icoa-cli 2.19.356 → 2.19.357

package/dist/lib/countdown.js

@@ -1 +1,43 @@
-import chalk from"chalk";export async function fetchWithCountdown(t,e={}){const o=e.from??15,r=e.waitText??"  one more moment...";let n=!1;t.then(()=>{n=!0},()=>{n=!0});for(let t=o;t>=1&&!n;t--)process.stdout.write("\r"+chalk.bold.cyan(`  ${t}`)+chalk.gray(" ...").padEnd(40," ")),await new Promise(t=>setTimeout(t,1e3));return process.stdout.write("\r"+" ".repeat(40)+"\r"),n||process.stdout.write(chalk.gray(r)+"\n"),t}
+/**
+ * 5-4-3-2-1 countdown wrapper for in-flight fetches.
+ *
+ * Wraps a promise with a visible countdown so the user has something to
+ * watch instead of a spinner. If the promise resolves DURING countdown,
+ * the remaining seconds are skipped and the line is cleared. If the
+ * promise hasn't resolved by the time countdown ends, a "wait" message
+ * stays on screen until it finishes.
+ *
+ * Deliberately avoids mentioning servers, network, or any architectural
+ * detail — students should experience the operation as one unbroken
+ * "ICOA does it" magic moment.
+ */
+import chalk from 'chalk';
+export async function fetchWithCountdown(fetchPromise, opts = {}) {
+    // 15s default — covers cold-start renders (model lazy-load + 90-frame
+    // baseline) without the "one more moment..." fallback firing too often.
+    // Warm-cache calls finish in 4-7s and the countdown exits early —
+    // no UX penalty.
+    const startSeconds = opts.from ?? 15;
+    const waitText = opts.waitText ?? '  one more moment...';
+    let resolved = false;
+    fetchPromise.then(() => {
+        resolved = true;
+    }, () => {
+        resolved = true;
+    });
+    for (let i = startSeconds; i >= 1; i--) {
+        if (resolved)
+            break;
+        // \r overwrites the same line. Pad with spaces to clear any prior
+        // longer text (e.g. on countdown from 10 → 9, the second char needs clearing).
+        process.stdout.write('\r' + chalk.bold.cyan(`  ${i}`) + chalk.gray(' ...').padEnd(40, ' '));
+        await new Promise((r) => setTimeout(r, 1000));
+    }
+    // Clear the countdown line
+    process.stdout.write('\r' + ' '.repeat(40) + '\r');
+    if (!resolved) {
+        // Stay-and-wait message — never mention WHY it's slow
+        process.stdout.write(chalk.gray(waitText) + '\n');
+    }
+    return fetchPromise;
+}

package/dist/lib/country-lang.js

@@ -1 +1,39 @@
-export const COUNTRY_LANG={UA:"uk",PE:"es",CN:"zh",AU:"en",JP:"ja",KR:"ko",BR:"pt",SA:"ar",FR:"fr",DE:"de",IN:"hi",ID:"id",TH:"th",VN:"vi",TR:"tr",RU:"ru",EG:"ar",HT:"ht",PH:"en",MY:"en",MM:"en",SG:"en",ZA:"en",KE:"sw",TZ:"sw",MO:"zh",UZ:"uz",GH:"en",LA:"lo",BD:"bn",BI:"fr",US:"en",UK:"en",NZ:"en",LK:"si",BW:"en",VE:"es"};
+export const COUNTRY_LANG = {
+    UA: 'uk',
+    PE: 'es',
+    CN: 'zh',
+    AU: 'en',
+    JP: 'ja',
+    KR: 'ko',
+    BR: 'pt',
+    SA: 'ar',
+    FR: 'fr',
+    DE: 'de',
+    IN: 'hi',
+    ID: 'id',
+    TH: 'th',
+    VN: 'vi',
+    TR: 'tr',
+    RU: 'ru',
+    EG: 'ar',
+    HT: 'ht',
+    PH: 'en',
+    MY: 'en',
+    MM: 'en',
+    SG: 'en',
+    ZA: 'en',
+    KE: 'sw',
+    TZ: 'sw',
+    MO: 'zh',
+    UZ: 'uz',
+    GH: 'en',
+    LA: 'lo',
+    BD: 'bn',
+    BI: 'fr',
+    US: 'en',
+    UK: 'en',
+    NZ: 'en',
+    LK: 'si',
+    BW: 'en',
+    VE: 'es',
+};

package/dist/lib/ctfd-client.js

@@ -1 +1,417 @@
