feat(authz): register config and return error on cleanup failure

ee/authz/openfgaauthz/provider.go

@@ -20,11 +20,13 @@ import (
 )
 
 type provider struct {
+	config          authz.Config
 	pkgAuthzService authz.AuthZ
 	openfgaServer   *openfgaserver.Server
 	licensing       licensing.Licensing
 	store           authtypes.RoleStore
 	registry        []authz.RegisterTypeable
+	settings        factory.ScopedProviderSettings
 }
 
 func NewProviderFactory(sqlstore sqlstore.SQLStore, openfgaSchema []openfgapkgtransformer.ModuleFile, openfgaDataStore storage.OpenFGADatastore, licensing licensing.Licensing, registry ...authz.RegisterTypeable) factory.ProviderFactory[authz.AuthZ, authz.Config] {
@@ -45,12 +47,16 @@ func newOpenfgaProvider(ctx context.Context, settings factory.ProviderSettings,
 		return nil, err
 	}
 
+	scopedSettings := factory.NewScopedProviderSettings(settings, "github.com/SigNoz/signoz/ee/authz/openfgaauthz")
+
 	return &provider{
+		config:          config,
 		pkgAuthzService: pkgAuthzService,
 		openfgaServer:   openfgaServer,
 		licensing:       licensing,
 		store:           sqlauthzstore.NewSqlAuthzStore(sqlstore),
 		registry:        registry,
+		settings:        scopedSettings,
 	}, nil
 }
 
@@ -78,14 +84,18 @@ func (provider *provider) BatchCheck(ctx context.Context, tupleReq map[string]*o
 	return provider.openfgaServer.BatchCheck(ctx, tupleReq)
 }
 
-func (provider *provider) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, typeable authtypes.Typeable) ([]*authtypes.Object, error) {
-	return provider.openfgaServer.ListObjects(ctx, subject, relation, typeable)
+func (provider *provider) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, objectType authtypes.Type) ([]*authtypes.Object, error) {
+	return provider.openfgaServer.ListObjects(ctx, subject, relation, objectType)
 }
 
 func (provider *provider) Write(ctx context.Context, additions []*openfgav1.TupleKey, deletions []*openfgav1.TupleKey) error {
 	return provider.openfgaServer.Write(ctx, additions, deletions)
 }
 
+func (provider *provider) ReadTuples(ctx context.Context, tupleKey *openfgav1.ReadRequestTupleKey) ([]*openfgav1.TupleKey, error) {
+	return provider.openfgaServer.ReadTuples(ctx, tupleKey)
+}
+
 func (provider *provider) Get(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*authtypes.Role, error) {
 	return provider.pkgAuthzService.Get(ctx, orgID, id)
 }
@@ -146,7 +156,7 @@ func (provider *provider) Create(ctx context.Context, orgID valuer.UUID, role *a
 		return errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
 	}
 
-	return provider.store.Create(ctx, authtypes.NewStorableRoleFromRole(role))
+	return provider.store.Create(ctx, role)
 }
 
 func (provider *provider) GetOrCreate(ctx context.Context, orgID valuer.UUID, role *authtypes.Role) (*authtypes.Role, error) {
@@ -163,10 +173,10 @@ func (provider *provider) GetOrCreate(ctx context.Context, orgID valuer.UUID, ro
 	}
 
 	if existingRole != nil {
-		return authtypes.NewRoleFromStorableRole(existingRole), nil
+		return existingRole, nil
 	}
 
-	err = provider.store.Create(ctx, authtypes.NewStorableRoleFromRole(role))
+	err = provider.store.Create(ctx, role)
 	if err != nil {
 		return nil, err
 	}
@@ -175,14 +185,13 @@ func (provider *provider) GetOrCreate(ctx context.Context, orgID valuer.UUID, ro
 }
 
 func (provider *provider) GetResources(_ context.Context) []*authtypes.Resource {
-	typeables := make([]authtypes.Typeable, 0)
-	for _, register := range provider.registry {
-		typeables = append(typeables, register.MustGetTypeables()...)
-	}
-
-	typeables = append(typeables, provider.MustGetTypeables()...)
 	resources := make([]*authtypes.Resource, 0)
-	for _, typeable := range typeables {
+	for _, register := range provider.registry {
+		for _, typeable := range register.MustGetTypeables() {
+			resources = append(resources, &authtypes.Resource{Name: typeable.Name(), Type: typeable.Type()})
+		}
+	}
+	for _, typeable := range provider.MustGetTypeables() {
 		resources = append(resources, &authtypes.Resource{Name: typeable.Name(), Type: typeable.Type()})
 	}
 
@@ -201,21 +210,23 @@ func (provider *provider) GetObjects(ctx context.Context, orgID valuer.UUID, id
 	}
 
 	objects := make([]*authtypes.Object, 0)
-	for _, resource := range provider.GetResources(ctx) {
-		if slices.Contains(authtypes.TypeableRelations[resource.Type], relation) {
-			resourceObjects, err := provider.
-				ListObjects(
-					ctx,
-					authtypes.MustNewSubject(authtypes.TypeableRole, storableRole.Name, orgID, &authtypes.RelationAssignee),
-					relation,
-					authtypes.MustNewTypeableFromType(resource.Type, resource.Name),
-				)
-			if err != nil {
-				return nil, err
-			}
-
-			objects = append(objects, resourceObjects...)
+	for _, objectType := range provider.getUniqueTypes() {
+		if !slices.Contains(authtypes.TypeableRelations[objectType], relation) {
+			continue
 		}
+
+		resourceObjects, err := provider.
+			ListObjects(
+				ctx,
+				authtypes.MustNewSubject(authtypes.TypeableRole, storableRole.Name, orgID, &authtypes.RelationAssignee),
+				relation,
+				objectType,
+			)
+		if err != nil {
+			return nil, err
+		}
+
+		objects = append(objects, resourceObjects...)
 	}
 
 	return objects, nil
@@ -227,7 +238,7 @@ func (provider *provider) Patch(ctx context.Context, orgID valuer.UUID, role *au
 		return errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
 	}
 
-	return provider.store.Update(ctx, orgID, authtypes.NewStorableRoleFromRole(role))
+	return provider.store.Update(ctx, orgID, role)
 }
 
 func (provider *provider) PatchObjects(ctx context.Context, orgID valuer.UUID, name string, relation authtypes.Relation, additions, deletions []*authtypes.Object) error {
@@ -260,18 +271,42 @@ func (provider *provider) Delete(ctx context.Context, orgID valuer.UUID, id valu
 		return errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
 	}
 
-	storableRole, err := provider.store.Get(ctx, orgID, id)
+	role, err := provider.store.Get(ctx, orgID, id)
 	if err != nil {
 		return err
 	}
 
-	role := authtypes.NewRoleFromStorableRole(storableRole)
 	err = role.ErrIfManaged()
 	if err != nil {
 		return err
 	}
 
-	return provider.store.Delete(ctx, orgID, id)
+	hasUserAssignees, err := provider.store.HasUserAssignees(ctx, id)
+	if err != nil {
+		return err
+	}
+	if hasUserAssignees {
+		return errors.New(errors.TypeInvalidInput, authtypes.ErrCodeRoleHasUserAssignees, "role has active user assignments, remove them before deleting")
+	}
+
+	hasServiceAccountAssignees, err := provider.store.HasServiceAccountAssignees(ctx, id)
+	if err != nil {
+		return err
+	}
+	if hasServiceAccountAssignees {
+		return errors.New(errors.TypeInvalidInput, authtypes.ErrCodeRoleHasServiceAccountAssignees, "role has active service account assignments, remove them before deleting")
+	}
+
+	if err := provider.cleanupTuples(ctx, role.Name, orgID); err != nil {
+		return errors.WithAdditionalf(err, "failed to delete transactions for the role: %s", role.Name)
+	}
+
+	err = provider.store.Delete(ctx, orgID, id)
+	if err != nil {
+		return err
+	}
+
+	return nil
 }
 
 func (provider *provider) MustGetTypeables() []authtypes.Typeable {
@@ -346,3 +381,62 @@ func (provider *provider) getManagedRoleTransactionTuples(orgID valuer.UUID) ([]
 
 	return tuples, nil
 }
+
+func (provider *provider) cleanupTuples(ctx context.Context, roleName string, orgID valuer.UUID) error {
+	subject := authtypes.MustNewSubject(authtypes.TypeableRole, roleName, orgID, &authtypes.RelationAssignee)
+
+	tuples := make([]*openfgav1.TupleKey, 0)
+	for _, objectType := range provider.getUniqueTypes() {
+		typeTuples, err := provider.ReadTuples(ctx, &openfgav1.ReadRequestTupleKey{
+			User:   subject,
+			Object: objectType.StringValue() + ":",
+		})
+		if err != nil {
+			return err
+		}
+		tuples = append(tuples, typeTuples...)
+	}
+
+	if len(tuples) == 0 {
+		return nil
+	}
+
+	for idx := 0; idx < len(tuples); idx += provider.config.OpenFGA.MaxTuplesPerWrite {
+		end := idx + provider.config.OpenFGA.MaxTuplesPerWrite
+		if end > len(tuples) {
+			end = len(tuples)
+		}
+
+		err := provider.Write(ctx, nil, tuples[idx:end])
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (provider *provider) getUniqueTypes() []authtypes.Type {
+	seen := make(map[string]struct{})
+	uniqueTypes := make([]authtypes.Type, 0)
+	for _, register := range provider.registry {
+		for _, typeable := range register.MustGetTypeables() {
+			typeKey := typeable.Type().StringValue()
+			if _, ok := seen[typeKey]; ok {
+				continue
+			}
+			seen[typeKey] = struct{}{}
+			uniqueTypes = append(uniqueTypes, typeable.Type())
+		}
+	}
+	for _, typeable := range provider.MustGetTypeables() {
+		typeKey := typeable.Type().StringValue()
+		if _, ok := seen[typeKey]; ok {
+			continue
+		}
+		seen[typeKey] = struct{}{}
+		uniqueTypes = append(uniqueTypes, typeable.Type())
+	}
+
+	return uniqueTypes
+}

ee/authz/openfgaserver/server.go

@@ -110,10 +110,14 @@ func (server *Server) BatchCheck(ctx context.Context, tupleReq map[string]*openf
 	return server.pkgAuthzService.BatchCheck(ctx, tupleReq)
 }
 
