test: strengthen performance, security, and snapshot regression coverage

[Yebom3220]

Summary

This PR adds comprehensive performance regression testing, modernized security tests, and a snapshot review process for the Scavenger platform. It addresses three testing infrastructure issues to improve quality assurance and prevent regressions.

Issue #1134 — Performance Regression Testing

Scenario added: performance/scenarios/waste-submission-regression.js

A dedicated k6 regression test exercising the core waste-submission flow:

1. Participant registration
2. Waste submission (randomized types and weights)
3. Waste verification
4. Incentive query

Configuration:

• Ramping VUs: 0 → 20 (30s) → 20 (2m) → 50 (30s) → 50 (2m) → 0 (30s)
• Configurable BASE_URL (default: http://localhost:3000/api)

Regression Thresholds:

Metric	Threshold	Regression Policy
p50 latency	< 400ms	Must not regress >20% from baseline
p95 latency	< 800ms	Must not regress >20% from baseline
p99 latency	< 1500ms	Must not regress >20% from baseline
Error rate	< 10%	Must not exceed threshold

Baseline methodology: Initial estimates in baselines.json under waste_submission_regression with a note that actual values require staging environment measurement. No fabricated numbers.

Integration: Added to run-perf-tests.sh alongside existing load/stress/endurance/spike tests.

Documentation: Updated performance/README.md with usage instructions, threshold table, and regression policy.

Issue #1135 — Security Test Suite

New test files:

tests/idor.test.ts (11 tests)

• Waste resource ownership enforcement
• Participant resource ownership enforcement
• Incentive resource ownership enforcement
• API endpoint enumeration resistance
• Resource existence leakage prevention

tests/broken-authentication.test.ts (12 tests)

• Missing authentication on protected endpoints
• Malformed JWT tokens and invalid signatures
• Empty/malformed bearer tokens
• Expired tokens
• Wallet-based authentication bypass
• Spoofed X-Role and X-Is-Admin headers
• Session security headers

tests/injection-input-validation.test.ts (25+ tests)

• SQL/ORM injection (8 payload variants + query parameters)
• XSS/script injection (8 payload variants + response reflection)
• Command injection (7 payload variants)
• Malformed JSON and type confusion
• Oversized and boundary inputs
• Path traversal (5 variants)
• Header injection (CRLF)

OWASP Top 10 coverage: A01 (Access Control), A02 (Crypto), A03 (Injection), A05 (Misconfig), A06 (Components), A07 (Auth), A08 (Data Integrity).

Documentation: Updated security-tests/README.md with OWASP coverage map, contributor guide, test naming conventions, assertion best practices, and environment requirements.

Secrets check: All test fixtures use deterministic fake/test credentials. No real API keys, private keys, or credentials.

Issue #1136 — Snapshot Review Process

New file: frontend/e2e/__snapshots__/SNAPSHOT_REVIEW.md

• Complete review process documentation
• Contributor guide for updating snapshots
• Reviewer checklist (9 items)
• When to update vs reject snapshot changes
• Environment considerations and troubleshooting

Updated: frontend/VISUAL_REGRESSION.md

• Added review checklist section
• Added when-to-update and when-to-reject guidelines
• Cross-reference to the new SNAPSHOT_REVIEW.md

Snapshot audit: The existing __snapshots__/ directories contain only .gitkeep files (no committed baselines). The visual-regression.spec.ts tests (32 tests across 3 browser projects) are properly configured and documented.

Validation

Syntax & Compilation

• esbuild compilation: All 3 new security test files — PASS
• node --check: Performance scenario — PASS
• bash -n: Shell script — PASS
• JSON.parse: baselines.json — PASS

Security Tests

• npx vitest run — Tests compile and execute. Failures are expected (no backend running) and indicate connection-refused errors, not code issues.

Existing Tests

• No existing test files were modified (only new files added and docs updated)
• All existing test infrastructure preserved

Files Changed (10 total)

Modified (5):

• performance/baselines.json — Added waste_submission_regression baselines
• performance/run-perf-tests.sh — Added regression test to suite
• performance/README.md — Added regression test documentation
• security-tests/README.md — Added OWASP coverage, contributor guide
• frontend/VISUAL_REGRESSION.md — Added review checklist

New (5):

• performance/scenarios/waste-submission-regression.js — k6 regression test
• security-tests/tests/idor.test.ts — IDOR tests
• security-tests/tests/broken-authentication.test.ts — Auth tests
• security-tests/tests/injection-input-validation.test.ts — Injection tests
• frontend/e2e/__snapshots__/SNAPSHOT_REVIEW.md — Review process docs

Review Checklist

• Performance regression scenario implemented
• Baseline/threshold policy documented
• Security tests updated for current auth model
• OWASP-relevant negative paths covered
• Snapshot inventory reviewed
• Snapshot review process documented
• No secrets added
• Existing tests preserved
• Relevant validation completed

Issues Closed

Closes #1134
Closes #1135
Closes #1136

[drips-wave]

@Yebom3220 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits