@prosopo/provider 5.14.0 → 5.16.0

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/handler.cjs

@@ -1,29 +1,32 @@
-const require_metrics = require("../../metrics.cjs");
-const require_dnsEventUrl = require("../../dnsEventUrl.cjs");
+const require_rawTlsSignalsMiddleware = require("../../rawTlsSignalsMiddleware.cjs");
 const require_compositeIpAddress = require("../../../compositeIpAddress.cjs");
-const require_blacklistRequestInspector = require("../../blacklistRequestInspector.cjs");
 const require_devicePlatform = require("../../../utils/devicePlatform.cjs");
+const require_metrics = require("../../metrics.cjs");
+const require_blacklistRequestInspector = require("../../blacklistRequestInspector.cjs");
+const require_audioAlternative = require("../../../tasks/audioAlternative.cjs");
+const require_dnsEventUrl = require("../../dnsEventUrl.cjs");
+const require_captchaTypeSelection = require("../../../tasks/captchaTypeSelection.cjs");
 const require_tasks = require("../../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_testSiteKey = require("../../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../../utils/normalizeRequestIp.cjs");
+const require_trafficFilterRequestTime = require("../trafficFilterRequestTime.cjs");
+const require_maintenanceModeResponses = require("../maintenanceModeResponses.cjs");
 const require_hashUserAgent = require("../../../utils/hashUserAgent.cjs");
 const require_hashUserIp = require("../../../utils/hashUserIp.cjs");
-const require_rawTlsSignalsMiddleware = require("../../rawTlsSignalsMiddleware.cjs");
-const require_maintenanceModeResponses = require("../maintenanceModeResponses.cjs");
-const require_trafficFilterRequestTime = require("../trafficFilterRequestTime.cjs");
 const require_honeypotResponse = require("./honeypotResponse.cjs");
 const require_accessPolicy = require("./accessPolicy.cjs");
 const require_constants = require("./constants.cjs");
 const require_decisionMachine = require("./decisionMachine.cjs");
 const require_decryptSimdReadings = require("./decryptSimdReadings.cjs");
+const require_refreshLineage = require("./refreshLineage.cjs");
 const require_sessionDedup = require("./sessionDedup.cjs");
 const require_shortCircuit = require("./shortCircuit.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
+let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 let _prosopo_util = require("@prosopo/util");
 let uuid = require("uuid");
-let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 let _prosopo_web_bot_auth = require("@prosopo/web-bot-auth");
 //#region src/api/captcha/getFrictionlessCaptchaChallenge/handler.ts
 var handler_default = (env, userAccessRulesStorage) => async (req, res, next) => {
@@ -38,7 +41,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 				}
 			}));
 		});
-		const { token, headHash, dapp, user, mode, simdReadings, detectorSessionId, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl, clientSessionId } = _prosopo_types.GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
+		const { token, headHash, dapp, user, mode, simdReadings, detectorSessionId, currentUrl: reportedCurrentUrl, iframeUrl: reportedIframeUrl, clientSessionId, refreshOf } = _prosopo_types.GetFrictionlessCaptchaChallengeRequestBody.parse(req.body);
 		const currentUrl = (0, _prosopo_util.sanitisePageUrl)(reportedCurrentUrl);
 		const iframeUrl = (0, _prosopo_util.sanitisePageUrl)(reportedIframeUrl);
 		const isProtect = (0, _prosopo_util.isProtectDeployment)(currentUrl, iframeUrl);
@@ -108,6 +111,10 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			i18n: req.i18n,
 			logger: req.logger
 		}));
+		const audioAlternativeEnabled = require_audioAlternative.isAudioAlternativeEnabled(clientRecord.settings);
+		tasks.frictionlessManager.setAudioAlternativeEnabled(audioAlternativeEnabled);
+		const allowedCaptchaTypes = require_constants.resolveSiteAllowedCaptchaTypes(clientRecord.settings);
+		tasks.frictionlessManager.setAllowedCaptchaTypes(allowedCaptchaTypes);
 		if (dedup) {
 			const dedupCountryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