-func (server *Server) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, typeable authtypes.Typeable) ([]*authtypes.Object, error) {
-	return server.pkgAuthzService.ListObjects(ctx, subject, relation, typeable)
+func (server *Server) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, objectType authtypes.Type) ([]*authtypes.Object, error) {
+	return server.pkgAuthzService.ListObjects(ctx, subject, relation, objectType)
 }
 
 func (server *Server) Write(ctx context.Context, additions []*openfgav1.TupleKey, deletions []*openfgav1.TupleKey) error {
 	return server.pkgAuthzService.Write(ctx, additions, deletions)
 }
+
+func (server *Server) ReadTuples(ctx context.Context, tupleKey *openfgav1.ReadRequestTupleKey) ([]*openfgav1.TupleKey, error) {
+	return server.pkgAuthzService.ReadTuples(ctx, tupleKey)
+}

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -4774,7 +4774,7 @@ export interface RuletypesPostableRuleDTO {
 	 * @type string
 	 */
 	alert: string;
-	alertType: RuletypesAlertTypeDTO;
+	alertType?: RuletypesAlertTypeDTO;
 	/**
 	 * @type object
 	 */
@@ -4899,7 +4899,7 @@ export interface RuletypesRuleDTO {
 	 * @type string
 	 */
 	alert: string;
-	alertType: RuletypesAlertTypeDTO;
+	alertType?: RuletypesAlertTypeDTO;
 	/**
 	 * @type object
 	 */
@@ -4984,8 +4984,8 @@ export interface RuletypesRuleConditionDTO {
 	 */
 	algorithm?: string;
 	compositeQuery: RuletypesAlertCompositeQueryDTO;
-	matchType?: RuletypesMatchTypeDTO;
-	op?: RuletypesCompareOperatorDTO;
+	matchType: RuletypesMatchTypeDTO;
+	op: RuletypesCompareOperatorDTO;
 	/**
 	 * @type boolean
 	 */

frontend/src/container/DashboardContainer/visualization/charts/ChartWrapper/ChartWrapper.tsx

@@ -1,4 +1,4 @@
-import { useCallback, useMemo, useRef } from 'react';
+import { useCallback, useRef } from 'react';
 import ChartLayout from 'container/DashboardContainer/visualization/layout/ChartLayout/ChartLayout';
 import Legend from 'lib/uPlotV2/components/Legend/Legend';
 import {
@@ -30,7 +30,6 @@ export default function ChartWrapper({
 	onDestroy = noop,
 	children,
 	layoutChildren,
-	yAxisUnit,
 	customTooltip,
 	pinnedTooltipElement,
 	'data-testid': testId,
@@ -63,13 +62,6 @@ export default function ChartWrapper({
 		[customTooltip],
 	);
 
-	const syncMetadata = useMemo(
-		() => ({
-			yAxisUnit,
-		}),
-		[yAxisUnit],
-	);
-
 	return (
 		<PlotContextProvider>
 			<ChartLayout
@@ -107,7 +99,6 @@ export default function ChartWrapper({
 									averageLegendWidth + TOOLTIP_WIDTH_PADDING,
 								)}
 								syncKey={syncKey}
-								syncMetadata={syncMetadata}
 								render={renderTooltipCallback}
 								pinnedTooltipElement={pinnedTooltipElement}
 							/>

frontend/src/container/DashboardContainer/visualization/charts/Histogram/Histogram.tsx

@@ -24,12 +24,13 @@ export default function Histogram(props: HistogramChartProps): JSX.Element {
 			}
 			const tooltipProps: HistogramTooltipProps = {
 				...props,
+				timezone: rest.timezone,
 				yAxisUnit: rest.yAxisUnit,
 				decimalPrecision: rest.decimalPrecision,
 			};
 			return <HistogramTooltip {...tooltipProps} />;
 		},
-		[customTooltip, rest.yAxisUnit, rest.decimalPrecision],
+		[customTooltip, rest.timezone, rest.yAxisUnit, rest.decimalPrecision],
 	);
 
 	return (

frontend/src/container/DashboardContainer/visualization/charts/types.ts

@@ -12,7 +12,10 @@ interface BaseChartProps {
 	height: number;
 	showTooltip?: boolean;
 	showLegend?: boolean;
+	timezone?: Timezone;
 	canPinTooltip?: boolean;
+	yAxisUnit?: string;
+	decimalPrecision?: PrecisionOption;
 	pinnedTooltipElement?: (clickData: TooltipClickData) => React.ReactNode;
 	customTooltip?: (props: TooltipRenderArgs) => React.ReactNode;
 	'data-testid'?: string;
@@ -29,31 +32,18 @@ interface UPlotBasedChartProps {
 	layoutChildren?: React.ReactNode;
 }
 
-interface UPlotChartDataProps {
-	yAxisUnit?: string;
-	decimalPrecision?: PrecisionOption;
-}
-
 export interface TimeSeriesChartProps
 	extends BaseChartProps,
-		UPlotBasedChartProps,
-		UPlotChartDataProps {
-	timezone?: Timezone;
-}
+		UPlotBasedChartProps {}
 
 export interface HistogramChartProps
 	extends BaseChartProps,
-		UPlotBasedChartProps,
-		UPlotChartDataProps {
+		UPlotBasedChartProps {
 	isQueriesMerged?: boolean;
 }
 
-export interface BarChartProps
-	extends BaseChartProps,
-		UPlotBasedChartProps,
-		UPlotChartDataProps {
+export interface BarChartProps extends BaseChartProps, UPlotBasedChartProps {
 	isStackedBarChart?: boolean;
-	timezone?: Timezone;
 }
 
 export type ChartProps =

frontend/src/container/DashboardContainer/visualization/panels/BarPanel/BarPanel.tsx

@@ -123,13 +123,13 @@ function BarPanel(props: PanelWrapperProps): JSX.Element {
 					}}
 					plotRef={onPlotRef}
 					onDestroy={onPlotDestroy}
+					yAxisUnit={widget.yAxisUnit}
+					decimalPrecision={widget.decimalPrecision}
 					data={chartData as uPlot.AlignedData}
 					width={containerDimensions.width}
 					height={containerDimensions.height}
 					layoutChildren={layoutChildren}
 					isStackedBarChart={widget.stackedBarChart ?? false}
-					yAxisUnit={widget.yAxisUnit}
-					decimalPrecision={widget.decimalPrecision}
 					timezone={timezone}
 				>
 					<ContextMenu

frontend/src/container/DashboardContainer/visualization/panels/HistogramPanel/HistogramPanel.tsx

@@ -3,6 +3,8 @@ import { PanelWrapperProps } from 'container/PanelWrapper/panelWrapper.types';
 import { useIsDarkMode } from 'hooks/useDarkMode';
 import { useResizeObserver } from 'hooks/useDimensions';
 import { LegendPosition } from 'lib/uPlotV2/components/types';
+import { DashboardCursorSync } from 'lib/uPlotV2/plugins/TooltipPlugin/types';
+import { useTimezone } from 'providers/Timezone';
 import uPlot from 'uplot';
 
 import Histogram from '../../charts/Histogram/Histogram';
@@ -27,6 +29,7 @@ function HistogramPanel(props: PanelWrapperProps): JSX.Element {
 	const containerDimensions = useResizeObserver(graphRef);
 
 	const isDarkMode = useIsDarkMode();
+	const { timezone } = useTimezone();
 
 	const config = useMemo(() => {
 		return prepareHistogramPanelConfig({
@@ -89,9 +92,11 @@ function HistogramPanel(props: PanelWrapperProps): JSX.Element {
 					onDestroy={(): void => {
 						uPlotRef.current = null;
 					}}
+					isQueriesMerged={widget.mergeAllActiveQueries}
 					yAxisUnit={widget.yAxisUnit}
 					decimalPrecision={widget.decimalPrecision}
-					isQueriesMerged={widget.mergeAllActiveQueries}
+					syncMode={DashboardCursorSync.Crosshair}
+					timezone={timezone}
 					data={chartData as uPlot.AlignedData}
 					width={containerDimensions.width}
 					height={containerDimensions.height}

frontend/src/container/DashboardContainer/visualization/panels/HistogramPanel/__tests__/HistogramPanel.test.tsx

@@ -48,8 +48,8 @@ jest.mock(
 					{JSON.stringify({
 						legendPosition: props.legendConfig?.position,
 						isQueriesMerged: props.isQueriesMerged,
-						yAxisUnit: props?.yAxisUnit,
-						decimalPrecision: props?.decimalPrecision,
+						yAxisUnit: props.yAxisUnit,
+						decimalPrecision: props.decimalPrecision,
 					})}
 				</div>
 				{props.layoutChildren}

frontend/src/container/DashboardContainer/visualization/panels/TimeSeriesPanel/TimeSeriesPanel.tsx

@@ -112,9 +112,9 @@ function TimeSeriesPanel(props: PanelWrapperProps): JSX.Element {
 					legendConfig={{
 						position: widget?.legendPosition ?? LegendPosition.BOTTOM,
 					}}
-					timezone={timezone}
 					yAxisUnit={widget.yAxisUnit}
 					decimalPrecision={widget.decimalPrecision}
+					timezone={timezone}
 					data={chartData as uPlot.AlignedData}
 					width={containerDimensions.width}
 					height={containerDimensions.height}

frontend/src/lib/uPlotV2/components/types.ts

@@ -62,10 +62,10 @@ export interface TooltipRenderArgs {
 
 export interface BaseTooltipProps {
 	showTooltipHeader?: boolean;
+	timezone?: Timezone;
 	yAxisUnit?: string;
 	decimalPrecision?: PrecisionOption;
 	content?: TooltipContentItem[];
-	timezone?: Timezone;
 }
 
 export interface TimeSeriesTooltipProps

frontend/src/lib/uPlotV2/plugins/TooltipPlugin/TooltipPlugin.tsx

@@ -4,7 +4,6 @@ import cx from 'classnames';
 import { getFocusedSeriesAtPosition } from 'lib/uPlotLib/plugins/onClickPlugin';
 import uPlot from 'uplot';
 
