3.8 KiB
3.8 KiB
Remote Performance, Fault, and Security Test Report
Date: 2026-06-29T06:16:21.982Z Base URL: https://100.90.90.91 Concurrency: 12 ready + 12 captcha requests
| Result | Check | Detail |
|---|---|---|
| PASS | HTTPS root is reachable before light concurrency | status=200, duration=2087ms |
| PASS | HTTPS root contains app root | contentType=text/html, bytes=434 |
| PASS | ready health is ok before light concurrency | status=200, duration=389ms |
| PASS | ready health reports database and redis ok before light concurrency | body={"status":"ok","service":"api","timestamp":"2026-06-29T06:15:52.352Z","checks":{"config":"ok","database":"ok","redis":"ok"}} |
| PASS | admin can login | status=200, duration=1103ms |
| PASS | admin login returns access token | tokenLength=296 |
| PASS | low-privilege user can login for RBAC checks | status=200, duration=773ms |
| PASS | PERF light API burst returns only 200 responses | requests=24, failed=0, wallMs=15477 |
| FAIL | PERF light API burst p95 stays under 10s | p95=14919ms, max=15441ms |
| PASS | ready health recovers after light concurrency | status=200, duration=604ms |
| PASS | ready health reports database and redis ok after light concurrency | body={"status":"ok","service":"api","timestamp":"2026-06-29T06:16:11.657Z","checks":{"config":"ok","database":"ok","redis":"ok"}} |
| PASS | SEC forged bearer token is rejected | status=401, duration=372ms |
| PASS | SEC forged token error does not leak internals | body={"code":"AUTH_REQUIRED","message":"Authentication is required."} |
| PASS | SEC unauthenticated write is rejected | status=401, duration=775ms |
| PASS | SEC unauthenticated write error does not leak internals | body={"code":"AUTH_REQUIRED","message":"Authentication is required."} |
| PASS | SEC low-privilege user cannot create customer | status=403, duration=605ms |
| PASS | SEC low-privilege write error does not leak internals | body={"code":"RBAC_FORBIDDEN","message":"Permission denied."} |
| PASS | SEC replay test customer is created | status=201, duration=1141ms |
| PASS | SEC first idempotent recharge succeeds | status=201, duration=535ms |
| PASS | SEC exact idempotent replay returns success | status=201, duration=456ms |
| PASS | SEC exact idempotent replay returns same recharge id | first=rch_44943fc6e1d3483ab17eee61fe279b1d, replay=rch_44943fc6e1d3483ab17eee61fe279b1d |
| PASS | SEC conflicting idempotency replay is rejected | status=409, duration=601ms |
| PASS | SEC conflicting replay error does not leak original body | body={"code":"IDEMPOTENCY_KEY_CONFLICT","message":"Idempotency key was used by another request."} |
| PASS | SEC low-privilege user cannot replay/write recharge | status=403, duration=371ms |
| PASS | SEC missing recording playback returns 404 | status=404, duration=575ms |
| PASS | SEC missing recording playback error does not expose paths | body={"code":"RECORDING_NOT_READY","message":"Recording is not available for playback."} |
| PASS | SEC encoded traversal recording id is rejected safely | status=404, body={"code":"RECORDING_NOT_READY","message":"Recording is not available for playback."} |
| PASS | SEC traversal playback error does not expose filesystem paths | body={"code":"RECORDING_NOT_READY","message":"Recording is not available for playback."} |
Notes
- This run intentionally avoids disruptive fault injection: no Worker, MySQL, Redis, OpenSIPS, or SIP traffic was stopped or modified.
- PERF-001/PERF-002 SIP call concurrency, SEC-001 illegal-source SIP probe, and SEC-002 CPS probe still require A/T-side SIP tooling and CDR/recording verification.
- FAIL-001 through FAIL-004 require an explicit maintenance window, rollback point, and service-stop approval before execution.
- The executed subset covers HTTPS/API light concurrency, service recovery after burst, forged/unauthenticated/low-privilege access, idempotency replay, and recording path-safety black-box checks.