 			const dedupAsn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
@@ -144,16 +151,17 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 					...dedupTrafficPolicies && { trafficPolicies: dedupTrafficPolicies }
 				}
 			}) : { captchaType: cachedCaptchaType };
-			const dedupConflictsWithRouting = dedupRouted.captchaType !== cachedCaptchaType;
+			const dedupConflictsWithRouting = require_captchaTypeSelection.coerceToEnabledCaptchaType(dedupRouted.captchaType, allowedCaptchaTypes) !== cachedCaptchaType;
+			const dedupConflictsWithAllowedTypes = require_captchaTypeSelection.coerceToEnabledCaptchaType(cachedCaptchaType, allowedCaptchaTypes) !== cachedCaptchaType;
 			let dedupConflictsWithBundle = false;
 			let dedupIncomingBundleId;
 			if (detectorSessionId && dedup.session.bundleId) {
 				dedupIncomingBundleId = (await tasks.frictionlessManager.resolveBundleByDetectorSession(detectorSessionId))?.bundleId;
 				if (dedupIncomingBundleId !== void 0 && dedupIncomingBundleId !== dedup.session.bundleId) dedupConflictsWithBundle = true;
 			}
-			if (dedupConflictsWithPolicy || dedupConflictsWithRouting) {
+			if (dedupConflictsWithPolicy || dedupConflictsWithRouting || dedupConflictsWithAllowedTypes) {
 				req.logger.info(() => ({
-					msg: "Evicting reused session: cached captchaType conflicts with access policy or routing machine",
+					msg: "Evicting reused session: cached captchaType conflicts with access policy, routing machine or allowed types",
 					data: {
 						userSitekeyIpHash,
 						sessionId: dedup.sessionId,
@@ -162,7 +170,8 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 							policyType: dedupAccessPolicy?.type,
 							policyCaptchaType: dedupAccessPolicy?.captchaType
 						},
-						...dedupConflictsWithRouting && { routedCaptchaType: dedupRouted.captchaType }
+						...dedupConflictsWithRouting && { routedCaptchaType: dedupRouted.captchaType },
+						...dedupConflictsWithAllowedTypes && { allowedCaptchaTypes }
 					}
 				}));
 				await tasks.db.checkAndRemoveSession(dedup.sessionId);
@@ -202,7 +211,8 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 					[_prosopo_types.ApiParams.captchaType]: dedup.captchaType,
 					[_prosopo_types.ApiParams.sessionId]: dedup.sessionId,
 					[_prosopo_types.ApiParams.status]: "ok",
-					dns_url: require_dnsEventUrl.buildDnsEventUrl(dedup.sessionId)
+					dns_url: require_dnsEventUrl.buildDnsEventUrl(dedup.sessionId),
+					...require_audioAlternative.offersAudioAlternative(dedup.captchaType, audioAlternativeEnabled) && { audioAlternativeAvailable: true }
 				});
 			}
 		}
@@ -306,6 +316,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			...triggeredDetectors && triggeredDetectors.length > 0 && { triggeredDetectors },
 			...shadowDomPenalty !== void 0 && { shadowDomPenalty }
 		};
+		const refreshLineage = await require_refreshLineage.resolveRefreshLineage(tasks.db, refreshOf, dapp, /* @__PURE__ */ new Date());
 		tasks.frictionlessManager.setSessionParams({
 			token: sessionToken,
 			score: botScore,
@@ -326,6 +337,7 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			...decodedSimdReadings && { simdReadings: decodedSimdReadings },
 			...d !== void 0 && { d },
 			...clientSessionId && { clientMetaData: { clientSessionId } },
+			...refreshLineage,
 			...req.tcpToChelloUs !== void 0 && { tcpToChelloUs: req.tcpToChelloUs },
 			...req.chelloToHandshakeUs !== void 0 && { chelloToHandshakeUs: req.chelloToHandshakeUs },
 			...require_rawTlsSignalsMiddleware.rawTlsSignalsForSession(req)
@@ -341,7 +353,6 @@ var handler_default = (env, userAccessRulesStorage) => async (req, res, next) =>
 			score: botScore,
 			imageMaxRounds: clientRecord.settings.imageMaxRounds,
 			imageMinRounds: clientRecord.settings.imageMinRounds,
-			frictionlessTypes: clientRecord.settings.frictionlessTypes,
 			baseImageRounds: env.config.captchas.solved.count,
 			puzzleMaxDifficulty: clientRecord.settings.puzzleMaxDifficulty,
 			platform: require_devicePlatform.derivePlatform(requestUserAgent, webView, { ...typeof ipInfoMobile === "boolean" && { isMobile: ipInfoMobile } }),