-import { syncCursorRegistry } from './syncCursorRegistry';
 import {
 	createInitialControllerState,
 	createSetCursorHandler,
@@ -41,7 +40,6 @@ export default function TooltipPlugin({
 	maxHeight = 600,
 	syncMode = DashboardCursorSync.None,
 	syncKey = '_tooltip_sync_global_',
-	syncMetadata,
 	pinnedTooltipElement,
 	canPinTooltip = false,
 }: TooltipPluginProps): JSX.Element | null {
@@ -102,29 +100,7 @@ export default function TooltipPlugin({
 		// crosshair / tooltip can follow the dashboard-wide cursor.
 		if (syncMode !== DashboardCursorSync.None && config.scales[0]?.props.time) {
 			config.setCursor({
-				sync: { key: syncKey, scales: ['x', 'y'] },
-			});
-
-			// Show the horizontal crosshair only when the receiving panel shares
-			// the same y-axis unit as the source panel. When this panel is the
-			// source (cursor.event != null) the line is always shown and this
-			// panel's metadata is written to the registry so receivers can read it.
-			config.addHook('setCursor', (u: uPlot): void => {
-				const yCursorEl = u.root.querySelector<HTMLElement>('.u-cursor-y');
-				if (!yCursorEl) {
-					return;
-				}
-
-				if (u.cursor.event != null) {
-					// This panel is the source — publish metadata and always show line.
-					syncCursorRegistry.setMetadata(syncKey, syncMetadata);
-					yCursorEl.style.display = '';
-				} else {
-					// This panel is receiving sync — show only if units match.
-					const sourceMeta = syncCursorRegistry.getMetadata(syncKey);
-					yCursorEl.style.display =
-						sourceMeta?.yAxisUnit === syncMetadata?.yAxisUnit ? '' : 'none';
-				}
+				sync: { key: syncKey, scales: ['x', null] },
 			});
 		}
 

frontend/src/lib/uPlotV2/plugins/TooltipPlugin/syncCursorRegistry.ts

@@ -1,24 +0,0 @@
-import type { TooltipSyncMetadata } from './types';
-
-/**
- * Module-level registry that tracks the metadata of the panel currently
- * acting as the cursor source (the one being hovered) per sync group.
- *
- * uPlot fires the source panel's setCursor hook before broadcasting to
- * receivers, so the registry is always populated before receivers read it.
- *
- * Receivers use this to make decisions such as:
- * - Whether to show the horizontal crosshair line (matching yAxisUnit)
- * - Future: what to render inside the tooltip (matching groupBy, etc.)
- */
-const metadataBySyncKey = new Map<string, TooltipSyncMetadata | undefined>();
-
-export const syncCursorRegistry = {
-	setMetadata(syncKey: string, metadata: TooltipSyncMetadata | undefined): void {
-		metadataBySyncKey.set(syncKey, metadata);
-	},
-
-	getMetadata(syncKey: string): TooltipSyncMetadata | undefined {
-		return metadataBySyncKey.get(syncKey);
-	},
-};

frontend/src/lib/uPlotV2/plugins/TooltipPlugin/types.ts

@@ -34,16 +34,11 @@ export interface TooltipLayoutInfo {
 	height: number;
 }
 
-export interface TooltipSyncMetadata {
-	yAxisUnit?: string;
-}
-
 export interface TooltipPluginProps {
 	config: UPlotConfigBuilder;
 	canPinTooltip?: boolean;
 	syncMode?: DashboardCursorSync;
 	syncKey?: string;
-	syncMetadata?: TooltipSyncMetadata;
 	render: (args: TooltipRenderArgs) => ReactNode;
 	pinnedTooltipElement?: (clickData: TooltipClickData) => ReactNode;
 	maxWidth?: number;

frontend/src/lib/uPlotV2/plugins/__tests__/TooltipPlugin.test.ts

@@ -516,7 +516,7 @@ describe('TooltipPlugin', () => {
 			);
 
 			expect(setCursorSpy).toHaveBeenCalledWith({
-				sync: { key: 'dashboard-sync', scales: ['x', 'y'] },
+				sync: { key: 'dashboard-sync', scales: ['x', null] },
 			});
 		});
 

pkg/apiserver/signozapiserver/ruler.go

@@ -44,7 +44,6 @@ func (provider *provider) addRulerRoutes(router *mux.Router) error {
 		Description:         "This endpoint creates a new alert rule",
 		Request:             new(ruletypes.PostableRule),
 		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
 		Response:            new(ruletypes.Rule),
 		ResponseContentType: "application/json",
 		SuccessStatusCode:   http.StatusCreated,
@@ -55,28 +54,27 @@ func (provider *provider) addRulerRoutes(router *mux.Router) error {
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authZ.EditAccess(provider.rulerHandler.UpdateRuleByID), handler.OpenAPIDef{
-		ID:                 "UpdateRuleByID",
-		Tags:               []string{"rules"},
-		Summary:            "Update alert rule",
-		Description:        "This endpoint updates an alert rule by ID",
-		Request:            new(ruletypes.PostableRule),
-		RequestContentType: "application/json",
-		RequestExamples:    postableRuleExamples(),
-		SuccessStatusCode:  http.StatusNoContent,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
+		ID:                  "UpdateRuleByID",
+		Tags:                []string{"rules"},
+		Summary:             "Update alert rule",
+		Description:         "This endpoint updates an alert rule by ID",
+		Request:             new(ruletypes.PostableRule),
+		RequestContentType:  "application/json",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
 	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authZ.EditAccess(provider.rulerHandler.DeleteRuleByID), handler.OpenAPIDef{
-		ID:                "DeleteRuleByID",
-		Tags:              []string{"rules"},
-		Summary:           "Delete alert rule",
-		Description:       "This endpoint deletes an alert rule by ID",
-		SuccessStatusCode: http.StatusNoContent,
-		ErrorStatusCodes:  []int{http.StatusNotFound},
-		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
+		ID:                  "DeleteRuleByID",
+		Tags:                []string{"rules"},
+		Summary:             "Delete alert rule",
+		Description:         "This endpoint deletes an alert rule by ID",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
 	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
@@ -88,7 +86,6 @@ func (provider *provider) addRulerRoutes(router *mux.Router) error {
 		Description:         "This endpoint applies a partial update to an alert rule by ID",
 		Request:             new(ruletypes.PostableRule),
 		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
 		Response:            new(ruletypes.Rule),
 		ResponseContentType: "application/json",
 		SuccessStatusCode:   http.StatusOK,
@@ -105,7 +102,6 @@ func (provider *provider) addRulerRoutes(router *mux.Router) error {
 		Description:         "This endpoint fires a test notification for the given rule definition",
 		Request:             new(ruletypes.PostableRule),
 		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
 		Response:            new(ruletypes.GettableTestRule),
 		ResponseContentType: "application/json",
 		SuccessStatusCode:   http.StatusOK,
@@ -160,27 +156,27 @@ func (provider *provider) addRulerRoutes(router *mux.Router) error {
 	}
 
 	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authZ.EditAccess(provider.rulerHandler.UpdateDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                 "UpdateDowntimeScheduleByID",
-		Tags:               []string{"downtimeschedules"},
-		Summary:            "Update downtime schedule",
-		Description:        "This endpoint updates a downtime schedule by ID",
-		Request:            new(ruletypes.PostablePlannedMaintenance),
-		RequestContentType: "application/json",
-		SuccessStatusCode:  http.StatusNoContent,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
+		ID:                  "UpdateDowntimeScheduleByID",
+		Tags:                []string{"downtimeschedules"},
+		Summary:             "Update downtime schedule",
+		Description:         "This endpoint updates a downtime schedule by ID",
+		Request:             new(ruletypes.PostablePlannedMaintenance),
+		RequestContentType:  "application/json",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
 	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authZ.EditAccess(provider.rulerHandler.DeleteDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                "DeleteDowntimeScheduleByID",
-		Tags:              []string{"downtimeschedules"},
-		Summary:           "Delete downtime schedule",
-		Description:       "This endpoint deletes a downtime schedule by ID",
-		SuccessStatusCode: http.StatusNoContent,
-		ErrorStatusCodes:  []int{http.StatusNotFound},
-		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
+		ID:                  "DeleteDowntimeScheduleByID",
+		Tags:                []string{"downtimeschedules"},
+		Summary:             "Delete downtime schedule",
+		Description:         "This endpoint deletes a downtime schedule by ID",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
 	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

