k9guard 1.0.1 → 1.0.3

package/src/utils/imageGenerator.ts

@@ -0,0 +1,154 @@
+import { RandomPool } from './crypto';
+
+interface ImageGeneratorResult {
+  image: string;
+  answer: string;
+  question: string;
+}
+
+const CHAR_POOL_EASY   = 'ABCDEFGHJKLMNPQRSTUVWXYZ';
+const CHAR_POOL_MEDIUM = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
+const CHAR_POOL_HARD   = 'ABCDEFGHJKLMNPQRSTUVWXYZabcdefghjkmnpqrstuvwxyz23456789';
+
+const SVG_WIDTH  = 200;
+const SVG_HEIGHT = 70;
+
+// prevents XML injection via user-controlled strings embedded in SVG
+function escapeXml(str: string): string {
+  return str
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+function generateText(pool: RandomPool, charPool: string, length: number): string {
+  let result = '';
+  for (let i = 0; i < length; i++) {
+    result += charPool[pool.byte() % charPool.length]!;
+  }
+  return result;
+}
+
+// each character is rendered individually with rotation and offset to resist OCR
+function renderChar(pool: RandomPool, char: string, x: number, baseY: number, colorHex: string): string {
+  const rotate  = pool.int(-25, 25);
+  const offsetY = pool.int(-6, 6);
+  const fontSize = pool.int(22, 30);
+  const opacity  = (pool.float() * 0.25 + 0.75).toFixed(2);
+
+  return `<text x="${x}" y="${baseY + offsetY}" transform="rotate(${rotate},${x},${baseY + offsetY})" font-size="${fontSize}" font-family="monospace" font-weight="bold" fill="${colorHex}" opacity="${opacity}" letter-spacing="2">${escapeXml(char)}</text>`;
+}
+
+function grayColor(pool: RandomPool): string {
+  const v = pool.int(100, 200);
+  return `rgb(${v},${v},${v})`;
+}
+
+function darkColor(pool: RandomPool): string {
+  const r = pool.int(20, 150);
+  const g = pool.int(20, 150);
+  const b = pool.int(20, 150);
+  return `rgb(${r},${g},${b})`;
+}
+
+// interference lines make automated segment extraction harder
+function renderNoiseLines(pool: RandomPool, count: number): string {
+  let lines = '';
+  for (let i = 0; i < count; i++) {
+    const x1 = pool.int(0, SVG_WIDTH);
+    const y1 = pool.int(0, SVG_HEIGHT);
+    const x2 = pool.int(0, SVG_WIDTH);
+    const y2 = pool.int(0, SVG_HEIGHT);
+    const strokeWidth = (pool.float() * 1.5 + 0.5).toFixed(1);
+    const color   = grayColor(pool);
+    const opacity = (pool.float() * 0.4 + 0.2).toFixed(2);
+    lines += `<line x1="${x1}" y1="${y1}" x2="${x2}" y2="${y2}" stroke="${color}" stroke-width="${strokeWidth}" opacity="${opacity}"/>`;
+  }
+  return lines;
+}
+
+// noise dots add pixel-level entropy that defeats simple segmentation
+function renderNoiseDots(pool: RandomPool, count: number): string {
+  let dots = '';
+  for (let i = 0; i < count; i++) {
+    const cx      = pool.int(0, SVG_WIDTH);
+    const cy      = pool.int(0, SVG_HEIGHT);
+    const r       = pool.int(1, 3);
+    const color   = grayColor(pool);
+    const opacity = (pool.float() * 0.5 + 0.1).toFixed(2);
+    dots += `<circle cx="${cx}" cy="${cy}" r="${r}" fill="${color}" opacity="${opacity}"/>`;
+  }
+  return dots;
+}
+
+// sinusoidal wave distortion applied as a path overlay
+function renderWavePath(pool: RandomPool): string {
+  const amplitude  = pool.int(3, 8);
+  const frequency  = pool.float() * 0.08 + 0.04;
+  const phaseShift = pool.float() * Math.PI * 2;
+  const strokeColor = grayColor(pool);
+
+  let d = `M 0 ${SVG_HEIGHT / 2}`;
+  for (let x = 1; x <= SVG_WIDTH; x += 2) {
+    const y = SVG_HEIGHT / 2 + amplitude * Math.sin(frequency * x + phaseShift);
+    d += ` L ${x} ${y.toFixed(2)}`;
+  }
+
+  return `<path d="${d}" stroke="${strokeColor}" stroke-width="1.5" fill="none" opacity="0.35"/>`;
+}
+
+function buildSvg(pool: RandomPool, text: string, difficulty: 'easy' | 'medium' | 'hard'): string {
+  const charCount = text.length;
+  const spacing   = SVG_WIDTH / (charCount + 1);
+  const baseY     = SVG_HEIGHT / 2 + 8;
+
+  const noiseLineCount = difficulty === 'easy' ? 4  : difficulty === 'medium' ? 7  : 10;
+  const noiseDotCount  = difficulty === 'easy' ? 20 : difficulty === 'medium' ? 40 : 60;
+  const waveCount      = difficulty === 'easy' ? 1  : difficulty === 'medium' ? 2  : 3;
+
+  const bgGray = pool.int(235, 250);
+  const background = `<rect width="${SVG_WIDTH}" height="${SVG_HEIGHT}" fill="rgb(${bgGray},${bgGray},${bgGray})" rx="6"/>`;
+
+  let chars = '';
+  for (let i = 0; i < charCount; i++) {
+    const x     = Math.round(spacing * (i + 1));
+    const color = darkColor(pool);
+    chars += renderChar(pool, text[i]!, x, baseY, color);
+  }
+
+  let waves = '';
+  for (let i = 0; i < waveCount; i++) {
+    waves += renderWavePath(pool);
+  }
+
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${SVG_WIDTH}" height="${SVG_HEIGHT}" viewBox="0 0 ${SVG_WIDTH} ${SVG_HEIGHT}">${background}${renderNoiseDots(pool, noiseDotCount)}${renderNoiseLines(pool, noiseLineCount)}${waves}${chars}</svg>`;
+}
+
+function svgToDataUri(svg: string): string {
+  // btoa requires a binary string; TextEncoder gives us the UTF-8 bytes
+  const bytes = new TextEncoder().encode(svg);
+  const binString = Array.from(bytes, b => String.fromCodePoint(b)).join('');
+  return `data:image/svg+xml;base64,${btoa(binString)}`;
+}
+
+export class ImageGenerator {
+  static generate(difficulty: 'easy' | 'medium' | 'hard'): ImageGeneratorResult {
+    // single pool allocation covers all random needs for this image — ~1 crypto
+    // call instead of the ~500 individual randomBytes(4) calls it replaced
+    const pool = new RandomPool(2048);
+
+    const charPool = difficulty === 'easy' ? CHAR_POOL_EASY : difficulty === 'medium' ? CHAR_POOL_MEDIUM : CHAR_POOL_HARD;
+    const length   = difficulty === 'easy' ? 4 : difficulty === 'medium' ? 5 : 6;
+    const answer   = generateText(pool, charPool, length);
+    const svg      = buildSvg(pool, answer, difficulty);
+    const image    = svgToDataUri(svg);
+
+    return {
+      image,
+      answer: answer.toLowerCase(),
+      question: 'Type the characters shown in the image'
+    };
+  }
+}

