mirror of
https://github.com/Dvorinka/Primora.git
synced 2026-10-28 15:51:23 +00:00
Tomas DvorakandDevin
55edbf8b56
Security:
- Graceful shutdown: http.Server + signal.NotifyContext, 10s drain,
retention sweeper cancelled before pool close
- Scoped API keys (migration 00006): ingest/read/write/admin enforced in
auth middleware; scope picker + badges in Settings UI; scopeless legacy
keys act as admin. Read-only keys now get 403 on ingest (verified live)
- nginx: baseline security headers on all responses, CSP scoped to SPA;
fixed add_header inheritance shadowing
- better-auth rate limit enabled unconditionally (was gated on NODE_ENV,
which the shipped .env sets to development)
- Mailpit moved to docker-compose.dev.yml; prod compose cannot expose it
- setup.sh generates PRIMORA_ENCRYPTION_KEY
Reliability/ops:
- Retention: per-project retention_{events,audit,webhook}_days
(migration 00007, 0=off) + hourly RetentionSweeper; edit UI in Projects
- GET /api/v1/metrics Prometheus exposition
- compose: healthchecks + restart policies everywhere, dragonfly pinned
to v2.0.0, depends_on service_healthy
- backup.sh/restore.sh (pg_dump -Fc + storage volume); restore verified
against scratch postgres+volume
- .dockerignore: exclude target dirs (build context was 4.7GB)
Correctness/testing:
- DBX transfer endpoint: POST /db-connections/:id/transfer — SQL or Redis
target, 1000-row bound, server-side creds (verified live pg→dragonfly)
- Pagination audit: ListComponents capped at 500 (auto-registers)
- CI: goose up/reset/up job + compose e2e-smoke job (smoke-e2e.sh
verified locally: signup, bootstrap, scoped keys, ingest, metrics)
- k6 load sanity script: 6650 reqs, ~217/s, 0 real failures, p95 221ms
(429s = configured rate limiter working)
Docs: DEPLOYMENT_GUIDE.md, PRODUCTION_READINESS.md; verify script
repaired (stale refs + set -e arithmetic abort). ROADMAP: phase 2 +
phase 6 marked complete.
Authored By: TDvorak <[email protected]>
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
76 lines
2.1 KiB
JavaScript
76 lines
2.1 KiB
JavaScript
// Primora load sanity — NOT a benchmark. Verifies the ingest path and a hot
|
|
// read endpoint hold up under modest concurrency without errors.
|
|
//
|
|
// k6 run scripts/load-sanity.js \
|
|
// -e PRIMORA_API_KEY=prm_xxx_xxx \
|
|
// -e PRIMORA_PROJECT_ID=<uuid> \
|
|
// -e BASE_URL=http://localhost
|
|
//
|
|
// The key needs the ingest + read scopes. Create one in Settings → API keys.
|
|
|
|
import http from "k6/http";
|
|
import { check } from "k6";
|
|
|
|
const BASE = __ENV.BASE_URL || "http://localhost";
|
|
const API_KEY = __ENV.PRIMORA_API_KEY || "";
|
|
const PROJECT = __ENV.PRIMORA_PROJECT_ID || "";
|
|
|
|
export const options = {
|
|
scenarios: {
|
|
ingest: {
|
|
exec: "ingest",
|
|
executor: "constant-vus",
|
|
vus: 5,
|
|
duration: "30s",
|
|
},
|
|
hot_read: {
|
|
exec: "hotRead",
|
|
executor: "constant-vus",
|
|
vus: 10,
|
|
duration: "30s",
|
|
},
|
|
},
|
|
// 429s are the rate limiter doing its job (API_KEY_RATE_LIMIT_PER_MINUTE,
|
|
// default 600/min) — counted as expected via responseCallback below. The
|
|
// sanity bar is: no real errors, no hangs. Raise the env limit or lower
|
|
// VUs to exercise unthrottled throughput.
|
|
thresholds: {
|
|
http_req_failed: ["rate<0.01"],
|
|
http_req_duration: ["p(95)<500"],
|
|
},
|
|
};
|
|
|
|
const ingestBody = JSON.stringify({
|
|
events: [
|
|
{
|
|
type: "metric",
|
|
severity: "info",
|
|
component: "load-sanity",
|
|
message: "k6 sanity metric",
|
|
payload: { name: "k6.sanity", value: 1 },
|
|
},
|
|
],
|
|
});
|
|
|
|
export function ingest() {
|
|
const res = http.post(`${BASE}/api/v1/ingest`, ingestBody, {
|
|
headers: {
|
|
"content-type": "application/json",
|
|
"X-Primora-Key": API_KEY,
|
|
},
|
|
responseCallback: http.expectedStatuses(202, 429),
|
|
});
|
|
check(res, { "ingest 202 or throttled": (r) => r.status === 202 || r.status === 429 });
|
|
}
|
|
|
|
export function hotRead() {
|
|
const res = http.get(
|
|
`${BASE}/api/v1/projects/${PROJECT}/events?limit=25`,
|
|
{
|
|
headers: { "X-Primora-Key": API_KEY },
|
|
responseCallback: http.expectedStatuses(200, 429),
|
|
},
|
|
);
|
|
check(res, { "events 200 or throttled": (r) => r.status === 200 || r.status === 429 });
|
|
}
|