pkg/apiserver/signozapiserver/ruler_examples.go

@@ -1,733 +0,0 @@
-package signozapiserver
-
-import "github.com/SigNoz/signoz/pkg/http/handler"
-
-// postableRuleExamples returns example payloads attached to every rule-write
-// endpoint. They cover each alert type, rule type, and composite-query shape.
-func postableRuleExamples() []handler.OpenAPIExample {
-	rolling := func(evalWindow, frequency string) map[string]any {
-		return map[string]any{
-			"kind": "rolling",
-			"spec": map[string]any{"evalWindow": evalWindow, "frequency": frequency},
-		}
-	}
-	renotify := func(interval string, states ...string) map[string]any {
-		s := make([]any, 0, len(states))
-		for _, v := range states {
-			s = append(s, v)
-		}
-		return map[string]any{
-			"enabled":     true,
-			"interval":    interval,
-			"alertStates": s,
-		}
-	}
-
-	return []handler.OpenAPIExample{
-		{
-			Name:        "metric_threshold_single",
-			Summary:     "Metric threshold single builder query",
-			Description: "Fires when a pod consumes more than 80% of its requested CPU for the whole evaluation window. Uses `k8s.pod.cpu_request_utilization`.",
-			Value: map[string]any{
-				"alert":         "Pod CPU above 80% of request",
-				"alertType":     "METRIC_BASED_ALERT",
-				"description":   "CPU usage for api-service pods exceeds 80% of the requested CPU",
-				"ruleType":      "threshold_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "builder",
-						"panelType": "graph",
-						"unit":      "percentunit",
-						"queries": []any{
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "A",
-									"signal":       "metrics",
-									"stepInterval": 60,
-									"aggregations": []any{map[string]any{"metricName": "k8s.pod.cpu_request_utilization", "timeAggregation": "avg", "spaceAggregation": "max"}},
-									"filter":       map[string]any{"expression": "k8s.deployment.name = 'api-service'"},
-									"groupBy": []any{
-										map[string]any{"name": "k8s.pod.name", "fieldContext": "resource", "fieldDataType": "string"},
-										map[string]any{"name": "deployment.environment", "fieldContext": "resource", "fieldDataType": "string"},
-									},
-									"legend": "{{k8s.pod.name}} ({{deployment.environment}})",
-								},
-							},
-						},
-					},
-					"selectedQueryName": "A",
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":      "critical",
-								"op":        "above",
-								"matchType": "all_the_times",
-								"target":    0.8,
-								"channels":  []any{"slack-platform", "pagerduty-oncall"},
-							},
-						},
-					},
-				},
-				"evaluation": rolling("15m", "1m"),
-				"notificationSettings": map[string]any{
-					"groupBy":  []any{"k8s.pod.name", "deployment.environment"},
-					"renotify": renotify("4h", "firing"),
-				},
-				"labels": map[string]any{"severity": "critical", "team": "platform"},
-				"annotations": map[string]any{
-					"description": "Pod {{$k8s.pod.name}} CPU is at {{$value}} of request in {{$deployment.environment}}.",
-					"summary":     "Pod CPU above {{$threshold}} of request",
-				},
-			},
-		},
-		{
-			Name:        "metric_threshold_formula",
-			Summary:     "Metric threshold multi-query formula",
-			Description: "Computes disk utilization as (1 - available/capacity) * 100 by combining two disabled base queries with a builder_formula. The formula emits 0–100, so compositeQuery.unit is set to \"percent\" and the target is a bare number.",
-			Value: map[string]any{
-				"alert":         "PersistentVolume above 80% utilization",
-				"alertType":     "METRIC_BASED_ALERT",
-				"description":   "Disk utilization for a persistent volume is above 80%",
-				"ruleType":      "threshold_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "builder",
-						"panelType": "graph",
-						"unit":      "percent",
-						"queries": []any{
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "A",
-									"signal":       "metrics",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"metricName": "k8s.volume.available", "timeAggregation": "max", "spaceAggregation": "max"}},
-									"filter":       map[string]any{"expression": "k8s.volume.type = 'persistentVolumeClaim'"},
-									"groupBy": []any{
-										map[string]any{"name": "k8s.persistentvolumeclaim.name", "fieldContext": "resource", "fieldDataType": "string"},
-										map[string]any{"name": "k8s.namespace.name", "fieldContext": "resource", "fieldDataType": "string"},
-									},
-								},
-							},
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "B",
-									"signal":       "metrics",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"metricName": "k8s.volume.capacity", "timeAggregation": "max", "spaceAggregation": "max"}},
-									"filter":       map[string]any{"expression": "k8s.volume.type = 'persistentVolumeClaim'"},
-									"groupBy": []any{
-										map[string]any{"name": "k8s.persistentvolumeclaim.name", "fieldContext": "resource", "fieldDataType": "string"},
-										map[string]any{"name": "k8s.namespace.name", "fieldContext": "resource", "fieldDataType": "string"},
-									},
-								},
-							},
-							map[string]any{
-								"type": "builder_formula",
-								"spec": map[string]any{
-									"name":       "F1",
-									"expression": "(1 - A/B) * 100",
-									"legend":     "{{k8s.persistentvolumeclaim.name}} ({{k8s.namespace.name}})",
-								},
-							},
-						},
-					},
-					"selectedQueryName": "F1",
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":      "critical",
-								"op":        "above",
-								"matchType": "at_least_once",
-								"target":    80,
-								"channels":  []any{"slack-storage"},
-							},
-						},
-					},
-				},
-				"evaluation": rolling("30m", "5m"),
-				"notificationSettings": map[string]any{
-					"groupBy":  []any{"k8s.namespace.name", "k8s.persistentvolumeclaim.name"},
-					"renotify": renotify("2h", "firing"),
-				},
-				"labels": map[string]any{"severity": "critical"},
-				"annotations": map[string]any{
-					"description": "Volume {{$k8s.persistentvolumeclaim.name}} in {{$k8s.namespace.name}} is {{$value}}% full.",
-					"summary":     "Disk utilization above {{$threshold}}%",
-				},
-			},
-		},
-		{
-			Name:        "metric_promql",
-			Summary:     "Metric threshold PromQL rule",
-			Description: "PromQL expression instead of the builder. Dotted OTEL resource attributes are quoted (\"deployment.environment\"). Useful for queries that combine series with group_right or other Prom operators.",
-			Value: map[string]any{
-				"alert":         "Kafka consumer group lag above 1000",
-				"alertType":     "METRIC_BASED_ALERT",
-				"description":   "Consumer group lag computed via PromQL",
-				"ruleType":      "promql_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "promql",
-						"panelType": "graph",
-						"queries": []any{
-							map[string]any{
-								"type": "promql",
-								"spec": map[string]any{
-									"name":   "A",
-									"query":  "(max by(topic, partition, \"deployment.environment\")(kafka_log_end_offset) - on(topic, partition, \"deployment.environment\") group_right max by(group, topic, partition, \"deployment.environment\")(kafka_consumer_committed_offset)) > 0",
-									"legend": "{{topic}}/{{partition}} ({{group}})",
-								},
-							},
-						},
-					},
-					"selectedQueryName": "A",
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":      "critical",
-								"op":        "above",
-								"matchType": "all_the_times",
-								"target":    1000,
-								"channels":  []any{"slack-data-platform", "pagerduty-data"},
-							},
-						},
-					},
-				},
-				"evaluation": rolling("10m", "1m"),
-				"notificationSettings": map[string]any{
-					"groupBy":  []any{"group", "topic"},
-					"renotify": renotify("1h", "firing"),
-				},
-				"labels": map[string]any{"severity": "critical"},
-				"annotations": map[string]any{
-					"description": "Consumer group {{$group}} is {{$value}} messages behind on {{$topic}}/{{$partition}}.",
-					"summary":     "Kafka consumer lag high",
-				},
-			},
-		},
-		{
-			Name:        "metric_anomaly",
-			Summary:     "Metric anomaly rule (v1 only)",
-			Description: "Anomaly rules are not yet supported under schemaVersion v2alpha1, so this example uses the v1 shape. Wraps a builder query in the `anomaly` function with daily seasonality SigNoz compares each point against the forecast for that time of day. Fires when the anomaly score stays below the threshold for the entire window; `requireMinPoints` guards against noisy intervals.",
-			Value: map[string]any{
-				"alert":       "Anomalous drop in ingested spans",
-				"alertType":   "METRIC_BASED_ALERT",
-				"description": "Detect an abrupt drop in span ingestion using a z-score anomaly function",
-				"ruleType":    "anomaly_rule",
-				"version":     "v5",
-				"evalWindow":  "24h",
-				"frequency":   "3h",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "builder",
-						"panelType": "graph",
-						"queries": []any{
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "A",
-									"signal":       "metrics",
-									"stepInterval": 21600,
-									"aggregations": []any{map[string]any{"metricName": "otelcol_receiver_accepted_spans", "timeAggregation": "rate", "spaceAggregation": "sum"}},
-									"filter":       map[string]any{"expression": "tenant_tier = 'premium'"},
-									"groupBy":      []any{map[string]any{"name": "tenant_id", "fieldContext": "attribute", "fieldDataType": "string"}},
-									"functions": []any{
-										map[string]any{
-											"name": "anomaly",
-											"args": []any{map[string]any{"name": "z_score_threshold", "value": 2}},
-										},
-									},
-									"legend": "{{tenant_id}}",
-								},
-							},
-						},
-					},
-					"op":                "below",
-					"matchType":         "all_the_times",
-					"target":            2,
-					"algorithm":         "standard",
-					"seasonality":       "daily",
-					"selectedQueryName": "A",
-					"requireMinPoints":  true,
-					"requiredNumPoints": 3,
-				},
-				"labels":            map[string]any{"severity": "warning"},
-				"preferredChannels": []any{"slack-ingestion"},
-				"annotations": map[string]any{
-					"description": "Ingestion rate for tenant {{$tenant_id}} is anomalously low (z-score {{$value}}).",
-					"summary":     "Span ingestion anomaly",
-				},
-			},
-		},
-		{
-			Name:        "logs_threshold",
-			Summary:     "Logs threshold count() over filter",
-			Description: "Counts matching log records (ERROR severity + body contains) over a rolling window. Fires at least once per evaluation when the count exceeds zero.",
-			Value: map[string]any{
-				"alert":         "Payments service panic logs",
-				"alertType":     "LOGS_BASED_ALERT",
-				"description":   "Any panic log line emitted by the payments service",
-				"ruleType":      "threshold_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "builder",
-						"panelType": "graph",
-						"queries": []any{
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "A",
-									"signal":       "logs",
-									"stepInterval": 60,
-									"aggregations": []any{map[string]any{"expression": "count()"}},
-									"filter":       map[string]any{"expression": "service.name = 'payments-api' AND severity_text = 'ERROR' AND body CONTAINS 'panic'"},
-									"groupBy": []any{
-										map[string]any{"name": "k8s.pod.name", "fieldContext": "resource", "fieldDataType": "string"},
-										map[string]any{"name": "deployment.environment", "fieldContext": "resource", "fieldDataType": "string"},
-									},
-									"legend": "{{k8s.pod.name}} ({{deployment.environment}})",
-								},
-							},
-						},
-					},
-					"selectedQueryName": "A",
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":      "critical",
-								"op":        "above",
-								"matchType": "at_least_once",
-								"target":    0,
-								"channels":  []any{"slack-payments", "pagerduty-payments"},
-							},
-						},
-					},
-				},
-				"evaluation": rolling("5m", "1m"),
-				"notificationSettings": map[string]any{
-					"groupBy":  []any{"k8s.pod.name", "deployment.environment"},
-					"renotify": renotify("15m", "firing"),
-				},
-				"labels": map[string]any{"severity": "critical", "team": "payments"},
-				"annotations": map[string]any{
-					"description": "{{$k8s.pod.name}} emitted {{$value}} panic log(s) in {{$deployment.environment}}.",
-					"summary":     "Payments service panic",
-				},
-			},
-		},
-		{
-			Name:        "logs_error_rate_formula",
-			Summary:     "Logs error rate error count / total count × 100",
-			Description: "Two disabled log count queries (A = errors, B = total) combined via a builder_formula into a percentage. Classic service-level error-rate alert pattern for log-based signals.",
-			Value: map[string]any{
-				"alert":         "Payments-api error log rate above 1%",
-				"alertType":     "LOGS_BASED_ALERT",
-				"description":   "Error log ratio as a percentage of total logs for payments-api",
-				"ruleType":      "threshold_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "builder",
-						"panelType": "graph",
-						"unit":      "percent",
-						"queries": []any{
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "A",
-									"signal":       "logs",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"expression": "count()"}},
-									"filter":       map[string]any{"expression": "service.name = 'payments-api' AND severity_text IN ['ERROR', 'FATAL']"},
