kimi-code/packages/server/test/snapshot.perf.test.ts
Haozhe 60dfb68a2d
feat(server): add bearer-token auth and safe host exposure (#1006)
* test(server): add API surface snapshot guardrail

Boot startServer on port 0 and snapshot the documented v1 route table derived from /openapi.json paths, plus the reachability of doc/meta endpoints (/healthz, /openapi.json, /asyncapi.json, /). Gives later auth/--host phases an intentional diff when routes change. M0 makes no production behavior change.

* test(server): add e2e server harness with token support

Add test/helpers/serverHarness.ts: boot() wraps startServer with an isolated lock + home dir and returns a handle (server, address, baseUrl, wsUrl, token, close) plus authedFetch/authedWs that carry Authorization: Bearer <token> (and the kimi-code.bearer.<token> WS subprotocol). serviceOverrides is the generic DI seam later phases use to inject a fixed-token auth service; IAuthTokenService is not referenced yet. closeAll() tears down every booted server and socket. M0 makes no production behavior change; typecheck-only gate.

* feat(server): add privateFiles 0600 atomic write/read utility

* feat(server): add per-start tokenStore

* feat(server): add env-based bcrypt password hash utility

* feat(server): add IAuthTokenService DI seam

* feat(server): add global onRequest auth hook with bypass + redaction

* fix(server): stop reflecting Host header in /asyncapi.json

* feat(server): add WS bearer subprotocol constant and parser

* feat(server): enforce bearer token auth on WS upgrade

* feat(server): add Host header allowlist middleware

* feat(server): add Origin/CORS middleware

* feat(server): wire Host/Origin checks into HTTP and WS

* feat(server): wire token auth, Host/Origin, and WS auth into start.ts

* fix(server): create lock file with 0600 permissions

* fix(server): suppress debug routes on non-loopback binds

* feat(kimi-code): read server token and send Authorization on CLI calls

* feat(kimi-code): inject server token into /web URL fragment

* feat(server): add bindClassify for loopback/lan/public classification

* feat(kimi-code): register --host flag and pass it through the daemon

* feat(server): require password and TLS opt-out on non-loopback binds

* feat(server): rate-limit repeated auth failures on non-loopback binds

* feat(server): disable shutdown and terminals on public binds by default

* feat(server): add security response headers on non-loopback binds

* test(server): cover LAN/public host-exposure hardening end to end

* docs(server): add deployment security and threat-model guide

* changeset: minor kimi-code for server auth and host exposure

* feat(kimi-web): add server bearer-token auth support

* fix: repair CI for server auth and host exposure

- Replace native @node-rs/bcrypt with pure-JS bcryptjs so the ESM CLI
  bundle and the SEA native bundle both build without native-addon
  require issues (node-rs/bcrypt broke the ESM smoke and the SEA
  check-bundle allowlist).
- Remove dead cleanup references (stopSpinner, authLogoBlinkTimer) in
  apps/kimi-web App.vue that failed vue-tsc.
- Fix lint: drop empty spread fallbacks in the e2e auth-header merge,
  void the intentionally-async WS upgrade listener, add missing
  assertions to satisfy jest/expect-expect, and convert a ternary
  statement to if/else.
- Send the bearer token in the snapshot perf/smoke tests so they pass
  under the new global auth hook.
- Refresh the pnpmDeps hash in flake.nix for the updated lockfile.

* feat(server): persist bearer token and add rotate-token command

- persist the server bearer token in <home>/server.token (0600) and reuse it across restarts instead of per-start server-<pid>.token
- add `kimi server rotate-token` to regenerate the token; the token store reloads on mtime/inode change so rotation applies without restart
- print the token and Vite-style Local/Network URLs in the startup banner
- allow non-loopback binds with bearer-token-only auth (password now optional) and update SECURITY.md
- surface daemon boot failures immediately with the exit reason and log tail instead of waiting for the spawn timeout

* feat(server): print full token URLs and re-print links after rotate

- Drop the ready-panel border so token URLs print in full for copying; keep the Kimi sprite beside the title.
- Re-print Local/Network access links after `server rotate-token` (host/port from the lock).
- Extract shared access-URL helpers into access-urls.ts.
- Unify link and token colors between the banner and rotate-token.

* feat(server): dim URL #token= fragment and de-highlight token

- Render the `#token=…` fragment in a dim gray so the host/port stands out in the banner and rotate-token links.
- De-highlight the standalone token; set it off with surrounding whitespace instead of color.
- Add splitTokenFragment helper.

* refactor(cli): polish server ready banner and rotate-token output

- move version onto the ready banner title line; drop the separate
  Ready:/Version: rows and the startup-time metric
- reorder rotate-token output so the new token sits between the
  invalidation note and the access links
- update server CLI tests for the new layout

* feat(server): warn on reuse and refine ready banner

- Warn when `server run` reuses an already-running daemon (its options are not applied) and show the running server's actual URLs.
- Show a `Network: off  use --host 0.0.0.0 to enable` hint on loopback binds.
- Move the version onto the title line and drop the startup-time metric.

