@prosopo/provider 5.15.0 → 5.16.0

package/dist/cjs/tasks/puzzleCaptcha/puzzleTasks.cjs

@@ -1,28 +1,30 @@
-const require_usageCounters = require("../../util/usageCounters.cjs");
-const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
-const require_rawTlsSignalsMiddleware = require("../../api/rawTlsSignalsMiddleware.cjs");
-const require_clientMetaData = require("../../utils/clientMetaData.cjs");
-const require_compositeIpAddress = require("../../compositeIpAddress.cjs");
-const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
-const require_captchaManager = require("../captchaManager.cjs");
-const require_util = require("../../util.cjs");
-const require_devicePlatform = require("../../utils/devicePlatform.cjs");
-const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
-const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
-const require_powTasksUtils = require("../powCaptcha/powTasksUtils.cjs");
+const require_interactiveCaptchaManager = require("../interactiveCaptcha/interactiveCaptchaManager.cjs");
 const require_puzzleTasksUtils = require("./puzzleTasksUtils.cjs");
-let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
-let _prosopo_util = require("@prosopo/util");
-let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
-let _polkadot_util = require("@polkadot/util");
 //#region src/tasks/puzzleCaptcha/puzzleTasks.ts
-var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
-	constructor(db, pair, config, logger, usageCounters) {
-		super(db, pair, config, logger);
-		this.POW_SEPARATOR = _prosopo_types.POW_SEPARATOR;
-		this.decisionMachineRunner = new require_decisionMachineRunner.DecisionMachineRunner(db);
-		this.usageCounters = usageCounters ?? null;
+var PuzzleCaptchaManager = class extends require_interactiveCaptchaManager.InteractiveCaptchaManager {
+	constructor(..._args) {
+		super(..._args);
+		this.captchaType = _prosopo_types.CaptchaType.puzzle;
+		this.logLabel = "puzzle";
+	}
+	getRecordByChallenge(challenge) {
+		return this.db.getPuzzleCaptchaRecordByChallenge(challenge);
+	}
+	updateRecord(challenge, updates) {
+		return this.db.updatePuzzleCaptchaRecord(challenge, updates);
+	}
+	updateSubmissionResult(challenge, result, userSignature, coords) {
+		return this.db.updatePuzzleCaptchaRecordResult(challenge, result, false, true, userSignature, coords);
+	}
+	async claimSubmission(record) {
+		return !record.userSubmitted;
+	}
+	markRecordChecked(challenge) {
+		return this.db.markPuzzleCaptchaRecordChecked(challenge);
+	}
+	decisionMachineEventFields(record) {
+		return { puzzleEvents: record.puzzleEvents };
 	}
 	/**
 	* @description Generates a Puzzle Captcha challenge for a given user and dapp
@@ -33,18 +35,15 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	* @param tolerance
 	*/
 	async getPuzzleCaptchaChallenge(userAccount, dappAccount, origin, tolerance) {
-		const resolvedTolerance = tolerance ?? _prosopo_types.puzzleToleranceDefault;
-		const requestedAtTimestamp = Date.now();
-		const challenge = `${requestedAtTimestamp}___${userAccount}___${dappAccount}___${Math.floor(Math.random() * 1e6)}`;
-		const challengeSignature = (0, _polkadot_util.u8aToHex)(this.pair.sign((0, _polkadot_util.stringToHex)(challenge)));
+		const { challenge, providerSignature, requestedAtTimestamp } = this.mintChallenge(userAccount, dappAccount);
 		return {
 			challenge,
 			targetX: Math.floor(Math.random() * 131) + 150,
 			targetY: Math.floor(Math.random() * 141) + 30,
 			originX: Math.floor(Math.random() * 111) + 20,
 			originY: Math.floor(Math.random() * 141) + 30,
-			tolerance: resolvedTolerance,
-			providerSignature: challengeSignature,
+			tolerance: tolerance ?? _prosopo_types.puzzleToleranceDefault,
+			providerSignature,
 			requestedAtTimestamp
 		};
 	}
@@ -63,467 +62,22 @@ var PuzzleCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	* @param behavioralData
 	*/
 	async verifyPuzzleCaptchaSolution(challenge, providerChallengeSignature, finalX, finalY, puzzleEvents, timeout, userTimestampSignature, ipAddress, headers, behavioralData, salt, simdReadings, clientMetaData) {
-		require_powTasksUtils.checkPowSignature(challenge, providerChallengeSignature, this.pair.address, _prosopo_types.ApiParams.challenge);
-		const challengeSplit = challenge.split(this.POW_SEPARATOR);
-		const timestamp = Number.parseInt((0, _prosopo_util.at)(challengeSplit, 0));
-		const userAccount = (0, _prosopo_util.at)(challengeSplit, 1);
-		require_powTasksUtils.checkPowSignature(timestamp.toString(), userTimestampSignature, userAccount, _prosopo_types.ApiParams.timestamp);
-		const challengeRecord = await this.db.getPuzzleCaptchaRecordByChallenge(challenge);
-		if (!challengeRecord) {
-			this.logger.debug(() => ({ msg: `No record of this challenge: ${challenge}` }));
-			return false;
-		}
-		let coords;
-		let saltDecodeError;
-		if (salt) try {
-			const extractedData = (0, _prosopo_util.extractData)(salt);
-			if (extractedData.length >= 2) {
-				const built = [[[extractedData[0], extractedData[1]]]];
-				(0, _prosopo_util.assertCoordsSafe)(built, "coords");
-				coords = built;
-			}
-		} catch (error) {
-			saltDecodeError = error;
-			this.logger.warn(() => ({
-				msg: "Failed to extract coordinates from salt",
-				error,
-				salt
-			}));
-		}
-		if (challengeRecord.userSubmitted) {
-			this.logger.debug(() => ({ msg: `Challenge already submitted: ${challenge}` }));
-			return false;
-		}
-		if (saltDecodeError) {
-			const badSaltResult = {
-				status: _prosopo_types.CaptchaStatus.disapproved,
-				reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_SALT
-			};
-			await this.db.updatePuzzleCaptchaRecordResult(challenge, badSaltResult, false, true, userTimestampSignature, void 0);
-			if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
-				userSubmitted: true,
-				result: badSaltResult,
-				...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, badSaltResult) && { blocked: true }
-			});
-			return false;
-		}
-		if (!(0, _prosopo_util.verifyRecency)(challenge, timeout)) {
-			const timeoutResult = {
-				status: _prosopo_types.CaptchaStatus.disapproved,
-				reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_TIMESTAMP
-			};
-			await this.db.updatePuzzleCaptchaRecordResult(challenge, timeoutResult, false, true, userTimestampSignature, coords);
-			if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
-				userSubmitted: true,
-				result: timeoutResult,
-				...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, timeoutResult) && { blocked: true }
-			});
-			return false;
-		}
-		const correct = require_puzzleTasksUtils.validatePuzzleSolution(finalX, finalY, challengeRecord.targetX, challengeRecord.targetY, challengeRecord.tolerance);
-		let result = { status: _prosopo_types.CaptchaStatus.approved };
-		if (!correct) result = {
-			status: _prosopo_types.CaptchaStatus.disapproved,
-			reason: _prosopo_types.ResultReason.CAPTCHA_INVALID_SOLUTION
-		};
-		if (correct && this.usageCounters) {
-			const dappAccount = (0, _prosopo_util.at)(challengeSplit, 2);
-			this.usageCounters.incrManyAsync(dappAccount, require_usageCounters.buildAllWindowIncrements("solved", _prosopo_types.CaptchaType.puzzle, ipAddress.address, userAccount));
-		}
-		await this.db.updatePuzzleCaptchaRecord(challenge, { puzzleEvents });
-		const decodedPayloads = await this.decodeSubmissionPayloads(challengeRecord.sessionId, {
