSiteKeyInMaintenanceMode(dapp)) {
+				req.logger.info(() => ({
+					msg: "Site key in maintenance mode - returning verified",
+					data: { siteKey: dapp }
+				}));
+				const maintenanceResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
+				return res.json(maintenanceResponse);
+			}
 			const { verified, score, reason, sessionId } = await tasks.powCaptchaManager.serverVerifyPowCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId);
 			const verificationResponse = tasks.powCaptchaManager.getVerificationResponse(verified, clientRecord, req.i18n.t, score, reason, sessionId);
 			return res.json(verificationResponse);
@@ -279,98 +396,30 @@ function prosopoVerifyRouter(env) {
 			}));
 		}
 	});
-	/**
-	* Verifies a dapp's puzzle captcha solution as being approved or not
-	*
-	* @param {string} token - Token containing dapp, blockNumber and challenge
-	* @param {string} dappSignature - Signed token
-	* @param {number} verifiedTimeout - The maximum time in milliseconds to be valid
-	*/
-	router.post(_prosopo_types.ClientApiPaths.VerifyPuzzleCaptchaSolution, async (req, res, next) => {
-		if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
-			req.logger.info(() => ({ msg: "Maintenance mode active - returning verified for puzzle captcha verification" }));
-			const verificationResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
-			return res.json(verificationResponse);
-		}
-		let parsed;
-		try {
-			parsed = _prosopo_types.ServerPuzzleCaptchaVerifyRequestBody.parse(req.body);
-		} catch (err) {
-			return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-				context: {
-					code: 400,
-					error: err,
-					body: require_requestBodySummary.summariseRequestBody(req)
-				},
-				i18n: req.i18n,
-				logger: req.logger
-			}));
-		}
-		try {
-			const { token, dappSignature, ip, email, clientSessionId } = parsed;
-			const decoded = decodeTokenOr400(token, req.i18n, req.logger, next);
-			if (decoded === null) return;
-			const { dapp, user, timestamp, challenge, providerUrl } = decoded;
-			const testVerdict = require_testSiteKey.resolveTestSiteKeyVerdict(dapp, req.logger);
-			if (testVerdict !== null) {
-				const verificationResponse = {
-					status: "ok",
-					verified: testVerdict
-				};
-				return res.json(verificationResponse);
-			}
-			const forwarded = await require_forwardVerify.forwardVerifyIfNotIssuer({
-				env,
-				logger: req.logger,
-				path: _prosopo_types.ClientApiPaths.VerifyPuzzleCaptchaSolution,
-				providerUrl,
-				dapp,
-				user,
-				body: parsed,
-				alreadyForwarded: req.headers[_prosopo_api.VERIFY_FORWARDED_HEADER] !== void 0
-			});
-			if (forwarded) return res.json(forwarded);
-			const tasks = new require_tasks.Tasks(env, req.logger);
-			(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
-			(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
-			const clientRecord = await tasks.db.getClientRecord(dapp);
-			if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-				context: {
-					code: 400,
-					siteKey: dapp
-				},
-				i18n: req.i18n,
-				logger: req.logger
-			}));
-			if (!challenge) {
-				const unverifiedResponse = {
-					status: req.i18n.t("API.USER_NOT_VERIFIED"),
-					[_prosopo_types.ApiParams.verified]: false
-				};
-				return res.json(unverifiedResponse);
-			}
-			const dappPair = env.keyring.addFromAddress(dapp);
-			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), dappPair, req);
-			if (signatureError) return next(signatureError);
-			const { verified, score, sessionId } = await tasks.puzzleCaptchaManager.serverVerifyPuzzleCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId);
-			const verificationResponse = tasks.puzzleCaptchaManager.getVerificationResponse(verified, clientRecord, req.i18n.t, score, void 0, sessionId);
-			return res.json(verificationResponse);
-		} catch (err) {
-			req.logger.error(() => ({
-				msg: "Error in verifyPuzzleCaptchaSolution",
-				err,
-				data: { body: require_requestBodySummary.summariseRequestBody(req) }
-			}));
-			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-				context: {
-					code: 500,
-					error: err
-				},
-				i18n: req.i18n,
-				logger: req.logger
-			}));
-		}
-	});
+	router.post(_prosopo_types.ClientApiPaths.VerifyPuzzleCaptchaSolution, interactiveVerifyHandler({
+		env,
+		userAccessRulesStorage,
+		path: _prosopo_types.ClientApiPaths.VerifyPuzzleCaptchaSolution,
+		label: "puzzle",
+		handlerName: "verifyPuzzleCaptchaSolution",
+		manager: (tasks) => tasks.puzzleCaptchaManager
+	}));
+	router.post(_prosopo_types.ClientApiPaths.VerifyAudioCaptchaSolution, interactiveVerifyHandler({
+		env,
+		userAccessRulesStorage,
+		path: _prosopo_types.ClientApiPaths.VerifyAudioCaptchaSolution,
+		label: "audio",
+		handlerName: "verifyAudioCaptchaSolution",
+		manager: (tasks) => tasks.audioCaptchaManager
+	}));
+	router.post(_prosopo_types.ClientApiPaths.VerifyIconOrderCaptchaSolution, interactiveVerifyHandler({
+		env,
+		userAccessRulesStorage,
+		path: _prosopo_types.ClientApiPaths.VerifyIconOrderCaptchaSolution,
+		label: "icon-order",
+		handlerName: "verifyIconOrderCaptchaSolution",
+		manager: (tasks) => tasks.iconOrderCaptchaManager
+	}));
 	/**
 	* Verify a Web Bot Auth authenticated session token. Enforces IP binding:
 	* the operator MUST forward `ip` in the request body, and it must equal
@@ -434,6 +483,14 @@ function prosopoVerifyRouter(env) {
 			const keyPair = env.keyring.addFromAddress(dapp);
 			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), keyPair, req);
 			if (signatureError) return next(signatureError);
+			if (require_apiToggleMaintenanceModeEndpoint.isSiteKeyInMaintenanceMode(dapp)) {
+				req.logger.info(() => ({
+					msg: "Site key in maintenance mode - returning verified",
+					data: { siteKey: dapp }
+				}));
+				const maintenanceResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
+				return res.json(maintenanceResponse);
+			}
 			if (!sessionId) return res.json({
 				status: "API.USER_NOT_VERIFIED_NO_SOLUTION",
 				verified: false

