Directories
¶
| Path | Synopsis |
|---|---|
|
Package apigen provides primitives to interact with the openapi HTTP API.
|
Package apigen provides primitives to interact with the openapi HTTP API. |
|
Package apperr defines the domain error vocabulary shared by every service.
|
Package apperr defines the domain error vocabulary shared by every service. |
|
Package audit records admin-relevant actions to the audit_log table.
|
Package audit records admin-relevant actions to the audit_log table. |
|
Package auth owns credentials and sessions: argon2id password hashing (PHC strings), the AuthProvider interface with the v0.1 email+password implementation, Redis-backed sessions, and the request identity context.
|
Package auth owns credentials and sessions: argon2id password hashing (PHC strings), the AuthProvider interface with the v0.1 email+password implementation, Redis-backed sessions, and the request identity context. |
|
Package challenges is the challenge domain service: admin CRUD (with the admin/participant split enforced at the handler layer), attachment storage, and the participant-facing board with visibility and phase gating.
|
Package challenges is the challenge domain service: admin CRUD (with the admin/participant split enforced at the handler layer), attachment storage, and the participant-facing board with visibility and phase gating. |
|
Package clock provides an injectable time source so time-based decisions (event window, freeze) are testable without sleeping (docs/v0.1/03-tech-stack.md).
|
Package clock provides an injectable time source so time-based decisions (event window, freeze) are testable without sleeping (docs/v0.1/03-tech-stack.md). |
|
Package config parses the process environment into one typed Config struct.
|
Package config parses the process environment into one typed Config struct. |
|
Package db owns the pgx connection pool and the goose migration runner.
|
Package db owns the pgx connection pool and the goose migration runner. |
|
migrations
Package migrations embeds the goose SQL migrations so they ship inside the binary and run on boot without a migrations directory on disk.
|
Package migrations embeds the goose SQL migrations so they ship inside the binary and run on boot without a migrations directory on disk. |
|
Package events is the single-event domain service: reads, admin updates with window validation, phase/freeze computation against an injected clock, and first-boot default-event seeding.
|
Package events is the single-event domain service: reads, admin updates with window validation, phase/freeze computation against an injected clock, and first-boot default-event seeding. |
|
Package fdbudget apportions a process's file-descriptor limit among the consumers that hold an fd per unit of concurrent work: live WebSocket connections and in-flight plugin calls (each pins its inbound request fd for the call's duration).
|
Package fdbudget apportions a process's file-descriptor limit among the consumers that hold an fd per unit of concurrent work: live WebSocket connections and in-flight plugin calls (each pins its inbound request fd for the call's duration). |
|
Package flags generates per-instance dynamic flags.
|
Package flags generates per-instance dynamic flags. |
|
Package handlers implements the generated strict-server interface.
|
Package handlers implements the generated strict-server interface. |
|
Package httpserver assembles the chi router: middleware stack, operational endpoints (/healthz, /readyz, /metrics), the mounted /api/v0 handler, and the embedded SPA fallback.
|
Package httpserver assembles the chi router: middleware stack, operational endpoints (/healthz, /readyz, /metrics), the mounted /api/v0 handler, and the embedded SPA fallback. |
|
Package httpx holds transport helpers shared across the HTTP layer: request-ID context plumbing, JSON writing, and the single problem+json error translator.
|
Package httpx holds transport helpers shared across the HTTP layer: request-ID context plumbing, JSON writing, and the single problem+json error translator. |
|
Package metrics owns the Prometheus registry and the platform's custom metrics.
|
Package metrics owns the Prometheus registry and the platform's custom metrics. |
|
Package pagination normalizes page/per_page query params into limit/offset.
|
Package pagination normalizes page/per_page query params into limit/offset. |
|
Package plugin is the host side of the OSCTF plugin ABI: discovery, the manifest, launching and supervising plugin processes, the in-flight budget, and the registry wiring.
|
Package plugin is the host side of the OSCTF plugin ABI: discovery, the manifest, launching and supervising plugin processes, the in-flight budget, and the registry wiring. |
|
plugintest
Package plugintest provides the hostile plugin doubles and the build/dial harness they are exercised through.
|
Package plugintest provides the hostile plugin doubles and the build/dial harness they are exercised through. |
|
plugintest/doubles/configecho
command
Double: reads its config through the PUBLIC sdk.Config() and reflects it in Value — so the host→plugin config path (OSCTF_PLUGIN_CONFIG env → sdk.Config) can be asserted end to end.
|
Double: reads its config through the PUBLIC sdk.Config() and reflects it in Value — so the host→plugin config path (OSCTF_PLUGIN_CONFIG env → sdk.Config) can be asserted end to end. |
|
plugintest/doubles/crashafter
command
Double: CRASHES AFTER SERVING — handshakes and answers Info, then exits non-zero on the first Value call.
|
Double: CRASHES AFTER SERVING — handshakes and answers Info, then exits non-zero on the first Value call. |
|
plugintest/doubles/crashlaunch
command
Double: CRASH ON LAUNCH — exits non-zero before serving, every time.
|
Double: CRASH ON LAUNCH — exits non-zero before serving, every time. |
|
plugintest/doubles/goodscore
command
Double: well-behaved baseline.
|
Double: well-behaved baseline. |
|
plugintest/doubles/hang
command
Double: HANG — Value never returns (and ignores the context).
|
Double: HANG — Value never returns (and ignores the context). |
|
plugintest/doubles/ignoreshutdown
command
Double: IGNORES SHUTDOWN — serves correctly but traps and ignores SIGINT/SIGTERM, so a graceful stop does not make it exit.
