@prosopo/provider 5.19.3 → 5.20.0

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasks.cjs

@@ -8,6 +8,7 @@ const require_enrichDnsEvent = require("../dnsEvent/enrichDnsEvent.cjs");
 const require_captchaManager = require("../captchaManager.cjs");
 const require_decisionMachineRunner = require("../decisionMachine/decisionMachineRunner.cjs");
 const require_frictionlessTasksUtils = require("../frictionless/frictionlessTasksUtils.cjs");
+const require_signatureCheck = require("../signatureCheck.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
 const require_lang = require("../../rules/lang.cjs");
 const require_pairs = require("../../pairs.cjs");
@@ -29,24 +30,38 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	}
 	async getCaptchaWithProof(datasetId, solved, size) {
 		const captchaDocs = await this.db.getRandomCaptcha(solved, datasetId, size);
-		if (!captchaDocs) throw new _prosopo_common.ProsopoEnvError("DATABASE.CAPTCHA_GET_FAILED", { context: {
-			failedFuncName: this.getCaptchaWithProof.name,
-			datasetId,
-			solved,
-			size
-		} });
+		if (!captchaDocs) throw new _prosopo_common.ProsopoError({
+			code: "DB_QUERY_FAILED",
+			errorSite: "PROV-59",
+			message: "Failed to get captcha",
+			context: {
+				failedFuncName: this.getCaptchaWithProof.name,
+				datasetId,
+				solved,
+				size
+			}
+		});
 		return captchaDocs;
 	}
 	async getRandomCaptchasAndRequestHash(datasetId, userAccount, ipAddress, captchaConfig, threshold, sessionId, ipInfo) {
 		const dataset = await this.db.getDatasetDetails(datasetId);
-		if (!dataset) throw new _prosopo_common.ProsopoEnvError("DATABASE.DATASET_GET_FAILED", { context: {
-			failedFuncName: this.getRandomCaptchasAndRequestHash.name,
-			dataset,
-			datasetId
-		} });
+		if (!dataset) throw new _prosopo_common.ProsopoError({
+			code: "DB_QUERY_FAILED",
+			errorSite: "PROV-60",
+			message: "Failed to get dataset",
+			context: {
+				failedFuncName: this.getRandomCaptchasAndRequestHash.name,
+				dataset,
+				datasetId
+			}
+		});
 		const unsolvedCount = Math.abs(Math.trunc(captchaConfig.unsolved.count));
 		const solvedCount = Math.abs(Math.trunc(captchaConfig.solved.count));
-		if (!solvedCount) throw new _prosopo_common.ProsopoEnvError("CONFIG.INVALID_CAPTCHA_NUMBER");
+		if (!solvedCount) throw new _prosopo_common.ProsopoError({
+			code: "CONFIG_INVALID",
+			errorSite: "PROV-61",
+			message: "Please configure captchas configurations correctly"
+		});
 		const solved = await this.getCaptchaWithProof(datasetId, true, solvedCount);
 		let unsolved = [];
 		if (unsolvedCount) unsolved = await this.getCaptchaWithProof(datasetId, false, unsolvedCount);
@@ -81,23 +96,33 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	* @return {Promise<DappUserSolutionResult>} result containing the contract event
 	*/
 	async dappUserSolution(userAccount, dappAccount, requestHash, captchas, userTimestampSignature, timestamp, providerRequestHashSignature, ipAddress, headers, ja4, behavioralData, ipInfo, simdReadings, clientMetaData) {
-		if (!(0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(timestamp.toString()), userTimestampSignature, userAccount).isValid) {
-			const err = new _prosopo_common.ProsopoEnvError("GENERAL.INVALID_SIGNATURE", { context: {
-				failedFuncName: this.dappUserSolution.name,
-				userAccount
-			} });
+		if (!require_signatureCheck.isSignatureValid(timestamp.toString(), userTimestampSignature, userAccount)) {
+			const err = new _prosopo_common.ProsopoError({
+				code: "UNAUTHORIZED",
+				errorSite: "PROV-62",
+				message: "Invalid signature",
+				context: {
+					failedFuncName: this.dappUserSolution.name,
+					userAccount
+				}
+			});
 			this.logger.info(() => ({
 				err,
 				msg: "Invalid user timestamp signature"
 			}));
 			throw err;
 		}
-		if (!(0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(requestHash.toString()), providerRequestHashSignature, this.pair.address).isValid) {
-			const err = new _prosopo_common.ProsopoEnvError("GENERAL.INVALID_SIGNATURE", { context: {
-				failedFuncName: this.dappUserSolution.name,
-				userAccount,
-				error: "requestHash signature is invalid"
-			} });
+		if (!require_signatureCheck.isSignatureValid(requestHash.toString(), providerRequestHashSignature, this.pair.address)) {
+			const err = new _prosopo_common.ProsopoError({
+				code: "UNAUTHORIZED",
+				errorSite: "PROV-63",
+				message: "Invalid signature",
+				context: {
+					failedFuncName: this.dappUserSolution.name,
+					userAccount,
+					error: "requestHash signature is invalid"
+				}
+			});
 			this.logger.info(() => ({
 				err,
 				msg: "Invalid provider requestHash signature"
@@ -130,7 +155,12 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			const inputMethodsDeclared = receivedCaptchas.some((c) => c.inputMethods !== void 0);
 			const { tree, commitmentId } = require_imgCaptchaTasksUtils.buildTreeAndGetCommitmentId(receivedCaptchas);
 			const datasetId = (0, _prosopo_util.at)(storedCaptchas, 0).datasetId;
-			if (!datasetId) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.ID_MISMATCH", { context: { failedFuncName: this.dappUserSolution.name } });
+			if (!datasetId) throw new _prosopo_common.ProsopoError({
