feat: Pretexta v2 — major platform overhaul for DEF CON Singapore 2026

Complete platform rewrite with new features, Indonesian content, and fixes:

PLATFORM ARCHITECTURE
- Role-based access: admin / trainer / user with separate dashboards
- Event-sourced simulation runtime with RiskVector (6 Cialdini dimensions)
- AIGateway abstraction for 6 LLM providers (Gemini, OpenAI, Anthropic, etc.)
- PersonaEngine for behavioral simulation state management
- Training groups + assignment system (trainer → user workflow)

NEW FEATURES
- Glossary CRUD: admin-managed social engineering terminology
- User History & Analytics: instructor view of any user's simulation logs
- Campaign Gameplay: multi-stage attack chains with stage-by-stage progress
- Indonesian Content Library: 6 scenarios + 3 quizzes in Indonesian context
- 6 new AI personas with Indonesian workplace context (DJP, BRI CS, BEC WhatsApp)
- 3 sample campaigns: BUMN infiltration, employee awareness, PNS red team

INDONESIAN SCENARIOS (new)
- Phishing DJP: NPWP verification scam
- WhatsApp OTP hijacking
- CEO Fraud targeting BUMN (Rp 4.75B transfer)
- BRI bank vishing (caller ID spoofing)
- BSSN spear phishing targeting PNS
- Social engineering via rapport building

BUG FIXES
- Assignment deep-link: Start button now launches specific content directly
- Mission logs: delete restricted to admin only
- Scenarios/Quiz page: 0 nodes/questions display fixed (MongoDB aggregation)
- Campaign stages: now actually playable end-to-end with auto-progress
- Select.Item empty string error in Assignments page
- Scenario player: no longer auto-navigates to History on load failure
- Challenge/Quiz schema: all fields made optional (eliminates 422 errors)

BACKEND
- New routes: /glossary, /instructor/user-history, /campaigns/stage/*/start
- YAML seeder runs on every startup (upsert-by-title, no duplicate imports)
- Campaign YAML type support in import_yaml.py and server auto-import
- Glossary seeded with 22 initial Indonesian + global terms on first run

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: dalpan

PRETEXTA/.claude/settings.local.json

@@ -0,0 +1,9 @@
+{
+  "permissions": {
+    "allow": [
+      "Read(//mnt/d/DEFCON/Pretexta/**)",
+      "Bash(python -c ' *)",
+      "Bash(git -C \"d:/DEFCON\" show HEAD:PRETEXTA/backend/routes/campaigns.py)"
+    ]
+  }
+}

PRETEXTA/.env.example

@@ -0,0 +1,36 @@
+# =============================================================
+# Pretexta — Environment Configuration
+# =============================================================
+# 1. Copy this file:  cp .env.example .env
+# 2. Edit .env with your actual values
+# 3. NEVER commit .env to version control
+# =============================================================
+
+# ---- Ports ----
+FRONTEND_PORT=9443
+BACKEND_PORT=9442
+MONGO_PORT=47017
+
+# ---- MongoDB ----
+MONGO_USERNAME=soceng_admin
+MONGO_PASSWORD=soceng_secure_password_2025
+DB_NAME=Pretexta
+
+# ---- JWT Secret (CHANGE IN PRODUCTION — use a long random string) ----
+# Generate: python3 -c "import secrets; print(secrets.token_hex(32))"
+JWT_SECRET=change-this-secret-key-in-production
+
+# ---- CORS Origins (comma-separated list of allowed frontend origins) ----
+CORS_ORIGINS=http://localhost:9443,http://localhost:3000,http://localhost:80
+
+# ---- Frontend → Backend URL (baked into React bundle at build time) ----
+# For Docker: use the backend container port that's mapped to the host
+# For local dev: http://localhost:8001
+REACT_APP_BACKEND_URL=http://localhost:9442
+
+# ---- Seed Admin User (created on first run if DB is empty) ----
+# This user gets role=admin automatically.
+# Change before deploying to production!
+SEED_ADMIN_USERNAME=soceng
+SEED_ADMIN_PASSWORD=Cialdini@2025!
+SEED_ADMIN_DISPLAY_NAME=Admin

PRETEXTA/.github/workflows/ci.yml

@@ -0,0 +1,67 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  backend-lint:
+    name: Backend Lint
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install ruff
+        run: pip install ruff
+
+      - name: Lint
+        run: ruff check .
+
+      - name: Format check
+        run: ruff format --check .
+
+  frontend-lint:
+    name: Frontend Lint & Build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+          cache: "yarn"
+          cache-dependency-path: frontend/yarn.lock
+
+      - name: Install dependencies
+        run: yarn install --frozen-lockfile
+
+      - name: Lint
+        run: yarn lint 2>/dev/null || true
+
+      - name: Build
+        run: yarn build
+
+  docker-build:
+    name: Docker Build
+    runs-on: ubuntu-latest
+    needs: [backend-lint, frontend-lint]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build backend image
+        run: docker build -f Dockerfile.backend -t pretexta-backend:test .
+
+      - name: Build frontend image
+        run: docker build -f Dockerfile.frontend -t pretexta-frontend:test .

