fix(user): return 400 instead of 501 for protected user states

ErrIfRoot, ErrIfDeleted and ErrIfPending used TypeUnsupported, which maps to 501. That code means the server lacks the functionality, which is how the noop providers use it for edition gating. These guards are business rules present in every build, so 501 was never accurate. They now use TypeInvalidInput, matching ErrIfNotPending which already did. No status code expresses "permanently rejected for every caller", so the meaning stays in the machine readable error code that each guard already carries. Assisted-by: Claude Fable 5
test(callbackauthn): cover the google authn flow end to end (#12486 )
2026-08-10 23:10:47 +01:00 · 2026-08-10 14:41:21 +05:30 · 2026-08-10 08:35:58 +00:00 · 2026-08-10 08:27:46 +00:00 · 2026-08-10 06:54:54 +00:00 · 2026-08-10 06:33:29 +00:00
161 changed files with 5058 additions and 9793 deletions
--- a/docs/api/openapi.yml
+++ b/docs/api/openapi.yml
@@ -4212,6 +4212,21 @@ components:
      - missingOptionalMetrics
      - missingRequiredAttributes
      type: object
+    InframonitoringtypesClusterFilter:
+      properties:
+        expression:
+          type: string
+        filterByNodeReadiness:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesNodeCondition'
+          nullable: true
+          type: array
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
    InframonitoringtypesClusterRecord:
      properties:
        clusterCPU:
@@ -4349,6 +4364,16 @@ components:
      - containerCannotRun
      - unknown
      type: object
+    InframonitoringtypesContainerFilter:
+      properties:
+        expression:
+          type: string
+        filterByContainerStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesContainerStatus'
+          nullable: true
+          type: array
+      type: object
    InframonitoringtypesContainerReady:
      enum:
      - ready
@@ -4448,6 +4473,16 @@ components:
      - total
      - endTimeBeforeRetention
      type: object
+    InframonitoringtypesDaemonSetFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
    InframonitoringtypesDaemonSetRecord:
      properties:
        currentNodes:
@@ -4520,6 +4555,16 @@ components:
      - total
      - endTimeBeforeRetention
      type: object
+    InframonitoringtypesDeploymentFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
    InframonitoringtypesDeploymentRecord:
      properties:
        availablePods:
@@ -4661,6 +4706,16 @@ components:
      - total
      - endTimeBeforeRetention
      type: object
+    InframonitoringtypesJobFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
    InframonitoringtypesJobRecord:
      properties:
        activePods:
@@ -4784,6 +4839,16 @@ components:
      - message
      - documentationLink
      type: object
+    InframonitoringtypesNamespaceFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
    InframonitoringtypesNamespaceRecord:
      properties:
        counts:
@@ -4865,6 +4930,21 @@ components:
      - ready
      - notReady
      type: object
+    InframonitoringtypesNodeFilter:
+      properties:
+        expression:
+          type: string
+        filterByNodeReadiness:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesNodeCondition'
+          nullable: true
+          type: array
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
    InframonitoringtypesNodeRecord:
      properties:
        condition:
@@ -4981,6 +5061,16 @@ components:
      - shutdown
      - unexpectedAdmissionError
      type: object
+    InframonitoringtypesPodFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
    InframonitoringtypesPodRecord:
      properties:
        meta:
@@ -5080,7 +5170,7 @@ components:
          format: int64
          type: integer
        filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesClusterFilter'
        groupBy:
          items:
            $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5106,7 +5196,7 @@ components:
          format: int64
          type: integer
        filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesContainerFilter'
        groupBy:
          items:
            $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5132,7 +5222,7 @@ components:
          format: int64
          type: integer
        filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesDaemonSetFilter'
        groupBy:
          items:
            $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5158,7 +5248,7 @@ components:
          format: int64
          type: integer
        filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesDeploymentFilter'
        groupBy:
          items:
            $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5210,7 +5300,7 @@ components:
          format: int64
          type: integer
        filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesJobFilter'
        groupBy:
          items:
            $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5236,7 +5326,7 @@ components:
          format: int64
          type: integer
        filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesNamespaceFilter'
        groupBy:
          items:
            $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5262,7 +5352,7 @@ components:
          format: int64
          type: integer
        filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesNodeFilter'
        groupBy:
          items:
            $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5288,7 +5378,7 @@ components:
          format: int64
          type: integer
        filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesPodFilter'
        groupBy:
          items:
            $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5314,7 +5404,7 @@ components:
          format: int64
          type: integer
        filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesStatefulSetFilter'
