pwndoc

package
v0.0.0-...-3593cfe Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 16, 2026 License: MIT Imports: 24 Imported by: 0

Documentation

Overview

Package pwndoc is an idiomatic, zero-dependency Go client for the pwndoc pentest-reporting REST API (https://github.com/pwndoc/pwndoc).

It covers the entire API surface — audits, findings, images, clients, companies, users, the vulnerability template database, data catalogs, report templates, settings and backups — and adds a high-level orchestration layer (see the *Client methods such as NewPentest, AddFindingWithImages, AttachImageToFinding and GenerateReport) so common workflows take only a handful of calls.

Authentication

pwndoc authenticates with a session cookie rather than a bearer token. Call Client.Login (or the Connect helper) once; the client stores the access and refresh tokens and attaches them to subsequent requests, transparently refreshing an expired access token on a 401. 

c, err := pwndoc.Connect(ctx, "https://pwndoc.example.com:8443",
    "user", "pass", pwndoc.WithInsecureTLS())
if err != nil {
    log.Fatal(err)
}
audits, err := c.Audits.List(ctx, nil)

Every method takes a context.Context and returns typed models and *APIError values for server-side failures (classify them with IsNotFound, IsForbidden, and the other package-level helpers).

Example

Example shows the end-to-end happy path: connect, build an engagement by name, add a finding with a captioned screenshot, and generate the report. 

package main

import (
	"context"
	"log"

	pwndoc "github.com/RaynLight/go-pwndocapi/pwndoc"
)

func main() {
	ctx := context.Background()

	c, err := pwndoc.Connect(ctx, "https://pwndoc.example.com:8443",
		"user", "password", pwndoc.WithInsecureTLS())
	if err != nil {
		log.Fatal(err)
	}

	audit, err := c.NewPentest("Acme Web App", "en", "Penetration Test").
		Company("Acme Corp").
		Client("ciso@acme.test", "Dana", "Lee").
		Scope("app.acme.test", "api.acme.test").
		Dates("2026-06-15", "2026-06-20").
		Run(ctx)
	if err != nil {
		log.Fatal(err)
	}

	if _, err := c.AddFindingWithImages(ctx, audit.ID,
		pwndoc.Finding{
			Title:    "SQL Injection in login form",
			Priority: pwndoc.PriorityHigh,
			CVSSv3:   "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
		},
		pwndoc.FindingImageGroup{
			Text:   "<p>Proof of concept:</p>",
			Images: []pwndoc.ImageSpec{{Path: "screenshots/sqli.png", Caption: "Figure 1 - SQLi"}},
		},
	); err != nil {
		log.Fatal(err)
	}

	if _, err := c.GenerateReport(ctx, audit.ID, "out/acme-report.docx"); err != nil {
		log.Fatal(err)
	}
}

Index

Examples

Constants

View Source 
const LineBreak = "<br>"

LineBreak is a <br>.

View Source 
const NotDefined = "X"

NotDefined is the universal "X" value for any modified/environmental metric.

View Source 
const (
	// Version is the library version, sent in the default User-Agent.
	Version = "0.2.0"
)

Variables

View Source 
var (
	// ErrNotAuthenticated is returned when an authenticated request is attempted
	// before a successful Login (or after the session was cleared).
	ErrNotAuthenticated = errors.New("pwndoc: not authenticated (call Login first)")
	// ErrRefreshFailed indicates the refresh token could not be exchanged.
	ErrRefreshFailed = errors.New("pwndoc: token refresh failed")
	// ErrNoTOTP indicates the account requires a TOTP token to log in.
	ErrNoTOTP = errors.New("pwndoc: account requires a TOTP token")
	// ErrEmptyID indicates a required resource id argument was empty.
	ErrEmptyID = errors.New("pwndoc: empty id")
)

Sentinel errors, comparable with errors.Is.

Functions

func Bold 

func Bold(text string) string

Bold wraps text in <strong> (renders bold).

func Bool 

func Bool(b bool) *bool

Bool returns a pointer to b. Convenience alias for Ptr[bool].

func Bullets 

func Bullets(items ...string) string

Bullets renders an unordered (<ul>) list. Each item is inline HTML (use Esc for literal text).

func Code 

func Code(text string) string

Code wraps text in inline <code>.

func CodeBlock 

func CodeBlock(lang, text string) string

CodeBlock wraps text in a <pre><code class="language-<lang>"> block; pwndoc applies syntax highlighting using the language hint (e.g. "bash", "http", "json"). Pass an empty lang for plain preformatted text.

func DataURI 

func DataURI(mimeType string, data []byte) string

DataURI builds a "data:<mime>;base64,<...>" string from raw bytes.

func Esc 

func Esc(s string) string

Esc HTML-escapes a string for safe inclusion as rich-text content.

func FormattingShowcase 

func FormattingShowcase() string

FormattingShowcase returns rich-text HTML demonstrating every formatting style pwndoc renders in the .docx — bold, italic, underline, strikethrough, highlight (multiple colors), inline code, a syntax-highlighted code block, a heading, and both list types. Drop it into any finding HTML field (Description, Observation, Remediation, POC) or the affected-assets field.

func Heading 

func Heading(level int, text string) string

Heading wraps text in <h1>..<h6>; level is clamped to 1..6.

func Highlight 

func Highlight(text string) string

Highlight wraps text in a yellow <mark>.

func HighlightWith 

func HighlightWith(text, hexColor string) string

HighlightWith wraps text in a <mark> with the given background color (hex, e.g. "#ffff25"). pwndoc maps a fixed palette of hex codes to Word highlight colors and falls back to yellow for anything else; recognized values include "#ffff25" (yellow), "#8f0000" (dark red), "#8e0075" (dark magenta), "#817d0c" (dark yellow), "#807d78" (dark gray), "#c4c1bb" (light gray) and "#000000" (black). The style attribute is always emitted because pwndoc's converter dereferences it unconditionally.

func Int 

func Int(i int) *int

Int returns a pointer to i. Convenience alias for Ptr[int].

func IsBadRequest 

func IsBadRequest(err error) bool

func IsConflict 

func IsConflict(err error) bool

func IsForbidden 

func IsForbidden(err error) bool

func IsNotFound 

func IsNotFound(err error) bool

Package-level classifiers usable on any returned error (wrap-aware).

Example

ExampleIsNotFound shows error classification. 

package main

import (
	"context"
	"fmt"

	pwndoc "github.com/RaynLight/go-pwndocapi/pwndoc"
)

func main() {
	ctx := context.Background()
	c, _ := pwndoc.Connect(ctx, "https://pwndoc.example.com:8443", "user", "pass", pwndoc.WithInsecureTLS())

	_, err := c.Audits.Get(ctx, "does-not-exist")
	if pwndoc.IsNotFound(err) {
		fmt.Println("audit not found")
	}
}

func IsServer 

func IsServer(err error) bool

func IsUnauthorized 

func IsUnauthorized(err error) bool

func Italic 

func Italic(text string) string

Italic wraps text in <em> (renders italic). 

func Link(href, text string) string

Link renders an anchor. NOTE: pwndoc's HTML-to-Word converter renders the link text as plain text (it does not emit a clickable Word hyperlink for <a>). Provided for editor round-tripping; for clickable references use the finding References list instead.

func MinimalReportTemplateDocx 

func MinimalReportTemplateDocx() ([]byte, error)

MinimalReportTemplateDocx builds a complete, valid pwndoc report template as a .docx byte slice, in memory. Upload it with Templates.Create / CreateDefault (or write it to disk) and assign it to an audit to generate reports without hunting for a working template.

The template intentionally favors correctness and coverage over visual polish: it lays every audit and finding field out as plain labelled paragraphs, including images with captions and the full CVSS 3.1 breakdown.

func Numbered 

func Numbered(items ...string) string

Numbered renders an ordered (<ol>) list. Each item is inline HTML.

func Para 

func Para(htmlContent string) string

Para wraps inline HTML content in a <p>. Content is NOT escaped so the inline helpers can be nested; use Esc for literal text. (Named Para to avoid colliding with the Paragraph report-model type in findings.go.)

func Ptr 

func Ptr[T any](v T) *T

Ptr returns a pointer to v. Use it for the tri-state pointer fields in update params where the zero value (0, "", false) is a meaningful value that must not be dropped by omitempty.

func Strike 

func Strike(text string) string

Strike wraps text in <s> (strikethrough).

func String 

func String(s string) *string

String returns a pointer to s. Convenience alias for Ptr[string].

func Underline 

func Underline(text string) string

Underline wraps text in <u>.

