test(06): complete UAT - 8 passed, 0 issues

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-04 19:00:19 +02:00
parent 651713fa7a
commit 582136c120
1 changed files with 58 additions and 0 deletions
@@ -0,0 +1,58 @@
+---
+status: complete
+phase: 06-performance-production-hardening
+source: 06-01-SUMMARY.md, 06-02-SUMMARY.md, 06-03-SUMMARY.md, 06-04-SUMMARY.md, 06-05-SUMMARY.md
+started: 2026-06-04T00:00:00Z
+updated: 2026-06-04T19:05:00Z
+---
+
+## Current Test
+
+[testing complete]
+
+## Tests
+
+### 1. Cold Start Smoke Test
+expected: Stop any running services. Run `docker compose up -d --build`. All services (backend, celery-worker, celery-beat, postgres, minio, redis, loki, promtail, grafana) start without errors. `curl -sf http://localhost:8000/health` returns a 200 response.
+result: pass
+
+### 2. X-Correlation-ID response header
+expected: Make any authenticated API request (e.g. `curl -si http://localhost:8000/health`). The response headers include `x-correlation-id: <UUID4>`. Make a second request — the header value is different (new UUID per request).
+result: pass
+
+### 3. JSON structured logging
+expected: Set LOG_JSON=true in the backend service (or `.env`), restart backend. Then call an endpoint and check `docker compose logs backend`. Log lines should be valid JSON objects containing an "event" key (e.g. `{"event": "...", "level": "info", "correlation_id": "...", ...}`).
+result: pass
+
+### 4. Grafana accessible
+expected: After `docker compose up`, navigate to http://localhost:3000 in a browser (or run `curl -sf http://localhost:3000/api/health`). Grafana loads and the health endpoint returns JSON with `"database": "ok"`.
+result: pass
+
+### 5. Loki ready
+expected: Run `curl -sf http://localhost:3100/ready`. Response body is `ready` and the command exits 0.
+result: pass
+
+### 6. Container runs as non-root (appuser)
+expected: Run `docker compose exec backend id`. Output shows `uid=1000(appuser)` — NOT uid=0 (root). The multi-stage hardened Dockerfile creates appuser with uid=1000.
+result: pass
+
+### 7. Read-only rootfs + writable /tmp
+expected: Run `docker compose exec backend sh -c 'touch /readonly_probe 2>&1 || echo "rootfs is read-only"'`. Output contains "read-only". Then run `docker compose exec backend sh -c 'touch /tmp/ok && echo "tmp writable"'`. Output contains "tmp writable" (the tmpfs mount works).
+result: pass
+
+### 8. Per-account rate limiting (429 after 100 req/min)
+expected: Log in as a regular user. Send 101+ rapid requests to `GET /api/documents/` (e.g. with a loop or ab/curl). The 101st request (or shortly after) returns HTTP 429 with a rate-limit error. A different user account is NOT affected by the first user hitting the limit.
+result: pass
+
+## Summary
+
+total: 8
+passed: 8
+issues: 0
+pending: 0
+skipped: 0
+blocked: 0
+
+## Gaps
+
+[none yet]