@jrpool/kilotest 47.0.1 → 49.0.0

package/web/ai0BalanceForm/ai0BalanceForm.test.ts

@@ -44,22 +44,28 @@ after(async () => {
 
 // TESTS
 
-test('ai0BalanceForm displays the current balance when no newBalance is submitted', async () => {
-  const result: any = await answer(null, '');
+test('ai0BalanceForm displays the current balance on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
   assert.ok(html.querySelector('title'));
 });
 
-test('ai0BalanceForm returns an error for an invalid auth code', async () => {
-  const result: any = await answer(null, 'authCode=wrong&newBalance=5.00');
+test('ai0BalanceForm ignores a newBalance query string on a GET request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=99.00', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(!result.answerPage.includes('$99 is the'));
+});
+
+test('ai0BalanceForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong&newBalance=5.00', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('ai0BalanceForm records a valid new balance with valid auth code', async () => {
-  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=2.50');
+test('ai0BalanceForm records a valid new balance with valid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=2.50', 'POST');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage.includes('$2.5 is the'));
   // Verify the file was written.
@@ -67,9 +73,9 @@ test('ai0BalanceForm records a valid new balance with valid auth code', async ()
   assert.equal(data.balance, 2.50);
 });
 
-test('ai0BalanceForm does not record an invalid balance', async () => {
+test('ai0BalanceForm does not record an invalid balance on a POST request', async () => {
   // 150 is out of range (>= 100).
-  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=150');
+  const result: any = await answer(null, 'authCode=test-auth-code&newBalance=150', 'POST');
   assert.equal(result.status, 'ok');
   // The oldBalance should not show the new value.
   assert.ok(!result.answerPage.includes('$150 is the'));
@@ -78,7 +84,7 @@ test('ai0BalanceForm does not record an invalid balance', async () => {
 test('ai0BalanceForm shows no-balance message when balance file is missing', async () => {
   await fs.unlink(balancePath).catch(() => {});
   try {
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'ok');
     assert.ok(result.answerPage.includes('There is no'));
   }

package/web/ai0BalanceForm/index.html

@@ -15,7 +15,7 @@
       <h1><a href="/">Kilotest</a>: Record AI service 0 balance</h1>
       <p>__oldBalance__ recorded AI service 0 balance.</p>
       <p>The current AI service 0 balance is available on the <a href="https://platform.claude.com/settings/billing">Claude Platform Billing page</a>.</p>
-      <form action="/ai0BalanceForm.html">
+      <form action="/ai0BalanceForm.html" method="post">
         <p><label>
           Balance (in $):
           <input type="number" size="5" min="0" max="99.99" step="0.01" name="newBalance" required>

package/web/ai0BalanceForm/index.ts

@@ -11,14 +11,16 @@ import {getJSON, populateTemplate} from '../../util.ts';
 
 // FUNCTIONS
 
-// Returns a form for recording the AI service 0 balance.
-export const answer = async (_: any, search: string) => {
+// Returns a form for recording the AI service 0 balance. A GET request never processes a
+// submission, regardless of its query string; only a POST request (the form's own
+// submission) does.
+export const answer = async (_: any, search: string, method: string) => {
   const searchParams = new URLSearchParams(search);
   const authCode = searchParams?.get('authCode');
   const newBalanceString = searchParams?.get('newBalance');
   let oldBalance: any;
-  // If the form displayed itself:
-  if (newBalanceString) {
+  // If the form has been submitted:
+  if (method === 'POST' && newBalanceString) {
     // If the authorization code is valid:
     if (authCode === process.env.AUTH_CODE) {
       const newBalance = Number.parseFloat(newBalanceString);
@@ -40,10 +42,12 @@ export const answer = async (_: any, search: string) => {
     }
     // Otherwise, i.e. if the authorization code is invalid:
     else {
-      // Report the error.
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
       return {
         status: 'error',
-        message: 'Invalid authorization code'
+        message: 'Invalid request'
       }
     }
   }

