Serve /metrics from a registry of its own (closes #227)

The HTTP metrics recorder, the delivery collectors and the Go and
process collectors now register on one prometheus.Registry that fx
provides, instead of Prometheus's global default registry, and
/metrics serves that registry. A second metrics-enabled router in one
process, or the server tests run with -count=2, no longer panics on a
duplicate registration.

The middleware builds its recorder once, in New, so installing
Metrics() on more than one router over the same graph is also safe;
NewForTest gives its Middleware a recorder on a fresh registry. The
scrape keeps the same series and labels, including go_*, process_*
and promhttp_metric_handler_*.

Model: opus-5-5

README.md

@@ -2703,16 +2703,12 @@ abuse limit later; they are tracked as future work.
 
 | Method | Path            | Description |
 | ------ | --------------- | ----------- |
-| `GET`  | `/pages/login`  | Login page (not rate limited). Its `next` parameter names the page to return to after login; anything but a path on this site is replaced with `/` |
+| `GET`  | `/pages/login`  | Login page (not rate limited) |
-| `POST` | `/pages/login`  | Login form submission. On success, redirects to the form's `next` when it is a path on this site, otherwise to `/`. Credentials are verified before any limit is consulted, so a correct password is never throttled; 5 FAILED attempts per minute per bucket per submitted username, then `429`. `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one (see [Rate Limiting](#rate-limiting)) |
+| `POST` | `/pages/login`  | Login form submission. Credentials are verified before any limit is consulted, so a correct password is never throttled; 5 FAILED attempts per minute per bucket per submitted username, then `429`. `503` if no verification slot frees up within 5s, or immediately if 16 requests are already queued for one (see [Rate Limiting](#rate-limiting)) |
 | `POST` | `/pages/logout` | Logout (destroys session) |
 
 #### Authenticated Endpoints
 
-A logged-out `GET` of any of these is redirected to `/pages/login` with
-its path and query as `next` when they fit in 2048 bytes, so logging in
-returns to the page that was asked for.
-
 | Method | Path                     | Description |
 | ------ | ------------------------ | ----------- |
 | `GET`  | `/user/{username}`       | User profile page |
@@ -2887,13 +2883,15 @@ Components are wired via Uber fx in this order:
 7. `healthcheck.New` — Health check service
 8. `session.New` — Cookie-based session manager (key from database)
 9. `handlers.New` — HTTP handlers
-10. `middleware.New` — HTTP middleware
+10. `metrics.NewRegistry` — The registry `/metrics` serves
-11. `delivery.New` — Event-driven delivery engine
+11. `metrics.New` — The delivery collectors, registered on that registry
-12. `delivery.NewArchiveSweeper` — Periodic pruning of idle archives
+12. `middleware.New` — HTTP middleware
-13. `delivery.Engine` → `delivery.Notifier` — interface bridge
+13. `delivery.New` — Event-driven delivery engine
-14. `delivery.Engine` → `delivery.WebhookEvictor` — interface bridge so
+14. `delivery.NewArchiveSweeper` — Periodic pruning of idle archives
+15. `delivery.Engine` → `delivery.Notifier` — interface bridge
+16. `delivery.Engine` → `delivery.WebhookEvictor` — interface bridge so
     deleting a webhook releases its archive writer
-15. `server.New` — HTTP server and router
+17. `server.New` — HTTP server and router
 
 The server starts via `fx.Invoke(func(*server.Server, *delivery.Engine,
 *database.RetentionReaper, *delivery.ArchiveSweeper) {})`, which

TODO.md

@@ -387,7 +387,7 @@ point of the branch.
 - 2026-03-05 security headers middleware, session regeneration on
   login, request body size limits (#41)
 - 2026-03-04 tests for delivery, middleware, and session packages
-  (#32); removed the build-architecture global (#31)
+  (#32); removed globals.Buildarch (#31)
 - 2026-03-04 1.0 MVP merge: Webhook/Entrypoint/Target rename, core
   delivery engine with bounded worker pool and circuit breaker,
   parallel fan-out, per-webhook event databases, management UI (#16)

cmd/webhooker/main.go

@@ -16,6 +16,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/resetpw"
 	"sneak.berlin/go/webhooker/internal/server"
@@ -177,6 +178,10 @@ func newApp() *fx.App {
 			healthcheck.New,
 			session.New,
 			handlers.New,
+			// The registry /metrics serves, and the delivery
+			// collectors registered on it.
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			// The one SSRF guard both target-creation validation
 			// and the delivery dialer consult, so they cannot

internal/delivery/engine.go

@@ -148,6 +148,7 @@ type EngineParams struct {
 	DBManager *database.WebhookDBManager
 	Logger    *logger.Logger
 	SSRFGuard *Guard
+	Metrics   *metrics.Set
 }
 
 // Engine processes queued deliveries in the background
@@ -167,10 +168,10 @@ type Engine struct {
 	retryCh    chan Task
 	workers    int
 