-			behavioural: behavioralData,
-			simd: simdReadings
+		return this.submitInteractiveCaptchaSolution({
+			challenge,
+			providerChallengeSignature,
+			timeout,
+			userTimestampSignature,
+			ipAddress,
+			behavioralData,
+			salt,
+			simdReadings,
+			clientMetaData,
+			isCorrect: (record) => require_puzzleTasksUtils.validatePuzzleSolution(finalX, finalY, record.targetX, record.targetY, record.tolerance),
+			persistInteraction: () => this.db.updatePuzzleCaptchaRecord(challenge, { puzzleEvents })
 		});
-		if (behavioralData) try {
-			const decryptedData = decodedPayloads.behavioural;
-			if (decryptedData) {
-				const dappAccount = (0, _prosopo_util.at)(challengeSplit, 2);
-				this.logger?.info(() => ({
-					msg: "Behavioral analysis completed",
-					data: {
-						userAccount,
-						dappAccount,
-						challenge,
-						mouseEventsCount: decryptedData.collector1?.length || 0,
-						touchEventsCount: decryptedData.collector2?.length || 0,
-						clickEventsCount: decryptedData.collector3?.length || 0,
-						scrollEventsCount: decryptedData.collector4?.length || 0,
-						deviceCapability: decryptedData.deviceCapability,
-						captchaResult: correct ? "passed" : "failed"
-					}
-				}));
-				const packedData = {
-					c1: decryptedData.collector1 || [],
-					c2: decryptedData.collector2 || [],
-					c3: decryptedData.collector3 || [],
-					c4: decryptedData.collector4 || [],
-					d: decryptedData.deviceCapability
-				};
-				await this.db.updatePuzzleCaptchaRecord(challenge, {
-					behavioralDataPacked: packedData,
-					deviceCapability: decryptedData.deviceCapability
-				});
-			}
-		} catch (error) {
-			this.logger?.error(() => ({
-				msg: "Failed to process behavioral data",
-				err: error
-			}));
-		}
-		const storedClientMetaData = require_clientMetaData.toStoredClientMetaData(clientMetaData);
-		if (storedClientMetaData) await this.db.updatePuzzleCaptchaRecord(challenge, { clientMetaData: storedClientMetaData });
-		await this.db.updatePuzzleCaptchaRecordResult(challenge, result, false, true, userTimestampSignature, coords);
-		if (challengeRecord.sessionId) {
-			const linkedSessionId = challengeRecord.sessionId;
-			await this.updateSessionRecordWithCache(linkedSessionId, {
-				userSubmitted: true,
-				result,
-				...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, result) && { blocked: true },
-				...storedClientMetaData && { clientMetaData: storedClientMetaData }
-			});
-			if (decodedPayloads.simd) await this.recordSessionSimdReadingsIfAbsentWithCache(linkedSessionId, decodedPayloads.simd, _prosopo_types.SimdReadingsStage.submit);
-		}
-		return correct;
 	}
-	/**
-	* @description Verifies a Puzzle Captcha for a given user and dapp. This is called by the server to verify the user's solution
-	* and update the record in the database to show that the user has solved the captcha
-	*
-	* @param {string} dappAccount - the dapp that is requesting the captcha
-	* @param {string} challenge - the challenge string
-	* @param {number} timeout - the time in milliseconds since the Provider was selected to provide the captcha
-	* @param env - provider environment
-	* @param ip - optional IP address for validation
-	* @param userAccessRulesStorage - storage for querying user access policies
-	* @param email
-	* @param spamEmailDomainCheckingEnabled
-	* @param spamFilter
-	* @param trafficFilter
-	* @param storeMetadata - when true, persists the dapp-server-provided
-	*   `email` on the captcha record for spam-rate analysis.
-	* @param clientSessionId - the session id the site rendered the widget
-	*   with. When supplied, the solve must carry the same value in its
-	*   `clientMetaData` or it is disapproved.
