@prosopo/provider 5.19.4 → 5.20.1

package/dist/cjs/api/domainMiddleware.cjs

@@ -20,11 +20,11 @@ var domainMiddleware = (env) => {
 			if (!cachedTasks) cachedTasks = new require_tasks.Tasks(env);
 			const tasks = cachedTasks;
 			const siteKey = req.headers["prosopo-site-key"];
-			if (!siteKey) throw siteKeyNotRegisteredError(req.i18n, "No sitekey provided", req.logger);
+			if (!siteKey) throw siteKeyNotRegisteredError("No sitekey provided");
 			try {
 				(0, _prosopo_util_crypto.validateAddress)(siteKey, false, 42);
 			} catch (err) {
-				throw invalidSiteKeyError(req.i18n, siteKey, req.logger);
+				throw invalidSiteKeyError(siteKey);
 			}
 			if (require_testSiteKey.isReservedTestSiteKey(siteKey)) {
 				require_metrics.recordDomainValidation("test_key");
@@ -32,32 +32,34 @@ var domainMiddleware = (env) => {
 				return;
 			}
 			const clientSettings = await tasks.db.getClientRecord(siteKey);
-			if (!clientSettings) throw siteKeyNotRegisteredError(req.i18n, siteKey, req.logger);
+			if (!clientSettings) throw siteKeyNotRegisteredError(siteKey);
 			const allowedDomains = clientSettings.settings?.domains;
-			if (!allowedDomains) throw siteKeyInvalidDomainError(req.i18n, siteKey, req.hostname, req.logger);
+			if (!allowedDomains) throw siteKeyInvalidDomainError(siteKey, req.hostname);
 			const origin = req.headers.origin;
-			if (!origin) throw unauthorizedOriginError(req.i18n, void 0, req.logger);
+			if (!origin) throw unauthorizedOriginError(void 0);
 			const candidateOrigins = [origin, ...googleTranslateOrigins(origin)];
 			for (const candidate of candidateOrigins) for (const domain of allowedDomains) if (tasks.clientTaskManager.domainPatternMatcher(candidate, domain)) {
 				require_metrics.recordDomainValidation("allowed");
 				next();
 				return;
 			}
-			throw unauthorizedOriginError(req.i18n, origin, req.logger);
+			throw unauthorizedOriginError(origin);
 		} catch (err) {
 			require_metrics.recordDomainValidation("rejected");
-			if (err instanceof _prosopo_common.ProsopoApiError || err instanceof zod.ZodError || err instanceof SyntaxError) (0, _prosopo_api_express_router.handleErrors)(err, req, res, next);
-			else {
-				req.logger.error(() => ({
-					err,
-					msg: "Domain middleware error"
-				}));
-				res.status(401).json({
-					error: "Unauthorized",
-					message: "Unauthorized"
-				});
+			if ((0, _prosopo_common.isProsopoError)(err) || err instanceof zod.ZodError || err instanceof SyntaxError) {
+				(0, _prosopo_api_express_router.handleErrors)(err, req, res, next);
 				return;
 			}
+			req.logger.error(() => ({
+				err,
+				msg: "Domain middleware error"
+			}));
+			const error = new _prosopo_common.ProsopoError({
+				code: "UNAUTHORIZED",
+				errorSite: "PROV-85",
+				cause: err
+			});
+			res.status(error.status).json({ error: (0, _prosopo_common.toPublicError)(error, "BACKEND_ERROR") });
 		}
 	};
 };
@@ -71,46 +73,36 @@ var googleTranslateOrigins = (origin) => {
 		return [];
 	}
 };
-var siteKeyNotRegisteredError = (i18n, dapp, logger) => {
-	return new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-		context: {
-			code: 400,
-			siteKey: dapp
-		},
-		i18n,
-		logger
+var siteKeyNotRegisteredError = (dapp) => {
+	return new _prosopo_common.ProsopoError({
+		code: "SITE_KEY_NOT_REGISTERED",
+		errorSite: "PROV-30",
+		context: { siteKey: dapp }
 	});
 };
-var invalidSiteKeyError = (i18n, siteKey, logger) => {
-	return new _prosopo_common.ProsopoApiError("API.INVALID_SITE_KEY", {
-		context: {
-			code: 400,
-			siteKey
-		},
-		i18n,
-		logger
+var invalidSiteKeyError = (siteKey) => {
+	return new _prosopo_common.ProsopoError({
+		code: "SITE_KEY_INVALID",
+		errorSite: "PROV-31",
+		context: { siteKey }
 	});
 };
-var unauthorizedOriginError = (i18n, origin, logger) => {
-	return new _prosopo_common.ProsopoApiError("API.UNAUTHORIZED_ORIGIN_URL", {
-		context: {
-			code: 400,
-			origin
-		},
-		i18n,
-		logger
+var unauthorizedOriginError = (origin) => {
+	return new _prosopo_common.ProsopoError({
+		code: "ORIGIN_NOT_ALLOWED",
+		errorSite: "PROV-32",
+		context: { origin }
 	});
 };
-var siteKeyInvalidDomainError = (i18n, dapp, domain, logger) => {
-	return new _prosopo_common.ProsopoApiError("API.UNAUTHORIZED_ORIGIN_URL", {
+var siteKeyInvalidDomainError = (dapp, domain) => {
+	return new _prosopo_common.ProsopoError({
+		code: "ORIGIN_NOT_ALLOWED",
+		errorSite: "PROV-33",
 		context: {
-			code: 400,
 			message: "No domains are allowed for this site key. Please fix in the Procaptcha Portal",
 			siteKey: dapp,
 			domain
-		},
-		i18n,
-		logger
+		}
 	});
 };
 //#endregion

