@b01lers/ctfd-api 1.0.0

package/.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text=auto

package/README.md

@@ -0,0 +1,2 @@
+# CTFd API
+A simple, typed API client for the CTFd API.

package/dist/index.js

@@ -0,0 +1,71 @@
+'use strict';
+
+function extractNonce(raw) {
+  return raw.match(/'csrfNonce': "(.+?)"/)[1];
+}
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class CTFdClient {
+  constructor(options) {
+    __publicField(this, "url");
+    __publicField(this, "username");
+    __publicField(this, "password");
+    __publicField(this, "cachedSession", null);
+    __publicField(this, "cachedNonce", null);
+    __publicField(this, "sessionExpiry", /* @__PURE__ */ new Date());
+    this.url = options.url.endsWith("/") ? options.url.slice(0, -1) : options.url;
+    this.username = options.username;
+    this.password = options.password;
+  }
+  async submitFlag(id, flag) {
+    const { session, nonce } = await this.getAuthedSessionNonce();
+    return await (await fetch(`${this.url}/api/v1/challenges/attempt`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Csrf-Token": nonce,
+        cookie: session
+      },
+      body: JSON.stringify({ challenge_id: id, submission: flag })
+    })).json();
+  }
+  async getChallenges() {
+    const { session } = await this.getAuthedSessionNonce();
+    return await (await fetch(`${this.url}/api/v1/challenges`, {
+      headers: { cookie: session }
+    })).json();
+  }
+  async getAuthedSessionNonce() {
+    if (/* @__PURE__ */ new Date() < this.sessionExpiry && this.cachedSession && this.cachedNonce)
+      return { session: this.cachedSession, nonce: this.cachedNonce };
+    const res = await fetch(`${this.url}/login`);
+    const [session] = res.headers.getSetCookie()[0].split("; ");
+    const nonce = extractNonce(await res.text());
+    const formData = new FormData();
+    formData.append("name", this.username);
+    formData.append("password", this.password);
+    formData.append("_submit", "Submit");
+    formData.append("nonce", nonce);
+    const loginRes = await fetch(`${this.url}/login`, {
+      method: "POST",
+      headers: { cookie: session },
+      redirect: "manual",
+      body: formData
+    });
+    const [authedSession, expiresGmt] = loginRes.headers.getSetCookie()[0].split("; ");
+    const authedRaw = await (await fetch(`${this.url}/challenges`, {
+      headers: { cookie: authedSession }
+    })).text();
+    this.cachedSession = authedSession;
+    this.cachedNonce = extractNonce(authedRaw);
+    this.sessionExpiry = new Date(expiresGmt.slice(8));
+    return {
+      nonce: this.cachedNonce,
+      session: this.cachedSession
+    };
+  }
+}
+
+exports.CTFdClient = CTFdClient;

package/dist/types.d.ts

@@ -0,0 +1,54 @@
+type ScoreboardData = {
+    pos: number;
+    account_id: number;
+    account_url: string;
+    account_type: "user";
+    oauth_id: null;
+    name: string;
+    score: number;
+    bracket_id: null;
+    bracket_name: null;
+};
+type ChallengesResponse = {
+    success: true;
+    data: ChallengeData[];
+};
+type ChallengeData = {
+    id: number;
+    type: 'standard' | 'multiple_choice' | 'code';
+    name: string;
+    category: string;
+    script: string;
+    solved_by_me: boolean;
+    solves: number;
+    tags: string[];
+    template: string;
+    value: number;
+};
+type FlagSubmissionResponse = {
+    success: true;
+    data: {
+        status: "incorrect";
+        message: "Incorrect";
+    };
+};
+
+type ClientOptions = {
+    url: string;
+    username: string;
+    password: string;
+};
+declare class CTFdClient {
+    private readonly url;
+    private readonly username;
+    private readonly password;
+    private cachedSession;
+    private cachedNonce;
+    private sessionExpiry;
+    constructor(options: ClientOptions);
+    submitFlag(id: number, flag: string): Promise<FlagSubmissionResponse>;
+    getChallenges(): Promise<ChallengesResponse>;
+    private getAuthedSessionNonce;
+}
+
+export { CTFdClient, type ChallengeData, type ScoreboardData };

package/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@b01lers/ctfd-api",
+  "version": "1.0.0",
+  "description": "An API client for CTFd.",
+  "main": "dist/index.js",
+  "types": "dist/types.d.ts",
+  "scripts": {
+    "build": "rollup --config"
+  },
+  "author": "ky28059",
+  "license": "MIT",
+  "devDependencies": {
+    "@types/node": "^22.10.10",
+    "rollup": "^4.32.0",
+    "rollup-plugin-dts": "^6.1.1",
+    "rollup-plugin-esbuild": "^6.1.1",
+    "tslib": "^2.8.1",
+    "typescript": "^5.7.3"
+  }
+}

package/rollup.config.mjs

@@ -0,0 +1,20 @@
+import esbuild from 'rollup-plugin-esbuild';
+import { dts } from 'rollup-plugin-dts';
+
+
+export default [{
+    input: 'src/index.ts',
+    output: {
+        file: 'dist/index.js',
+        format: 'cjs'
+    },
+    plugins: [
+        esbuild(),
+    ]
+}, {
+    input: "./src/index.ts",
+    output: [{ file: "dist/types.d.ts", format: "es" }],
+    plugins: [
+        dts()
+    ],
+}];

