Implementación de Telemetría Biométrica Pasiva y Entropía Kinestésica para Detección Anti-Bot Zero Trust en Frontend

/**
 * Zero Trust Biometric Entropy Shield v2.0
 * Engine de telemetría kinestésica no intrusiva con firma criptográfica HMAC-SHA256.
 */
class BiometricEntropyShield {
    #sampleSize;
    #telemetryBuffer;
    #bufferIndex = 0;
    #isRecording = false;
    #lastX = null;
    #lastY = null;
    #lastTime = null;
    #lastAngle = null;
    #secretKey = null;
    #cryptoKey = null;
    #boundTrackMovement;

    /**
     * @param {Object} config
     * @param {number} [config.sampleSize=60] Tasa de muestreo en buffer circular.
     * @param {string} [config.secretKey] Clave simétrica para firma HMAC de payload.
     */
    constructor(config = {}) {
        this.#sampleSize = config.sampleSize || 60;
        this.#secretKey = config.secretKey || 'default-zero-trust-secret-key';
        
        // Estructura de datos flat optimizada para performance
        this.#telemetryBuffer = {
            velocity: new Float32Array(this.#sampleSize),
            acceleration: new Float32Array(this.#sampleSize),
            angularJitter: new Float32Array(this.#sampleSize)
        };

        this.#boundTrackMovement = this.#trackMovement.bind(this);
        this.#initCryptoKey();
        this.#bindEvents();
    }

    async #initCryptoKey() {
        if (!window.crypto || !window.crypto.subtle) return;
        const encoder = new TextEncoder();
        const keyData = encoder.encode(this.#secretKey);
        this.#cryptoKey = await window.crypto.subtle.importKey(
            'raw',
            keyData,
            { name: 'HMAC', hash: 'SHA-256' },
            false,
            ['sign']
        );
    }

    #bindEvents() {
        const options = { passive: true };
        window.addEventListener('mousemove', this.#boundTrackMovement, options);
        window.addEventListener('touchmove', this.#boundTrackMovement, options);
    }

    #trackMovement(event) {
        if (!this.#isRecording) return;

        const timeNow = performance.now();
        if (this.#lastTime === null) {
            const touch = event.touches ? event.touches[0] : null;
            this.#lastX = touch ? touch.clientX : event.clientX;
            this.#lastY = touch ? touch.clientY : event.clientY;
            this.#lastTime = timeNow;
            return;
        }

        const deltaTime = timeNow - this.#lastTime;
        // Limitación a frecuencia de renderizado (~60Hz / 16ms)
        if (deltaTime < 15) return;

        const touch = event.touches ? event.touches[0] : null;
        const clientX = touch ? touch.clientX : event.clientX;
        const clientY = touch ? touch.clientY : event.clientY;

        const deltaX = clientX - this.#lastX;
        const deltaY = clientY - this.#lastY;
        const distance = Math.hypot(deltaX, deltaY);
        
        // Ignorar micromovimientos estáticos insignificantes
        if (distance < 0.5) return;

        const velocity = distance / deltaTime;
        const currentAngle = Math.atan2(deltaY, deltaX);

        // Cálculo de métricas derivadas
        const prevVelocity = this.#telemetryBuffer.velocity[this.#bufferIndex % this.#sampleSize] || 0;
        const acceleration = (velocity - prevVelocity) / deltaTime;

        let angularJitter = 0;
        if (this.#lastAngle !== null) {
            let angleDiff = Math.abs(currentAngle - this.#lastAngle);
            if (angleDiff > Math.PI) angleDiff = 2 * Math.PI - angleDiff;
            angularJitter = angleDiff;
        }

        // Actualización de buffer circular
        const index = this.#bufferIndex % this.#sampleSize;
        this.#telemetryBuffer.velocity[index] = velocity;
        this.#telemetryBuffer.acceleration[index] = acceleration;
        this.#telemetryBuffer.angularJitter[index] = angularJitter;

        this.#bufferIndex++;
        this.#lastX = clientX;
        this.#lastY = clientY;
        this.#lastTime = timeNow;
        this.#lastAngle = currentAngle;
    }

    start() {
        this.#bufferIndex = 0;
        this.#lastX = null;
        this.#lastY = null;
        this.#lastTime = null;
        this.#lastAngle = null;
        this.#telemetryBuffer.velocity.fill(0);
        this.#telemetryBuffer.acceleration.fill(0);
        this.#telemetryBuffer.angularJitter.fill(0);
        this.#isRecording = true;
    }

    stop() {
        this.#isRecording = false;
    }

    destroy() {
        this.stop();
        window.removeEventListener('mousemove', this.#boundTrackMovement);
        window.removeEventListener('touchmove', this.#boundTrackMovement);
    }

    /**
     * Evalúa la variabilidad multivariable de los datos kinestésicos.
     * @private
     */
    #calculateVariance(array, validSamples) {
        if (validSamples === 0) return 0;
        let sum = 0;
        for (let i = 0; i < validSamples; i++) sum += array[i];
        const mean = sum / validSamples;

        let varianceSum = 0;
        for (let i = 0; i < validSamples; i++) {
            varianceSum += Math.pow(array[i] - mean, 2);
        }
        return varianceSum / validSamples;
    }

    /**
     * Calcula la puntuación global de humanidad basada en la combinación
     * de varianza kinestésica y entropía angular.
     * @returns {number} Puntuación de 0.0 (Bot estricto) a 1.0 (Humano confirmado)
     */
    generateHumanityScore() {
        const validSamples = Math.min(this.#bufferIndex, this.#sampleSize);
        if (validSamples < 12) return 0.0;

        const velVariance = this.#calculateVariance(this.#telemetryBuffer.velocity, validSamples);
        const accVariance = this.#calculateVariance(this.#telemetryBuffer.acceleration, validSamples);
        const jitterVariance = this.#calculateVariance(this.#telemetryBuffer.angularJitter, validSamples);

        // Ponderación de factores kinestésicos
        const velocityWeight = Math.min(velVariance * 80, 0.4);
        const accelerationWeight = Math.min(accVariance * 1200, 0.3);
        const angularWeight = Math.min(jitterVariance * 2.5, 0.3);

        const score = velocityWeight + accelerationWeight + angularWeight;
        return Number(Math.min(Math.max(score, 0.0), 1.0).toFixed(4));
    }

    /**
     * Construye un payload firmado criptográficamente con HMAC-SHA256
     * para consumo seguro en el API Gateway / Backend.
     * @returns {Promise<string>} Base64URL del JSON concatenado con su firma HMAC.
     */
    async generateSignedPayload() {
        const score = this.generateHumanityScore();
        const validSamples = Math.min(this.#bufferIndex, this.#sampleSize);
        
        const payloadData = {
            score,
            samples: validSamples,
            timestamp: Date.now(),
            nonce: Math.random().toString(36).substring(2, 10)
        };

        const jsonString = JSON.stringify(payloadData);
        
        if (!this.#cryptoKey || !window.crypto || !window.crypto.subtle) {
            return btoa(jsonString);
        }

        const encoder = new TextEncoder();
        const dataBuffer = encoder.encode(jsonString);
        const signatureBuffer = await window.crypto.subtle.sign('HMAC', this.#cryptoKey, dataBuffer);

        const signatureArray = Array.from(new Uint8Array(signatureBuffer));
        const signatureHex = signatureArray.map(b => b.toString(16).padStart(2, '0')).join('');

        return btoa(JSON.stringify({
            data: payloadData,
            signature: signatureHex
        }));
    }
}