bestony 324a491671 feat: extend Server-Timing to authenticated user web APIs ...

Mirror the Admin UI Server-Timing opt-in for user-facing pages so
authenticated callers can inspect total/app/db/redis/deps metrics on
session, profile, keys, usage, payment, and related user APIs.

- Collect when X-User-UI-Request=1 or path is on the user allowlist
- Emit for non-admin only on allowlisted paths (header is not auth)
- Exclude payment public/webhook surfaces
- Mark matching SPA requests and allow the new CORS request header

2026-07-15 00:23:27 +08:00

..

collector_test.go

fix: preserve instrumented client contracts

2026-07-14 01:29:30 +08:00

collector.go

feat: extend Server-Timing to authenticated user web APIs

2026-07-15 00:23:27 +08:00

http_test.go

feat(admin): add opt-in server timing metrics

2026-07-14 01:29:30 +08:00

http.go

feat(admin): add opt-in server timing metrics

2026-07-14 01:29:30 +08:00