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/refreshLineage.cjs

@@ -0,0 +1,20 @@
+//#region src/api/captcha/getFrictionlessCaptchaChallenge/refreshLineage.ts
+/**
+* Work out where a refresh sits in its chain from the session it replaced.
+*
+* An unknown session, or one from another site, is ignored rather than
+* rejected: the request then mints an ordinary session, which is all a client
+* that never sent `refreshOf` would have got.
+*/
+var resolveRefreshLineage = async (db, refreshOf, siteKey, now) => {
+	if (!refreshOf) return void 0;
+	const replaced = await db.getSessionRecordBySessionId(refreshOf);
+	if (!replaced || replaced.siteKey !== siteKey) return void 0;
+	return {
+		refreshOf,
+		refreshCount: (replaced.refreshCount ?? 0) + 1,
+		refreshedAfterMs: Math.max(0, now.getTime() - new Date(replaced.createdAt).getTime())
+	};
+};
+//#endregion
+exports.resolveRefreshLineage = resolveRefreshLineage;

package/dist/cjs/api/captcha/getFrictionlessCaptchaChallenge/shortCircuit.cjs

@@ -68,6 +68,7 @@ var runConfiguredCaptchaTypeShortCircuit = async (input, res) => {
 		}));
 		case _prosopo_types.CaptchaType.pow: return res.json(await input.tasks.frictionlessManager.sendPowCaptcha(sessionParams));
 		case _prosopo_types.CaptchaType.puzzle: return res.json(await input.tasks.frictionlessManager.sendPuzzleCaptcha(sessionParams));
+		case _prosopo_types.CaptchaType.iconOrder: return res.json(await input.tasks.frictionlessManager.sendIconOrderCaptcha(sessionParams));
 		default: throw new Error(`Unhandled configured captchaType in /frictionless short-circuit: ${configuredType}`);
 	}
 };