package/src/utils/random.ts

@@ -3,8 +3,8 @@ import { randomBytes } from './crypto';
 export class Random {
   static getRandomNumber(difficulty: 'easy' | 'medium' | 'hard'): number {
     const buffer = randomBytes(4);
-    // NOTE: convert crypto bytes to a number between 0 and 1
-    const rand = buffer.readUInt32LE(0) / 0xFFFFFFFF;
+    // divide by 2^32 (not 2^32-1) so the result is strictly in [0, 1) — avoids off-by-one at the top
+    const rand = buffer.readUInt32LE(0) / 0x100000000;
     if (difficulty === 'easy') {
       return Math.floor(rand * 10) + 1;
     }

package/src/utils/reverseGenerator.ts

@@ -1,3 +1,5 @@
+import { randomBytes } from './crypto';
+
 export class ReverseGenerator {
   private static readonly easyWords = [
     'cat', 'dog', 'sun', 'moon', 'star', 'fish', 'bird', 'tree',
@@ -42,7 +44,9 @@ export class ReverseGenerator {
       wordPool = this.hardWords;
     }
     
-    const text = wordPool![Math.floor(Math.random() * wordPool!.length)]!;
+    const buf = randomBytes(4);
+    const rand = buf.readUInt32LE(0) / 0xFFFFFFFF;
+    const text = wordPool![Math.floor(rand * wordPool!.length)]!;
     const reversed = text.split('').reverse().join('');
     
     return { question: reversed, answer: text };

package/src/utils/scrambleGenerator.ts

@@ -1,24 +1,35 @@
 import { randomBytes } from './crypto';
 
 export class ScrambleGenerator {
-  private static words: string[] = [
+  private static readonly easyWords: string[] = [
+    'apple', 'cat', 'dog', 'house', 'sun', 'moon', 'car', 'tree', 'book', 'water'
+  ];
+
+  private static readonly mediumWords: string[] = [
     'apple', 'cat', 'dog', 'house', 'sun', 'moon', 'car', 'tree', 'book', 'water',
     'bread', 'milk', 'fish', 'bird', 'flower', 'star', 'hand', 'eye', 'nose', 'mouth'
   ];
 
