Performance & Security Testing

# macOS
brew install k6

# Linux (Debian/Ubuntu)
sudo gpg -k && sudo gpg --no-default-keyring \
  --keyring /usr/share/keyrings/k6-archive-keyring.gpg \
  --keyserver hkp://keyserver.ubuntu.com:80 \
  --recv-keys C5AD17C747E3415A3642D57D77C6C491D6AC1D69
echo "deb [signed-by=/usr/share/keyrings/k6-archive-keyring.gpg] https://dl.k6.io/deb stable main" \
  | sudo tee /etc/apt/sources.list.d/k6.list
sudo apt-get update && sudo apt-get install k6

# Windows
winget install k6

# 1. Start the API (in another terminal)
go run .                              # single-app
# or: cd apps/api && go run cmd/server/main.go

# 2. Run any test
export BASE_URL=http://localhost:8080
k6 run tests/k6/smoke.js              # 30s — does it work?
k6 run tests/k6/average-load.js       # 9m — baseline at 100 VUs
k6 run tests/k6/stress.js             # 9m — 4× load
k6 run tests/k6/spike.js              # 4m — 50 → 1000 → 50
k6 run tests/k6/breakpoint.js         # 1h — slow ramp to 5000
k6 run tests/k6/soak.js               # 4h — overnight

name: perf
on: [pull_request]
jobs:
  k6:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build and start API
        run: |
          go build -o /tmp/server .
          /tmp/server &
          sleep 5
      - uses: grafana/setup-k6-action@v1
      - name: Smoke + average-load
        env:
          BASE_URL: http://localhost:8080
        run: |
          k6 run tests/k6/smoke.js
          k6 run tests/k6/average-load.js

# Login as user A
TOKEN_A=$(curl -s -X POST http://localhost:8080/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"a@example.com","password":"password"}' | jq -r '.data.tokens.access_token')

# Create an invoice
INV_ID=$(curl -s -X POST http://localhost:8080/api/invoices \
  -H "Authorization: Bearer $TOKEN_A" \
  -d '{"amount":100}' | jq -r '.data.id')

# Now login as user B and try to read user A's invoice
TOKEN_B=$(curl -s -X POST http://localhost:8080/api/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"b@example.com","password":"password"}' | jq -r '.data.tokens.access_token')

curl -s http://localhost:8080/api/invoices/$INV_ID \
  -H "Authorization: Bearer $TOKEN_B"
# Expected: 404 (NOT 403, NOT 200). authz.MustOwn returns 404 so existence
# of A's invoice doesn't leak to B.

# Try classic payloads on any parameter that hits the DB
curl "http://localhost:8080/api/users?email=' OR '1'='1"
curl "http://localhost:8080/api/users?email=admin' --"
# Expected: 200 with a normal (empty) response. GORM parameterises so the
# input is interpreted as data, never SQL.

# Time-based blind probe
curl "http://localhost:8080/api/users?email=' OR pg_sleep(5)--"
# Expected: response in <100ms (no delay). The DB never sees the payload as SQL.

# Try stored XSS via a field that's later rendered
curl -X POST http://localhost:8080/api/blogs \
  -H "Authorization: Bearer $TOKEN_ADMIN" \
  -d '{"title":"<script>alert(1)</script>","content":"x"}'

# View the blog in the SPA. React escapes by default → the script tag
# renders as text. The CSP header blocks inline script as a 2nd layer.
# Check the response headers:
curl -I http://localhost:8080/ | grep -i content-security
# Expected: Content-Security-Policy: default-src 'self'; script-src 'self'; ...

# Try to make the server fetch the AWS metadata endpoint via any feature
# that fetches user-provided URLs (webhook delivery, image-from-URL, etc).
curl -X POST http://localhost:8080/api/webhooks/dispatch \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"url":"http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

# Expected: 400 with "URL not allowed". internal/safefetch blocks the
# request at validation AND re-blocks at TCP-connect time if DNS rebinds.

# Hammer the login endpoint
for i in $(seq 1 20); do
  curl -s -X POST http://localhost:8080/api/auth/login \
    -H 'Content-Type: application/json' \
    -d '{"email":"victim@example.com","password":"guess'$i'"}'
done
# Expected after ~5 attempts: 429 "Rate limited" (Sentinel's per-route limit).
# After more attempts at the same email: the account locks (AuthShield).

# Probe for verbose error pages
curl http://localhost:8080/api/this-route-does-not-exist
curl http://localhost:8080/api/users/invalid-uuid

# Expected: generic error JSON, no stack trace, no DB driver names.
# Also check the security headers are set:
curl -I http://localhost:8080/api/health | grep -iE 'x-frame|x-content|content-security|strict-transport|referrer'