[ATLURI0001]

Overview

Expands the static verification suite in tests/test_project.py from 6 to 13 automated tests to cover critical edge proxy security, forwarding invariants, upstream pooling, and observability:

1. Security Headers & Protocol Hardening (test_security_headers_and_hardening):

   • Asserts mandatory presence of X-Content-Type-Options nosniff always, Referrer-Policy strict-origin-when-cross-origin always, and X-Frame-Options DENY always.
   • Asserts HTTP/2 enablement on the TLS listener and connection limits (limit_conn client_conn 50).

2. Proxy Forwarding Invariants (test_proxy_forwarding_invariants):

   • Asserts proxy_http_version 1.1, upstream Host propagation, X-Real-IP, X-Forwarded-For, X-Forwarded-Proto, and X-Request-ID forwarding.
   • Verifies short connect timeout (3s) and Connection "" to maintain upstream keepalive pools.

3. Rate Limiting & Connection Throttling (test_rate_limiting_and_http_status):

   • Asserts HTTP 429 status code for rate exceeded events (limit_req_status 429;).
   • Asserts burst buffer and nodelay behavior for the /api/ route.

4. Upstream Pools & Keepalive Balancing (test_upstream_load_balancing_and_keepalive):

   • Asserts least_conn load balancing across active backends.
   • Asserts circuit-breaking retry parameters (max_fails=3 fail_timeout=10s) and persistent upstream keepalive pools (keepalive 32 / keepalive 8).

5. Internal Metrics Isolation & Health Routing (test_metrics_port_isolation, test_http_redirect_preserves_uri, test_compose_healthchecks_and_isolation):

   • Verifies unexposed port 8081 metrics isolation and stub status endpoint.
   • Verifies HTTP 308 redirect preserving query parameters.
   • Verifies Grafana disabled public signups (GF_USERS_ALLOW_SIGN_UP: "false") and exporter scrape target.