Eop card browser/m3 eop api endpoints

[ayman-art]

Description

• Serves the Elevation of Privilege (EoP) edition (eop-5.0-en) through the existing cornucopia API, so that API consumers like OWASP Threat Dragon can pull the EoP cards and discover their card browser pages.
• Completes milestone M3 of the EoP Card Browser Project Adding a endpoint for each eop card and to the card browser #1322
• Unblocks Add Elevation of Privilege game to OWASP Threat Dragon EoP Games diagram threat-dragon#1448 as GET /api/cre/eop/en is the endpoint mentioned there for adding the Elevation of Privilege game to Threat Dragon's EoP Games diagram.

Changes

Feature 1: EoP API endpoints

GET /api/lang/eop/{version}

Returns the supported languages for an EoP deck version. The route is generic and already works, so no code change was needed for this endpoint, only tests were added (Feature 4).

GET /api/cre/eop/{lang}

Returns all 78 EoP cards with their codes, descriptions and card page links. This is the endpoint OWASP/threat-dragon#1448 will consume.

• src/routes/api/cre/[edition]/[lang]/+server.ts: added eop to the editions allowlist
• src/domain/cre/creController.ts: added eop to the editions map as "Elevation of Privilege Edition" and the category map as "Elevation of Privilege"

GET /api/cre/eop

Returns the eop edition metadata (name, languages, latest version). The route is generic and already works.

GET /api/mapping/eop/{version}

Returns the per-card STRIDE mappings (stride, stride_print, url). The route is generic and already works.

Feature 2: Spanish and Russian translations

The eop translations already existed in source/, so registering them was enough: /api/lang/eop/5.0 now returns ["en", "es", "ru"] and /api/cre/eop/{lang} serves all three languages.

• src/lib/services/deckService.ts: added es and ru to the eop entries in latests and decks
• src/domain/suit/suitController.ts: added es and ru to the eop entry in the languages map

Feature 3: API docs

Documented the EoP endpoints at /api/docs, all in static/api/openapi.yaml:

• /lang/eop/{version}: new entry with the LanguageMetaEop schema
• /cre/eop/{lang}: new entry, noting the empty links as EoP has no Open CRE mappings
• /mapping/eop/{version}: new entry for the generic mapping route
• /lang/{edition}/{version}: added eop to the edition enum
• Also fixed the indentation inconsistentcy of LanguageMetaCompanion schema and the API description string, which had only mentioned the Website App and Mobile App editions

Feature 4: Tests

Mimicking the existing webapp endpoint tests:

• src/routes/api/lang/[edition]/[version]/server.test.ts: response test for /api/lang/eop/5.0
• src/routes/api/cre/[edition]/[lang]/server.test.ts: response test for /api/cre/eop/en
• src/lib/services/deckService.test.ts: updated the eop languages tests after providing the new languages

Screenshots:

Notes

Resolved or fixed issue: none (partial progress on #1322)

AI Tool Disclosure

• My contribution does not include any AI-generated content
• My contribution includes AI-generated content, as disclosed below:
  • AI Tools: [e.g. GitHub CoPilot, ChatGPT, JetBrains Junie etc.]
  • LLMs and versions: [e.g. GPT-4.1, Claude Haiku 4.5, Gemini 2.5 Pro etc.]
  • Prompts: [Summarize the key prompts or instructions given to the AI tools]

Affirmation

• My code follows the CONTRIBUTING.md guidelines

[ayman-art]

@sydseter @rewtd

GET /api/cre/eop/en now returns all 78 cards like this:

{
  "meta": {
    "edition": "Elevation of Privilege Edition",
    "component": "cards",
    "language": "en",
    "version": "5.0"
  },
  "standards": [
    {
      "doctype": "Tool",
      "id": "https://cornucopia.owasp.org/edition/eop/SP2/5.0/en",
      "name": "Elevation of Privilege Edition",
      "section": "Spoofing",
      "description": "An attacker could take over the port or socket that the server normally uses",
      "sectionID": "SP2",
      "hyperlink": "https://cornucopia.owasp.org/edition/eop/SP2/5.0/en",
      "links": [],
      "tags": [
        "Threat modeling",
        "Elevation of Privilege"
      ],
      "tooltype": "Defensive"
    },
    ...
  ]
}

The links array is empty because EoP has no ASVS/CAPEC/CRE mappings, which also means GET /api/asvs/eop/5.0 and GET /api/capec/eop/5.0 currently are not existing. What do you think of this response for OWASP/threat-dragon#1448, is the empty links acceptable? Should EoP have ASVS/CAPEC mappings at all?

Note: this branch is based on the M2 branch (#3181) since it needs the eop deck registration. I'll rebase onto master once M2 is merged.

[sydseter]

@sydseter @rewtd

GET /api/cre/eop/en now returns all 78 cards like this:

{
  "meta": {
    "edition": "Elevation of Privilege Edition",
    "component": "cards",
    "language": "en",
    "version": "5.0"
  },
  "standards": [
    {
      "doctype": "Tool",
      "id": "https://cornucopia.owasp.org/edition/eop/SP2/5.0/en",
      "name": "Elevation of Privilege Edition",
      "section": "Spoofing",
      "description": "An attacker could take over the port or socket that the server normally uses",
      "sectionID": "SP2",
      "hyperlink": "https://cornucopia.owasp.org/edition/eop/SP2/5.0/en",
      "links": [],
      "tags": [
        "Threat modeling",
        "Elevation of Privilege"
      ],
      "tooltype": "Defensive"
    },
    ...
  ]
}

The links array is empty because EoP has no ASVS/CAPEC/CRE mappings, which also means GET /api/asvs/eop/5.0 and GET /api/capec/eop/5.0 currently are not existing. What do you think of this response for OWASP/threat-dragon#1448, is the empty links acceptable? Should EoP have ASVS/CAPEC mappings at all?

Note: this branch is based on the M2 branch (#3181) since it needs the eop deck registration. I'll rebase onto master once M2 is merged.

Yes, this is acceptable. Are we able to get it in Spanish and Russian as well?

[ayman-art]

Yes, this is acceptable. Are we able to get it in Spanish and Russian as well?

Done!
Now, regarding the documentation, I noticed some inconsistencies in the api docs for the other editions:

Companion

• No /lang/companion/{version} entry provided, though the endpoint works and other decks have this.
• The only edition with a no-lang /cre/companion entry documented.

DBD

• Missing from the generic /lang/{edition}/{version} edition enum.
• No /mapping/dbd entry, while the other editions' mapping endpoints are documented.

Should those be fixed too?