package/dist/cjs/api/errorCodeForReason.cjs

@@ -0,0 +1,22 @@
+let _prosopo_common = require("@prosopo/common");
+//#region src/api/errorCodeForReason.ts
+var RENAMED = {
+	"API.INVALID_SITE_KEY": "SITE_KEY_INVALID",
+	"API.UNAUTHORIZED_ORIGIN_URL": "ORIGIN_NOT_ALLOWED",
+	"API.BAD_REQUEST": "INVALID_REQUEST"
+};
+/**
+* A request validation outcome (a `ResultReason` or other translation key) as
+* the error code the widget branches on: the key without its namespace, e.g.
+* `API.VPN_BLOCKED` is `VPN_BLOCKED`. An outcome with no code of its own gets
+* `fallback`.
+*/
+var errorCodeForReason = (reason, fallback = "INVALID_REQUEST") => {
+	if (reason === void 0) return fallback;
+	const renamed = RENAMED[reason];
+	if (renamed) return renamed;
+	const unprefixed = reason.slice(reason.indexOf(".") + 1);
+	return (0, _prosopo_common.isErrorCode)(unprefixed) ? unprefixed : fallback;
+};
+//#endregion
+exports.errorCodeForReason = errorCodeForReason;

package/dist/cjs/api/headerCheckMiddleware.cjs

@@ -1,4 +1,5 @@
 const require_validateAddress = require("./validateAddress.cjs");
+let _prosopo_common = require("@prosopo/common");
 let _prosopo_api_express_router = require("@prosopo/api-express-router");
 //#region src/api/headerCheckMiddleware.ts
 var headerCheckMiddleware = (env) => {
@@ -7,15 +8,23 @@ var headerCheckMiddleware = (env) => {
 			const user = req.headers["prosopo-user"];
 			const siteKey = req.headers["prosopo-site-key"];
 			if (!user) {
-				unauthorised(res);
+				(0, _prosopo_api_express_router.sendProsopoError)(res, new _prosopo_common.ProsopoError({
+					code: "UNAUTHORIZED",
+					errorSite: "PROV-86",
+					message: "Missing prosopo-user header"
+				}));
 				return;
 			}
 			if (!siteKey) {
-				unauthorised(res);
+				(0, _prosopo_api_express_router.sendProsopoError)(res, new _prosopo_common.ProsopoError({
+					code: "UNAUTHORIZED",
+					errorSite: "PROV-87",
+					message: "Missing prosopo-site-key header"
+				}));
 				return;
 			}
-			require_validateAddress.validateSiteKey(siteKey, req.logger);
-			require_validateAddress.validateAddr(user, void 0, req.logger);
+			require_validateAddress.validateSiteKey(siteKey);
+			require_validateAddress.validateAddr(user);
 			req.user = user;
 			req.siteKey = siteKey;
 			req.logger = req.logger.with({
@@ -28,9 +37,5 @@ var headerCheckMiddleware = (env) => {
 		}
 	};
 };
-var unauthorised = (res) => res.status(401).json({
-	error: "Unauthorized",
-	message: "Unauthorized"
-});
 //#endregion
 exports.headerCheckMiddleware = headerCheckMiddleware;

