✨ Headless load tests

.devcontainer/.env.development

@@ -212,6 +212,13 @@ KEYCLOAK_TENANT_REALM_CONFIG_S3_KEY=defaults/keycloak/tenant-90505c8a-23a9-4cdf-
 SUPER_ADMIN_TENANT_ID=90505c8a-23a9-4cdf-a26b-4e19f6a097d5
 MAX_DIFF_LINES=500
 
+# Dev-only: lets ONLINE cast-vote fall back to `iat` when a voter token has
+# no `auth_time` claim (true for any non-browser, password-grant login —
+# Keycloak only sets AUTH_TIME for the authorization_code/browser flow).
+# Needed for headless-load-test's voter login. Never set this in a real
+# deployment's config — it's absent (= strict) everywhere else on purpose.
+HARVEST_ALLOW_ONLINE_AUTH_TIME_IAT_FALLBACK=true
+
 # This is the name of the keycloak group voters need to be included in
 KEYCLOAK_VOTER_GROUP_NAME=voter
 

.devcontainer/docker-compose-base.yml

@@ -434,6 +434,7 @@ services:
     environment:
       RUST_BACKTRACE: ${RUST_BACKTRACE}
       SUPER_ADMIN_TENANT_ID: ${SUPER_ADMIN_TENANT_ID}
+      HARVEST_ALLOW_ONLINE_AUTH_TIME_IAT_FALLBACK: ${HARVEST_ALLOW_ONLINE_AUTH_TIME_IAT_FALLBACK:-false}
       LOG_LEVEL: ${LOG_LEVEL}
       ROCKET_ADDRESS: ${ROCKET_ADDRESS}
       ROCKET_PORT: ${HARVEST_PORT}

.gitignore

@@ -60,4 +60,7 @@ packages/voting-portal/logs
 packages/ballot-verifier/logs
 
 # ignore artifacts for airgapped environments
-airgapped-artifacts
+airgapped-artifacts
+
+# local headless-load-test run data (real exports, tuned layers.yaml — not fixtures)
+packages/headless-load-test/data/local/

packages/Cargo.toml

@@ -18,6 +18,7 @@ members = [
     "windmill",
     "wrap-map-err",
     "step-cli",
+    "headless-load-test",
     "e2e/src/mock_server",
     "e2e",
     "orare",

packages/harvest/src/routes/insert_cast_vote.rs

@@ -52,10 +52,9 @@ pub async fn insert_cast_vote(
             ErrorCode::Unauthorized,
         )
     })?;
-    let auth_time = &claims.auth_time.or_else(|| {
-        matches!(voting_channel, VotingStatusChannel::TELEPHONE)
-            .then_some(claims.iat)
-    });
+    let auth_time = &claims
+        .auth_time
+        .or_else(|| auth_time_iat_fallback_allowed(voting_channel).then_some(claims.iat));
 
     info!("insert-cast-vote: starting");
 
@@ -319,3 +318,59 @@ pub async fn insert_cast_vote(
 
     Ok(Json(inserted_cast_vote))
 }
+
+/// Whether a missing `auth_time` claim may fall back to `iat` for the
+/// given voting channel.
+///
+/// Always allowed for `TELEPHONE`: that channel already has no
+/// browser-derived `auth_time` to rely on. `ONLINE` real voters always go
+/// through a browser and get a genuine `auth_time` for free — Keycloak
+/// only ever sets the `AUTH_TIME` session note on the `authorization_code`
+/// flow, never on `grant_type=password` — so requiring it there doubles
+/// as an implicit "this came from a browser" check. This fallback is an
+/// explicit, env-gated escape hatch from that for non-browser tooling
+/// (e.g. `headless-load-test`'s password-grant voter login,
+/// `packages/headless-load-test/src/vote/cast.rs`) against environments
+/// that opt in via `HARVEST_ALLOW_ONLINE_AUTH_TIME_IAT_FALLBACK=true` —
+/// unset (the default) preserves the strict, browser-only requirement, and
+/// no real deployment's config sets it.
+fn auth_time_iat_fallback_allowed(voting_channel: VotingStatusChannel) -> bool {
+    match voting_channel {
+        VotingStatusChannel::TELEPHONE => true,
+        VotingStatusChannel::ONLINE => {
+            std::env::var("HARVEST_ALLOW_ONLINE_AUTH_TIME_IAT_FALLBACK")
+                .map(|value| value == "true")
+                .unwrap_or(false)
+        }
+        VotingStatusChannel::KIOSK | VotingStatusChannel::EARLY_VOTING => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const ENV_VAR: &str = "HARVEST_ALLOW_ONLINE_AUTH_TIME_IAT_FALLBACK";
+
+    // One test, run sequentially, so concurrent `cargo test` threads don't
+    // race on this shared process-global env var.
+    #[test]
+    fn auth_time_iat_fallback_is_gated_per_channel_and_env_var() {
+        std::env::remove_var(ENV_VAR);
+        assert!(auth_time_iat_fallback_allowed(VotingStatusChannel::TELEPHONE));
+        assert!(!auth_time_iat_fallback_allowed(VotingStatusChannel::ONLINE));
+        assert!(!auth_time_iat_fallback_allowed(VotingStatusChannel::KIOSK));
+        assert!(!auth_time_iat_fallback_allowed(
+            VotingStatusChannel::EARLY_VOTING
+        ));
+
+        std::env::set_var(ENV_VAR, "true");
+        assert!(auth_time_iat_fallback_allowed(VotingStatusChannel::ONLINE));
+        assert!(auth_time_iat_fallback_allowed(VotingStatusChannel::TELEPHONE));
+
+        std::env::set_var(ENV_VAR, "false");
+        assert!(!auth_time_iat_fallback_allowed(VotingStatusChannel::ONLINE));
+
+        std::env::remove_var(ENV_VAR);
+    }
+}

packages/headless-load-test/Cargo.toml

@@ -0,0 +1,27 @@
+# SPDX-FileCopyrightText: 2026 Sequent Tech Inc <legal@sequentech.io>
+#
+# SPDX-License-Identifier: AGPL-3.0-only
+
+[package]
+name = "headless-load-test"
+version = "0.1.0"
+edition = "2021"
+default-run = "headless-load-test"
+
+[dependencies]
+anyhow = { workspace = true }
+clap = { version = "4.5", features = ["derive", "env"] }
+serde = { workspace = true }
+serde_json = { workspace = true }
+serde_yaml = "0.9"
+reqwest = { version = "0.12", features = ["json"] }
+graphql_client = "0.14"
+tokio = { workspace = true }
+uuid = { version = "1.5", features = ["v4", "fast-rng"] }
+sequent-core = { path = "../sequent-core", features = ["default_features"] }
+strand = { path = "../strand" }
+csv = "1.1"
+
+[[bin]]
+name = "headless-load-test"
+path = "src/main.rs"