fix(api): fall back to GET on forbidden POSTs (#2030)

Signed-off-by: immanuwell <pchpr.00@list.ru>

Author: immanuwell

api/prometheus/v1/api.go

@@ -1545,8 +1545,8 @@ func (h *apiClientImpl) Do(ctx context.Context, req *http.Request) (*http.Respon
 	return resp, []byte(result.Data), result.Warnings, err
 }
 
-// DoGetFallback will attempt to do the request as-is, and on a 405 or 501 it
-// will fallback to a GET request.
+// DoGetFallback will attempt to do the request as-is, and on a 403, 405, or
+// 501 it will fallback to a GET request.
 func (h *apiClientImpl) DoGetFallback(ctx context.Context, u *url.URL, args url.Values) (*http.Response, []byte, Warnings, error) {
 	encodedArgs := args.Encode()
 	req, err := http.NewRequest(http.MethodPost, u.String(), strings.NewReader(encodedArgs))
@@ -1564,7 +1564,7 @@ func (h *apiClientImpl) DoGetFallback(ctx context.Context, u *url.URL, args url.
 	req.Header["Idempotency-Key"] = nil
 
 	resp, body, warnings, err := h.Do(ctx, req)
-	if resp != nil && (resp.StatusCode == http.StatusMethodNotAllowed || resp.StatusCode == http.StatusNotImplemented) {
+	if resp != nil && (resp.StatusCode == http.StatusForbidden || resp.StatusCode == http.StatusMethodNotAllowed || resp.StatusCode == http.StatusNotImplemented) {
 		u.RawQuery = encodedArgs
 		req, err = http.NewRequest(http.MethodGet, u.String(), nil)
 		if err != nil {

api/prometheus/v1/api_test.go

@@ -1921,6 +1921,13 @@ func TestDoGetFallback(t *testing.T) {
 
 		body, _ := json.Marshal(apiResp)
 
+		if req.Method == http.MethodPost {
+			if req.URL.Path == "/blockPost403" {
+				http.Error(w, string(body), http.StatusForbidden)
+				return
+			}
+		}
+
 		if req.Method == http.MethodPost {
 			if req.URL.Path == "/blockPost405" {
 				http.Error(w, string(body), http.StatusMethodNotAllowed)
@@ -1965,6 +1972,22 @@ func TestDoGetFallback(t *testing.T) {
 		t.Fatalf("Mismatch in values")
 	}
 
+	// Do a fallback to a get on 403.
+	u.Path = "/blockPost403"
+	_, b, _, err = api.DoGetFallback(context.TODO(), u, v)
+	if err != nil {
+		t.Fatalf("Error doing local request: %v", err)
+	}
+	if err := json.Unmarshal(b, resp); err != nil {
+		t.Fatal(err)
+	}
+	if resp.Method != http.MethodGet {
+		t.Fatalf("Mismatch method")
+	}
+	if resp.Values != v.Encode() {
+		t.Fatalf("Mismatch in values")
+	}
+
 	// Do a fallback to a get on 405.
 	u.Path = "/blockPost405"
 	_, b, _, err = api.DoGetFallback(context.TODO(), u, v)