package/dist/cjs/api/ipInfoMiddleware.cjs

@@ -1,6 +1,10 @@
 //#region src/api/ipInfoMiddleware.ts
-var ipInfoMiddleware = (env) => {
+var ipInfoMiddleware = (env, skipPaths = /* @__PURE__ */ new Set()) => {
 	return async (req, _res, next) => {
+		if (skipPaths.has(req.path)) {
+			next();
+			return;
+		}
 		try {
 			const ip = req.ip;
 			if (ip && env.ipInfoService.isAvailable()) req.ipInfo = await env.ipInfoService.lookup(ip);

package/dist/cjs/api/metrics.cjs

@@ -1,4 +1,6 @@
+let _prosopo_common = require("@prosopo/common");
 let _prosopo_types = require("@prosopo/types");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
 let node_crypto = require("node:crypto");
 let node_net = require("node:net");
 let prom_client = require("prom-client");
@@ -386,7 +388,13 @@ var metricsHandler = (env) => {
 	return async (req, res) => {
 		const access = metricsAccess(req);
 		if (access !== 200) {
-			res.status(access).send(access === 401 ? "Unauthorized" : "Forbidden");
+			(0, _prosopo_api_express_router.sendProsopoError)(res, access === 401 ? new _prosopo_common.ProsopoError({
+				code: "UNAUTHORIZED",
+				errorSite: "PROV-91"
+			}) : new _prosopo_common.ProsopoError({
+				code: "FORBIDDEN",
+				errorSite: "PROV-92"
+			}));
 			return;
 		}
 		const m = getMetrics();

package/dist/cjs/api/public.cjs

@@ -62,7 +62,11 @@ function publicRouter(env) {
 				data: { reqParams: req.params },
 				msg: "Error getting provider details"
 			}));
-			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", { context: { code: 500 } }));
+			return next(new _prosopo_common.ProsopoError({
+				code: "UNEXPECTED",
+				errorSite: "PROV-34",
+				message: "BadRequest"
+			}));
 		}
 	});
 	router.use(require_assetDocument.assetDocumentRouter());

package/dist/cjs/api/rateLimitHandler.cjs

@@ -0,0 +1,20 @@
+let _prosopo_common = require("@prosopo/common");
+let _prosopo_api_express_router = require("@prosopo/api-express-router");
+//#region src/api/rateLimitHandler.ts
+var rateLimitHandler = (logger, path) => (req, res, _next, options) => {
+	logger.warn(() => ({
+		msg: "Rate limit exceeded",
+		data: {
+			path,
+			ip: req.ip,
+			siteKey: req.headers["prosopo-site-key"]
+		}
+	}));
+	(0, _prosopo_api_express_router.sendProsopoError)(res, new _prosopo_common.ProsopoError({
+		code: "RATE_LIMITED",
+		errorSite: "PROV-93",
+		status: options.statusCode
+	}));
+};
+//#endregion
+exports.rateLimitHandler = rateLimitHandler;

