[LeeroyHannigan]

What

The console metrics dashboard and its data feed now serve admin sessions only. The Settings and Cache pages were already admin only. Now the three pages refuse an IAM-user session in the same way.

• GET /console/metrics, GET /console/settings, GET /console/cache and POST /console/cache/invalidate redirect an IAM-user session to /console. They share one check, require_admin. Before, Settings, Cache and the cache form answered with a plain-text 403. The other admin-only console pages already redirect an IAM-user session.
• GET /console/metrics-data answers an IAM-user session with HTTP 403 and {"__type":"AccessDeniedException","message":"Metrics are visible to admin users only"}. The handler returns the refusal before it reads the metrics store or the in-memory collector. This route is a JSON endpoint, and the dashboard's script parses its response as JSON. So the route keeps the 403 instead of a redirect to an HTML page.
• The navigation bar shows the Metrics, Settings and Cache links to admins only. identity_label now returns the label together with whether the caller is an admin. So the 38 nav_bar call sites are unchanged.
• The page no longer sets const accountFilter for IAM users. The dashboard script never read that variable.

Admin sessions get the same payload, pages and navigation bar as before. The only change for them is that the metrics page no longer has the unused accountFilter variable.

The architecture guide, admin guide, getting started guide and security model now say that the dashboard is admin only and covers every account. The admin guide also lists Settings and Cache as admin only. The upgrade manual has a v0.1.15 entry for the change. The demo manual says to open the dashboard as the admin user. AGENTS.md's /metrics example now passes admin credentials, which that endpoint requires.

Merging with #704 and #734

This PR and #704 (console session revocation) conflict only in the imports of crates/server/src/console/pages/mod.rs. This PR adds use crate::console::html;, and #704 adds use crate::console::session::SessionCheck;. Keeping both lines resolves it. Before the Settings and Cache change, a trial merge with #704 passed 20 tests in cargo test -p extenddb-server --lib console. Against a SQLite build of that merged tree, tests/test_console_metrics_admin_only.py passed 7 cases. The Settings and Cache change adds no conflict with #704.

#734 (console account pages) is on main. It added a sentence to docs/manuals/10-security-model.md: until this PR merges, /console/metrics-data serves every console session the table metrics of every account. 791ae9a removes that sentence. In the same file, #718 rewrote the login rate limiting line next to this branch's new line. 61a5800 merges main and keeps both lines.

Why

/console/metrics-data checked only that the caller had a console session, then returned the rows of the metrics table. That table has no account column, and the store query filters on time, table name and metric only. So any IAM user who could log in to the console read the table names, index names, operations, request counts and latencies of every account. The account id that the page set for IAM users stayed in the browser and did not limit what the server sent.

Reproduction on main's console code (f49c5f823), SQLite backend, 2026-11-01:

1. Create an account with an IAM user that has a console password. The account has no tables.
2. Log in as that user at /console/login and request /console/metrics-data.
3. The response is HTTP 200 and carries 18 distinct TableName values. All of them are tables of other accounts on the server. ?window=LastHour and ?window=AllTime return the same 18 names.

The same steps on this branch return HTTP 403 with the body above and no table names. /console/metrics returns a redirect to /console.

Testing done

New tests:

• crates/server/src/console/pages/metrics_pages_tests.rs, 5 tests:
  • An IAM-user session gets 403 from the data feed, with no table name, index name or operation in the body. The fake store records no read.
  • An admin gets both accounts' rows, their index dimension and the latency segments.
  • The page redirects an IAM-user session. An admin gets the page without accountFilter.
  • An admin's navigation bar has the Metrics, Settings and Cache links in that order, between Accounts and the spacer. An IAM user's bar has none of them.
• tests/test_console_metrics_admin_only.py, 13 cases against a server. Two accounts each create a table and send it reads and writes. The fixture waits until the admin's feed shows both tables, which takes up to two flush intervals of 60 seconds. Then:
  • The IAM user of the second account gets 403 and no table names from the feed under four query strings.
  • The Metrics, Settings and Cache pages redirect that user. The cache form redirects the user too, with the session's own CSRF token and with a wrong one.
  • The user's navigation bar has none of the three links. The admin's bar has all three.
  • The admin gets the Metrics page with both tables, the Settings page and the Cache page.

Commands run before the Settings and Cache change:

• cargo +1.97.0 fmt --all -- --check: clean.
• cargo +1.97.0 clippy --locked -p extenddb-server --all-targets -- -D warnings: clean. With -W clippy::pedantic the crate has 499 warnings, and none of them are in the changed files.
• cargo test --locked -p extenddb-server on Rust 1.99.0 and on 1.88.0: 242 passed on each.
• cargo check --locked --workspace --all-targets: clean.
• pytest against a SQLite debug build and against a PostgreSQL debug build. On each, tests/test_console*.py passed 42 cases, including the 7 new cases. tests/test_metrics.py with tests/test_cross_account_isolation.py passed 23.

