Harden admin metrics cohorts/usage aggregation and enforce router-level admin guard

[Copilot]

The metrics follow-up identified cohort inflation, N+1 retention checks, and aggregation memory risk, plus a missing router-level admin guard and a misleading reliability alert comment.

• Admin metrics authorization

  • Apply requireAdmin at the router level so all /api/admin/metrics/* endpoints are covered by default.

• Feature-usage aggregation safety

  • Replace $addToSet-based unique developer tracking with a $facet + $count approach to avoid aggregation memory pressure while preserving totals.

• Reliability alert clarity

  • Align the inline threshold comment with the actual >=20 requests / >=5% error rate logic.

Example (feature-usage aggregation change):

const agg = await DeveloperActivity.aggregate([
  { $match: { date: { $gte: thirtyDaysAgo } } },
  {
    $facet: {
      totals: [{ $group: { _id: null, totalApiCalls: { $sum: '$apiCallCount' } } }],
      activeDevelopers: [{ $group: { _id: '$developerId' } }, { $count: 'count' }],
    },
  },
]);

[Copilot]

Pull request overview

This PR hardens admin metrics endpoints by centralizing admin authorization and reduces feature-usage aggregation memory risk while clarifying reliability alert documentation.

Changes:

• Applies authMiddleware and requireAdmin at the admin metrics router level.
• Converts feature-usage unique developer counting to a $facet with $count.
• Updates the reliability alert comment to match the actual >=5% threshold.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
apps/dashboard-api/src/routes/admin.metrics.js	Adds router-level authentication and admin middleware for all metrics routes.
apps/dashboard-api/src/controllers/admin.metrics.controller.js	Exports requireAdmin as middleware and updates feature-usage aggregation.
packages/common/src/queues/reliabilityAlertQueue.js	Corrects the reliability threshold comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[yash-pouranik]

@coderabbitai
ok to merge??

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check PR status, reviews, checks, and open comments
gh pr view 167 --repo geturbackend/urBackend --json state,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,reviews,comments

echo "---REVIEW THREADS---"
gh api repos/geturbackend/urBackend/pulls/167/reviews

echo "---CHECK RUNS---"
gh pr checks 167 --repo geturbackend/urBackend

echo "---OPEN REVIEW COMMENTS---"
gh api repos/geturbackend/urBackend/pulls/167/comments --jq '[.[] | {id, path, body, position, user: .user.login, resolved: (.position == null)}]'

Length of output: 8918

---

@yash-pouranik Here's the current status of PR #167:

✅ All Clear

Check	Status
Merge conflicts	✅ None (CLEAN)
CI — dashboard-api-tests	✅ Pass
CI — public-api-tests	✅ Pass
CI — sdk-tests	✅ Pass
CI — python-sdk-tests	✅ Pass
CI — frontend-lint	✅ Pass
CodeQL / JS-TS analysis	✅ Pass
Open review threads	✅ None
Copilot review	✅ No issues found (3/3 files reviewed)

⚠️ One thing to note

There is no formal human approval recorded on the PR yet (reviewDecision is unset). If your repository requires an approved review before merging, you'll need to get a team member to approve first.

Otherwise, the PR is technically in great shape — all CI checks pass, no merge conflicts, no unresolved comments, and the three objectives (router-level requireAdmin, $facet aggregation, reliability comment fix) are all addressed. 🚀