-	// mtr is the delivery metric set. Production wires the
+	// mtr is the delivery metric set. Production wires the one
-	// process-wide one; a test can substitute a set registered on
+	// registered on the registry /metrics serves; a test can
-	// a private registry so its assertions are not disturbed by
+	// substitute a set registered on a registry it holds, so it can
-	// deliveries other tests are making at the same time.
+	// gather what its own deliveries recorded.
 	mtr *metrics.Set
 
 	// targets maps each target type to its implementation.
@@ -204,7 +205,7 @@ func New(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    defaultWorkers,
-		mtr:        metrics.Default(),
+		mtr:        params.Metrics,
 	}
 
 	e.initTargets(&http.Client{

internal/delivery/export_test.go

@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"go.uber.org/fx"
 	"gorm.io/gorm"
 	"sneak.berlin/go/webhooker/internal/database"
@@ -389,7 +390,7 @@ func NewTestEngine(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
-		mtr:        metrics.Default(),
+		mtr:        metrics.New(prometheus.NewRegistry()),
 	}
 	e.initTargets(client)
 
@@ -404,7 +405,7 @@ func NewTestEngineSmallRetry(
 	e := &Engine{
 		log:     log,
 		retryCh: make(chan Task, 1),
-		mtr:     metrics.Default(),
+		mtr:     metrics.New(prometheus.NewRegistry()),
 	}
 	e.initTargets(nil)
 
@@ -427,7 +428,7 @@ func NewTestEngineWithDB(
 		deliveryCh: make(chan Task, deliveryChannelSize),
 		retryCh:    make(chan Task, retryChannelSize),
 		workers:    workers,
-		mtr:        metrics.Default(),
+		mtr:        metrics.New(prometheus.NewRegistry()),
 	}
 	e.initTargets(client)
 
@@ -435,8 +436,7 @@ func NewTestEngineWithDB(
 }
 
 // ExportSetMetrics substitutes the engine's metric set, so a test can
-// assert on collectors registered on a private registry instead of
+// assert on collectors registered on a registry it holds.
-// the process-wide ones every other test is also moving.
 func (e *Engine) ExportSetMetrics(mtr *metrics.Set) {
 	e.mtr = mtr
 }

internal/delivery/metrics_test.go

@@ -35,9 +35,8 @@ const (
 )
 
 // mIsolate gives the setup's engine a metric set registered on a
-// private registry. The process-wide collectors are moved by every
+// registry this test holds, so its exact assertions can gather from
-// other delivery test running in parallel, so exact assertions are
+// it.
-// only possible against a registry this test owns.
 func mIsolate(
 	t *testing.T, s iSetup,
 ) *prometheus.Registry {

internal/handlers/auth.go

@@ -2,56 +2,19 @@ package handlers
 
 import (
 	"net/http"
-	"net/url"
 	"strconv"
-	"strings"
-	"unicode"
 
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/logfield"
-	"sneak.berlin/go/webhooker/internal/middleware"
 )
 
-// loginDestination returns where a successful login sends the
-// browser: next when it is a path on this site, otherwise "/", which
-// leads to the webhook list.
-//
-// A browser reads "//host" as another site, reads "\" as "/", and
-// drops tabs and newlines before reading at all. So the value must
-// start with exactly one "/" and hold no "\" or control character
-// anywhere: http.Redirect cleans "/a/../\host" down to "/\host". It
-// is checked after percent-decoding, so an encoded form of any of
-// these is refused too.
-func loginDestination(next string) string {
-	if len(next) > middleware.MaxNextBytes {
-		return "/"
-	}
-
-	decoded, err := url.PathUnescape(next)
-	if err != nil ||
-		!strings.HasPrefix(decoded, "/") ||
-		strings.HasPrefix(decoded, "//") ||
-		strings.Contains(decoded, `\`) ||
-		strings.ContainsFunc(decoded, unicode.IsControl) {
-		return "/"
-	}
-
-	return next
-}
-
 // HandleLoginPage returns a handler for the login page (GET)
 func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		next := loginDestination(
-			r.URL.Query().Get(middleware.NextParam),
-		)
-
 		// Check if already logged in
 		sess, err := h.session.Get(r)
 		if err == nil && h.session.IsAuthenticated(sess) {
-			http.Redirect( //nolint:gosec // checked by loginDestination
+			http.Redirect(w, r, "/", http.StatusSeeOther)
-				w, r, next, http.StatusSeeOther,
-			)
 
 			return
 		}
@@ -59,7 +22,6 @@ func (h *Handlers) HandleLoginPage() http.HandlerFunc {
 		// Render login page
 		data := map[string]any{
 			tmplKeyError: "",
-			tmplKeyNext:  next,
 		}
 
 		h.renderTemplate(w, r, "login.html", data)
@@ -115,13 +77,8 @@ func (h *Handlers) HandleLoginSubmit() http.HandlerFunc {
 			"user_id", user.ID,
 		)
 
-		// The form value is the client's to set, so it is checked
+		// Redirect to home page
-		// again here rather than trusted from the rendered page.
+		http.Redirect(w, r, "/", http.StatusSeeOther)
-		http.Redirect( //nolint:gosec // checked by loginDestination
-			w, r,
-			loginDestination(r.PostFormValue(middleware.NextParam)),
-			http.StatusSeeOther,
-		)
 	}
 }
 