+  // hard pool: longer words with uncommon letter patterns to resist guessing
+  private static readonly hardWords: string[] = [
+    'typescript', 'javascript', 'algorithm', 'encryption', 'blockchain',
+    'metamorphosis', 'cryptography', 'synchronize', 'parallelism', 'obfuscation',
+    'infrastructure', 'authentication', 'authorization', 'vulnerability', 'orchestration'
+  ];
+
   static generate(difficulty: 'easy' | 'medium' | 'hard'): { question: string; answer: string } {
-    let word: string;
-    const buffer = randomBytes(4);
-    // convert crypto bytes to a float between 0 and 1
-    const rand = buffer.readUInt32LE(0) / 0xFFFFFFFF;
-    
+    let pool: string[];
     if (difficulty === 'easy') {
-      word = this.words[Math.floor(rand * 10)]!;
+      pool = this.easyWords;
     } else if (difficulty === 'medium') {
-      word = this.words[Math.floor(rand * this.words.length)]!;
+      pool = this.mediumWords;
     } else {
-      word = 'typescript';
+      pool = this.hardWords;
     }
+
+    const buffer = randomBytes(4);
+    const rand = buffer.readUInt32LE(0) / 0xFFFFFFFF;
+    const word = pool[Math.floor(rand * pool.length)]!;
     
     const scrambled = this.scramble(word);
     return { question: scrambled, answer: word };
@@ -26,10 +37,11 @@ export class ScrambleGenerator {
 
   private static scramble(word: string): string {
     const arr = word.split('');
-    // NOTE: fisher yates shuffle using crypto random for each swap
-    for (let i = arr.length - 1; i > 0; i--) {
-      const buffer = randomBytes(4);
-      const j = buffer.readUInt32LE(0) % (i + 1);
+    const n   = arr.length;
+    // batch all uint32 values for Fisher-Yates in one crypto call (n-1 swaps × 4 bytes)
+    const batchBuf = randomBytes(n * 4);
+    for (let i = n - 1; i > 0; i--) {
+      const j = batchBuf.readUInt32LE((n - 1 - i) * 4) % (i + 1);
       [arr[i]!, arr[j]!] = [arr[j]!, arr[i]!];
     }
     return arr.join('');

package/src/utils/sequenceGenerator.ts

@@ -3,31 +3,32 @@ import { randomBytes } from './crypto';
 export class SequenceGenerator {
   static generate(difficulty: 'easy' | 'medium' | 'hard'): { question: string; answer: number | string } {
     if (difficulty === 'easy') {
-      const buffer = randomBytes(4);
-      // NOTE: generate random starting number and step size for arithmetic sequence
+      const buffer = randomBytes(8);
+      // use separate byte ranges for start and step to remove correlation between them
       const start = (buffer.readUInt32LE(0) % 5) + 1;
-      const step = ((buffer.readUInt32LE(0) >> 8) % 3) + 1;
+      const step = (buffer.readUInt32LE(4) % 3) + 1;
       const sequence = [start, start + step, start + 2 * step];
       const answer = start + 3 * step;
       return { question: `${sequence.join(', ')}, ?`, answer };
     }
     if (difficulty === 'medium') {
       const letters = ['A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J'];
-      const buffer = randomBytes(4);
-      const start = buffer.readUInt32LE(0) % 4;
       const step = 2;
+      // max start ensures all 4 elements (start, +2, +4, +6) fit within the 10-letter array
+      const maxStart = letters.length - step * 3 - 1;
+      const buffer = randomBytes(4);
+      const start = buffer.readUInt32LE(0) % (maxStart + 1);
       const sequence = [letters[start], letters[start + step], letters[start + 2 * step]];
-      const nextIndex = start + 3 * step;
-      // check if next letter goes out of bounds
-      if (nextIndex >= letters.length) {
-        return { question: `${sequence.join(', ')}, ?`, answer: '?' };
-      }
-      const answer = letters[nextIndex]!;
+      const answer = letters[start + 3 * step]!;
       return { question: `${sequence.join(', ')}, ?`, answer };
     }
-    // hard mode uses fibonacci sequence
-    const sequence = [1, 1, 2, 3];
-    const answer = 5;
+    // hard: pick a random starting offset in the Fibonacci sequence so the answer is not always 5
+    const fibs = [1, 1, 2, 3, 5, 8, 13, 21, 34, 55, 89, 144];
+    const buffer = randomBytes(4);
+    const maxStart = fibs.length - 5; // ensure 4 shown + 1 answer all fit
+    const start = buffer.readUInt32LE(0) % (maxStart + 1);
+    const sequence = fibs.slice(start, start + 4);
+    const answer = fibs[start + 4]!;
     return { question: `${sequence.join(', ')}, ?`, answer };
   }
 }