package/dist/cjs/api/startProviderApi.cjs

@@ -17,11 +17,11 @@ const require_detectorPoolBodyParser = require("./detectorPoolBodyParser.cjs");
 const require_headerCheckMiddleware = require("./headerCheckMiddleware.cjs");
 const require_ignoreMiddleware = require("./ignoreMiddleware.cjs");
 const require_ipInfoMiddleware = require("./ipInfoMiddleware.cjs");
+const require_rateLimitHandler = require("./rateLimitHandler.cjs");
 const require_robotsMiddleware = require("./robotsMiddleware.cjs");
 let _prosopo_logger = require("@prosopo/logger");
 let _prosopo_types = require("@prosopo/types");
 let _prosopo_api_express_router = require("@prosopo/api-express-router");
-let _prosopo_locale = require("@prosopo/locale");
 let node_fs = require("node:fs");
 node_fs = require_runtime.__toESM(node_fs, 1);
 let node_path = require("node:path");
@@ -30,6 +30,7 @@ let node_https = require("node:https");
 node_https = require_runtime.__toESM(node_https, 1);
 let express = require("express");
 express = require_runtime.__toESM(express, 1);
+let _prosopo_locale = require("@prosopo/locale");
 let node_url = require("node:url");
 let _prosopo_user_access_policy_api = require("@prosopo/user-access-policy/api");
 let cors = require("cors");
@@ -73,6 +74,7 @@ var providerCorsOptions = {
 var isTlsAvailable = () => {
 	return node_fs.default.existsSync(keyPath) && node_fs.default.existsSync(crtPath);
 };
+var getServerVerifyPaths = () => Object.values(_prosopo_types.ClientApiPaths).filter((path) => path.endsWith("/verify"));
 /**
 * Get client API paths that expect Prosopo headers (like site key) for validation, excluding verify and spam routes
 * @returns Array of ClientApiPaths excluding verify and spam routes
@@ -181,36 +183,25 @@ async function startProviderApi(env, admin = false, port) {
 			...(0, _prosopo_user_access_policy_api.getExpressApiRuleRateLimits)()
 		};
 		const adminPaths = Object.values(_prosopo_types.AdminApiPaths);
-		const rateLimitHandler = (path) => (req, res, _next, options) => {
-			env.logger.warn(() => ({
-				msg: "Rate limit exceeded",
-				data: {
-					path,
-					ip: req.ip,
-					siteKey: req.headers["prosopo-site-key"]
-				}
-			}));
-			res.status(options.statusCode).send(options.message);
-		};
 		for (const [path, limit] of Object.entries(rateLimits)) {
 			const enumPath = path;
 			if (adminPaths.includes(enumPath)) apiApp.use(enumPath, (0, express_rate_limit.default)({
 				...limit,
-				handler: rateLimitHandler(enumPath),
+				handler: require_rateLimitHandler.rateLimitHandler(env.logger, enumPath),
 				keyGenerator: (req) => {
 					return getUserFromJWT(req) || req.ip || "unknown";
 				}
 			}));
 			else if (path === _prosopo_types.ClientApiPaths.VerifyImageCaptchaSolutionDapp || path === _prosopo_types.ClientApiPaths.VerifyPowCaptchaSolution) apiApp.use(enumPath, (0, express_rate_limit.default)({
 				...limit,
-				handler: rateLimitHandler(enumPath),
+				handler: require_rateLimitHandler.rateLimitHandler(env.logger, enumPath),
 				keyGenerator: (req) => {
 					return req.headers["prosopo-site-key"] || req.ip || "unknown";
 				}
 			}));
 			else apiApp.use(enumPath, (0, express_rate_limit.default)({
 				...limit,
-				handler: rateLimitHandler(enumPath)
+				handler: require_rateLimitHandler.rateLimitHandler(env.logger, enumPath)
 			}));
 		}
 	}
@@ -222,7 +213,7 @@ async function startProviderApi(env, admin = false, port) {
 	apiApp.use(require_ja4Middleware.ja4Middleware(env));
 	apiApp.use(require_handshakeTimingMiddleware.handshakeTimingMiddleware(env));
 	apiApp.use(require_rawTlsSignalsMiddleware.rawTlsSignalsMiddleware(env));
-	apiApp.use(require_ipInfoMiddleware.ipInfoMiddleware(env));
+	apiApp.use(require_ipInfoMiddleware.ipInfoMiddleware(env, new Set(getServerVerifyPaths())));
 	apiApp.use(clientPathsExcludingVerify, require_headerCheckMiddleware.headerCheckMiddleware(env));
 	apiApp.use(require_verify.prosopoVerifyRouter(env));
 	env.logger.info(() => ({ msg: "Enabling admin auth middleware" }));
@@ -270,6 +261,7 @@ async function startProviderApi(env, admin = false, port) {
 }
 //#endregion
 exports.getClientApiPathsExpectingProsopoHeaders = getClientApiPathsExpectingProsopoHeaders;
+exports.getServerVerifyPaths = getServerVerifyPaths;
 exports.getUserFromJWT = getUserFromJWT;
 exports.isTlsAvailable = isTlsAvailable;
 exports.providerCorsOptions = providerCorsOptions;

