Add bulk-run actions and per-source rate limiting

Run-all buttons (per target and per investigation) queue every applicable,
not-already-in-flight source via a new FindingDispatcher, re-attempting
prior failures automatically. RunFinding now applies a per-source
RateLimited queue middleware so a bulk run can't hammer the free public
APIs (ip-api, crt.sh, whois, sherlock, theharvester) it depends on;
$tries raised to 30 to survive rate-limiter releases, with a failed()
handler so exhausted retries still resolve the Finding instead of leaving
it stuck pending.

Also fixes CrtShRunner treating crt.sh's intermittent 404/502 (a known
flaky free service) as fatal on the first try — added a bounded retry.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/Http/Controllers/InvestigationController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers;
 
 use App\Models\Investigation;
 use App\Models\Source;
+use App\Osint\FindingDispatcher;
 use App\Osint\RunnerRegistry;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
@@ -72,4 +73,18 @@ class InvestigationController extends Controller
 
         return redirect()->route('investigations.index');
     }
+
+    public function runAll(Request $request, Investigation $investigation, FindingDispatcher $dispatcher): RedirectResponse
+    {
+        $this->authorize('update', $investigation);
+
+        $queued = $investigation->targets->sum(
+            fn ($target) => $dispatcher->dispatchAllApplicable($target, $request->user())
+        );
+
+        return redirect()->route('investigations.show', $investigation)
+            ->with('status', $queued > 0
+                ? "Queued {$queued} lookup(s) across all targets..."
+                : 'Nothing to queue — already up to date.');
+    }
 }

app/Http/Controllers/TargetController.php

@@ -7,6 +7,7 @@ use App\Models\Finding;
 use App\Models\Investigation;
 use App\Models\Source;
 use App\Models\Target;
+use App\Osint\FindingDispatcher;
 use App\Osint\RunnerRegistry;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
@@ -74,4 +75,18 @@ class TargetController extends Controller
         return redirect()->route('investigations.show', $investigation)
             ->with('status', "Running {$source->name} against {$target->value}...");
     }
+
+    public function runAll(Request $request, Investigation $investigation, Target $target, FindingDispatcher $dispatcher): RedirectResponse
+    {
+        $this->authorize('update', $investigation);
+
+        abort_if($target->investigation_id !== $investigation->id, 404);
+
+        $queued = $dispatcher->dispatchAllApplicable($target, $request->user());
+
+        return redirect()->route('investigations.show', $investigation)
+            ->with('status', $queued > 0
+                ? "Queued {$queued} lookup(s) for {$target->value}..."
+                : "Nothing to queue for {$target->value} — already up to date.");
+    }
 }

app/Jobs/RunFinding.php

@@ -6,18 +6,41 @@ use App\Models\Finding;
 use App\Osint\RunnerRegistry;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Queue\Queueable;
+use Illuminate\Queue\Middleware\RateLimited;
 
 class RunFinding implements ShouldQueue
 {
     use Queueable;
 
-    public int $tries = 1;
+    /**
+     * Business-logic failures (a runner throwing) are caught in handle()
+     * below and never bubble up to the queue, so this only needs to cover
+     * genuine retries: rate-limiter releases (see middleware()) and worker
+     * crashes. A bulk run against a busy investigation can easily queue
+     * dozens of same-source lookups behind one rate limit, so this is set
+     * high enough to ride that out rather than give up mid-queue.
+     */
+    public int $tries = 30;
 
     public function __construct(
         public readonly int $findingId,
     ) {
     }
 