package/src/locale/en.json

@@ -1,46 +0,0 @@
-{
-  "riddles": [
-    { "question": "What has keys but can't open locks?", "answer": "piano" },
-    { "question": "What gets wetter as it dries?", "answer": "towel" },
-    { "question": "What has a head, a tail, but no body?", "answer": "coin" },
-    { "question": "What can you catch but not throw?", "answer": "cold" },
-    { "question": "What has one eye but can't see?", "answer": "needle" },
-    { "question": "What is always in front of you but can't be seen?", "answer": "future" },
-    { "question": "What has many teeth but can't bite?", "answer": "comb" },
-    { "question": "What is full of holes but still holds water?", "answer": "sponge" },
-    { "question": "What has a neck but no head?", "answer": "bottle" },
-    { "question": "What can travel around the world while staying in a corner?", "answer": "stamp" },
-    { "question": "What has hands but cannot clap?", "answer": "clock" },
-    { "question": "What runs but never walks?", "answer": "water" },
-    { "question": "What has a bed but never sleeps?", "answer": "river" },
-    { "question": "What has a face and two hands but no arms or legs?", "answer": "clock" },
-    { "question": "What goes up but never comes down?", "answer": "age" },
-    { "question": "What has words but never speaks?", "answer": "book" },
-    { "question": "What has a thumb and four fingers but is not alive?", "answer": "glove" },
-    { "question": "What can fill a room but takes up no space?", "answer": "light" },
-    { "question": "What breaks when you say its name?", "answer": "silence" },
-    { "question": "What has legs but cannot walk?", "answer": "table" }
-  ],
-  "logics": [
-    { "question": "If today is Monday, tomorrow is Tuesday. True or False?", "answer": "True" },
-    { "question": "A cat is an animal. True or False?", "answer": "True" },
-    { "question": "Water is dry. True or False?", "answer": "False" },
-    { "question": "All apples are red. True or False?", "answer": "False" },
-    { "question": "5 is greater than 3. True or False?", "answer": "True" },
-    { "question": "If A > B and B > C, then A > C. True or False?", "answer": "True" },
-    { "question": "A square has 3 sides. True or False?", "answer": "False" },
-    { "question": "The sun rises in the east. True or False?", "answer": "True" },
-    { "question": "Fish can fly. True or False?", "answer": "False" },
-    { "question": "2 + 2 = 4. True or False?", "answer": "True" },
-    { "question": "A triangle has 3 corners. True or False?", "answer": "True" },
-    { "question": "Ice is hot. True or False?", "answer": "False" },
-    { "question": "10 is an even number. True or False?", "answer": "True" },
-    { "question": "Humans need oxygen to breathe. True or False?", "answer": "True" },
-    { "question": "A year has 12 months. True or False?", "answer": "True" },
-    { "question": "Birds are mammals. True or False?", "answer": "False" },
-    { "question": "7 is less than 15. True or False?", "answer": "True" },
-    { "question": "A circle has corners. True or False?", "answer": "False" },
-    { "question": "The earth is flat. True or False?", "answer": "False" },
-    { "question": "A week has 7 days. True or False?", "answer": "True" }
-  ]
-}