package/dist/cjs/compositeIpAddress.cjs

@@ -4,6 +4,11 @@ let ip_address = require("ip-address");
 //#region src/compositeIpAddress.ts
 var V6_SHIFT = 64n;
 var v6_LOWER_MASK = (1n << V6_SHIFT) - 1n;
+/**
+* The part of a v4 address treated as the host rather than the network, for
+* the purposes of `isSameIpOrigin`. 8 bits — a /24.
+*/
+var V4_HOST_BITS = 8n;
 var getCompositeIpAddress = (ip) => {
 	let ipAddress;
 	try {
@@ -60,10 +65,19 @@ var isUnknownIp = (ip) => ip.type === _prosopo_types.IpAddressType.v4 && readPar
 /**
 * Do two observations of a client come from the same place on the network?
 *
-* v4 is compared exactly. v6 is compared on the /64 prefix alone — the
-* interface identifier in the low 64 bits is designed to rotate (RFC 8981
-* privacy extensions), often several times a day on one unchanged connection,
-* so comparing it would call an ordinary phone a different host.
+* Both families are compared on the network part and neither on the host part.
+*
+* v6 is the /64 prefix: the interface identifier in the low 64 bits is designed
+* to rotate (RFC 8981 privacy extensions), often several times a day on one
+* unchanged connection, so comparing it would call an ordinary phone a
+* different host.
+*
+* v4 is the /24. A carrier NAT or mobile pool reassigns the low octet mid
+* session — an EE subscriber was observed moving one address in four seconds —
+* so comparing the whole address called every rotating mobile and CGNAT client
+* a different host, which is the opposite of the leniency this check is for.
+* The /24 still separates an unrelated network, which is the case worth
+* catching: a challenge handed to a second host to farm the work out.
 *
 * A value we do not actually have counts as the same — one that will not
 * parse, or the all-zero v4 `getCompositeIpAddress` returns when handed an
@@ -73,13 +87,13 @@ var isUnknownIp = (ip) => ip.type === _prosopo_types.IpAddressType.v4 && readPar
 var isSameIpOrigin = (a, b) => {
 	if (isUnknownIp(a) || isUnknownIp(b)) return true;
 	if (a.type !== b.type) return false;
-	const compare = (left, right) => {
+	const sameNetwork = (left, right, hostBits) => {
 		const leftPart = readPart(left);
 		const rightPart = readPart(right);
 		if (leftPart === void 0 || rightPart === void 0) return true;
-		return leftPart === rightPart;
+		return leftPart >> hostBits === rightPart >> hostBits;
 	};
-	return a.type === _prosopo_types.IpAddressType.v6 ? compare(a.upper, b.upper) : compare(a.lower, b.lower);
+	return a.type === _prosopo_types.IpAddressType.v6 ? sameNetwork(a.upper, b.upper, 0n) : sameNetwork(a.lower, b.lower, V4_HOST_BITS);
 };
 var never = () => {
 	throw new Error("Unhandled type");

package/dist/cjs/index.cjs

@@ -1,8 +1,8 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_compositeIpAddress = require("./compositeIpAddress.cjs");
