RSPEED-3444: fix REST API metrics middleware route discovery and root_path handling

[thepetk]

Description

Fix REST API middleware-level metrics never recording. FastAPI 0.137.0 (fastapi#15745) refactored include_router() to include routers with lazy _IncludedRouter wrapper objects in app.routes instead of copying individual Route instances. The old list comprehension filtered with isinstance(route, (Mount, Route, WebSocketRoute)), which silently drops _IncludedRouter objects — leaving app_routes_paths containing only the 4 built-in FastAPI routes (/openapi.json, /docs, /docs/oauth2-redirect, /redoc). No application route ever matched, so metrics were never
recorded regardless of the root_path setting.

FastAPI was pinned to 0.141.1 in the LCORE-2922 dependency update, merged via PR #2358 / commit 18c0876d.

Additionally, RestApiMetricsMiddleware read root_path from scope.get("root_path", ""). In older versions of FastAPI/Starlette the scope field was never populated by the framework for this use case, so it always returned "", the prefix-stripping logic never activated, and every prefixed path failed to be recorded.

About the fix:

Replaced the route discovery list comprehension with FastAPI's official iter_route_contexts() API (PR fastapi#15785, discussion #15791), which correctly resolves all registered routes including the lazy _IncludedRouter wrappers introduced in 0.137. We also read root_path from app.root_path instead of the ASGI scope, which is the actual source of the configured value. Together these two changes ensure app_routes_paths is fully populated and that proxy-prefixed paths are correctly stripped, so middleware-level metrics record for every API endpoint regardless of deployment configuration.

Type of change

• Refactor
• New feature
• Bug fix
• CVE fix
• Optimization
• Documentation Update
• Configuration Update
• Bump-up service version
• Bump-up dependent library [pyproject.toml + uv.lock]
• Bump-up dependent library [requirements.*.txt for Konflux]
• Bump-up library or tool used for development (does not change the final image)
• CI configuration change
• Konflux configuration change
• Unit tests improvement
• Integration tests improvement
• End to end tests improvement
• Benchmarks improvement

Tools used to create PR

• Assisted-by: Claude Sonnet 4.6
• Generated by: N/A

Related Tickets & Documents

• Related to RSPEED-3444: Partially related
• Fixes [BUG] metrics are never recorded when root_path is configured #2379

Checklist before requesting a review

• I have performed a self-review of my code.
• PR has passed all pre-merge test jobs.
• If it is a core feature, I have added thorough tests.

Testing

To reproduce:

On main:

• Start the service locally with service.root_path: /api/lightspeed configured (that simulates 3scale), then send requests using the full prefixed path the proxy will forward:

GET /api/lightspeed/liveness
GET /api/lightspeed/readiness

• Check /metrics afterwards: ls_rest_api_calls_total should have zero samples despite successful responses. Metrics lke ls_llm_token_sent_total should be recorded cause they are being handled inside the scope of the endpoint.

To verify the fix end-to-end:

After the fix, repeat the same requests. /metrics should show:

ls_rest_api_calls_total{path="/liveness",status_code="200"} 2.0
ls_rest_api_calls_total{path="/readiness",status_code="200"} 1.0

Unit test coverage:

• test_rest_api_metrics_strips_root_path — updated to patch app.root_path directly (scope carries no root_path, matching actual runtime behaviour).
• test_rest_api_metrics_no_root_path_unchanged — unchanged; confirms empty root_path deployments are unaffected.
• test_rest_api_metrics_uses_app_root_path_not_scope — regression test; fails if the middleware is switched back to reading from the scope.
• test_app_routes_paths_contains_application_routes — new; asserts app_routes_paths contains application routes beyond the 4 FastAPI built-ins. Fails if the iter_route_contexts() call is reverted to the old isinstance filter.

Summary by CodeRabbit

• Bug Fixes
  • Improved API metrics path handling when an application is configured with a root path.
  • Metrics now correctly match routes and record request paths, including versioned endpoints such as /v1/infer.
  • Resolved inconsistencies when incoming requests do not include root-path information.

