icoa-cli 2.19.357 → 2.19.358

package/dist/lib/countdown.js

@@ -1,43 +1 @@
-/**
- * 5-4-3-2-1 countdown wrapper for in-flight fetches.
- *
- * Wraps a promise with a visible countdown so the user has something to
- * watch instead of a spinner. If the promise resolves DURING countdown,
- * the remaining seconds are skipped and the line is cleared. If the
- * promise hasn't resolved by the time countdown ends, a "wait" message
- * stays on screen until it finishes.
- *
- * Deliberately avoids mentioning servers, network, or any architectural
- * detail — students should experience the operation as one unbroken
- * "ICOA does it" magic moment.
- */
-import chalk from 'chalk';
-export async function fetchWithCountdown(fetchPromise, opts = {}) {
-    // 15s default — covers cold-start renders (model lazy-load + 90-frame
-    // baseline) without the "one more moment..." fallback firing too often.
-    // Warm-cache calls finish in 4-7s and the countdown exits early —
-    // no UX penalty.
-    const startSeconds = opts.from ?? 15;
-    const waitText = opts.waitText ?? '  one more moment...';
-    let resolved = false;
-    fetchPromise.then(() => {
-        resolved = true;
-    }, () => {
-        resolved = true;
-    });
-    for (let i = startSeconds; i >= 1; i--) {
-        if (resolved)
-            break;
-        // \r overwrites the same line. Pad with spaces to clear any prior
-        // longer text (e.g. on countdown from 10 → 9, the second char needs clearing).
-        process.stdout.write('\r' + chalk.bold.cyan(`  ${i}`) + chalk.gray(' ...').padEnd(40, ' '));
-        await new Promise((r) => setTimeout(r, 1000));
-    }
-    // Clear the countdown line
-    process.stdout.write('\r' + ' '.repeat(40) + '\r');
-    if (!resolved) {
-        // Stay-and-wait message — never mention WHY it's slow
-        process.stdout.write(chalk.gray(waitText) + '\n');
-    }
-    return fetchPromise;
-}
+import chalk from"chalk";export async function fetchWithCountdown(t,e={}){const o=e.from??15,r=e.waitText??"  one more moment...";let n=!1;t.then(()=>{n=!0},()=>{n=!0});for(let t=o;t>=1&&!n;t--)process.stdout.write("\r"+chalk.bold.cyan(`  ${t}`)+chalk.gray(" ...").padEnd(40," ")),await new Promise(t=>setTimeout(t,1e3));return process.stdout.write("\r"+" ".repeat(40)+"\r"),n||process.stdout.write(chalk.gray(r)+"\n"),t}

package/dist/lib/country-lang.js

@@ -1,39 +1 @@
-export const COUNTRY_LANG = {
-    UA: 'uk',
-    PE: 'es',
-    CN: 'zh',
-    AU: 'en',
-    JP: 'ja',
-    KR: 'ko',
-    BR: 'pt',
-    SA: 'ar',
-    FR: 'fr',
-    DE: 'de',
-    IN: 'hi',
-    ID: 'id',
-    TH: 'th',
-    VN: 'vi',
-    TR: 'tr',
-    RU: 'ru',
-    EG: 'ar',
-    HT: 'ht',
-    PH: 'en',
-    MY: 'en',
-    MM: 'en',
-    SG: 'en',
-    ZA: 'en',
-    KE: 'sw',
-    TZ: 'sw',
-    MO: 'zh',
-    UZ: 'uz',
-    GH: 'en',
-    LA: 'lo',
-    BD: 'bn',
-    BI: 'fr',
-    US: 'en',
-    UK: 'en',
-    NZ: 'en',
-    LK: 'si',
-    BW: 'en',
-    VE: 'es',
-};
+export const COUNTRY_LANG={UA:"uk",PE:"es",CN:"zh",AU:"en",JP:"ja",KR:"ko",BR:"pt",SA:"ar",FR:"fr",DE:"de",IN:"hi",ID:"id",TH:"th",VN:"vi",TR:"tr",RU:"ru",EG:"ar",HT:"ht",PH:"en",MY:"en",MM:"en",SG:"en",ZA:"en",KE:"sw",TZ:"sw",MO:"zh",UZ:"uz",GH:"en",LA:"lo",BD:"bn",BI:"fr",US:"en",UK:"en",NZ:"en",LK:"si",BW:"en",VE:"es"};

package/dist/lib/ctfd-client.js

@@ -1,417 +1 @@
-import { createWriteStream, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { pipeline } from 'node:stream/promises';
-import { Readable } from 'node:stream';
-export class CTFdClient {
-    baseUrl;
-    token;
-    sessionCookie;
-    csrfNonce;
-    constructor(baseUrl, token, sessionCookie, csrfNonce) {
-        this.baseUrl = baseUrl.replace(/\/+$/, '');
-        this.token = token;
-        this.sessionCookie = sessionCookie || '';
-        this.csrfNonce = csrfNonce || '';