+				code: "INVALID_DATA",
+				errorSite: "PROV-64",
+				message: "captcha id mismatch",
+				context: { failedFuncName: this.dappUserSolution.name }
+			});
 			if (!await this.db.updatePendingImageCommitmentStatus(requestHash)) {
 				this.logger.info(() => ({ msg: "Request hash already consumed by a concurrent submission" }));
 				return response;
@@ -198,7 +228,11 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			await this.db.storeUserImageCaptchaSolution(receivedCaptchas, commit);
 			const solutionRecords = await Promise.all(storedCaptchas.map(async (captcha) => {
 				const solutionRecord = await this.db.getSolutionByCaptchaId(captcha.captchaId);
-				if (!solutionRecord) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.SOLUTION_NOT_FOUND", { context: { failedFuncName: this.dappUserSolution.name } });
+				if (!solutionRecord) throw new _prosopo_common.ProsopoError({
+					code: "SOLUTION_NOT_FOUND",
+					errorSite: "PROV-65",
+					context: { failedFuncName: this.dappUserSolution.name }
+				});
 				return solutionRecord;
 			}));
 			const totalImages = storedCaptchas[0]?.items.length || 0;
@@ -276,14 +310,24 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		const receivedCaptchas = (0, _prosopo_datasets.parseAndSortCaptchaSolutions)(captchas);
 		const captchaIds = receivedCaptchas.map((captcha) => captcha.captchaId);
 		const storedCaptchas = await this.db.getCaptchaById(captchaIds);
-		if (!storedCaptchas || receivedCaptchas.length !== storedCaptchas.length) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.INVALID_CAPTCHA_ID", { context: {
-			failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
-			captchas
-		} });
-		if (!storedCaptchas.every((captcha) => captcha.datasetId === (0, _prosopo_util.at)(storedCaptchas, 0).datasetId)) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DIFFERENT_DATASET_IDS", { context: {
-			failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
-			captchas
-		} });
+		if (!storedCaptchas || receivedCaptchas.length !== storedCaptchas.length) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_DATA",
+			errorSite: "PROV-66",
+			message: "Invalid captcha id",
+			context: {
+				failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
+				captchas
+			}
+		});
+		if (!storedCaptchas.every((captcha) => captcha.datasetId === (0, _prosopo_util.at)(storedCaptchas, 0).datasetId)) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_DATA",
+			errorSite: "PROV-67",
+			message: "Dataset ids do not match",
+			context: {
+				failedFuncName: this.validateReceivedCaptchasAgainstStoredCaptchas.name,
+				captchas
+			}
+		});
 		return {
 			storedCaptchas,
 			receivedCaptchas,
@@ -312,10 +356,15 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	}
 	async getDappUserCommitmentById(commitmentId) {
 		const dappUserSolution = await this.db.getDappUserCommitmentById(commitmentId);
-		if (!dappUserSolution) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
-			failedFuncName: this.getDappUserCommitmentById.name,
-			commitmentId
-		} });
+		if (!dappUserSolution) throw new _prosopo_common.ProsopoError({
+			code: "SOLUTION_NOT_FOUND",
+			errorSite: "PROV-68",
+			message: "Dapp user solution not found",
+			context: {
+				failedFuncName: this.getDappUserCommitmentById.name,
+				commitmentId
+			}
+		});
 		return dappUserSolution;
 	}
 	async verifyImageCaptchaSolution(user, dapp, commitmentId, env, maxVerifiedTime, ip, disallowWebView, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false, clientSessionId) {
@@ -378,8 +427,9 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			};
 			failStatus = _prosopo_types.ResultReason.CLIENT_SESSION_MISMATCH;
 		}
+		const sessionRecord = solution.sessionId ? await this.getSessionRecordWithOriginFallback(solution.sessionId) : void 0;
 		if (!failStatus && userAccessRulesStorage) try {
-			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, solution, solution.userAccount, solution.headers, solution.coords, solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0, solution.ipInfo?.isValid ? solution.ipInfo.asnNumber : void 0);
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, solution, solution.userAccount, solution.headers, sessionRecord?.decryptedHeadHash, solution.coords, solution.ipInfo?.isValid ? solution.ipInfo.countryCode : void 0, solution.ipInfo?.isValid ? solution.ipInfo.asnNumber : void 0);
 			if (blockPolicy) {
 				logger.info(() => ({
 					msg: "User blocked by access policy in server image verification",
@@ -462,10 +512,9 @@ var ImgCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				}));
 			}
 		}
-		const sessionRecord = solution.sessionId ? await this.getSessionRecordWithOriginFallback(solution.sessionId) : void 0;
 		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? solution.ipInfo?.ip);
 		if (!failStatus) {
-			const check = await this.resolveTrafficFilterCheck(env, solution.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			const check = await this.resolveTrafficFilterCheck(solution.ipInfo, trafficFilter, ip ? await env.ipInfoService.lookup(ip) : void 0, enrichedDnsEvent);
 			if (check.isBlocked) {
 				logger.info(() => ({
 					msg: "Traffic filter rejected request",