-									"groupBy":      []any{map[string]any{"name": "deployment.environment", "fieldContext": "resource", "fieldDataType": "string"}},
-								},
-							},
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "B",
-									"signal":       "logs",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"expression": "count()"}},
-									"filter":       map[string]any{"expression": "service.name = 'payments-api'"},
-									"groupBy":      []any{map[string]any{"name": "deployment.environment", "fieldContext": "resource", "fieldDataType": "string"}},
-								},
-							},
-							map[string]any{
-								"type": "builder_formula",
-								"spec": map[string]any{
-									"name":       "F1",
-									"expression": "(A / B) * 100",
-									"legend":     "{{deployment.environment}}",
-								},
-							},
-						},
-					},
-					"selectedQueryName": "F1",
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":      "critical",
-								"op":        "above",
-								"matchType": "at_least_once",
-								"target":    1,
-								"channels":  []any{"slack-payments"},
-							},
-						},
-					},
-				},
-				"evaluation": rolling("5m", "1m"),
-				"notificationSettings": map[string]any{
-					"groupBy":  []any{"deployment.environment"},
-					"renotify": renotify("30m", "firing"),
-				},
-				"labels": map[string]any{"severity": "critical", "team": "payments"},
-				"annotations": map[string]any{
-					"description": "Error log rate in {{$deployment.environment}} is {{$value}}%",
-					"summary":     "Payments-api error rate above {{$threshold}}%",
-				},
-			},
-		},
-		{
-			Name:        "traces_threshold_latency",
-			Summary:     "Traces threshold p99 latency (ns → s conversion)",
-			Description: "Builder query against the traces signal with p99(duration_nano). The series unit is ns (compositeQuery.unit), the target is in seconds (threshold.targetUnit) SigNoz converts before comparing. Canonical shape when series and target live in different units.",
-			Value: map[string]any{
-				"alert":         "Search API p99 latency above 5s",
-				"alertType":     "TRACES_BASED_ALERT",
-				"description":   "p99 duration of the search endpoint exceeds 5s",
-				"ruleType":      "threshold_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "builder",
-						"panelType": "graph",
-						"unit":      "ns",
-						"queries": []any{
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "A",
-									"signal":       "traces",
-									"stepInterval": 60,
-									"aggregations": []any{map[string]any{"expression": "p99(duration_nano)"}},
-									"filter":       map[string]any{"expression": "service.name = 'search-api' AND name = 'GET /api/v1/search'"},
-									"groupBy": []any{
-										map[string]any{"name": "service.name", "fieldContext": "resource", "fieldDataType": "string"},
-										map[string]any{"name": "http.route", "fieldContext": "attribute", "fieldDataType": "string"},
-									},
-									"legend": "{{service.name}} {{http.route}}",
-								},
-							},
-						},
-					},
-					"selectedQueryName": "A",
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":       "warning",
-								"op":         "above",
-								"matchType":  "at_least_once",
-								"target":     5,
-								"targetUnit": "s",
-								"channels":   []any{"slack-search"},
-							},
-						},
-					},
-				},
-				"evaluation": rolling("5m", "1m"),
-				"notificationSettings": map[string]any{
-					"groupBy":  []any{"service.name", "http.route"},
-					"renotify": renotify("30m", "firing"),
-				},
-				"labels": map[string]any{"severity": "warning", "team": "search"},
-				"annotations": map[string]any{
-					"description": "p99 latency for {{$service.name}} on {{$http.route}} crossed {{$threshold}}s.",
-					"summary":     "Search-api latency degraded",
-				},
-			},
-		},
-		{
-			Name:        "traces_error_rate_formula",
-			Summary:     "Traces error rate error spans / total spans × 100",
-			Description: "Two disabled trace count queries (A = error spans where hasError=true, B = total spans) combined via a builder_formula into a percentage. Mirrors the common request-error-rate dashboard shape.",
-			Value: map[string]any{
-				"alert":         "Search-api error rate above 5%",
-				"alertType":     "TRACES_BASED_ALERT",
-				"description":   "Request error rate for search-api, grouped by route",
-				"ruleType":      "threshold_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "builder",
-						"panelType": "graph",
-						"unit":      "percent",
-						"queries": []any{
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "A",
-									"signal":       "traces",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"expression": "count()"}},
-									"filter":       map[string]any{"expression": "service.name = 'search-api' AND hasError = true"},
-									"groupBy": []any{
-										map[string]any{"name": "service.name", "fieldContext": "resource", "fieldDataType": "string"},
-										map[string]any{"name": "http.route", "fieldContext": "attribute", "fieldDataType": "string"},
-									},
-								},
-							},
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "B",
-									"signal":       "traces",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"expression": "count()"}},
-									"filter":       map[string]any{"expression": "service.name = 'search-api'"},
-									"groupBy": []any{
-										map[string]any{"name": "service.name", "fieldContext": "resource", "fieldDataType": "string"},
-										map[string]any{"name": "http.route", "fieldContext": "attribute", "fieldDataType": "string"},
-									},
-								},
-							},
-							map[string]any{
-								"type": "builder_formula",
-								"spec": map[string]any{
-									"name":       "F1",
-									"expression": "(A / B) * 100",
-									"legend":     "{{service.name}} {{http.route}}",
-								},
-							},
-						},
-					},
-					"selectedQueryName": "F1",
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":      "critical",
-								"op":        "above",
-								"matchType": "at_least_once",
-								"target":    5,
-								"channels":  []any{"slack-search", "pagerduty-search"},
-							},
-						},
-					},
-				},
-				"evaluation": rolling("5m", "1m"),
-				"notificationSettings": map[string]any{
-					"groupBy":  []any{"service.name", "http.route"},
-					"renotify": renotify("15m", "firing"),
-				},
-				"labels": map[string]any{"severity": "critical", "team": "search"},
-				"annotations": map[string]any{
-					"description": "Error rate on {{$service.name}} {{$http.route}} is {{$value}}%",
-					"summary":     "Search-api error rate above {{$threshold}}%",
-				},
-			},
-		},
-		{
-			Name:        "tiered_thresholds",
-			Summary:     "Tiered thresholds with per-tier channels",
-			Description: "Two tiers (warning and critical) in a single rule, each with its own target, op, matchType, and channels so warnings and pages route to different receivers. `alertOnAbsent` + `absentFor` fires a no-data alert when the query returns no series for 15 consecutive evaluations.",
-			Value: map[string]any{
-				"alert":         "Kafka consumer lag warn / critical",
-				"alertType":     "METRIC_BASED_ALERT",
-				"description":   "Warn at lag ≥ 50 and page at ≥ 200, tiered via thresholds.spec.",
-				"ruleType":      "threshold_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "builder",
-						"panelType": "graph",
-						"queries": []any{
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "A",
-									"signal":       "metrics",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"metricName": "kafka_log_end_offset", "timeAggregation": "max", "spaceAggregation": "max"}},
-									"filter":       map[string]any{"expression": "topic != '__consumer_offsets'"},
-									"groupBy": []any{
-										map[string]any{"name": "topic", "fieldContext": "attribute", "fieldDataType": "string"},
-										map[string]any{"name": "partition", "fieldContext": "attribute", "fieldDataType": "string"},
-									},
-								},
-							},
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "B",
-									"signal":       "metrics",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"metricName": "kafka_consumer_committed_offset", "timeAggregation": "max", "spaceAggregation": "max"}},
-									"filter":       map[string]any{"expression": "topic != '__consumer_offsets'"},
-									"groupBy": []any{
-										map[string]any{"name": "topic", "fieldContext": "attribute", "fieldDataType": "string"},
-										map[string]any{"name": "partition", "fieldContext": "attribute", "fieldDataType": "string"},
-									},
-								},
-							},
-							map[string]any{
-								"type": "builder_formula",
-								"spec": map[string]any{
-									"name":       "F1",
-									"expression": "A - B",
-									"legend":     "{{topic}}/{{partition}}",
-								},
-							},
-						},
-					},
-					"alertOnAbsent":     true,
-					"absentFor":         15,
-					"selectedQueryName": "F1",
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":      "warning",
-								"op":        "above",
-								"matchType": "all_the_times",
-								"target":    50,
-								"channels":  []any{"slack-kafka-info"},
-							},
-							map[string]any{
-								"name":      "critical",
-								"op":        "above",
-								"matchType": "all_the_times",
-								"target":    200,
-								"channels":  []any{"slack-kafka-alerts", "pagerduty-kafka"},
-							},
-						},
-					},
-				},
-				"evaluation": rolling("5m", "1m"),
-				"notificationSettings": map[string]any{
-					"groupBy":  []any{"topic"},
-					"renotify": renotify("15m", "firing"),
-				},
-				"labels": map[string]any{"team": "data-platform"},
-				"annotations": map[string]any{
-					"description": "Consumer lag for {{$topic}} partition {{$partition}} is {{$value}}.",
-					"summary":     "Kafka consumer lag",
-				},
-			},
-		},
-		{
-			Name:        "notification_settings",
-			Summary:     "Full notification settings (grouping, nodata renotify, grace period)",
-			Description: "Demonstrates the full notificationSettings surface: `groupBy` merges alerts across labels to cut noise, `newGroupEvalDelay` gives newly-appearing series a grace period before firing, `renotify` re-alerts every 30m while firing OR while the alert is in nodata (missing data is treated as actionable), and `usePolicy: false` means channels come from the threshold entries rather than global routing policies. Set `usePolicy: true` to skip per-threshold channels and route via the org-level notification policy instead.",
-			Value: map[string]any{
-				"alert":         "API 5xx error rate above 1%",
-				"alertType":     "TRACES_BASED_ALERT",
-				"description":   "Noise-controlled 5xx error rate alert with renotify on gaps",
-				"ruleType":      "threshold_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
-				"condition": map[string]any{
-					"compositeQuery": map[string]any{
-						"queryType": "builder",
-						"panelType": "graph",
-						"unit":      "percent",
-						"queries": []any{
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "A",
-									"signal":       "traces",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"expression": "count()"}},
-									"filter":       map[string]any{"expression": "service.name CONTAINS 'api' AND http.status_code >= 500"},
-									"groupBy": []any{
-										map[string]any{"name": "service.name", "fieldContext": "resource", "fieldDataType": "string"},
-										map[string]any{"name": "deployment.environment", "fieldContext": "resource", "fieldDataType": "string"},
-									},
-								},
-							},
-							map[string]any{
-								"type": "builder_query",
-								"spec": map[string]any{
-									"name":         "B",
-									"signal":       "traces",
-									"stepInterval": 60,
-									"disabled":     true,
-									"aggregations": []any{map[string]any{"expression": "count()"}},
-									"filter":       map[string]any{"expression": "service.name CONTAINS 'api'"},
-									"groupBy": []any{
-										map[string]any{"name": "service.name", "fieldContext": "resource", "fieldDataType": "string"},
-										map[string]any{"name": "deployment.environment", "fieldContext": "resource", "fieldDataType": "string"},
-									},
-								},
-							},
-							map[string]any{
-								"type": "builder_formula",
-								"spec": map[string]any{
-									"name":       "F1",
-									"expression": "(A / B) * 100",
-									"legend":     "{{service.name}} ({{deployment.environment}})",
-								},
-							},
-						},
-					},
-					"selectedQueryName": "F1",
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":      "critical",
-								"op":        "above",
-								"matchType": "at_least_once",
-								"target":    1,
-								"channels":  []any{"slack-api-alerts", "pagerduty-oncall"},
-							},
-						},
-					},
-				},
-				"evaluation": rolling("5m", "1m"),
-				"notificationSettings": map[string]any{
-					"groupBy":           []any{"service.name", "deployment.environment"},
-					"newGroupEvalDelay": "2m",
-					"usePolicy":         false,
-					"renotify":          renotify("30m", "firing", "nodata"),
-				},
-				"labels": map[string]any{"team": "platform"},
-				"annotations": map[string]any{
-					"description": "{{$service.name}} 5xx rate in {{$deployment.environment}} is {{$value}}%.",
-					"summary":     "API service error rate elevated",
-				},
-			},
-		},
-	}
-}

