Custom actuator metric with request counter (experimental)

SECURITY.md

@@ -7,8 +7,8 @@ For older versions, we highly recommend upgrading to the latest version.
 
 | Version | Supported          |
 |---------| ------------------ |
-| 1.19.x  | :white_check_mark: |
-| < 1.19  | :x:                |
+| 1.20.x  | :white_check_mark: |
+| < 1.20  | :x:                |
 
 ## Current Recommendations
 

pom.xml

@@ -10,7 +10,7 @@
     </parent>
     <groupId>org.fairdatateam</groupId>
     <artifactId>fairdatapoint</artifactId>
-    <version>1.19.1</version>
+    <version>1.20.0</version>
     <packaging>jar</packaging>
 
     <name>FairDataPoint</name>

src/main/java/org/fairdatateam/fairdatapoint/config/ActuatorConfig.java

@@ -0,0 +1,55 @@
+/**
+ * The MIT License
+ * Copyright © 2017 FAIR Data Team
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+package org.fairdatateam.fairdatapoint.config;
+
+import io.micrometer.common.KeyValue;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.http.server.observation.DefaultServerRequestObservationConvention;
+import org.springframework.http.server.observation.ServerRequestObservationContext;
+
+@Configuration
+public class ActuatorConfig {
+
+    /**
+     * Replaces the default `uri` path-pattern values with full paths in actuator metrics http.server.requests
+     */
+    @Bean
+    DefaultServerRequestObservationConvention customServerRequestObservationConvention() {
+        return new DefaultServerRequestObservationConvention() {
+            /**
+             * Replace the default URI path pattern (e.g. `/catalog/{id}`) with the full URI path (e.g. `/catalog/123`).
+             * This is high-cardinality data, but we add it as low-cardinality to make sure it shows up in the metrics.
+             * Beware, this could lead to memory issues in case of excessive number of URIs.
+             * See micrometer docs for more info.
+             * @param context ServerRequestObservationContext
+             * @return KeyValue with full uri
+             */
+            @Override
+            protected KeyValue uri(ServerRequestObservationContext context) {
+                // note the resulting tag name is "http.url" instead of "uri"
+                return super.httpUrl(context);
+            }
+        };
+    }
+}

src/main/java/org/fairdatateam/fairdatapoint/config/SecurityConfig.java

@@ -23,6 +23,7 @@
 package org.fairdatateam.fairdatapoint.config;
 
 import org.fairdatateam.fairdatapoint.api.filter.FilterConfigurer;
+import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
@@ -62,6 +63,7 @@ public SecurityFilterChain filterChain(HttpSecurity http, FilterConfigurer filte
                                     .requestMatchers("/index/admin**").authenticated()
                                     .requestMatchers("/index**").permitAll()
                                     .requestMatchers(HttpMethod.PUT).authenticated()
+                                    .requestMatchers(EndpointRequest.to("metrics")).authenticated()
                                     .anyRequest().permitAll();
                         }
                 )

src/main/resources/application.yml

@@ -26,16 +26,18 @@ spring:
       thread-name-prefix: fdp-task-
 
 management:
-  health:
-    solr:
-      enabled:  false
   info:
     defaults:
       enabled: false
   endpoints:
     web:
       exposure:
-        include: health, info
+        include: health, info, metrics
+  metrics:
+    enable:
+      all: false
+      http.server.requests: true
+      http.server.requests.active: false
 
 security:
   jwt:
@@ -67,7 +69,7 @@ metadataProperties:
 
 openapi:
   title: FAIR Data Point API
-  version: 1.19.1
+  version: 1.20.0
   description: "The reference implementation of the metadata registration service: A service implementing the API specification. It contains an authentication system to allow maintainers to define and update metadata. Read-only access to the data is public."
   contact:
     name: Luiz Bonino

src/test/java/org/fairdatateam/fairdatapoint/acceptance/actuator/MetricsTest.java