package/dist/cjs/tasks/imgCaptcha/imgCaptchaTasksUtils.cjs

@@ -17,10 +17,15 @@ var nativeMerkle = (() => {
 * CaptchaMerkleTree so callers can still generate proofs.
 */
 var buildTreeAndGetCommitmentId = (captchaSolutions) => {
-	if (captchaSolutions.length === 0) throw new _prosopo_common.ProsopoEnvError("CONTRACT.CAPTCHA_SOLUTION_COMMITMENT_DOES_NOT_EXIST", { context: {
-		failedFuncName: buildTreeAndGetCommitmentId.name,
-		commitmentId: null
-	} });
+	if (captchaSolutions.length === 0) throw new _prosopo_common.ProsopoError({
+		code: "RECORD_NOT_FOUND",
+		errorSite: "PROV-69",
+		message: "Captcha solution commitment does not exist",
+		context: {
+			failedFuncName: buildTreeAndGetCommitmentId.name,
+			commitmentId: null
+		}
+	});
 	const layers = require_metrics.measureSync("merkle_build", () => {
 		const solutionsHashed = captchaSolutions.map((captcha) => nativeMerkle.computeCaptchaSolutionHash(captcha.captchaId, captcha.captchaContentId, captcha.solution, captcha.salt));
 		return nativeMerkle.buildMerkleLayers(solutionsHashed);
@@ -28,10 +33,15 @@ var buildTreeAndGetCommitmentId = (captchaSolutions) => {
 	const tree = new _prosopo_datasets.CaptchaMerkleTree();
 	tree.hydrateFromLayers(layers);
 	const commitmentId = tree.root?.hash;
-	if (!commitmentId) throw new _prosopo_common.ProsopoEnvError("CONTRACT.CAPTCHA_SOLUTION_COMMITMENT_DOES_NOT_EXIST", { context: {
-		failedFuncName: buildTreeAndGetCommitmentId.name,
-		commitmentId
-	} });
+	if (!commitmentId) throw new _prosopo_common.ProsopoError({
+		code: "RECORD_NOT_FOUND",
+		errorSite: "PROV-70",
+		message: "Captcha solution commitment does not exist",
+		context: {
+			failedFuncName: buildTreeAndGetCommitmentId.name,
+			commitmentId
+		}
+	});
 	return {
 		tree,
 		commitmentId

