feat: expose metrics and harden release paths

Author: stefan-ernst

.gitignore

@@ -194,4 +194,6 @@ blog/
 /cmd/ws/ws
 /playground
 /docs
+!/docs/
+!/docs/metrics.md
 /CONTEXT.md

docs/metrics.md

@@ -0,0 +1,34 @@
+# Prometheus metrics
+
+Windshift exposes Prometheus metrics from the public `GET /metrics` endpoint.
+When `WINDSHIFT_CONTEXT_PATH` is set, the endpoint uses the same prefix as the
+rest of the application, for example `/windshift/metrics`.
+
+The endpoint is intentionally unauthenticated so an infrastructure scraper can
+reach it in the same way as `/healthz` and `/readyz`. Restrict it at the reverse
+proxy or network boundary when metrics should not be available publicly.
+
+The registry includes:
+
+- Go runtime metrics (`go_*`), including goroutines, heap use, and GC pauses.
+- Process metrics (`windshift_process_*`), including CPU, memory, and open file
+  descriptors where the operating system supports them.
+- Database pool metrics (`go_sql_*`) for open, in-use, and idle connections,
+  connection waits, and connection lifetime closures.
+- HTTP request totals and duration histograms (`windshift_http_*`). The `route`
+  label contains the registered route pattern, such as `/api/items/{id}`, and
+  never the raw request path. Both metric families also include the response
+  status code.
+- Agent run queue depth, in-flight runs, retained outcomes, and average duration
+  (`windshift_agent_*`).
+- Retained webhook delivery outcomes (`windshift_webhook_dispatches`).
+- Scheduled SCM poll totals, failures, and duration (`windshift_scm_*`).
+
+Example Prometheus configuration:
+
+```yaml
+scrape_configs:
+  - job_name: windshift
+    static_configs:
+      - targets: [windshift:8080]
+```

frontend/src/lib/dialogs/LoginDialog.svelte

@@ -11,6 +11,7 @@
   import Input from '../components/Input.svelte';
   import Label from '../components/Label.svelte';
   import AlertBox from '../components/AlertBox.svelte';
+  import Spinner from '../components/Spinner.svelte';
   import {
     isWebAuthnSupported
   } from '../utils/webauthn-utils.js';
@@ -37,6 +38,7 @@
   let showFidoOption = $state(false);
   let ssoError = $state(null);
   let ssoRequiredMessage = $state(null);
+  let loginOptionsReady = $state(false);
 
   // Auth policy status (fetched on mount)
   let policyStatus = $state({
@@ -50,12 +52,16 @@
 
   // Initialize SSO status and auth policy on mount
   onMount(async () => {
-    await Promise.all([
-      ssoStore.initStatus(),
-      loadPolicyStatus()
-    ]);
-    // Check for SSO error in URL (after callback redirect)
-    ssoError = ssoStore.checkForError();
+    try {
+      await Promise.all([
+        ssoStore.initStatus(),
+        loadPolicyStatus()
+      ]);
+      // Check for SSO error in URL (after callback redirect)
+      ssoError = ssoStore.checkForError();
+    } finally {
+      loginOptionsReady = true;
+    }
   });
 
   // Load public policy status
@@ -252,6 +258,15 @@
       <AlertBox variant="error" message={$authStore.error} class="mb-4" />
     {/if}
 
+    {#if !loginOptionsReady}
+      <div
+        class="flex min-h-40 items-center justify-center gap-3 text-sm text-[var(--ds-text-subtle)]"
+        data-testid="login-options-loading"
+      >
+        <Spinner size="sm" />
+        <span>{t('common.loading')}</span>
+      </div>
+    {:else}
     <!-- Keep the session choice in front of SSO so it also remains available
          when the authentication policy hides the password form. -->
     {#if $ssoStore.enabled && !$ssoStore.statusLoading}
@@ -367,7 +382,11 @@
     {:else}
 