pkg/apiserver/signozapiserver/ruler_examples_test.go

@@ -1,32 +0,0 @@
-package signozapiserver
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/types/ruletypes"
-)
-
-// TestPostableRuleExamplesValidate verifies every example payload returned by
-// postableRuleExamples() round-trips through PostableRule.UnmarshalJSON and
-// passes Validate(). If an example drifts from the runtime contract this
-// breaks loudly so the spec doesn't ship invalid payloads to users.
-func TestPostableRuleExamplesValidate(t *testing.T) {
-	for _, example := range postableRuleExamples() {
-		t.Run(example.Name, func(t *testing.T) {
-			raw, err := json.Marshal(example.Value)
-			if err != nil {
-				t.Fatalf("marshal example: %v", err)
-			}
-
-			var rule ruletypes.PostableRule
-			if err := json.Unmarshal(raw, &rule); err != nil {
-				t.Fatalf("unmarshal: %v\npayload: %s", err, raw)
-			}
-
-			if err := rule.Validate(); err != nil {
-				t.Fatalf("Validate: %v\npayload: %s", err, raw)
-			}
-		})
-	}
-}

pkg/authz/authz.go

@@ -26,7 +26,7 @@ type AuthZ interface {
 	Write(context.Context, []*openfgav1.TupleKey, []*openfgav1.TupleKey) error
 
 	// Lists the selectors for objects assigned to subject (s) with relation (r) on resource (s)
-	ListObjects(context.Context, string, authtypes.Relation, authtypes.Typeable) ([]*authtypes.Object, error)
+	ListObjects(context.Context, string, authtypes.Relation, authtypes.Type) ([]*authtypes.Object, error)
 
 	// Creates the role.
 	Create(context.Context, valuer.UUID, *authtypes.Role) error
@@ -78,6 +78,9 @@ type AuthZ interface {
 
 	// Bootstrap managed roles transactions and user assignments
 	CreateManagedUserRoleTransactions(context.Context, valuer.UUID, valuer.UUID) error
+
+	// ReadTuples reads tuples from the authorization server matching the given tuple key filter.
+	ReadTuples(context.Context, *openfgav1.ReadRequestTupleKey) ([]*openfgav1.TupleKey, error)
 }
 
 type RegisterTypeable interface {

pkg/authz/authzstore/sqlauthzstore/store.go

@@ -18,7 +18,7 @@ func NewSqlAuthzStore(sqlstore sqlstore.SQLStore) authtypes.RoleStore {
 	return &store{sqlstore: sqlstore}
 }
 
-func (store *store) Create(ctx context.Context, role *authtypes.StorableRole) error {
+func (store *store) Create(ctx context.Context, role *authtypes.Role) error {
 	_, err := store.
 		sqlstore.
 		BunDBCtx(ctx).
@@ -32,8 +32,8 @@ func (store *store) Create(ctx context.Context, role *authtypes.StorableRole) er
 	return nil
 }
 
-func (store *store) Get(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*authtypes.StorableRole, error) {
-	role := new(authtypes.StorableRole)
+func (store *store) Get(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*authtypes.Role, error) {
+	role := new(authtypes.Role)
 	err := store.
 		sqlstore.
 		BunDBCtx(ctx).
@@ -49,8 +49,8 @@ func (store *store) Get(ctx context.Context, orgID valuer.UUID, id valuer.UUID)
 	return role, nil
 }
 
-func (store *store) GetByOrgIDAndName(ctx context.Context, orgID valuer.UUID, name string) (*authtypes.StorableRole, error) {
-	role := new(authtypes.StorableRole)
+func (store *store) GetByOrgIDAndName(ctx context.Context, orgID valuer.UUID, name string) (*authtypes.Role, error) {
+	role := new(authtypes.Role)
 	err := store.
 		sqlstore.
 		BunDBCtx(ctx).
@@ -66,8 +66,8 @@ func (store *store) GetByOrgIDAndName(ctx context.Context, orgID valuer.UUID, na
 	return role, nil
 }
 
-func (store *store) List(ctx context.Context, orgID valuer.UUID) ([]*authtypes.StorableRole, error) {
-	roles := make([]*authtypes.StorableRole, 0)
+func (store *store) List(ctx context.Context, orgID valuer.UUID) ([]*authtypes.Role, error) {
+	roles := make([]*authtypes.Role, 0)
 	err := store.
 		sqlstore.
 		BunDBCtx(ctx).
@@ -82,8 +82,8 @@ func (store *store) List(ctx context.Context, orgID valuer.UUID) ([]*authtypes.S
 	return roles, nil
 }
 
-func (store *store) ListByOrgIDAndNames(ctx context.Context, orgID valuer.UUID, names []string) ([]*authtypes.StorableRole, error) {
-	roles := make([]*authtypes.StorableRole, 0)
+func (store *store) ListByOrgIDAndNames(ctx context.Context, orgID valuer.UUID, names []string) ([]*authtypes.Role, error) {
+	roles := make([]*authtypes.Role, 0)
 	err := store.
 		sqlstore.
 		BunDBCtx(ctx).
@@ -103,8 +103,8 @@ func (store *store) ListByOrgIDAndNames(ctx context.Context, orgID valuer.UUID,
 	return roles, nil
 }
 
-func (store *store) ListByOrgIDAndIDs(ctx context.Context, orgID valuer.UUID, ids []valuer.UUID) ([]*authtypes.StorableRole, error) {
-	roles := make([]*authtypes.StorableRole, 0)
+func (store *store) ListByOrgIDAndIDs(ctx context.Context, orgID valuer.UUID, ids []valuer.UUID) ([]*authtypes.Role, error) {
+	roles := make([]*authtypes.Role, 0)
 	err := store.
 		sqlstore.
 		BunDBCtx(ctx).
@@ -124,7 +124,7 @@ func (store *store) ListByOrgIDAndIDs(ctx context.Context, orgID valuer.UUID, id
 	return roles, nil
 }
 