@@ -134,9 +91,6 @@ func (h *Handlers) renderLoginError(
 ) {
 	data := map[string]any{
 		tmplKeyError: msg,
-		tmplKeyNext: loginDestination(
-			r.PostFormValue(middleware.NextParam),
-		),
 	}
 
 	w.WriteHeader(status)

internal/handlers/auth_test.go

@@ -454,159 +454,6 @@ func TestLogin_SuccessCreatesSession(t *testing.T) {
 	)
 }
 
-// TestLogin_ReturnsOnlyToAPathOnThisSite is the security half of
-// https://git.eeqj.de/sneak/webhooker/issues/384: the page a login
-// returns to is client-chosen, so anything that is not a path on this
-// site, plain or percent-encoded, must land on "/", the webhook list.
-func TestLogin_ReturnsOnlyToAPathOnThisSite(t *testing.T) {
-	t.Parallel()
-
-	var (
-		h  *handlers.Handlers
-		db *database.Database
-	)
-
-	app := newTestApp(t, &h, &db)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	seedOperator(t, db)
-
-	cases := []struct{ next, want string }{
-		{"/source/abc/logs?page=2", "/source/abc/logs?page=2"},
-		{"", "/"},
-		{"https://evil.example/", "/"},
-		{"https%3A%2F%2Fevil.example%2F", "/"},
-		{"//evil.example/", "/"},
-		{"%2F%2Fevil.example/", "/"},
-		{"/%2Fevil.example/", "/"},
-		{`/\evil.example/`, "/"},
-		{"%2F%5Cevil.example/", "/"},
-		{"/%5Cevil.example/", "/"},
-		{`/a/../\evil.example/`, "/"},
-		{"/\t/evil.example/", "/"},
-		{"/%09/evil.example/", "/"},
-		{"/\n/evil.example/", "/"},
-		{"/%0A/evil.example/", "/"},
-		{"/\r/evil.example/", "/"},
-		{"/%0D/evil.example/", "/"},
-		{"/%00/evil.example/", "/"},
-		{"/%7F/evil.example/", "/"},
-		{"%252F%252Fevil.example/", "/"},
-		{"https%253A%252F%252Fevil.example%252F", "/"},
-		{"/" + strings.Repeat("a", 4096), "/"},
-	}
-
-	for _, c := range cases {
-		form := url.Values{}
-		form.Set("username", operatorUser)
-		form.Set("password", operatorPassword)
-		form.Set("next", c.next)
-
-		req := httptest.NewRequestWithContext(
-			context.Background(),
-			http.MethodPost,
-			"/pages/login",
-			strings.NewReader(form.Encode()),
-		)
-		req.Header.Set(
-			"Content-Type", "application/x-www-form-urlencoded",
-		)
-		req.RemoteAddr = sharedProxyPeer
-
-		w := httptest.NewRecorder()
-		h.HandleLoginSubmit().ServeHTTP(w, req)
-
-		assert.Equal(t, http.StatusSeeOther, w.Code, "next %q", c.next)
-		assert.Equal(
-			t, c.want, w.Header().Get("Location"), "next %q", c.next,
-		)
-	}
-}
-
-// loginPageGet renders the login page as a GET with the given next
-// value and cookies.
-func loginPageGet(
-	h *handlers.Handlers, next string, cookies []*http.Cookie,
-) *httptest.ResponseRecorder {
-	req := httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet,
-		"/pages/login?"+url.Values{"next": {next}}.Encode(), nil,
-	)
-
-	for _, c := range cookies {
-		req.AddCookie(c)
-	}
-
-	w := httptest.NewRecorder()
-	h.HandleLoginPage().ServeHTTP(w, req)
-
-	return w
-}
-
-// TestLoginPage_CarriesOnlyAPathOnThisSite covers the login page
-// itself: its form carries the requested page only when it is a path
-// on this site, and a browser already logged in goes straight there,
-// or to "/" when it is not.
-func TestLoginPage_CarriesOnlyAPathOnThisSite(t *testing.T) {
-	t.Parallel()
-
-	var (
-		h    *handlers.Handlers
-		sess *session.Session
-	)
-
-	app := newTestApp(t, &h, &sess)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	assert.Contains(
-		t, loginPageGet(h, "/source/abc", nil).Body.String(),
-		`name="next" value="/source/abc"`,
-	)
-	assert.Contains(
-		t, loginPageGet(h, "//evil.example/", nil).Body.String(),
-		`name="next" value="/"`,
-	)
-
-	cookies := authenticatedCookies(t, sess, "test-user-id", "testuser")
-
-	cases := []struct{ next, want string }{
-		{"/source/abc", "/source/abc"},
-		{"//evil.example/", "/"},
-		{`/\evil.example/`, "/"},
-	}
-
-	for _, c := range cases {
-		w := loginPageGet(h, c.next, cookies)
-
-		assert.Equal(t, http.StatusSeeOther, w.Code, "next %q", c.next)
-		assert.Equal(
-			t, c.want, w.Header().Get("Location"), "next %q", c.next,
-		)
-	}
-}
-
-// TestLoginPage_HasNoLinkToItself: the navigation bar on the login
-// page offers no link to the login page.
-func TestLoginPage_HasNoLinkToItself(t *testing.T) {
-	t.Parallel()
-
-	var h *handlers.Handlers
-
-	app := newTestApp(t, &h)
-	app.RequireStart()
-
-	t.Cleanup(app.RequireStop)
-
-	w := loginPageGet(h, "", nil)
-
-	require.Equal(t, http.StatusOK, w.Code)
-	assert.NotContains(t, w.Body.String(), `href="/pages/login"`)
-}
-
 // TestLogin_UsernameAtLimitCanLogIn shows that a username of exactly
 // database.MaxUsernameBytes still fits in the session cookie. Past
 // what the cookie can carry, a correct login answers 500.