Types

type APIError 

type APIError struct {
	StatusCode int    // HTTP status (400/401/403/404/...)
	Status     string // envelope "status" field, usually "error"
	Message    string // human-readable message from datas
	Method     string // request method, for diagnostics
	Path       string // request path (no host), for diagnostics
	Op         string // logical operation, e.g. "Findings.Create"
	Err        error  // wrapped low-level cause (decode/transport failures); usually nil
}

APIError is returned whenever the server reports a non-success outcome, or a transport/decoding problem is attributable to a specific request. Inspect it with errors.As, the package-level classifiers (IsNotFound, IsUnauthorized, ...), or the predicate methods (NotFound, Unauthorized, ...).

func AsAPIError 

func AsAPIError(err error) (*APIError, bool)

AsAPIError extracts the underlying *APIError, if any. 

if ae, ok := pwndoc.AsAPIError(err); ok && ae.StatusCode == 403 { ... }

func (*APIError) BadRequest 

func (e *APIError) BadRequest() bool

func (*APIError) Conflict 

func (e *APIError) Conflict() bool

func (*APIError) Error 

func (e *APIError) Error() string

func (*APIError) Forbidden 

func (e *APIError) Forbidden() bool

func (*APIError) NotFound 

func (e *APIError) NotFound() bool

func (*APIError) Server 

func (e *APIError) Server() bool

func (*APIError) Unauthorized 

func (e *APIError) Unauthorized() bool

Predicate methods — match on these instead of magic numbers.

func (*APIError) Unwrap 

func (e *APIError) Unwrap() error

Unwrap exposes the wrapped low-level cause, if any.

type AttackComplexity 

type AttackComplexity string

AttackComplexity (AC) — base metric. Required. 

const (
	ACLow  AttackComplexity = "L"
	ACHigh AttackComplexity = "H"
)

type AttackVector 

type AttackVector string

AttackVector (AV) — base metric. Required. 

const (
	AVNetwork  AttackVector = "N" // Network
	AVAdjacent AttackVector = "A" // Adjacent network
	AVLocal    AttackVector = "L" // Local
	AVPhysical AttackVector = "P" // Physical
)

type Audit 

type Audit struct {
	ID            string             `json:"_id,omitempty"`
	Name          string             `json:"name"`
	Language      string             `json:"language,omitempty"`
	AuditType     string             `json:"auditType,omitempty"`
	Type          AuditMode          `json:"type,omitempty"`
	ParentID      string             `json:"parentId,omitempty"`
	Date          string             `json:"date,omitempty"`
	DateStart     string             `json:"date_start,omitempty"`
	DateEnd       string             `json:"date_end,omitempty"`
	Client        *Contact           `json:"client,omitempty"`
	Company       *Company           `json:"company,omitempty"`
	Collaborators []User             `json:"collaborators,omitempty"`
	Reviewers     []User             `json:"reviewers,omitempty"`
	Scope         []ScopeHost        `json:"scope,omitempty"`
	Findings      []Finding          `json:"findings,omitempty"`
	Sections      []SectionData      `json:"sections,omitempty"`
	Template      *TemplateRef       `json:"template,omitempty"` // id on create, populated object on read
	CustomFields  []CustomFieldValue `json:"customFields,omitempty"`
	State         string             `json:"state,omitempty"`
	Approvals     []User             `json:"approvals,omitempty"`
	CreatedAt     time.Time          `json:"createdAt,omitempty"`
	UpdatedAt     time.Time          `json:"updatedAt,omitempty"`
}

Audit is the full audit (engagement) document.

type AuditGeneral 

type AuditGeneral struct {
	Name          *string            `json:"name,omitempty"`
	Date          *string            `json:"date,omitempty"`
	DateStart     *string            `json:"date_start,omitempty"`
	DateEnd       *string            `json:"date_end,omitempty"`
	Client        *Contact           `json:"client,omitempty"`
	Company       *CompanyRef        `json:"company,omitempty"` // {_id} or {name}
	Collaborators []User             `json:"collaborators,omitempty"`
	Reviewers     []User             `json:"reviewers,omitempty"`
	Language      *string            `json:"language,omitempty"`
	Scope         []string           `json:"scope,omitempty"` // host strings; the server wraps each as {name}
	Template      *string            `json:"template,omitempty"`
	CustomFields  []CustomFieldValue `json:"customFields,omitempty"`
}

AuditGeneral is the PUT /general body. Pointer scalar fields distinguish "unset" (leave as-is) from "set to empty".

type AuditListFilter 

type AuditListFilter struct {
	FindingTitle string
	Type         string // default|multi
}

AuditListFilter maps the ?findingTitle= and ?type= query params. A nil filter applies none.

type AuditMode 

type AuditMode string

AuditMode distinguishes a standalone audit from a multi-audit: default|multi. 

const (
	AuditModeDefault AuditMode = "default"
	AuditModeMulti   AuditMode = "multi"
)

type AuditNetwork 

type AuditNetwork struct {
	Scope []ScopeHost `json:"scope,omitempty"`
}

AuditNetwork is the audit's network scope (GET/PUT /network).

type AuditSummary 

type AuditSummary struct {
	ID            string    `json:"_id"`
	Name          string    `json:"name"`
	Language      string    `json:"language,omitempty"`
	AuditType     string    `json:"auditType,omitempty"`
	Type          AuditMode `json:"type,omitempty"`
	Company       *Company  `json:"company,omitempty"`
	Collaborators []User    `json:"collaborators,omitempty"`
	ParentID      string    `json:"parentId,omitempty"`
	State         string    `json:"state,omitempty"`
	CreatedAt     time.Time `json:"createdAt,omitempty"`
}

AuditSummary is the condensed audit shape returned by List/Children.

type AuditType 

type AuditType struct {
	Name      string              `json:"name"`
	Templates []AuditTypeTemplate `json:"templates,omitempty"`
	Sections  []string            `json:"sections,omitempty"`
	Hidden    []string            `json:"hidden,omitempty"` // network|findings
	Stage     string              `json:"stage,omitempty"`  // default|multi|retest
}

AuditType is a kind of audit, linking templates per locale.

type AuditTypeTemplate 

type AuditTypeTemplate struct {
	Template string `json:"template"`
	Locale   string `json:"locale"`
}

AuditTypeTemplate maps a template id to a locale.

type AuditsService 

type AuditsService struct {
	// contains filtered or unexported fields
}

AuditsService manages audits and everything nested under them.

func (*AuditsService) AddComment 

func (s *AuditsService) AddComment(ctx context.Context, id string, comment Comment) (*Comment, error)

AddComment adds a comment to a finding or section. Set exactly one of comment.FindingID or comment.SectionID, plus FieldName and Author (user id).

func (*AuditsService) Children 

func (s *AuditsService) Children(ctx context.Context, id string) ([]AuditSummary, error)

Children returns the child audits of a multi-audit.

func (*AuditsService) Create 

func (s *AuditsService) Create(ctx context.Context, p CreateAuditParams) (*Audit, error)

Create creates an audit and returns the created document.

func (*AuditsService) CreateRetest 

func (s *AuditsService) CreateRetest(ctx context.Context, id string, p RetestParams) (*Audit, error)

CreateRetest creates a retest of the given audit.

func (*AuditsService) Delete 

func (s *AuditsService) Delete(ctx context.Context, id string) error

Delete deletes the audit by id.

func (*AuditsService) DeleteComment 

func (s *AuditsService) DeleteComment(ctx context.Context, id, commentID string) error

DeleteComment deletes a comment.

func (*AuditsService) DeleteParent 

func (s *AuditsService) DeleteParent(ctx context.Context, id string) error

DeleteParent removes the audit's parent link.

func (*AuditsService) Generate 

func (s *AuditsService) Generate(ctx context.Context, id string) (*Report, error)

Generate generates the audit's .docx report into memory.

func (*AuditsService) GenerateTo 

func (s *AuditsService) GenerateTo(ctx context.Context, id string, w io.Writer) error

GenerateTo streams the audit's .docx report to w.

func (*AuditsService) Get 

func (s *AuditsService) Get(ctx context.Context, id string) (*Audit, error)

Get returns the full audit by id.

func (*AuditsService) GetNetwork 

func (s *AuditsService) GetNetwork(ctx context.Context, id string) (*AuditNetwork, error)

GetNetwork returns the audit's network scope.

func (*AuditsService) GetRetest 

func (s *AuditsService) GetRetest(ctx context.Context, id string) (*Audit, error)

GetRetest returns the retest audit linked to the given audit, if any.

func (*AuditsService) GetSection 

func (s *AuditsService) GetSection(ctx context.Context, id, sectionID string) (*SectionData, error)

GetSection returns a custom section of the audit.

func (*AuditsService) List 

func (s *AuditsService) List(ctx context.Context, f *AuditListFilter) ([]AuditSummary, error)

List returns audits visible to the current user, optionally filtered.

func (*AuditsService) MoveFinding 

func (s *AuditsService) MoveFinding(ctx context.Context, id string, oldIndex, newIndex int) error

MoveFinding moves a finding from oldIndex to newIndex.

func (*AuditsService) SortFindings 

func (s *AuditsService) SortFindings(ctx context.Context, id string, p SortFindingsParams) error

SortFindings updates the audit's finding sort options.

func (*AuditsService) ToggleApproval 

func (s *AuditsService) ToggleApproval(ctx context.Context, id string) error

ToggleApproval toggles the current reviewer's approval on the audit.

func (*AuditsService) UpdateComment 

func (s *AuditsService) UpdateComment(ctx context.Context, id, commentID string, comment Comment) (*Comment, error)

UpdateComment updates a comment's text, replies or resolved state.

func (*AuditsService) UpdateGeneral 

func (s *AuditsService) UpdateGeneral(ctx context.Context, id string, g AuditGeneral) error

UpdateGeneral updates an audit's general information (name, dates, company, client, scope, collaborators, reviewers, template, custom fields).

func (*AuditsService) UpdateNetwork 

func (s *AuditsService) UpdateNetwork(ctx context.Context, id string, n AuditNetwork) error

UpdateNetwork replaces the audit's network scope (e.g. to import nmap data).

func (*AuditsService) UpdateParent 

func (s *AuditsService) UpdateParent(ctx context.Context, id, parentID string) error

UpdateParent sets the audit's parent (linking it into a multi-audit).

func (*AuditsService) UpdateReadyForReview 

func (s *AuditsService) UpdateReadyForReview(ctx context.Context, id string, ready bool) error

UpdateReadyForReview moves the audit between EDIT and REVIEW states.

func (*AuditsService) UpdateSection 

func (s *AuditsService) UpdateSection(ctx context.Context, id, sectionID string, data SectionData) error

UpdateSection updates a custom section's custom fields (and optional text).

type Backup 

type Backup struct {
	Slug      string   `json:"slug,omitempty"`
	Name      string   `json:"name,omitempty"`
	Type      string   `json:"type,omitempty"`
	State     string   `json:"state,omitempty"`
	Data      []string `json:"data,omitempty"`
	Size      int64    `json:"size,omitempty"`
	CreatedAt string   `json:"createdAt,omitempty"`
}