-const require_blacklistRequestInspector = require("./api/blacklistRequestInspector.cjs");
 const require_ipComparison = require("./services/ipComparison.cjs");
 const require_util = require("./util.cjs");
+const require_blacklistRequestInspector = require("./api/blacklistRequestInspector.cjs");
 const require_tasks = require("./tasks/tasks.cjs");
 const require_updateSpamEmailDomains = require("./tasks/spam/updateSpamEmailDomains.cjs");
 const require_block = require("./api/block.cjs");

package/dist/cjs/tasks/audio/audioBuffer.cjs

@@ -0,0 +1,72 @@
+let _prosopo_audio_assets = require("@prosopo/audio-assets");
+var settingsKey = (settings) => [
+	settings.digitCount,
+	settings.noiseSnrDb,
+	settings.babbleGain,
+	settings.babbleVoices,
+	settings.reverbMix,
+	settings.gapMs
+].join(":");
+var createAudioChallengeBuffer = (options = {}) => {
+	const capacity = options.capacity ?? 8;
+	const refillIntervalMs = options.refillIntervalMs ?? 500;
+	const refillBatch = options.refillBatch ?? 2;
+	const maxVariants = options.maxVariants ?? 8;
+	const variants = /* @__PURE__ */ new Map();
+	let starved = 0;
+	const touch = (key, settings) => {
+		const existing = variants.get(key);
+		if (existing) {
+			variants.delete(key);
+			variants.set(key, existing);
+			return existing;
+		}
+		const created = {
+			settings,
+			ready: []
+		};
+		variants.set(key, created);
+		while (variants.size > maxVariants) {
+			const oldest = variants.keys().next().value;
+			if (oldest === void 0) break;
+			variants.delete(oldest);
+		}
+		return created;
+	};
+	const topUp = (limit) => {
+		for (const variant of variants.values()) for (let i = 0; i < limit && variant.ready.length < capacity; i++) variant.ready.push((0, _prosopo_audio_assets.renderAudioChallenge)(variant.settings));
+	};
+	const prime = options.primeSettings ?? _prosopo_audio_assets.DEFAULT_RENDER_SETTINGS;
+	touch(settingsKey(prime), prime);
+	topUp(capacity);
+	const timer = setInterval(() => topUp(refillBatch), refillIntervalMs);
+	timer.unref?.();
+	return {
+		take(settings) {
+			const challenge = touch(settingsKey(settings), settings).ready.pop();
+			if (!challenge) {
+				starved++;
+				return (0, _prosopo_audio_assets.renderAudioChallenge)(settings);
+			}
+			return challenge;
+		},
+		depth: () => {
+			let total = 0;
+			for (const variant of variants.values()) total += variant.ready.length;
+			return total;
+		},
+		starvations: () => starved,
+		stop: () => clearInterval(timer)
+	};
+};
+var globalBuffer = null;
+var initAudioChallengeBuffer = (options = {}) => {
+	globalBuffer?.stop();
+	globalBuffer = createAudioChallengeBuffer(options);
+	return globalBuffer;
+};
+var getAudioChallengeBuffer = () => globalBuffer;
+//#endregion
+exports.createAudioChallengeBuffer = createAudioChallengeBuffer;
+exports.getAudioChallengeBuffer = getAudioChallengeBuffer;
+exports.initAudioChallengeBuffer = initAudioChallengeBuffer;

