feat: platform features — SSO, billing, plan enforcement, audit log, chaos tests, Redis cluster

.github/workflows/cd.yml

@@ -59,7 +59,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: "1.24"
+          go-version: "1.25"
           cache: true
 
       - name: Build & Vet (Go)
@@ -95,4 +95,4 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max

.github/workflows/chaos.yml

@@ -0,0 +1,122 @@
+name: Chaos Tests
+
+permissions:
+  contents: read
+
+on:
+  workflow_dispatch:
+    inputs:
+      experiment:
+        description: 'Experiment to run'
+        required: true
+        default: all
+        type: choice
+        options:
+          - all
+          - pod-kill
+          - kafka-consumer-pause
+          - redis-outage
+          - projection-lag
+          - network-partition
+      namespace:
+        description: 'Target namespace'
+        required: true
+        default: grainguard-dev
+  schedule:
+    # Run full suite every Saturday at 02:00 UTC (off-peak)
+    - cron: '0 2 * * 6'
+
+env:
+  NAMESPACE: ${{ github.event.inputs.namespace || 'grainguard-dev' }}
+
+jobs:
+  chaos:
+    name: Chaos — ${{ github.event.inputs.experiment || 'all' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Configure kubectl
+        uses: azure/setup-kubectl@v3
+        with:
+          version: 'v1.29.0'
+
+      - name: Set kubeconfig
+        run: |
+          mkdir -p "${HOME}/.kube"
+          echo "${{ secrets.KUBECONFIG_DEV }}" | base64 -d > "${HOME}/.kube/config"
+          chmod 600 "${HOME}/.kube/config"
+
+      - name: Install Chaos Toolkit
+        run: |
+          pip install --quiet \
+            chaostoolkit==1.19.0 \
+            chaostoolkit-kubernetes==0.26.4 \
+            chaostoolkit-verification==0.3.0
+
+      - name: Make scripts executable
+        run: chmod +x tests/chaos/*.sh
+
+      - name: Run — all experiments
+        if: ${{ github.event.inputs.experiment == 'all' || github.event_name == 'schedule' }}
+        env:
+          NAMESPACE: ${{ env.NAMESPACE }}
+          KAFKA_BOOTSTRAP: kafka:9092
+          GATEWAY_URL: ${{ secrets.CHAOS_GATEWAY_URL }}
+          PROMETHEUS_URL: ${{ secrets.CHAOS_PROMETHEUS_URL }}
+          TEST_JWT: ${{ secrets.CHAOS_TEST_JWT }}
+        run: bash tests/chaos/run-all.sh
+
+      - name: Run — pod-kill
+        if: ${{ github.event.inputs.experiment == 'pod-kill' }}
+        run: chaos run tests/chaos/pod-kill.yaml
+
+      - name: Run — kafka-consumer-pause
+        if: ${{ github.event.inputs.experiment == 'kafka-consumer-pause' }}
+        env:
+          NAMESPACE: ${{ env.NAMESPACE }}
+          KAFKA_BOOTSTRAP: kafka:9092
+        run: bash tests/chaos/kafka-consumer-pause.sh
+
+      - name: Run — redis-outage
+        if: ${{ github.event.inputs.experiment == 'redis-outage' }}
+        env:
+          NAMESPACE: ${{ env.NAMESPACE }}
+          GATEWAY_URL: ${{ secrets.CHAOS_GATEWAY_URL }}
+          TEST_JWT: ${{ secrets.CHAOS_TEST_JWT }}
+        run: bash tests/chaos/redis-outage.sh
+
+      - name: Run — projection-lag
+        if: ${{ github.event.inputs.experiment == 'projection-lag' }}
+        env:
+          NAMESPACE: ${{ env.NAMESPACE }}
+          KAFKA_BOOTSTRAP: kafka:9092
+          PROMETHEUS_URL: ${{ secrets.CHAOS_PROMETHEUS_URL }}
+        run: bash tests/chaos/projection-lag.sh
+
+      - name: Run — network-partition
+        if: ${{ github.event.inputs.experiment == 'network-partition' }}
+        run: chaos run tests/chaos/network-partition.yaml
+
+      - name: Upload chaos logs
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: chaos-results-${{ github.run_number }}
+          path: tests/chaos/results/
+          retention-days: 30
+
+      - name: Notify Slack on failure
+        if: failure()
+        uses: slackapi/slack-github-action@v1.26.0
+        with:
+          payload: |
+            {
+              "text": ":fire: Chaos experiment *${{ github.event.inputs.experiment || 'all' }}* FAILED on `${{ env.NAMESPACE }}` — <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View run>"
+            }
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_CHAOS_WEBHOOK }}
+          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

