[FEATURE] Rate-limiting & graceful degradation when an API key is missing

[NovaCode37]

Several modules depend on third-party API keys (Shodan, VirusTotal, AbuseIPDB, Censys…). When a key is absent or rate-limited, the module should return a clear "skipped: no API key" / "rate limited" status instead of a hard error, and the dashboard should render that state.

Acceptance criteria

• Standard status enum for module results: ok | skipped | rate_limited | error.
• Each key-dependent module reports the right status.
• Frontend badge per module reflecting the status.

[rabiay34]

I'd like to work on this issue, if it's available.

[rabiay34]

I've opened a PR that addresses all three acceptance criteria: #64

• Standard ok | skipped | rate_limited | error status enum via modules/module_status.py
• Each key-dependent module (Shodan, VirusTotal, AbuseIPDB, Censys, Leak-Lookup, Telegram) now reports the correct status
• Frontend badges reflect the status on both the live progress view and the results cards

Happy to make any changes based on review feedback!

[NovaCode37]

I've opened a PR that addresses all three acceptance criteria: #64

• Standard ok | skipped | rate_limited | error status enum via modules/module_status.py
• Each key-dependent module (Shodan, VirusTotal, AbuseIPDB, Censys, Leak-Lookup, Telegram) now reports the correct status
• Frontend badges reflect the status on both the live progress view and the results cards

Happy to make any changes based on review feedback!

Thanks for the thorough PR — the ok | skipped | rate_limited | error enum, the per-module wiring, the WebSocket propagation and the frontend badges all look clean, and I like that only ok results get cached. One blocker and two minor points before merge:

Blocker — HIBP path (Copilot's high-severity note is correct).
In check_email_hibp the header is hard-coded "hibp-api-key": "", and there's no HIBP_API_KEY in config.py at all (only LEAK_LOOKUP_API_KEY). So the request always returns 401 → now always reports skipped with "add the key to .env" — but adding a key to .env does nothing, because the code never reads it. That turns a non-functional path into a misleading "gracefully skipped" one. Please either:

• add HIBP_API_KEY = os.getenv("HIBP_API_KEY", "") to config.py, import it, and pass it in the header — then 401 → skipped is honest; or
• if HIBP is intentionally unsupported, short-circuit to skipped before making the doomed HTTP call.

Minor — unsafe cast (App.tsx). msg.status as LiveModuleStatus bypasses validation. Low real risk (ScanProgress has a fallback style and backend only emits the 4 known values), but a small guard mapping unknown values to error/ok would be more robust.

Nit — type duplication (ScanResults.tsx). The local ModStatus is identical to the ModuleStatus you exported in types.ts. Reuse the shared ModuleStatus / ModuleStatusFields to avoid future drift.

Only the first one is required to merge — the other two can be quick follow-ups. Thanks again!

[rabiay34]

Thanks for the detailed review — all points noted.

I'll address the HIBP configuration issue as the blocker and also apply the suggested improvements for status validation and shared types in the frontend. Will push an updated revision shortly.

[rabiay34]

Thanks for the detailed review! Addressed all three:

• Blocker (HIBP): Added HIBP_API_KEY to config.py, imported it, and pass it in the request header. The lookup now short-circuits to skipped before making any HTTP call when the key is absent, so the "add the key to .env" hint is actually actionable; with a key present, a 401 reports as skipped (invalid key). Also added HIBP_API_KEY= to .env.example.
• Minor (unsafe cast): Added a toLiveStatus() guard in App.tsx that validates the status against the known set and defaults unknown values, used in both the WebSocket and polling paths.
• Nit (type duplication): Removed the local ModStatus in ScanResults.tsx and reused the exported ModuleStatus / ModuleStatusFields from types.ts.

Updated the HIBP tests to exercise the real request paths (with a key) and added a test asserting no HTTP call is made when the key is absent. Ready for another look.

[NovaCode37]

Thanks for the detailed review! Addressed all three:

• Blocker (HIBP): Added HIBP_API_KEY to config.py, imported it, and pass it in the request header. The lookup now short-circuits to skipped before making any HTTP call when the key is absent, so the "add the key to .env" hint is actually actionable; with a key present, a 401 reports as skipped (invalid key). Also added HIBP_API_KEY= to .env.example.
• Minor (unsafe cast): Added a toLiveStatus() guard in App.tsx that validates the status against the known set and defaults unknown values, used in both the WebSocket and polling paths.
• Nit (type duplication): Removed the local ModStatus in ScanResults.tsx and reused the exported ModuleStatus / ModuleStatusFields from types.ts.

Updated the HIBP tests to exercise the real request paths (with a key) and added a test asserting no HTTP call is made when the key is absent. Ready for another look.

Thank you, looks pretty good!