-	*/
 	async serverVerifyPuzzleCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false, clientSessionId) {
-		const notVerifiedResponse = { verified: false };
-		const logger = this.logger.with({
-			challenge,
-			dappAccount
-		});
-		const challengeRecord = await this.db.getPuzzleCaptchaRecordByChallenge(challenge);
-		if (!challengeRecord) {
-			logger.debug(() => ({ msg: `No record of this challenge: ${challenge}` }));
-			return notVerifiedResponse;
-		}
-		notVerifiedResponse.sessionId = challengeRecord.sessionId;
-		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoApiError("CAPTCHA.INVALID_SOLUTION", { context: {
-			code: 400,
-			failedFuncName: this.serverVerifyPuzzleCaptchaSolution.name,
-			challenge
-		} });
-		if (challengeRecord.serverChecked) return notVerifiedResponse;
-		const challengeDappAccount = challengeRecord.dappAccount;
-		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
-			failedFuncName: this.serverVerifyPuzzleCaptchaSolution.name,
-			dappAccount,
-			challengeDappAccount
-		} });
-		if (!await this.db.markPuzzleCaptchaRecordChecked(challengeRecord.challenge)) return notVerifiedResponse;
-		const submittedAt = challengeRecord.submittedAtTimestamp;
-		if ((submittedAt instanceof Date ? Date.now() - submittedAt.getTime() : Number.POSITIVE_INFINITY) > timeout) {
-			const disapprovedResult = {
-				status: _prosopo_types.CaptchaStatus.disapproved,
-				reason: _prosopo_types.ResultReason.TIMESTAMP_TOO_OLD
-			};
-			const isBlocked = (0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, disapprovedResult);
-			await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
-				result: disapprovedResult,
-				...isBlocked && { blocked: true }
-			});
-			if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
-				serverChecked: true,
-				result: disapprovedResult,
-				...isBlocked && { blocked: true }
-			});
-			return notVerifiedResponse;
-		}
-		if (require_clientMetaData.isClientSessionMismatch(clientSessionId, challengeRecord.clientMetaData?.clientSessionId)) {
-			logger.info(() => ({
-				msg: "Client session mismatch in server puzzle verification",
-				data: { hasRecordedClientSessionId: Boolean(challengeRecord.clientMetaData?.clientSessionId) }
-			}));
-			const mismatchResult = {
-				status: _prosopo_types.CaptchaStatus.disapproved,
-				reason: _prosopo_types.ResultReason.CLIENT_SESSION_MISMATCH
-			};
-			const isBlocked = (0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, mismatchResult);
-			await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
-				result: mismatchResult,
-				...isBlocked && { blocked: true }
-			});
-			if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
-				serverChecked: true,
-				result: mismatchResult,
-				...isBlocked && { blocked: true }
-			});
-			return notVerifiedResponse;
-		}
-		if (userAccessRulesStorage) try {
-			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
-			if (blockPolicy) {
-				logger.info(() => ({
-					msg: "User blocked by access policy in server puzzle verification",
-					data: {
-						userAccount: challengeRecord.userAccount,
-						policy: blockPolicy
-					}
-				}));
-				const blockedResult = {
-					status: _prosopo_types.CaptchaStatus.disapproved,
-					reason: _prosopo_types.ResultReason.ACCESS_POLICY_BLOCK
-				};
-				const isBlocked = (0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, blockedResult);
-				await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
-					result: blockedResult,
-					...isBlocked && { blocked: true }
-				});
-				if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
-					serverChecked: true,
-					result: blockedResult,
-					...isBlocked && { blocked: true },
-					matchedRule: (0, _prosopo_user_access_policy.describeMatchedRule)(blockPolicy)
-				});