package/dist/cjs/tasks/interactiveCaptcha/interactiveCaptchaManager.cjs

@@ -183,18 +183,26 @@ var InteractiveCaptchaManager = class extends require_captchaManager.CaptchaMana
 			return notVerifiedResponse;
 		}
 		notVerifiedResponse.sessionId = challengeRecord.sessionId;
-		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoApiError("CAPTCHA.INVALID_SOLUTION", { context: {
-			code: 400,
-			failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
-			challenge
-		} });
+		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_SOLUTION",
+			errorSite: "PROV-71",
+			context: {
+				failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
+				challenge
+			}
+		});
 		if (challengeRecord.serverChecked) return notVerifiedResponse;
 		const challengeDappAccount = challengeRecord.dappAccount;
-		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
-			failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
-			dappAccount,
-			challengeDappAccount
-		} });
+		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoError({
+			code: "SOLUTION_NOT_FOUND",
+			errorSite: "PROV-72",
+			message: "Dapp user solution not found",
+			context: {
+				failedFuncName: this.serverVerifyInteractiveCaptchaSolution.name,
+				dappAccount,
+				challengeDappAccount
+			}
+		});
 		if (!await this.markRecordChecked(challengeRecord.challenge)) return notVerifiedResponse;
 		const submittedAt = challengeRecord.submittedAtTimestamp;
 		if ((submittedAt instanceof Date ? Date.now() - submittedAt.getTime() : Number.POSITIVE_INFINITY) > timeout) {
@@ -209,8 +217,9 @@ var InteractiveCaptchaManager = class extends require_captchaManager.CaptchaMana
 			await this.disapproveVerification(challengeRecord, _prosopo_types.ResultReason.CLIENT_SESSION_MISMATCH);
 			return notVerifiedResponse;
 		}
+		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
 		if (userAccessRulesStorage) try {
-			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, sessionRecord?.decryptedHeadHash, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
 			if (blockPolicy) {
 				logger.info(() => ({
 					msg: `User blocked by access policy in server ${this.logLabel} verification`,
@@ -268,10 +277,9 @@ var InteractiveCaptchaManager = class extends require_captchaManager.CaptchaMana
 				}));
 			}
 		}
-		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
 		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip);
 		{
-			const check = await this.resolveTrafficFilterCheck(env, challengeRecord.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			const check = await this.resolveTrafficFilterCheck(challengeRecord.ipInfo, trafficFilter, ip ? await env.ipInfoService.lookup(ip) : void 0, enrichedDnsEvent);
 			if (check.isBlocked) {
 				logger.info(() => ({
 					msg: `Traffic filter rejected request in ${this.logLabel} verification`,

package/dist/cjs/tasks/powCaptcha/backgroundWrites.cjs

@@ -0,0 +1,24 @@
+//#region src/tasks/powCaptcha/backgroundWrites.ts
+/**
+* Lets writes finish after the response, but once `limit` are still pending
+* the caller waits for its own, so a slow database cannot pile them up.
+*/
+var BackgroundWrites = class {
+	constructor(limit) {
+		this.limit = limit;
+		this.pending = 0;
+	}
+	async add(writes, onError) {
+		const settled = writes.then(() => void 0, onError);
+		if (this.pending >= this.limit) {
+			await settled;
+			return;
+		}
+		this.pending++;
+		settled.finally(() => {
+			this.pending--;
+		});
+	}
+};
+//#endregion
+exports.BackgroundWrites = BackgroundWrites;