package/dist/cjs/api/captcha/getIconOrderCaptchaChallenge.cjs

@@ -0,0 +1,37 @@
+const require_iconOrderRenderer = require("../../tasks/iconOrder/iconOrderRenderer.cjs");
+const require_interactiveCaptchaChallenge = require("./interactiveCaptchaChallenge.cjs");
+const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
+let _prosopo_types = require("@prosopo/types");
+//#region src/api/captcha/getIconOrderCaptchaChallenge.ts
+var issueIconOrderChallenge = async ({ tasks, user, dapp, clientSettings, sessionRecord, trafficVerdict, provenance }) => {
+	const challengeVerdict = trafficVerdict.kind === "challenge" ? trafficVerdict : void 0;
+	const tolerance = challengeVerdict?.iconOrderTolerance ?? sessionRecord?.iconOrderTolerance ?? clientSettings?.settings?.iconOrderTolerance;
+	const renderSettings = require_iconOrderRenderer.resolveIconOrderRenderSettings(clientSettings?.settings?.iconOrder, challengeVerdict?.iconOrderSettings ?? sessionRecord?.iconOrder);
+	const challenge = await tasks.iconOrderCaptchaManager.getIconOrderCaptchaChallenge(user, dapp, tolerance, () => require_iconOrderRenderer.renderIconOrderImages(renderSettings));
+	await tasks.db.storeIconOrderCaptchaRecord(challenge.challenge, {
+		requestedAtTimestamp: challenge.requestedAtTimestamp,
+		userAccount: user,
+		dappAccount: dapp
+	}, challenge.targets, challenge.tolerance, challenge.providerSignature, provenance.ipAddress, provenance.headers, provenance.ja4, provenance.sessionId, provenance.ipInfo);
+	return {
+		logData: { tolerance: challenge.tolerance },
+		response: {
+			[_prosopo_types.ApiParams.status]: "ok",
+			[_prosopo_types.ApiParams.challenge]: challenge.challenge,
+			[_prosopo_types.ApiParams.background]: challenge.images.background,
+			[_prosopo_types.ApiParams.legend]: challenge.images.legend,
+			[_prosopo_types.ApiParams.legendIconSize]: challenge.images.legendIconSize,
+			[_prosopo_types.ApiParams.timestamp]: challenge.requestedAtTimestamp.toString(),
+			[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: challenge.providerSignature } }
+		}
+	};
+};
+var getIconOrderCaptchaChallenge_default = (env, userAccessRulesStorage) => require_interactiveCaptchaChallenge.interactiveChallengeHandler(env, userAccessRulesStorage, {
+	captchaType: _prosopo_types.CaptchaType.iconOrder,
+	label: "icon-order",
+	manager: (tasks) => tasks.iconOrderCaptchaManager,
+	maintenanceResponse: require_maintenanceModeResponses.buildIconOrderMaintenanceResponse,
+	issue: issueIconOrderChallenge
+});
+//#endregion
+exports.default = getIconOrderCaptchaChallenge_default;

package/dist/cjs/api/captcha/getImageCaptchaChallenge.cjs

@@ -1,12 +1,12 @@
-const require_validateAddress = require("../validateAddress.cjs");
 const require_metrics = require("../metrics.cjs");
 const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const require_validateAddress = require("../validateAddress.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_testSiteKey = require("../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
-const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
+const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 const require_sealedAssetsResolver = require("./sealedAssetsResolver.cjs");
 const require_signedAssetsResolver = require("./signedAssetsResolver.cjs");
 let _prosopo_common = require("@prosopo/common");

package/dist/cjs/api/captcha/getPoWCaptchaChallenge.cjs

@@ -1,14 +1,14 @@
-const require_validateAddress = require("../validateAddress.cjs");
-const require_metrics = require("../metrics.cjs");
 const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
+const require_metrics = require("../metrics.cjs");
 const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const require_validateAddress = require("../validateAddress.cjs");
 const require_tasks = require("../../tasks/tasks.cjs");
 const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
 const require_testSiteKey = require("../testSiteKey.cjs");
 const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
-const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
-const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
 const require_requestBodySummary = require("../requestBodySummary.cjs");
+const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
+const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");