+    /**
+     * @return array<int, object>
+     */
+    public function middleware(): array
+    {
+        $sourceKey = Finding::find($this->findingId)?->source?->key;
+
+        if ($sourceKey === null) {
+            return [];
+        }
+
+        return [new RateLimited('osint-runner:'.$sourceKey)];
+    }
+
     public function handle(RunnerRegistry $registry): void
     {
         $finding = Finding::with(['target', 'source'])->findOrFail($this->findingId);
@@ -41,4 +64,17 @@ class RunFinding implements ShouldQueue
             ]);
         }
     }
+
+    /**
+     * Only reached if the job itself fails outside handle()'s own
+     * try/catch — e.g. retries exhausted while rate-limited.
+     */
+    public function failed(\Throwable $exception): void
+    {
+        Finding::where('id', $this->findingId)->update([
+            'status' => 'failed',
+            'error' => 'Gave up after retries: '.$exception->getMessage(),
+            'ran_at' => now(),
+        ]);
+    }
 }

app/Osint/FindingDispatcher.php

@@ -0,0 +1,50 @@
+<?php
+
+namespace App\Osint;
+
+use App\Jobs\RunFinding;
+use App\Models\Source;
+use App\Models\Target;
+use App\Models\User;
+
+class FindingDispatcher
+{
+    public function __construct(private readonly RunnerRegistry $registry)
+    {
+    }
+
+    /**
+     * Queue a lookup for every enabled, registered source that applies to
+     * the target's type and doesn't already have a pending/running finding
+     * for it. Returns how many were queued.
+     */
+    public function dispatchAllApplicable(Target $target, User $runBy): int
+    {
+        $applicableSources = Source::where('enabled', true)->get()
+            ->filter(fn (Source $source) => in_array($target->type, $source->target_types, true)
+                && $this->registry->has($source->key));
+
+        $busySourceIds = $target->findings()
+            ->whereIn('status', ['pending', 'running'])
+            ->pluck('source_id');
+
+        $queued = 0;
+
+        foreach ($applicableSources as $source) {
+            if ($busySourceIds->contains($source->id)) {
+                continue;
+            }
+
+            $finding = $target->findings()->create([
+                'source_id' => $source->id,
+                'run_by' => $runBy->id,
+                'status' => 'pending',
+            ]);
+
+            RunFinding::dispatch($finding->id);
+            $queued++;
+        }
+
+        return $queued;
+    }
+}

app/Osint/Runners/CrtShRunner.php

@@ -16,14 +16,20 @@ class CrtShRunner implements Runner
             throw new RunnerException('crt.sh only supports "domain" targets.');
         }
 
+        // crt.sh is a free, frequently overloaded public service that
+        // intermittently returns 404/502/503 for queries that succeed
+        // moments later (confirmed by hand: same query, 404 then 200 with
+        // no code changes) — worth a few retries before treating it as a
+        // real failure.
         $response = Http::timeout((int) config('osint.run_timeout'))
+            ->retry(3, 2000, throw: false)
             ->get('https://crt.sh/', [
                 'q' => $target->value,
                 'output' => 'json',
             ]);
 
         if (! $response->successful()) {
-            throw new RunnerException('crt.sh request failed with status '.$response->status().'.');
+            throw new RunnerException('crt.sh request failed with status '.$response->status().' after retries.');
         }
 
         // crt.sh returns an empty body (not valid JSON) when there are no matches.

app/Providers/AppServiceProvider.php

@@ -2,6 +2,8 @@
 
 namespace App\Providers;
 
+use Illuminate\Cache\RateLimiting\Limit;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
@@ -19,6 +21,13 @@ class AppServiceProvider extends ServiceProvider
      */
     public function boot(): void
     {
-        //
+        // Self-imposed limits so bulk-running lookups doesn't hammer the
+        // free public infrastructure these runners depend on. ip-api.com's
+        // limit (45/min) is theirs; the rest are courtesy limits of ours.
+        RateLimiter::for('osint-runner:ip-api', fn () => Limit::perMinute(45));
+        RateLimiter::for('osint-runner:crtsh', fn () => Limit::perMinute(30));
+        RateLimiter::for('osint-runner:whois', fn () => Limit::perMinute(20));
+        RateLimiter::for('osint-runner:sherlock', fn () => Limit::perMinute(10));
+        RateLimiter::for('osint-runner:theharvester', fn () => Limit::perMinute(5));
     }
 }