package/dist/cjs/tasks/powCaptcha/powTasks.cjs

@@ -11,6 +11,7 @@ const require_frictionlessTasksUtils = require("../frictionless/frictionlessTask
 const require_powTasksUtils = require("./powTasksUtils.cjs");
 const require_evaluateEmailSpamRules = require("../spam/evaluateEmailSpamRules.cjs");
 const require_routingMachine = require("../frictionless/routingMachine.cjs");
+const require_backgroundWrites = require("./backgroundWrites.cjs");
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
 let _polkadot_util = require("@polkadot/util");
@@ -18,6 +19,7 @@ let _prosopo_user_access_policy = require("@prosopo/user-access-policy");
 let _prosopo_util = require("@prosopo/util");
 //#region src/tasks/powCaptcha/powTasks.ts
 var DEFAULT_POW_DIFFICULTY = 4;
+var verifyOutcomeWrites = new require_backgroundWrites.BackgroundWrites(500);
 var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	constructor(db, pair, config, logger, writeQueue, usageCounters) {
 		super(db, pair, config, logger, writeQueue);
@@ -65,7 +67,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	* @param behavioralData
 	* @param salt
 	*/
-	async verifyPowCaptchaSolution(challenge, providerChallengeSignature, nonce, timeout, userTimestampSignature, ipAddress, headers, behavioralData, salt, simdReadings, clientMetaData) {
+	async verifyPowCaptchaSolution(challenge, providerChallengeSignature, nonce, timeout, userTimestampSignature, ipAddress, headers, behavioralData, salt, simdReadings, clientMetaData, fingerprintSummary) {
 		require_powTasksUtils.checkPowSignature(challenge, providerChallengeSignature, this.pair.address, _prosopo_types.ApiParams.challenge);
 		const challengeSplit = challenge.split(this.POW_SEPARATOR);
 		const timestamp = Number.parseInt((0, _prosopo_util.at)(challengeSplit, 0));
@@ -134,7 +136,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		};
 		if (correct && this.usageCounters) {
 			const dappAccount = (0, _prosopo_util.at)(challengeSplit, 2);
-			this.usageCounters.incrManyAsync(dappAccount, require_usageCounters.buildAllWindowIncrements("solved", _prosopo_types.CaptchaType.pow, ipAddress.address, userAccount));
+			this.usageCounters.incrManyAsync(dappAccount, require_usageCounters.buildAllWindowIncrements("solved", _prosopo_types.CaptchaType.pow, ipAddress.address, userAccount, void 0, fingerprintSummary?.bucketId));
 		}
 		let behavioralUpdates = {};
 		let decryptedBehavioralDataPacked;
@@ -180,6 +182,7 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			}));
 		}
 		const recordUpdates = { ...behavioralUpdates };
+		if (fingerprintSummary) recordUpdates.fingerprintSummary = fingerprintSummary;
 		const storedClientMetaData = require_clientMetaData.toStoredClientMetaData(clientMetaData);
 		if (storedClientMetaData) recordUpdates.clientMetaData = storedClientMetaData;
 		if (Object.keys(recordUpdates).length > 0) await this.db.updatePowCaptchaRecord(challenge, recordUpdates);
@@ -294,8 +297,10 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 	* @param clientSessionId - the session id the site rendered the widget
 	*   with. When supplied, the solve must carry the same value in its
 	*   `clientMetaData` or it is disapproved.
+	* @param ipValidationRules - the site's rules for comparing `ip` with the
+	*   ip the challenge was issued to.
 	*/
-	async serverVerifyPowCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false, clientSessionId) {
+	async serverVerifyPowCaptchaSolution(dappAccount, challenge, timeout, env, ip, userAccessRulesStorage, email, spamEmailDomainCheckingEnabled = false, spamFilter, trafficFilter, storeMetadata = false, clientSessionId, ipValidationRules) {
 		const notVerified = (reason, sessionId) => ({
 			verified: false,
 			reason,
@@ -310,18 +315,26 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			logger.debug(() => ({ msg: `No record of this challenge: ${challenge}` }));
 			return notVerified("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND");
 		}
-		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoApiError("CAPTCHA.INVALID_SOLUTION", { context: {
-			code: 400,
-			failedFuncName: this.serverVerifyPowCaptchaSolution.name,
-			challenge
-		} });
+		if (challengeRecord.result.status !== _prosopo_types.CaptchaStatus.approved) throw new _prosopo_common.ProsopoError({
+			code: "INVALID_SOLUTION",
+			errorSite: "PROV-73",
+			context: {