package/dist/cjs/tasks/audio/audioRenderer.cjs

@@ -0,0 +1,32 @@
+const require_audioBuffer = require("./audioBuffer.cjs");
+let _prosopo_audio_assets = require("@prosopo/audio-assets");
+//#region src/tasks/audio/audioRenderer.ts
+/** Layers partial overrides onto the asset defaults; later sources win. */
+var resolveAudioRenderSettings = (...overrides) => {
+	let resolved = { ..._prosopo_audio_assets.DEFAULT_RENDER_SETTINGS };
+	for (const override of overrides) resolved = {
+		digitCount: override?.digitCount ?? resolved.digitCount,
+		noiseSnrDb: override?.noiseSnrDb ?? resolved.noiseSnrDb,
+		babbleGain: override?.babbleGain ?? resolved.babbleGain,
+		babbleVoices: override?.babbleVoices ?? resolved.babbleVoices,
+		reverbMix: override?.reverbMix ?? resolved.reverbMix,
+		gapMs: override?.gapMs ?? resolved.gapMs
+	};
+	return resolved;
+};
+/**
+* Takes one challenge from the process-wide buffer, created on first use so a
+* provider that never serves audio pays nothing for it.
+*/
+var renderAudioClip = (settings) => {
+	const challenge = (require_audioBuffer.getAudioChallengeBuffer() ?? require_audioBuffer.initAudioChallengeBuffer()).take(settings);
+	return {
+		clip: (0, _prosopo_audio_assets.toDataUri)(challenge.wav),
+		characterCount: challenge.answer.length,
+		answer: challenge.answer,
+		durationMs: challenge.durationMs
+	};
+};
+//#endregion
+exports.renderAudioClip = renderAudioClip;
+exports.resolveAudioRenderSettings = resolveAudioRenderSettings;

package/dist/cjs/tasks/audioAlternative.cjs

@@ -0,0 +1,23 @@
+let _prosopo_types = require("@prosopo/types");
+//#region src/tasks/audioAlternative.ts
+var AUDIO_ALTERNATIVE_SESSION_TYPES = /* @__PURE__ */ new Set([
+	_prosopo_types.CaptchaType.image,
+	_prosopo_types.CaptchaType.puzzle,
+	_prosopo_types.CaptchaType.iconOrder
+]);
+/** Whether a session of this type is a visual challenge that can offer audio. */
+var isAudioAlternativeSessionType = (captchaType) => captchaType !== void 0 && AUDIO_ALTERNATIVE_SESSION_TYPES.has(captchaType);
+/**
+* The site owner has to turn the alternative on, and Prosopo has to have
+* switched on the audio feature flag for the site.
+*/
+var isAudioAlternativeEnabled = (settings) => settings?.audioAccessibilityEnabled === true && (0, _prosopo_types.isCaptchaTypeFeatureEnabled)(_prosopo_types.CaptchaType.audio, settings.captchaTypeFeatureFlags);
+/** Whether a challenge of this type shows "use audio instead". */
+var offersAudioAlternative = (captchaType, audioAlternativeEnabled) => audioAlternativeEnabled && isAudioAlternativeSessionType(captchaType);
+/** Whether an audio challenge may be issued against a session of another type. */
+var isAudioAlternativeAllowed = (requestedCaptchaType, sessionCaptchaType, settings) => requestedCaptchaType === _prosopo_types.CaptchaType.audio && offersAudioAlternative(sessionCaptchaType, isAudioAlternativeEnabled(settings));
+//#endregion
+exports.isAudioAlternativeAllowed = isAudioAlternativeAllowed;
+exports.isAudioAlternativeEnabled = isAudioAlternativeEnabled;
+exports.isAudioAlternativeSessionType = isAudioAlternativeSessionType;
+exports.offersAudioAlternative = offersAudioAlternative;