-import{createWriteStream as t,mkdirSync as e}from"node:fs";import{join as s}from"node:path";import{pipeline as n}from"node:stream/promises";import{Readable as o}from"node:stream";export class CTFdClient{baseUrl;token;sessionCookie;csrfNonce;constructor(t,e,s,n){this.baseUrl=t.replace(/\/+$/,""),this.token=e,this.sessionCookie=s||"",this.csrfNonce=n||""}getAuthHeaders(){if(this.token)return{Authorization:`Token ${this.token}`};if(this.sessionCookie){const t={Cookie:this.sessionCookie};return this.csrfNonce&&(t["CSRF-Token"]=this.csrfNonce),t}return{}}async fetchCsrfNonce(){if(this.csrfNonce)return this.csrfNonce;try{const t=await fetch(this.baseUrl,{headers:this.sessionCookie?{Cookie:this.sessionCookie}:{}}),e=(await t.text()).match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);if(e)return this.csrfNonce=e[1],this.csrfNonce}catch{}return""}async request(t,e,s){this.sessionCookie&&!this.csrfNonce&&await this.fetchCsrfNonce();const n=`${this.baseUrl}/api/v1${e}`,o={...this.getAuthHeaders()};(void 0!==s||this.token)&&(o["Content-Type"]="application/json");const i=await fetch(n,{method:t,headers:o,body:void 0!==s?JSON.stringify(s):void 0,redirect:"manual"});if(i.status>=300&&i.status<400)throw new Error("Authentication failed: token invalid or expired. Re-run `join <url>` to sign in again.");if(!i.ok){const t=await i.text().catch(()=>"Unknown error");if(t.trimStart().startsWith("<")){if(/banned/i.test(t))throw new Error("Account banned: this account has been banned from the competition. Contact the organizer if you believe this is an error.");throw new Error("Access denied (403). Either your session expired — re-run `join <url>` — or this account is banned / not enabled for the competition (try a different account, or contact the organizer).")}throw new Error(`CTFd API error (${i.status}): ${t}`)}if(!(i.headers.get("content-type")||"").includes("application/json")&&(await i.text().catch(()=>"")).trimStart().startsWith("<"))throw new Error("Authentication failed: server returned a login page instead of data. Re-run `join <url>`.");const r=await i.json();if(!1===r.success)throw new Error(`CTFd error: ${r.errors?.join(", ")||"Unknown error"}`);return r.data}async testConnection(){try{return await this.request("GET","/users/me")}catch(t){if(this.sessionCookie&&(t.message?.includes("403")||t.message?.includes("Authentication failed")))return this.testConnectionViaProfile();throw t}}async testConnectionViaProfile(){const t=await fetch(`${this.baseUrl}/settings`,{headers:{Cookie:this.sessionCookie}});if(!t.ok){if(403===t.status)throw new Error("ACCOUNT_BLOCKED: signed in, but this account is banned / disabled / not enabled for the competition. Use a different account, or contact the organizer.");throw new Error("Session expired or invalid.")}const e=await t.text(),s=e.match(/name="name"[^>]*value="([^"]+)"/)||e.match(/<input[^>]*id="name"[^>]*value="([^"]+)"/),n=e.match(/user_id['":\s]+(\d+)/)||e.match(/userId['":\s]+(\d+)/);if(!s&&!n)throw new Error("Authentication failed: session is not signed in. Re-run `join <url>` and check your username/password.");const o=s?.[1]||"User",i=n?parseInt(n[1],10):0,r=e.