+				failedFuncName: this.serverVerifyPowCaptchaSolution.name,
+				challenge
+			}
+		});
 		if (challengeRecord.serverChecked) return notVerified("API.USER_ALREADY_VERIFIED", challengeRecord.sessionId);
 		const challengeDappAccount = challengeRecord.dappAccount;
-		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoEnvError("CAPTCHA.DAPP_USER_SOLUTION_NOT_FOUND", { context: {
-			failedFuncName: this.serverVerifyPowCaptchaSolution.name,
-			dappAccount,
-			challengeDappAccount
-		} });
+		if (dappAccount !== challengeDappAccount) throw new _prosopo_common.ProsopoError({
+			code: "SOLUTION_NOT_FOUND",
+			errorSite: "PROV-74",
+			message: "Dapp user solution not found",
+			context: {
+				failedFuncName: this.serverVerifyPowCaptchaSolution.name,
+				dappAccount,
+				challengeDappAccount
+			}
+		});
 		if (await this.db.markDappUserPoWCommitmentsChecked([challengeRecord.challenge]) === 0) return notVerified("API.USER_ALREADY_VERIFIED", challengeRecord.sessionId);
 		const powRecordUpdates = {};
 		let failResult;
@@ -346,8 +359,16 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			};
 			failReason = "API.CLIENT_SESSION_MISMATCH";
 		}
+		const sessionRecordRead = challengeRecord.sessionId ? this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : Promise.resolve(void 0);
+		const enrichedDnsEventRead = sessionRecordRead.then((sessionRecord) => require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip));
+		const currentIpInfoRead = ip && !failResult ? env.ipInfoService.lookup(ip) : Promise.resolve(void 0);
+		for (const read of [
+			sessionRecordRead,
+			enrichedDnsEventRead,
+			currentIpInfoRead
+		]) read.catch(() => void 0);
 		if (!failResult && userAccessRulesStorage) try {
-			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
+			const blockPolicy = await this.checkForHardBlock(userAccessRulesStorage, challengeRecord, challengeRecord.userAccount, challengeRecord.headers, (await sessionRecordRead)?.decryptedHeadHash, challengeRecord.coords, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.countryCode : void 0, challengeRecord.ipInfo?.isValid ? challengeRecord.ipInfo.asnNumber : void 0);
 			if (blockPolicy) {
 				logger.info(() => ({
 					msg: "User blocked by access policy in server PoW verification",
@@ -429,10 +450,10 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 				}));
 			}
 		}
-		const sessionRecord = challengeRecord.sessionId ? await this.getSessionRecordWithOriginFallback(challengeRecord.sessionId) : void 0;
-		const enrichedDnsEvent = await require_enrichDnsEvent.enrichDnsEvent(sessionRecord?.dnsEvent, env.ipInfoService, ip ?? challengeRecord.ipInfo?.ip);
+		const sessionRecord = await sessionRecordRead;
+		const enrichedDnsEvent = await enrichedDnsEventRead;
 		if (!failResult) {
-			const check = await this.resolveTrafficFilterCheck(env, challengeRecord.ipInfo, trafficFilter, ip, enrichedDnsEvent);
+			const check = await this.resolveTrafficFilterCheck(challengeRecord.ipInfo, trafficFilter, await currentIpInfoRead, enrichedDnsEvent);
 			if (check.isBlocked) {
 				logger.info(() => ({
 					msg: "Traffic filter rejected request in PoW verification",
@@ -459,7 +480,6 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 		};
 		if (!failResult && ip) {
 			const challengeIpAddress = require_compositeIpAddress.getIpAddressFromComposite(challengeRecord.ipAddress);
-			const ipValidationRules = (await this.db.getClientRecord(dappAccount))?.settings?.ipValidationRules;
 			powRecordUpdates.providedIp = require_compositeIpAddress.getCompositeIpAddress(ip);
 			if (ipValidationRules?.enabled === true) {
 				const ipValidation = await require_util.deepValidateIpAddress(ip, challengeIpAddress, logger, env.ipInfoService, ipValidationRules, enrichedDnsEvent?.peerIp);
@@ -569,7 +589,12 @@ var PowCaptchaManager = class extends require_captchaManager.CaptchaManager {
 			...(0, _prosopo_types.isBlockingCaptchaResult)(_prosopo_types.CaptchaType.pow, finalResult) && { blocked: true },
 			...matchedRule && { matchedRule }
 		}, true));
-		if (writePromises.length > 0) await Promise.all(writePromises);
+		await verifyOutcomeWrites.add(Promise.all(writePromises), (err) => {
+			logger.error(() => ({
+				msg: "Failed to record the outcome of a PoW verification",
+				err
+			}));
+		});
 		if (failReason) return notVerified(failReason, challengeRecord.sessionId);
 		return {
 			verified: true,