[coderabbitai]

Walkthrough

RestApiMetricsMiddleware now reads the path prefix from app.root_path. Tests verify metrics recording for prefixed requests when the ASGI scope does not contain root_path.

Changes

Root path metrics matching

Layer / File(s)	Summary
Use configured root path for metrics matching src/app/main.py, tests/unit/app/test_main_middleware.py	The middleware uses app.root_path to strip configured prefixes. Tests configure the FastAPI root path, omit the ASGI scope root path, and verify successful /v1/infer metrics recording.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: tisnik, asimurka

🚥 Pre-merge checks | ✅ 7

✅ Passed checks (7 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The change reads app.root_path for prefix stripping and adds regression coverage for prefixed and unprefixed paths, satisfying issue #2379.
Out of Scope Changes check	✅ Passed	All code and test changes directly support the root_path metrics bug fix described in issue #2379.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Performance And Algorithmic Complexity	✅ Passed	The change only replaces one scope lookup with an app attribute lookup; it adds no loops, API calls, parsing, caches, buffers, or list operations.
Security And Secret Handling	✅ Passed	PR changes only trusted app.root_path lookup and tests; it adds no endpoints, secrets, auth changes, injection sinks, sensitive logging, or Kubernetes Secret manifests.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the REST API metrics middleware route discovery and root_path handling fix described in the changes.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

✨ Simplify code

• Create PR with simplified code

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/unit/app/test_main_middleware.py`:
- Around line 253-288: The new test duplicates
test_rest_api_metrics_strips_root_path; remove
test_rest_api_metrics_uses_app_root_path_not_scope or change it to use a
conflicting non-empty scope root_path while keeping fastapi_app.root_path set,
then assert metrics use the application root.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c7065dbc-1fec-44da-9aed-6ca74752b197

📥 Commits

Reviewing files that changed from the base of the PR and between 0c15c15 and 1ebf238.

📒 Files selected for processing (2)

• src/app/main.py
• tests/unit/app/test_main_middleware.py

📜 Review details

⏰ Context from checks skipped due to timeout. (5)

• GitHub Check: E2E: server mode / ci / group 2
• GitHub Check: E2E: library mode / ci / group 1
• GitHub Check: E2E: server mode / ci / group 3
• GitHub Check: E2E: library mode / ci / group 2
• GitHub Check: E2E Tests for Lightspeed Evaluation job

🧰 Additional context used

📓 Path-based instructions (3)

**/*

📄 CodeRabbit inference engine (Custom checks)

**/*: Flag meaningful O(n^2)+ algorithms on non-trivial inputs, including handlers and Kubernetes list operations.
Flag N+1 patterns that list items and then query once per item, including Kubernetes API and database access.
Flag expensive work inside loops, including API calls, JSON parsing, and regex compilation.
Flag unbounded growth in caches, watchers, or buffers when eviction or limits are missing.
Flag missing pagination or limits on list operations and API endpoints.
Flag secrets or tokens logged in plaintext or hardcoded in source.
Flag API endpoints missing authentication or authorization.
Flag injection vulnerabilities, including SQL injection, command injection, and path traversal.
Flag sensitive data leaked in API responses, WebSocket messages, or logs.
Flag Kubernetes Secrets and Red Hat secrets missing OwnerReferences.

Files:

• src/app/main.py
• tests/unit/app/test_main_middleware.py

src/**/*.py

📄 CodeRabbit inference engine (AGENTS.md)