-				return notVerifiedResponse;
-			}
-		} catch (error) {
-			logger.warn(() => ({
-				msg: "Failed to check user access policies in server puzzle verification",
-				error
-			}));
-		}
-		if (email && spamEmailDomainCheckingEnabled) try {
-			if (await this.checkSpamEmail(email)) {
-				const emailDomain = email.split("@")[1] || "unknown";
-				logger.info(() => ({
-					msg: "Spam email domain detected in server puzzle verification",
-					data: { emailDomain }
-				}));
-				const spamResult = {
-					status: _prosopo_types.CaptchaStatus.disapproved,
-					reason: _prosopo_types.ResultReason.SPAM_EMAIL_DOMAIN
-				};
-				await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
-					result: spamResult,
-					...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, spamResult) && { blocked: true }
-				});
-				return notVerifiedResponse;
-			}
-		} catch (error) {
-			logger.warn(() => ({
-				msg: "Failed to check spam email domain in server puzzle verification",
-				error
-			}));
-		}
-		const maxEmailSubmissionCount = spamFilter?.enabled && spamFilter.emailRules?.enabled ? spamFilter.emailRules.maxEmailSubmissionCount : void 0;
-		let emailNormalised;
-		if (maxEmailSubmissionCount !== void 0 && email && storeMetadata) {
-			emailNormalised = require_evaluateEmailSpamRules.normaliseEmailForMatching(email);
-			if (emailNormalised) try {
-				const priorCount = await this.db.countCommitmentsByNormalisedEmail(dappAccount, emailNormalised);
-				if (priorCount >= maxEmailSubmissionCount) {
-					logger.info(() => ({
-						msg: "Email submission count exceeded in server puzzle verification",
-						data: {
-							priorCount,
-							maxEmailSubmissionCount
-						}
-					}));
-					const spamCountResult = {
-						status: _prosopo_types.CaptchaStatus.disapproved,
-						reason: _prosopo_types.ResultReason.SPAM_EMAIL_COUNT_EXCEEDED
-					};
-					await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
-						result: spamCountResult,
-						...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, spamCountResult) && { blocked: true }
-					});
-					return notVerifiedResponse;
-				}
-			} catch (error) {
-				logger.warn(() => ({
-					msg: "Failed to check email submission count in server puzzle verification",
-					error
-				}));
-			}
-		}
-		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
-		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip);
-		{
-			const check = await this.resolveTrafficFilterCheck(env, challengeRecord.ipInfo, trafficFilter, ip, enrichedDnsEvent);
-			if (check.isBlocked) {
-				logger.info(() => ({
-					msg: "Traffic filter rejected request in puzzle verification",
-					data: {
-						ip,
-						reason: check.reason,
-						dnsPeerIp: enrichedDnsEvent?.peerIp,
-						dnsResolverIp: enrichedDnsEvent?.resolverIp,
-						dnsPeerAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
-						dnsResolverAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo),
-						dnsPathValid: enrichedDnsEvent?.pathValid
-					}
-				}));
-				const blockedResult = {
-					status: _prosopo_types.CaptchaStatus.disapproved,
-					reason: check.reason
-				};
-				const isBlocked = (0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, blockedResult);
-				await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
-					result: blockedResult,
-					...isBlocked && { blocked: true }
-				});
-				if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
-					serverChecked: true,
-					result: blockedResult,
-					...isBlocked && { blocked: true }
-				});
-				return notVerifiedResponse;
-			}
-		}
-		if (storeMetadata && email) await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, { metadata: {
-			email,
-			emailNormalised: emailNormalised ?? require_evaluateEmailSpamRules.normaliseEmailForMatching(email)