package/web/enqueue/index.ts

@@ -48,9 +48,12 @@ export const answer = async (url: string, description: string, authCode: string)
       answerPage
     };
   }
-  // Otherwise, i.e. if the authorization code is invalid, return an error page.
+  // Otherwise, i.e. if the authorization code is invalid, return an error page. The
+  // message is deliberately vague so as not to confirm to an attacker that the
+  // authorization code specifically (as opposed to some other part of the request) is
+  // what was wrong.
   return {
     status: 'error',
-    message: 'Invalid authorization code'
+    message: 'Invalid request'
   };
 };

package/web/expungeReportsForm/expungeReportsForm.test.ts

@@ -35,32 +35,40 @@ after(async () => {
 
 // TESTS
 
-test('expungeReportsForm displays a list of reports when no submission', async () => {
-  const result: any = await answer(null, '');
+test('expungeReportsForm displays a list of reports on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
   assert.ok(html.querySelector('title'));
 });
 
-test('expungeReportsForm returns an error for an invalid auth code', async () => {
-  const result: any = await answer(null, 'authCode=wrong&report=260101T0001-ct');
+test('expungeReportsForm ignores a report query string on a GET request', async () => {
+  const reportPath = path.join(reportsPath(), '260101T0001-ct.json');
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0001-ct', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been deleted by a mere GET request.
+  await fs.access(reportPath);
+});
+
+test('expungeReportsForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong&report=260101T0001-ct', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('expungeReportsForm returns an error when deleting a nonexistent report', async () => {
-  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('expungeReportsForm returns an error when deleting a nonexistent report on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message.includes('Deleting sole reports'));
 });
 
-test('expungeReportsForm deletes a sole report with valid auth code', async () => {
+test('expungeReportsForm deletes a sole report with valid auth code on a POST request', async () => {
   // 260101T0001-ct is the only report for its URL (canttell).
   const reportPath = path.join(reportsPath(), '260101T0001-ct.json');
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
-    const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0001-ct');
+    const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0001-ct', 'POST');
     assert.equal(result.status, 'ok');
     await fs.access(reportPath).then(
       () => {throw new Error('Report should have been deleted');},
@@ -77,7 +85,7 @@ test('expungeReportsForm returns an error when a report file is corrupt', async
   const backup = await fs.readFile(reportPath, 'utf8');
   try {
     await fs.writeFile(reportPath, 'not valid json');
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'error');
   }
   finally {
@@ -100,7 +108,7 @@ test('expungeReportsForm shows no-deletable message when every URL has at least
   process.env.DB_DIR = tmpDir;
   try {
     const {answer} = await import('./index.ts');
-    const result: any = await answer(null, '');
+    const result: any = await answer(null, '', 'GET');
     assert.equal(result.status, 'ok');
     assert.ok(result.answerPage.includes('no reports to delete'));
     assert.ok(result.answerPage.includes('disabled'));

package/web/expungeReportsForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Expunge reports</h1>
       <p>__intro__</p>
-      <form action="/expungeReportsForm.html">
+      <form action="/expungeReportsForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__

package/web/expungeReportsForm/index.ts

@@ -10,7 +10,7 @@ import {reportDeletionForm} from '../reportDeletion.ts';
 // FUNCTIONS
 
 // Returns a form for deleting sole reports.
-export const answer = async (_: any, search: string) => reportDeletionForm(import.meta.dirname, search, {
+export const answer = async (_: any, search: string, method: string) => reportDeletionForm(import.meta.dirname, search, method, {
   intro: 'Choose the sole reports to delete.',
   emptyIntro: 'Each target has at least 2 reports, so there are no reports to delete.',
   failurePrefix: 'Deleting sole reports failed',

package/web/hideReportForm/hideReportForm.test.ts

@@ -44,8 +44,8 @@ after(async () => {
 
 // TESTS
 
-test('hideReportForm displays a list of reports when no submission', async () => {
-  const result: any = await answer(null, '');
+test('hideReportForm displays a list of reports on a GET request', async () => {
+  const result: any = await answer(null, '', 'GET');
   assert.equal(result.status, 'ok');
   assert.ok(result.answerPage);
   const html = parse(result.answerPage);
@@ -53,13 +53,28 @@ test('hideReportForm displays a list of reports when no submission', async () =>
   assert.ok(radios.length > 0);
 });
 