Backup describes an instance backup archive.

type BackupStatus 

type BackupStatus struct {
	State    string `json:"state,omitempty"`
	Progress int    `json:"progress,omitempty"`
	Message  string `json:"message,omitempty"`
}

BackupStatus is the state of an in-progress backup or restore.

type BackupsService 

type BackupsService struct {
	// contains filtered or unexported fields
}

BackupsService manages instance backups.

func (*BackupsService) Create 

func (s *BackupsService) Create(ctx context.Context, p CreateBackupParams) (*Backup, error)

Create requests a new backup.

func (*BackupsService) Delete 

func (s *BackupsService) Delete(ctx context.Context, slug string) error

Delete deletes the backup identified by slug.

func (*BackupsService) Download 

func (s *BackupsService) Download(ctx context.Context, slug string) ([]byte, error)

Download returns the raw .tar bytes of the backup identified by slug.

func (*BackupsService) DownloadTo 

func (s *BackupsService) DownloadTo(ctx context.Context, slug string, w io.Writer) error

DownloadTo streams the backup .tar to w.

func (*BackupsService) List 

func (s *BackupsService) List(ctx context.Context) ([]Backup, error)

List returns all backups.

func (*BackupsService) Restore 

func (s *BackupsService) Restore(ctx context.Context, slug string, p RestoreParams) error

Restore restores the backup identified by slug.

func (*BackupsService) Status 

func (s *BackupsService) Status(ctx context.Context) (*BackupStatus, error)

Status returns the current backup/restore worker status.

func (*BackupsService) Upload 

func (s *BackupsService) Upload(ctx context.Context, r io.Reader, filename string) (*Backup, error)

Upload uploads a backup .tar archive read from r. filename must end in ".tar".

type CVSS31 

type CVSS31 struct {
	// Base (required)
	AV AttackVector
	AC AttackComplexity
	PR PrivilegesRequired
	UI UserInteraction
	S  CVSSScope
	C  Impact
	I  Impact
	A  Impact

	// Temporal (optional)
	E  ExploitCodeMaturity
	RL RemediationLevel
	RC ReportConfidence

	// Environmental — security requirements (optional)
	CR SecurityRequirement
	IR SecurityRequirement
	AR SecurityRequirement

	// Environmental — modified base (optional)
	MAV ModAttackVector
	MAC ModAttackComplexity
	MPR ModPrivilegesRequired
	MUI ModUserInteraction
	MS  ModScope
	MC  ModImpact
	MI  ModImpact
	MA  ModImpact
}

CVSS31 holds every CVSS v3.1 metric. The eight base metrics are required to form a valid vector; temporal and environmental metrics are optional and are omitted from the vector string when empty or "X" (Not Defined).

Build a vector and attach it to a finding: 

v := pwndoc.CVSS31{
    AV: pwndoc.AVNetwork, AC: pwndoc.ACLow, PR: pwndoc.PRNone, UI: pwndoc.UINone,
    S: pwndoc.ScopeUnchanged, C: pwndoc.ImpactHigh, I: pwndoc.ImpactHigh, A: pwndoc.ImpactHigh,
}
finding.CVSSv3 = v.Vector() // "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"

pwndoc computes the base/temporal/environmental scores and severities from this string at report-generation time.

func ParseCVSS31 

func ParseCVSS31(vector string) (CVSS31, error)

ParseCVSS31 parses a CVSS v3.1 vector string into a CVSS31. The leading "CVSS:3.1/" prefix is optional. A "CVSS:3.0/" prefix is rejected (the scoring guidance differs between versions). Unknown metric keys are ignored.

func (CVSS31) String 

func (c CVSS31) String() string

String is an alias for Vector.

func (CVSS31) Validate 

func (c CVSS31) Validate() error

Validate reports an error if any of the eight required base metrics is unset or holds an illegal value.

func (CVSS31) Vector 

func (c CVSS31) Vector() string

Vector returns the CVSS v3.1 vector string (prefixed "CVSS:3.1/"), including every set metric in canonical order and omitting any that are empty or "X". It does not validate; use Validate to check base-metric completeness.

type CVSSScope 

type CVSSScope string

CVSSScope (S) — base metric. Required. ("Scope" is named CVSSScope to avoid colliding with audit scope.) 

const (
	ScopeUnchanged CVSSScope = "U"
	ScopeChanged   CVSSScope = "C"
)

type Client 

type Client struct {

	// Audits manages audits (engagements): findings, sections, comments,
	// scope, retests, the review workflow and report generation.
	Audits *AuditsService
	// Findings is a convenience view over an audit's findings.
	Findings *FindingsService
	// Clients manages client contacts (modeled as Contact to avoid colliding
	// with this Client type).
	Clients *ClientsService
	// Companies manages companies.
	Companies *CompaniesService
	// Users manages user accounts and the current profile.
	Users *UsersService
	// Data manages the shared catalogs: languages, audit types, vulnerability
	// types and categories, custom sections and custom fields.
	Data *DataService
	// Vulnerabilities manages the reusable vulnerability template database.
	Vulnerabilities *VulnerabilitiesService
	// Templates manages Word report templates.
	Templates *TemplatesService
	// Settings reads and updates instance settings.
	Settings *SettingsService
	// Images uploads, fetches and deletes images referenced by findings.
	Images *ImagesService
	// Backups manages instance backups.
	Backups *BackupsService
	// contains filtered or unexported fields
}

Client is a pwndoc API client. Create one with New or Connect. A Client is safe for concurrent use by multiple goroutines.

Resources are grouped into services accessed via the exported fields, e.g. c.Audits.Create, c.Findings.Create, c.Images.Upload. High-level "do everything" verbs (Login, NewPentest, AddFindingWithImages, GenerateReport, ...) are methods on *Client directly.

func Connect 

func Connect(ctx context.Context, baseURL, username, password string, opts ...Option) (*Client, error)

Connect creates a Client and immediately logs in, returning a ready-to-use authenticated client. It is the most convenient entry point.

func New 

func New(baseURL string, opts ...Option) (*Client, error)

New creates a Client for the pwndoc instance at baseURL (for example "https://pwndoc.example.com:8443"). It performs no network I/O; authenticate with Client.Login, or use Connect to do both at once.

func (*Client) AddFindingWithImages 

func (c *Client) AddFindingWithImages(ctx context.Context, auditID string, f Finding, groups ...FindingImageGroup) (*Finding, error)

AddFindingWithImages creates a finding and uploads+embeds all images with their captions into the finding's POC field, in one call.

func (*Client) AttachImageToField 

func (c *Client) AttachImageToField(ctx context.Context, auditID, findingID string, field FindingField, imagePath, caption string) (*Finding, error)

AttachImageToField uploads a local image and appends it, with the given caption, to the chosen rich-text field of the finding.

func (*Client) AttachImageToFinding 

func (c *Client) AttachImageToFinding(ctx context.Context, auditID, findingID, imagePath, caption string) (*Finding, error)

AttachImageToFinding uploads a local image and appends it, with the given caption, to the finding's proof-of-concept (POC) field. One call performs: upload -> get finding -> append <img> (immutable copy) -> update.

Example

ExampleClient_AttachImageToFinding attaches a captioned screenshot to an existing finding's proof-of-concept field. 

package main

import (
	"context"
	"fmt"
	"log"

	pwndoc "github.com/RaynLight/go-pwndocapi/pwndoc"
)

func main() {
	ctx := context.Background()
	c, _ := pwndoc.Connect(ctx, "https://pwndoc.example.com:8443", "user", "pass", pwndoc.WithInsecureTLS())

	finding, err := c.AttachImageToFinding(ctx, "<auditID>", "<findingID>",
		"poc.png", "Figure 1 - exploited request")
	if err != nil {
		log.Fatal(err)
	}
	fmt.Println(finding.Title)
}

func (*Client) BaseURL 

func (c *Client) BaseURL() string

BaseURL returns the normalized base URL the client targets (without the trailing /api path).

func (*Client) CheckToken 

func (c *Client) CheckToken(ctx context.Context) (string, error)

CheckToken returns the raw token cookie value if the current session is valid, or an *APIError otherwise.

func (*Client) GenerateReport 

func (c *Client) GenerateReport(ctx context.Context, auditID, outPath string) (int64, error)

GenerateReport generates the .docx report and writes it to outPath, creating parent directories as needed. It returns the number of bytes written.

func (*Client) IsAuthenticated 

func (c *Client) IsAuthenticated() bool

IsAuthenticated reports whether the client currently holds an access token.

func (*Client) Login 

func (c *Client) Login(ctx context.Context, username, password, totp string) error

Login authenticates with a username and password (and an optional TOTP token for accounts with two-factor authentication — pass "" when not used), storing the resulting session tokens on the client.

func (*Client) Logout 

func (c *Client) Logout(ctx context.Context) error

Logout invalidates the server-side session and clears the stored tokens.

func (*Client) NewPentest 

func (c *Client) NewPentest(name, language, auditType string) *PentestBuilder

NewPentest starts a builder. name, language and auditType are required.

func (*Client) QuickFinding 

func (c *Client) QuickFinding(ctx context.Context, auditID, title string, priority Priority) (*Finding, error)

QuickFinding is the minimal-args fast path: create a finding with just a title and priority.

func (*Client) Refresh 

func (c *Client) Refresh(ctx context.Context) error

Refresh exchanges the stored refresh token for a fresh access token. The client does this automatically on a 401 when auto-refresh is enabled (the default), so calling it directly is rarely necessary.

func (*Client) SetAffectedAssets 

func (c *Client) SetAffectedAssets(ctx context.Context, auditID, findingID, html string) (*Finding, error)