package/dist/cjs/api/validateAddress.cjs

@@ -1,27 +1,21 @@
 let _prosopo_common = require("@prosopo/common");
 let _prosopo_util_crypto = require("@prosopo/util-crypto");
 //#region src/api/validateAddress.ts
-var validateSiteKey = (siteKey, logger) => {
-	return validateAddr(siteKey, "API.INVALID_SITE_KEY", logger);
-};
-var validateAddr = (address, translationKey = "CONTRACT.INVALID_ADDRESS", logger) => {
+var validateSiteKey = (siteKey) => validateAddr(siteKey, "SITE_KEY_INVALID");
+var validateAddr = (address, code = "INVALID_REQUEST") => {
+	let valid = false;
+	let cause;
 	try {
-		if (!(0, _prosopo_util_crypto.validateAddress)(address, false, 42)) throw new _prosopo_common.ProsopoApiError(translationKey, {
-			context: {
-				code: 400,
-				siteKey: address
-			},
-			logger
-		});
+		valid = (0, _prosopo_util_crypto.validateAddress)(address, false, 42);
 	} catch (err) {
-		throw new _prosopo_common.ProsopoApiError(translationKey, {
-			context: {
-				code: 400,
-				siteKey: address
-			},
-			logger
-		});
+		cause = err;
 	}
+	if (!valid) throw new _prosopo_common.ProsopoError({
+		code,
+		errorSite: "PROV-35",
+		cause,
+		context: { siteKey: address }
+	});
 };
 //#endregion
 exports.validateAddr = validateAddr;