|
Double: IGNORES SHUTDOWN — serves correctly but traps and ignores SIGINT/SIGTERM, so a graceful stop does not make it exit. |
|
plugintest/doubles/logecho
command
Double: logs via the PUBLIC sdk.Log() on each call, so the plugin→host log path (over go-plugin's stderr channel into the host Logger) can be asserted end to end.
|
Double: logs via the PUBLIC sdk.Log() on each call, so the plugin→host log path (over go-plugin's stderr channel into the host Logger) can be asserted end to end. |
|
plugintest/doubles/malformed
command
Double: MALFORMED — serves Info fine but returns a gRPC error status on Value (and an out-of-contract Info name mismatch is available via NAME).
|
Double: MALFORMED — serves Info fine but returns a gRPC error status on Value (and an out-of-contract Info name mismatch is available via NAME). |
|
plugintest/doubles/nohandshake
command
Double: NEVER HANDSHAKES — a valid executable that starts and then blocks forever without calling plugin.Serve, so the go-plugin handshake never completes and the loader's launch is stuck until its StartTimeout.
|
Double: NEVER HANDSHAKES — a valid executable that starts and then blocks forever without calling plugin.Serve, so the go-plugin handshake never completes and the loader's launch is stuck until its StartTimeout. |
|
plugintest/doubles/slow
command
Double: SLOW — responds correctly, every time, in 4 seconds, and deliberately IGNORES the request context.
|
Double: SLOW — responds correctly, every time, in 4 seconds, and deliberately IGNORES the request context. |
|
plugintest/doubles/slowcoop
command
Double: SLOW BUT COOPERATIVE — a long call like `slow`, except it HONORS ctx cancellation: on cancel it returns promptly with codes.Canceled instead of running to completion.
|
Double: SLOW BUT COOPERATIVE — a long call like `slow`, except it HONORS ctx cancellation: on cancel it returns promptly with codes.Canceled instead of running to completion. |
|
plugintest/doubles/slowshutdown
command
Double: SLOW ONLY ON SHUTDOWN — responds normally, but on a stop signal takes far longer than the 30s drain window to exit.
|
Double: SLOW ONLY ON SHUTDOWN — responds normally, but on a stop signal takes far longer than the 30s drain window to exit. |
|
plugintest/doubles/wrongabi
command
Double: WRONG ABI MAJOR — serves correctly but with a go-plugin ProtocolVersion the host does not speak.
|
Double: WRONG ABI MAJOR — serves correctly but with a go-plugin ProtocolVersion the host does not speak. |
|
Package redisx sets up the shared go-redis client.
|
Package redisx sets up the shared go-redis client. |
|
Package runtime manages challenge workload containers behind the ChallengeRuntime interface.
|
Package runtime manages challenge workload containers behind the ChallengeRuntime interface. |
|
Package scheduler owns the lifecycle of per-team challenge instances: spawn on demand (with quota + flag + TTL), extend, stop, expire on a TTL, and clean up at event end.
|
Package scheduler owns the lifecycle of per-team challenge instances: spawn on demand (with quota + flag + TTL), extend, stop, expire on a TTL, and clean up at event end. |
|
Package scoreboard computes standings from the ground truth (recompute-from- scratch, not incremental), caches the snapshot in Redis, and manages the freeze snapshot.
|
Package scoreboard computes standings from the ground truth (recompute-from- scratch, not incremental), caches the snapshot in Redis, and manages the freeze snapshot. |
|
Package scoring computes challenge point values.
|
Package scoring computes challenge point values. |
|
Package seed performs idempotent first-boot seeding: the admin account, the default event (M4), and the example challenges (M10).
|
Package seed performs idempotent first-boot seeding: the admin account, the default event (M4), and the example challenges (M10). |
|
Package storage persists challenge attachments and future blobs behind the ObjectStore interface.
|
Package storage persists challenge attachments and future blobs behind the ObjectStore interface. |
|
Package submissions owns the flag-submission hot path: the single-transaction flow that locks the challenge, enforces solve/attempt rules, compares the flag in constant time, and always logs the attempt (docs/v0.1/01-architecture.md).
|
Package submissions owns the flag-submission hot path: the single-transaction flow that locks the challenge, enforces solve/attempt rules, compares the flag in constant time, and always logs the attempt (docs/v0.1/01-architecture.md). |
|
Package teams is the team domain service: creation, membership, captain transfer, and the public team pages.
|
Package teams is the team domain service: creation, membership, captain transfer, and the public team pages. |
|
Package testsupport spins up ephemeral Postgres and Redis via testcontainers for integration tests.
|
Package testsupport spins up ephemeral Postgres and Redis via testcontainers for integration tests. |
|
Package users is the user-account domain service: registration validation, profile reads, and password changes.
|
Package users is the user-account domain service: registration validation, profile reads, and password changes. |
|
Package version exposes the build version, set via -ldflags at build time.
|
Package version exposes the build version, set via -ldflags at build time. |
|
Package webdist serves the React SPA.
|
Package webdist serves the React SPA. |
|
Package ws is the WebSocket hub for live scoreboard updates: a connection registry, throttled latest-wins broadcast, ping/pong keepalive, and graceful drain on shutdown.
|
Package ws is the WebSocket hub for live scoreboard updates: a connection registry, throttled latest-wins broadcast, ping/pong keepalive, and graceful drain on shutdown. |
Click to show internal directories.
Click to hide internal directories.