SetAffectedAssets sets a finding's "Affected assets" field. In pwndoc this is the finding's Scope field; it is rendered via the {@affected} template tag, so HTML (use the rich-text helpers) is supported. Returns the updated finding.

func (*Client) SetClient 

func (c *Client) SetClient(ctx context.Context, auditID, email string) error

SetClient sets (creating if needed) the audit's client contact by email.

func (*Client) SetCompany 

func (c *Client) SetCompany(ctx context.Context, auditID, name string) error

SetCompany sets (creating if needed) the audit's company by name.

func (*Client) SetDates 

func (c *Client) SetDates(ctx context.Context, auditID, start, end string) error

SetDates sets the engagement start and end dates (ISO yyyy-mm-dd).

func (*Client) SetFigureCaption 

func (c *Client) SetFigureCaption(ctx context.Context, auditID, findingID string, imageIndex int, caption string) (*Finding, error)

SetFigureCaption updates the caption (alt text) of the imageIndex-th image (0-based) in the finding's POC field.

func (*Client) SetGlobalCaptionLabels 

func (c *Client) SetGlobalCaptionLabels(ctx context.Context, labels []string) (*Settings, error)

SetGlobalCaptionLabels sets the instance figure caption labels (settings.report.public.captions, e.g. ["Figure", "Table"]), preserving all other settings.

func (*Client) SetScope 

func (c *Client) SetScope(ctx context.Context, auditID string, hosts ...string) error

SetScope replaces the audit scope with the given host strings.

func (*Client) Tokens 

func (c *Client) Tokens() (access, refresh string)

Tokens returns the current access and refresh tokens, allowing a session to be persisted and later restored with WithToken.

type ClientsService 

type ClientsService struct {
	// contains filtered or unexported fields
}

ClientsService manages client contacts.

func (*ClientsService) Create 

func (s *ClientsService) Create(ctx context.Context, p Contact) (*Contact, error)

Create creates a client contact. Email is required; set Company.Name to associate (or auto-create) a company.

func (*ClientsService) Delete 

func (s *ClientsService) Delete(ctx context.Context, id string) error

Delete deletes the client contact with the given id.

func (*ClientsService) FindByEmail 

func (s *ClientsService) FindByEmail(ctx context.Context, email string) (*Contact, error)

FindByEmail returns the client contact with the given email (case-insensitive), or nil.

func (*ClientsService) List 

func (s *ClientsService) List(ctx context.Context) ([]Contact, error)

List returns all client contacts.

func (*ClientsService) Update 

func (s *ClientsService) Update(ctx context.Context, id string, p Contact) (*Contact, error)

Update updates the client contact with the given id and returns the stored record (re-read, since pwndoc returns only a status message).

type Comment 

type Comment struct {
	ID        string    `json:"_id,omitempty"`
	FindingID string    `json:"findingId,omitempty"`
	SectionID string    `json:"sectionId,omitempty"`
	FieldName string    `json:"fieldName,omitempty"`
	Author    string    `json:"author,omitempty"`
	Text      string    `json:"text,omitempty"`
	Replies   []Comment `json:"replies,omitempty"`
	Resolved  bool      `json:"resolved,omitempty"`
}

Comment is a review comment on a finding or section, with nested replies.

type CompaniesService 

type CompaniesService struct {
	// contains filtered or unexported fields
}

CompaniesService manages companies.

func (*CompaniesService) Create 

func (s *CompaniesService) Create(ctx context.Context, p Company) (*Company, error)

Create creates a company. Name is required.

func (*CompaniesService) Delete 

func (s *CompaniesService) Delete(ctx context.Context, id string) error

Delete deletes the company with the given id.

func (*CompaniesService) EnsureByName 

func (s *CompaniesService) EnsureByName(ctx context.Context, name string) (*Company, error)

EnsureByName returns the named company, creating it if it does not exist.

func (*CompaniesService) FindByName 

func (s *CompaniesService) FindByName(ctx context.Context, name string) (*Company, error)

FindByName returns the company whose name matches (case-insensitively), or nil.

func (*CompaniesService) List 

func (s *CompaniesService) List(ctx context.Context) ([]Company, error)

List returns all companies.

func (*CompaniesService) Update 

func (s *CompaniesService) Update(ctx context.Context, id string, p Company) (*Company, error)

Update updates the company with the given id and returns the updated record.

type Company 

type Company struct {
	ID        string `json:"_id,omitempty"`
	Name      string `json:"name"`
	ShortName string `json:"shortName,omitempty"`
}

Company represents a company in pwndoc.

type CompanyRef 

type CompanyRef struct {
	ID   string `json:"_id,omitempty"`
	Name string `json:"name,omitempty"`
}

CompanyRef references a company by id or name (PUT /general accepts either).

func (*CompanyRef) UnmarshalJSON 

func (r *CompanyRef) UnmarshalJSON(data []byte) error

UnmarshalJSON lets a CompanyRef decode from either a bare id string (as returned when a client is created) or an object ({_id} / {name}).

type Contact 

type Contact struct {
	ID        string      `json:"_id,omitempty"`
	Email     string      `json:"email"` // required
	Firstname string      `json:"firstname,omitempty"`
	Lastname  string      `json:"lastname,omitempty"`
	Phone     string      `json:"phone,omitempty"`
	Cell      string      `json:"cell,omitempty"`
	Title     string      `json:"title,omitempty"`
	Company   *CompanyRef `json:"company,omitempty"` // resolved by {name}; returned as {_id} or {name}
}

Contact is a client contact at a company. (pwndoc calls these "clients"; the type is named Contact here to avoid colliding with the API Client type. The service is still c.Clients to match pwndoc's terminology and routes.)

type CreateAuditParams 

type CreateAuditParams struct {
	Name      string    `json:"name"`
	Language  string    `json:"language"`
	AuditType string    `json:"auditType"`
	Type      AuditMode `json:"type,omitempty"`     // default|multi
	ParentID  string    `json:"parentId,omitempty"` // only for default-type children
}

CreateAuditParams are the fields for creating an audit. Name, Language and AuditType are required.

type CreateBackupParams 

type CreateBackupParams struct {
	Name     string   `json:"name,omitempty"`
	Type     string   `json:"type,omitempty"`
	Data     []string `json:"data,omitempty"`
	Password string   `json:"password,omitempty"`
}

CreateBackupParams configures a new backup. Data optionally restricts which data domains are included; Password encrypts the archive.

type CreateTemplateParams 

type CreateTemplateParams struct {
	Name string `json:"name"`
	File string `json:"file,omitempty"`
	Ext  string `json:"ext,omitempty"`
}

CreateTemplateParams are the fields for creating or updating a template. File is the base64-encoded document contents (use CreateFromFile to build it).

type CreateUserParams 

type CreateUserParams struct {
	Username  string `json:"username"`
	Password  string `json:"password"`
	Firstname string `json:"firstname"`
	Lastname  string `json:"lastname"`
	Role      string `json:"role,omitempty"`
	Email     string `json:"email,omitempty"`
	Phone     string `json:"phone,omitempty"`
	JobTitle  string `json:"jobTitle,omitempty"`
}

CreateUserParams are the fields for creating a user. Username, Password, Firstname and Lastname are required; Role defaults to "user".

type CustomField 

type CustomField struct {
	ID          string   `json:"_id,omitempty"`
	FieldType   string   `json:"fieldType"` // text|checkbox|select|space|...
	Label       string   `json:"label"`
	Display     string   `json:"display,omitempty"` // finding|audit|section|vulnerability
	DisplaySub  string   `json:"displaySub,omitempty"`
	Size        int      `json:"size,omitempty"`
	Offset      int      `json:"offset,omitempty"`
	Required    bool     `json:"required,omitempty"`
	Description string   `json:"description,omitempty"`
	Options     []string `json:"options,omitempty"`
	Position    int      `json:"position,omitempty"`
}

CustomField defines a custom data field shown on findings, audits, sections or vulnerabilities.

type CustomFieldValue 

type CustomFieldValue struct {
	CustomField string `json:"customField,omitempty"`
	Text        any    `json:"text,omitempty"` // string or []string depending on fieldType
}

CustomFieldValue is the per-document value of a custom field.

type CustomSection 

type CustomSection struct {
	Field  string `json:"field"`
	Name   string `json:"name"`
	Locale string `json:"locale,omitempty"`
	Text   string `json:"text,omitempty"`
	Icon   string `json:"icon,omitempty"`
}

CustomSection is a reusable report section definition.

type DataService 

type DataService struct {
	// contains filtered or unexported fields
}

DataService manages the shared catalogs under /api/data. Per the pwndoc convention, the PUT endpoints replace the whole array (the Set* methods); Create*/Delete* operate on a single entry. Mutating methods return the refreshed catalog.