-		} });
-		if (ip) {
-			const challengeIpAddress = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
-			const ipValidationRules = (await this.db.getClientRecord(dappAccount))?.settings?.ipValidationRules;
-			await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, { providedIp: require_compositeIpAddress.getCompositeIpAddress(ip) });
-			if (ipValidationRules?.enabled === true) {
-				const ipValidation = await require_util.deepValidateIpAddress(ip, challengeIpAddress, logger, env.ipInfoService, ipValidationRules, enrichedDnsEvent?.peerIp);
-				if (!ipValidation.isValid) {
-					logger.error(() => ({
-						msg: "IP validation failed for puzzle captcha",
-						data: {
-							ip,
-							challengeIp: challengeIpAddress.address,
-							error: ipValidation.errorMessage,
-							distanceKm: ipValidation.distanceKm
-						}
-					}));
-					const ipFailResult = {
-						status: _prosopo_types.CaptchaStatus.disapproved,
-						reason: _prosopo_types.ResultReason.FAILED_IP_VALIDATION
-					};
-					const isBlocked = (0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, ipFailResult);
-					await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
-						result: ipFailResult,
-						...isBlocked && { blocked: true }
-					});
-					if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
-						serverChecked: true,
-						result: ipFailResult,
-						...isBlocked && { blocked: true }
-					});
-					return notVerifiedResponse;
-				}
-			}
-		}
-		let score;
-		if (sessionRecord) {
-			const dnsAsymmetry = require_enrichDnsEvent.computeDnsAsymmetry(enrichedDnsEvent, challengeRecord.ipInfo, trafficFilter);
-			if (dnsAsymmetry > 0) sessionRecord.scoreComponents = {
-				...sessionRecord.scoreComponents,
-				dnsAsymmetry
-			};
-			score = require_frictionlessTasksUtils.computeFrictionlessScore(sessionRecord?.scoreComponents);
-			logger.info(() => ({ data: {
-				scoreComponents: { ...sessionRecord?.scoreComponents || {} },
-				score,
-				dnsPeerAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.peerIpInfo),
-				dnsResolverAsn: require_enrichDnsEvent.getIpInfoAsn(enrichedDnsEvent?.resolverIpInfo)
-			} }));
-		}
-		try {
-			const decisionInput = {
-				userAccount: challengeRecord.userAccount,
-				dappAccount: challengeRecord.dappAccount,
-				captchaResult: "passed",
-				headers: challengeRecord.headers,
-				captchaType: _prosopo_types.CaptchaType.puzzle,
-				behavioralDataPacked: challengeRecord.behavioralDataPacked,
-				deviceCapability: challengeRecord.deviceCapability,
-				countryCode: challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0,
-				ipInfo: challengeRecord.ipInfo,
-				dnsEvent: enrichedDnsEvent,
-				score,
-				threshold: sessionRecord?.threshold,
-				scoreComponents: sessionRecord?.scoreComponents,
-				decryptedHeadHash: sessionRecord?.decryptedHeadHash,
-				userSitekeyIpHash: sessionRecord?.userSitekeyIpHash,
-				simdReadings: sessionRecord?.simdReadings,
-				d: sessionRecord?.d,
-				frictionlessReason: sessionRecord?.reason,
-				ruleType: sessionRecord?.ruleType,
-				webView: sessionRecord?.webView,
-				iFrame: sessionRecord?.iFrame,
-				currentUrl: sessionRecord?.currentUrl,
-				iframeUrl: sessionRecord?.iframeUrl,
-				coords: challengeRecord.coords,
-				puzzleEvents: challengeRecord.puzzleEvents,
-				...require_rawTlsSignalsMiddleware.rawTlsSignalsFromRecord(sessionRecord),
-				trafficPolicies: require_devicePlatform.deriveTrafficPolicies(trafficFilter)
-			};
-			const decision = await this.decisionMachineRunner.decide(decisionInput, logger);
-			if (decision.decision === _prosopo_types.DecisionMachineDecision.Deny) {
-				logger.info(() => ({
-					msg: "Decision machine denied puzzle captcha in server verification",
-					data: {
-						userAccount: challengeRecord.userAccount,