        groupBy:
          items:
            $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5365,6 +5455,16 @@ components:
      - list
      - grouped_list
      type: string
+    InframonitoringtypesStatefulSetFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
    InframonitoringtypesStatefulSetRecord:
      properties:
        currentPods:
@@ -8838,15 +8938,6 @@ components:
      required:
      - id
      type: object
-    TypesPostableBulkInviteRequest:
-      properties:
-        invites:
-          items:
-            $ref: '#/components/schemas/TypesPostableInvite'
-          type: array
-      required:
-      - invites
-      type: object
    TypesPostableForgotPassword:
      properties:
        email:
@@ -11454,57 +11545,6 @@ paths:
      summary: Create invite
      tags:
      - users
-  /api/v1/invite/bulk:
-    post:
-      deprecated: true
-      description: This endpoint creates a bulk invite for a user
-      operationId: CreateBulkInvite
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/TypesPostableBulkInviteRequest'
-      responses:
-        "201":
-          description: Created
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "409":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Conflict
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Create bulk invite
-      tags:
-      - users
  /api/v1/llm_pricing_rules:
    get:
      deprecated: false
@@ -12158,9 +12198,9 @@ paths:
      - dashboard
  /api/v1/resetPassword:
    post:
-      deprecated: false
+      deprecated: true
      description: This endpoint resets the password by token
-      operationId: ResetPassword
+      operationId: ResetPasswordDeprecated
      requestBody:
        content:
          application/json:
@@ -14428,177 +14468,6 @@ paths:
      summary: List users
      tags:
      - users
-  /api/v1/user/{id}:
-    delete:
-      deprecated: true
-      description: This endpoint deletes the user by id
-      operationId: DeleteUserDeprecated
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      responses:
-        "204":
-          description: No Content
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Delete user
-      tags:
-      - users
-    get:
-      deprecated: true
-      description: This endpoint returns the user by id
-      operationId: GetUserDeprecated
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/TypesDeprecatedUser'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Get user
-      tags:
-      - users
-    put:
-      deprecated: true
-      description: This endpoint updates the user by id
-      operationId: UpdateUserDeprecated
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/TypesDeprecatedUser'
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/TypesDeprecatedUser'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Update user
-      tags:
-      - users
  /api/v1/user/me:
    get:
      deprecated: true
@@ -15698,6 +15567,41 @@ paths:
      summary: Forgot password
      tags:
      - users
+  /api/v2/factor_password/reset:
+    post:
+      deprecated: false
+      description: This endpoint resets the password using a single use reset password
+        token
+      operationId: ResetPassword
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/TypesPostableResetPassword'
+      responses:
+        "204":
+          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      summary: Reset password
+      tags:
+      - users
  /api/v2/features:
    get:
      deprecated: false
@@ -23517,6 +23421,12 @@ paths:
      responses:
        "204":
          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
        "401":
          content:
            application/json:
@@ -23863,6 +23773,12 @@ paths:
      responses:
        "200":
          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
        "401":
          content:
            application/json:
@@ -23915,6 +23831,12 @@ paths:
      responses:
        "204":
          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
        "401":
          content:
            application/json:
@@ -24002,6 +23924,12 @@ paths:
      responses:
        "204":
          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
        "401":
          content:
            application/json:
--- a/docs/contributing/tests/e2e.md
+++ b/docs/contributing/tests/e2e.md
@@ -232,14 +232,11 @@ cd tests/e2e
 # Single feature dir
 npx playwright test tests/alerts/ --project=chromium

-# Single sub-area
-npx playwright test tests/alerts/history/ --project=chromium
-
 # Single file
-npx playwright test tests/alerts/page.spec.ts --project=chromium
+npx playwright test tests/alerts/alerts.spec.ts --project=chromium

 # Single test by title grep
-npx playwright test --project=chromium -g "AL-01"
+npx playwright test --project=chromium -g "TC-01"
 ```

 ### Iterative modes
@@ -273,14 +270,7 @@ yarn test:staging
 | `SIGNOZ_E2E_PASSWORD` | Admin password. Bootstrap writes the integration-test default. |
 | `SIGNOZ_E2E_SEEDER_URL` | Seeder HTTP base URL — hit by specs that need per-test telemetry. |

-Precedence in `playwright.config.ts`, lowest to highest: `.env` (user-provided, staging) → `.env.local` (bootstrap-generated, local mode) → whatever is already in `process.env`. The config parses both files itself and only fills in keys the environment does not already define, so exporting a variable always wins:
-
-```bash
-# runs against a locally served frontend, not whatever .env.local points at
-SIGNOZ_E2E_BASE_URL=http://127.0.0.1:3301 pnpm test tests/alerts
-```
-
-This is deliberately not `dotenv.config({ override: true })`. That flag makes the *file* beat `process.env`, which silently discarded exported values — including the `SIGNOZ_E2E_BASE_URL` in `pnpm test:staging`, whenever a `.env.local` happened to exist.
