Bound the /metrics method label (closes #261)

internal/middleware/metrics_test.go

@@ -97,20 +97,24 @@ func metricsTestRouter(
 	return r, reg
 }
 
-// drivePaths sends one POST per supplied path and returns how many
-// responses carried each status code.
-func drivePaths(
-	t *testing.T,
-	h http.Handler,
-	paths []string,
-) map[int]int {
+// probe is one request a cardinality assertion sends. Both label
+// dimensions that have leaked are request-controlled — the path and
+// the method — so both vary here and one driver sends them.
+type probe struct {
+	method string
+	path   string
+}
+
+// drive sends every probe and returns how many responses carried each
+// status code.
+func drive(t *testing.T, h http.Handler, probes []probe) map[int]int {
 	t.Helper()
 
 	codes := make(map[int]int)
 
-	for _, p := range paths {
+	for _, p := range probes {
 		req := httptest.NewRequestWithContext(
-			t.Context(), http.MethodPost, p, nil,
+			t.Context(), p.method, p.path, nil,
 		)
 		w := httptest.NewRecorder()
 		h.ServeHTTP(w, req)
@@ -120,6 +124,25 @@ func drivePaths(
 	return codes
 }
 
+// drivePaths sends one POST per supplied path.
+func drivePaths(
+	t *testing.T,
+	h http.Handler,
+	paths []string,
+) map[int]int {
+	t.Helper()
+
+	probes := make([]probe, 0, len(paths))
+
+	for _, p := range paths {
+		probes = append(
+			probes, probe{method: http.MethodPost, path: p},
+		)
+	}
+
+	return drive(t, h, probes)
+}
+
 // receiverPaths returns n distinct /webhook/ paths, each naming a
 // fresh UUID exactly as an unauthenticated flood would.
 func receiverPaths(n int) []string {