Custom actuator metric with request counter (#836)

* bump version to 1.20.0 (metrics are a new feature)

* expose actuator metrics endpoint, but only enable http.server.requests metrics

  this only works after the configuration changes from #906

* add ActuatorConfig to customize the http.server.requests metric (so it shows all individual resource endpoints instead of grouping them by pattern)
  
  Here we override the DefaultServerRequestObservationConvention instead of subclassing the ObservationFilter
  Based on advise by micrometer devs.

* add TestMetrics class with metrics filter check
* test values of http.url tag

* test that endpoint visits are counted

* require authorization for actuator metrics endpoints

* test unauthenticated access to actuator metrics

* accept header not necessary for metrics auth test

* test auth for metric uri instead of metric list uri, so we can be sure the authentication requirement also applies to sub-paths of /actuator/metrics

Author: dennisvang

SECURITY.md

@@ -7,8 +7,8 @@ For older versions, we highly recommend upgrading to the latest version.
 
 | Version | Supported          |
 |---------| ------------------ |
-| 1.19.x  | :white_check_mark: |
-| < 1.19  | :x:                |
+| 1.20.x  | :white_check_mark: |
+| < 1.20  | :x:                |
 
 ## Current Recommendations
 

pom.xml

@@ -10,7 +10,7 @@
     </parent>
     <groupId>org.fairdatateam</groupId>
     <artifactId>fairdatapoint</artifactId>
-    <version>1.19.1</version>
+    <version>1.20.0</version>
     <packaging>jar</packaging>
 
     <name>FairDataPoint</name>

src/main/java/org/fairdatateam/fairdatapoint/config/ActuatorConfig.java

@@ -0,0 +1,55 @@
+/**
+ * The MIT License
+ * Copyright © 2017 FAIR Data Team
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+package org.fairdatateam.fairdatapoint.config;
+
+import io.micrometer.common.KeyValue;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.server.observation.DefaultServerRequestObservationConvention;
+import org.springframework.http.server.observation.ServerRequestObservationContext;
+
+@Configuration
+public class ActuatorConfig {
+
+    /**
+     * Replaces the default `uri` path-pattern values with full paths in actuator metrics http.server.requests
+     */
+    @Bean
+    DefaultServerRequestObservationConvention customServerRequestObservationConvention() {
+        return new DefaultServerRequestObservationConvention() {
+            /**
+             * Replace the default URI path pattern (e.g. `/catalog/{id}`) with the full URI path (e.g. `/catalog/123`).
+             * This is high-cardinality data, but we add it as low-cardinality to make sure it shows up in the metrics.
+             * Beware, this could lead to memory issues in case of excessive number of URIs.
+             * See micrometer docs for more info.
+             * @param context ServerRequestObservationContext
+             * @return KeyValue with full uri
+             */
+            @Override
+            protected KeyValue uri(ServerRequestObservationContext context) {
+                // note the resulting tag name is "http.url" instead of "uri"
+                return super.httpUrl(context);
+            }
+        };
+    }
+}

src/main/java/org/fairdatateam/fairdatapoint/config/SecurityConfig.java

@@ -23,6 +23,7 @@
 package org.fairdatateam.fairdatapoint.config;
 
 import org.fairdatateam.fairdatapoint.api.filter.FilterConfigurer;
+import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
@@ -62,6 +63,7 @@ public SecurityFilterChain filterChain(HttpSecurity http, FilterConfigurer filte
                                     .requestMatchers("/index/admin**").authenticated()
                                     .requestMatchers("/index**").permitAll()
                                     .requestMatchers(HttpMethod.PUT).authenticated()
+                                    .requestMatchers(EndpointRequest.to("metrics")).authenticated()
                                     .anyRequest().permitAll();
                         }
                 )

src/main/resources/application.yml

@@ -26,16 +26,18 @@ spring:
       thread-name-prefix: fdp-task-
 
 management:
-  health:
-    solr:
-      enabled:  false
   info:
     defaults:
       enabled: false
   endpoints:
     web:
       exposure:
-        include: health, info
+        include: health, info, metrics
+  metrics:
+    enable:
+      all: false
+      http.server.requests: true
+      http.server.requests.active: false
 
 security:
   jwt:
@@ -67,7 +69,7 @@ metadataProperties:
 
 openapi:
   title: FAIR Data Point API
-  version: 1.19.1
+  version: 1.20.0
   description: "The reference implementation of the metadata registration service: A service implementing the API specification. It contains an authentication system to allow maintainers to define and update metadata. Read-only access to the data is public."
   contact:
     name: Luiz Bonino

src/test/java/org/fairdatateam/fairdatapoint/acceptance/actuator/MetricsTest.java