Commands on e28d8db, which adds the Settings and Cache change:

• cargo +1.97.0 fmt --all -- --check: clean.
• cargo +1.97.0 clippy --locked -p extenddb-server --all-targets -- -D warnings: clean.
• cargo +1.97.0 test --locked -p extenddb-server --lib console: 8 passed.
• pytest against a SQLite debug build: tests/test_console_metrics_admin_only.py passed 13 cases. With the same server build, the other tests/test_console*.py files passed 35.

Negative controls, each restored with git afterwards. Before the Settings and Cache change:

• Data feed check removed: the Rust 403 test fails. The 4 Python feed cases fail with HTTP 200 and the first account's table in the body.
• Page check removed: the Rust redirect test fails.
• Metrics link shown to every session: the Rust nav bar test fails.
• main's console code: all 7 Python cases fail.

On e28d8db:

• The three admin links moved after the spacer: the Rust nav bar test fails.
• The cache form checks the CSRF token before it checks for an admin: the Python case with the wrong token fails.

Checklist

• I have read CONTRIBUTING.md
• All tests pass (cargo test --workspace)
• Code is formatted (cargo fmt --check)
• Clippy is clean (cargo clippy -- -W clippy::pedantic)
• I have added or updated tests for new functionality
• I have updated documentation if behavior changed
• Breaking changes are noted below (if any)
• If this changes the wire protocol, Storage trait, auth model, on-disk
  format, or public CLI surface, an RFC has been accepted or is linked
  below. Otherwise, an ADR captures the decision (link below).

On 5d885b4, CI ran the workspace tests on Rust 1.88.0 and on stable, and the integration suites on all four backends. All of them passed. Clippy ran with -D warnings, without the pedantic group. CI runs again on 791ae9a, after the merge of main.

ADR / RFC: n/a

Breaking changes

IAM users lose the console metrics dashboard. The page redirects them to /console, the data feed returns HTTP 403, and the navigation bar no longer links it. The Settings page, the Cache page and the cache form now redirect an IAM-user session to /console, where they answered HTTP 403 before. The navigation bar no longer links Settings and Cache for IAM users. Admin sessions and the admin-authenticated /metrics endpoint are unchanged.

Not covered by this change

• Per-account metrics (Metrics have no account dimension, so accounts with the same table name share rows, and failed requests record their raw table names #728). The metrics table has no account column on any of the four backends. The collector and the flush worker carry no account dimension either. A view of its own metrics for an IAM user needs that column and a migration on each backend. It also needs the account carried from the request through the collector and the flush worker. Without the column, two accounts that use the same table name also share one row. So an admin sees their counts and latencies added together.
• The metrics table records the table name of a request that failed validation. So a CreateTable with an invalid name adds that name as a dimension value (Metrics have no account dimension, so accounts with the same table name share rows, and failed requests record their raw table names #728). After this change, only admins read those values.
• An IAM user could request the console's account, user, group and role detail pages of another account by its ID. Those pages then showed the names in that account (Console: an IAM user can read any account's name and its IAM user, group and role names by account ID #724, fixed in fix: serve the console account pages to an IAM user for its own account only #734). This PR does not touch those pages.
• The README, the admin guide and the demo manual show curl .../metrics without credentials, which answers 401. docs: correct the quick start, monitoring commands, backend count and design index #668 fixes them.

---

By submitting this pull request, I confirm that my contribution is made under
the terms of the Apache License 2.0 and I agree to the Developer Certificate of
Origin (DCO). See CONTRIBUTING.md for details.

[hitesh96db]

There's an inconsistent refusals for IAM users.

• Metrics page: redirects to /console.
• Settings and Cache: plain-text 403 ("Settings are visible to admin users only"), and they're still linked in the navigation bar.
• Metrics data endpoint: JSON 403.

Three admin-only pages now refuse in three different ways, and the navigation bar hides only one of them. We can hide all admin-only links in the nav bar from IAM users.

[LeeroyHannigan]

Agreed. e28d8db hides the Metrics, Settings and Cache links from IAM users. All three pages and the cache form now redirect an IAM-user session to /console through one check, require_admin. /console/metrics-data keeps its JSON 403, because the dashboard's script fetches that route and parses the response as JSON.

The branch conflicts with main in one docs file, so CI has not run on this commit yet. The console unit tests and tests/test_console*.py pass locally against a SQLite build.

[hitesh96db]

LGTM

[LeeroyHannigan]

#718 rewrote the login rate limiting bullet in docs/manuals/10-security-model.md and added a section after it, which conflicted with the admin-only metrics bullet in this PR. 61a5800 merges main and keeps both: the bullet and section from #718, then this PR's bullet. The merge changes no code.

On the merge, cargo +1.97.0 clippy --locked --all-targets -- -D warnings is clean and cargo +1.88.0 test --locked -p extenddb-server passes. The push dismissed the approval, so the PR needs a new one before it can go into the queue.

[LeeroyHannigan]

791ae9a removes the sentence that #734 added to docs/manuals/10-security-model.md about /console/metrics-data. The sentence says the feed serves every console session until this PR merges. The merge in 61a5800 kept it, and the description says this PR removes it. The commit changes that one paragraph and no code.