package/dist/cjs/tasks/powCaptcha/powTasksUtils.cjs

@@ -1,19 +1,23 @@
+const require_signatureCheck = require("../signatureCheck.cjs");
 let _prosopo_common = require("@prosopo/common");
-let _polkadot_util = require("@polkadot/util");
 let _prosopo_util = require("@prosopo/util");
-let _prosopo_util_crypto = require("@prosopo/util-crypto");
 let _noble_hashes_sha2_js = require("@noble/hashes/sha2.js");
 //#region src/tasks/powCaptcha/powTasksUtils.ts
 var validateSolution = (nonce, challenge, difficulty) => (0, _prosopo_util.hashMeetsDifficulty)((0, _noble_hashes_sha2_js.sha256)(new TextEncoder().encode(nonce + challenge)), difficulty);
 var checkPowSignature = (message, signature, address, signatureType) => {
-	if (!(0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(message), signature, address).isValid) throw new _prosopo_common.ProsopoApiError("GENERAL.INVALID_SIGNATURE", { context: {
-		ERROR: `Signature is invalid for this message: ${signatureType}`,
-		failedFuncName: checkPowSignature.name,
-		address,
-		message,
-		signature,
-		signatureType
-	} });
+	if (!require_signatureCheck.isSignatureValid(message, signature, address)) throw new _prosopo_common.ProsopoError({
+		code: "UNAUTHORIZED",
+		errorSite: "PROV-75",
+		message: "Invalid signature",
+		context: {
+			ERROR: `Signature is invalid for this message: ${signatureType}`,
+			failedFuncName: checkPowSignature.name,
+			address,
+			message,
+			signature,
+			signatureType
+		}
+	});
 };
 var isCoordsAllZero = (coords) => coords !== void 0 && coords.length > 0 && coords.every((group) => group.length > 0 && group.every(([x, y]) => x === 0 && y === 0));
 //#endregion

package/dist/cjs/tasks/puzzle/puzzleRenderer.cjs

@@ -46,13 +46,9 @@ var resolvePuzzleRenderSettings = (...overrides) => {
 var pieceSizeSampler = require_stratifiedSampler.createStratifiedSampler();
 /**
 * Resolve the effective piece scale range from the same layered
-* client-settings / traffic-filter overrides used for render settings, and
-* draw a per-challenge piece size in pixels. Stratified so the distribution
-* is evenly spread across the range even for short bursts of requests.
-* Rounded to an integer because the pixel buffer is allocated as
-* `size * size * 4`.
+* client-settings / traffic-filter overrides used for render settings.
 */
-var resolvePuzzlePieceSize = (...overrides) => {
+var resolvePuzzlePieceScaleRange = (...overrides) => {
 	let min = _prosopo_types.puzzlePieceScaleMinDefault;
 	let max = _prosopo_types.puzzlePieceScaleMaxDefault;
 	for (const override of overrides) {
@@ -61,7 +57,19 @@ var resolvePuzzlePieceSize = (...overrides) => {
 		if (override.pieceScale.max !== void 0) max = override.pieceScale.max;
 	}
 	if (min > max) min = max;
-	const scale = pieceSizeSampler.sample(min, max);
+	return {
+		min,
+		max
+	};
+};
+/**
+* Draw a per-challenge piece size in pixels from a scale range. Stratified so
+* the distribution is evenly spread across the range even for short bursts of
+* requests. Rounded to an integer because the pixel buffer is allocated as
+* `size * size * 4`.
+*/
+var samplePuzzlePieceSize = (range) => {
+	const scale = pieceSizeSampler.sample(range.min, range.max);
 	return Math.max(1, Math.round(_prosopo_puzzle_assets.DEFAULT_GEOMETRY.width * scale));
 };
 /**
@@ -94,5 +102,6 @@ var renderPuzzleImages = async (placement, settings = _prosopo_puzzle_assets.DEF
 //#endregion
 exports.isPuzzleRenderAvailable = isPuzzleRenderAvailable;
 exports.renderPuzzleImages = renderPuzzleImages;
-exports.resolvePuzzlePieceSize = resolvePuzzlePieceSize;
+exports.resolvePuzzlePieceScaleRange = resolvePuzzlePieceScaleRange;
 exports.resolvePuzzleRenderSettings = resolvePuzzleRenderSettings;
+exports.samplePuzzlePieceSize = samplePuzzlePieceSize;

