@webdecoy/fcaptcha 1.28.0 → 1.28.2

package/index.js

@@ -246,6 +246,7 @@ class ScoringEngine {
   // Verify signals and return score
   verify(signals, ip, siteKey, userAgent, headers = {}, powSolution = null) {
     const detections = [];
+    let powSatisfied = false;
 
     // Run all detection modules
     detections.push(...this._detectVisionAI(signals));
@@ -272,6 +273,7 @@ class ScoringEngine {
           reason: `PoW verification failed: ${powResult.reason}`
         });
       } else if (powResult.serverElapsed < BASE_MIN_AGE_MS) {
+        powSatisfied = true;
         // Under the universal baseline nothing legitimate can have happened —
         // no human completes an interaction that fast.
         detections.push({
@@ -281,6 +283,7 @@ class ScoringEngine {
           reason: `Challenge solved too fast (${powResult.serverElapsed}ms server-side)`
         });
       } else if (powResult.serverElapsed < powResult.minAgeMs) {
+        powSatisfied = true;
         // Between the baseline and this source's own elevated floor is weaker
         // evidence: a client predating adaptive cost, or one served from a
         // stale cache, does not know to wait. It contributes rather than
@@ -291,6 +294,8 @@ class ScoringEngine {
           confidence: 0.5,
           reason: `Challenge submitted before the required delay for this source (${powResult.serverElapsed}ms of ${powResult.minAgeMs}ms)`
         });
+      } else {
+        powSatisfied = true;
       }
     } else {
       detections.push({
@@ -336,7 +341,12 @@ class ScoringEngine {
     else if (finalScore < 0.6) recommendation = 'challenge';
     else recommendation = 'block';
 
-    const success = finalScore < 0.5;
+    // PoW is a precondition, not weighted evidence. Expressing a missing or
+    // invalid solution only as a bot-category score lets the category weight
+    // dilute it below the allow threshold and used to mint a token for an empty
+    // request. Keep this gate independent of scoring so weight changes cannot
+    // reopen the bypass.
+    const success = finalScore < 0.5 && powSatisfied;
     const token = success ? this._generateToken(ip, siteKey, finalScore) : null;
 
     // Feed the ledger so the next challenge this source asks for is priced on
@@ -350,7 +360,8 @@ class ScoringEngine {
       timestamp: Math.floor(Date.now() / 1000),
       recommendation,
       categoryScores,
-      detections
+      detections,
+      ...(!powSatisfied ? { reason: 'pow_not_satisfied' } : {})
     };
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fcaptcha",
-  "version": "1.28.0",
+  "version": "1.28.2",
   "description": "Open source CAPTCHA with PoW, bot detection, and Vision AI protection",
   "main": "index.js",
   "exports": {
@@ -15,7 +15,7 @@
     "test:clientip": "node clientip.test.js",
     "test:limits": "node limits.test.js",
     "test:detection": "node detection.test.js",
-    "test": "node clientip.test.js && node limits.test.js && node detection.test.js && node inputforensics.test.js && node webbotauth.test.js && node siteverify.test.js && node --test suspicion.test.js",
+    "test": "node clientip.test.js && node limits.test.js && node detection.test.js && node inputforensics.test.js && node webbotauth.test.js && node siteverify.test.js && node index.test.js && node --test suspicion.test.js",
     "test:siteverify": "node siteverify.test.js",
     "test:forensics": "node inputforensics.test.js",
     "test:suspicion": "node --test suspicion.test.js"

package/server.js

@@ -1425,11 +1425,13 @@ function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash
         category: 'bot',
         score: 0.7,
         confidence: 0.8,
-        reason: `PoW verification failed: ${powVerification.reason}`,
-        // A solution that does not verify against a challenge this server
-        // issued is not weak evidence of automation, it is proof the challenge
-        // was not completed. See DISPOSITIVE_FLOOR.
-        dispositive: true
+        reason: `PoW verification failed: ${powVerification.reason}`
+        // Deliberately NOT dispositive. The gate already withholds the token,
+        // which is the security requirement. Flooring the score as well says
+        // "blatant bot", and a failed proof of work does not mean that: the
+        // challenge expires after five minutes, challenges live only in memory
+        // so every deploy invalidates the outstanding ones, and a double-click
+        // replays a solution. All ordinary things that happen to real people.
       });
     } else {
       powSatisfied = true;
@@ -1447,8 +1449,8 @@ function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash
           category: 'bot',
           score: 0.9,
           confidence: 0.9,
-          reason: 'Challenge nonce mismatch (signals not bound to challenge)',
-          dispositive: true
+          reason: 'Challenge nonce mismatch (signals not bound to challenge)'
+          // Not dispositive — see above; a stale challenge produces this too.
         });
       }
     }
@@ -1480,8 +1482,9 @@ function runVerification(signals, ip, siteKey, userAgent, headers = {}, ja3Hash
       category: 'bot',
       score: 0.9,
       confidence: 0.95,
-      reason: 'No PoW solution provided',
-      dispositive: true
+      reason: 'No PoW solution provided'
+      // Not dispositive — the gate refuses the token; inflating the score on
+      // top only mislabels whoever hit a stale page.
     });
   }