func (*DataService) AuditTypes 

func (s *DataService) AuditTypes(ctx context.Context) ([]AuditType, error)

func (*DataService) CreateAuditType 

func (s *DataService) CreateAuditType(ctx context.Context, a AuditType) ([]AuditType, error)

func (*DataService) CreateCustomField 

func (s *DataService) CreateCustomField(ctx context.Context, f CustomField) ([]CustomField, error)

func (*DataService) CreateLanguage 

func (s *DataService) CreateLanguage(ctx context.Context, l Language) ([]Language, error)

func (*DataService) CreateSection 

func (s *DataService) CreateSection(ctx context.Context, sec CustomSection) ([]CustomSection, error)

func (*DataService) CreateVulnerabilityCategory 

func (s *DataService) CreateVulnerabilityCategory(ctx context.Context, v VulnerabilityCategory) ([]VulnerabilityCategory, error)

func (*DataService) CreateVulnerabilityType 

func (s *DataService) CreateVulnerabilityType(ctx context.Context, v VulnerabilityType) ([]VulnerabilityType, error)

func (*DataService) CustomFields 

func (s *DataService) CustomFields(ctx context.Context) ([]CustomField, error)

func (*DataService) DeleteAuditType 

func (s *DataService) DeleteAuditType(ctx context.Context, name string) error

func (*DataService) DeleteCustomField 

func (s *DataService) DeleteCustomField(ctx context.Context, fieldID string) error

func (*DataService) DeleteLanguage 

func (s *DataService) DeleteLanguage(ctx context.Context, locale string) error

func (*DataService) DeleteSection 

func (s *DataService) DeleteSection(ctx context.Context, field, locale string) error

func (*DataService) DeleteVulnerabilityCategory 

func (s *DataService) DeleteVulnerabilityCategory(ctx context.Context, name string) error

func (*DataService) DeleteVulnerabilityType 

func (s *DataService) DeleteVulnerabilityType(ctx context.Context, name string) error

func (*DataService) Languages 

func (s *DataService) Languages(ctx context.Context) ([]Language, error)

func (*DataService) Roles 

func (s *DataService) Roles(ctx context.Context) ([]string, error)

Roles returns the list of role names defined on the instance.

func (*DataService) Sections 

func (s *DataService) Sections(ctx context.Context) ([]CustomSection, error)

func (*DataService) SetAuditTypes 

func (s *DataService) SetAuditTypes(ctx context.Context, a []AuditType) ([]AuditType, error)

func (*DataService) SetCustomFields 

func (s *DataService) SetCustomFields(ctx context.Context, f []CustomField) ([]CustomField, error)

func (*DataService) SetLanguages 

func (s *DataService) SetLanguages(ctx context.Context, l []Language) ([]Language, error)

func (*DataService) SetSections 

func (s *DataService) SetSections(ctx context.Context, secs []CustomSection) ([]CustomSection, error)

func (*DataService) SetVulnerabilityCategories 

func (s *DataService) SetVulnerabilityCategories(ctx context.Context, v []VulnerabilityCategory) ([]VulnerabilityCategory, error)

func (*DataService) SetVulnerabilityTypes 

func (s *DataService) SetVulnerabilityTypes(ctx context.Context, v []VulnerabilityType) ([]VulnerabilityType, error)

func (*DataService) VulnerabilityCategories 

func (s *DataService) VulnerabilityCategories(ctx context.Context) ([]VulnerabilityCategory, error)

func (*DataService) VulnerabilityTypes 

func (s *DataService) VulnerabilityTypes(ctx context.Context) ([]VulnerabilityType, error)

type Doer 

type Doer interface {
	Do(*http.Request) (*http.Response, error)
}

Doer is the minimal HTTP transport seam, satisfied by *http.Client. Supplying a custom Doer (via WithHTTPDoer) makes the client trivial to unit-test.

type ExploitCodeMaturity 

type ExploitCodeMaturity string

ExploitCodeMaturity (E) — temporal metric. Optional. 

const (
	ENotDefined     ExploitCodeMaturity = "X"
	EUnproven       ExploitCodeMaturity = "U"
	EProofOfConcept ExploitCodeMaturity = "P"
	EFunctional     ExploitCodeMaturity = "F"
	EHigh           ExploitCodeMaturity = "H"
)

type Finding 

type Finding struct {
	ID                    string                `json:"_id,omitempty"`
	Identifier            int                   `json:"identifier,omitempty"` // server-assigned
	Title                 string                `json:"title"`                // required
	VulnType              string                `json:"vulnType,omitempty"`
	Description           string                `json:"description,omitempty"` // HTML
	Observation           string                `json:"observation,omitempty"` // HTML
	Remediation           string                `json:"remediation,omitempty"` // HTML
	RemediationComplexity RemediationComplexity `json:"remediationComplexity,omitempty"`
	Priority              Priority              `json:"priority,omitempty"`
	References            []string              `json:"references,omitempty"`
	CVSSv3                string                `json:"cvssv3,omitempty"`
	CVSSv4                string                `json:"cvssv4,omitempty"`
	POC                   string                `json:"poc,omitempty"` // HTML (proof of concept)
	Scope                 string                `json:"scope,omitempty"`
	Status                *FindingStatus        `json:"status,omitempty"` // pointer: 0=Done is meaningful
	Category              string                `json:"category,omitempty"`
	CustomFields          []CustomFieldValue    `json:"customFields,omitempty"`
	Paragraphs            []Paragraph           `json:"paragraphs,omitempty"`
	RetestStatus          RetestStatus          `json:"retestStatus,omitempty"`
	RetestDescription     string                `json:"retestDescription,omitempty"`
}

Finding is a vulnerability finding within an audit. The rich-text fields (Description, Observation, Remediation, POC) are HTML; embed images in them with <img src="<imageID>" alt="<caption>"> — see AttachImageToFinding and AddFindingWithImages for helpers that do this for you.

type FindingField 

type FindingField string

FindingField names a finding's rich-text (HTML) field. Images are embedded into one of these fields. 

const (
	FindingFieldPOC         FindingField = "poc"
	FindingFieldDescription FindingField = "description"
	FindingFieldObservation FindingField = "observation"
	FindingFieldRemediation FindingField = "remediation"
)

type FindingImageGroup 

type FindingImageGroup struct {
	Text   string
	Images []ImageSpec
}

FindingImageGroup ties a block of (HTML) text to a set of images. Each group is appended to the finding's POC field as the images are uploaded.

type FindingStatus 

type FindingStatus int

FindingStatus is a finding's editorial state: 0=Done, 1=Redacting. It is used via *FindingStatus on the wire so that 0 (Done) is not dropped by omitempty. 

const (
	FindingDone      FindingStatus = 0
	FindingRedacting FindingStatus = 1
)

func (FindingStatus) String 

func (s FindingStatus) String() string

String returns a human-readable label.

func (FindingStatus) Valid 

func (s FindingStatus) Valid() bool

Valid reports whether s is a known value.

type FindingsService 

type FindingsService struct {
	// contains filtered or unexported fields
}

FindingsService manages the findings of an audit.

func (*FindingsService) Create 

func (s *FindingsService) Create(ctx context.Context, auditID string, f Finding) (*Finding, error)

Create adds a finding to an audit. Title is required. pwndoc returns only a status message on create, so the audit is re-read to return the stored finding (with its server-assigned id and identifier).

func (*FindingsService) CreateFromVulnerability 

func (s *FindingsService) CreateFromVulnerability(ctx context.Context, auditID, locale, vulnID string) (*Finding, error)

CreateFromVulnerability imports a vulnerability from the template database into the audit as a new finding, using the given locale's details.

func (*FindingsService) Delete 

func (s *FindingsService) Delete(ctx context.Context, auditID, findingID string) error

Delete removes a finding from an audit.

func (*FindingsService) Get 

func (s *FindingsService) Get(ctx context.Context, auditID, findingID string) (*Finding, error)

Get returns a single finding of an audit.

func (*FindingsService) List 

func (s *FindingsService) List(ctx context.Context, auditID string) ([]Finding, error)

List returns all findings of an audit. (pwndoc has no findings-list endpoint; this reads the audit and returns its findings.)

func (*FindingsService) Update 

func (s *FindingsService) Update(ctx context.Context, auditID, findingID string, f Finding) (*Finding, error)

Update updates a finding and returns the stored result (re-read, since pwndoc returns only a status message).

type Host 

type Host struct {
	IP       string    `json:"ip,omitempty"`
	Hostname string    `json:"hostname,omitempty"`
	OS       string    `json:"os,omitempty"`
	Services []Service `json:"services,omitempty"`
}

Host is a discovered network host within a scope entry.

type Image 

type Image struct {
	ID      string `json:"_id,omitempty"`
	Value   string `json:"value,omitempty"`
	Name    string `json:"name,omitempty"`
	AuditID string `json:"auditId,omitempty"`
}

Image represents an image stored in pwndoc. Value is a data URI of the form "data:image/png;base64,...". When uploading, only ID is returned.

type ImageSpec 

type ImageSpec struct {
	Path    string
	Reader  io.Reader
	Bytes   []byte
	Mime    string
	Name    string
	Caption string
}

ImageSpec describes one image (and its caption) to attach to a finding. Set exactly one of Path, Reader or Bytes; Mime is required with Reader/Bytes and inferred for Path.

type ImagesService 

type ImagesService struct {
	// contains filtered or unexported fields
}

ImagesService uploads, fetches and deletes images referenced by findings.

func (*ImagesService) Delete 

func (s *ImagesService) Delete(ctx context.Context, id string) error

Delete deletes the image by id.

func (*ImagesService) Download 

func (s *ImagesService) Download(ctx context.Context, id string) ([]byte, error)

Download returns the decoded raw bytes of the image by id.

func (*ImagesService) DownloadTo 

func (s *ImagesService) DownloadTo(ctx context.Context, id string, w io.Writer) error

DownloadTo streams the decoded raw image bytes to w.

func (*ImagesService) Get 

func (s *ImagesService) Get(ctx context.Context, id string) (*Image, error)

Get returns the image (including its data URI value) by id.

func (*ImagesService) Upload 

func (s *ImagesService) Upload(ctx context.Context, p UploadImageParams) (*Image, error)

Upload uploads an image from a data URI. pwndoc de-duplicates by value, so uploading identical bytes returns the existing image's id.

func (*ImagesService) UploadBytes 

func (s *ImagesService) UploadBytes(ctx context.Context, data []byte, mimeType, name, auditID string) (*Image, error)

UploadBytes uploads raw image bytes with the given MIME type and display name.

func (*ImagesService) UploadFile 

func (s *ImagesService) UploadFile(ctx context.Context, path, auditID string) (*Image, error)