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);return r&&(this.csrfNonce=r[1]),{id:i,name:o,score:0,team_id:0,country:""}}async getChallenges(){return this.request("GET","/challenges")}async getChallenge(t){return this.request("GET",`/challenges/${t}`)}async submitFlag(t,e){this.sessionCookie&&!this.csrfNonce&&await this.fetchCsrfNonce();const s=await fetch(`${this.baseUrl}/api/v1/challenges/attempt`,{method:"POST",headers:{...this.getAuthHeaders(),"Content-Type":"application/json"},body:JSON.stringify({challenge_id:t,submission:e})});if(!s.ok){const t=await s.text().catch(()=>"Unknown error");if(t.trimStart().startsWith("<")){if(/banned/i.test(t))throw new Error("Account banned: this account has been banned from the competition. Your submission was not recorded. Contact the organizer if you believe this is an error.");throw new Error("Authentication failed: not signed in (server returned the login page). Re-run `join <url>` and check your username/password.")}throw new Error(`CTFd API error (${s.status}): ${t}`)}return(await s.json()).data}async getScoreboard(){return this.request("GET","/scoreboard")}async getTeam(){return this.request("GET","/teams/me")}async getCompetitionMeta(){const t=await fetch(this.baseUrl),e=await t.text(),s=e.match(/'start'\s*:\s*(\d+)/),n=e.match(/'end'\s*:\s*(\d+)/),o=e.match(/'userMode'\s*:\s*"([^"]+)"/),i=e.match(/'csrfNonce'\s*:\s*"([^"]+)"/);return{start:s?parseInt(s[1],10):null,end:n?parseInt(n[1],10):null,userMode:o?.[1]||"users",csrfNonce:i?.[1]||""}}async getChallengeFiles(t){return(await this.getChallenge(t)).files||[]}async downloadFile(i,r){e(r,{recursive:!0});const a=i.startsWith("http")?i:`${this.baseUrl}/${i.replace(/^\//,"")}`,c=await fetch(a,{headers:this.getAuthHeaders(),redirect:"follow"});if(!c.ok||!c.body)throw new Error(`Failed to download: ${a}`);const h=(i.split("/").pop()||"file").split("?")[0],d=s(r,h),u=t(d);return await n(o.fromWeb(c.body),u),d}async getTokenViaIcoaApi(t,e){const s=JSON.stringify({name:t,password:e}),n={"Content-Type":"application/json"};try{const t=await fetch(`${this.baseUrl}/api/icoa/token`,{method:"POST",headers:n,body:s,signal:AbortSignal.timeout(5e3)});if(t.ok){const e=await t.json();if(e.success&&e.data?.token)return e.data.token}}catch{}try{const t=await fetch(`${this.baseUrl}:9090/api/icoa/token`,{method:"POST",headers:n,body:s,signal:AbortSignal.timeout(5e3)});if(t.ok){const e=await t.json();if(e.success&&e.data?.token)return e.data.token}}catch{}return null}async tokenAuthenticates(t){try{const e=await fetch(`${this.baseUrl}/api/v1/users/me`,{headers:{Authorization:`Token ${t}`,"Content-Type":"application/json"},redirect:"manual",signal:AbortSignal.timeout(5e3)});if(200!==e.status)return!1;if(!(e.headers.get("content-type")||"").includes("application/json"))return!1;const s=await e.json();return!0===s?.success}catch{return!1}}async loginWithCredentials(t,e){const s=await this.getTokenViaIcoaApi(t,e);if(s&&await this.tokenAuthenticates(s))return{token:s,session:"",csrf:""};const n=await fetch(`${this.baseUrl}/login`),o=await n.text(),i=o.match(/name="nonce"[^>]*value="([^"]+)"/)||o.match(/value="([^"]+)"[^>]*name="nonce"/)||o.match(/id="nonce"[^>]*value="([^"]+)"/)||o.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/),r=i?.[1]||"";if(!r)throw new Error("Could not extract CSRF nonce from login page.");const a=n.headers.getSetCookie?.()||[],c=a.map(t=>t.split(";")[0]).join("; "),h=await fetch(`${this.baseUrl}/login`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Cookie:c},body:new URLSearchParams({name:t,password:e,nonce:r,_submit:"Submit"}),redirect:"manual"}),d=h.headers.getSetCookie?.