-    }
-    getAuthHeaders() {
-        if (this.token) {
-            return { Authorization: `Token ${this.token}` };
-        }
-        if (this.sessionCookie) {
-            const headers = { Cookie: this.sessionCookie };
-            if (this.csrfNonce) {
-                headers['CSRF-Token'] = this.csrfNonce;
-            }
-            return headers;
-        }
-        return {};
-    }
-    async fetchCsrfNonce() {
-        if (this.csrfNonce)
-            return this.csrfNonce;
-        try {
-            const res = await fetch(this.baseUrl, {
-                headers: this.sessionCookie ? { Cookie: this.sessionCookie } : {},
-            });
-            const html = await res.text();
-            const match = html.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
-            if (match) {
-                this.csrfNonce = match[1];
-                return this.csrfNonce;
-            }
-        }
-        catch {
-            /* ignore */
-        }
-        return '';
-    }
-    async request(method, path, body) {
-        // Auto-fetch CSRF nonce for session-based auth
-        if (this.sessionCookie && !this.csrfNonce) {
-            await this.fetchCsrfNonce();
-        }
-        const url = `${this.baseUrl}/api/v1${path}`;
-        const headers = {
-            ...this.getAuthHeaders(),
-        };
-        // Content-Type policy is auth-mode-specific:
-        //  · Session-cookie mode: CTFd returns 403 for a bodyless GET that carries
-        //    `Content-Type: application/json` (it tries to parse an empty body), so
-        //    only set it when there's an actual body — otherwise every CTFd-account
-        //    `join` breaks (challenges/open/scoreboard).
-        //  · Token mode: the OPPOSITE — CTFd's before_request only honors the
-        //    `Authorization: Token …` header when `request.is_json`, so a bodyless
-        //    GET MUST carry `Content-Type: application/json` or CTFd ignores the
-        //    token and 302-redirects to /login. (Token auth takes priority in
-        //    getAuthHeaders, so key off this.token here.)
-        if (body !== undefined || this.token) {
-            headers['Content-Type'] = 'application/json';
-        }
-        const res = await fetch(url, {
-            method,
-            headers,
-            body: body !== undefined ? JSON.stringify(body) : undefined,
-            // Do NOT auto-follow redirects. When the token/session is invalid or
-            // expired, CTFd (account visibility = private) 302-redirects API calls to
-            // the HTML /login page instead of returning 403 JSON. fetch's default
-            // redirect:'follow' lands on that 200 HTML page, and res.json() then throws
-            // the cryptic `Unexpected token '<', "<!DOCTYPE "...`. Catch the 3xx here.
-            redirect: 'manual',
-        });
-        // A redirect (almost always → /login) means we were not authenticated.
-        if (res.status >= 300 && res.status < 400) {
-            throw new Error('Authentication failed: token invalid or expired. Re-run `join <url>` to sign in again.');
-        }
-        if (!res.ok) {
-            const text = await res.text().catch(() => 'Unknown error');
-            // CTFd (account visibility = private) answers an unauthenticated API call
-            // with the HTML login page at 401/403 instead of a JSON error. Dumping that
-            // raw `<!DOCTYPE html>...` page tells the user nothing — surface the same
-            // actionable message as the redirect / 2xx-HTML guards. Keep the phrase
-            // "Authentication failed" so testConnection's session-mode fallback (which
-            // matches on it) still fires. The previous code path leaked the whole login
-            // page on every API call when a join produced an unauthenticated session.