UploadFile reads an image file from disk and uploads it, inferring the MIME type from the file.

func (*ImagesService) UploadReader 

func (s *ImagesService) UploadReader(ctx context.Context, r io.Reader, name, mimeType, auditID string) (*Image, error)

UploadReader uploads an image read from r.

type Impact 

type Impact string

Impact is the value type shared by the Confidentiality (C), Integrity (I) and Availability (A) base metrics. All three are required. 

const (
	ImpactNone Impact = "N"
	ImpactLow  Impact = "L"
	ImpactHigh Impact = "H"
)

type Language 

type Language struct {
	Locale   string `json:"locale"`
	Language string `json:"language"`
}

Language is a report language (e.g. {Locale:"en", Language:"English"}).

type MergeParams 

type MergeParams struct {
	VulnID string `json:"vulnId"`
	Locale string `json:"locale"`
}

MergeParams configures a vulnerability merge: VulnID is the source vulnerability whose Locale content is merged into the target.

type ModAttackComplexity 

type ModAttackComplexity string // MAC: X|L|H

Modified base metrics (environmental). Each accepts the same values as its base metric plus "X" (Not Defined). They are typed as strings so any of the matching base constants can be assigned, e.g. MAV: string(AVNetwork).

type ModAttackVector 

type ModAttackVector string // MAV: X|N|A|L|P

Modified base metrics (environmental). Each accepts the same values as its base metric plus "X" (Not Defined). They are typed as strings so any of the matching base constants can be assigned, e.g. MAV: string(AVNetwork).

type ModImpact 

type ModImpact string // MC/MI/MA: X|N|L|H

Modified base metrics (environmental). Each accepts the same values as its base metric plus "X" (Not Defined). They are typed as strings so any of the matching base constants can be assigned, e.g. MAV: string(AVNetwork).

type ModPrivilegesRequired 

type ModPrivilegesRequired string // MPR: X|N|L|H

Modified base metrics (environmental). Each accepts the same values as its base metric plus "X" (Not Defined). They are typed as strings so any of the matching base constants can be assigned, e.g. MAV: string(AVNetwork).

type ModScope 

type ModScope string // MS:  X|U|C

Modified base metrics (environmental). Each accepts the same values as its base metric plus "X" (Not Defined). They are typed as strings so any of the matching base constants can be assigned, e.g. MAV: string(AVNetwork).

type ModUserInteraction 

type ModUserInteraction string // MUI: X|N|R

Modified base metrics (environmental). Each accepts the same values as its base metric plus "X" (Not Defined). They are typed as strings so any of the matching base constants can be assigned, e.g. MAV: string(AVNetwork).

type Option 

type Option func(*Client) error

Option configures a Client. Options are applied in order by New and may return an error to reject an invalid or conflicting combination.

func WithAutoRefresh 

func WithAutoRefresh(enabled bool) Option

WithAutoRefresh controls whether the client transparently refreshes an expired access token and retries the request on a 401. Enabled by default.

func WithCABundle 

func WithCABundle(pem []byte) Option

WithCABundle trusts the given PEM-encoded CA certificate(s) for TLS verification — a safer alternative to WithInsecureTLS for instances using a private CA.

func WithHTTPClient 

func WithHTTPClient(hc *http.Client) Option

WithHTTPClient sets a custom *http.Client. It conflicts with WithInsecureTLS, WithTLSConfig, WithCABundle and WithTimeout, which configure the default client — set those on your own client instead.

func WithHTTPDoer 

func WithHTTPDoer(d Doer) Option

WithHTTPDoer sets a custom transport implementing Doer. Useful in tests.

func WithInsecureTLS 

func WithInsecureTLS() Option

WithInsecureTLS disables TLS certificate verification. pwndoc instances are frequently deployed with self-signed certificates, so this is commonly required for lab setups. Prefer WithCABundle in production.

func WithRetries 

func WithRetries(maxAttempts int, base, maxDelay time.Duration) Option

WithRetries configures automatic retries for transient failures (network timeouts and 429/5xx responses) on idempotent requests. max is the number of extra attempts; base and max delay bound the exponential backoff.

func WithTLSConfig 

func WithTLSConfig(cfg *tls.Config) Option

WithTLSConfig sets a base *tls.Config for the default HTTP client. Any WithInsecureTLS / WithCABundle settings are layered on top of a clone of it.

func WithTimeout 

func WithTimeout(d time.Duration) Option

WithTimeout sets the per-request timeout on the default HTTP client (default 30s). Ignored when WithHTTPClient/WithHTTPDoer is used.

func WithToken 

func WithToken(access, refresh string) Option

WithToken seeds the client with an existing access token (and optionally a refresh token), so a persisted session can be reused without calling Login.

func WithUserAgent 

func WithUserAgent(ua string) Option

WithUserAgent overrides the User-Agent header sent with every request.

type Paragraph 

type Paragraph struct {
	Text   string           `json:"text,omitempty"`
	Images []ParagraphImage `json:"images,omitempty"`
}

Paragraph is one block of finding prose plus its inline images. pwndoc derives paragraphs from the HTML rich-text fields at report-generation time, so this is primarily a read model — set images by embedding <img> tags in the HTML fields rather than by populating Paragraphs.

type ParagraphImage 

type ParagraphImage struct {
	Image   string `json:"image"`
	Caption string `json:"caption,omitempty"`
}

ParagraphImage links an image reference to its caption.

type PentestBuilder 

type PentestBuilder struct {
	// contains filtered or unexported fields
}

PentestBuilder fluently assembles and creates an audit with a company, client, scope, dates, collaborators, reviewers and template — all by human-readable name. Names are resolved to ids (auto-creating company and client when missing) when Run is called.

func (*PentestBuilder) AddFinding 

func (b *PentestBuilder) AddFinding(f Finding) *PentestBuilder

AddFinding queues a finding to be created once the audit exists.

func (*PentestBuilder) Client 

func (b *PentestBuilder) Client(email, firstname, lastname string) *PentestBuilder

Client sets the client contact by email (resolved/created at Run).

func (*PentestBuilder) Collaborators 

func (b *PentestBuilder) Collaborators(usernames ...string) *PentestBuilder

Collaborators adds collaborators by username (or email), resolved at Run.

func (*PentestBuilder) Company 

func (b *PentestBuilder) Company(name string) *PentestBuilder

Company sets the company by name (resolved/created at Run).

func (*PentestBuilder) Dates 

func (b *PentestBuilder) Dates(start, end string) *PentestBuilder

Dates sets the engagement start and end dates (ISO yyyy-mm-dd).

func (*PentestBuilder) Multi 

func (b *PentestBuilder) Multi() *PentestBuilder

Multi marks the audit as a multi-audit.

func (*PentestBuilder) Parent 

func (b *PentestBuilder) Parent(id string) *PentestBuilder

Parent links this audit under the given parent audit id.

func (*PentestBuilder) Reviewers 

func (b *PentestBuilder) Reviewers(usernames ...string) *PentestBuilder

Reviewers adds reviewers by username (or email), resolved at Run.

func (*PentestBuilder) Run 

func (b *PentestBuilder) Run(ctx context.Context) (*Audit, error)

Run creates the audit, resolves all names to ids (auto-creating company and client when missing), applies the general settings, and flushes queued findings. On success it returns the freshly fetched, fully-populated audit.

On a partial failure (the audit was created but a later step failed), Run returns a non-nil *Audit whose ID identifies the created — now orphaned — audit, alongside the error, so the caller can delete it. Run mutates builder state and is not idempotent; create a new builder to retry.

func (*PentestBuilder) Scope 

func (b *PentestBuilder) Scope(hosts ...string) *PentestBuilder

Scope appends scope host entries.

func (*PentestBuilder) Template 

func (b *PentestBuilder) Template(id string) *PentestBuilder

Template sets the report template id.

func (*PentestBuilder) TemplateByName 

func (b *PentestBuilder) TemplateByName(name string) *PentestBuilder

TemplateByName sets the report template by name, resolved to its id at Run. If no template with that name exists, one is created from the built-in minimal template (see Templates.EnsureDefault) so report generation works.

type Priority 

type Priority int

Priority rates a finding's urgency: 1=Low, 2=Medium, 3=High, 4=Urgent. 

const (
	PriorityLow    Priority = 1
	PriorityMedium Priority = 2
	PriorityHigh   Priority = 3
	PriorityUrgent Priority = 4
)

func (Priority) String 

func (p Priority) String() string

String returns a human-readable label.

func (Priority) Valid 

func (p Priority) Valid() bool

Valid reports whether p is a known value.

type PrivilegesRequired 

type PrivilegesRequired string

PrivilegesRequired (PR) — base metric. Required. 

const (
	PRNone PrivilegesRequired = "N"
	PRLow  PrivilegesRequired = "L"
	PRHigh PrivilegesRequired = "H"
)

type RemediationComplexity 

type RemediationComplexity int

RemediationComplexity rates how hard a finding is to fix: 1=Easy, 2=Medium, 3=Complex. 

const (
	RemediationEasy    RemediationComplexity = 1
	RemediationMedium  RemediationComplexity = 2
	RemediationComplex RemediationComplexity = 3
)

func (RemediationComplexity) String 

func (r RemediationComplexity) String() string

String returns a human-readable label.

func (RemediationComplexity) Valid 

func (r RemediationComplexity) Valid() bool

Valid reports whether r is a known value.

type RemediationLevel 

type RemediationLevel string

RemediationLevel (RL) — temporal metric. Optional. 

const (
	RLNotDefined   RemediationLevel = "X"
	RLOfficialFix  RemediationLevel = "O"
	RLTemporaryFix RemediationLevel = "T"
	RLWorkaround   RemediationLevel = "W"
	RLUnavailable  RemediationLevel = "U"
)

type Report 

type Report struct {
	Filename    string
	ContentType string
	Data        []byte
}