src/**/*.py: Use absolute imports for internal modules and follow the prescribed FastAPI and Llama Stack import conventions.
All modules must begin with descriptive docstrings; use logger = get_logger(__name__) from log.py for module logging; package __init__.py files must contain brief package descriptions.
Define shared constants in the central constants.py module, add descriptive comments, and annotate constants with Final[type].
Use complete type annotations for function parameters, return types, class attributes, and type aliases; prefer specific types over Any, use modern union syntax, and use typing_extensions.Self for model validators.
All functions and classes require descriptive Google-style docstrings, including appropriate Parameters, Returns, Raises, and Attributes sections.
Use descriptive snake_case, action-oriented function names such as get_, validate_, and check_; use PascalCase class names with standard suffixes such as Configuration, Error/Exception, Resolver, and Interface.
Avoid modifying input parameters in place; return a newly constructed data structure instead.
Use async def for I/O operations and external API calls; API endpoints should raise FastAPI HTTPException with appropriate status codes and handle Llama Stack APIConnectionError.
Use from log import get_logger and standard logger levels: debug for diagnostics, info for general execution, warning for unexpected conditions or potential problems, and error for serious failures.
Configuration models must extend ConfigurationBase, set extra="forbid" to reject unknown fields, use Pydantic validators for custom validation, and use types such as Optional[FilePath], PositiveInt, and SecretStr where appropriate.
Abstract interfaces must use ABC and @abstractmethod decorators.
Never commit secrets or keys; use environment variables for sensitive data.

Files:

• src/app/main.py

tests/unit/**/*.py

📄 CodeRabbit inference engine (AGENTS.md)

Use pytest for unit tests, shared fixtures in conftest.py, pytest-mock for mocks, pytest.mark.asyncio for async tests, and maintain at least 60% unit-test coverage.

Files:

• tests/unit/app/test_main_middleware.py

🧠 Learnings (3)

📚 Learning: 2026-06-24T13:45:37.249Z

Learnt from: Jdubrick
Repo: lightspeed-core/lightspeed-stack PR: 1971
File: src/utils/markdown_repair.py:31-36
Timestamp: 2026-06-24T13:45:37.249Z
Learning: In the lightspeed-stack repository, docstrings must use the section header name "Parameters:" (not "Args:") for function arguments, even if the project references Google Python docstring conventions. Ensure docstrings follow the project’s established "Parameters:" header format for any documented function parameters.

Applied to files:

• src/app/main.py
• tests/unit/app/test_main_middleware.py

📚 Learning: 2026-07-06T15:26:18.398Z

Learnt from: Jdubrick
Repo: lightspeed-core/lightspeed-stack PR: 2071
File: src/models/config.py:2416-2422
Timestamp: 2026-07-06T15:26:18.398Z
Learning: In this repo’s Python code under src/**, don’t treat differences in string concatenation style as a style inconsistency when Black has effectively forced (or made clearer) use of explicit `+` string concatenation in multi-line logger/string expressions. If adjacent-literal implicit concatenation is avoided/changed specifically to accommodate Black’s formatting in these call sites, accept the `+` usage and don’t recommend converting it solely for consistency with nearby blocks that use implicit concatenation.

Applied to files:

• src/app/main.py

📚 Learning: 2026-07-17T19:25:05.325Z

Learnt from: Jdubrick
Repo: lightspeed-core/lightspeed-stack PR: 2166
File: src/utils/saved_prompts.py:129-157
Timestamp: 2026-07-17T19:25:05.325Z
Learning: For any endpoint that handles saved prompts and calls `src/utils/saved_prompts.py::create_saved_prompt`, treat the endpoint as the validation boundary. Before calling `create_saved_prompt`, validate the incoming saved-prompt name and content, specifically using `validate_saved_prompt_name` and then persist (store) the normalized value it returns. Do not call `create_saved_prompt` with unvalidated/raw name/content.

Applied to files:

• src/app/main.py

🔇 Additional comments (3)

src/app/main.py (1)

215-215: LGTM!

tests/unit/app/test_main_middleware.py (2)

12-18: LGTM!

---

198-198: LGTM!

Also applies to: 211-213

[thepetk]

Will mark it again as "ready for review" once I complete a final round of tests

[thepetk]

I see the same failures in many different PRs currently opened. I don't believe they are related to my changes tbh.

[thepetk]

Will mark it again as "ready for review" once I complete a final round of tests

PR updated. Was able to reproduce and verify the fix works