-            if (text.trimStart().startsWith('<')) {
-                // CTFd returns an HTML page (not JSON) for two distinct states. The ban
-                // page carries a recognizable banner ("You have been banned from this
-                // CTF") — when we see it, say so definitively. Otherwise we can't tell a
-                // banned account from an expired session apart from the body alone (a
-                // banned account's /login still 302-redirects, so login "succeeds" but
-                // every API call 403s with HTML), so name both real fixes. (A1)
-                if (/banned/i.test(text)) {
-                    throw new Error('Account banned: this account has been banned from the competition. Contact the organizer if you believe this is an error.');
-                }
-                throw new Error('Access denied (403). Either your session expired — re-run `join <url>` — or this account is banned / not enabled for the competition (try a different account, or contact the organizer).');
-            }
-            throw new Error(`CTFd API error (${res.status}): ${text}`);
-        }
-        // Guard against an HTML body slipping through on a 2xx (proxy/maintenance
-        // page). Without this, res.json() emits the same opaque parse error.
-        const contentType = res.headers.get('content-type') || '';
-        if (!contentType.includes('application/json')) {
-            const text = await res.text().catch(() => '');
-            if (text.trimStart().startsWith('<')) {
-                throw new Error('Authentication failed: server returned a login page instead of data. Re-run `join <url>`.');
-            }
-        }
-        const json = (await res.json());
-        if (json.success === false) {
-            throw new Error(`CTFd error: ${json.errors?.join(', ') || 'Unknown error'}`);
-        }
-        return json.data;
-    }
-    async testConnection() {
-        try {
-            return await this.request('GET', '/users/me');
-        }
-        catch (err) {
-            // Session mode fallback: the API may 403 or (with redirect:'manual')
-            // surface as an "Authentication failed" redirect. Either way, try scraping
-            // the profile page before giving up on a session login.
-            if (this.sessionCookie && (err.message?.includes('403') || err.message?.includes('Authentication failed'))) {
-                return this.testConnectionViaProfile();
-            }
-            throw err;
-        }
-    }
-    async testConnectionViaProfile() {
-        const res = await fetch(`${this.baseUrl}/settings`, {
-            headers: { Cookie: this.sessionCookie },
-        });
-        if (!res.ok) {
-            // A banned / disabled account authenticates (login 302-redirects) but every
-            // authenticated page — including /settings — comes back 403. Surface that as
-            // a distinct, actionable state so `join` doesn't mislabel it "limited API".
-            if (res.status === 403) {
-                throw new Error('ACCOUNT_BLOCKED: signed in, but this account is banned / disabled / not enabled for the competition. Use a different account, or contact the organizer.');
-            }
-            throw new Error('Session expired or invalid.');
-        }
-        const html = await res.text();
-        // Extract user name from settings page
-        const nameMatch = html.match(/name="name"[^>]*value="([^"]+)"/) || html.match(/<input[^>]*id="name"[^>]*value="([^"]+)"/);
-        // Extract user ID from page
-        const idMatch = html.match(/user_id['":\s]+(\d+)/) || html.match(/userId['":\s]+(\d+)/);
-        // When the session is NOT authenticated, /settings redirects to the login
-        // page (HTTP 200) where neither the name input nor a user id exists. The old
-        // code then returned a fabricated {id:0, name:'User'}, so `join` reported a
-        // bogus "Connected" success and the failure only surfaced later on the first
-        // real API call. Treat "no name AND no id" as the login page → fail at join
-        // time with an actionable message.