Report bundles a generated .docx with its metadata.

type ReportConfidence 

type ReportConfidence string

ReportConfidence (RC) — temporal metric. Optional. 

const (
	RCNotDefined ReportConfidence = "X"
	RCUnknown    ReportConfidence = "U"
	RCReasonable ReportConfidence = "R"
	RCConfirmed  ReportConfidence = "C"
)

type ReportPublicSettings 

type ReportPublicSettings struct {
	Captions []string `json:"captions,omitempty"` // figure caption labels, e.g. ["Figure"]
}

ReportPublicSettings carries the public report settings this library models explicitly. Other keys are preserved via Settings.Raw.

type ReportSettings 

type ReportSettings struct {
	Public ReportPublicSettings `json:"public"`
}

ReportSettings is the report section of the settings.

type RestoreParams 

type RestoreParams struct {
	Mode     string   `json:"mode,omitempty"`
	Data     []string `json:"data,omitempty"`
	Password string   `json:"password,omitempty"`
}

RestoreParams configures a restore. Mode "revert" reverts instead of merging; Password decrypts an encrypted archive.

type RetestParams 

type RetestParams struct {
	AuditType string `json:"auditType,omitempty"`
}

RetestParams configures retest creation.

type RetestStatus 

type RetestStatus string

RetestStatus is the outcome of a retest: ok|ko|unknown|partial. 

const (
	RetestOK      RetestStatus = "ok"
	RetestKO      RetestStatus = "ko"
	RetestUnknown RetestStatus = "unknown"
	RetestPartial RetestStatus = "partial"
)

func (RetestStatus) Valid 

func (r RetestStatus) Valid() bool

Valid reports whether r is a known value.

type RichText 

type RichText struct {
	// contains filtered or unexported fields
}

RichText accumulates HTML rich-text content fluently. The zero value is ready to use; call String for the HTML. 

html := pwndoc.NewRichText().
    H(3, "Summary").
    Text("The endpoint is vulnerable to SQL injection.").
    P("Affected parameter: " + pwndoc.Code("id")).
    Bullets("Confirmed on /api/users", "Confirmed on /api/orders").
    Code("bash", "sqlmap -u https://target/api/users?id=1").
    String()

func NewRichText 

func NewRichText() *RichText

NewRichText returns an empty RichText builder.

func (*RichText) Bullets 

func (r *RichText) Bullets(items ...string) *RichText

Bullets appends an unordered list.

func (*RichText) Code 

func (r *RichText) Code(lang, s string) *RichText

Code appends a syntax-highlighted code block.

func (*RichText) H 

func (r *RichText) H(level int, s string) *RichText

H appends a heading (level 1..6).

func (*RichText) Numbered 

func (r *RichText) Numbered(items ...string) *RichText

Numbered appends an ordered list.

func (*RichText) P 

func (r *RichText) P(htmlContent string) *RichText

P appends a paragraph of inline HTML content (not escaped).

func (*RichText) Raw 

func (r *RichText) Raw(htmlContent string) *RichText

Raw appends pre-built HTML verbatim.

func (*RichText) String 

func (r *RichText) String() string

String returns the accumulated HTML.

func (*RichText) Text 

func (r *RichText) Text(s string) *RichText

Text appends a paragraph of plain text (escaped).

type ScopeHost 

type ScopeHost struct {
	Name  string `json:"name"`
	Hosts []Host `json:"hosts,omitempty"`
}

ScopeHost is one named scope entry with optional discovered hosts.

type SectionData 

type SectionData struct {
	ID           string             `json:"_id,omitempty"`
	Field        string             `json:"field,omitempty"`
	Name         string             `json:"name,omitempty"`
	Text         string             `json:"text,omitempty"`
	CustomFields []CustomFieldValue `json:"customFields,omitempty"`
}

SectionData is a custom section of an audit (its per-section custom fields).

type SecurityRequirement 

type SecurityRequirement string

SecurityRequirement is the value type shared by the Confidentiality (CR), Integrity (IR) and Availability (AR) environmental requirement metrics. 

const (
	ReqNotDefined SecurityRequirement = "X"
	ReqLow        SecurityRequirement = "L"
	ReqMedium     SecurityRequirement = "M"
	ReqHigh       SecurityRequirement = "H"
)

type Service 

type Service struct {
	Port     int    `json:"port,omitempty"`
	Protocol string `json:"protocol,omitempty"` // tcp|udp
	Name     string `json:"name,omitempty"`
	Product  string `json:"product,omitempty"`
	Version  string `json:"version,omitempty"`
}

Service is a network service on a Host.

type Settings 

type Settings struct {
	Report ReportSettings `json:"report"`

	// Raw holds the full settings JSON for lossless round-trips.
	Raw json.RawMessage `json:"-"`
}

Settings is the instance settings document. Because the document is large and version-dependent, the full JSON blob is preserved in Raw so that a get-mutate-update round-trip never clobbers keys this library does not model. The typed fields (e.g. report.public.captions) are overlaid back onto Raw on marshal.

func (Settings) MarshalJSON 

func (s Settings) MarshalJSON() ([]byte, error)

MarshalJSON overlays the typed fields onto the preserved Raw blob.

func (*Settings) UnmarshalJSON 

func (s *Settings) UnmarshalJSON(data []byte) error

UnmarshalJSON decodes the typed fields and preserves the full blob in Raw.

type SettingsService 

type SettingsService struct {
	// contains filtered or unexported fields
}

SettingsService reads and updates instance settings.

func (*SettingsService) Captions 

func (s *SettingsService) Captions(ctx context.Context) ([]string, error)

Captions returns the configured figure caption labels (report.public.captions).

func (*SettingsService) Export 

func (s *SettingsService) Export(ctx context.Context) ([]byte, error)

Export returns the settings as JSON bytes.

func (*SettingsService) ExportTo 

func (s *SettingsService) ExportTo(ctx context.Context, w io.Writer) error

ExportTo streams the settings JSON to w.

func (*SettingsService) Get 

func (s *SettingsService) Get(ctx context.Context) (*Settings, error)

Get returns the full settings document.

func (*SettingsService) GetPublic 

func (s *SettingsService) GetPublic(ctx context.Context) (*Settings, error)

GetPublic returns the public subset of the settings.

func (*SettingsService) Revert 

func (s *SettingsService) Revert(ctx context.Context) (*Settings, error)

Revert restores the default settings.

func (*SettingsService) SetCaptions 

func (s *SettingsService) SetCaptions(ctx context.Context, labels []string) error

SetCaptions sets the figure caption labels, preserving all other settings.

func (*SettingsService) Update 

func (s *SettingsService) Update(ctx context.Context, in Settings) (*Settings, error)

Update saves the settings and returns the stored result. Get, mutate, then Update for a forward-compatible round-trip.

type SortFindingsParams 

type SortFindingsParams struct {
	SortOrder string    `json:"sortOrder,omitempty"` // asc|desc
	SortField string    `json:"sortField,omitempty"`
	SortAuto  bool      `json:"sortAuto,omitempty"`
	Findings  []Finding `json:"findings,omitempty"`
}

SortFindingsParams configures finding sort order for an audit.

type TOTPDisableParams 

type TOTPDisableParams struct {
	Token string `json:"totpToken"`
}

TOTPDisableParams disables TOTP using a current code.

type TOTPEnableParams 

type TOTPEnableParams struct {
	Secret string `json:"totpSecret"`
	Token  string `json:"totpToken"`
}

TOTPEnableParams enables TOTP using the secret from GetTOTP and a current code.

type TOTPSetup 

type TOTPSetup struct {
	QRCode string `json:"totpQrUrl,omitempty"`
	Secret string `json:"totpSecret,omitempty"`
}

TOTPSetup carries the data needed to enable two-factor authentication.

type Template 

type Template struct {
	ID   string `json:"_id,omitempty"`
	Name string `json:"name"`
	Ext  string `json:"ext,omitempty"`
	File string `json:"file,omitempty"` // base64, on create/update only
}

Template represents a Word report template.

type TemplateRef 

type TemplateRef struct {
	ID   string `json:"_id,omitempty"`
	Name string `json:"name,omitempty"`
	Ext  string `json:"ext,omitempty"`
}

TemplateRef references a report template. On read pwndoc populates it as an object ({_id, name, ext}); on write only the id is needed.

func (*TemplateRef) UnmarshalJSON 

func (r *TemplateRef) UnmarshalJSON(data []byte) error

UnmarshalJSON allows a TemplateRef to decode from a bare id string or an object.

type TemplatesService 

type TemplatesService struct {
	// contains filtered or unexported fields
}

TemplatesService manages Word report templates.

func (*TemplatesService) Create 

func (s *TemplatesService) Create(ctx context.Context, p CreateTemplateParams) (*Template, error)

Create uploads a new template. Name, File (base64) and Ext are required.

func (*TemplatesService) CreateDefault 

func (s *TemplatesService) CreateDefault(ctx context.Context, name string) (*Template, error)

CreateDefault uploads the built-in minimal report template (see MinimalReportTemplateDocx) under the given name and returns the stored template. This is the one-call way to give an instance a working report template.

func (*TemplatesService) CreateFromFile 

func (s *TemplatesService) CreateFromFile(ctx context.Context, name, path string) (*Template, error)

CreateFromFile uploads a template document from disk. The extension is taken from the file name.

func (*TemplatesService) Delete 

func (s *TemplatesService) Delete(ctx context.Context, id string) error

Delete deletes the template by id.

func (*TemplatesService) Download 

func (s *TemplatesService) Download(ctx context.Context, id string) ([]byte, error)

Download returns the raw bytes of the template document by id.

func (*TemplatesService) DownloadTo 

func (s *TemplatesService) DownloadTo(ctx context.Context, id string, w io.Writer) error