@@ -0,0 +1,148 @@
+/**
+ * The MIT License
+ * Copyright © 2017 FAIR Data Team
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+package org.fairdatateam.fairdatapoint.acceptance.actuator;
+
+import io.micrometer.core.instrument.MeterRegistry;
+import org.fairdatateam.fairdatapoint.Profiles;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.security.test.context.support.WithAnonymousUser;
+import org.springframework.security.test.context.support.WithMockUser;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.web.servlet.assertj.MockMvcTester;
+import org.springframework.test.web.servlet.assertj.MvcTestResult;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import java.net.URI;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+@ActiveProfiles(Profiles.TESTING)
+@AutoConfigureMockMvc
+@SpringBootTest
+@WithMockUser
+class MetricsTest {
+
+    final String metricName = "http.server.requests";
+    final UriComponentsBuilder metricsUriBuilder = UriComponentsBuilder.fromPath("/actuator/metrics");
+    final String tagName = "http.url";
+    final String uriVisited = "/meta";
+
+    private final MeterRegistry meterRegistry;
+
+    // https://docs.spring.io/spring-framework/reference/testing/mockmvc/assertj.html
+    private final MockMvcTester mockMvc;
+
+    /**
+     * Constructor
+     */
+    @Autowired
+    MetricsTest(MeterRegistry meterRegistry, MockMvcTester mockMvc) {
+        this.meterRegistry = meterRegistry;
+        this.mockMvc = mockMvc;
+    }
+
+    @BeforeEach
+    void clearMeterRegistry() {
+        // clear all metrics
+        meterRegistry.clear();
+    }
+
+    @Test
+    @WithAnonymousUser
+    void onlyAuthenticatedUsersCanAccessMetrics() {
+        MvcTestResult testResult = mockMvc.get()
+                .uri(metricsUriBuilder.pathSegment(metricName).build().toUri())
+                .exchange();
+        // todo: should actually be 401 UNAUTHORIZED (see #704)
+        assertThat(testResult).hasStatus(HttpStatus.FORBIDDEN);
+    }
+
+    @Test
+    void onlyExposesHttpServerRequestsMetric() {
+        // visit some endpoint to initialize the "http.server.requests" metric
+        mockMvc.get().uri(uriVisited).exchange();
+        // get metrics list
+        MvcTestResult testResult = mockMvc.get()
+                .uri(metricsUriBuilder.build().toUri())
+                .accept(MediaType.APPLICATION_JSON)
+                .exchange();
+        // results should only include the "http.server.requests" (this only appears if endpoints have been visited)
+        assertThat(testResult)
+                .hasStatusOk()
+                .hasContentTypeCompatibleWith(MediaType.APPLICATION_JSON)
+                .bodyJson()
+                .extractingPath("$.names")
+                .asArray()
+                .containsExactly(metricName);
+    }
+
+    @Test
+    void listsVisitedEndpointUris() {
+        // visit some endpoint to initialize the "http.server.requests" metric
+        mockMvc.get().uri(uriVisited).exchange();
+        // get the available metrics for "http.server.requests"
+        MvcTestResult testResult = mockMvc.get()
+                .uri(metricsUriBuilder.pathSegment(metricName).build().toUri())
+                .accept(MediaType.APPLICATION_JSON)
+                .exchange();
+        // the visited endpoint should be included in the available tag values for "http.url"
+        assertThat(testResult).hasStatusOk().hasContentTypeCompatibleWith(MediaType.APPLICATION_JSON);
+        assertThat(testResult).bodyJson().extractingPath("$.name").isEqualTo(metricName);
+        assertThat(testResult).bodyJson().extractingPath("$.availableTags").asArray()
+                .filteredOn("tag", tagName)
+                .flatExtracting("values")
+                .contains(uriVisited);
+    }
+
+    @Test
+    void endpointVisitsAreCounted() {
+        // visit some endpoint a number of times
+        final int visitCount = 3;
+        for (int i = 0; i < visitCount; i++) {
+            mockMvc.get().uri(uriVisited).exchange();
+        }
+        // get the available metrics for this endpoint
+        URI endpointMetricsUri = metricsUriBuilder
+                .pathSegment(metricName)
+                .queryParam("tag", "%s:%s".formatted(tagName, uriVisited))
+                .build().toUri();
+        MvcTestResult testResult = mockMvc.get()
+                .uri(endpointMetricsUri)
+                .accept(MediaType.APPLICATION_JSON)
+                .exchange();
+        // the COUNT statistic value for this endpoint should match the actual number of visits
+        assertThat(testResult).hasStatusOk().hasContentTypeCompatibleWith(MediaType.APPLICATION_JSON);
+        assertThat(testResult).bodyJson().extractingPath("$.name").isEqualTo(metricName);
+        assertThat(testResult).bodyJson().extractingPath("$.measurements").asArray()
+                .filteredOn("statistic", "COUNT")
+                .extracting("value")
+                .contains((double) visitCount);
+    }
+}