     <!-- Login Form -->
-    <form onsubmit={(e) => { e.preventDefault(); handleSubmit(); }} class="space-y-4">
+    <form
+      onsubmit={(e) => { e.preventDefault(); handleSubmit(); }}
+      class="space-y-4"
+      data-testid="login-password-form"
+    >
       <!-- Email/Username Field -->
       <div>
         <Label for="emailOrUsername" color="default" class="mb-1">
@@ -479,6 +498,7 @@
       </Button>
     </form>
     {/if}
+    {/if}
   </div>
   </div>
 </div>

go.mod

@@ -20,6 +20,7 @@ require (
 	github.com/emersion/go-message v0.18.2
 	github.com/emersion/go-sasl v0.0.0-20241020182733-b788ff22d5a6
 	github.com/extism/go-sdk v1.7.1
+	github.com/felixge/httpsnoop v1.1.0
 	github.com/getkin/kin-openapi v0.144.0
 	github.com/go-ldap/ldap/v3 v3.4.12
 	github.com/go-playground/validator/v10 v10.28.0
@@ -36,6 +37,7 @@ require (
 	github.com/microcosm-cc/bluemonday v1.0.27
 	github.com/modelcontextprotocol/go-sdk v1.4.1
 	github.com/openai/openai-go/v3 v3.46.0
+	github.com/prometheus/client_golang v1.24.1
 	github.com/sahilm/fuzzy v0.1.3
 	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
 	github.com/spf13/cobra v1.8.0
@@ -82,6 +84,7 @@ require (
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/aymerick/douceur v0.2.0 // indirect
 	github.com/beevik/etree v1.6.0 // indirect
+	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/charmbracelet/anthropic-sdk-go v0.0.0-20260223140439-63879b0b8dab // indirect
@@ -106,7 +109,6 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a // indirect
 	github.com/fatih/color v1.17.0 // indirect
-	github.com/felixge/httpsnoop v1.1.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.10 // indirect
 	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
@@ -151,11 +153,15 @@ require (
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
 	github.com/muhlemmer/gu v0.3.1 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/oasdiff/yaml v0.1.1 // indirect
 	github.com/oasdiff/yaml3 v0.0.14 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.70.1 // indirect
+	github.com/prometheus/procfs v0.21.1 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/russellhaering/goxmldsig v1.6.0 // indirect

go.sum

@@ -85,6 +85,8 @@ github.com/aymerick/douceur v0.2.0 h1:Mv+mAeH1Q+n9Fr+oyamOlAkUNPWPlA8PPGR0QAaYuP
 github.com/aymerick/douceur v0.2.0/go.mod h1:wlT5vV2O3h55X9m7iVYN0TBM0NH/MmbLnd30/FjWUq4=
 github.com/beevik/etree v1.6.0 h1:u8Kwy8pp9D9XeITj2Z0XtA5qqZEmtJtuXZRQi+j03eE=
 github.com/beevik/etree v1.6.0/go.mod h1:bh4zJxiIr62SOf9pRzN7UUYaEDa9HEKafK25+sLc0Gc=
+github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bmatcuk/doublestar/v4 v4.9.2 h1:b0mc6WyRSYLjzofB2v/0cuDUZ+MqoGyH3r0dVij35GI=
 github.com/bmatcuk/doublestar/v4 v4.9.2/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
@@ -347,6 +349,8 @@ github.com/muhlemmer/gu v0.3.1 h1:7EAqmFrW7n3hETvuAdmFmn4hS8W+z3LgKtrnow+YzNM=
 github.com/muhlemmer/gu v0.3.1/go.mod h1:YHtHR+gxM+bKEIIs7Hmi9sPT3ZDUvTN/i88wQpZkrdM=
 github.com/muhlemmer/httpforwarded v0.1.0 h1:x4DLrzXdliq8mprgUMR0olDvHGkou5BJsK/vWUetyzY=
 github.com/muhlemmer/httpforwarded v0.1.0/go.mod h1:yo9czKedo2pdZhoXe+yDkGVbU0TJ0q9oQ90BVoDEtw0=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOFAw7w=
 github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
 github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
@@ -365,6 +369,14 @@ github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10/go.mod h1
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prometheus/client_golang v1.24.1 h1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=
+github.com/prometheus/client_golang v1.24.1/go.mod h1:F+oSRECHg4sse5ucfYpYDeIv/hu68Zo0uoHKetWnzcE=
+github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
+github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
+github.com/prometheus/common v0.70.1 h1:1HvjP4D5oL3t8RsPlwxA9onvvStjtIHYE5XuuwOi/PY=
+github.com/prometheus/common v0.70.1/go.mod h1:VdFUQDMZK3VLkurFUVhia6uys/0suUp86TJz5qbJRhc=
+github.com/prometheus/procfs v0.21.1 h1:GljZCt+zSTS+NZq88cyQ1LjZ+RCHp3uVuabBWA5+OJI=
+github.com/prometheus/procfs v0.21.1/go.mod h1:aB55Cww9pdSJVHk0hUf0inxWyyjPogFIjmHKYgMKmtY=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
@@ -459,6 +471,8 @@ go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/
 go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE=
 go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk=
 go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
 go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
@@ -475,17 +489,13 @@ golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
 golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
-golang.org/x/image v0.44.0 h1:+tDekMZED9+LrtB3G5xzRggpVh9CARjZqROla3R3R+I=
-golang.org/x/image v0.44.0/go.mod h1:V8K3KE9KKKE+pLpQDOeN18w9oacNSvy1tDOirTu4xtY=
 golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0=
 golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
-golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
 golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -553,8 +563,6 @@ golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
 golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
@@ -565,8 +573,6 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
-golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE=
 golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