+Loading order in `playwright.config.ts`: `.env` first (user-provided, staging), then `.env.local` with `override: true` (bootstrap-generated, local mode). Anything already set in `process.env` at yarn-test time wins because dotenv doesn't touch vars that are already present.

 ### Playwright options

--- a/frontend/src/api/generated/services/sigNoz.schemas.ts
+++ b/frontend/src/api/generated/services/sigNoz.schemas.ts
@@ -5648,6 +5648,47 @@ export interface InframonitoringtypesChecksDTO {
 	type: InframonitoringtypesCheckTypeDTO;
 }

+export enum InframonitoringtypesNodeConditionDTO {
+	ready = 'ready',
+	not_ready = 'not_ready',
+	no_data = 'no_data',
+}
+export enum InframonitoringtypesPodStatusDTO {
+	pending = 'pending',
+	running = 'running',
+	failed = 'failed',
+	unknown = 'unknown',
+	crashloopbackoff = 'crashloopbackoff',
+	imagepullbackoff = 'imagepullbackoff',
+	errimagepull = 'errimagepull',
+	createcontainerconfigerror = 'createcontainerconfigerror',
+	containercreating = 'containercreating',
+	oomkilled = 'oomkilled',
+	completed = 'completed',
+	error = 'error',
+	containercannotrun = 'containercannotrun',
+	evicted = 'evicted',
+	nodeaffinity = 'nodeaffinity',
+	nodelost = 'nodelost',
+	shutdown = 'shutdown',
+	unexpectedadmissionerror = 'unexpectedadmissionerror',
+	no_data = 'no_data',
+}
+export interface InframonitoringtypesClusterFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByNodeReadiness?: InframonitoringtypesNodeConditionDTO[] | null;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesClusterRecordDTOCounts = {
 	/**
 	 * @type integer
@@ -5923,21 +5964,6 @@ export interface InframonitoringtypesContainerCountsByStatusDTO {
 	waiting: number;
 }

-export enum InframonitoringtypesContainerReadyDTO {
-	ready = 'ready',
-	not_ready = 'not_ready',
-	no_data = 'no_data',
-}
-export type InframonitoringtypesContainerRecordDTOMetaAnyOf = {
-	[key: string]: string;
-};
-
-/**
- * @nullable
- */
-export type InframonitoringtypesContainerRecordDTOMeta =
-	InframonitoringtypesContainerRecordDTOMetaAnyOf | null;
-
 export enum InframonitoringtypesContainerStatusDTO {
 	running = 'running',
 	waiting = 'waiting',
@@ -5954,6 +5980,32 @@ export enum InframonitoringtypesContainerStatusDTO {
 	unknown = 'unknown',
 	no_data = 'no_data',
 }
+export interface InframonitoringtypesContainerFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByContainerStatus?: InframonitoringtypesContainerStatusDTO[] | null;
+}
+
+export enum InframonitoringtypesContainerReadyDTO {
+	ready = 'ready',
+	not_ready = 'not_ready',
+	no_data = 'no_data',
+}
+export type InframonitoringtypesContainerRecordDTOMetaAnyOf = {
+	[key: string]: string;
+};
+
+/**
+ * @nullable
+ */
+export type InframonitoringtypesContainerRecordDTOMeta =
+	InframonitoringtypesContainerRecordDTOMetaAnyOf | null;
+
 export interface InframonitoringtypesContainerRecordDTO {
 	containerCountsByReady: InframonitoringtypesContainerCountsByReadyDTO;
 	containerCountsByStatus: InframonitoringtypesContainerCountsByStatusDTO;
@@ -6025,6 +6077,17 @@ export interface InframonitoringtypesContainersDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }

+export interface InframonitoringtypesDaemonSetFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesDaemonSetRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6110,6 +6173,17 @@ export interface InframonitoringtypesDaemonSetsDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }

+export interface InframonitoringtypesDeploymentFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesDeploymentRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6272,6 +6346,17 @@ export interface InframonitoringtypesHostsDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }

+export interface InframonitoringtypesJobFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesJobRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6357,6 +6442,17 @@ export interface InframonitoringtypesJobsDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }

+export interface InframonitoringtypesNamespaceFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesNamespaceRecordDTOCounts = {
 	/**
 	 * @type integer
@@ -6433,11 +6529,21 @@ export interface InframonitoringtypesNamespacesDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }

-export enum InframonitoringtypesNodeConditionDTO {
-	ready = 'ready',
-	not_ready = 'not_ready',
-	no_data = 'no_data',
+export interface InframonitoringtypesNodeFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByNodeReadiness?: InframonitoringtypesNodeConditionDTO[] | null;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
 }
+
 export type InframonitoringtypesNodeRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6499,6 +6605,17 @@ export interface InframonitoringtypesNodesDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }

+export interface InframonitoringtypesPodFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesPodRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6509,27 +6626,6 @@ export type InframonitoringtypesPodRecordDTOMetaAnyOf = {
 export type InframonitoringtypesPodRecordDTOMeta =
 	InframonitoringtypesPodRecordDTOMetaAnyOf | null;

-export enum InframonitoringtypesPodStatusDTO {
-	pending = 'pending',
-	running = 'running',
-	failed = 'failed',
-	unknown = 'unknown',
-	crashloopbackoff = 'crashloopbackoff',
-	imagepullbackoff = 'imagepullbackoff',
-	errimagepull = 'errimagepull',
-	createcontainerconfigerror = 'createcontainerconfigerror',
-	containercreating = 'containercreating',
-	oomkilled = 'oomkilled',
-	completed = 'completed',
-	error = 'error',
-	containercannotrun = 'containercannotrun',
-	evicted = 'evicted',
-	nodeaffinity = 'nodeaffinity',
-	nodelost = 'nodelost',
-	shutdown = 'shutdown',
-	unexpectedadmissionerror = 'unexpectedadmissionerror',
-	no_data = 'no_data',
-}
 export interface InframonitoringtypesPodRecordDTO {
 	/**
 	 * @type object,null
@@ -6606,7 +6702,7 @@ export interface InframonitoringtypesPostableClustersDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesClusterFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6633,7 +6729,7 @@ export interface InframonitoringtypesPostableContainersDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesContainerFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6660,7 +6756,7 @@ export interface InframonitoringtypesPostableDaemonSetsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesDaemonSetFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6687,7 +6783,7 @@ export interface InframonitoringtypesPostableDeploymentsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesDeploymentFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6741,7 +6837,7 @@ export interface InframonitoringtypesPostableJobsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesJobFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6768,7 +6864,7 @@ export interface InframonitoringtypesPostableNamespacesDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesNamespaceFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6795,7 +6891,7 @@ export interface InframonitoringtypesPostableNodesDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesNodeFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6822,7 +6918,7 @@ export interface InframonitoringtypesPostablePodsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesPodFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6843,13 +6939,24 @@ export interface InframonitoringtypesPostablePodsDTO {
 	start: number;
 }

+export interface InframonitoringtypesStatefulSetFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export interface InframonitoringtypesPostableStatefulSetsDTO {
 	/**
 	 * @type integer
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesStatefulSetFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -9950,6 +10057,21 @@ export interface TypesOrganizationDTO {