-test('hideReportForm returns an error for an invalid auth code', async () => {
-  const result: any = await answer(null, 'authCode=wrong&report=260101T0009-brd');
+test('hideReportForm ignores a report query string on a GET request', async () => {
+  const reportPath = path.join(reportsPath(), '260101T0009-brd.json');
+  const hiddenPath = path.join(hiddenReportsPath(), '260101T0009-brd.json');
+  try {
+    await fs.rename(hiddenPath, reportPath);
+  }
+  catch {
+    // Report may already be in reports.
+  }
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0009-brd', 'GET');
+  assert.equal(result.status, 'ok');
+  // The report should NOT have been hidden by a mere GET request.
+  await fs.access(reportPath);
+});
+
+test('hideReportForm returns an error for an invalid auth code on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=wrong&report=260101T0009-brd', 'POST');
   assert.equal(result.status, 'error');
-  assert.equal(result.message, 'Invalid authorization code');
+  assert.equal(result.message, 'Invalid request');
 });
 
-test('hideReportForm hides a report with valid auth code', async () => {
+test('hideReportForm hides a report with valid auth code on a POST request', async () => {
   const reportPath = path.join(reportsPath(), '260101T0009-brd.json');
   const hiddenPath = path.join(hiddenReportsPath(), '260101T0009-brd.json');
   // Ensure the report exists in reports and not in hidden.
@@ -69,14 +84,14 @@ test('hideReportForm hides a report with valid auth code', async () => {
   catch {
     // Report may already be in reports.
   }
-  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0009-brd');
+  const result: any = await answer(null, 'authCode=test-auth-code&report=260101T0009-brd', 'POST');
   assert.equal(result.status, 'ok');
   // The report should now be in the hidden directory.
   await fs.access(hiddenPath);
 });
 
-test('hideReportForm returns an error when hiding a nonexistent report', async () => {
-  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope');
+test('hideReportForm returns an error when hiding a nonexistent report on a POST request', async () => {
+  const result: any = await answer(null, 'authCode=test-auth-code&report=999999T9999-nope', 'POST');
   assert.equal(result.status, 'error');
   assert.ok(result.message.includes('Hiding report'));
 });

package/web/hideReportForm/index.html

@@ -14,7 +14,7 @@
     <main>
       <h1><a href="/">Kilotest</a>: Classify report as experimental</h1>
       <p>Choose a report to classify as experimental.</p>
-      <form action="/hideReportForm.html">
+      <form action="/hideReportForm.html" method="post">
         <fieldset>
           <legend>Reports</legend>
           __reports__

package/web/hideReportForm/index.ts

@@ -11,13 +11,14 @@ import path from 'node:path';
 
 // FUNCTIONS
 
-// Returns a form for hiding a report.
-export const answer = async (_: any, search: string) => {
+// Returns a form for hiding a report. A GET request never processes a submission,
+// regardless of its query string; only a POST request (the form's own submission) does.
+export const answer = async (_: any, search: string, method: string) => {
   const searchParams = new URLSearchParams(search);
   const authCode = searchParams?.get('authCode');
   const jobName = searchParams?.get('report');
-  // If the form has been displayed by itself after a submission and a report is to be hidden:
-  if (jobName) {
+  // If the form has been submitted and a report is to be hidden:
+  if (method === 'POST' && jobName) {
     // If the authorization code is valid:
     if (authCode === process.env.AUTH_CODE) {
       const fileName = `${jobName}.json`;
@@ -36,10 +37,12 @@ export const answer = async (_: any, search: string) => {
     }
     // Otherwise, i.e. if the authorization code is invalid:
     else {
-      // Report the error.
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
       return {
         status: 'error',
-        message: 'Invalid authorization code'
+        message: 'Invalid request'
       }
     }
   }