-        if (!nameMatch && !idMatch) {
-            throw new Error('Authentication failed: session is not signed in. Re-run `join <url>` and check your username/password.');
-        }
-        const name = nameMatch?.[1] || 'User';
-        const id = idMatch ? parseInt(idMatch[1], 10) : 0;
-        // Update CSRF nonce from settings page
-        const csrfMatch = html.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
-        if (csrfMatch)
-            this.csrfNonce = csrfMatch[1];
-        return { id, name, score: 0, team_id: 0, country: '' };
-    }
-    async getChallenges() {
-        return this.request('GET', '/challenges');
-    }
-    async getChallenge(id) {
-        return this.request('GET', `/challenges/${id}`);
-    }
-    async submitFlag(challengeId, submission) {
-        // Session-mode POSTs require a session-bound CSRF token. join() persists the
-        // cookie but not the nonce, so a client rebuilt from config has none → CTFd
-        // rejects the submission with 403. Fetch it on demand (same as request()).
-        if (this.sessionCookie && !this.csrfNonce) {
-            await this.fetchCsrfNonce();
-        }
-        const res = await fetch(`${this.baseUrl}/api/v1/challenges/attempt`, {
-            method: 'POST',
-            headers: {
-                ...this.getAuthHeaders(),
-                'Content-Type': 'application/json',
-            },
-            body: JSON.stringify({ challenge_id: challengeId, submission }),
-        });
-        if (!res.ok) {
-            const text = await res.text().catch(() => 'Unknown error');
-            if (text.trimStart().startsWith('<')) {
-                // Distinguish a ban from a dead session — same as request(). (A1)
-                if (/banned/i.test(text)) {
-                    throw new Error('Account banned: this account has been banned from the competition. Your submission was not recorded. Contact the organizer if you believe this is an error.');
-                }
-                throw new Error('Authentication failed: not signed in (server returned the login page). Re-run `join <url>` and check your username/password.');
-            }
-            throw new Error(`CTFd API error (${res.status}): ${text}`);
-        }
-        const json = (await res.json());
-        return json.data;
-    }
-    async getScoreboard() {
-        return this.request('GET', '/scoreboard');
-    }
-    async getTeam() {
-        return this.request('GET', '/teams/me');
-    }
-    async getCompetitionMeta() {
-        const res = await fetch(this.baseUrl);
-        const html = await res.text();
-        const startMatch = html.match(/'start'\s*:\s*(\d+)/);
-        const endMatch = html.match(/'end'\s*:\s*(\d+)/);
-        const modeMatch = html.match(/'userMode'\s*:\s*"([^"]+)"/);
-        const csrfMatch = html.match(/'csrfNonce'\s*:\s*"([^"]+)"/);
-        return {
-            start: startMatch ? parseInt(startMatch[1], 10) : null,
-            end: endMatch ? parseInt(endMatch[1], 10) : null,
-            userMode: modeMatch?.[1] || 'users',
-            csrfNonce: csrfMatch?.[1] || '',
-        };
-    }
-    async getChallengeFiles(id) {
-        const challenge = await this.getChallenge(id);
-        return challenge.files || [];
-    }
-    async downloadFile(filePath, destDir) {
-        mkdirSync(destDir, { recursive: true });
-        const url = filePath.startsWith('http') ? filePath : `${this.baseUrl}/${filePath.replace(/^\//, '')}`;
-        const res = await fetch(url, {
-            headers: this.getAuthHeaders(),
-            redirect: 'follow',
-        });
-        if (!res.ok || !res.body) {
-            throw new Error(`Failed to download: ${url}`);
-        }
-        const rawName = filePath.split('/').pop() || 'file';
-        const fileName = rawName.split('?')[0];
-        const destPath = join(destDir, fileName);
-        const fileStream = createWriteStream(destPath);
-        await pipeline(Readable.fromWeb(res.body), fileStream);
-        return destPath;
-    }
-    async getTokenViaIcoaApi(username, password) {
-        const body = JSON.stringify({ name: username, password });
-        const headers = { 'Content-Type': 'application/json' };
-        // Try via nginx proxy first (same origin, no port)
-        try {
-            const res = await fetch(`${this.baseUrl}/api/icoa/token`, {
-                method: 'POST',
-                headers,
-                body,
-                signal: AbortSignal.timeout(5000),
-            });
-            if (res.ok) {
-                const json = (await res.json());
-                if (json.success && json.data?.token)
-                    return json.data.token;
-            }
-        }
-        catch {
-            /* proxy not available */
-        }
-        // Fallback: direct port 9090
-        try {
-            const res = await fetch(`${this.baseUrl}:9090/api/icoa/token`, {
-                method: 'POST',
-                headers,
-                body,
-                signal: AbortSignal.timeout(5000),
-            });
-            if (res.ok) {
-                const json = (await res.json());
-                if (json.success && json.data?.token)
-                    return json.data.token;
-            }
-        }
-        catch {
-            /* API not available */
-        }
-        return null;
-    }
-    // Verify a token actually authenticates against CTFd. The ICOA token API
-    // (handle_token) returns whatever token row exists for a user WITHOUT checking
-    // expiration, so a stale token comes back looking valid. Probe /users/me with
-    // it (manual redirect → a 302 to /login = not authenticated) before trusting
-    // it; otherwise the caller would short-circuit a working session login.