package/src/locale/tr.json

@@ -1,46 +0,0 @@
-{
-  "riddles": [
-    { "question": "Anahtarları var ama kapıları açamaz?", "answer": "piyano" },
-    { "question": "Kurudukça ıslanan nedir?", "answer": "havlu" },
-    { "question": "Baş ve kuyruğu var ama vücudu yok?", "answer": "madeni para" },
-    { "question": "Yakalayabilirsin ama atamazsın?", "answer": "soğuk algınlığı" },
-    { "question": "Bir gözü var ama göremez?", "answer": "iğne" },
-    { "question": "Her zaman önünde ama görülemez?", "answer": "gelecek" },
-    { "question": "Çok dişleri var ama ısırmaz?", "answer": "tarak" },
-    { "question": "Delik dolu ama suyu tutar?", "answer": "sünger" },
-    { "question": "Boynu var ama başı yok?", "answer": "şişe" },
-    { "question": "Dünyayı dolaşır ama köşede kalır?", "answer": "posta pulu" },
-    { "question": "Elleri var ama alkışlayamaz?", "answer": "saat" },
-    { "question": "Koşar ama asla yürümez?", "answer": "su" },
-    { "question": "Yatağı var ama asla uyumaz?", "answer": "nehir" },
-    { "question": "Yüzü ve iki eli var ama kolu ve bacağı yok?", "answer": "saat" },
-    { "question": "Yukarı çıkar ama asla aşağı inmez?", "answer": "yaş" },
-    { "question": "Kelimeleri var ama asla konuşmaz?", "answer": "kitap" },
-    { "question": "Başparmağı ve dört parmağı var ama canlı değil?", "answer": "eldiven" },
-    { "question": "Bir odayı doldurur ama yer kaplamaz?", "answer": "ışık" },
-    { "question": "Adını söylediğinde kırılır?", "answer": "sessizlik" },
-    { "question": "Bacakları var ama yürüyemez?", "answer": "masa" }
-  ],
-  "logics": [
-    { "question": "Bugün Pazartesi ise, yarın Salı'dır. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Kedi bir hayvandır. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Su kurudur. Doğru mu Yanlış mı?", "answer": "Yanlış" },
-    { "question": "Tüm elmalar kırmızıdır. Doğru mu Yanlış mı?", "answer": "Yanlış" },
-    { "question": "5, 3'ten büyüktür. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Eğer A > B ve B > C ise, A > C olur. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Karenin 3 kenarı vardır. Doğru mu Yanlış mı?", "answer": "Yanlış" },
-    { "question": "Güneş doğudan doğar. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Balıklar uçar. Doğru mu Yanlış mı?", "answer": "Yanlış" },
-    { "question": "2 + 2 = 4. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Üçgenin 3 köşesi vardır. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Buz sıcaktır. Doğru mu Yanlış mı?", "answer": "Yanlış" },
-    { "question": "10 çift sayıdır. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "İnsanlar nefes almak için oksijene ihtiyaç duyar. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Bir yılda 12 ay vardır. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Kuşlar memelidir. Doğru mu Yanlış mı?", "answer": "Yanlış" },
-    { "question": "7, 15'ten küçüktür. Doğru mu Yanlış mı?", "answer": "Doğru" },
-    { "question": "Dairenin köşeleri vardır. Doğru mu Yanlış mı?", "answer": "Yanlış" },
-    { "question": "Dünya düzdür. Doğru mu Yanlış mı?", "answer": "Yanlış" },
-    { "question": "Bir haftada 7 gün vardır. Doğru mu Yanlış mı?", "answer": "Doğru" }
-  ]
-}

package/src/utils/logicGenerator.ts

@@ -1,18 +0,0 @@
-import { randomBytes } from './crypto';
-import enData from '../locale/en.json';
-import trData from '../locale/tr.json';
-
-export class LogicGenerator {
-  private static data: Record<'en' | 'tr', { question: string; answer: string }[]> = {
-    en: enData.logics,
-    tr: trData.logics
-  };
-
-  static getRandom(locale: 'en' | 'tr' = 'en', difficulty: 'easy' | 'medium' | 'hard' = 'easy'): { question: string; answer: string } {
-    const logics = this.data[locale];
-    // use crypto random to select a logic puzzle securely
-    const buffer = randomBytes(4);
-    const index = buffer.readUInt32LE(0) % logics.length;
-    return logics[index]!;
-  }
-}

package/src/utils/riddleBank.ts

@@ -1,18 +0,0 @@
-import { randomBytes } from './crypto';
-import enData from '../locale/en.json';
-import trData from '../locale/tr.json';
-
-export class RiddleBank {
-  private static data: Record<'en' | 'tr', { question: string; answer: string }[]> = {
-    en: enData.riddles,
-    tr: trData.riddles
-  };
-
-  static getRandom(locale: 'en' | 'tr' = 'en', difficulty: 'easy' | 'medium' | 'hard' = 'easy'): { question: string; answer: string } {
-    const riddles = this.data[locale];
-    // use crypto random to select a riddle securely
-    const buffer = randomBytes(4);
-    const index = buffer.readUInt32LE(0) % riddles.length;
-    return riddles[index]!;
-  }
-}