internal/handlers/handlers.go

@@ -12,6 +12,7 @@ import (
 	"net/http"
 	"sync/atomic"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/database"
 	"sneak.berlin/go/webhooker/internal/delivery"
@@ -36,9 +37,6 @@ const (
 	tmplKeyError = "Error"
 	// tmplKeyWebhook is the template data key for a webhook.
 	tmplKeyWebhook = "Webhook"
-	// tmplKeyNext is the template data key for the page to return
-	// to after login.
-	tmplKeyNext = "Next"
 )
 
 // errInvalidPassword is returned when a password does not match.
@@ -64,6 +62,8 @@ type HandlersParams struct {
 	Notifier     delivery.Notifier
 	Evictor      delivery.WebhookEvictor
 	SSRFGuard    *delivery.Guard
+	Metrics      *metrics.Set
+	Registry     *prometheus.Registry
 }
 
 // Handlers provides HTTP handler methods for all application
@@ -125,7 +125,7 @@ func New(
 	s.mw = params.Middleware
 	s.notifier = params.Notifier
 	s.evictor = params.Evictor
-	s.mtr = metrics.Default()
+	s.mtr = params.Metrics
 	s.ssrf = params.SSRFGuard
 
 	// Parse all page templates once at startup

internal/handlers/handlers_test.go

@@ -20,6 +20,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/session"
 )
@@ -109,6 +110,8 @@ func newTestApp(
 			func(r *recordingEvictor) delivery.WebhookEvictor {
 				return r
 			},
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			delivery.NewGuard,
 			handlers.New,

internal/handlers/metrics.go

@@ -0,0 +1,21 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+)
+
+// HandleMetrics returns the Prometheus scrape handler for the
+// registry built by metrics.NewRegistry, which the HTTP, delivery, Go
+// runtime and process collectors register on. It is what
+// promhttp.Handler builds for the global default registry, including
+// the promhttp_metric_handler_* series that count scrapes, pointed at
+// that registry instead.
+func (s *Handlers) HandleMetrics() http.HandlerFunc {
+	reg := s.params.Registry
+
+	return promhttp.InstrumentMetricHandler(
+		reg, promhttp.HandlerFor(reg, promhttp.HandlerOpts{}),
+	).ServeHTTP
+}

internal/handlers/profile_test.go

@@ -160,10 +160,7 @@ func TestUserRoute_Unauthenticated_RedirectedByMiddleware(t *testing.T) {
 		"handler must not be reached for unauthenticated request",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
+	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
-		t, "/pages/login?next=%2Fuser%2Ftestuser",
-		w.Header().Get("Location"),
-	)
 }
 
 // passwordChangeRequest builds a POST request to the password-change

internal/metrics/metrics.go

@@ -3,17 +3,18 @@
 // deliveries are attempted, how they end, how long they take, how
 // deep the queues are, and how many circuit breakers are open.
 //
-// The inbound HTTP metrics come from the go-http-metrics recorder in
+// It also builds the registry the authenticated /metrics route
-// internal/middleware and land on prometheus.DefaultRegisterer. These
+// serves. In production, these collectors, the inbound HTTP metrics
-// collectors register there too, so both surfaces are gathered by the
+// recorded in internal/middleware, and the Go runtime and process
-// one promhttp handler mounted on the authenticated /metrics route.
+// collectors all register on that one registry, never on Prometheus's
+// global default.
 package metrics
 
 import (
-	"sync"
 	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/collectors"
 	"github.com/prometheus/client_golang/prometheus/promauto"
 	"sneak.berlin/go/webhooker/internal/database"
 )
@@ -57,25 +58,31 @@ var knownTargetTypes = []database.TargetType{
 	database.TargetTypeSlack,
 }
 
-// defaultSet is the process-wide metric set, registered on the same
+// NewRegistry returns the registry /metrics serves, carrying the Go
-// registry the HTTP middleware and the /metrics handler already use.
+// runtime and process collectors that Prometheus's global default
-// It is built on first use rather than in an init so that a test
+// registry carries, so the go_* and process_* series stay in the
-// binary that never touches metrics never registers them.
+// scrape.
 //
-//nolint:gochecknoglobals // one process-wide registration, by design
+// A registry of its own, rather than the global default, is what lets
-var defaultSet = sync.OnceValue(func() *Set {
+// two dependency graphs in one process — two tests, say — each
-	return New(prometheus.DefaultRegisterer)
+// register their collectors without the second registration
-})
+// panicking.
+func NewRegistry() *prometheus.Registry {
+	reg := prometheus.NewRegistry()
+	reg.MustRegister(
+		collectors.NewGoCollector(),
+		collectors.NewProcessCollector(
+			collectors.ProcessCollectorOpts{},
+		),
+	)
 