package/dist/cjs/tasks/signatureCheck.cjs

@@ -0,0 +1,12 @@
+let _polkadot_util = require("@polkadot/util");
+let _prosopo_util_crypto = require("@prosopo/util-crypto");
+//#region src/tasks/signatureCheck.ts
+var isSignatureValid = (message, signature, address) => {
+	try {
+		return (0, _prosopo_util_crypto.signatureVerify)((0, _polkadot_util.stringToHex)(message), signature, address).isValid;
+	} catch {
+		return false;
+	}
+};
+//#endregion
+exports.isSignatureValid = isSignatureValid;

package/dist/cjs/tasks/tasks.cjs

@@ -23,7 +23,12 @@ var Tasks = class {
 		this.db = env.getDb();
 		this.captchaConfig = env.config.captchas;
 		this.logger = logger || (0, _prosopo_logger.getLogger)((0, _prosopo_logger.parseLogLevel)(env.config.logLevel), "Tasks");
-		if (!env.pair) throw new _prosopo_common.ProsopoEnvError("DEVELOPER.MISSING_PROVIDER_PAIR", { context: { failedFuncName: "Tasks.constructor" } });
+		if (!env.pair) throw new _prosopo_common.ProsopoError({
+			code: "CONFIG_INVALID",
+			errorSite: "PROV-76",
+			message: "Missing provider pair",
+			context: { failedFuncName: "Tasks.constructor" }
+		});
 		this.pair = env.pair;
 		if (this.config.mongoCaptchaUri && this.db instanceof _prosopo_database.ProviderDatabase && !this.db.hasCentralDbStreamer()) {
 			const streamer = new _prosopo_database.CentralDbStreamer(this.config.mongoCaptchaUri, this.logger);

package/dist/cjs/util/usageCounters.cjs

@@ -152,10 +152,15 @@ var UsageCounters = class {
 	}
 };
 /**
-* Helper: produce the standard 24-counter served/solved write set for a given
-* captcha challenge. Used by both served (post-session) and solved hooks.
+* Helper: produce the standard served/solved write set for a given captcha
+* challenge. Used by both served (post-session) and solved hooks.
+*
+* `deviceBucket` is only written when the caller knows one, which for now is
+* the PoW solve path with a verified proof of fingerprint. Omitting it leaves
+* the key absent rather than at zero, so a bucket's count is over the requests
+* that actually proved it.
 */
-var buildAllWindowIncrements = (kind, captchaType, ip, userAccount, peerIp) => {
+var buildAllWindowIncrements = (kind, captchaType, ip, userAccount, peerIp, deviceBucket) => {
 	const out = [];
 	for (const window of [
 		"1m",
@@ -191,6 +196,15 @@ var buildAllWindowIncrements = (kind, captchaType, ip, userAccount, peerIp) => {
 			},
 			value: peerIp
 		});
+		if (deviceBucket) out.push({
+			spec: {
+				kind,
+				captchaType,
+				dimension: "deviceBucket",
+				window
+			},
+			value: deviceBucket
+		});
 		if (captchaType !== "any") {
 			out.push({
 				spec: {
@@ -218,6 +232,15 @@ var buildAllWindowIncrements = (kind, captchaType, ip, userAccount, peerIp) => {
 				},
 				value: peerIp
 			});
+			if (deviceBucket) out.push({
+				spec: {
+					kind,
+					captchaType: "any",
+					dimension: "deviceBucket",
+					window
+				},
+				value: deviceBucket
+			});
 		}
 	}
 	return out;