package/web/listReports/index.ts

@@ -15,7 +15,6 @@ import {
   getTestRequests,
   getReportData,
   getReportExtracts,
-  getRequestability,
   jobsPath,
   objectSort,
   populateTemplate
@@ -35,14 +34,14 @@ const populateQuery = async (query: Record<string, any>) => {
     tested: []
   };
   // Get the test requests.
-  const testRequests = await getTestRequests() as Record<string, {description: string, why: string}[]>;
+  const testRequests = await getTestRequests();
   // For each requested URL:
   Object.keys(testRequests).forEach(url => {
     // For each of its requests:
     testRequests[url]!.forEach((req: any) => {
-      const {description, why} = req;
+      const {description, reason} = req;
       // Add a line.
-      lines.requests.push(`${margin}<li><code>${url}</code> (${description}): ${why}</li>`);
+      lines.requests.push(`${margin}<li><code>${url}</code> (${description}): ${reason}</li>`);
     });
   });
   // Sort the lines in alphabetical order by URL and secondarily by proposed name.
@@ -55,12 +54,29 @@ const populateQuery = async (query: Record<string, any>) => {
   : 'No requests await approval now.';
   // Get the file names of all queued and claimed jobs.
   const jobFileNames = await getJobNames();
+  // Initialize sets of the page descriptions and URLs of jobs in both categories.
+  const jobsData = {
+    queue: {
+      descriptions: new Set(),
+      urls: new Set()
+    },
+    claimed: {
+      descriptions: new Set(),
+      urls: new Set()
+    }
+  };
   // For each job category:
   for (const category of ['queue', 'claimed'] as const) {
     // For each job in the category:
     for (const fileName of jobFileNames[category]) {
       // Get the job.
       const job = await getObject(path.join(jobsPath(), category, fileName)) as {target: {url: string, what: string}};
+      // Get the description and URL of its page.
+      const {target} = job;
+      const {what, url} = target;
+      // Ensure they are in the sets of properties of the category.
+      jobsData[category].descriptions.add(what);
+      jobsData[category].urls.add(url);
       // Add a line.
       lines[category].push(`${margin}<li><code>${job.target.url}</code> (${job.target.what})</li>`);
     }
@@ -84,7 +100,7 @@ const populateQuery = async (query: Record<string, any>) => {
   sortedExtracts = objectSort(sortedExtracts, 'description', 'alpha');
   // For each report:
   for (const extract of sortedExtracts) {
-    const {jobID, timeStamp, url, description} = extract;
+    const {jobID, timeStamp, url, description, superseded} = extract;
     // Get data about it.
     const reportData = await getReportData(timeStamp, jobID);
     // If this failed:
@@ -145,21 +161,26 @@ const populateQuery = async (query: Record<string, any>) => {
       const link = `<a ${href} ${label}>What ${questionString}?</a>`;
       lines.tested.push(`${margin}    <li>${link}</li>`);
     }
-    // Add the status of, and if necessary a question link about, retesting to the lines.
-    const status = await getRequestability(url);
-    let retestString: string;
-    if (status === 'claimed') {
+    let retestString: string = '';
+    // If a page with the same description or URL is being tested:
+    if (jobsData.claimed.descriptions.has(description) || jobsData.claimed.urls.has(url)) {
+      // Report this.
       retestString = 'Currently being retested';
     }
-    else if (status === 'queued') {
+    // Otherwise, if such a page is queued:
+    else if (jobsData.queue.descriptions.has(description) || jobsData.queue.urls.has(url)) {
       retestString = 'Currently in the queue for retesting';
     }
-    else {
+    // Otherwise, if no such page is being tested or queued and the report is not superseded:
+    else if (!superseded) {
+      // Make the page available for retesting.
       const href = `/requestRetestForm.html/${timeStamp}/${jobID}`;
       const retestContent = 'Should Kilotest retest the page?';
       retestString = `<a href="${href}">${retestContent}</a>`;
     }
-    lines.tested.push(`${margin}    <li>${retestString}</li>`);
+    if (retestString) {
+      lines.tested.push(`${margin}    <li>${retestString}</li>`);
+    }
     lines.tested.push(`${margin}  </ul>`);
     lines.tested.push(`${margin}</details>`);
   }