-    //
-    // CTFd's before_request token loader only honors an `Authorization: Token …`
-    // header when `request.is_json` is true — i.e. the request MUST carry
-    // `Content-Type: application/json`. Without it CTFd silently ignores the token
-    // and 302-redirects this @authed_only endpoint to /login, so a perfectly valid
-    // token looks unauthenticated and every join fell through to session mode.
-    async tokenAuthenticates(token) {
-        try {
-            const res = await fetch(`${this.baseUrl}/api/v1/users/me`, {
-                headers: { Authorization: `Token ${token}`, 'Content-Type': 'application/json' },
-                redirect: 'manual',
-                signal: AbortSignal.timeout(5000),
-            });
-            if (res.status !== 200)
-                return false;
-            if (!(res.headers.get('content-type') || '').includes('application/json'))
-                return false;
-            const json = (await res.json());
-            return json?.success === true;
-        }
-        catch {
-            return false;
-        }
-    }
-    async loginWithCredentials(username, password) {
-        // Try ICOA token API first (fastest path). Only trust the token if it really
-        // authenticates — a stale token row (e.g. account ppdd) would otherwise lock
-        // the user out, since we'd skip the standard session login that still works.
-        const icoaToken = await this.getTokenViaIcoaApi(username, password);
-        if (icoaToken && (await this.tokenAuthenticates(icoaToken))) {
-            return { token: icoaToken, session: '', csrf: '' };
-        }
-        // icoaToken missing or stale → fall through to the standard CTFd /login flow,
-        // which re-establishes a working session and mints a fresh API token.
-        // Fallback: standard CTFd login flow
-        // Step 1: GET /login to get nonce
-        const loginPageRes = await fetch(`${this.baseUrl}/login`);
-        const loginHtml = await loginPageRes.text();
-        const nonceMatch = loginHtml.match(/name="nonce"[^>]*value="([^"]+)"/) ||
-            loginHtml.match(/value="([^"]+)"[^>]*name="nonce"/) ||
-            loginHtml.match(/id="nonce"[^>]*value="([^"]+)"/) ||
-            loginHtml.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
-        const nonce = nonceMatch?.[1] || '';
-        if (!nonce) {
-            throw new Error('Could not extract CSRF nonce from login page.');
-        }
-        const cookies = loginPageRes.headers.getSetCookie?.() || [];
-        const cookieStr = cookies.map((c) => c.split(';')[0]).join('; ');
-        // Step 2: POST /login with credentials
-        const loginRes = await fetch(`${this.baseUrl}/login`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-                Cookie: cookieStr,
-            },
-            body: new URLSearchParams({ name: username, password, nonce, _submit: 'Submit' }),
-            redirect: 'manual',
-        });
-        const loginCookies = loginRes.headers.getSetCookie?.() || [];
-        // Dedupe by cookie name, letting the post-login Set-Cookie win. Otherwise
-        // we'd send `session=<pre-login>; session=<post-login>` and CTFd honours the
-        // first (unauthenticated) one, serving the login page (200 HTML) for every
-        // API call → "failed to load challenges" for CTFd-account logins.