.github/workflows/e2e.yml

@@ -0,0 +1,77 @@
+name: E2E Tests
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  e2e:
+    name: Playwright E2E
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: apps/dashboard/package-lock.json
+
+      - name: Install dashboard deps
+        run: npm ci
+        working-directory: apps/dashboard
+
+      - name: Install E2E deps
+        run: npm install --save-dev @playwright/test typescript ts-node
+        working-directory: tests/e2e
+
+      - name: Install Playwright browsers
+        run: npx playwright install --with-deps chromium firefox
+        working-directory: tests/e2e
+
+      - name: Build dashboard
+        run: npm run build
+        working-directory: apps/dashboard
+        env:
+          VITE_AUTH0_DOMAIN:    ${{ secrets.VITE_AUTH0_DOMAIN }}
+          VITE_AUTH0_CLIENT_ID: ${{ secrets.VITE_AUTH0_CLIENT_ID }}
+          VITE_AUTH0_AUDIENCE:  ${{ secrets.VITE_AUTH0_AUDIENCE }}
+          VITE_BFF_URL:         ${{ secrets.E2E_BFF_URL }}
+          VITE_GATEWAY_URL:     ${{ secrets.E2E_GATEWAY_URL }}
+
+      - name: Serve dashboard
+        run: npx serve -s dist -l 5173 &
+        working-directory: apps/dashboard
+
+      - name: Wait for server
+        run: npx wait-on http://localhost:5173 --timeout 30000
+
+      - name: Run Playwright tests
+        run: npx playwright test --config playwright.config.ts
+        working-directory: tests/e2e
+        env:
+          E2E_BASE_URL:         http://localhost:5173
+          VITE_AUTH0_CLIENT_ID: ${{ secrets.VITE_AUTH0_CLIENT_ID }}
+          VITE_AUTH0_AUDIENCE:  ${{ secrets.VITE_AUTH0_AUDIENCE }}
+
+      - name: Upload Playwright report
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: playwright-report-${{ github.run_number }}
+          path: tests/e2e/playwright-report/
+          retention-days: 14
+
+      - name: Upload test results (JUnit)
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: playwright-results-${{ github.run_number }}
+          path: tests/e2e/playwright-results.xml