package/dist/cjs/api/captcha/getPuzzleCaptchaChallenge.cjs

@@ -1,120 +1,51 @@
-const require_validateAddress = require("../validateAddress.cjs");
-const require_metrics = require("../metrics.cjs");
-const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
-const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
 const require_puzzleRenderer = require("../../tasks/puzzle/puzzleRenderer.cjs");
-const require_tasks = require("../../tasks/tasks.cjs");
-const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
-const require_testSiteKey = require("../testSiteKey.cjs");
-const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
+const require_interactiveCaptchaChallenge = require("./interactiveCaptchaChallenge.cjs");
 const require_maintenanceModeResponses = require("./maintenanceModeResponses.cjs");
-const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
-const require_requestBodySummary = require("../requestBodySummary.cjs");
-let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
-let _prosopo_util = require("@prosopo/util");
+let _prosopo_puzzle_assets = require("@prosopo/puzzle-assets");
 //#region src/api/captcha/getPuzzleCaptchaChallenge.ts
-var getPuzzleCaptchaChallenge_default = (env, userAccessRulesStorage) => async (req, res, next) => {
-	let parsed;
-	try {
-		parsed = _prosopo_types.GetPuzzleCaptchaChallengeRequestBody.parse(req.body);
-	} catch (err) {
-		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-			context: {
-				code: 400,
-				error: err
-			},
-			i18n: req.i18n,
-			logger: req.logger
+var issuePuzzleChallenge = async ({ tasks, user, dapp, origin, clientSettings, sessionRecord, trafficVerdict, provenance }) => {
+	const challengeVerdict = trafficVerdict.kind === "challenge" ? trafficVerdict : void 0;
+	const tolerance = challengeVerdict?.puzzleTolerance ?? sessionRecord?.puzzleTolerance ?? clientSettings?.settings?.puzzleTolerance;
+	const routedPuzzleSettings = challengeVerdict?.puzzleSettings ?? sessionRecord?.puzzle;
+	const effectivePuzzleSettings = require_puzzleRenderer.resolvePuzzleRenderSettings(clientSettings?.settings?.puzzle, routedPuzzleSettings);
+	const effectivePieceSize = require_puzzleRenderer.resolvePuzzlePieceSize(clientSettings?.settings?.puzzle, routedPuzzleSettings);
+	const challenge = await tasks.puzzleCaptchaManager.getPuzzleCaptchaChallenge(user, dapp, origin, tolerance);
+	await tasks.db.storePuzzleCaptchaRecord(challenge.challenge, {
+		requestedAtTimestamp: challenge.requestedAtTimestamp,
+		userAccount: user,
+		dappAccount: dapp
+	}, challenge.targetX, challenge.targetY, challenge.originX, challenge.originY, challenge.tolerance, challenge.providerSignature, provenance.ipAddress, provenance.headers, provenance.ja4, provenance.sessionId, provenance.ipInfo);
+	const images = await require_puzzleRenderer.renderPuzzleImages({
+		targetX: challenge.targetX,
+		targetY: challenge.targetY
+	}, effectivePuzzleSettings, effectivePieceSize);
+	await tasks.db.updatePuzzleCaptchaRecord(challenge.challenge, { render: {
+		...sessionRecord?.puzzleLevel !== void 0 && { level: sessionRecord.puzzleLevel },
+		pieceSize: images.pieceSize,
+		geometry: {
+			width: _prosopo_puzzle_assets.DEFAULT_GEOMETRY.width,
+			height: _prosopo_puzzle_assets.DEFAULT_GEOMETRY.height,
+			notchSize: _prosopo_puzzle_assets.DEFAULT_GEOMETRY.notchSize
+		},
+		settings: {
+			decoyCount: effectivePuzzleSettings.decoyCount,