package/dist/cjs/tasks/audioCaptcha/audioTasks.cjs

@@ -0,0 +1,65 @@
+const require_audioRenderer = require("../audio/audioRenderer.cjs");
+const require_interactiveCaptchaManager = require("../interactiveCaptcha/interactiveCaptchaManager.cjs");
+const require_audioTasksUtils = require("./audioTasksUtils.cjs");
+let _prosopo_types = require("@prosopo/types");
+//#region src/tasks/audioCaptcha/audioTasks.ts
+var AudioCaptchaManager = class extends require_interactiveCaptchaManager.InteractiveCaptchaManager {
+	constructor(..._args) {
+		super(..._args);
+		this.captchaType = _prosopo_types.CaptchaType.audio;
+		this.logLabel = "audio";
+	}
+	getRecordByChallenge(challenge) {
+		return this.db.getAudioCaptchaRecordByChallenge(challenge);
+	}
+	updateRecord(challenge, updates) {
+		return this.db.updateAudioCaptchaRecord(challenge, updates);
+	}
+	updateSubmissionResult(challenge, result, userSignature, coords) {
+		return this.db.updateAudioCaptchaRecordResult(challenge, result, false, true, userSignature, coords);
+	}
+	/** Atomic, so concurrent submissions cannot each be graded. */
+	claimSubmission(record) {
+		return this.db.claimAudioCaptchaSubmission(record.challenge);
+	}
+	markRecordChecked(challenge) {
+		return this.db.markAudioCaptchaRecordChecked(challenge);
+	}
+	decisionMachineEventFields(record) {
+		return {
+			audioEvents: record.audioEvents,
+			audioReplays: record.replays
+		};
+	}
+	/**
+	* The renderer picks the digits, so the answer only exists once the clip
+	* does; the caller must store `answer` before responding.
+	*/
+	getAudioCaptchaChallenge(userAccount, dappAccount, settings) {
+		return {
+			...this.mintChallenge(userAccount, dappAccount),
+			...require_audioRenderer.renderAudioClip(settings)
+		};
+	}
+	async verifyAudioCaptchaSolution(challenge, providerChallengeSignature, submittedAnswer, replays, audioEvents, timeout, userTimestampSignature, ipAddress, behavioralData, salt, simdReadings, clientMetaData) {
+		return this.submitInteractiveCaptchaSolution({
+			challenge,
+			providerChallengeSignature,
+			timeout,
+			userTimestampSignature,
+			ipAddress,
+			behavioralData,
+			salt,
+			simdReadings,
+			clientMetaData,
+			isCorrect: (record) => require_audioTasksUtils.validateAudioSolution(submittedAnswer, record.answer),
+			persistInteraction: () => this.db.updateAudioCaptchaRecord(challenge, {
+				audioEvents,
+				replays,
+				submittedAnswer: require_audioTasksUtils.normaliseAudioAnswer(submittedAnswer)
+			})
+		});
+	}
+};
+//#endregion
+exports.AudioCaptchaManager = AudioCaptchaManager;