-func (store *store) Update(ctx context.Context, orgID valuer.UUID, role *authtypes.StorableRole) error {
+func (store *store) Update(ctx context.Context, orgID valuer.UUID, role *authtypes.Role) error {
 	_, err := store.
 		sqlstore.
 		BunDBCtx(ctx).
@@ -145,7 +145,7 @@ func (store *store) Delete(ctx context.Context, orgID valuer.UUID, id valuer.UUI
 		sqlstore.
 		BunDBCtx(ctx).
 		NewDelete().
-		Model(new(authtypes.StorableRole)).
+		Model(new(authtypes.Role)).
 		Where("org_id = ?", orgID).
 		Where("id = ?", id).
 		Exec(ctx)
@@ -156,6 +156,36 @@ func (store *store) Delete(ctx context.Context, orgID valuer.UUID, id valuer.UUI
 	return nil
 }
 
+func (store *store) HasUserAssignees(ctx context.Context, roleID valuer.UUID) (bool, error) {
+	exists, err := store.
+		sqlstore.
+		BunDBCtx(ctx).
+		NewSelect().
+		TableExpr("user_role").
+		Where("role_id = ?", roleID).
+		Exists(ctx)
+	if err != nil {
+		return false, err
+	}
+
+	return exists, nil
+}
+
+func (store *store) HasServiceAccountAssignees(ctx context.Context, roleID valuer.UUID) (bool, error) {
+	exists, err := store.
+		sqlstore.
+		BunDBCtx(ctx).
+		NewSelect().
+		TableExpr("service_account_role").
+		Where("role_id = ?", roleID).
+		Exists(ctx)
+	if err != nil {
+		return false, err
+	}
+
+	return exists, nil
+}
+
 func (store *store) RunInTx(ctx context.Context, cb func(ctx context.Context) error) error {
 	return store.sqlstore.RunInTxCtx(ctx, nil, func(ctx context.Context) error {
 		return cb(ctx)

pkg/authz/config.go

@@ -4,14 +4,30 @@ import (
 	"github.com/SigNoz/signoz/pkg/factory"
 )
 
-type Config struct{}
+type Config struct {
+	// Provider is the name of the authorization provider to use.
+	Provider string `mapstructure:"provider"`
+
+	// OpenFGA is the configuration specific to the OpenFGA authorization provider.
+	OpenFGA OpenFGAConfig `mapstructure:"openfga"`
+}
+
+type OpenFGAConfig struct {
+	// MaxTuplesPerWrite is the maximum number of tuples to include in a single write call.
+	MaxTuplesPerWrite int `mapstructure:"max_tuples_per_write"`
+}
 
 func NewConfigFactory() factory.ConfigFactory {
 	return factory.NewConfigFactory(factory.MustNewName("authz"), newConfig)
 }
 
 func newConfig() factory.Config {
-	return Config{}
+	return &Config{
+		Provider: "openfga",
+		OpenFGA: OpenFGAConfig{
+			MaxTuplesPerWrite: 100,
+		},
+	}
 }
 
 func (c Config) Validate() error {

pkg/authz/openfgaauthz/provider.go

@@ -68,68 +68,32 @@ func (provider *provider) Write(ctx context.Context, additions []*openfgav1.Tupl
 	return provider.server.Write(ctx, additions, deletions)
 }
 
-func (provider *provider) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, typeable authtypes.Typeable) ([]*authtypes.Object, error) {
-	return provider.server.ListObjects(ctx, subject, relation, typeable)
+func (provider *provider) ReadTuples(ctx context.Context, tupleKey *openfgav1.ReadRequestTupleKey) ([]*openfgav1.TupleKey, error) {
+	return provider.server.ReadTuples(ctx, tupleKey)
+}
+
+func (provider *provider) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, objectType authtypes.Type) ([]*authtypes.Object, error) {
+	return provider.server.ListObjects(ctx, subject, relation, objectType)
 }
 
 func (provider *provider) Get(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*authtypes.Role, error) {
-	storableRole, err := provider.store.Get(ctx, orgID, id)
-	if err != nil {
-		return nil, err
-	}
-
-	return authtypes.NewRoleFromStorableRole(storableRole), nil
+	return provider.store.Get(ctx, orgID, id)
 }
 
 func (provider *provider) GetByOrgIDAndName(ctx context.Context, orgID valuer.UUID, name string) (*authtypes.Role, error) {
-	storableRole, err := provider.store.GetByOrgIDAndName(ctx, orgID, name)
-	if err != nil {
-		return nil, err
-	}
-
-	return authtypes.NewRoleFromStorableRole(storableRole), nil
+	return provider.store.GetByOrgIDAndName(ctx, orgID, name)
 }
 
 func (provider *provider) List(ctx context.Context, orgID valuer.UUID) ([]*authtypes.Role, error) {
-	storableRoles, err := provider.store.List(ctx, orgID)
-	if err != nil {
-		return nil, err
-	}
-
-	roles := make([]*authtypes.Role, len(storableRoles))
-	for idx, storableRole := range storableRoles {
-		roles[idx] = authtypes.NewRoleFromStorableRole(storableRole)
-	}
-
-	return roles, nil
+	return provider.store.List(ctx, orgID)
 }
 
 func (provider *provider) ListByOrgIDAndNames(ctx context.Context, orgID valuer.UUID, names []string) ([]*authtypes.Role, error) {
-	storableRoles, err := provider.store.ListByOrgIDAndNames(ctx, orgID, names)
-	if err != nil {
-		return nil, err
-	}
-
-	roles := make([]*authtypes.Role, len(storableRoles))
-	for idx, storable := range storableRoles {
-		roles[idx] = authtypes.NewRoleFromStorableRole(storable)
-	}
-
-	return roles, nil
+	return provider.store.ListByOrgIDAndNames(ctx, orgID, names)
 }
 
 func (provider *provider) ListByOrgIDAndIDs(ctx context.Context, orgID valuer.UUID, ids []valuer.UUID) ([]*authtypes.Role, error) {
-	storableRoles, err := provider.store.ListByOrgIDAndIDs(ctx, orgID, ids)
-	if err != nil {
-		return nil, err
-	}
-
-	roles := make([]*authtypes.Role, len(storableRoles))
-	for idx, storable := range storableRoles {
-		roles[idx] = authtypes.NewRoleFromStorableRole(storable)
-	}
-
-	return roles, nil
+	return provider.store.ListByOrgIDAndIDs(ctx, orgID, ids)
 }
 
 func (provider *provider) Grant(ctx context.Context, orgID valuer.UUID, names []string, subject string) error {
@@ -197,7 +161,7 @@ func (provider *provider) Revoke(ctx context.Context, orgID valuer.UUID, names [
 func (provider *provider) CreateManagedRoles(ctx context.Context, _ valuer.UUID, managedRoles []*authtypes.Role) error {
 	err := provider.store.RunInTx(ctx, func(ctx context.Context) error {
 		for _, role := range managedRoles {
-			err := provider.store.Create(ctx, authtypes.NewStorableRoleFromRole(role))
+			err := provider.store.Create(ctx, role)
 			if err != nil {
 				return err
 			}

pkg/authz/openfgaserver/server.go

@@ -265,17 +265,45 @@ func (server *Server) Write(ctx context.Context, additions []*openfgav1.TupleKey
 	return nil
 }
 
-func (server *Server) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, typeable authtypes.Typeable) ([]*authtypes.Object, error) {
+func (server *Server) ReadTuples(ctx context.Context, tupleKey *openfgav1.ReadRequestTupleKey) ([]*openfgav1.TupleKey, error) {
+	storeID, _ := server.getStoreIDandModelID()
+	var tuples []*openfgav1.TupleKey
+	continuationToken := ""
+
+	for {
+		response, err := server.openfgaServer.Read(ctx, &openfgav1.ReadRequest{
+			StoreId:           storeID,
+			TupleKey:          tupleKey,
+			ContinuationToken: continuationToken,
+		})
+		if err != nil {
+			return nil, errors.Wrapf(err, errors.TypeInternal, authtypes.ErrCodeAuthZUnavailable, "failed to read tuples from authorization server")
+		}
+
+		for _, tuple := range response.Tuples {
+			tuples = append(tuples, tuple.Key)
+		}
+
+		if response.ContinuationToken == "" {
+			break
+		}
+		continuationToken = response.ContinuationToken
+	}
+
+	return tuples, nil
+}
+
+func (server *Server) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, objectType authtypes.Type) ([]*authtypes.Object, error) {
 	storeID, modelID := server.getStoreIDandModelID()
 	response, err := server.openfgaServer.ListObjects(ctx, &openfgav1.ListObjectsRequest{
 		StoreId:              storeID,
 		AuthorizationModelId: modelID,
 		User:                 subject,
 		Relation:             relation.StringValue(),
-		Type:                 typeable.Type().StringValue(),
+		Type:                 objectType.StringValue(),
 	})
 	if err != nil {
-		return nil, errors.Wrapf(err, errors.TypeInternal, authtypes.ErrCodeAuthZUnavailable, "cannot list objects for subject %s with relation %s for type %s", subject, relation.StringValue(), typeable.Type().StringValue())
+		return nil, errors.Wrapf(err, errors.TypeInternal, authtypes.ErrCodeAuthZUnavailable, "cannot list objects for subject %s with relation %s for type %s", subject, relation.StringValue(), objectType.StringValue())
 	}
 
 	return authtypes.MustNewObjectsFromStringSlice(response.Objects), nil

pkg/signoz/config.go

@@ -12,6 +12,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/analytics"
 	"github.com/SigNoz/signoz/pkg/apiserver"
 	"github.com/SigNoz/signoz/pkg/auditor"
+	"github.com/SigNoz/signoz/pkg/authz"
 	"github.com/SigNoz/signoz/pkg/cache"
 	"github.com/SigNoz/signoz/pkg/config"
 	"github.com/SigNoz/signoz/pkg/emailing"
@@ -131,6 +132,9 @@ type Config struct {
 