-// Default returns the process-wide metric set.
+	return reg
-func Default() *Set {
-	return defaultSet()
 }
 
 // Set is one registered group of webhooker's delivery collectors.
-// Production uses the single Default set; tests build their own
+// Production builds one on the registry /metrics serves; tests build
-// against a private registry so assertions are not disturbed by
+// one on a registry of their own so they can gather what their own
-// deliveries other tests are making concurrently.
+// deliveries recorded.
 type Set struct {
 	eventsReceived      prometheus.Counter
 	deliveryAttempts    *prometheus.CounterVec
@@ -93,7 +100,7 @@ type Set struct {
 // New registers a full set of delivery collectors on reg and returns
 // it. It panics if reg already holds them, which is the intended
 // behaviour for a duplicate registration.
-func New(reg prometheus.Registerer) *Set {
+func New(reg *prometheus.Registry) *Set {
 	factory := promauto.With(reg)
 
 	s := &Set{

internal/middleware/export_test.go

@@ -10,8 +10,7 @@ import (
 
 // MetricsMiddlewareForTest builds the metrics recording middleware
 // against a caller-supplied recorder, so a test can gather from its
-// own Prometheus registry rather than the process-wide default one
+// own Prometheus registry without building a whole Middleware.
-// that Middleware.Metrics uses.
 func MetricsMiddlewareForTest(
 	rec httpmetrics.Recorder,
 ) func(http.Handler) http.Handler {

internal/middleware/metrics.go

@@ -7,7 +7,6 @@ import (
 
 	"github.com/go-chi/chi"
 	httpmetrics "github.com/slok/go-http-metrics/metrics"
-	prommetrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	ghmm "github.com/slok/go-http-metrics/middleware"
 	"github.com/slok/go-http-metrics/middleware/std"
 )
@@ -151,17 +150,17 @@ func (r boundedLabelRecorder) AddInflightRequests(
 
 var _ httpmetrics.Recorder = boundedLabelRecorder{}
 
-// Metrics returns middleware that records Prometheus HTTP metrics on
+// Metrics returns middleware that records Prometheus HTTP metrics
-// the default registry, which is the one the /metrics route gathers.
+// with the Middleware's one recorder, which New builds on the registry
+// the /metrics route serves and NewForTest on a registry of its own.
+// Every call reuses that recorder, so any number of routers can
+// install it.
 func (s *Middleware) Metrics() func(http.Handler) http.Handler {
-	return metricsMiddleware(
+	return metricsMiddleware(s.metricsRecorder)
-		prommetrics.NewRecorder(prommetrics.Config{}),
-	)
 }
 
 // metricsMiddleware builds the recording middleware against a given
-// recorder, so tests can gather from a registry of their own instead
+// recorder, so tests can gather from a registry of their own.
-// of the process-wide default.
 func metricsMiddleware(
 	rec httpmetrics.Recorder,
 ) func(http.Handler) http.Handler {

internal/middleware/metrics_test.go

@@ -57,9 +57,8 @@ const (
 // Server.setupWebhookRoutes inside it. That ordering is the whole
 // defect, so a test that flattens it would prove nothing.
 //
-// The recorder writes to a registry of the test's own rather than the
+// The recorder writes to a registry of the test's own, so each test
-// process-wide default one, so each test observes only its own
+// observes only its own traffic.
-// traffic.
 func metricsTestRouter(
 	t *testing.T,
 	receiverLimit int,
@@ -455,3 +454,29 @@ func TestMetrics_StatusAndSizeStillRecorded(t *testing.T) {
 		"the interceptor must still count written bytes",
 	)
 }
+
+// TestMetrics_WorksOnNewForTestMiddleware pins that a Middleware built
+// by NewForTest has a recorder of its own: its Metrics() serves a
+// request instead of panicking, and a second one does not collide
+// with the first.
+func TestMetrics_WorksOnNewForTestMiddleware(t *testing.T) {
+	t.Parallel()
+
+	log := slog.New(slog.DiscardHandler)
+	cfg := &config.Config{Environment: "prod"}
+	ok := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(okBody))
+	})
+
+	for range 2 {
+		h := middleware.NewForTest(log, cfg, nil).Metrics()(ok)
+
+		req := httptest.NewRequestWithContext(
+			t.Context(), http.MethodGet, okRoute, nil,
+		)
+		w := httptest.NewRecorder()
+		h.ServeHTTP(w, req)
+
+		assert.Equal(t, http.StatusOK, w.Code)
+	}
+}

internal/middleware/middleware.go

@@ -6,7 +6,6 @@ import (
 	"log/slog"
 	"net"
 	"net/http"
-	"net/url"
 	"sync"
 	"time"
 
