# Load Tests — SentryAgent.ai AgentIdP

Load tests are written for [k6](https://k6.io/) and cover the three most
performance-critical API flows.

## Prerequisites

Install k6 on your machine (one-time):

```bash
# macOS
brew install k6

# Ubuntu / Debian
sudo gpg -k
sudo gpg --no-default-keyring --keyring /usr/share/keyrings/k6-archive-keyring.gpg \
  --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys C5AD17C747E3415A3642D57D77C6C491D6AC1D69
echo "deb [signed-by=/usr/share/keyrings/k6-archive-keyring.gpg] https://dl.k6.io/deb stable main" \
  | sudo tee /etc/apt/sources.list.d/k6.list
sudo apt-get update && sudo apt-get install k6

# Windows (Chocolatey)
choco install k6
```

## Environment Variables

Each script reads the following env vars:

| Variable          | Default                        | Description                          |
|-------------------|--------------------------------|--------------------------------------|
| `BASE_URL`        | `http://localhost:3000`        | AgentIdP base URL                    |
| `CLIENT_ID`       | *(required for token test)*    | OAuth2 client_id for token issuance  |
| `CLIENT_SECRET`   | *(required for token test)*    | OAuth2 client_secret                 |
| `AGENT_ID`        | *(required for rotation test)* | Agent ID for credential rotation     |

Export them before running:

```bash
export BASE_URL=http://localhost:3000
export CLIENT_ID=your-client-id
export CLIENT_SECRET=your-client-secret
export AGENT_ID=your-agent-id
```

## Running Individual Scenarios

```bash
# Agent Registration — 100 VUs, 60s
k6 run tests/load/agent-registration.js

# Token Issuance — 1000 VUs, 60s
k6 run tests/load/token-issuance.js

# Credential Rotation — 50 VUs, 60s
k6 run tests/load/credential-rotation.js
```

## Running All Scenarios (npm script)

```bash
npm run load-test
```

This runs all three scenarios sequentially, matching the same order as the CI
pipeline.

## Pass / Fail Thresholds

All scenarios enforce these thresholds (tests FAIL if any is breached):

| Metric                  | Threshold  |
|-------------------------|------------|
| p95 response time       | < 500 ms   |
| HTTP error rate         | < 1 %      |

k6 exits with a non-zero status code when any threshold is breached, making it
safe to use in CI pipelines.

## Results

k6 prints a summary table to stdout on completion. For HTML reports:

```bash
k6 run --out json=results.json tests/load/agent-registration.js
k6 report results.json
```