()||[],u=new Map;for(const t of[...a,...d]){const e=t.split(";")[0],s=e.indexOf("=");s>0&&u.set(e.slice(0,s),e.slice(s+1))}const l=[...u.entries()].map(([t,e])=>`${t}=${e}`).join("; "),f=h.headers.get("location")||"";if(!(h.status>=300&&h.status<400)||f.includes("/login"))throw new Error("Invalid username or password.");try{const t=await fetch(`${this.baseUrl}/settings`,{headers:{Cookie:l}}),e=(await t.text()).match(/csrfNonce['":\s]+['"]([^'"]+)['"]/),s=e?.[1]||r,n=await fetch(`${this.baseUrl}/api/v1/tokens`,{method:"POST",headers:{"Content-Type":"application/json",Cookie:l,"CSRF-Token":s},body:JSON.stringify({expiration:"2026-12-31T23:59:59+00:00"})});if(n.ok){const t=await n.json();if(t.success&&t.data?.value)return{token:t.data.value,session:"",csrf:""}}}catch{}let w="";try{const t=await fetch(`${this.baseUrl}/challenges`,{headers:{Cookie:l}}),e=(await t.text()).match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);e&&(w=e[1])}catch{}return{token:"",session:l,csrf:w}}}
+import { createWriteStream, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { Readable } from 'node:stream';
+export class CTFdClient {
+    baseUrl;
+    token;
+    sessionCookie;
+    csrfNonce;
+    constructor(baseUrl, token, sessionCookie, csrfNonce) {
+        this.baseUrl = baseUrl.replace(/\/+$/, '');
+        this.token = token;
+        this.sessionCookie = sessionCookie || '';
+        this.csrfNonce = csrfNonce || '';
+    }
+    getAuthHeaders() {
+        if (this.token) {
+            return { Authorization: `Token ${this.token}` };
+        }
+        if (this.sessionCookie) {
+            const headers = { Cookie: this.sessionCookie };
+            if (this.csrfNonce) {
+                headers['CSRF-Token'] = this.csrfNonce;
+            }
+            return headers;
+        }
+        return {};
+    }
+    async fetchCsrfNonce() {
+        if (this.csrfNonce)
+            return this.csrfNonce;
+        try {
+            const res = await fetch(this.baseUrl, {
+                headers: this.sessionCookie ? { Cookie: this.sessionCookie } : {},
+            });
+            const html = await res.text();
+            const match = html.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
+            if (match) {
+                this.csrfNonce = match[1];
+                return this.csrfNonce;
+            }
+        }
+        catch {
+            /* ignore */
+        }
+        return '';
+    }
+    async request(method, path, body) {
+        // Auto-fetch CSRF nonce for session-based auth
+        if (this.sessionCookie && !this.csrfNonce) {
+            await this.fetchCsrfNonce();
+        }
+        const url = `${this.baseUrl}/api/v1${path}`;
+        const headers = {
+            ...this.getAuthHeaders(),
+        };
+        // Content-Type policy is auth-mode-specific:
+        //  · Session-cookie mode: CTFd returns 403 for a bodyless GET that carries
+        //    `Content-Type: application/json` (it tries to parse an empty body), so
+        //    only set it when there's an actual body — otherwise every CTFd-account
+        //    `join` breaks (challenges/open/scoreboard).
+        //  · Token mode: the OPPOSITE — CTFd's before_request only honors the
+        //    `Authorization: Token …` header when `request.is_json`, so a bodyless
+        //    GET MUST carry `Content-Type: application/json` or CTFd ignores the
+        //    token and 302-redirects to /login. (Token auth takes priority in
+        //    getAuthHeaders, so key off this.token here.)
+        if (body !== undefined || this.token) {
+            headers['Content-Type'] = 'application/json';
+        }
+        const res = await fetch(url, {
+            method,
+            headers,
+            body: body !== undefined ? JSON.stringify(body) : undefined,
+            // Do NOT auto-follow redirects. When the token/session is invalid or
+            // expired, CTFd (account visibility = private) 302-redirects API calls to
+            // the HTML /login page instead of returning 403 JSON. fetch's default
+            // redirect:'follow' lands on that 200 HTML page, and res.json() then throws
+            // the cryptic `Unexpected token '<', "<!DOCTYPE "...`. Catch the 3xx here.
+            redirect: 'manual',
+        });
+        // A redirect (almost always → /login) means we were not authenticated.
+        if (res.status >= 300 && res.status < 400) {
+            throw new Error('Authentication failed: token invalid or expired. Re-run `join <url>` to sign in again.');
+        }
+        if (!res.ok) {
+            const text = await res.text().catch(() => 'Unknown error');
+            // CTFd (account visibility = private) answers an unauthenticated API call
+            // with the HTML login page at 401/403 instead of a JSON error. Dumping that
+            // raw `<!DOCTYPE html>...` page tells the user nothing — surface the same
+            // actionable message as the redirect / 2xx-HTML guards. Keep the phrase
+            // "Authentication failed" so testConnection's session-mode fallback (which
+            // matches on it) still fires. The previous code path leaked the whole login
+            // page on every API call when a join produced an unauthenticated session.
+            if (text.trimStart().startsWith('<')) {
+                // CTFd returns an HTML page (not JSON) for two distinct states. The ban
+                // page carries a recognizable banner ("You have been banned from this
+                // CTF") — when we see it, say so definitively. Otherwise we can't tell a
+                // banned account from an expired session apart from the body alone (a
+                // banned account's /login still 302-redirects, so login "succeeds" but
+                // every API call 403s with HTML), so name both real fixes. (A1)
+                if (/banned/i.test(text)) {
+                    throw new Error('Account banned: this account has been banned from the competition. Contact the organizer if you believe this is an error.');
+                }
+                throw new Error('Access denied (403). Either your session expired — re-run `join <url>` — or this account is banned / not enabled for the competition (try a different account, or contact the organizer).');
+            }
+            throw new Error(`CTFd API error (${res.status}): ${text}`);
+        }
+        // Guard against an HTML body slipping through on a 2xx (proxy/maintenance
+        // page). Without this, res.json() emits the same opaque parse error.
+        const contentType = res.headers.get('content-type') || '';
+        if (!contentType.includes('application/json')) {
+            const text = await res.text().catch(() => '');
+            if (text.trimStart().startsWith('<')) {
+                throw new Error('Authentication failed: server returned a login page instead of data. Re-run `join <url>`.');
+            }
+        }
+        const json = (await res.json());
+        if (json.success === false) {
+            throw new Error(`CTFd error: ${json.errors?.join(', ') || 'Unknown error'}`);
+        }
+        return json.data;
+    }
+    async testConnection() {
+        try {
+            return await this.request('GET', '/users/me');
+        }
+        catch (err) {
+            // Session mode fallback: the API may 403 or (with redirect:'manual')
+            // surface as an "Authentication failed" redirect. Either way, try scraping
+            // the profile page before giving up on a session login.
+            if (this.sessionCookie && (err.message?.includes('403') || err.message?.includes('Authentication failed'))) {
+                return this.testConnectionViaProfile();
+            }
+            throw err;
+        }
+    }
+    async testConnectionViaProfile() {
+        const res = await fetch(`${this.baseUrl}/settings`, {
+            headers: { Cookie: this.sessionCookie },
+        });
+        if (!res.ok) {
+            // A banned / disabled account authenticates (login 302-redirects) but every
+            // authenticated page — including /settings — comes back 403. Surface that as
+            // a distinct, actionable state so `join` doesn't mislabel it "limited API".