package/dist/cjs/api/verify.cjs

@@ -36,13 +36,11 @@ var decodeTokenOr400 = (token, i18n, logger, next) => {
 	try {
 		return (0, _prosopo_types.decodeProcaptchaOutput)(token);
 	} catch (error) {
-		next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-			context: {
-				code: 400,
-				error
-			},
-			i18n,
-			logger
+		next(new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-37",
+			message: "Error parsing captcha",
+			cause: error
 		}));
 		return null;
 	}
@@ -52,13 +50,12 @@ var dappSignatureError = (signature, message, pair, req) => {
 		(0, _prosopo_api_express_router.verifySignature)(signature, message, pair);
 		return;
 	} catch {
-		return new _prosopo_common.ProsopoApiError("GENERAL.INVALID_SIGNATURE", {
-			context: {
-				code: 400,
-				siteKey: pair.address
-			},
-			i18n: req.i18n,
-			logger: req.logger
+		return new _prosopo_common.ProsopoError({
+			code: "UNAUTHORIZED",
+			errorSite: "PROV-38",
+			message: "Invalid signature",
+			status: 400,
+			context: { siteKey: pair.address }
 		});
 	}
 };
@@ -77,14 +74,12 @@ var interactiveVerifyHandler = ({ env, userAccessRulesStorage, path, label, hand
 	try {
 		parsed = _prosopo_types.ServerPuzzleCaptchaVerifyRequestBody.parse(req.body);
 	} catch (err) {
-		return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-			context: {
-				code: 400,
-				error: err,
-				body: require_requestBodySummary.summariseRequestBody(req)
-			},
-			i18n: req.i18n,
-			logger: req.logger
+		return next(new _prosopo_common.ProsopoError({
+			code: "INVALID_REQUEST",
+			errorSite: "PROV-39",
+			message: "Error parsing captcha",
+			cause: err,
+			context: { body: require_requestBodySummary.summariseRequestBody(req) }
 		}));
 	}
 	try {
@@ -115,13 +110,10 @@ var interactiveVerifyHandler = ({ env, userAccessRulesStorage, path, label, hand
 		(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
 		(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
 		const clientRecord = await tasks.db.getClientRecord(dapp);
-		if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-			context: {
-				code: 400,
-				siteKey: dapp
-			},
-			i18n: req.i18n,
-			logger: req.logger
+		if (!clientRecord) return next(new _prosopo_common.ProsopoError({
+			code: "SITE_KEY_NOT_REGISTERED",
+			errorSite: "PROV-40",
+			context: { siteKey: dapp }
 		}));
 		if (!challenge) {
 			const unverifiedResponse = {
@@ -151,13 +143,11 @@ var interactiveVerifyHandler = ({ env, userAccessRulesStorage, path, label, hand
 			err,
 			data: { body: require_requestBodySummary.summariseRequestBody(req) }
 		}));
-		return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-			context: {
-				code: 500,
-				error: err
-			},
-			i18n: req.i18n,
-			logger: req.logger
+		return next(new _prosopo_common.ProsopoError({
+			code: "UNEXPECTED",
+			errorSite: "PROV-41",
+			message: "BadRequest",
+			cause: err
 		}));
 	}
 };
@@ -217,14 +207,12 @@ function prosopoVerifyRouter(env) {
 		try {
 			parsed = _prosopo_types.VerifySolutionBody.parse(req.body);
 		} catch (err) {
-			return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-				context: {
-					code: 400,
-					error: err,
-					body: require_requestBodySummary.summariseRequestBody(req)
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			return next(new _prosopo_common.ProsopoError({
+				code: "INVALID_REQUEST",
+				errorSite: "PROV-42",
+				message: "Error parsing captcha",
+				cause: err,
+				context: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 		}
 		const { dappSignature, token, ip, maxVerifiedTime, email, clientSessionId } = parsed;
@@ -255,14 +243,13 @@ function prosopoVerifyRouter(env) {
 			(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
 			(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
 			const clientRecord = await tasks.db.getClientRecord(dapp);
-			if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			if (!clientRecord) return next(new _prosopo_common.ProsopoError({
+				code: "SITE_KEY_NOT_REGISTERED",
+				errorSite: "PROV-43",
 				context: {
-					code: 400,
 					siteKey: dapp,
 					user
-				},
-				i18n: req.i18n,
-				logger: req.logger
+				}
 			}));
 			const keyPair = env.keyring.addFromAddress(dapp);
 			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), keyPair, req);
@@ -285,14 +272,14 @@ function prosopoVerifyRouter(env) {
 				msg: "Error in verifyImageCaptchaSolution",
 				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
-			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			return next(new _prosopo_common.ProsopoError({
+				code: "UNEXPECTED",
+				errorSite: "PROV-44",
+				message: "BadRequest",
 				context: {
-					code: 500,
 					siteKey: req.body.dapp,
 					user: req.body.user
-				},
-				i18n: req.i18n,
-				logger: req.logger
+				}
 			}));
 		}
 	});