-						reason: decision.reason,
-						score: decision.score,
-						tags: decision.tags
-					}
-				}));
-				const dmResult = {
-					status: _prosopo_types.CaptchaStatus.disapproved,
-					reason: decision.reason || _prosopo_types.ResultReason.CAPTCHA_DECISION_MACHINE_DENIED
-				};
-				const isBlocked = (0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.puzzle, dmResult);
-				await this.db.updatePuzzleCaptchaRecord(challengeRecord.challenge, {
-					result: dmResult,
-					...isBlocked && { blocked: true }
-				});
-				if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
-					serverChecked: true,
-					result: dmResult,
-					...isBlocked && { blocked: true }
-				});
-				return notVerifiedResponse;
-			}
-			logger.debug(() => ({
-				msg: "Decision machine allowed puzzle captcha",
-				data: {
-					reason: decision.reason,
-					score: decision.score,
-					tags: decision.tags
-				}
-			}));
-		} catch (error) {
-			logger.error(() => ({
-				msg: "Failed to run decision machine in server puzzle verification",
-				err: error
-			}));
-		}
-		if (challengeRecord.sessionId) await this.updateSessionRecordWithCache(challengeRecord.sessionId, {
-			serverChecked: true,
-			result: { status: _prosopo_types.CaptchaStatus.approved }
-		});
-		return {
-			verified: true,
-			...score ? { score } : {},
-			...challengeRecord.sessionId && { sessionId: challengeRecord.sessionId }
-		};
+		return this.serverVerifyInteractiveCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled, spamFilter, trafficFilter, storeMetadata, clientSessionId);
 	}
 };
 //#endregion

package/dist/cjs/tasks/spam/checkTrafficFilter.cjs

@@ -131,6 +131,8 @@ var checkTrafficFilter = (ipInfo, trafficFilter, extraIpInfos, dnsPathValid) =>
 		matches
 	};
 };
+/** A lower tolerance is a smaller hit radius, so the strictest is the minimum. */
+var strictestTolerance = (current, next) => next === void 0 || current === void 0 ? next ?? current : Math.min(current, next);
 /**
 * Combine the `challenge` matches into a single effective policy: pick the
 * strictest captcha type, then take the hardest params (max difficulty,
@@ -147,14 +149,26 @@ var resolveChallengePolicy = (matches) => {
 	let solvedImagesCount;
 	let puzzleTolerance;
 	let puzzleSettings;
+	let audioSettings;
+	let iconOrderTolerance;
+	let iconOrderSettings;
 	for (const m of challenges) {
 		if (m.policy.powDifficulty !== void 0) powDifficulty = powDifficulty === void 0 ? m.policy.powDifficulty : Math.max(powDifficulty, m.policy.powDifficulty);
 		if (m.policy.solvedImagesCount !== void 0) solvedImagesCount = solvedImagesCount === void 0 ? m.policy.solvedImagesCount : Math.max(solvedImagesCount, m.policy.solvedImagesCount);
-		if (m.policy.puzzleTolerance !== void 0) puzzleTolerance = puzzleTolerance === void 0 ? m.policy.puzzleTolerance : Math.min(puzzleTolerance, m.policy.puzzleTolerance);
+		puzzleTolerance = strictestTolerance(puzzleTolerance, m.policy.puzzleTolerance);
 		if (m.policy.puzzle) puzzleSettings = {
 			...puzzleSettings ?? {},
 			...m.policy.puzzle
 		};
+		if (m.policy.audio) audioSettings = {
+			...audioSettings ?? {},
+			...m.policy.audio
+		};
+		iconOrderTolerance = strictestTolerance(iconOrderTolerance, m.policy.iconOrderTolerance);
+		if (m.policy.iconOrder) iconOrderSettings = {
+			...iconOrderSettings ?? {},
+			...m.policy.iconOrder
+		};
 	}
 	return {
 		captchaType: winningCaptchaType,
@@ -162,6 +176,9 @@ var resolveChallengePolicy = (matches) => {
 		solvedImagesCount,
 		puzzleTolerance,
 		puzzleSettings,
+		audioSettings,
+		iconOrderTolerance,
+		iconOrderSettings,
 		sourceCategories: challenges.map((m) => m.category)
 	};
 };

package/dist/cjs/tasks/tasks.cjs

@@ -1,8 +1,10 @@
 const require_usageCounters = require("../util/usageCounters.cjs");