-        const cookieJar = new Map();
-        for (const c of [...cookies, ...loginCookies]) {
-            const pair = c.split(';')[0];
-            const eq = pair.indexOf('=');
-            if (eq > 0)
-                cookieJar.set(pair.slice(0, eq), pair.slice(eq + 1));
-        }
-        const allCookies = [...cookieJar.entries()].map(([k, v]) => `${k}=${v}`).join('; ');
-        // A successful CTFd login is a 3xx redirect away from /login (→ /challenges
-        // or /). A wrong password re-renders the login page at HTTP 200 with NO
-        // redirect ("Your username or password is incorrect"). The old check only
-        // caught a /login redirect, so a typo'd password slipped through as a fake
-        // success: an unauthenticated session that then failed downstream with the
-        // cryptic "Connected (session mode — limited API)" + `<!DOCTYPE` on every
-        // API call. Require a real redirect that isn't back to /login.
-        const location = loginRes.headers.get('location') || '';
-        const redirected = loginRes.status >= 300 && loginRes.status < 400;
-        if (!redirected || location.includes('/login')) {
-            throw new Error('Invalid username or password.');
-        }
-        // Step 3: Try to generate API token (some CTFd instances allow it)
-        try {
-            const settingsRes = await fetch(`${this.baseUrl}/settings`, {
-                headers: { Cookie: allCookies },
-            });
-            const settingsHtml = await settingsRes.text();
-            const csrfMatch = settingsHtml.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
-            const csrfNonce = csrfMatch?.[1] || nonce;
-            const tokenRes = await fetch(`${this.baseUrl}/api/v1/tokens`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json',
-                    Cookie: allCookies,
-                    'CSRF-Token': csrfNonce,
-                },
-                body: JSON.stringify({ expiration: '2026-12-31T23:59:59+00:00' }),
-            });
-            if (tokenRes.ok) {
-                const tokenJson = (await tokenRes.json());
-                if (tokenJson.success && tokenJson.data?.value) {
-                    return { token: tokenJson.data.value, session: '', csrf: '' };
-                }
-            }
-        }
-        catch {
-            /* Token generation not available, use session */
-        }
-        // Fallback: use session cookie + CSRF nonce
-        // Get CSRF nonce from the main page
-        let csrf = '';
-        try {
-            const mainRes = await fetch(`${this.baseUrl}/challenges`, { headers: { Cookie: allCookies } });
-            const mainHtml = await mainRes.text();
-            const csrfMatch = mainHtml.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);
-            if (csrfMatch)
-                csrf = csrfMatch[1];
-        }
-        catch {
-            /* ignore */
-        }
-        return { token: '', session: allCookies, csrf };
-    }
-}
+import{createWriteStream as t,mkdirSync as e}from"node:fs";import{join as s}from"node:path";import{pipeline as n}from"node:stream/promises";import{Readable as o}from"node:stream";export class CTFdClient{baseUrl;token;sessionCookie;csrfNonce;constructor(t,e,s,n){this.baseUrl=t.replace(/\/+$/,""),this.token=e,this.sessionCookie=s||"",this.csrfNonce=n||""}getAuthHeaders(){if(this.token)return{Authorization:`Token ${this.token}`};if(this.sessionCookie){const t={Cookie:this.sessionCookie};return this.csrfNonce&&(t["CSRF-Token"]=this.csrfNonce),t}return{}}async fetchCsrfNonce(){if(this.csrfNonce)return this.csrfNonce;try{const t=await fetch(this.baseUrl,{headers:this.sessionCookie?