Through a Slack discussion we discovered that the current implementation of loki-gateway (observatorium/api) is not correctly enforcing authorization policies on the "/series" endpoint. Allowing to get stream metadata information from any log stream.

This is happens as the "/series" endpoint uses "match" instead of "query" to filter which series metadata should be returned to the request.

observatorium/api should fixed to have into consideration this difference and inherently correctly enforce authorization policies.