From 2330ad80376ea630b40506f0f78cbe111c6d86f6 Mon Sep 17 00:00:00 2001 From: sneak Date: Thu, 15 Oct 2026 10:39:12 +0000 Subject: [PATCH] Keep the metrics entry at the top of Completed Steps The rebase onto next placed the entry for this change below the one next gained meanwhile; the TODO.md workflow puts a finished step at the top. Model: opus-5-5 --- TODO.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/TODO.md b/TODO.md index 700a6b0..dd2d75e 100644 --- a/TODO.md +++ b/TODO.md @@ -51,6 +51,15 @@ P2: security: per-origin rate limiting not in the cache is made from the cached source when there is one. `README.md` says so under `/v1/image/`. A refusal from the negative cache now counts as a miss, as any other request that misses the variant cache does. +- 2026-10-15 the request metrics are labelled by route, not by path (closes + #254): their `handler` label was each request's path, so every new path, a 404 + or an encrypted URL, added series to the Prometheus registry that were never + removed, and `/metrics` listed every encrypted URL's token. The label is now + the pattern of the chi route the request matches, such as `/v1/image/*`, or + `unmatched` for a request that matches none: one the router answers 404 or + 405, or a CORS preflight. The metrics library takes the label before the + request is routed, so the metrics middleware asks the router which route + matches. - 2026-10-15 the host of a `/v1/image/` URL is lower-cased, and one with a port needs a signature (closes #246): with `cdn.example.com` allowlisted, `CDN.Example.com` and `cdn.example.com:8443` passed the allowlist too, and @@ -62,15 +71,6 @@ P2: security: per-origin rate limiting not in `allowlist.IsAllowed`, which also matches `referer_blocklist`, where a `Referer` is blocked whatever its port. A URL is signed over its host as it writes it, in lower case, with any IPv6 brackets, `:` and port kept. -- 2026-10-15 the request metrics are labelled by route, not by path (closes - #254): their `handler` label was each request's path, so every new path, a 404 - or an encrypted URL, added series to the Prometheus registry that were never - removed, and `/metrics` listed every encrypted URL's token. The label is now - the pattern of the chi route the request matches, such as `/v1/image/*`, or - `unmatched` for a request that matches none: one the router answers 404 or - 405, or a CORS preflight. The metrics library takes the label before the - request is routed, so the metrics middleware asks the router which route - matches. - 2026-10-15 a `:` in the source path or query no longer moves where the path ends and the query begins (closes #247): the signed data and the cache key joined host, path and query with `:` and no escaping, so a URL signed for