Add bulk-run actions and per-source rate limiting

Run-all buttons (per target and per investigation) queue every applicable, not-already-in-flight source via a new FindingDispatcher, re-attempting prior failures automatically. RunFinding now applies a per-source RateLimited queue middleware so a bulk run can't hammer the free public APIs (ip-api, crt.sh, whois, sherlock, theharvester) it depends on; $tries raised to 30 to survive rate-limiter releases, with a failed() handler so exhausted retries still resolve the Finding instead of leaving it stuck pending. Also fixes CrtShRunner treating crt.sh's intermittent 404/502 (a known flaky free service) as fatal on the first try — added a bounded retry. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
2026-07-20 11:29:26 +03:00
parent 853686f3f3
commit e4fa57c3d6
13 changed files with 387 additions and 5 deletions
@@ -0,0 +1,69 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Jobs\RunFinding;
+use App\Models\Investigation;
+use App\Models\Source;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Tests\TestCase;
+
+class BulkRunTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_editor_can_run_all_applicable_sources_for_a_target(): void
+    {
+        Queue::fake();
+
+        $owner = User::factory()->create();
+        $investigation = Investigation::factory()->for($owner, 'owner')->create();
+        $target = $investigation->targets()->create(['type' => 'domain', 'value' => 'example.com', 'created_by' => $owner->id]);
+        Source::create(['key' => 'crtsh', 'name' => 'crt.sh', 'target_types' => ['domain'], 'enabled' => true]);
+        Source::create(['key' => 'whois', 'name' => 'WHOIS', 'target_types' => ['domain'], 'enabled' => true]);
+
+        $this->actingAs($owner)
+            ->post(route('investigations.targets.run-all', [$investigation, $target]))
+            ->assertRedirect(route('investigations.show', $investigation));
+
+        Queue::assertPushed(RunFinding::class, 2);
+        $this->assertDatabaseCount('findings', 2);
+    }
+
+    public function test_run_all_for_investigation_covers_every_target(): void
+    {
+        Queue::fake();
+
+        $owner = User::factory()->create();
+        $investigation = Investigation::factory()->for($owner, 'owner')->create();
+        $domainTarget = $investigation->targets()->create(['type' => 'domain', 'value' => 'example.com', 'created_by' => $owner->id]);
+        $ipTarget = $investigation->targets()->create(['type' => 'ip', 'value' => '8.8.8.8', 'created_by' => $owner->id]);
+        Source::create(['key' => 'crtsh', 'name' => 'crt.sh', 'target_types' => ['domain'], 'enabled' => true]);
+        Source::create(['key' => 'ip-api', 'name' => 'ip-api.com', 'target_types' => ['ip'], 'enabled' => true]);
+
+        $this->actingAs($owner)
+            ->post(route('investigations.run-all', $investigation))
+            ->assertRedirect(route('investigations.show', $investigation));
+
+        Queue::assertPushed(RunFinding::class, 2);
+    }
+
+    public function test_viewer_cannot_bulk_run(): void
+    {
+        $owner = User::factory()->create();
+        $viewer = User::factory()->create();
+        $investigation = Investigation::factory()->for($owner, 'owner')->create();
+        $investigation->users()->attach($viewer, ['role' => 'viewer']);
+        $target = $investigation->targets()->create(['type' => 'domain', 'value' => 'example.com', 'created_by' => $owner->id]);
+
+        $this->actingAs($viewer)
+            ->post(route('investigations.targets.run-all', [$investigation, $target]))
+            ->assertForbidden();
+
+        $this->actingAs($viewer)
+            ->post(route('investigations.run-all', $investigation))
+            ->assertForbidden();
+    }
+}