package/web/listReports/listReports.test.ts

@@ -95,7 +95,7 @@ test('listReports shows requests when testRequests.json has entries', {timeout:
   try {
     const testRequests = {
       'https://example.com/mixed': [
-        {description: 'Mixed Outcomes Page', why: 'Needs retesting for accessibility'}
+        {description: 'Mixed Outcomes Page', reason: 'Needs retesting for accessibility'}
       ]
     };
     await fs.writeFile(testRequestsPath, JSON.stringify(testRequests, null, 2));

package/web/listTopIssues/index.ts

@@ -79,7 +79,7 @@ const getIssuesSummary = async () => {
       // Report this.
       console.log(`ERROR: Annotations obsolete for issue ${issueID}; reannotate`);
       // Notify a manager.
-      sendAlert('Annotations obsolete', `Annotations for issue ${issueID} obsolete; reannotate.`);
+      sendAlert('Kilotest: Annotations obsolete', `Annotations for issue ${issueID} obsolete; reannotate.`);
     }
   });
   // For each summarized issue:

package/web/manage/index.html

@@ -23,9 +23,10 @@
         <li><a href="/rewindReportsForm.html">Delete latest superseding reports</a></li>
         <li><a href="/expungeReportsForm.html">Delete sole reports</a></li>
         <li><a href="/hideReportForm.html">Classify a report as experimental</a></li>
-        <li><a href="/unhideReportForm.html">Declassify a report as experimental</a></li>
+        <li><a href="/showHiddenReportsForm.html">View the list of experimental reports</a></li>
         <li><a href="/ai0BalanceForm.html">Record the current balance of AI service 0</a></li>
         <li><a href="/renewWCAGForm.html">Renew the map of WCAG numeric to text identifiers</a></li>
+        <li><a href="/metrics.html">View usage metrics</a></li>
       </ul>
     </main>
   </body>

package/web/metrics/index.html

@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="publisher" content="Jonathan Robert Pool">
+    <meta name="creator" content="Jonathan Robert Pool">
+    <meta name="keywords" content="report,accessibility,a11y">
+    <title>Usage metrics | Kilotest</title>
+    <link rel="icon" href="/favicon.ico">
+    <link rel="stylesheet" href="/style.css">
+  </head>
+  <body>
+    <main>
+      <h1><a href="/">Kilotest</a>: Usage metrics</h1>
+      __body__
+    </main>
+  </body>
+</html>

