[UT] Align BE handler auth test with AuthN-only probes; add getFeMetrics FE coverage

- BE: update handler_required_privilege_test probe/prometheus case to the AuthN-only
  contract (need_auth()==true, required_privilege()==NONE). The old _skip_framework_auth
  assertions broke after the probe handlers were flipped to need_auth()==true.
- BE: drop the now-redundant observability_probes_are_authn_only from metrics_action_test
  (handler_required_privilege_test is the canonical handler-auth test) and its unused includes.
- FE: add FrontendServiceImplTest.testGetFeMetrics covering getFeMetrics, the previously
  uncovered method that dragged FE incremental coverage below the threshold.

Signed-off-by: atman <11624213+iatman@users.noreply.github.com>

Author: iatman

be/test/http/handler_required_privilege_test.cpp

@@ -194,10 +194,16 @@ TEST(BeHandlerNeedAuthTest, download_action_error_log_requires_framework_auth) {
     EXPECT_TRUE(error_log.need_auth());
 }
 
-TEST(BeHandlerNeedAuthTest, probe_and_prometheus_endpoints_skip_framework_auth) {
-    EXPECT_FALSE(HealthAction(nullptr).need_auth());
-    EXPECT_FALSE(MetricsAction(nullptr).need_auth());
-    EXPECT_FALSE(MemoryMetricsAction(fake_global_env()).need_auth());
+// Probe / Prometheus endpoints (/api/health, /metrics, /metrics/memory) are AuthN-only:
+// historically anonymous, now gated by `config::enable_http_auth` -- need_auth() == true
+// (the injected verifier short-circuits when the flag is off) with no extra privilege.
+TEST(BeHandlerNeedAuthTest, probe_and_prometheus_endpoints_are_authn_only) {
+    EXPECT_TRUE(HealthAction(nullptr).need_auth());
+    EXPECT_EQ(Priv::NONE, HealthAction(nullptr).required_privilege());
+    EXPECT_TRUE(MetricsAction(nullptr).need_auth());
+    EXPECT_EQ(Priv::NONE, MetricsAction(nullptr).required_privilege());
+    EXPECT_TRUE(MemoryMetricsAction(fake_global_env()).need_auth());
+    EXPECT_EQ(Priv::NONE, MemoryMetricsAction(fake_global_env()).required_privilege());
 }
 
 TEST(BeHandlerNeedAuthTest, stream_load_uses_builtin_fe_auth_flow) {

be/test/http/metrics_action_test.cpp

@@ -39,12 +39,9 @@
 #include "base/metrics.h"
 #include "common/config_metrics_fwd.h"
 #include "common/metrics/process_metrics_registry.h"
-#include "http/action/health_action.h"
-#include "http/action/memory_metrics_action.h"
 #include "http/http_channel.h"
 #include "http/http_request.h"
 #include "http/http_response.h"
-#include "runtime/env/global_env.h"
 #ifdef USE_STAROS
 #include "metrics/metrics.h"
 #endif
@@ -155,25 +152,6 @@ TEST_F(MetricsActionTest, prometheus_no_name) {
     action.handle(&request);
 }
 
-// The public observability probes (`/metrics`, `/api/health`, `/metrics/memory`) are now
-// in the `enable_http_auth` scope at AuthN-only level: they require Basic identity (the
-// injected verifier short-circuits when the flag is off) but declare no extra privilege,
-// so identity alone is sufficient.
-TEST_F(MetricsActionTest, observability_probes_are_authn_only) {
-    ProcessMetricsRegistry registry("test");
-    MetricsAction metrics_action(&registry, &mock_send_reply);
-    EXPECT_TRUE(metrics_action.need_auth());
-    EXPECT_EQ(HttpHandler::RequiredPrivilege::NONE, metrics_action.required_privilege());
-
-    HealthAction health_action(nullptr);
-    EXPECT_TRUE(health_action.need_auth());
-    EXPECT_EQ(HttpHandler::RequiredPrivilege::NONE, health_action.required_privilege());
-
-    MemoryMetricsAction memory_action(*GlobalEnv::GetInstance());
-    EXPECT_TRUE(memory_action.need_auth());
-    EXPECT_EQ(HttpHandler::RequiredPrivilege::NONE, memory_action.required_privilege());
-}
-
 TEST_F(MetricsActionTest, prometheus_output_with_table_metrics) {
     ProcessMetricsRegistry registry("test");
     enable_table_metrics(&registry);

fe/fe-core/src/test/java/com/starrocks/service/FrontendServiceImplTest.java

@@ -67,6 +67,8 @@
 import com.starrocks.thrift.TDescribeTableParams;
 import com.starrocks.thrift.TDescribeTableResult;
 import com.starrocks.thrift.TExecPlanFragmentParams;
+import com.starrocks.thrift.TFeMetricsRequest;
+import com.starrocks.thrift.TFeMetricsResult;
 import com.starrocks.thrift.TFeResult;
 import com.starrocks.thrift.TFileType;
 import com.starrocks.thrift.TGetDictQueryParamRequest;
@@ -212,6 +214,16 @@ public void testMvReportIsCompatibilityNoOp() throws TException {
         Assertions.assertNotNull(response);
     }
 
+    @Test
+    public void testGetFeMetrics() throws TException {
+        // information_schema.fe_metrics is served over this RPC instead of scraping HTTP /metrics.
+        // It returns the same JSON payload as /metrics?type=json with an OK status.
+        FrontendServiceImpl impl = new FrontendServiceImpl(exeEnv);
+        TFeMetricsResult result = impl.getFeMetrics(new TFeMetricsRequest());
+        Assertions.assertEquals(TStatusCode.OK, result.getStatus().getStatus_code());
+        Assertions.assertNotNull(result.getJson_metrics());
+    }
+
     @Test
     public void testCheckAuthRejectsMissingCredentials() throws TException {
         FrontendServiceImpl impl = new FrontendServiceImpl(exeEnv);