test: restore audit-failure log coverage, prune stale /metrics asserts

Author: raisedadead

internal/handler/audit_test.go

@@ -3,6 +3,7 @@ package handler
 import (
 	"context"
 	"errors"
+	"log/slog"
 	"testing"
 
 	"github.com/freeCodeCamp/artemis/internal/pg"
@@ -36,10 +37,13 @@ func TestAudit_RecordsEvent(t *testing.T) {
 }
 
 func TestAudit_FireAndLogOnFailure(t *testing.T) {
+	logs := captureAccessLog(t)
 	h := &Handlers{Audit: &fakeAudit{err: errors.New("db down")}}
 	require.NotPanics(t, func() {
 		h.audit(context.Background(), pg.AuditEvent{Action: "site.delete", Actor: "alice", Outcome: "success"})
 	})
+	assert.Equal(t, slog.LevelError, logs.levelOf(t, "audit.write.failed"),
+		"a failed audit write must surface as an error log (never fails the response)")
 }
 
 func TestAudit_DetachedFromRequestCancellation(t *testing.T) {

internal/handler/middleware.go

@@ -199,10 +199,6 @@ func Recoverer(next http.Handler) http.Handler {
 	})
 }
 
-// accessLogSkipPaths are request URIs that bypass AccessLog. Health
-// + readiness + metrics probes from k8s arrive every few seconds
-// and flood the log without operator value; status codes feed the
-// regular probe-result counters instead.
 var accessLogSkipPaths = map[string]struct{}{
 	"/healthz": {},
 	"/readyz":  {},

internal/integration/public_block_test.go

@@ -9,11 +9,6 @@ import (
 	"time"
 )
 
-// TestPublicRouteBlock asserts that the public Gateway HTTPRoute
-// rewrites /metrics + /readyz to /_artemis_blocked_path so external
-// callers see chi's catch-all 404 instead of operator-only payloads.
-// /healthz stays public for external liveness checks.
-//
 // The Gateway URLRewrite is configured in
 // k3s/gxy-management/apps/artemis/charts/artemis/templates/httproute.yaml.
 func TestPublicRouteBlock(t *testing.T) {
@@ -28,13 +23,6 @@ func TestPublicRouteBlock(t *testing.T) {
 		}
 	})
 
-	t.Run("metrics_returns_404", func(t *testing.T) {
-		status, body := c.statusOnly(ctx, http.MethodGet, "/metrics", "", nil)
-		if status != 404 {
-			t.Fatalf("public /metrics: status=%d body=%s — want 404 (Gateway URLRewrite to /_artemis_blocked_path)", status, truncate(body, 200))
-		}
-	})
-
 	t.Run("healthz_stays_public_200", func(t *testing.T) {
 		status, body := c.statusOnly(ctx, http.MethodGet, "/healthz", "", nil)
 		if status != 200 {