 	updatedAt?: string;
 }

+export interface TypesPostableForgotPasswordDTO {
+	/**
+	 * @type string
+	 */
+	email: string;
+	/**
+	 * @type string
+	 */
+	frontendBaseURL?: string;
+	/**
+	 * @type string
+	 */
+	orgId: string;
+}
+
 export interface TypesPostableInviteDTO {
 	/**
 	 * @type string
@@ -9969,28 +10091,6 @@ export interface TypesPostableInviteDTO {
 	role?: string;
 }

-export interface TypesPostableBulkInviteRequestDTO {
-	/**
-	 * @type array
-	 */
-	invites: TypesPostableInviteDTO[];
-}
-
-export interface TypesPostableForgotPasswordDTO {
-	/**
-	 * @type string
-	 */
-	email: string;
-	/**
-	 * @type string
-	 */
-	frontendBaseURL?: string;
-	/**
-	 * @type string
-	 */
-	orgId: string;
-}
-
 export interface TypesPostableResetPasswordDTO {
 	/**
 	 * @type string
@@ -11101,31 +11201,6 @@ export type ListUsersDeprecated200 = {
 	status: string;
 };

-export type DeleteUserDeprecatedPathParameters = {
-	id: string;
-};
-export type GetUserDeprecatedPathParameters = {
-	id: string;
-};
-export type GetUserDeprecated200 = {
-	data: TypesDeprecatedUserDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type UpdateUserDeprecatedPathParameters = {
-	id: string;
-};
-export type UpdateUserDeprecated200 = {
-	data: TypesDeprecatedUserDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
 export type GetMyUserDeprecated200 = {
 	data: TypesDeprecatedUserDTO;
 	/**
--- a/frontend/src/api/generated/services/users/index.ts
+++ b/frontend/src/api/generated/services/users/index.ts
@@ -25,7 +25,6 @@ import type {
 	CreateResetPasswordTokenPathParameters,
 	CreateUser201,
 	CreateUserRole201,
-	DeleteUserDeprecatedPathParameters,
 	DeleteUserPathParameters,
 	DeleteUserRolePathParameters,
 	GetMyUser200,
@@ -37,8 +36,6 @@ import type {
 	GetRolesByUserID200,
 	GetRolesByUserIDPathParameters,
 	GetUser200,
-	GetUserDeprecated200,
-	GetUserDeprecatedPathParameters,
 	GetUserPathParameters,
 	GetUserRole200,
 	GetUserRolePathParameters,
@@ -50,16 +47,12 @@ import type {
 	RenderErrorResponseDTO,
 	SetRoleByUserIDPathParameters,
 	TypesChangePasswordRequestDTO,
-	TypesDeprecatedUserDTO,
-	TypesPostableBulkInviteRequestDTO,
 	TypesPostableForgotPasswordDTO,
 	TypesPostableInviteDTO,
 	TypesPostableResetPasswordDTO,
 	TypesPostableRoleDTO,
 	TypesPostableVerifyResetPasswordTokenDTO,
 	TypesUpdatableUserDTO,
-	UpdateUserDeprecated200,
-	UpdateUserDeprecatedPathParameters,
 	UpdateUserPathParameters,
 } from '../sigNoz.schemas';

@@ -260,96 +253,12 @@ export const useCreateInvite = <
 > => {
 	return useMutation(getCreateInviteMutationOptions(options));
 };
-/**
- * This endpoint creates a bulk invite for a user
- * @deprecated
- * @summary Create bulk invite
- */
-export const createBulkInvite = (
-	typesPostableBulkInviteRequestDTO?: BodyType<TypesPostableBulkInviteRequestDTO>,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<void>({
-		url: `/api/v1/invite/bulk`,
-		method: 'POST',
-		headers: { 'Content-Type': 'application/json' },
-		data: typesPostableBulkInviteRequestDTO,
-		signal,
-	});
-};
-
-export const getCreateBulkInviteMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof createBulkInvite>>,
-		TError,
-		{ data?: BodyType<TypesPostableBulkInviteRequestDTO> },
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof createBulkInvite>>,
-	TError,
-	{ data?: BodyType<TypesPostableBulkInviteRequestDTO> },
-	TContext
-> => {
-	const mutationKey = ['createBulkInvite'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof createBulkInvite>>,
-		{ data?: BodyType<TypesPostableBulkInviteRequestDTO> }
-	> = (props) => {
-		const { data } = props ?? {};
-
-		return createBulkInvite(data);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type CreateBulkInviteMutationResult = NonNullable<
-	Awaited<ReturnType<typeof createBulkInvite>>
->;
-export type CreateBulkInviteMutationBody =
