feat(multiplayer): export bounded API metrics

server/observability/metrics_test.go

@@ -0,0 +1,24 @@
+package observability
+
+import (
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestMetricsNormalizesOperationsAndExportsBoundedLabels(t *testing.T) {
+	m := NewMetrics()
+	m.ObserveAPI("queue", 201, 10*time.Millisecond)
+	m.ObserveAPI("/crafted/path/with-secret", 500, time.Second)
+	var output strings.Builder
+	if err := m.WritePrometheus(&output); err != nil {
+		t.Fatal(err)
+	}
+	text := output.String()
+	if !strings.Contains(text, `operation="queue",status="2xx"`) || !strings.Contains(text, `operation="other",status="5xx"`) {
+		t.Fatalf("metrics output = %s", text)
+	}
+	if strings.Contains(text, "crafted") || strings.Contains(text, "secret") {
+		t.Fatalf("unbounded operation label leaked: %s", text)
+	}
+}