ced4568
d34ddae458
- admin-routes.js: create-with-credentials, /convert, /reset-password, /revoke-sessions, /sessions, /import (transactional CSV import — whole file validated, one Postgres transaction, never accepts a password/hash column from input). Fixed GET /api/admin/students to select an explicit safe column list instead of SELECT * — the new password_hash/credential_token_hash columns must never be exposed through this route. - server.js: /api/login now also blocks on credential_token_hash (not just password_hash) — closes a real window where a student mid-conversion stayed reachable via the old bare-student_id path. studentSession middleware now re-verifies status='active' on every request, not just at session creation, matching instructorSession's existing behavior. - sessions.js: revokeAllStudentSessions, listStudentSessions. - rbac.js: extracted checkCohortAccess/checkCohortWriteAccess as shared core functions so the new classroom/help-request RBAC (next commit) reuses the exact same authorization rule instead of a parallel copy. - student-csv.js + test: hand-rolled parser (no new dependency), unit tested. - prometheus.yml.j2: activated the platform-api scrape job.
93 lines
3.2 KiB
Django/Jinja
93 lines
3.2 KiB
Django/Jinja
# Prometheus config — deployed to rn-platform-01 (runs alongside the app stack; see
|
|
# infra/ansible/roles/monitoring-agent/). Scrapes both hosts remotely — node-exporter/
|
|
# postgres-exporter here on rn-platform-01 (same-host, local network), node-exporter/cadvisor
|
|
# on rn-lab-host-01 over the network (allowed by the firewall rule added for exactly this,
|
|
# infra/firewall/rn-lab-host-01.rules).
|
|
#
|
|
# Deliberately does NOT scrape or duplicate the application's own instructor learning
|
|
# analytics (docs/PHASE3B_LEARNING_AND_ASSESSMENT.md §12) — operational observability
|
|
# (uptime/CPU/errors) and learning analytics (completion rates/hint usage) are separate
|
|
# concerns with separate audiences, per the explicit Phase 4 instruction.
|
|
|
|
global:
|
|
scrape_interval: 15s
|
|
evaluation_interval: 15s
|
|
|
|
alerting:
|
|
alertmanagers:
|
|
- static_configs:
|
|
- targets: ["localhost:9093"]
|
|
|
|
rule_files:
|
|
- /etc/prometheus/rules/*.yml
|
|
|
|
scrape_configs:
|
|
- job_name: platform-node
|
|
static_configs:
|
|
- targets: ["localhost:9100"]
|
|
labels: { host: rn-platform-01 }
|
|
|
|
- job_name: platform-postgres
|
|
static_configs:
|
|
- targets: ["postgres-exporter:9187"]
|
|
labels: { host: rn-platform-01 }
|
|
|
|
- job_name: lab-host-node
|
|
static_configs:
|
|
- targets: ["{{ lab_host_ip }}:9100"]
|
|
labels: { host: rn-lab-host-01 }
|
|
|
|
- job_name: lab-host-cadvisor
|
|
static_configs:
|
|
- targets: ["{{ lab_host_ip }}:8080"]
|
|
labels: { host: rn-lab-host-01 }
|
|
|
|
# Uptime checks (Phase 4 §17) — blackbox_exporter probing the healthz endpoints added this
|
|
# phase (Platform API, Gateway) plus the Provisioner's existing /health (Phase 1).
|
|
- job_name: blackbox-gateway
|
|
metrics_path: /probe
|
|
params: { module: [http_2xx] }
|
|
static_configs:
|
|
- targets: ["https://{{ academy_domain }}/healthz"]
|
|
relabel_configs:
|
|
- source_labels: [__address__]
|
|
target_label: __param_target
|
|
- source_labels: [__param_target]
|
|
target_label: instance
|
|
- target_label: __address__
|
|
replacement: localhost:9115
|
|
|
|
- job_name: blackbox-platform-api
|
|
metrics_path: /probe
|
|
params: { module: [http_2xx] }
|
|
static_configs:
|
|
- targets: ["http://api:4300/healthz"]
|
|
relabel_configs:
|
|
- source_labels: [__address__]
|
|
target_label: __param_target
|
|
- source_labels: [__param_target]
|
|
target_label: instance
|
|
- target_label: __address__
|
|
replacement: localhost:9115
|
|
|
|
- job_name: blackbox-provisioner
|
|
metrics_path: /probe
|
|
params: { module: [http_2xx] }
|
|
static_configs:
|
|
- targets: ["http://provisioner:4100/health"]
|
|
relabel_configs:
|
|
- source_labels: [__address__]
|
|
target_label: __param_target
|
|
- source_labels: [__param_target]
|
|
target_label: instance
|
|
- target_label: __address__
|
|
replacement: localhost:9115
|
|
|
|
# RootNode application metrics — Phase 5A §34 (platform/api/src/metrics.js): classroom/help-
|
|
# request/Lab-state gauges and student login counters. No student/instructor id or other
|
|
# high-cardinality value is ever a label here — see that file's header comment.
|
|
- job_name: rootnode-platform-api
|
|
static_configs:
|
|
- targets: ["api:4300"]
|
|
metrics_path: /metrics
|