@@ -313,14 +300,12 @@ function prosopoVerifyRouter(env) {
 		try {
 			parsed = _prosopo_types.ServerPowCaptchaVerifyRequestBody.parse(req.body);
 		} catch (err) {
-			return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-				context: {
-					code: 400,
-					error: err,
-					body: require_requestBodySummary.summariseRequestBody(req)
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			return next(new _prosopo_common.ProsopoError({
+				code: "INVALID_REQUEST",
+				errorSite: "PROV-45",
+				message: "Error parsing captcha",
+				cause: err,
+				context: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 		}
 		try {
@@ -351,13 +336,10 @@ function prosopoVerifyRouter(env) {
 			(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
 			(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
 			const clientRecord = await tasks.db.getClientRecord(dapp);
-			if (!clientRecord) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
-				context: {
-					code: 400,
-					siteKey: dapp
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			if (!clientRecord) return next(new _prosopo_common.ProsopoError({
+				code: "SITE_KEY_NOT_REGISTERED",
+				errorSite: "PROV-46",
+				context: { siteKey: dapp }
 			}));
 			if (!challenge) {
 				const unverifiedResponse = {
@@ -377,7 +359,7 @@ function prosopoVerifyRouter(env) {
 				const maintenanceResponse = require_maintenanceModeResponses.buildMaintenanceVerificationResponse(req.i18n.t);
 				return res.json(maintenanceResponse);
 			}
-			const { verified, score, reason, sessionId } = await tasks.powCaptchaManager.serverVerifyPowCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId);
+			const { verified, score, reason, sessionId } = await tasks.powCaptchaManager.serverVerifyPowCaptchaSolution(dapp, challenge, clientRecord.settings.verifiedTimeout, env, ip, userAccessRulesStorage, email, clientRecord.settings.spamEmailDomainCheckEnabled, clientRecord.settings.spamFilter, clientRecord.settings.trafficFilter, clientRecord.settings.storeMetadata, clientSessionId, clientRecord.settings.ipValidationRules);
 			const verificationResponse = tasks.powCaptchaManager.getVerificationResponse(verified, clientRecord, req.i18n.t, score, reason, sessionId);
 			return res.json(verificationResponse);
 		} catch (err) {
@@ -386,13 +368,11 @@ function prosopoVerifyRouter(env) {
 				err,
 				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
-			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
-				context: {
-					code: 500,
-					error: err
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			return next(new _prosopo_common.ProsopoError({
+				code: "UNEXPECTED",
+				errorSite: "PROV-47",
+				message: "BadRequest",
+				cause: err
 			}));
 		}
 	});
@@ -437,14 +417,12 @@ function prosopoVerifyRouter(env) {
 		try {
 			parsed = _prosopo_types.VerifySolutionBody.parse(req.body);
 		} catch (err) {
-			return next(new _prosopo_common.ProsopoApiError("CAPTCHA.PARSE_ERROR", {
-				context: {
-					code: 400,
-					error: err,
-					body: require_requestBodySummary.summariseRequestBody(req)
-				},
-				i18n: req.i18n,
-				logger: req.logger
+			return next(new _prosopo_common.ProsopoError({
+				code: "INVALID_REQUEST",
+				errorSite: "PROV-48",
+				message: "Error parsing captcha",
+				cause: err,
+				context: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
 		}
 		const { dappSignature, token, ip, clientSessionId } = parsed;
@@ -471,14 +449,13 @@ function prosopoVerifyRouter(env) {
 			const tasks = new require_tasks.Tasks(env, req.logger);
 			(0, _prosopo_util_crypto.validateAddress)(dapp, false, 42);
 			(0, _prosopo_util_crypto.validateAddress)(user, false, 42);
-			if (!await tasks.db.getClientRecord(dapp)) return next(new _prosopo_common.ProsopoApiError("API.SITE_KEY_NOT_REGISTERED", {
+			if (!await tasks.db.getClientRecord(dapp)) return next(new _prosopo_common.ProsopoError({
+				code: "SITE_KEY_NOT_REGISTERED",
+				errorSite: "PROV-49",
 				context: {
-					code: 400,
 					siteKey: dapp,
 					user
-				},
-				i18n: req.i18n,
-				logger: req.logger
+				}
 			}));
 			const keyPair = env.keyring.addFromAddress(dapp);
 			const signatureError = dappSignatureError(dappSignature, timestamp.toString(), keyPair, req);
@@ -503,14 +480,14 @@ function prosopoVerifyRouter(env) {
 				msg: "Error in verifyAuthenticatedSession",
 				data: { body: require_requestBodySummary.summariseRequestBody(req) }
 			}));
-			return next(new _prosopo_common.ProsopoApiError("API.BAD_REQUEST", {
+			return next(new _prosopo_common.ProsopoError({
+				code: "UNEXPECTED",
+				errorSite: "PROV-50",
+				message: "BadRequest",
 				context: {
-					code: 500,
 					siteKey: req.body.dapp,
 					user: req.body.user
-				},
-				i18n: req.i18n,
-				logger: req.logger
+				}
 			}));
 		}
 	});