@@ -14,6 +13,9 @@ import (
 	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
 	"github.com/go-chi/cors"
+	"github.com/prometheus/client_golang/prometheus"
+	httpmetrics "github.com/slok/go-http-metrics/metrics"
+	prommetrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	"go.uber.org/fx"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/globals"
@@ -149,10 +151,11 @@ const (
 type MiddlewareParams struct {
 	fx.In
 
-	Logger  *logger.Logger
+	Logger   *logger.Logger
-	Globals *globals.Globals
+	Globals  *globals.Globals
-	Config  *config.Config
+	Config   *config.Config
-	Session *session.Session
+	Session  *session.Session
+	Registry *prometheus.Registry
 }
 
 // Middleware provides HTTP middleware for logging, CORS, auth, and
@@ -162,6 +165,14 @@ type Middleware struct {
 	params  *MiddlewareParams
 	session *session.Session
 
+	// metricsRecorder records the inbound HTTP metrics. New builds
+	// it on the registry /metrics serves, NewForTest on a registry
+	// of its own. Either way it is built once per Middleware and
+	// Metrics reuses it, because building it registers its
+	// collectors, and a second registration on the same registry
+	// panics.
+	metricsRecorder httpmetrics.Recorder
+
 	// loginGuard counts failed credential verifications and bounds
 	// concurrent password hashing. It is built on first use so that
 	// every construction path gets one; see guard().
@@ -180,6 +191,9 @@ func New(
 	s.params = &params
 	s.log = params.Logger.Get()
 	s.session = params.Session
+	s.metricsRecorder = prommetrics.NewRecorder(
+		prommetrics.Config{Registry: params.Registry},
+	)
 
 	return s, nil
 }
@@ -367,30 +381,6 @@ func (s *Middleware) CORS() func(http.Handler) http.Handler {
 	}
 }
 
-// NextParam is the query parameter on the login redirect, and the
-// login form field, that holds the page to return to after login.
-const NextParam = "next"
-
-// MaxNextBytes bounds the NextParam value. The login page writes it
-// into its form, and every page is rendered into a buffer first, so
-// without a bound a request would choose the size of that buffer.
-const MaxNextBytes = 2048
-
-// loginURL is the login page RequireAuth redirects to. A GET carries
-// its own path and query in NextParam so that logging in returns to
-// it, unless they are longer than MaxNextBytes; loginDestination in
-// the handlers package checks whether that value is safe to follow.
-// Other methods carry nothing, since a redirect cannot repeat them.
-func loginURL(r *http.Request) string {
-	next := r.URL.RequestURI()
-
-	if r.Method != http.MethodGet || len(next) > MaxNextBytes {
-		return "/pages/login"
-	}
-
-	return "/pages/login?" + url.Values{NextParam: {next}}.Encode()
-}
-
 // RequireAuth returns middleware that checks for a valid session.
 // Unauthenticated users are redirected to the login page.
 func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
@@ -406,7 +396,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					"error", err,
 				)
 				http.Redirect(
-					w, r, loginURL(r), http.StatusSeeOther,
+					w, r, "/pages/login", http.StatusSeeOther,
 				)
 
 				return
@@ -434,7 +424,7 @@ func (s *Middleware) RequireAuth() func(http.Handler) http.Handler {
 					),
 				)
 				http.Redirect(
-					w, r, loginURL(r), http.StatusSeeOther,
+					w, r, "/pages/login", http.StatusSeeOther,
 				)
 
 				return

internal/middleware/middleware_test.go

@@ -338,76 +338,6 @@ func TestRequireAuth_NoSession_RedirectsToLogin(t *testing.T) {
 			"unauthenticated request",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
-		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
-	)
-}
-
-// TestRequireAuth_LoginRedirectCarriesOnlyAGet pins what the login
-// redirect carries: a GET's path and query, so logging in can return
-// there, and nothing for a POST, which a redirect cannot repeat.
-func TestRequireAuth_LoginRedirectCarriesOnlyAGet(t *testing.T) {
-	t.Parallel()
-
-	m, _ := testMiddleware(t, config.EnvironmentDev)
-
-	handler := m.RequireAuth()(http.HandlerFunc(
-		func(_ http.ResponseWriter, _ *http.Request) {},
-	))
-
-	get := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodGet, "/source/abc/logs?page=2", nil,
-	)
-	w := httptest.NewRecorder()
-	handler.ServeHTTP(w, get)
-
-	assert.Equal(
-		t, "/pages/login?next=%2Fsource%2Fabc%2Flogs%3Fpage%3D2",
-		w.Header().Get("Location"),
-	)
-
-	post := httptest.NewRequestWithContext(
-		context.Background(),
-		http.MethodPost, "/source/abc/delete", nil,
-	)
-	w = httptest.NewRecorder()
-	handler.ServeHTTP(w, post)
-
-	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
-}
-
-// TestRequireAuth_LoginRedirectLeavesOutALongURL: a GET whose path
-// and query are longer than the login page accepts goes to the plain
-// login page, so a long URL does not make the redirect long.
-func TestRequireAuth_LoginRedirectLeavesOutALongURL(t *testing.T) {
-	t.Parallel()
-
-	m, _ := testMiddleware(t, config.EnvironmentDev)
-
-	handler := m.RequireAuth()(http.HandlerFunc(
-		func(_ http.ResponseWriter, _ *http.Request) {},
-	))
-
-	atLimit := "/" + strings.Repeat("a", middleware.MaxNextBytes-1)
-
-	get := httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet, atLimit, nil,
-	)
-	w := httptest.NewRecorder()
-	handler.ServeHTTP(w, get)
-
-	assert.Equal(
-		t, "/pages/login?next=%2F"+atLimit[1:],
-		w.Header().Get("Location"),
-	)
-
-	get = httptest.NewRequestWithContext(
-		context.Background(), http.MethodGet, atLimit+"a", nil,
-	)
-	w = httptest.NewRecorder()
-	handler.ServeHTTP(w, get)
-
 	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
 }
 