{Cookie:this.sessionCookie}:{}}),e=(await t.text()).match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);if(e)return this.csrfNonce=e[1],this.csrfNonce}catch{}return""}async request(t,e,s){this.sessionCookie&&!this.csrfNonce&&await this.fetchCsrfNonce();const n=`${this.baseUrl}/api/v1${e}`,o={...this.getAuthHeaders()};(void 0!==s||this.token)&&(o["Content-Type"]="application/json");const i=await fetch(n,{method:t,headers:o,body:void 0!==s?JSON.stringify(s):void 0,redirect:"manual"});if(i.status>=300&&i.status<400)throw new Error("Authentication failed: token invalid or expired. Re-run `join <url>` to sign in again.");if(!i.ok){const t=await i.text().catch(()=>"Unknown error");if(t.trimStart().startsWith("<")){if(/banned/i.test(t))throw new Error("Account banned: this account has been banned from the competition. Contact the organizer if you believe this is an error.");throw new Error("Access denied (403). Either your session expired — re-run `join <url>` — or this account is banned / not enabled for the competition (try a different account, or contact the organizer).")}throw new Error(`CTFd API error (${i.status}): ${t}`)}if(!(i.headers.get("content-type")||"").includes("application/json")&&(await i.text().catch(()=>"")).trimStart().startsWith("<"))throw new Error("Authentication failed: server returned a login page instead of data. Re-run `join <url>`.");const r=await i.json();if(!1===r.success)throw new Error(`CTFd error: ${r.errors?.join(", ")||"Unknown error"}`);return r.data}async testConnection(){try{return await this.request("GET","/users/me")}catch(t){if(this.sessionCookie&&(t.message?.includes("403")||t.message?.includes("Authentication failed")))return this.testConnectionViaProfile();throw t}}async testConnectionViaProfile(){const t=await fetch(`${this.baseUrl}/settings`,{headers:{Cookie:this.sessionCookie}});if(!t.ok){if(403===t.status)throw new Error("ACCOUNT_BLOCKED: signed in, but this account is banned / disabled / not enabled for the competition. Use a different account, or contact the organizer.");throw new Error("Session expired or invalid.")}const e=await t.text(),s=e.match(/name="name"[^>]*value="([^"]+)"/)||e.match(/<input[^>]*id="name"[^>]*value="([^"]+)"/),n=e.match(/user_id['":\s]+(\d+)/)||e.match(/userId['":\s]+(\d+)/);if(!s&&!n)throw new Error("Authentication failed: session is not signed in. Re-run `join <url>` and check your username/password.");const o=s?.[1]||"User",i=n?parseInt(n[1],10):0,r=e.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);return r&&(this.csrfNonce=r[1]),{id:i,name:o,score:0,team_id:0,country:""}}async getChallenges(){return this.request("GET","/challenges")}async getChallenge(t){return this.request("GET",`/challenges/${t}`)}async submitFlag(t,e){this.sessionCookie&&!this.csrfNonce&&await this.fetchCsrfNonce();const s=await fetch(`${this.baseUrl}/api/v1/challenges/attempt`,{method:"POST",headers:{...this.getAuthHeaders(),"Content-Type":"application/json"},body:JSON.stringify({challenge_id:t,submission:e})});if(!s.ok){const t=await s.text().catch(()=>"Unknown error");if(t.trimStart().startsWith("<")){if(/banned/i.test(t))throw new Error("Account banned: this account has been banned from the competition. Your submission was not recorded. Contact the organizer if you believe this is an error.");throw new Error("Authentication failed: not signed in (server returned the login page). Re-run `join <url>` and check your username/password.")