DownloadTo streams the template document to w.

func (*TemplatesService) EnsureDefault 

func (s *TemplatesService) EnsureDefault(ctx context.Context, name string) (*Template, error)

EnsureDefault returns the named template, creating it from the built-in minimal template (see MinimalReportTemplateDocx) if it does not yet exist. This guarantees the instance has a working report template to generate with.

func (*TemplatesService) FindByName 

func (s *TemplatesService) FindByName(ctx context.Context, name string) (*Template, error)

FindByName returns the template whose name matches (case-insensitively), or nil if none exists.

func (*TemplatesService) List 

func (s *TemplatesService) List(ctx context.Context) ([]Template, error)

List returns all report templates.

func (*TemplatesService) Update 

func (s *TemplatesService) Update(ctx context.Context, id string, p CreateTemplateParams) (*Template, error)

Update updates a template's name (and optionally its file/ext).

type UpdateProfileParams 

type UpdateProfileParams struct {
	CurrentPassword string  `json:"currentPassword"`
	NewPassword     string  `json:"newPassword,omitempty"`
	ConfirmPassword string  `json:"confirmPassword,omitempty"`
	Username        string  `json:"username,omitempty"`
	Firstname       string  `json:"firstname,omitempty"`
	Lastname        string  `json:"lastname,omitempty"`
	Email           *string `json:"email,omitempty"`
	Phone           *string `json:"phone,omitempty"`
	JobTitle        *string `json:"jobTitle,omitempty"`
}

UpdateProfileParams updates the current user's own profile. CurrentPassword is required; set NewPassword and ConfirmPassword together to change the password.

type UpdateUserParams 

type UpdateUserParams struct {
	Username    *string `json:"username,omitempty"`
	Firstname   *string `json:"firstname,omitempty"`
	Lastname    *string `json:"lastname,omitempty"`
	Email       *string `json:"email,omitempty"`
	Phone       *string `json:"phone,omitempty"`
	JobTitle    *string `json:"jobTitle,omitempty"`
	Password    *string `json:"password,omitempty"`
	Role        *string `json:"role,omitempty"`
	TOTPEnabled *bool   `json:"totpEnabled,omitempty"`
	Enabled     *bool   `json:"enabled,omitempty"`
}

UpdateUserParams updates another user (admin). Only non-nil fields are sent.

type UploadImageParams 

type UploadImageParams struct {
	Value   string `json:"value"`
	Name    string `json:"name,omitempty"`
	AuditID string `json:"auditId,omitempty"`
}

UploadImageParams are the fields for uploading an image. Value is a data URI; AuditID is optional but recommended so the image is scoped to an audit.

type User 

type User struct {
	ID          string `json:"_id,omitempty"`
	Username    string `json:"username,omitempty"`
	Firstname   string `json:"firstname,omitempty"`
	Lastname    string `json:"lastname,omitempty"`
	Role        string `json:"role,omitempty"`
	Email       string `json:"email,omitempty"`
	Phone       string `json:"phone,omitempty"`
	JobTitle    string `json:"jobTitle,omitempty"`
	TOTPEnabled bool   `json:"totpEnabled,omitempty"`
	Enabled     bool   `json:"enabled,omitempty"`
}

User represents a pwndoc user account.

type UserInteraction 

type UserInteraction string

UserInteraction (UI) — base metric. Required. 

const (
	UINone     UserInteraction = "N"
	UIRequired UserInteraction = "R"
)

type UsersService 

type UsersService struct {
	// contains filtered or unexported fields
}

UsersService manages user accounts.

func (*UsersService) Create 

func (s *UsersService) Create(ctx context.Context, p CreateUserParams) (*User, error)

Create creates a user and returns the stored record (re-read by username, since pwndoc returns only a status message).

func (*UsersService) DisableTOTP 

func (s *UsersService) DisableTOTP(ctx context.Context, p TOTPDisableParams) error

DisableTOTP disables TOTP on the current account.

func (*UsersService) EnableTOTP 

func (s *UsersService) EnableTOTP(ctx context.Context, p TOTPEnableParams) error

EnableTOTP enables TOTP on the current account.

func (*UsersService) Get 

func (s *UsersService) Get(ctx context.Context, username string) (*User, error)

Get returns a user by username.

func (*UsersService) GetTOTP 

func (s *UsersService) GetTOTP(ctx context.Context) (*TOTPSetup, error)

GetTOTP returns the QR-code URL and secret for enabling TOTP on the current account.

func (*UsersService) Init 

func (s *UsersService) Init(ctx context.Context, p CreateUserParams) (*User, error)

Init creates the first user on a fresh instance (always an admin) and logs the client in. It fails if the instance is already initialized.

func (*UsersService) InitRequired 

func (s *UsersService) InitRequired(ctx context.Context) (bool, error)

InitRequired reports whether the instance has no users yet and therefore needs its first (admin) user created with Init.

func (*UsersService) List 

func (s *UsersService) List(ctx context.Context) ([]User, error)

List returns all users.

func (*UsersService) Me 

func (s *UsersService) Me(ctx context.Context) (*User, error)

Me returns the currently authenticated user.

func (*UsersService) Reviewers 

func (s *UsersService) Reviewers(ctx context.Context) ([]User, error)

Reviewers returns all users permitted to review audits.

func (*UsersService) Update 

func (s *UsersService) Update(ctx context.Context, id string, p UpdateUserParams) (*User, error)

Update updates another user (admin) and returns the stored record.

func (*UsersService) UpdateMe 

func (s *UsersService) UpdateMe(ctx context.Context, p UpdateProfileParams) (*User, error)

UpdateMe updates the current user's own profile. On success the rotated access token is stored automatically.

type VulnDetail 

type VulnDetail struct {
	Locale       string             `json:"locale"`
	Title        string             `json:"title,omitempty"`
	VulnType     string             `json:"vulnType,omitempty"`
	Description  string             `json:"description,omitempty"`
	Observation  string             `json:"observation,omitempty"`
	Remediation  string             `json:"remediation,omitempty"`
	References   []string           `json:"references,omitempty"`
	CustomFields []CustomFieldValue `json:"customFields,omitempty"`
}

VulnDetail is the localized content of a vulnerability.

type VulnerabilitiesService 

type VulnerabilitiesService struct {
	// contains filtered or unexported fields
}

VulnerabilitiesService manages the reusable vulnerability template database.

func (*VulnerabilitiesService) Create 

func (s *VulnerabilitiesService) Create(ctx context.Context, v []Vulnerability) ([]Vulnerability, error)

Create bulk-creates vulnerabilities. Each must have at least one detail with a locale and title.

func (*VulnerabilitiesService) CreateFromFinding 

func (s *VulnerabilitiesService) CreateFromFinding(ctx context.Context, locale string, f Finding) (string, error)

CreateFromFinding promotes a finding into the vulnerability template database for the given locale, returning the server's status message.

func (*VulnerabilitiesService) Delete 

func (s *VulnerabilitiesService) Delete(ctx context.Context, id string) error

Delete deletes a vulnerability by id.

func (*VulnerabilitiesService) DeleteAll 

func (s *VulnerabilitiesService) DeleteAll(ctx context.Context) error

DeleteAll deletes every vulnerability in the database.

func (*VulnerabilitiesService) Export 

func (s *VulnerabilitiesService) Export(ctx context.Context) ([]byte, error)

Export returns the full vulnerability database as JSON bytes (suitable for a backup or for re-import via Create).

func (*VulnerabilitiesService) List 

func (s *VulnerabilitiesService) List(ctx context.Context) ([]Vulnerability, error)

List returns all vulnerabilities (full, with all locales).

func (*VulnerabilitiesService) ListByLocale 

func (s *VulnerabilitiesService) ListByLocale(ctx context.Context, locale string) ([]Vulnerability, error)

ListByLocale returns vulnerabilities flattened to a single locale's content.

func (*VulnerabilitiesService) Merge 

func (s *VulnerabilitiesService) Merge(ctx context.Context, vulnID string, p MergeParams) error

Merge merges the source vulnerability's locale content (p.VulnID / p.Locale) into the target vulnerability vulnID.

func (*VulnerabilitiesService) Update 

func (s *VulnerabilitiesService) Update(ctx context.Context, id string, v Vulnerability) (*Vulnerability, error)

Update updates a vulnerability by id.

func (*VulnerabilitiesService) Updates 

func (s *VulnerabilitiesService) Updates(ctx context.Context, vulnID string) ([]Vulnerability, error)

Updates returns the pending community updates for a vulnerability id.

type Vulnerability 

type Vulnerability struct {
	ID                    string                `json:"_id,omitempty"`
	CVSSv3                string                `json:"cvssv3,omitempty"`
	CVSSv4                string                `json:"cvssv4,omitempty"`
	Priority              Priority              `json:"priority,omitempty"`
	RemediationComplexity RemediationComplexity `json:"remediationComplexity,omitempty"`
	Category              string                `json:"category,omitempty"`
	Details               []VulnDetail          `json:"details,omitempty"`
	Status                int                   `json:"status,omitempty"`
}

Vulnerability is a reusable entry in the vulnerability template database. Its localized content lives in Details (one per locale).

type VulnerabilityCategory 

type VulnerabilityCategory struct {
	Name      string `json:"name"`
	SortValue string `json:"sortValue,omitempty"`
	SortOrder string `json:"sortOrder,omitempty"` // asc|desc
	SortAuto  bool   `json:"sortAuto,omitempty"`
}

VulnerabilityCategory groups findings/vulnerabilities and controls sorting.

type VulnerabilityType 

type VulnerabilityType struct {
	Name   string `json:"name"`
	Locale string `json:"locale,omitempty"`
}

VulnerabilityType is a category of vulnerability for a locale.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.