@@ -513,9 +443,7 @@ func TestRequireAuth_UnauthenticatedSession_RedirectsToLogin(
 			"unauthenticated session",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
+	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
-		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
-	)
 }
 
 // --- RequireAuth Session Expiry Tests ---
@@ -613,9 +541,7 @@ func TestRequireAuth_IdleExpiredSession_RedirectsToLogin(
 		"handler should not run for an idle-expired session",
 	)
 	assert.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(
+	assert.Equal(t, "/pages/login", w.Header().Get("Location"))
-		t, "/pages/login?next=%2Fdashboard", w.Header().Get("Location"),
-	)
 	assert.Empty(
 		t, sessionCookies(w),
 		"an expired session must not be refreshed",

internal/middleware/testing.go

@@ -3,12 +3,17 @@ package middleware
 import (
 	"log/slog"
 
+	"github.com/prometheus/client_golang/prometheus"
+	prommetrics "github.com/slok/go-http-metrics/metrics/prometheus"
 	"sneak.berlin/go/webhooker/internal/config"
 	"sneak.berlin/go/webhooker/internal/session"
 )
 
 // NewForTest creates a Middleware with the minimum dependencies
 // needed for testing. This bypasses the fx lifecycle.
+//
+// Its metrics recorder writes to a fresh registry of its own, so
+// Metrics() works on it and two of them never collide.
 func NewForTest(
 	log *slog.Logger,
 	cfg *config.Config,
@@ -20,5 +25,8 @@ func NewForTest(
 			Config: cfg,
 		},
 		session: sess,
+		metricsRecorder: prommetrics.NewRecorder(
+			prommetrics.Config{Registry: prometheus.NewRegistry()},
+		),
 	}
 }

internal/resetpw/resetpw_test.go

@@ -24,6 +24,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/resetpw"
 	"sneak.berlin/go/webhooker/internal/session"
@@ -163,6 +164,8 @@ func newServerApp(
 			session.New,
 			func() delivery.Notifier { return &noopNotifier{} },
 			func() delivery.WebhookEvictor { return &noopEvictor{} },
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			delivery.NewGuard,
 			handlers.New,

internal/server/routes.go

@@ -7,7 +7,6 @@ import (
 	sentryhttp "github.com/getsentry/sentry-go/http"
 	"github.com/go-chi/chi"
 	"github.com/go-chi/chi/middleware"
-	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"sneak.berlin/go/webhooker/static"
 )
 
@@ -130,12 +129,7 @@ func (s *Server) setupRoutes() {
 	if s.params.Config.MetricsAuthEnabled() {
 		s.router.Group(func(r chi.Router) {
 			r.Use(s.mw.MetricsAuth())
-			r.Get(
+			r.Get("/metrics", s.h.HandleMetrics())
-				"/metrics",
-				http.HandlerFunc(
-					promhttp.Handler().ServeHTTP,
-				),
-			)
 		})
 	}
 

internal/server/routes_test.go

@@ -24,6 +24,7 @@ import (
 	"sneak.berlin/go/webhooker/internal/handlers"
 	"sneak.berlin/go/webhooker/internal/healthcheck"
 	"sneak.berlin/go/webhooker/internal/logger"
+	"sneak.berlin/go/webhooker/internal/metrics"
 	"sneak.berlin/go/webhooker/internal/middleware"
 	"sneak.berlin/go/webhooker/internal/server"
 	"sneak.berlin/go/webhooker/internal/session"
@@ -113,6 +114,8 @@ func newTestEnvWithConfig(
 			session.New,
 			func() delivery.Notifier { return &noopNotifier{} },
 			func() delivery.WebhookEvictor { return &noopEvictor{} },
+			metrics.NewRegistry,
+			metrics.New,
 			middleware.New,
 			delivery.NewGuard,
 			handlers.New,
@@ -680,44 +683,6 @@ func TestPagesLogin_CookiesFromAnEarlierDatabase(t *testing.T) {
 	)
 }
 
