[Testing] k6 baseline load test hits authenticated endpoints with no credentials and never fails on check errors

[grantfox-oss]

Join our community: https://t.me/+DOylgFv1jyJlNzM0

Why this matters

scripts/loadtest/baseline.js is wired into .github/workflows/loadtest.yml as the project's only load test. It sends unauthenticated GET requests to ${BASE_URL}/api/v1/loans and ${BASE_URL}/api/v1/score/${WALLET_SEED}.

Looking at the routes, GET /loans is behind requireJwtAuth in backend/src/routes/loanRoutes.ts, and the score route is behind requireApiKey in backend/src/routes/scoreRoutes.ts. Neither request in the k6 script sends a JWT or API key, so both calls will always return 401 during every load test run.

The k6 thresholds in baseline.js only check http_req_duration and http_req_failed (network-level failures), not the check() results. A 401 response is a normal HTTP response, not a network failure, so the workflow reports green even though it never actually load-tests the real, authenticated request paths it claims to cover. The load test is effectively measuring 401-response latency, not the borrower/lender flows it is meant to exercise.

Acceptance criteria

• scripts/loadtest/baseline.js obtains valid auth (JWT and/or API key) before hitting protected endpoints, or is repointed at genuinely public endpoints.
• The k6 script's check() results actually gate pass/fail for the workflow run (e.g. via a checks threshold or explicit exit-code handling), so silently-failing checks can no longer produce a green run.
• .github/workflows/loadtest.yml documents how to supply credentials/env vars needed for the authenticated run.

Files to touch

• scripts/loadtest/baseline.js
• .github/workflows/loadtest.yml

Out of scope

• Adding new load test scenarios beyond fixing the existing baseline script's auth and check-gating.
• Changing the auth middleware itself.

[TheShnider]

@TheShnider has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi. I have reviewed this issue and would like to work on it.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @TheShnider to this issue.

[d1a-m3n]

@d1a-m3n has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

pls assign me to this task, i can work on it

ℹ️ Repo Maintainers: To accept this application, review their application or assign @d1a-m3n to this issue.

[EmeditWeb]

@EmeditWeb has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi admin, please assign

ℹ️ Repo Maintainers: To accept this application, review their application or assign @EmeditWeb to this issue.

[drips-wave]

Congratulations, @EmeditWeb! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @EmeditWeb: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