cedry2k1992andClaude Sonnet 5
e4fa57c3d6
Run-all buttons (per target and per investigation) queue every applicable, not-already-in-flight source via a new FindingDispatcher, re-attempting prior failures automatically. RunFinding now applies a per-source RateLimited queue middleware so a bulk run can't hammer the free public APIs (ip-api, crt.sh, whois, sherlock, theharvester) it depends on; $tries raised to 30 to survive rate-limiter releases, with a failed() handler so exhausted retries still resolve the Finding instead of leaving it stuck pending. Also fixes CrtShRunner treating crt.sh's intermittent 404/502 (a known flaky free service) as fatal on the first try — added a bounded retry. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
70 lines
2.8 KiB
PHP
70 lines
2.8 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use App\Jobs\RunFinding;
|
|
use App\Models\Investigation;
|
|
use App\Models\Source;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Queue;
|
|
use Tests\TestCase;
|
|
|
|
class BulkRunTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
public function test_editor_can_run_all_applicable_sources_for_a_target(): void
|
|
{
|
|
Queue::fake();
|
|
|
|
$owner = User::factory()->create();
|
|
$investigation = Investigation::factory()->for($owner, 'owner')->create();
|
|
$target = $investigation->targets()->create(['type' => 'domain', 'value' => 'example.com', 'created_by' => $owner->id]);
|
|
Source::create(['key' => 'crtsh', 'name' => 'crt.sh', 'target_types' => ['domain'], 'enabled' => true]);
|
|
Source::create(['key' => 'whois', 'name' => 'WHOIS', 'target_types' => ['domain'], 'enabled' => true]);
|
|
|
|
$this->actingAs($owner)
|
|
->post(route('investigations.targets.run-all', [$investigation, $target]))
|
|
->assertRedirect(route('investigations.show', $investigation));
|
|
|
|
Queue::assertPushed(RunFinding::class, 2);
|
|
$this->assertDatabaseCount('findings', 2);
|
|
}
|
|
|
|
public function test_run_all_for_investigation_covers_every_target(): void
|
|
{
|
|
Queue::fake();
|
|
|
|
$owner = User::factory()->create();
|
|
$investigation = Investigation::factory()->for($owner, 'owner')->create();
|
|
$domainTarget = $investigation->targets()->create(['type' => 'domain', 'value' => 'example.com', 'created_by' => $owner->id]);
|
|
$ipTarget = $investigation->targets()->create(['type' => 'ip', 'value' => '8.8.8.8', 'created_by' => $owner->id]);
|
|
Source::create(['key' => 'crtsh', 'name' => 'crt.sh', 'target_types' => ['domain'], 'enabled' => true]);
|
|
Source::create(['key' => 'ip-api', 'name' => 'ip-api.com', 'target_types' => ['ip'], 'enabled' => true]);
|
|
|
|
$this->actingAs($owner)
|
|
->post(route('investigations.run-all', $investigation))
|
|
->assertRedirect(route('investigations.show', $investigation));
|
|
|
|
Queue::assertPushed(RunFinding::class, 2);
|
|
}
|
|
|
|
public function test_viewer_cannot_bulk_run(): void
|
|
{
|
|
$owner = User::factory()->create();
|
|
$viewer = User::factory()->create();
|
|
$investigation = Investigation::factory()->for($owner, 'owner')->create();
|
|
$investigation->users()->attach($viewer, ['role' => 'viewer']);
|
|
$target = $investigation->targets()->create(['type' => 'domain', 'value' => 'example.com', 'created_by' => $owner->id]);
|
|
|
|
$this->actingAs($viewer)
|
|
->post(route('investigations.targets.run-all', [$investigation, $target]))
|
|
->assertForbidden();
|
|
|
|
$this->actingAs($viewer)
|
|
->post(route('investigations.run-all', $investigation))
|
|
->assertForbidden();
|
|
}
|
|
}
|