Skip to content

perf(loadtest,hosting): working Inertia locust harness; validate path prefixes once; batch static security headers - #842

Merged
antosubash merged 6 commits into
mainfrom
fix/s16-perf-harness-micro
Nov 5, 2026
Merged

antosubash merged 6 commits into
mainfrom
fix/s16-perf-harness-micro

Conversation

@antosubash

Copy link
Copy Markdown
Owner

Load-test harness fix plus two measured per-request savings. These come from the local performance review of 2026-11-05.

Load-test harness (tests/loadtest/)

  • The committed locustfile predated Inertia v3 conformance. Its Inertia requests sent no X-Inertia-Version, so /dashboard/ and /admin/users/ got a 409 on every request: 26.5% failures, and those endpoints measured nothing. It also sent no X-SM-I18n, so every response carried the full catalog.
  • Each user now loads the first HTML page and reads the asset version from data-page. It sends X-Inertia-Version and X-SM-I18n the way the client does, and treats 409 as a failure.
  • The README documents this, along with pool sizing: 300 users exhaust the default pool of 10 + 20 connections.
  • Offline tests cover the client in tests/loadtest/test_loadtest_inertia_client.py.

Per-request micro-optimisations (kept only where a benchmark shows a gain; scripts/bench_loadtest_overheads.py, numbers in tests/loadtest/README.md)

  • matches_path no longer re-validates prefixes on every call. Callers build their tuples once with the new validated_prefixes(...), which keeps the trailing-slash check at import time. That covers rate limit, setup gate, maintenance, observability, auth's public paths and site_lock's health prefix. 0.76 → 0.23 µs per call.
  • Static security headers are built once and swapped in as a batch. CSP nonce, HSTS and the sandbox/304 handling stay per response. The middleware moved to _security_headers.py, and simple_module_hosting.middleware.SecurityHeadersMiddleware still imports. Full wrapper: 14.4 → 11.4 µs.
  • Dropped as not consistently faster: flag DTO construction, statement-filter caching and session cookie re-signing. Tenancy and soft-delete filtering are unchanged.

Pipeline:

  • Review fixed two things: the auth and site_lock prefix tuples lost the slash guard when validation moved out of matches_path, and the header batch mutated the app's header list.
  • A second pass was clean.

Local CI: make lint ✓ · make test-py (8 workers) 7885 passed ✓ · make test-js ✓.

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Nov 5, 2026 •

Copy link
Copy Markdown

Deploying simple-module-python with  Cloudflare Pages  Cloudflare Pages

Latest commit: a17192f
Status: ✅  Deploy successful!
Preview URL: https://9eaad1ea.simple-module-python.pages.dev
Branch Preview URL: https://fix-s16-perf-harness-micro.simple-module-python.pages.dev

View logs

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 5, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ✅ Completed 2026-11-05T17:58:28.010714Z 8411e51 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@antosubash
antosubash merged commit 2e1de18 into main Nov 5, 2026
16 checks passed
@antosubash
antosubash deleted the fix/s16-perf-harness-micro branch November 5, 2026 23:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant