npm - human-verify - Versions diffs - 1.0.0 - Mend

human-verify 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/LICENSE +21 -0
package/README.md +210 -0
package/backend/index.js +1 -0
package/frontend/human-verify.es.js +1 -0
package/frontend/human-verify.umd.js +1 -0
package/package.json +32 -0

package/LICENSE ADDED Viewed

@@ -0,0 +1,21 @@
+MIT License
+Copyright (c) 2026 gamerunwuyazi
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md ADDED Viewed

@@ -0,0 +1,210 @@
+# HumanVerify 人机验证库
+基于行为特征分析的人机验证库，前后端分离架构。
+## 包内容
+```
+human-verify/
+├── frontend/
+│   ├── human-verify.es.js     # 前端 ES 模块（混淆）
+│   └── human-verify.umd.js    # 前端 UMD 模块（混淆）
+├── backend/
+│   └── index.js               # 后端验证库（混淆）
+└── package.json
+```
+## 安装
+```bash
+npm install human-verify
+```
+## 前端使用
+### 组件模式（Vue 3 项目）
+```vue
+<script setup>
+import { HumanVerify } from 'human-verify'
+</script>
+<template>
+  <HumanVerify
+    backend-url="/api"
+    @verified="onVerified"
+    @failed="onFailed"
+  />
+</template>
+```
+### 函数模式
+```ts
+import { humanVerify } from 'human-verify'
+const result = await humanVerify({
+  backendUrl: '/api',
+  onProgress: (progress, status) => {
+    console.log(`${progress}%: ${status}`)
+  }
+})
+if (result.passed) {
+  console.log('验证通过，token:', result.token)
+}
+```
+### 自定义元素模式（纯 HTML）
+```html
+<!-- 需要 Vue 3 全局构建 -->
+<script src="https://unpkg.com/vue@3/dist/vue.global.prod.js"></script>
+<script src="/lib/human-verify.umd.js"></script>
+<human-verify backend-url="/api" onverify-id="my-callback"></human-verify>
+<script>
+  window.HumanVerifyCallbacks.set('my-callback', (result) => {
+    if (result.passed) {
+      console.log('验证通过，得分:', result.score, 'token:', result.token)
+    } else {
+      console.log('验证失败:', result.reason)
+    }
+  })
+</script>
+```
+### 组件属性
+| 属性 | 类型 | 默认值 | 说明 |
+|------|------|--------|------|
+| `backend-url` | `string` | `'/api'` | 后端 API 基础路径 |
+| `timeout` | `number` | `30000` | 超时时间（ms） |
+| `onverify-id` | `string` | — | 回调 ID，通过 `window.HumanVerifyCallbacks.set(id, fn)` 注册 |
+### 组件事件
+| 事件 | detail | 说明 |
+|------|--------|------|
+| `verified` | `{ passed, score, token }` | 验证通过 |
+| `failed` | `{ reason, score }` | 验证失败 |
+| `progress` | `{ progress, status }` | 进度更新 |
+### 返回结果
+```ts
+interface VerifyResult {
+  passed: boolean       // 是否通过
+  score: number         // 行为评分 (0-100)
+  token?: string        // 验证通过后的 token（防重放）
+  reason?: string       // 失败原因
+}
+```
+## 后端使用
+```ts
+import {
+  createSession,
+  verifySession,
+  generatePOWChallenge,
+  verifyPOWSolution,
+  detectAutomation,
+  analyzeBehavior
+} from 'human-verify/backend'
+```
+> 后端库为 ESM 格式，Node.js 18+。
+### 函数列表
+| 函数 | 参数 | 返回值 | 说明 |
+|------|------|--------|------|
+| `createSession()` | 无 | `{ sessionId, publicKey, challenge, expiresAt }` | 创建会话，生成 RSA 密钥对 |
+| `verifySession(sessionId, encryptedData, threshold?)` | sessionId, 加密数据, 分数阈值（默认 50） | `{ success, passed, score, token?, reason? }` | 验证加密数据并评分，验证后销毁会话 |
+| `generatePOWChallenge(sessionId)` | sessionId | `{ success, challenge, difficulty, requiredLeadingBits }` | 根据评分生成 POW 挑战 |
+| `verifyPOWSolution(sessionId, nonce)` | sessionId, nonce | `{ success, passed, token?, score? }` | 验证 POW 结果 |
+| `detectAutomation(fingerprint)` | DeviceFingerprint | `{ isBot, reason }` | 检测自动化工具 |
+| `analyzeBehavior(data, challengeResult)` | 行为数据, 挑战结果 | `{ passed, score, details }` | 分析行为数据 |
+### 示例
+```ts
+import express from 'express'
+import { createSession, verifySession, generatePOWChallenge, verifyPOWSolution } from 'human-verify/backend'
+const app = express()
+app.use(express.json())
+// 1. 创建验证会话
+app.post('/api/verify/challenge', (req, res) => {
+  const session = createSession()
+  res.json(session)
+})
+// 2. 行为验证 + POW 挑战
+app.post('/api/verify/pow-challenge', (req, res) => {
+  const { sessionId, encryptedData, threshold } = req.body
+  const result = verifySession(sessionId, encryptedData, threshold)
+  if (!result.success) {
+    return res.status(400).json({ error: result.error })
+  }
+  if (!result.passed) {
+    return res.json({ passed: false, score: result.score, reason: result.reason })
+  }
+  const pow = generatePOWChallenge(sessionId)
+  res.json({ passed: true, score: result.score, token: result.token, pow })
+})
+// 3. POW 验证
+app.post('/api/verify/pow-verify', (req, res) => {
+  const { sessionId, nonce } = req.body
+  const result = verifyPOWSolution(sessionId, nonce)
+  if (!result.success) {
+    return res.status(400).json({ error: result.error })
+  }
+  res.json({ passed: result.passed, token: result.token, score: result.score })
+})
+app.listen(3000)
+```
+## 验证流程
+```
+前端                                          后端
+ │                                             │
+ │  POST /api/verify/challenge                 │
+ │ ──────────────────────────────────────────► │  createSession()
+ │ ◄────────────────────────────────────────── │  → { sessionId, publicKey }
+ │                                             │
+ │  采集指纹 + 行为数据                         │
+ │  Web Worker 加密（RSA + AES）                │
+ │                                             │
+ │  POST /api/verify/pow-challenge             │
+ │   { sessionId, encryptedData }              │
+ │ ──────────────────────────────────────────► │  verifySession() → 评分
+ │                                             │  generatePOWChallenge()
+ │ ◄────────────────────────────────────────── │  → { passed, score, pow }
+ │                                             │
+ │  Web Worker 计算 POW（实时进度）              │
+ │                                             │
+ │  POST /api/verify/pow-verify                │
+ │   { sessionId, nonce }                      │
+ │ ──────────────────────────────────────────► │  verifyPOWSolution()
+ │ ◄────────────────────────────────────────── │  → { passed, token, score }
+```
+## 安全机制
+- **防重放** — 会话一次性使用，验证即销毁，过期时间 5 分钟
+- **双层加密** — RSA-OAEP-SHA256（2048 位）+ AES-256-GCM，Web Worker 中执行
+- **工作量证明** — SHA-256 前导零位，难度 1-10 秒，Web Worker 计算
+- **自动化检测** — Playwright / Puppeteer / Selenium / Headless 检测
+- **设备指纹** — 100+ 采集项（Canvas / WebGL / Audio / Fonts / WebRTC）
+- **代码混淆** — 控制流扁平化 / 死代码注入 / 字符串数组化
+## License
+MIT

package/backend/index.js ADDED Viewed

@@ -0,0 +1 @@