-	| BodyType<TypesPostableBulkInviteRequestDTO>
-	| undefined;
-export type CreateBulkInviteMutationError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @deprecated
- * @summary Create bulk invite
- */
-export const useCreateBulkInvite = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof createBulkInvite>>,
-		TError,
-		{ data?: BodyType<TypesPostableBulkInviteRequestDTO> },
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof createBulkInvite>>,
-	TError,
-	{ data?: BodyType<TypesPostableBulkInviteRequestDTO> },
-	TContext
-> => {
-	return useMutation(getCreateBulkInviteMutationOptions(options));
-};
 /**
 * This endpoint resets the password by token
+ * @deprecated
 * @summary Reset password
 */
-export const resetPassword = (
+export const resetPasswordDeprecated = (
 	typesPostableResetPasswordDTO?: BodyType<TypesPostableResetPasswordDTO>,
 	signal?: AbortSignal,
 ) => {
@@ -362,23 +271,23 @@ export const resetPassword = (
 	});
 };

-export const getResetPasswordMutationOptions = <
+export const getResetPasswordDeprecatedMutationOptions = <
 	TError = ErrorType<RenderErrorResponseDTO>,
 	TContext = unknown,
 >(options?: {
 	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof resetPassword>>,
+		Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 		TError,
 		{ data?: BodyType<TypesPostableResetPasswordDTO> },
 		TContext
 	>;
 }): UseMutationOptions<
-	Awaited<ReturnType<typeof resetPassword>>,
+	Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 	TError,
 	{ data?: BodyType<TypesPostableResetPasswordDTO> },
 	TContext
 > => {
-	const mutationKey = ['resetPassword'];
+	const mutationKey = ['resetPasswordDeprecated'];
 	const { mutation: mutationOptions } = options
 		? options.mutation &&
 			'mutationKey' in options.mutation &&
@@ -388,45 +297,47 @@ export const getResetPasswordMutationOptions = <
 		: { mutation: { mutationKey } };

 	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof resetPassword>>,
+		Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 		{ data?: BodyType<TypesPostableResetPasswordDTO> }
 	> = (props) => {
 		const { data } = props ?? {};

-		return resetPassword(data);
+		return resetPasswordDeprecated(data);
 	};

 	return { mutationFn, ...mutationOptions };
 };

-export type ResetPasswordMutationResult = NonNullable<
-	Awaited<ReturnType<typeof resetPassword>>
+export type ResetPasswordDeprecatedMutationResult = NonNullable<
+	Awaited<ReturnType<typeof resetPasswordDeprecated>>
 >;
-export type ResetPasswordMutationBody =
+export type ResetPasswordDeprecatedMutationBody =
 	| BodyType<TypesPostableResetPasswordDTO>
 	| undefined;
-export type ResetPasswordMutationError = ErrorType<RenderErrorResponseDTO>;
+export type ResetPasswordDeprecatedMutationError =
+	ErrorType<RenderErrorResponseDTO>;

 /**
+ * @deprecated
 * @summary Reset password
 */
-export const useResetPassword = <
+export const useResetPasswordDeprecated = <
 	TError = ErrorType<RenderErrorResponseDTO>,
 	TContext = unknown,
 >(options?: {
 	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof resetPassword>>,
+		Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 		TError,
 		{ data?: BodyType<TypesPostableResetPasswordDTO> },
 		TContext
 	>;
 }): UseMutationResult<
-	Awaited<ReturnType<typeof resetPassword>>,
+	Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 	TError,
 	{ data?: BodyType<TypesPostableResetPasswordDTO> },
 	TContext
 > => {
-	return useMutation(getResetPasswordMutationOptions(options));
+	return useMutation(getResetPasswordDeprecatedMutationOptions(options));
 };
 /**
 * This endpoint lists all users
@@ -515,295 +426,6 @@ export const invalidateListUsersDeprecated = async (
 	return queryClient;
 };

-/**
- * This endpoint deletes the user by id
- * @deprecated
- * @summary Delete user
- */
-export const deleteUserDeprecated = (
-	{ id }: DeleteUserDeprecatedPathParameters,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<void>({