package/web/metrics/index.ts

@@ -0,0 +1,126 @@
+/*
+  index.ts
+  Serves usage metrics for the maintainer: web page views, MCP tool calls, and API
+  operation calls, each broken down by name, recorded since a given date and time.
+*/
+
+// IMPORTS
+
+import {
+  clearMetrics, getDateTimeString, getExclusionCookieValue, getMetrics, metricsExclusionCookieName, populateTemplate
+} from '../../util.ts';
+
+// FUNCTIONS
+
+// Returns an HTML table of the counts in a metrics category, sorted by descending count.
+const getCategoryTable = (counts: Record<string, number>): string => {
+  const margin = ' '.repeat(6);
+  const names = Object.keys(counts).sort((a, b) => counts[b]! - counts[a]!);
+  if (!names.length) {
+    return `${margin}<p>None yet.</p>`;
+  }
+  const rows = names.map(name => `${margin}    <tr><td>${name}</td><td>${counts[name]}</td></tr>`);
+  return [
+    `${margin}<table class="allBorder">`,
+    `${margin}  <thead>`,
+    `${margin}    <tr><th>Name</th><th>Count</th></tr>`,
+    `${margin}  </thead>`,
+    `${margin}  <tbody>`,
+    ...rows,
+    `${margin}  </tbody>`,
+    `${margin}</table>`
+  ].join('\n');
+};
+// Returns an HTML table of manager-page activity, sorted by descending failure count,
+// since repeated failures are the signal of suspected abuse most worth surfacing first.
+const getManagerActivityTable = (activity: Record<string, {ok: number; error: number}>): string => {
+  const margin = ' '.repeat(6);
+  const names = Object.keys(activity).sort((a, b) => activity[b]!.error - activity[a]!.error);
+  if (!names.length) {
+    return `${margin}<p>None yet.</p>`;
+  }
+  const rows = names.map(name => {
+    const {ok, error} = activity[name]!;
+    return `${margin}    <tr><td>${name}</td><td>${ok}</td><td>${error}</td></tr>`;
+  });
+  return [
+    `${margin}<table class="allBorder">`,
+    `${margin}  <thead>`,
+    `${margin}    <tr><th>Name</th><th>Successful</th><th>Failed</th></tr>`,
+    `${margin}  </thead>`,
+    `${margin}  <tbody>`,
+    ...rows,
+    `${margin}  </tbody>`,
+    `${margin}</table>`
+  ].join('\n');
+};
+// Returns a page reporting usage metrics, or, if the form has not been submitted (a POST
+// request) yet, a form requesting an authorization code. A GET request, regardless of its
+// query string, never processes a submission, so the action cannot be triggered by GET.
+export const answer = async (_: any, search: string, method: string) => {
+  const searchParams = new URLSearchParams(search);
+  const authCode = searchParams?.get('authCode');
+  let query: Record<string, string>;
+  // If the form has been submitted:
+  if (method === 'POST') {
+    // If the authorization code is invalid:
+    if (authCode !== process.env.AUTH_CODE) {
+      // Report the error, deliberately vague so as not to confirm to an attacker that the
+      // authorization code specifically (as opposed to some other part of the request) is
+      // what was wrong.
+      return {
+        status: 'error',
+        message: 'Invalid request'
+      };
+    }
+    // If clearing the counts was requested:
+    const clearCounts = searchParams.has('clearCounts');
+    const metrics = clearCounts ? await clearMetrics() : await getMetrics();
+    query = {
+      body: [
+        ...(clearCounts ? ['<p>Counts cleared.</p>'] : []),
+        `<p>Counts recorded since ${getDateTimeString(metrics.since)}.</p>`,
+        '<h2>Web page views</h2>',
+        getCategoryTable(metrics.pageViews),
+        '<h2>MCP tool calls</h2>',
+        getCategoryTable(metrics.mcpToolCalls),
+        '<h2>API operation calls</h2>',
+        getCategoryTable(metrics.apiOperations),
+        '<h2>Manager page activity</h2>',
+        '<p>Manager-only pages (linked from <a href="/manage.html">management</a>), excluded from the web page views above. A high failed count for a page may indicate a suspected attack, such as repeated guessing of the authorization code.</p>',
+        getManagerActivityTable(metrics.managerActivity)
+      ].join('\n')
+    };
+  }
+  // Otherwise, i.e. if the form has not been submitted yet:
+  else {
+    query = {
+      body: [
+        '<form action="/metrics.html" method="post">',
+        '  <p><label>',
+        '    Authorization code: <input size="3" minlength="3" maxlength="3" name="authCode" required>',
+        '  </label></p>',
+        '  <p><label><input type="checkbox" name="clearCounts"> Clear counts</label></p>',
+        '  <p><button type="submit">Submit</button></p>',
+        '</form>'
+      ].join('\n')
+    };
+  }
+  // Get the populated template.
+  const answerPage = await populateTemplate(import.meta.dirname, query);
+  // Return the populated page. Submitting a valid authCode also sets a cookie that
+  // excludes this browser's future page views and API calls from usage metrics, on the
+  // premise that a maintainer who has just proven their identity here is very likely the
+  // same person about to manually browse and test the rest of Kilotest.
+  return {
+    status: 'ok',
+    answerPage,
+    ...(method === 'POST' && {
+      setCookie: {
+        name: metricsExclusionCookieName,
+        value: getExclusionCookieValue(),
+        maxAgeSeconds: 30 * 24 * 60 * 60
+      }
+    })
+  };
+};