+            if (res.status === 403) {
+                throw new Error('ACCOUNT_BLOCKED: signed in, but this account is banned / disabled / not enabled for the competition. Use a different account, or contact the organizer.');
+            }
+            throw new Error('Session expired or invalid.');
+        }
+        const html = await res.text();
+        // Extract user name from settings page
+        const nameMatch = html.match(/name="name"[^>]*value="([^"]+)"/) || html.match(/<input[^>]*id="name"[^>]*value="([^"]+)"/);
+        // Extract user ID from page
+        const idMatch = html.match(/user_id['":\s]+(\d+)/) || html.match(/userId['":\s]+(\d+)/);
+        // When the session is NOT authenticated, /settings redirects to the login
+        // page (HTTP 200) where neither the name input nor a user id exists. The old
+        // code then returned a fabricated {id:0, name:'User'}, so `join` reported a
+        // bogus "Connected" success and the failure only surfaced later on the first
+        // real API call. Treat "no name AND no id" as the login page → fail at join
+        // time with an actionable message.
+        if (!nameMatch && !idMatch) {
+            throw new Error('Authentication failed: session is not signed in. Re-run `join <url>` and check your username/password.');
+        }
+        const name = nameMatch?.[1] || 'User';
+        const id = idMatch ? parseInt(idMatch[1], 10) : 0;
+        // Update CSRF nonce from settings page
+        const csrfMatch = html.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
+        if (csrfMatch)
+            this.csrfNonce = csrfMatch[1];
+        return { id, name, score: 0, team_id: 0, country: '' };
+    }
+    async getChallenges() {
+        return this.request('GET', '/challenges');
+    }
+    async getChallenge(id) {
+        return this.request('GET', `/challenges/${id}`);
+    }
+    async submitFlag(challengeId, submission) {
+        // Session-mode POSTs require a session-bound CSRF token. join() persists the
+        // cookie but not the nonce, so a client rebuilt from config has none → CTFd
+        // rejects the submission with 403. Fetch it on demand (same as request()).
+        if (this.sessionCookie && !this.csrfNonce) {
+            await this.fetchCsrfNonce();
+        }
+        const res = await fetch(`${this.baseUrl}/api/v1/challenges/attempt`, {
+            method: 'POST',
+            headers: {
+                ...this.getAuthHeaders(),
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ challenge_id: challengeId, submission }),
+        });
+        if (!res.ok) {
+            const text = await res.text().catch(() => 'Unknown error');
+            if (text.trimStart().startsWith('<')) {
+                // Distinguish a ban from a dead session — same as request(). (A1)
+                if (/banned/i.test(text)) {
+                    throw new Error('Account banned: this account has been banned from the competition. Your submission was not recorded. Contact the organizer if you believe this is an error.');
+                }
+                throw new Error('Authentication failed: not signed in (server returned the login page). Re-run `join <url>` and check your username/password.');
+            }
+            throw new Error(`CTFd API error (${res.status}): ${text}`);
+        }
+        const json = (await res.json());
+        return json.data;
+    }
+    async getScoreboard() {
+        return this.request('GET', '/scoreboard');
+    }
+    async getTeam() {
+        return this.request('GET', '/teams/me');
+    }
+    async getCompetitionMeta() {
+        const res = await fetch(this.baseUrl);
+        const html = await res.text();
+        const startMatch = html.match(/'start'\s*:\s*(\d+)/);
+        const endMatch = html.match(/'end'\s*:\s*(\d+)/);
+        const modeMatch = html.match(/'userMode'\s*:\s*"([^"]+)"/);
+        const csrfMatch = html.match(/'csrfNonce'\s*:\s*"([^"]+)"/);
+        return {
+            start: startMatch ? parseInt(startMatch[1], 10) : null,
+            end: endMatch ? parseInt(endMatch[1], 10) : null,
+            userMode: modeMatch?.[1] || 'users',
+            csrfNonce: csrfMatch?.[1] || '',
+        };
+    }
+    async getChallengeFiles(id) {
+        const challenge = await this.getChallenge(id);