PRETEXTA/.gitignore

@@ -0,0 +1,45 @@
+
+# Node.js / TypeScript
+node_modules/
+dist/
+build/
+out/
+coverage/
+.env
+.DS_Store
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+
+# Python
+__pycache__/
+*.py[cod]
+*$py.class
+venv/
+.venv/
+env/
+.env/
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# IDEs
+.vscode/
+.idea/

PRETEXTA/CONTRIBUTING.md

@@ -0,0 +1,170 @@
+# Contributing to Pretexta
+
+Thank you for your interest in contributing! We welcome YAML-based scenarios and quizzes that help improve security awareness training.
+
+## 🎯 What We're Looking For
+
+- **Realistic** social engineering scenarios
+- Coverage of all 6 Cialdini principles:
+  - Authority
+  - Scarcity
+  - Reciprocity
+  - Commitment & Consistency
+  - Liking
+  - Social Proof
+- Diverse attack vectors: email, phone, chat, web
+- Bilingual content (EN/ID preferred)
+- Well-documented decision trees
+
+## 📝 YAML Guidelines
+
+### File Naming
+
+```
+YYYY-MM-DD-brief-description-slug.yaml
+```
+
+Examples:
+- `2025-01-15-ceo-fraud-wire-transfer.yaml`
+- `2025-01-16-it-support-password-reset.yaml`
+
+### Challenge Template
+
+See `templates/challenge_template.yaml`
+
+```yaml
+type: challenge
+title: "Your Challenge Title"
+description: "Brief description for users"
+difficulty: easy|medium|hard
+cialdini_categories: [authority, scarcity]
+estimated_time: 10  # minutes
+metadata:
+  author: "Your Name"
+  license: "MIT"
+  tags: [phishing, email, corporate]
+
+nodes:
+  - id: start
+    type: message
+    channel: email_inbox
+    content_en:
+      subject: "Email subject"
+      from: "sender@example.com"
+      body: "Email body"
+    content_id:  # Optional Indonesian
+      subject: "Subjek email"
+      from: "pengirim@example.com"
+      body: "Isi email"
+    next: choice_1
+
+  - id: choice_1
+    type: question
+    content_en:
+      text: "What do you do?"
+    options:
+      - text: "Click the link"
+        next: bad_outcome
+        score_impact: -15
+      - text: "Verify first"
+        next: good_outcome
+        score_impact: +10
+
+  - id: bad_outcome
+    type: end
+    result: failure
+    content_en:
+      title: "Compromised!"
+      explanation: "Clicking unverified links can lead to credential theft."
+
+  - id: good_outcome
+    type: end
+    result: success
+    content_en:
+      title: "Well done!"
+      explanation: "Always verify requests through known channels."
+```
+
+### Quiz Template
+
+See `templates/quiz_template.yaml`
+
+```yaml
+type: quiz
+title: "Quiz Title"
+description: "Brief description"
+difficulty: easy|medium|hard
+cialdini_categories: 
+  - authority
+
+metadata:
+  author: "Pretexta"
+  tags: [phishing, email, basics]
+
+questions:
+  - id: q1
+    content_en:
+      text: "Question text?"
+      explanation: "Why this answer matters"
+    options:
+      - text: "Option A"
+        correct: true
+      - text: "Option B"
+        correct: false
+    points: 10
+```
+
+## ✅ Validation
+
+Before submitting:
+
+```bash
+python bin/validate_yaml.py your_file.yaml
+```
+
+## 🔄 Pull Request Process
+
+1. **Fork** the repository
+2. **Create** a branch: `git checkout -b add-scenario-name`
+3. **Add** your YAML to `data/sample/`
+4. **Validate** using the CLI tool
+5. **Commit**: `git commit -m "Add: CEO fraud scenario"`
+6. **Push**: `git push origin add-scenario-name`
+7. **Submit** a Pull Request
+
+### PR Guidelines
+
+- **One YAML per PR** (easier to review)
+- Include brief description of scenario
+- Test locally before submitting
+- Follow existing naming conventions
+- Add yourself to metadata author field
+
+## 🚫 What Not to Submit
+
+- Scenarios targeting real individuals or organizations
+- Content promoting illegal activities
+- Scenarios that could cause harm if misused
+- Malicious payloads or actual exploits
+- Low-quality or joke submissions
+
+## 📚 Resources
+
+- [Cialdini's 6 Principles](https://en.wikipedia.org/wiki/Robert_Cialdini#6_key_principles_of_influence_by_Robert_Cialdini)
+- [Social Engineering Attacks](https://www.social-engineer.org/framework/attack-vectors/)
+- [YAML Syntax](https://yaml.org/spec/1.2.2/)
+
+## 🤝 Code of Conduct
+
+- Be respectful and professional
+- Focus on security awareness education
+- No discrimination or harassment
+- Constructive feedback only
+
+## ❔ Questions?
+
+Open an issue or reach out to the maintainers.
+
+---
+
+**Thank you for helping make security awareness training more effective!**

PRETEXTA/Dockerfile.backend

@@ -0,0 +1,35 @@
+# syntax=docker/dockerfile:1
+FROM python:3.11-slim
+
+# Build-time DNS fix for environments with IPv6 issues (WSL2, certain CI systems)
+# Ensures pip install works even if the container's DNS is broken
+ARG PIP_INDEX_URL=https://pypi.org/simple/
+
+WORKDIR /app
+
+# Install system dependencies — cached separately from code changes
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc \
+    g++ \
+    libffi-dev \
+    libjpeg-dev \
+    libopenjp2-7 \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Python dependencies before copying code (better layer cache)
+COPY backend/requirements.txt ./requirements.txt
+RUN pip install --no-cache-dir --timeout 120 -r requirements.txt
+
+# Copy backend source code
+COPY backend/ /app/
+
+# Create required directories
+RUN mkdir -p /app/data/sample /app/data/professionals /app/bin
+
+EXPOSE 8001
+
+HEALTHCHECK --interval=10s --timeout=5s --start-period=15s --retries=3 \
+    CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8001/api/health')" || exit 1
+
+CMD ["uvicorn", "server:app", "--host", "0.0.0.0", "--port", "8001"]