.github/workflows/perf.yml

@@ -0,0 +1,181 @@
+name: Performance Budget
+
+on:
+  pull_request:
+    branches: [master]
+    paths:
+      - "apps/gateway/**"
+      - "apps/bff/**"
+      - "scripts/load-tests/**"
+
+permissions:
+  contents: read
+
+jobs:
+  perf:
+    name: k6 Performance Budget
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_USER: grainguard
+          POSTGRES_PASSWORD: grainguard
+          POSTGRES_DB: grainguard
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+
+      redis:
+        image: redis:7-alpine
+        ports:
+          - 6379:6379
+        options: >-
+          --health-cmd "redis-cli ping"
+          --health-interval 10s
+          --health-retries 5
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: |
+            apps/gateway/package-lock.json
+            apps/bff/package-lock.json
+
+      - name: Install gateway deps
+        run: npm ci
+        working-directory: apps/gateway
+
+      - name: Ensure Postgres client is available
+        run: |
+          if ! command -v psql >/dev/null 2>&1; then
+            sudo apt-get update
+            sudo apt-get install -y postgresql-client
+          fi
+
+      - name: Start gateway in background
+        run: npx ts-node src/server.ts &
+        working-directory: apps/gateway
+        env:
+          PORT: 3000
+          NODE_ENV: test
+          AUTH_ENABLED: "false"
+          DATABASE_URL: postgres://grainguard:grainguard@localhost:5432/grainguard
+          WRITE_DATABASE_URL: postgres://grainguard:grainguard@localhost:5432/grainguard
+          READ_DATABASE_URL: postgres://grainguard:grainguard@localhost:5432/grainguard
+          REDIS_HOST: localhost
+          REDIS_PORT: "6379"
+          JWKS_URL: https://example.com/.well-known/jwks.json
+          JWT_ISSUER: https://example.com/
+          JWT_AUDIENCE: grainguard
+          ALLOWED_ORIGINS: http://localhost:5173
+          STRIPE_SECRET_KEY: test_placeholder
+          STRIPE_WEBHOOK_SECRET: webhook_placeholder
+          STRIPE_PRICE_STARTER: price_placeholder
+          STRIPE_PRICE_PROFESSIONAL: price_placeholder
+          STRIPE_PRICE_ENTERPRISE: price_placeholder
+          DASHBOARD_URL: http://localhost:5173
+          AUTH0_DOMAIN: placeholder.auth0.com
+          AUTH0_MANAGEMENT_CLIENT_ID: placeholder
+          AUTH0_MANAGEMENT_CLIENT_SECRET: placeholder
+
+      - name: Install BFF deps
+        run: npm ci
+        working-directory: apps/bff
+
+      - name: Create minimal read-model tables for startup
+        run: |
+          PGPASSWORD=grainguard psql \
+            -h localhost \
+            -U grainguard \
+            -d grainguard \
+            -c 'CREATE TABLE IF NOT EXISTS device_telemetry_latest (
+                  device_id uuid PRIMARY KEY,
+                  tenant_id uuid,
+                  temperature double precision,
+                  humidity double precision,
+                  recorded_at timestamptz,
+                  updated_at timestamptz,
+                  version bigint
+                );
+                INSERT INTO device_telemetry_latest (
+                  device_id, tenant_id, temperature, humidity, recorded_at, updated_at, version
+                )
+                VALUES (
+                  '\''00000000-0000-0000-0000-000000000001'\'',
+                  '\''11111111-1111-1111-1111-111111111111'\'',
+                  21.5,
+                  48.2,
+                  NOW(),
+                  NOW(),
+                  1
+                )
+                ON CONFLICT (device_id) DO UPDATE
+                SET tenant_id = EXCLUDED.tenant_id,
+                    temperature = EXCLUDED.temperature,
+                    humidity = EXCLUDED.humidity,
+                    recorded_at = EXCLUDED.recorded_at,
+                    updated_at = EXCLUDED.updated_at,
+                    version = EXCLUDED.version;'
+
+      - name: Create performance results directory
+        run: mkdir -p scripts/load-tests/results
+
+      - name: Start BFF in background
+        run: npx ts-node-dev --transpile-only src/server.ts &
+        working-directory: apps/bff
+        env:
+          PORT: 4000
+          NODE_ENV: test
+          AUTH_ENABLED: "false"
+          READ_DATABASE_URL: postgres://grainguard:grainguard@localhost:5432/grainguard
+          REDIS_HOST: localhost
+          REDIS_PORT: "6379"
+          ELASTICSEARCH_URL: http://localhost:9200
+          CASSANDRA_HOSTS: localhost
+          CASSANDRA_KEYSPACE: grainguard_telemetry
+          JWKS_URL: https://example.com/.well-known/jwks.json
+          JWT_ISSUER: https://example.com/
+          JWT_AUDIENCE: grainguard
+          ALLOWED_ORIGINS: http://localhost:5173,http://localhost:3000
+
+      - name: Wait for gateway
+        run: npx wait-on http://localhost:3000/health --timeout 30000
+
+      - name: Wait for BFF
+        run: npx wait-on tcp:4000 --timeout 30000
+
+      - name: Install k6
+        run: |
+          curl -L https://github.com/grafana/k6/releases/download/v0.51.0/k6-v0.51.0-linux-amd64.tar.gz | tar xz
+          sudo mv k6-v0.51.0-linux-amd64/k6 /usr/local/bin/k6
+
+      - name: Run performance budget
+        run: |
+          k6 run \
+            --env GATEWAY_URL=http://localhost:3000 \
+            --env BFF_URL=http://localhost:4000 \
+            --env GATEWAY_AUTH_DISABLED=true \
+            --env BFF_AUTH_DISABLED=true \
+            --env JWT=dummy-jwt \
+            --env TEST_DEVICE_ID=00000000-0000-0000-0000-000000000001 \
+            scripts/load-tests/performance-budget.js
+
+      - name: Upload performance results
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: perf-results-${{ github.run_number }}
+          path: scripts/load-tests/results/
+          retention-days: 30