Operational: Metrics middleware collects per-IP data with no retention policy #103

New issue

Open

opened 2026-05-11 13:49:53 +00:00 by thabeta · 0 comments

thabeta commented

2026-05-11 13:49:53 +00:00

Owner

Severity: Medium

Location

crates/hero_aibroker_lib/src/middleware/metrics.rs

Finding

The metrics middleware tracks per-IP request counts and error rates:

pub struct Metrics {
    requests: DashMap<IpAddr, AtomicU64>,
    errors: DashMap<IpAddr, AtomicU64>,
}

Like the rate limiter, this grows without bound. There is no:

Retention policy
Aggregation into time windows
Export mechanism (just in-memory counters)
Cleanup of stale entries

Recommendation

Implement time-windowed metrics (e.g., 1-minute buckets)
Add Prometheus-compatible export
Periodic cleanup of entries older than retention window
Aggregate by provider, model, and status code, not just IP

## Severity: Medium ## Location `crates/hero_aibroker_lib/src/middleware/metrics.rs` ## Finding The metrics middleware tracks per-IP request counts and error rates: ```rust pub struct Metrics { requests: DashMap<IpAddr, AtomicU64>, errors: DashMap<IpAddr, AtomicU64>, } ``` Like the rate limiter, this grows without bound. There is no: - Retention policy - Aggregation into time windows - Export mechanism (just in-memory counters) - Cleanup of stale entries ## Recommendation - Implement time-windowed metrics (e.g., 1-minute buckets) - Add Prometheus-compatible export - Periodic cleanup of entries older than retention window - Aggregate by provider, model, and status code, not just IP