@@ -0,0 +1,148 @@
+/**
+ * The MIT License
+ * Copyright © 2017 FAIR Data Team
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+package org.fairdatateam.fairdatapoint.acceptance.actuator;
+
+import io.micrometer.core.instrument.MeterRegistry;
+import org.fairdatateam.fairdatapoint.Profiles;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.security.test.context.support.WithAnonymousUser;
+import org.springframework.security.test.context.support.WithMockUser;
+import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.web.servlet.assertj.MockMvcTester;
+import org.springframework.test.web.servlet.assertj.MvcTestResult;
+import org.springframework.web.util.UriComponentsBuilder;
+
+import java.net.URI;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+
+@ActiveProfiles(Profiles.TESTING)
+@AutoConfigureMockMvc
+@SpringBootTest
+@WithMockUser
+class MetricsTest {
+
+    final String metricName = "http.server.requests";
+    final UriComponentsBuilder metricsUriBuilder = UriComponentsBuilder.fromPath("/actuator/metrics");
+    final String tagName = "http.url";
+    final String uriVisited = "/meta";
+
+    private final MeterRegistry meterRegistry;
+
+    // https://docs.spring.io/spring-framework/reference/testing/mockmvc/assertj.html
+    private final MockMvcTester mockMvc;
+
+    /**
+     * Constructor
+     */
+    @Autowired
+    MetricsTest(MeterRegistry meterRegistry, MockMvcTester mockMvc) {
+        this.meterRegistry = meterRegistry;
+        this.mockMvc = mockMvc;
+    }
+
+    @BeforeEach
+    void clearMeterRegistry() {
+        // clear all metrics
+        meterRegistry.clear();
+    }
+
+    @Test
+    @WithAnonymousUser
+    void onlyAuthenticatedUsersCanAccessMetrics() {
+        MvcTestResult testResult = mockMvc.get()
+                .uri(metricsUriBuilder.pathSegment(metricName).build().toUri())
+                .exchange();
+        // todo: should actually be 401 UNAUTHORIZED (see #704)
+        assertThat(testResult).hasStatus(HttpStatus.FORBIDDEN);
+    }
+
+    @Test
+    void onlyExposesHttpServerRequestsMetric() {
+        // visit some endpoint to initialize the "http.server.requests" metric
+        mockMvc.get().uri(uriVisited).exchange();
+        // get metrics list
+        MvcTestResult testResult = mockMvc.get()
+                .uri(metricsUriBuilder.build().toUri())
+                .accept(MediaType.APPLICATION_JSON)
+                .exchange();
+        // results should only include the "http.server.requests" (this only appears if endpoints have been visited)
+        assertThat(testResult)
+                .hasStatusOk()
+                .hasContentTypeCompatibleWith(MediaType.APPLICATION_JSON)
+                .bodyJson()
+                .extractingPath("$.names")
+                .asArray()
+                .containsExactly(metricName);
+    }
+
+    @Test
+    void listsVisitedEndpointUris() {
+        // visit some endpoint to initialize the "http.server.requests" metric
+        mockMvc.get().uri(uriVisited).exchange();
+        // get the available metrics for "http.server.requests"
+        MvcTestResult testResult = mockMvc.get()
+                .uri(metricsUriBuilder.pathSegment(metricName).build().toUri())
+                .accept(MediaType.APPLICATION_JSON)
+                .exchange();
+        // the visited endpoint should be included in the available tag values for "http.url"
+        assertThat(testResult).hasStatusOk().hasContentTypeCompatibleWith(MediaType.APPLICATION_JSON);
+        assertThat(testResult).bodyJson().extractingPath("$.name").isEqualTo(metricName);
+        assertThat(testResult).bodyJson().extractingPath("$.availableTags").asArray()
+                .filteredOn("tag", tagName)
+                .flatExtracting("values")
+                .contains(uriVisited);
+    }
+
+    @Test
+    void endpointVisitsAreCounted() {
+        // visit some endpoint a number of times
+        final int visitCount = 3;
+        for (int i = 0; i < visitCount; i++) {
+            mockMvc.get().uri(uriVisited).exchange();
+        }
+        // get the available metrics for this endpoint
+        URI endpointMetricsUri = metricsUriBuilder
+                .pathSegment(metricName)
+                .queryParam("tag", "%s:%s".formatted(tagName, uriVisited))
+                .build().toUri();
+        MvcTestResult testResult = mockMvc.get()
+                .uri(endpointMetricsUri)
+                .accept(MediaType.APPLICATION_JSON)
+                .exchange();
+        // the COUNT statistic value for this endpoint should match the actual number of visits
+        assertThat(testResult).hasStatusOk().hasContentTypeCompatibleWith(MediaType.APPLICATION_JSON);
+        assertThat(testResult).bodyJson().extractingPath("$.name").isEqualTo(metricName);
+        assertThat(testResult).bodyJson().extractingPath("$.measurements").asArray()
+                .filteredOn("statistic", "COUNT")
+                .extracting("value")
+                .contains((double) visitCount);
+    }
+}