 const require_decisionMachineRunner = require("./decisionMachine/decisionMachineRunner.cjs");
+const require_audioTasks = require("./audioCaptcha/audioTasks.cjs");
 const require_clientTasks = require("./client/clientTasks.cjs");
 const require_datasetTasks = require("./dataset/datasetTasks.cjs");
 const require_frictionlessTasks = require("./frictionless/frictionlessTasks.cjs");
+const require_iconOrderTasks = require("./iconOrderCaptcha/iconOrderTasks.cjs");
 const require_imgCaptchaTasks = require("./imgCaptcha/imgCaptchaTasks.cjs");
 const require_powTasks = require("./powCaptcha/powTasks.cjs");
 const require_puzzleTasks = require("./puzzleCaptcha/puzzleTasks.cjs");
@@ -33,6 +35,8 @@ var Tasks = class {
 		this.usageCounters = this.initUsageCounters();
 		this.powCaptchaManager = new require_powTasks.PowCaptchaManager(this.db, this.pair, this.config, this.logger, this.writeQueue, this.usageCounters);
 		this.puzzleCaptchaManager = new require_puzzleTasks.PuzzleCaptchaManager(this.db, this.pair, this.config, this.logger, this.usageCounters);
+		this.audioCaptchaManager = new require_audioTasks.AudioCaptchaManager(this.db, this.pair, this.config, this.logger, this.usageCounters);
+		this.iconOrderCaptchaManager = new require_iconOrderTasks.IconOrderCaptchaManager(this.db, this.pair, this.config, this.logger, this.usageCounters);
 		this.datasetManager = new require_datasetTasks.DatasetManager(this.config, this.logger, this.captchaConfig, this.db);
 		this.imgCaptchaManager = new require_imgCaptchaTasks.ImgCaptchaManager(this.db, this.pair, this.config, this.logger, this.writeQueue, this.usageCounters);
 		this.clientTaskManager = new require_clientTasks.ClientTaskManager(this.config, this.logger, this.db);
@@ -62,6 +66,8 @@ var Tasks = class {
 		this.logger = logger;
 		this.powCaptchaManager.logger = logger;
 		this.puzzleCaptchaManager.logger = logger;
+		this.audioCaptchaManager.logger = logger;
+		this.iconOrderCaptchaManager.logger = logger;
 		this.datasetManager.logger = logger;
 		this.imgCaptchaManager.logger = logger;
 		this.clientTaskManager.logger = logger;

package/dist/cjs/util.cjs

@@ -2,10 +2,10 @@ const require_ipComparison = require("./services/ipComparison.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_util = require("@prosopo/util");
-let _prosopo_util_crypto = require("@prosopo/util-crypto");
 let ip_address = require("ip-address");
 let _polkadot_util_hex = require("@polkadot/util/hex");
 let _polkadot_util_is = require("@polkadot/util/is");
+let _prosopo_util_crypto = require("@prosopo/util-crypto");
 //#region src/util.ts
 function encodeStringAddress(address) {
 	try {

package/dist/index.js

@@ -1,9 +1,9 @@
 import "./_virtual/_rolldown/runtime.js";
 import { getCompositeIpAddress, getIpAddressFromComposite, isSameIpOrigin } from "./compositeIpAddress.js";
-import { BlacklistRequestInspector, getPrioritisedAccessRule, getRequestUserScope, getVerdictCache, normalizeHeadersForMatching, rankCandidateRules } from "./api/blacklistRequestInspector.js";
-import { FrictionlessReason } from "./tasks/frictionless/frictionlessTasks.js";
 import { compareIPs } from "./services/ipComparison.js";
 import { checkIfTaskIsRunning, deepValidateIpAddress, encodeStringAddress, evaluateIpValidationRules, getIPAddress, getIPAddressFromBigInt, shuffleArray, validateIpAddress } from "./util.js";
+import { BlacklistRequestInspector, getPrioritisedAccessRule, getRequestUserScope, getVerdictCache, normalizeHeadersForMatching, rankCandidateRules } from "./api/blacklistRequestInspector.js";
+import { FrictionlessReason } from "./tasks/frictionless/frictionlessTasks.js";
 import { Tasks } from "./tasks/tasks.js";
 import { updateSpamEmailDomains } from "./tasks/spam/updateSpamEmailDomains.js";
 import { blockMiddleware } from "./api/block.js";