rays
f8408a3d26
The page and the service worker were strict TypeScript; the tests, the build, the home page's generator, the load tests, boot.js and the directory's site.js were plain JavaScript that nothing checked. All of it is TypeScript now, in five programs, each with its own globals, all checked by npm run typecheck: the page (tsconfig.json, with boot.ts and the directory's site.ts), the worker, Node's (tsconfig.tools.json: the Node tests, the browser suite, the build, the site generator, the load harness), and k6's (tsconfig.k6.json, with @types/k6). Node 24 runs the .ts files by stripping their types, so they hold only TypeScript that erases (erasableSyntaxOnly) and import each other by .ts name; package.json says "type": "module" for it, and Dockerfile.web moves to Node 24 to run build.mts. k6 2.3 strips its scripts' types itself. The browser suite's page.evaluate calls reach the page's globals; the page's tsc run now also writes its declarations to target/page-types, which the suite's program includes, so those calls are typed by the page's own code rather than by hand-written copies. boot.ts is compiled by build.mts with swc, as the worker is, and named by the hash of what is served. The directory's build has no Node, so site.js is compiled from site.ts and committed (node web/build.mts --directory-script), and tests/directory-script.ts fails if they drift. Checked: the site generator's 139 pages are byte for byte what the JavaScript made; the page build's app.js is identical and only boot.js (now minified) and its hash differ; contrast, page-smoke, page-unit, native-bridge, the browser suite (96 passed, 2 skipped) and the directory's and ipx's Rust tests pass; k6 parses each load script. The load tests themselves did not run: they build a release binary outside the capped builder. .agents/skills/security-audit is an installed skill's, not ours, and is left as it is. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
45 lines
2.2 KiB
TypeScript
45 lines
2.2 KiB
TypeScript
import http from 'k6/http';
|
|
import { check, sleep } from 'k6';
|
|
import { Trend } from 'k6/metrics';
|
|
import { BASE, as, me } from './lib.ts';
|
|
|
|
// A flood of sign-in attempts with wrong passwords while everyone else goes on using the site.
|
|
// Two things only many requests at once show: whether checking passwords, tens of milliseconds
|
|
// of CPU each, starves the rest of the server, and whether a wrong password for a name that is
|
|
// an account takes longer to refuse than one for a name that is not -- the answers read the
|
|
// same, and the time would tell anyone which names are accounts here.
|
|
const gap = new Trend('signin_name_gap', true);
|
|
export const options = {
|
|
scenarios: {
|
|
attempts: { executor: 'constant-vus', vus: 40, duration: '40s', exec: 'attempt' },
|
|
everyone: { executor: 'constant-vus', vus: 5, duration: '40s', exec: 'browse' },
|
|
},
|
|
thresholds: {
|
|
http_req_failed: ['rate==0'],
|
|
checks: ['rate==1'],
|
|
// 57ms on 2026-10-05 on SQLite, 68 on Postgres; 4.3s while password checks ran on the async
|
|
// workers (#137).
|
|
'http_req_duration{name:meanwhile}': ['p(95)<300'],
|
|
// Known name against unknown, one straight after the other: no gap but noise. 0.2ms on
|
|
// 2026-10-05; 31ms while an unknown name was refused without a check (#138).
|
|
signin_name_gap: ['med<10'],
|
|
},
|
|
};
|
|
const refused = { headers: { 'Content-Type': 'application/json' }, responseCallback: http.expectedStatuses(401) };
|
|
|
|
export function attempt() {
|
|
const known = http.post(`${BASE}/api/login`, JSON.stringify({ name: 'piper', password: 'not-the-password' }),
|
|
{ ...refused, tags: { name: 'signin-known' } });
|
|
const unknown = http.post(`${BASE}/api/login`, JSON.stringify({ name: `nobody-${__VU}-${__ITER}`, password: 'not-the-password' }),
|
|
{ ...refused, tags: { name: 'signin-unknown' } });
|
|
check(known, { 'a wrong password refused': r => r.status === 401 });
|
|
check(unknown, { 'an unknown name refused': r => r.status === 401 });
|
|
gap.add(known.timings.duration - unknown.timings.duration);
|
|
}
|
|
|
|
export function browse() {
|
|
const r = http.get(`${BASE}/api/feeds`, as(me(), 'meanwhile'));
|
|
check(r, { 'the site still answers': r => r.status === 200 });
|
|
sleep(0.5);
|
|
}
|