package/dist/cjs/tasks/audioCaptcha/audioTasksUtils.cjs

@@ -0,0 +1,19 @@
+//#region src/tasks/audioCaptcha/audioTasksUtils.ts
+/**
+* Keeps only the digits, in order: "1 2 3", "1-2-3" and screen-reader inserted
+* separators all grade the same, and no different digit sequence can pass.
+*/
+var normaliseAudioAnswer = (raw) => raw.replace(/\D/g, "");
+/**
+* Exact match after normalisation. No edit-distance slack: one substitution
+* widens the accepted set far more than it helps a listener, and a wrong
+* answer only costs a fresh challenge.
+*/
+var validateAudioSolution = (submitted, expected) => {
+	const normalised = normaliseAudioAnswer(submitted);
+	if (normalised.length === 0 || expected.length === 0) return false;
+	return normalised === expected;
+};
+//#endregion
+exports.normaliseAudioAnswer = normaliseAudioAnswer;
+exports.validateAudioSolution = validateAudioSolution;

package/dist/cjs/tasks/captchaManager.cjs

@@ -1,5 +1,6 @@
 const require_compositeIpAddress = require("../compositeIpAddress.cjs");
 const require_blacklistRequestInspector = require("../api/blacklistRequestInspector.cjs");
+const require_audioAlternative = require("./audioAlternative.cjs");
 const require_bundlePool = require("./detection/bundlePool.cjs");
 const require_decoderPool = require("./detection/decoderPool.cjs");
 const require_checkTrafficFilter = require("./spam/checkTrafficFilter.cjs");
@@ -225,6 +226,21 @@ var CaptchaManager = class CaptchaManager {
 				sessionId
 			}
 		}));
+		if (!(requestedCaptchaType === _prosopo_types.CaptchaType.audio ? require_audioAlternative.isAudioAlternativeEnabled(clientSettings.settings) : (0, _prosopo_types.isCaptchaTypeFeatureEnabled)(requestedCaptchaType, clientSettings.settings?.captchaTypeFeatureFlags))) {
+			this.logger.warn(() => ({
+				msg: "Captcha type is switched off for this site",
+				data: {
+					account: clientSettings.account,
+					requestedCaptchaType,
+					sessionId
+				}
+			}));
+			return {
+				valid: false,
+				reason: _prosopo_types.ResultReason.INCORRECT_CAPTCHA_TYPE,
+				type: requestedCaptchaType
+			};
+		}
 		if (sessionId) {
 			const cachedBeforeRemove = this.writeQueue ? await this.writeQueue.getCachedSession(sessionId) : null;
 			const cachedHash = typeof cachedBeforeRemove?.userSitekeyIpHash === "string" ? cachedBeforeRemove.userSitekeyIpHash : void 0;
@@ -317,7 +333,7 @@ var CaptchaManager = class CaptchaManager {
 					type: requestedCaptchaType
 				};
 			}
-			if (sessionRecord.captchaType !== requestedCaptchaType) {
+			if (sessionRecord.captchaType !== requestedCaptchaType && !require_audioAlternative.isAudioAlternativeAllowed(requestedCaptchaType, sessionRecord.captchaType, clientSettings.settings)) {
 				this.logger.warn(() => ({
 					msg: "Session captcha type does not match requested type",
 					data: {
@@ -342,6 +358,17 @@ var CaptchaManager = class CaptchaManager {
 				ipInfo: sessionRecord.ipInfo
 			};
 		}
+		if (requestedCaptchaType === _prosopo_types.CaptchaType.audio) {
+			this.logger.warn(() => ({
+				msg: "Sessionless audio captcha request rejected",
+				data: { account: clientSettings.account }
+			}));
+			return {
+				valid: false,
+				reason: _prosopo_types.ResultReason.INCORRECT_CAPTCHA_TYPE,
+				type: requestedCaptchaType
+			};
+		}
 		if (userAccessPolicy?.captchaType !== void 0 && userAccessPolicy.captchaType !== requestedCaptchaType) {
 			this.logger.warn(() => ({
 				msg: "Invalid captcha type for user access policy (sessionless)",