[Testing] k6 baseline load test hits authenticated endpoints with no credentials and never fails on check errors

[grantfox-oss]

Join our community: https://t.me/+DOylgFv1jyJlNzM0

Why this matters

scripts/loadtest/baseline.js is wired into .github/workflows/loadtest.yml as the project's only load test. It sends unauthenticated GET requests to ${BASE_URL}/api/v1/loans and ${BASE_URL}/api/v1/score/${WALLET_SEED}.

Looking at the routes, GET /loans is behind requireJwtAuth in backend/src/routes/loanRoutes.ts, and the score route is behind requireApiKey in backend/src/routes/scoreRoutes.ts. Neither request in the k6 script sends a JWT or API key, so both calls will always return 401 during every load test run.

The k6 thresholds in baseline.js only check http_req_duration and http_req_failed (network-level failures), not the check() results. A 401 response is a normal HTTP response, not a network failure, so the workflow reports green even though it never actually load-tests the real, authenticated request paths it claims to cover. The load test is effectively measuring 401-response latency, not the borrower/lender flows it is meant to exercise.

Acceptance criteria

• scripts/loadtest/baseline.js obtains valid auth (JWT and/or API key) before hitting protected endpoints, or is repointed at genuinely public endpoints.
• The k6 script's check() results actually gate pass/fail for the workflow run (e.g. via a checks threshold or explicit exit-code handling), so silently-failing checks can no longer produce a green run.
• .github/workflows/loadtest.yml documents how to supply credentials/env vars needed for the authenticated run.

Files to touch

• scripts/loadtest/baseline.js
• .github/workflows/loadtest.yml

Out of scope

• Adding new load test scenarios beyond fixing the existing baseline script's auth and check-gating.
• Changing the auth middleware itself.