}throw new Error(`CTFd API error (${s.status}): ${t}`)}return(await s.json()).data}async getScoreboard(){return this.request("GET","/scoreboard")}async getTeam(){return this.request("GET","/teams/me")}async getCompetitionMeta(){const t=await fetch(this.baseUrl),e=await t.text(),s=e.match(/'start'\s*:\s*(\d+)/),n=e.match(/'end'\s*:\s*(\d+)/),o=e.match(/'userMode'\s*:\s*"([^"]+)"/),i=e.match(/'csrfNonce'\s*:\s*"([^"]+)"/);return{start:s?parseInt(s[1],10):null,end:n?parseInt(n[1],10):null,userMode:o?.[1]||"users",csrfNonce:i?.[1]||""}}async getChallengeFiles(t){return(await this.getChallenge(t)).files||[]}async downloadFile(i,r){e(r,{recursive:!0});const a=i.startsWith("http")?i:`${this.baseUrl}/${i.replace(/^\//,"")}`,c=await fetch(a,{headers:this.getAuthHeaders(),redirect:"follow"});if(!c.ok||!c.body)throw new Error(`Failed to download: ${a}`);const h=(i.split("/").pop()||"file").split("?")[0],d=s(r,h),u=t(d);return await n(o.fromWeb(c.body),u),d}async getTokenViaIcoaApi(t,e){const s=JSON.stringify({name:t,password:e}),n={"Content-Type":"application/json"};try{const t=await fetch(`${this.baseUrl}/api/icoa/token`,{method:"POST",headers:n,body:s,signal:AbortSignal.timeout(5e3)});if(t.ok){const e=await t.json();if(e.success&&e.data?.token)return e.data.token}}catch{}try{const t=await fetch(`${this.baseUrl}:9090/api/icoa/token`,{method:"POST",headers:n,body:s,signal:AbortSignal.timeout(5e3)});if(t.ok){const e=await t.json();if(e.success&&e.data?.token)return e.data.token}}catch{}return null}async tokenAuthenticates(t){try{const e=await fetch(`${this.baseUrl}/api/v1/users/me`,{headers:{Authorization:`Token ${t}`,"Content-Type":"application/json"},redirect:"manual",signal:AbortSignal.timeout(5e3)});if(200!==e.status)return!1;if(!(e.headers.get("content-type")||"").includes("application/json"))return!1;const s=await e.json();return!0===s?.success}catch{return!1}}async loginWithCredentials(t,e){const s=await this.getTokenViaIcoaApi(t,e);if(s&&await this.tokenAuthenticates(s))return{token:s,session:"",csrf:""};const n=await fetch(`${this.baseUrl}/login`),o=await n.text(),i=o.match(/name="nonce"[^>]*value="([^"]+)"/)||o.match(/value="([^"]+)"[^>]*name="nonce"/)||o.match(/id="nonce"[^>]*value="([^"]+)"/)||o.match(/csrfNonce['":\s]+['"]([^'"]+)['"]/),r=i?.[1]||"";if(!r)throw new Error("Could not extract CSRF nonce from login page.");const a=n.headers.getSetCookie?.()||[],c=a.map(t=>t.split(";")[0]).join("; "),h=await fetch(`${this.baseUrl}/login`,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Cookie:c},body:new URLSearchParams({name:t,password:e,nonce:r,_submit:"Submit"}),redirect:"manual"}),d=h.headers.getSetCookie?.()||[],u=new Map;for(const t of[...a,...d]){const e=t.split(";")[0],s=e.indexOf("=");s>0&&u.set(e.slice(0,s),e.slice(s+1))}const l=[...u.entries()].map(([t,e])=>`${t}=${e}`).join("; "),f=h.headers.get("location")||"";if(!(h.status>=300&&h.status<400)||f.includes("/login"))throw new Error("Invalid username or password.");try{const t=await fetch(`${this.baseUrl}/settings`,{headers:{Cookie:l}}),e=(await t.text()).match(/csrfNonce['":\s]+['"]([^'"]+)['"]/),s=e?.[1]||r,n=await fetch(`${this.baseUrl}/api/v1/tokens`,{method:"POST",headers:{"Content-Type":"application/json",Cookie:l,"CSRF-Token":s},body:JSON.stringify({expiration:"2026-12-31T23:59:59+00:00"})});if(n.ok){const t=await n.json();if(t.success&&t.data?.value)return{token:t.data.value,session:"",csrf:""}}}catch{}let w="";try{const t=await fetch(`${this.baseUrl}/challenges`,{headers:{Cookie:l}}),e=(await t.text()).match(/csrfNonce['":\s]+['"]([^'"]+)['"]/);e&&(w=e[1])}catch{}return{token:"",session:l,csrf:w}}}