DRAFT: add first draft of load simulator

.gitignore

@@ -21,3 +21,6 @@ e2e/test-results/
 e2e/playwright-report/
 e2e/blob-report/
 e2e/.env
+
+# Load test user pool (contains credentials)
+load-tests/data/users.json

docker-compose.yml

@@ -351,6 +351,8 @@ services:
       DRIVING: AGNOSTIC
       DRIVEN: AGNOSTIC
       DISABLE_SSL: "true"
+      # Rate limiting disabled by default in development
+      RateLimiting__Enabled: "false"
       ConnectionStrings__messaging: "kafka:29092"
       ConnectionStrings__database: "Host=user-management-db;Port=5432;Database=user_management;Username=user_mgmt_user;Password=user_mgmt_password"
       KAFKA__BOOTSTRAPSERVERS: "kafka:29092"
@@ -453,6 +455,8 @@ services:
       DD_AGENT_HOST: datadog-agent
       # Application configuration
       NODE_ENV: development
+      # Rate limiting disabled by default in development
+      SKIP_RATE_LIMIT: "true"
       OAUTH_ISSUER_INTERNAL: http://user-management:8080
       OAUTH_CLIENT_ID: web-ui
       OAUTH_CLIENT_SECRET: stickerlandia-web-ui-secret-2025
@@ -544,12 +548,40 @@ services:
       - "traefik.http.routers.sticker-award.priority=100"
       - "traefik.http.services.sticker-award.loadbalancer.server.port=8080"
 
+  # Load testing service - runs k6 load tests against the stack
+  load-simulator:
+    image: grafana/k6:latest
+    volumes:
+      - ./load-tests:/scripts
+    environment:
+      - TARGET_URL=http://traefik:80
+      - DEPLOYMENT_HOST_URL=${DEPLOYMENT_HOST_URL:-http://localhost:8080}
+      - WORKLOAD=${WORKLOAD:-smoke}
+      - SCENARIO=${SCENARIO:-mixed}
+      - TEST_EMAIL=${TEST_EMAIL:-user@stickerlandia.com}
+      - TEST_PASSWORD=${TEST_PASSWORD:-Stickerlandia2025!}
+    command: run /scripts/load-test.js
+    depends_on:
+      traefik:
+        condition: service_healthy
+      user-management:
+        condition: service_healthy
+      sticker-catalogue:
+        condition: service_healthy
+      sticker-award:
+        condition: service_healthy
+      web-backend:
+        condition: service_started
+    profiles:
+      - load-test
+
   datadog-agent:
     image: datadog/agent:7.75.0
     pull_policy: always
     container_name: datadog-agent
     profiles:
       - monitoring
+      - load-test
     environment:
       # Core Datadog configuration
       - DD_API_KEY=${DD_API_KEY}

load-tests/README.md

@@ -0,0 +1,78 @@
+# Load Testing
+
+k6-based load tests for Stickerlandia.
+
+## Running Tests
+
+```bash
+mise run load:smoke          # Quick test: 2 users, 30 seconds
+mise run load:test           # Full test: ramp to 30 users over 10 minutes
+mise run load:sustained      # Multi-user: provision users, run 10 min sustained load
+```
+
+Each command starts services, runs the test, then cleans up.
+
+### Test Scenarios
+
+```bash
+mise run load:smoke:public   # Public endpoints only (no auth)
+mise run load:smoke:auth     # Authenticated flows only
+mise run load:smoke:register # Registration flow
+```
+
+### Keep Services Running
+
+For iterative testing:
+
+```bash
+mise run load:start              # Start services
+mise run load:sustained:run      # Run test (repeat as needed)
+mise run load:stop               # Stop and cleanup
+```
+
+## Multi-User Pool
+
+For sustained tests with multiple concurrent users:
+
+1. Create `load-tests/data/users.json`:
+
+```json
+{
+  "users": [
+    {"email": "loadtest-001@example.com", "password": "LoadTest2026!"},
+    {"email": "loadtest-002@example.com", "password": "LoadTest2026!"}
+  ]
+}
+```
+
+2. Provision users once: `mise run load:provision-users`
+
+3. Run tests: `mise run load:sustained`
+
+## Validating Telemetry in Datadog
+
+After running load tests, verify data appears in Datadog:
+
+| Product | Link | What to Check |
+|---------|------|---------------|
+| APM | [Traces](https://app.datadoghq.com/apm/traces?query=env%3Adevelopment) | Service traces for all requests |
+| Logs | [Logs](https://app.datadoghq.com/logs?query=env%3Adevelopment) | Application logs from all services |
+| RUM | [Sessions](https://app.datadoghq.com/rum/sessions) | Browser sessions (requires frontend interaction) |
+| DSM | [Data Streams](https://app.datadoghq.com/data-streams) | Kafka message flow between services |
+| DBM | [Databases](https://app.datadoghq.com/databases) | Query performance metrics |
+| Profiling | [Profiles](https://app.datadoghq.com/profiling/explorer?query=env%3Adevelopment) | CPU/memory profiles |
+
+Filter by `env:development` to see load test data.
+
+## Configuration
+
+Override defaults with environment variables:
+
+```bash
+WORKLOAD=load SCENARIO=auth mise run load:smoke
+```
+
+| Variable | Default | Options |
+|----------|---------|---------|
+| `WORKLOAD` | `smoke` | `smoke`, `load`, `sustained`, `sustained:auth`, `sustained:catalogue` |
+| `SCENARIO` | `mixed` | `mixed`, `public`, `auth`, `register` |