+        return challenge.files || [];
+    }
+    async downloadFile(filePath, destDir) {
+        mkdirSync(destDir, { recursive: true });
+        const url = filePath.startsWith('http') ? filePath : `${this.baseUrl}/${filePath.replace(/^\//, '')}`;
+        const res = await fetch(url, {
+            headers: this.getAuthHeaders(),
+            redirect: 'follow',
+        });
+        if (!res.ok || !res.body) {
+            throw new Error(`Failed to download: ${url}`);
+        }
+        const rawName = filePath.split('/').pop() || 'file';
+        const fileName = rawName.split('?')[0];
+        const destPath = join(destDir, fileName);
+        const fileStream = createWriteStream(destPath);
+        await pipeline(Readable.fromWeb(res.body), fileStream);
+        return destPath;
+    }
+    async getTokenViaIcoaApi(username, password) {
+        const body = JSON.stringify({ name: username, password });
+        const headers = { 'Content-Type': 'application/json' };
+        // Try via nginx proxy first (same origin, no port)
+        try {
+            const res = await fetch(`${this.baseUrl}/api/icoa/token`, {
+                method: 'POST',
+                headers,
+                body,
+                signal: AbortSignal.timeout(5000),
+            });
+            if (res.ok) {
+                const json = (await res.json());
+                if (json.success && json.data?.token)
+                    return json.data.token;
+            }
+        }
+        catch {
+            /* proxy not available */
+        }
+        // Fallback: direct port 9090
+        try {
+            const res = await fetch(`${this.baseUrl}:9090/api/icoa/token`, {
+                method: 'POST',
+                headers,
+                body,
+                signal: AbortSignal.timeout(5000),
+            });
+            if (res.ok) {
+                const json = (await res.json());
+                if (json.success && json.data?.token)
+                    return json.data.token;
+            }
+        }
+        catch {
+            /* API not available */
+        }
+        return null;
+    }
+    // Verify a token actually authenticates against CTFd. The ICOA token API
+    // (handle_token) returns whatever token row exists for a user WITHOUT checking
+    // expiration, so a stale token comes back looking valid. Probe /users/me with
+    // it (manual redirect → a 302 to /login = not authenticated) before trusting
+    // it; otherwise the caller would short-circuit a working session login.
+    //
+    // CTFd's before_request token loader only honors an `Authorization: Token …`
+    // header when `request.is_json` is true — i.e. the request MUST carry
+    // `Content-Type: application/json`. Without it CTFd silently ignores the token
+    // and 302-redirects this @authed_only endpoint to /login, so a perfectly valid
+    // token looks unauthenticated and every join fell through to session mode.
+    async tokenAuthenticates(token) {
+        try {
+            const res = await fetch(`${this.baseUrl}/api/v1/users/me`, {
+                headers: { Authorization: `Token ${token}`, 'Content-Type': 'application/json' },
+                redirect: 'manual',
+                signal: AbortSignal.timeout(5000),
+            });
+            if (res.status !== 200)
+                return false;
+            if (!(res.headers.get('content-type') || '').includes('application/json'))
+                return false;
+            const json = (await res.json());
+            return json?.success === true;
+        }
+        catch {
+            return false;
+        }
+    }
+    async loginWithCredentials(username, password) {
+        // Try ICOA token API first (fastest path). Only trust the token if it really
+        // authenticates — a stale token row (e.g. account ppdd) would otherwise lock
+        // the user out, since we'd skip the standard session login that still works.
+        const icoaToken = await this.getTokenViaIcoaApi(username, password);
+        if (icoaToken && (await this.tokenAuthenticates(icoaToken))) {
+            return { token: icoaToken, session: '', csrf: '' };
+        }
+        // icoaToken missing or stale → fall through to the standard CTFd /login flow,
+        // which re-establishes a working session and mints a fresh API token.