* fix(web): relabel auth dialog to token and cover full page

- Relabel the server auth dialog from "password" to "token"; the server accepts the bearer token, with the password only as a fallback.
- Make the auth dialog overlay fully opaque so it covers the whole page instead of revealing the login page underneath.

* fix: resolve CI failures on web auth PR

- Replace chalk.yellow named color with chalk.hex(darkColors.warning)
  in the server reuse notice to satisfy the chalk named color guard.
- Update pnpmDeps hash in flake.nix to match the regenerated
  pnpm-lock.yaml so the Nix build succeeds.
- Retry rmSync in ws-broadcast e2e teardown to ride out EBUSY /
  ENOTEMPTY races while the server flushes files after close().

* test(server): update API surface snapshot for warnings route

The feat/web-auth branch adds GET /api/v1/sessions/{session_id}/warnings
(packages/server/src/routes/sessions.ts), so the API surface guardrail
snapshot needs to record the new documented v1 route.
2026-06-25 17:57:56 +08:00

112 lines
3.9 KiB
TypeScript

/**
* Tiny standalone perf check for the snapshot reader. Boots a real daemon,
* creates 50 sessions to populate the workdir index, then times the snapshot
* endpoint on a target session across 20 iterations and prints p50/p95.
*
* Run with: `pnpm vitest run test/snapshot.perf.bench.ts`
* `KIMI_SNAPSHOT_READER=legacy pnpm vitest run test/snapshot.perf.bench.ts`
*
* Goal: demonstrate that the new reader stays well under 200ms warm and
* does not scale linearly with session count, unlike the legacy listSessions
* path. Not a CI gate — invoked by hand from the harness; the assertion is
* just an upper-bound sanity check.
*/
import { mkdtempSync, rmSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { pino } from 'pino';
import { afterEach, beforeEach, describe, expect, it } from 'vitest';
import { startServer, type RunningServer } from '../src';
import { fixedTokenAuth, withAuth } from './helpers/serverHarness';
let tmpDir: string;
let bridgeHome: string;
let server: RunningServer | undefined;
beforeEach(() => {
tmpDir = mkdtempSync(join(tmpdir(), 'kimi-snapshot-perf-'));
bridgeHome = mkdtempSync(join(tmpdir(), 'kimi-snapshot-perf-home-'));
});
afterEach(async () => {
try {
await server?.close();
} catch {
// ignore
}
server = undefined;
rmSync(tmpDir, { recursive: true, force: true });
rmSync(bridgeHome, { recursive: true, force: true });
});
async function postSession(baseUrl: string, cwd: string): Promise<string> {
const res = await fetch(
`${baseUrl}/api/v1/sessions`,
withAuth({
method: 'POST',
headers: { 'content-type': 'application/json' },
body: JSON.stringify({ metadata: { cwd } }),
}),
);
const env = (await res.json()) as { code: number; data: { id: string } | null };
if (env.code !== 0 || env.data === null) throw new Error(JSON.stringify(env));
return env.data.id;
}
async function timeSnapshot(baseUrl: string, sid: string): Promise<number> {
const t = performance.now();
const res = await fetch(`${baseUrl}/api/v1/sessions/${sid}/snapshot`, withAuth());
await res.text();
return performance.now() - t;
}
function quantile(samples: readonly number[], q: number): number {
const sorted = [...samples].sort((a, b) => a - b);
const idx = Math.min(sorted.length - 1, Math.floor(q * sorted.length));
return sorted[idx]!;
}
describe('SnapshotReader perf (real HTTP, 50 sessions)', () => {
it(`mode=${process.env['KIMI_SNAPSHOT_READER'] ?? 'auto'} p95 stays under 200ms warm`, async () => {
server = await startServer({
host: '127.0.0.1',
port: 0,
lockPath: join(tmpDir, 'lock'),
serviceOverrides: [fixedTokenAuth()],
logger: pino({ level: 'silent' }),
coreProcessOptions: { homeDir: bridgeHome },
});
const baseUrl = server.address;
const sessionCount = 50;
const sids: string[] = [];
for (let i = 0; i < sessionCount; i++) {
sids.push(await postSession(baseUrl, join(tmpDir, `ws-${i}`)));
}
const target = sids.at(-1)!;
for (let i = 0; i < 5; i++) await timeSnapshot(baseUrl, target);
const samples: number[] = [];
const N = 20;
for (let i = 0; i < N; i++) samples.push(await timeSnapshot(baseUrl, target));
const p50 = quantile(samples, 0.5);
const p95 = quantile(samples, 0.95);
const min = Math.min(...samples);
const max = Math.max(...samples);
const mode = process.env['KIMI_SNAPSHOT_READER'] ?? 'auto';
// eslint-disable-next-line no-console
console.log(
`mode=${mode} sessions=${sessionCount} n=${N} min=${min.toFixed(1)}ms p50=${p50.toFixed(1)}ms p95=${p95.toFixed(1)}ms max=${max.toFixed(1)}ms`,
);
// Generous upper bound — even on a slow CI VM the new reader should
// comfortably beat this; legacy path on a 50-session store will too,
// but its scaling is the production concern, not this micro number.
expect(p95).toBeLessThan(1000);
}, 60_000);
});