+			decoyEdgeDarkness: effectivePuzzleSettings.decoyEdgeDarkness,
+			decoyBodyBrightness: effectivePuzzleSettings.decoyBodyBrightness,
+			holeDarken: effectivePuzzleSettings.holeDarken,
+			decoyHoleDarken: effectivePuzzleSettings.decoyHoleDarken
+		},
+		backgroundSeed: images.backgroundSeed,
+		renderSeed: images.renderSeed
+	} }).catch((updateErr) => {
+		tasks.logger.warn(() => ({
+			err: updateErr,
+			msg: "Failed to patch puzzle render inputs onto the challenge record"
 		}));
-	}
-	const { user, dapp, sessionId, simdReadings } = parsed;
-	require_validateAddress.validateSiteKey(dapp);
-	require_validateAddress.validateAddr(user);
-	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
-		req.logger.info(() => ({
-			msg: "Maintenance mode active - returning dummy puzzle challenge",
-			data: {
-				dapp,
-				user,
-				sessionId
-			}
-		}));
-		return res.json(await require_maintenanceModeResponses.buildPuzzleMaintenanceResponse(user, dapp));
-	}
-	if (require_testSiteKey.isReservedTestSiteKey(dapp)) {
-		req.logger.warn(() => ({
-			msg: "Reserved TEST site key - returning dummy puzzle challenge",
-			data: {
-				dapp,
-				user,
-				sessionId
-			}
-		}));
-		return res.json(await require_maintenanceModeResponses.buildPuzzleMaintenanceResponse(user, dapp));
-	}
-	const tasks = new require_tasks.Tasks(env, req.logger);
-	try {
-		const clientSettings = await tasks.db.getClientRecord(dapp);
-		if (!clientSettings) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-			context: {
-				code: 400,
-				siteKey: dapp
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-		const normalizedIp = require_normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
-		if (!normalizedIp) req.logger.warn(() => ({ msg: "Request missing IP; geoblocking will be skipped" }));
-		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
-		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
-		const sessionRecord = sessionId ? await tasks.db.getSessionRecordBySessionId(sessionId) : void 0;
-		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, sessionRecord?.decryptedHeadHash, void 0, countryCode, asn);
-		const userAccessPolicy = (await tasks.puzzleCaptchaManager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope, require_blacklistRequestInspector.normalizeHeadersForMatching(req.headers))).find((p) => !p.deferToVerify);
-		const { valid, reason, sessionId: validSessionId } = await tasks.puzzleCaptchaManager.isValidRequest(clientSettings, _prosopo_types.CaptchaType.puzzle, env, sessionId, userAccessPolicy, normalizedIp);
-		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {
-			context: {
-				code: 400,
-				siteKey: dapp,
-				user
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-		const origin = req.headers.origin;
-		if (!origin) return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-			context: {
-				error: "Origin header not found",
-				code: 400,
-				siteKey: dapp,
-				user
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-		const trafficVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientSettings.settings?.trafficFilter, req.logger);
-		const tolerance = (trafficVerdict.kind === "challenge" ? trafficVerdict.puzzleTolerance : void 0) ?? sessionRecord?.puzzleTolerance ?? clientSettings?.settings?.puzzleTolerance;
-		const routedPuzzleSettings = (trafficVerdict.kind === "challenge" ? trafficVerdict.puzzleSettings : void 0) ?? sessionRecord?.puzzle;
-		const effectivePuzzleSettings = require_puzzleRenderer.resolvePuzzleRenderSettings(clientSettings?.settings?.puzzle, routedPuzzleSettings);
-		const effectivePieceSize = require_puzzleRenderer.resolvePuzzlePieceSize(clientSettings?.settings?.puzzle, routedPuzzleSettings);
-		const challenge = await tasks.puzzleCaptchaManager.getPuzzleCaptchaChallenge(user, dapp, origin, tolerance);
-		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {
-			req.logger.warn(() => ({
-				err: updateErr,
-				msg: "Failed to patch session with SIMD readings on puzzle challenge"
-			}));
-		});
-		await tasks.db.storePuzzleCaptchaRecord(challenge.challenge, {
-			requestedAtTimestamp: challenge.requestedAtTimestamp,
-			userAccount: user,
-			dappAccount: dapp
-		}, challenge.targetX, challenge.targetY, challenge.originX, challenge.originY, challenge.tolerance, challenge.providerSignature, require_compositeIpAddress.getCompositeIpAddress(normalizedIp), (0, _prosopo_util.flatten)(req.headers), req.ja4, validSessionId, req.ipInfo);
-		const images = await require_puzzleRenderer.renderPuzzleImages({
-			targetX: challenge.targetX,
-			targetY: challenge.targetY
-		}, effectivePuzzleSettings, effectivePieceSize);
-		const padBytes = trafficVerdict.padBytes;
-		const getPuzzleCaptchaResponse = {
+	});
+	return {
+		logData: { tolerance: challenge.tolerance },
+		response: {
 			[_prosopo_types.ApiParams.status]: "ok",
 			[_prosopo_types.ApiParams.challenge]: challenge.challenge,
 			[_prosopo_types.ApiParams.background]: images.background,
@@ -124,39 +55,15 @@ var getPuzzleCaptchaChallenge_default = (env, userAccessRulesStorage) => async (
 			[_prosopo_types.ApiParams.originY]: challenge.originY,
 			[_prosopo_types.ApiParams.timestamp]: challenge.requestedAtTimestamp.toString(),
 			[_prosopo_types.ApiParams.signature]: { [_prosopo_types.ApiParams.provider]: { [_prosopo_types.ApiParams.challenge]: challenge.providerSignature } }
-		};
-		req.logger.info(() => ({
-			msg: "Puzzle captcha challenge issued",
-			data: {
-				captchaType: _prosopo_types.CaptchaType.puzzle,
-				challenge: challenge.challenge,
-				tolerance: challenge.tolerance,
-				user,
-				dapp,
-				session: sessionId
-			}
-		}));
-		res.locals.padBytes = padBytes;
-		require_metrics.recordCaptchaIssued(_prosopo_types.CaptchaType.puzzle);
-		return res.json(getPuzzleCaptchaResponse);
-	} catch (err) {
-		require_metrics.recordCaptchaIssueError(_prosopo_types.CaptchaType.puzzle);
-		req.logger.error(() => ({
-			err,
-			body: require_requestBodySummary.summariseRequestBody(req),
-			msg: "Error in puzzle captcha challenge request"
-		}));
-		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-			context: {
-				code: 500,
-				siteKey: req.body.dapp,
-				user: req.body.user,
-				error: err
-			},
-			i18n: req.i18n,
-			logger: req.logger
-		}));
-	}
+		}
+	};
 };
+var getPuzzleCaptchaChallenge_default = (env, userAccessRulesStorage) => require_interactiveCaptchaChallenge.interactiveChallengeHandler(env, userAccessRulesStorage, {
+	captchaType: _prosopo_types.CaptchaType.puzzle,
+	label: "puzzle",
+	manager: (tasks) => tasks.puzzleCaptchaManager,
+	maintenanceResponse: require_maintenanceModeResponses.buildPuzzleMaintenanceResponse,
+	issue: issuePuzzleChallenge
+});
 //#endregion
 exports.default = getPuzzleCaptchaChallenge_default;

package/dist/cjs/api/captcha/interactiveCaptchaChallenge.cjs

@@ -0,0 +1,154 @@
+const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
+const require_metrics = require("../metrics.cjs");
+const require_blacklistRequestInspector = require("../blacklistRequestInspector.cjs");
+const require_validateAddress = require("../validateAddress.cjs");
+const require_tasks = require("../../tasks/tasks.cjs");
+const require_apiToggleMaintenanceModeEndpoint = require("../admin/apiToggleMaintenanceModeEndpoint.cjs");
+const require_testSiteKey = require("../testSiteKey.cjs");
+const require_normalizeRequestIp = require("../../utils/normalizeRequestIp.cjs");
+const require_requestBodySummary = require("../requestBodySummary.cjs");
+const require_trafficFilterRequestTime = require("./trafficFilterRequestTime.cjs");
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_types = require("@prosopo/types");
+let _prosopo_util = require("@prosopo/util");
+//#region src/api/captcha/interactiveCaptchaChallenge.ts
+var capitalise = (text) => text.charAt(0).toUpperCase() + text.slice(1);
+/** Request handling shared by the challenge endpoints of the interactive types. */
+var interactiveChallengeHandler = (env, userAccessRulesStorage, spec) => async (req, res, next) => {
+	const { captchaType, label } = spec;
+	let parsed;
+	try {
+		parsed = _prosopo_types.GetPuzzleCaptchaChallengeRequestBody.parse(req.body);
+	} catch (err) {
+		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
+			context: {
+				code: 400,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+	const { user, dapp, sessionId, simdReadings } = parsed;
+	require_validateAddress.validateSiteKey(dapp);
+	require_validateAddress.validateAddr(user);
+	if (require_apiToggleMaintenanceModeEndpoint.getMaintenanceMode()) {
+		req.logger.info(() => ({
+			msg: `Maintenance mode active - returning dummy ${label} challenge`,
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(await spec.maintenanceResponse(user, dapp));
+	}
+	if (require_testSiteKey.isReservedTestSiteKey(dapp)) {
+		req.logger.warn(() => ({
+			msg: `Reserved TEST site key - returning dummy ${label} challenge`,
+			data: {
+				dapp,
+				user,
+				sessionId
+			}
+		}));
+		return res.json(await spec.maintenanceResponse(user, dapp));
+	}
+	const tasks = new require_tasks.Tasks(env, req.logger);
+	const manager = spec.manager(tasks);
+	try {
+		const clientSettings = await tasks.db.getClientRecord(dapp);
+		if (!clientSettings) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			context: {
+				code: 400,
+				siteKey: dapp
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const normalizedIp = require_normalizeRequestIp.normalizeRequestIp(req.ip, req.logger);
+		if (!normalizedIp) req.logger.warn(() => ({ msg: "Request missing IP; geoblocking will be skipped" }));
+		const countryCode = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.countryCode : void 0;
+		const asn = req.ipInfo && "isValid" in req.ipInfo && req.ipInfo.isValid ? req.ipInfo.asnNumber : void 0;
+		const sessionRecord = sessionId ? await tasks.db.getSessionRecordBySessionId(sessionId) : void 0;
+		const userScope = require_blacklistRequestInspector.getRequestUserScope((0, _prosopo_util.flatten)(req.headers), req.ja4, normalizedIp, user, sessionRecord?.decryptedHeadHash, void 0, countryCode, asn);
+		const userAccessPolicy = (await manager.getPrioritisedAccessPolicies(userAccessRulesStorage, dapp, userScope, require_blacklistRequestInspector.normalizeHeadersForMatching(req.headers))).find((p) => !p.deferToVerify);
+		const { valid, reason, sessionId: validSessionId } = await manager.isValidRequest(clientSettings, captchaType, env, sessionId, userAccessPolicy, normalizedIp);
+		if (!valid) return next(new _prosopo_common.ProsopoApiError(reason || "API.BAD_REQUEST", {
+			context: {
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const origin = req.headers.origin;
+		if (!origin) return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				error: "Origin header not found",
+				code: 400,
+				siteKey: dapp,
+				user
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+		const trafficVerdict = require_trafficFilterRequestTime.applyTrafficFilterAtRequestTime(req.ipInfo, clientSettings.settings?.trafficFilter, req.logger);
+		if (validSessionId && simdReadings) await tasks.frictionlessManager.decryptAndAttachSimdReadingsIfAbsent(validSessionId, simdReadings, _prosopo_types.SimdReadingsStage.challenge).catch((updateErr) => {
+			req.logger.warn(() => ({
+				err: updateErr,
+				msg: `Failed to patch session with SIMD readings on ${label} challenge`
+			}));
+		});
+		const { response, logData } = await spec.issue({
+			tasks,
+			user,
+			dapp,
+			origin,
+			clientSettings,
+			sessionRecord,
+			trafficVerdict,
+			provenance: {
+				ipAddress: require_compositeIpAddress.getCompositeIpAddress(normalizedIp),
+				headers: (0, _prosopo_util.flatten)(req.headers),
+				ja4: req.ja4,
+				sessionId: validSessionId,
+				ipInfo: req.ipInfo
+			}
+		});
+		req.logger.info(() => ({
+			msg: `${capitalise(label)} captcha challenge issued`,
+			data: {
+				captchaType,
+				challenge: response.challenge,
+				...logData,
+				user,
+				dapp,
+				session: sessionId
+			}
+		}));
+		res.locals.padBytes = trafficVerdict.padBytes;
+		require_metrics.recordCaptchaIssued(captchaType);
+		return res.json(response);
+	} catch (err) {
+		require_metrics.recordCaptchaIssueError(captchaType);
+		req.logger.error(() => ({
+			err,
+			body: require_requestBodySummary.summariseRequestBody(req),
+			msg: `Error in ${label} captcha challenge request`
+		}));
+		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			context: {
+				code: 500,
+				siteKey: req.body.dapp,
+				user: req.body.user,
+				error: err
+			},
+			i18n: req.i18n,
+			logger: req.logger
+		}));
+	}
+};
+//#endregion
+exports.interactiveChallengeHandler = interactiveChallengeHandler;