load-tests/helpers.js

@@ -0,0 +1,107 @@
+/*
+ * Unless explicitly stated otherwise all files in this repository are licensed under the Apache License Version 2.0.
+ * This product includes software developed at Datadog (https://www.datadoghq.com/).
+ * Copyright 2025-Present Datadog, Inc.
+ */
+
+/**
+ * Shared URL helpers for k6 load tests.
+ * k6 doesn't have native URL constructor, so we implement manual URL parsing.
+ */
+
+// Configuration from environment
+export const BASE_URL = __ENV.TARGET_URL || 'http://traefik:80';
+export const DEPLOYMENT_HOST_URL = __ENV.DEPLOYMENT_HOST_URL || 'http://localhost:8080';
+
+/**
+ * Rewrite external URLs to internal Docker network URLs.
+ * OAuth redirects use the configured external hostname (e.g., localhost:8080)
+ * but k6 inside Docker needs to use the internal hostname (traefik:80).
+ */
+export function rewriteUrl(url) {
+  if (url && url.startsWith(DEPLOYMENT_HOST_URL)) {
+    return url.replace(DEPLOYMENT_HOST_URL, BASE_URL);
+  }
+  return url;
+}
+
+/**
+ * Extract origin (protocol + host) from a URL string.
+ */
+export function getUrlOrigin(url) {
+  const match = url.match(/^(https?:\/\/[^\/]+)/);
+  return match ? match[1] : '';
+}
+
+/**
+ * Get the directory path from a URL (everything up to the last /).
+ */
+export function getUrlDirectory(url) {
+  const origin = getUrlOrigin(url);
+  const path = url.slice(origin.length);
+  const lastSlash = path.lastIndexOf('/');
+  return origin + (lastSlash >= 0 ? path.slice(0, lastSlash + 1) : '/');
+}
+
+/**
+ * Resolve a relative URL against a base URL.
+ */
+export function resolveUrl(baseUrl, relativeUrl) {
+  if (relativeUrl.startsWith('http')) {
+    return relativeUrl;
+  }
+  if (relativeUrl.startsWith('/')) {
+    return getUrlOrigin(baseUrl) + relativeUrl;
+  }
+  return getUrlDirectory(baseUrl) + relativeUrl;
+}
+
+/**
+ * Extract access_token from URL query string or fragment.
+ * Handles URLs like: http://example.com/callback?access_token=xxx
+ * or: http://example.com/callback#access_token=xxx
+ *
+ * NOTE: k6's goja runtime lacks native URL/URLSearchParams APIs,
+ * so we parse manually instead of using `new URL(url).searchParams`.
+ */
+export function extractTokenFromUrl(url) {
+  try {
+    // Split URL into base and the part after ? or #
+    // Handle both query string (?access_token=) and fragment (#access_token=)
+    let searchStr = '';
+
+    const queryIndex = url.indexOf('?');
+    const hashIndex = url.indexOf('#');
+
+    if (queryIndex !== -1) {
+      const endIndex = hashIndex > queryIndex ? hashIndex : url.length;
+      searchStr = url.substring(queryIndex + 1, endIndex);
+    } else if (hashIndex !== -1) {
+      searchStr = url.substring(hashIndex + 1);
+    }
+
+    if (searchStr) {
+      const params = {};
+      searchStr.split('&').forEach(pair => {
+        const eqIndex = pair.indexOf('=');
+        if (eqIndex !== -1) {
+          const key = decodeURIComponent(pair.substring(0, eqIndex));
+          const value = decodeURIComponent(pair.substring(eqIndex + 1));
+          params[key] = value;
+        }
+      });
+
+      if (params.access_token) {
+        return { success: true, accessToken: params.access_token };
+      }
+    }
+  } catch (e) {
+    console.warn('Failed to extract token from URL:', url, e);
+  }
+  return { success: false, error: 'Could not extract token from URL' };
+}
+
+/**
+ * Maximum number of redirects to follow to prevent infinite loops.
+ */
+export const MAX_REDIRECTS = 10;