-// TestPagesLogin_ReturnsToTheRequestedPage is
-// https://git.eeqj.de/sneak/webhooker/issues/384: a page opened while
-// logged out leads to the login page, and logging in from there lands
-// on that page, query included.
-func TestPagesLogin_ReturnsToTheRequestedPage(t *testing.T) {
-	t.Parallel()
-
-	const (
-		username = "operator"
-		password = "correct-horse-battery-staple"
-	)
-
-	env := newTestEnv(t)
-	userID, _ := env.seedUser(t, username, password)
-	asked := "/source/" + env.seedWebhook(t, userID).ID + "/logs?page=2"
-
-	bounced := env.get(asked, nil)
-	require.Equal(t, http.StatusSeeOther, bounced.Code)
-
-	loginPage := bounced.Header().Get("Location")
-
-	match := regexp.MustCompile(`name="next" value="([^"]*)"`).
-		FindStringSubmatch(env.get(loginPage, nil).Body.String())
-	require.Len(t, match, 2, "the login form must carry the page")
-
-	token, cookies := env.csrfFrom(t, loginPage, nil)
-
-	form := url.Values{}
-	form.Set("csrf_token", token)
-	form.Set("username", username)
-	form.Set("password", password)
-	form.Set("next", html.UnescapeString(match[1]))
-
-	w := env.post("/pages/login", form, cookies)
-	require.Equal(t, http.StatusSeeOther, w.Code)
-	assert.Equal(t, asked, w.Header().Get("Location"))
-}
-
 // --- /user/{username} group ---
 
 // TestPasswordChange_OversizeBody_RejectedAndPasswordUnchanged
@@ -868,10 +833,7 @@ func TestSourceLogsBody_OtherUser404s(t *testing.T) {
 
 	anon := env.get(path, nil)
 	assert.Equal(t, http.StatusSeeOther, anon.Code)
-	assert.Equal(
+	assert.Equal(t, "/pages/login", anon.Header().Get("Location"))
-		t, "/pages/login?next="+url.QueryEscape(path),
-		anon.Header().Get("Location"),
-	)
 }
 
 // TestDeliveryReplay_PostOnlyAndCSRFProtected walks the replay action
@@ -1068,3 +1030,46 @@ func TestMetricsRouteUnmountedOnHalfSetConfig(t *testing.T) {
 		})
 	}
 }
+
+// TestTwoMetricsRoutersInOneProcess pins
+// https://git.eeqj.de/sneak/webhooker/issues/227: a second
+// metrics-enabled router in one process used to panic, because the
+// HTTP metrics registered on Prometheus's global default registry.
+// Two routers are built over separate dependency graphs and a third
+// over the first graph again, and each must still serve the HTTP,
+// delivery, Go runtime and process series, and the series counting
+// scrapes of /metrics itself.
+func TestTwoMetricsRoutersInOneProcess(t *testing.T) {
+	t.Parallel()
+
+	first := newTestEnvWithConfig(
+		t, metricsConfig(t, metricsUser, metricsAuthValue),
+	)
+	second := newTestEnvWithConfig(
+		t, metricsConfig(t, metricsUser, metricsAuthValue),
+	)
+	third := &testEnv{
+		router: server.NewRouterForTest(
+			first.log.Get(), first.cfg, first.mw, first.hnd,
+		),
+	}
+
+	for _, env := range []*testEnv{first, second, third} {
+		env.get("/", nil)
+
+		scrape := env.metricsRequest(metricsUser, metricsAuthValue)
+		require.Equal(t, http.StatusOK, scrape.Code)
+
+		for _, series := range []string{
+			"http_request_duration_seconds",
+			"http_response_size_bytes",
+			"http_requests_inflight",
+			"webhooker_events_received_total",
+			"go_goroutines",
+			"process_start_time_seconds",
+			"promhttp_metric_handler_requests_total",
+		} {
+			assert.Contains(t, scrape.Body.String(), series)
+		}
+	}
+}

templates/login.html

@@ -24,7 +24,6 @@
 
             <form method="POST" action="/pages/login" class="space-y-6">
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
-                <input type="hidden" name="next" value="{{.Next}}">
                 <div class="form-group">
                     <label for="username" class="label">Username</label>
                     <input

templates/navbar.html

@@ -6,14 +6,12 @@
         </div>
 
         <!-- Mobile menu button -->
-        {{if .User}}
         <button @click="open = !open" class="md:hidden p-2 rounded-md text-gray-500 hover:bg-gray-100">
             <svg class="w-6 h-6" fill="none" stroke="currentColor" viewBox="0 0 24 24">
                 <path x-show="!open" stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M4 6h16M4 12h16M4 18h16"/>
                 <path x-show="open" x-cloak stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"/>
             </svg>
         </button>
-        {{end}}
 
         <!-- Desktop navigation -->
         <div class="hidden md:flex items-center gap-4">
@@ -30,6 +28,8 @@
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                 <button type="submit" class="btn-text">Logout</button>
             </form>
+            {{else}}
+            <a href="/pages/login" class="btn-primary">Login</a>
             {{end}}
         </div>
     </div>
@@ -44,6 +44,8 @@
                 <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
                 <button type="submit" class="btn-text w-full text-left">Logout</button>
             </form>
+            {{else}}
+            <a href="/pages/login" class="btn-primary w-full">Login</a>
             {{end}}
         </div>
     </div>