internal/handlers/items_roadmap_hierarchy.go

@@ -26,7 +26,8 @@ func (h *ItemHandler) GetRoadmapHierarchyDates(w http.ResponseWriter, r *http.Re
 	ctx, cancel := h.requestDBContext(r)
 	defer cancel()
 
-	items, truncated, err := repository.NewItemRepository(h.db).GetRoadmapHierarchyDates(ctx, req.RootIDs)
+	itemRepo := repository.NewItemRepository(h.db)
+	rootWorkspaceIDs, err := itemRepo.GetRoadmapHierarchyRootWorkspaceIDs(ctx, req.RootIDs)
 	if err != nil {
 		if errors.Is(err, repository.ErrRoadmapHierarchyRootLimit) {
 			respondBadRequest(w, r, err.Error())
@@ -35,6 +36,19 @@ func (h *ItemHandler) GetRoadmapHierarchyDates(w http.ResponseWriter, r *http.Re
 		}
 		return
 	}
+	authorizedRootIDs, err := authorizedRoadmapHierarchyRootIDs(req.RootIDs, rootWorkspaceIDs, func(workspaceID int) (bool, error) {
+		return h.canViewItem(user.ID, workspaceID)
+	})
+	if err != nil {
+		respondInternalError(w, r, err)
+		return
+	}
+
+	items, truncated, err := itemRepo.GetRoadmapHierarchyDates(ctx, authorizedRootIDs)
+	if err != nil {
+		respondInternalError(w, r, err)
+		return
+	}
 
 	allowedByWorkspace := make(map[int]bool)
 	filtered := make([]models.RoadmapHierarchyDate, 0, len(items))
@@ -55,3 +69,35 @@ func (h *ItemHandler) GetRoadmapHierarchyDates(w http.ResponseWriter, r *http.Re
 
 	respondJSONOK(w, map[string]any{"items": filtered, "truncated": truncated})
 }
+
+func authorizedRoadmapHierarchyRootIDs(rootIDs []int, workspaceIDs map[int]int, canView func(int) (bool, error)) ([]int, error) {
+	allowedByWorkspace := make(map[int]bool)
+	seen := make(map[int]struct{}, len(rootIDs))
+	authorized := make([]int, 0, len(rootIDs))
+	for _, itemID := range rootIDs {
+		if itemID <= 0 {
+			continue
+		}
+		if _, duplicate := seen[itemID]; duplicate {
+			continue
+		}
+		seen[itemID] = struct{}{}
+		workspaceID, exists := workspaceIDs[itemID]
+		if !exists {
+			continue
+		}
+		allowed, known := allowedByWorkspace[workspaceID]
+		if !known {
+			var err error
+			allowed, err = canView(workspaceID)
+			if err != nil {
+				return nil, err
+			}
+			allowedByWorkspace[workspaceID] = allowed
+		}
+		if allowed {
+			authorized = append(authorized, itemID)
+		}
+	}
+	return authorized, nil
+}