Initial commit: Laravel OSINT platform

Multi-user OSINT investigation tool with owner-controlled per-user and per-group access grants. Includes Sherlock, theHarvester, crt.sh, WHOIS, and ip-api.com collectors wired through a pluggable Runner/queue pipeline, investigation search, and printable/CSV/JSON reporting. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-20 10:22:05 +03:00
commit 873699e23e
165 changed files with 18507 additions and 0 deletions
@@ -0,0 +1,84 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Investigation;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+class InvestigationReportTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_owner_can_view_printable_report(): void
+    {
+        $user = User::factory()->create();
+        $investigation = Investigation::factory()->for($user, 'owner')->create();
+
+        $this->actingAs($user)
+            ->get(route('investigations.report', $investigation))
+            ->assertOk()
+            ->assertSee($investigation->name);
+    }
+
+    public function test_unrelated_user_cannot_view_report(): void
+    {
+        $user = User::factory()->create();
+        $stranger = User::factory()->create();
+        $investigation = Investigation::factory()->for($user, 'owner')->create();
+
+        $this->actingAs($stranger)
+            ->get(route('investigations.report', $investigation))
+            ->assertForbidden();
+    }
+
+    public function test_csv_export_contains_finding_rows(): void
+    {
+        $user = User::factory()->create();
+        $investigation = Investigation::factory()->for($user, 'owner')->create();
+        $target = $investigation->targets()->create(['type' => 'username', 'value' => 'someone', 'created_by' => $user->id]);
+        $source = \App\Models\Source::create([
+            'key' => 'test-source', 'name' => 'Test Source', 'target_types' => ['username'], 'enabled' => true,
+        ]);
+        $target->findings()->create([
+            'source_id' => $source->id, 'status' => 'completed', 'summary' => 'Found it',
+        ]);
+
+        $response = $this->actingAs($user)->get(route('investigations.export.csv', $investigation));
+
+        $response->assertOk();
+        $response->assertHeader('Content-Type', 'text/csv; charset=UTF-8');
+        $this->assertStringContainsString('Test Source', $response->getContent());
+        $this->assertStringContainsString('Found it', $response->getContent());
+    }
+
+    public function test_csv_export_neutralizes_formula_injection_in_target_value(): void
+    {
+        $user = User::factory()->create();
+        $investigation = Investigation::factory()->for($user, 'owner')->create();
+        $target = $investigation->targets()->create(['type' => 'person', 'value' => 'safe name', 'created_by' => $user->id]);
+        $source = \App\Models\Source::create([
+            'key' => 'test-source', 'name' => 'Test Source', 'target_types' => ['person'], 'enabled' => true,
+        ]);
+        $target->findings()->create([
+            'source_id' => $source->id, 'status' => 'completed', 'summary' => '=cmd|"/c calc"!A1',
+        ]);
+
+        $response = $this->actingAs($user)->get(route('investigations.export.csv', $investigation));
+
+        $this->assertStringContainsString("'=cmd", $response->getContent());
+    }
+
+    public function test_json_export_includes_targets_and_findings(): void
+    {
+        $user = User::factory()->create();
+        $investigation = Investigation::factory()->for($user, 'owner')->create();
+        $investigation->targets()->create(['type' => 'domain', 'value' => 'example.com', 'created_by' => $user->id]);
+
+        $response = $this->actingAs($user)->get(route('investigations.export.json', $investigation));
+
+        $response->assertOk();
+        $response->assertJsonPath('targets.0.value', 'example.com');
+    }
+}