+        // Fallback: standard CTFd login flow
+        // Step 1: GET /login to get nonce
+        const loginPageRes = await fetch(`${this.baseUrl}/login`);
+        const loginHtml = await loginPageRes.text();
+        const nonceMatch = loginHtml.match(/name="nonce"[^>]*value="([^"]+)"/) ||
+            loginHtml.match(/value="([^"]+)"[^>]*name="nonce"/) ||
+            loginHtml.match(/id="nonce"[^>]*value="([^"]+)"/) ||
+            loginHtml.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
+        const nonce = nonceMatch?.[1] || '';
+        if (!nonce) {
+            throw new Error('Could not extract CSRF nonce from login page.');
+        }
+        const cookies = loginPageRes.headers.getSetCookie?.() || [];
+        const cookieStr = cookies.map((c) => c.split(';')[0]).join('; ');
+        // Step 2: POST /login with credentials
+        const loginRes = await fetch(`${this.baseUrl}/login`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Cookie: cookieStr,
+            },
+            body: new URLSearchParams({ name: username, password, nonce, _submit: 'Submit' }),
+            redirect: 'manual',
+        });
+        const loginCookies = loginRes.headers.getSetCookie?.() || [];
+        // Dedupe by cookie name, letting the post-login Set-Cookie win. Otherwise
+        // we'd send `session=<pre-login>; session=<post-login>` and CTFd honours the
+        // first (unauthenticated) one, serving the login page (200 HTML) for every
+        // API call → "failed to load challenges" for CTFd-account logins.
+        const cookieJar = new Map();
+        for (const c of [...cookies, ...loginCookies]) {
+            const pair = c.split(';')[0];
+            const eq = pair.indexOf('=');
+            if (eq > 0)
+                cookieJar.set(pair.slice(0, eq), pair.slice(eq + 1));
+        }
+        const allCookies = [...cookieJar.entries()].map(([k, v]) => `${k}=${v}`).join('; ');
+        // A successful CTFd login is a 3xx redirect away from /login (→ /challenges
+        // or /). A wrong password re-renders the login page at HTTP 200 with NO
+        // redirect ("Your username or password is incorrect"). The old check only
+        // caught a /login redirect, so a typo'd password slipped through as a fake
+        // success: an unauthenticated session that then failed downstream with the
+        // cryptic "Connected (session mode — limited API)" + `<!DOCTYPE` on every
+        // API call. Require a real redirect that isn't back to /login.
+        const location = loginRes.headers.get('location') || '';
+        const redirected = loginRes.status >= 300 && loginRes.status < 400;
+        if (!redirected || location.includes('/login')) {
+            throw new Error('Invalid username or password.');
+        }
+        // Step 3: Try to generate API token (some CTFd instances allow it)
+        try {
+            const settingsRes = await fetch(`${this.baseUrl}/settings`, {
+                headers: { Cookie: allCookies },
+            });
+            const settingsHtml = await settingsRes.text();
+            const csrfMatch = settingsHtml.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
+            const csrfNonce = csrfMatch?.[1] || nonce;
+            const tokenRes = await fetch(`${this.baseUrl}/api/v1/tokens`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Cookie: allCookies,
+                    'CSRF-Token': csrfNonce,
+                },
+                body: JSON.stringify({ expiration: '2026-12-31T23:59:59+00:00' }),
+            });
+            if (tokenRes.ok) {
+                const tokenJson = (await tokenRes.json());
+                if (tokenJson.success && tokenJson.data?.value) {
+                    return { token: tokenJson.data.value, session: '', csrf: '' };
+                }
+            }
+        }
+        catch {
+            /* Token generation not available, use session */
+        }
+        // Fallback: use session cookie + CSRF nonce
+        // Get CSRF nonce from the main page
+        let csrf = '';
+        try {
+            const mainRes = await fetch(`${this.baseUrl}/challenges`, { headers: { Cookie: allCookies } });
+            const mainHtml = await mainRes.text();
+            const csrfMatch = mainHtml.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
+            if (csrfMatch)
+                csrf = csrfMatch[1];
+        }
+        catch {
+            /* ignore */
+        }
+        return { token: '', session: allCookies, csrf };
+    }
+}