package/src/client.ts

@@ -0,0 +1,92 @@
+import { extractNonce } from './util';
+import type { ChallengesResponse, FlagSubmissionResponse } from './types';
+
+
+type ClientOptions = {
+    url: string,
+    username: string,
+    password: string,
+}
+
+export class CTFdClient {
+    private readonly url: string;
+    private readonly username: string;
+    private readonly password: string;
+
+    private cachedSession: string | null = null;
+    private cachedNonce: string | null = null;
+    private sessionExpiry = new Date();
+
+    constructor(options: ClientOptions) {
+        this.url = options.url.endsWith('/') ? options.url.slice(0, -1) : options.url;
+        this.username = options.username;
+        this.password = options.password;
+    }
+
+    public async submitFlag(id: number, flag: string) {
+        const { session, nonce } = await this.getAuthedSessionNonce();
+
+        return await (await fetch(`${this.url}/api/v1/challenges/attempt`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Csrf-Token': nonce,
+                cookie: session,
+            },
+            body: JSON.stringify({ challenge_id: id, submission: flag }),
+        })).json() as FlagSubmissionResponse;
+    }
+
+    public async getChallenges() {
+        const { session } = await this.getAuthedSessionNonce();
+
+        return await (await fetch(`${this.url}/api/v1/challenges`, {
+            headers: { cookie: session }
+        })).json() as ChallengesResponse;
+    }
+
+    private async getAuthedSessionNonce() {
+        // If we have a cached, non-expired session, use it
+        if (new Date() < this.sessionExpiry && this.cachedSession && this.cachedNonce)
+            return { session: this.cachedSession, nonce: this.cachedNonce };
+
+        const res = await fetch(`${this.url}/login`);
+
+        const [session] = res.headers.getSetCookie()[0].split('; ');
+        const nonce = extractNonce(await res.text());
+
+        const formData = new FormData();
+        formData.append('name', this.username);
+        formData.append('password', this.password);
+        formData.append('_submit', 'Submit');
+        formData.append('nonce', nonce);
+
+        const loginRes = await fetch(`${this.url}/login`, {
+            method: 'POST',
+            headers: { cookie: session },
+            redirect: 'manual',
+            body: formData,
+        });
+
+        const [authedSession, expiresGmt] = loginRes.headers.getSetCookie()[0].split('; ');
+        const authedRaw = await (await fetch(`${this.url}/challenges`, {
+            headers: { cookie: authedSession }
+        })).text();
+
+        // Cache session data and expiry date
+        this.cachedSession = authedSession;
+        this.cachedNonce = extractNonce(authedRaw);
+        this.sessionExpiry = new Date(expiresGmt.slice(8));
+
+        return {
+            nonce: this.cachedNonce,
+            session: this.cachedSession,
+        };
+    }
+}
+
+// export async function getScoreboard() {
+//     return await (await fetch('https://ectf.ctfd.io/api/v1/scoreboard', {
+//         headers: { 'Authorization': CTFD_API_KEY }
+//     })).json() as ScoreboardResponse;
+// }

package/src/index.ts

@@ -0,0 +1,2 @@
+export { CTFdClient } from './client';
+export type { ScoreboardData, ChallengeData } from './types';

package/src/types.ts

@@ -0,0 +1,42 @@
+export type ScoreboardResponse = {
+    success: true,
+    data: ScoreboardData[],
+}
+
+export type ScoreboardData = {
+    pos: number,
+    account_id: number,
+    account_url: string,
+    account_type: "user",
+    oauth_id: null,
+    name: string,
+    score: number,
+    bracket_id: null,
+    bracket_name: null
+}
+
+export type ChallengesResponse = {
+    success: true,
+    data: ChallengeData[]
+}
+
+export type ChallengeData = {
+    id: number,
+    type: 'standard' | 'multiple_choice' | 'code',
+    name: string,
+    category: string,
+    script: string,
+    solved_by_me: boolean,
+    solves: number,
+    tags: string[],
+    template: string,
+    value: number,
+}
+
+export type FlagSubmissionResponse = {
+    success: true,
+    data: {
+        status: "incorrect", // TODO
+        message: "Incorrect"
+    }
+}

package/src/util.ts

@@ -0,0 +1,3 @@
+export function extractNonce(raw: string) {
+    return raw.match(/'csrfNonce': "(.+?)"/)![1];
+}

package/tests/build.js

@@ -0,0 +1,16 @@
+const { CTFdClient } = require('../dist/index.js');
+
+;(async () => {
+    const client = new CTFdClient({
+        url: 'https://demo.ctfd.io/',
+        username: 'user',
+        password: 'password',
+    });
+
+    const challs = await client.getChallenges();
+    console.log(challs.data);
+
+    const chall = challs.data.find((c) => c.name === 'The Lost Park');
+    const res = await client.submitFlag(chall.id, 'cftd{test_flag}');
+    console.log(res);
+})()

package/tests/demo.ts

@@ -0,0 +1,17 @@
+import { CTFdClient } from '../src/client';
+
+
+;(async () => {
+    const client = new CTFdClient({
+        url: 'https://demo.ctfd.io/',
+        username: 'user',
+        password: 'password',
+    });
+
+    const challs = await client.getChallenges();
+    console.log(challs.data);
+
+    const chall = challs.data.find((c) => c.name === 'The Lost Park')!;
+    const res = await client.submitFlag(chall.id, 'cftd{test_flag}');
+    console.log(res);
+})()

package/tsconfig.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "display": "Node 20",
+  "_version": "20.1.0",
+  "include": ["src"],
+  "compilerOptions": {
+    "lib": ["es2023"],
+    "module": "node16",
+    "target": "es2022",
+
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "downlevelIteration": true,
+    "moduleResolution": "node16"
+  }
+}