 	// CloudIntegration config
 	CloudIntegration cloudintegration.Config `mapstructure:"cloudintegration"`
+
+	// Authz config
+	Authz authz.Config `mapstructure:"authz"`
 }
 
 func NewConfig(ctx context.Context, logger *slog.Logger, resolverConfig config.ResolverConfig) (Config, error) {
@@ -163,6 +167,7 @@ func NewConfig(ctx context.Context, logger *slog.Logger, resolverConfig config.R
 		serviceaccount.NewConfigFactory(),
 		auditor.NewConfigFactory(),
 		cloudintegration.NewConfigFactory(),
+		authz.NewConfigFactory(),
 	}
 
 	conf, err := config.New(ctx, resolverConfig, configFactories)

pkg/signoz/signoz.go

@@ -333,7 +333,7 @@ func New(
 	if err != nil {
 		return nil, err
 	}
-	authz, err := authzProviderFactory.New(ctx, providerSettings, authz.Config{})
+	authz, err := authzProviderFactory.New(ctx, providerSettings, config.Authz)
 	if err != nil {
 		return nil, err
 	}

pkg/sqlmigration/059_add_managed_roles.go

@@ -54,7 +54,7 @@ func (migration *addManagedRoles) Up(ctx context.Context, db *bun.DB) error {
 		return err
 	}
 
-	managedRoles := []*authtypes.StorableRole{}
+	managedRoles := []*authtypes.Role{}
 	for _, orgIDStr := range orgIDs {
 		orgID, err := valuer.NewUUID(orgIDStr)
 		if err != nil {
@@ -63,19 +63,19 @@ func (migration *addManagedRoles) Up(ctx context.Context, db *bun.DB) error {
 
 		// signoz admin
 		signozAdminRole := authtypes.NewRole(authtypes.SigNozAdminRoleName, authtypes.SigNozAdminRoleDescription, authtypes.RoleTypeManaged, orgID)
-		managedRoles = append(managedRoles, authtypes.NewStorableRoleFromRole(signozAdminRole))
+		managedRoles = append(managedRoles, signozAdminRole)
 
 		// signoz editor
 		signozEditorRole := authtypes.NewRole(authtypes.SigNozEditorRoleName, authtypes.SigNozEditorRoleDescription, authtypes.RoleTypeManaged, orgID)
-		managedRoles = append(managedRoles, authtypes.NewStorableRoleFromRole(signozEditorRole))
+		managedRoles = append(managedRoles, signozEditorRole)
 
 		// signoz viewer
 		signozViewerRole := authtypes.NewRole(authtypes.SigNozViewerRoleName, authtypes.SigNozViewerRoleDescription, authtypes.RoleTypeManaged, orgID)
-		managedRoles = append(managedRoles, authtypes.NewStorableRoleFromRole(signozViewerRole))
+		managedRoles = append(managedRoles, signozViewerRole)
 
 		// signoz anonymous
 		signozAnonymousRole := authtypes.NewRole(authtypes.SigNozAnonymousRoleName, authtypes.SigNozAnonymousRoleDescription, authtypes.RoleTypeManaged, orgID)
-		managedRoles = append(managedRoles, authtypes.NewStorableRoleFromRole(signozAnonymousRole))
+		managedRoles = append(managedRoles, signozAnonymousRole)
 	}
 
 	if len(managedRoles) > 0 {

pkg/types/authtypes/role.go

@@ -20,6 +20,8 @@ var (
 	ErrCodeRoleNotFound                     = errors.MustNewCode("role_not_found")
 	ErrCodeRoleFailedTransactionsFromString = errors.MustNewCode("role_failed_transactions_from_string")
 	ErrCodeRoleUnsupported                  = errors.MustNewCode("role_unsupported")
+	ErrCodeRoleHasUserAssignees             = errors.MustNewCode("role_has_user_assignees")
+	ErrCodeRoleHasServiceAccountAssignees   = errors.MustNewCode("role_has_service_account_assignees")
 )
 
 var (
@@ -60,17 +62,6 @@ var (
 	TypeableResourcesRoles = MustNewTypeableMetaResources(MustNewName("roles"))
 )
 
-type StorableRole struct {
-	bun.BaseModel `bun:"table:role"`
-
-	types.Identifiable
-	types.TimeAuditable
-	Name        string `bun:"name,type:string" json:"name"`
-	Description string `bun:"description,type:string" json:"description"`
-	Type        string `bun:"type,type:string" json:"type"`
-	OrgID       string `bun:"org_id,type:string" json:"orgId"`
-}
-
 type Role struct {
 	bun.BaseModel `bun:"table:role"`
 
@@ -91,28 +82,6 @@ type PatchableRole struct {
 	Description string `json:"description" required:"true"`
 }
 
-func NewStorableRoleFromRole(role *Role) *StorableRole {
-	return &StorableRole{
-		Identifiable:  role.Identifiable,
-		TimeAuditable: role.TimeAuditable,
-		Name:          role.Name,
-		Description:   role.Description,
-		Type:          role.Type.String(),
-		OrgID:         role.OrgID.StringValue(),
-	}
-}
-
-func NewRoleFromStorableRole(storableRole *StorableRole) *Role {
-	return &Role{
-		Identifiable:  storableRole.Identifiable,
-		TimeAuditable: storableRole.TimeAuditable,
-		Name:          storableRole.Name,
-		Description:   storableRole.Description,
-		Type:          valuer.NewString(storableRole.Type),
-		OrgID:         valuer.MustNewUUID(storableRole.OrgID),
-	}
-}
-
 func NewRole(name, description string, roleType valuer.String, orgID valuer.UUID) *Role {
 	return &Role{
 		Identifiable: types.Identifiable{
@@ -264,13 +233,15 @@ func MustGetSigNozManagedRoleFromExistingRole(role types.Role) string {
 }
 
 type RoleStore interface {
-	Create(context.Context, *StorableRole) error
-	Get(context.Context, valuer.UUID, valuer.UUID) (*StorableRole, error)
-	GetByOrgIDAndName(context.Context, valuer.UUID, string) (*StorableRole, error)
-	List(context.Context, valuer.UUID) ([]*StorableRole, error)
-	ListByOrgIDAndNames(context.Context, valuer.UUID, []string) ([]*StorableRole, error)
-	ListByOrgIDAndIDs(context.Context, valuer.UUID, []valuer.UUID) ([]*StorableRole, error)
-	Update(context.Context, valuer.UUID, *StorableRole) error
+	Create(context.Context, *Role) error
+	Get(context.Context, valuer.UUID, valuer.UUID) (*Role, error)
+	GetByOrgIDAndName(context.Context, valuer.UUID, string) (*Role, error)
+	List(context.Context, valuer.UUID) ([]*Role, error)
+	ListByOrgIDAndNames(context.Context, valuer.UUID, []string) ([]*Role, error)
+	ListByOrgIDAndIDs(context.Context, valuer.UUID, []valuer.UUID) ([]*Role, error)
+	Update(context.Context, valuer.UUID, *Role) error
 	Delete(context.Context, valuer.UUID, valuer.UUID) error
+	HasUserAssignees(context.Context, valuer.UUID) (bool, error)
+	HasServiceAccountAssignees(context.Context, valuer.UUID) (bool, error)
 	RunInTx(context.Context, func(ctx context.Context) error) error
 }

pkg/types/ruletypes/alerting.go

@@ -114,11 +114,11 @@ type AlertCompositeQuery struct {
 
 type RuleCondition struct {
 	CompositeQuery    *AlertCompositeQuery `json:"compositeQuery" required:"true"`
-	CompareOperator   CompareOperator      `json:"op,omitzero"`
+	CompareOperator   CompareOperator      `json:"op" required:"true"`
 	Target            *float64             `json:"target,omitempty"`
 	AlertOnAbsent     bool                 `json:"alertOnAbsent,omitempty"`
 	AbsentFor         uint64               `json:"absentFor,omitempty"`
-	MatchType         MatchType            `json:"matchType,omitzero"`
+	MatchType         MatchType            `json:"matchType" required:"true"`
 	TargetUnit        string               `json:"targetUnit,omitempty"`
 	Algorithm         string               `json:"algorithm,omitempty"`
 	Seasonality       Seasonality          `json:"seasonality,omitzero"`

pkg/types/ruletypes/api_params.go

@@ -50,13 +50,13 @@ const (
 // PostableRule is used to create alerting rule from HTTP api.
 type PostableRule struct {
 	AlertName   string              `json:"alert" required:"true"`
-	AlertType   AlertType           `json:"alertType" required:"true"`
+	AlertType   AlertType           `json:"alertType,omitempty"`
 	Description string              `json:"description,omitempty"`
-	RuleType    RuleType            `json:"ruleType" required:"true"`
+	RuleType    RuleType            `json:"ruleType,omitzero" required:"true"`
 	EvalWindow  valuer.TextDuration `json:"evalWindow,omitzero"`
 	Frequency   valuer.TextDuration `json:"frequency,omitzero"`
 
-	RuleCondition *RuleCondition    `json:"condition" required:"true"`
+	RuleCondition *RuleCondition    `json:"condition,omitempty" required:"true"`
 	Labels        map[string]string `json:"labels,omitempty"`
 	Annotations   map[string]string `json:"annotations,omitempty"`
 
@@ -67,9 +67,9 @@ type PostableRule struct {
 
 	PreferredChannels []string `json:"preferredChannels,omitempty"`
 
-	Version string `json:"version"`
+	Version string `json:"version,omitempty"`
 
-	Evaluation    *EvaluationEnvelope `json:"evaluation,omitempty"`
+	Evaluation    *EvaluationEnvelope `yaml:"evaluation,omitempty" json:"evaluation,omitempty"`
 	SchemaVersion string              `json:"schemaVersion,omitempty"`
 
 	NotificationSettings *NotificationSettings `json:"notificationSettings,omitempty"`