-		url: `/api/v1/user/${id}`,
-		method: 'DELETE',
-		signal,
-	});
-};
-
-export const getDeleteUserDeprecatedMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof deleteUserDeprecated>>,
-		TError,
-		{ pathParams: DeleteUserDeprecatedPathParameters },
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof deleteUserDeprecated>>,
-	TError,
-	{ pathParams: DeleteUserDeprecatedPathParameters },
-	TContext
-> => {
-	const mutationKey = ['deleteUserDeprecated'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof deleteUserDeprecated>>,
-		{ pathParams: DeleteUserDeprecatedPathParameters }
-	> = (props) => {
-		const { pathParams } = props ?? {};
-
-		return deleteUserDeprecated(pathParams);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type DeleteUserDeprecatedMutationResult = NonNullable<
-	Awaited<ReturnType<typeof deleteUserDeprecated>>
->;
-
-export type DeleteUserDeprecatedMutationError =
-	ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @deprecated
- * @summary Delete user
- */
-export const useDeleteUserDeprecated = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof deleteUserDeprecated>>,
-		TError,
-		{ pathParams: DeleteUserDeprecatedPathParameters },
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof deleteUserDeprecated>>,
-	TError,
-	{ pathParams: DeleteUserDeprecatedPathParameters },
-	TContext
-> => {
-	return useMutation(getDeleteUserDeprecatedMutationOptions(options));
-};
-/**
- * This endpoint returns the user by id
- * @deprecated
- * @summary Get user
- */
-export const getUserDeprecated = (
-	{ id }: GetUserDeprecatedPathParameters,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<GetUserDeprecated200>({
-		url: `/api/v1/user/${id}`,
-		method: 'GET',
-		signal,
-	});
-};
-
-export const getGetUserDeprecatedQueryKey = ({
-	id,
-}: GetUserDeprecatedPathParameters) => {
-	return [`/api/v1/user/${id}`] as const;
-};
-
-export const getGetUserDeprecatedQueryOptions = <
-	TData = Awaited<ReturnType<typeof getUserDeprecated>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ id }: GetUserDeprecatedPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getUserDeprecated>>,
-			TError,
-			TData
-		>;
-	},
-) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey =
-		queryOptions?.queryKey ?? getGetUserDeprecatedQueryKey({ id });
-
-	const queryFn: QueryFunction<
-		Awaited<ReturnType<typeof getUserDeprecated>>
-	> = ({ signal }) => getUserDeprecated({ id }, signal);
-
-	return {
-		queryKey,
-		queryFn,
-		enabled: !!id,
-		...queryOptions,
-	} as UseQueryOptions<
-		Awaited<ReturnType<typeof getUserDeprecated>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type GetUserDeprecatedQueryResult = NonNullable<
-	Awaited<ReturnType<typeof getUserDeprecated>>
->;
-export type GetUserDeprecatedQueryError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @deprecated
- * @summary Get user
- */
-
-export function useGetUserDeprecated<
-	TData = Awaited<ReturnType<typeof getUserDeprecated>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ id }: GetUserDeprecatedPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getUserDeprecated>>,
-			TError,
-			TData
-		>;
-	},
-): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getGetUserDeprecatedQueryOptions({ id }, options);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return { ...query, queryKey: queryOptions.queryKey };
-}
-
-/**
- * @deprecated
- * @summary Get user
- */
-export const invalidateGetUserDeprecated = async (
-	queryClient: QueryClient,
-	{ id }: GetUserDeprecatedPathParameters,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getGetUserDeprecatedQueryKey({ id }) },
-		options,
-	);
-
-	return queryClient;
-};
-
-/**
- * This endpoint updates the user by id
- * @deprecated
- * @summary Update user
- */
-export const updateUserDeprecated = (
-	{ id }: UpdateUserDeprecatedPathParameters,
-	typesDeprecatedUserDTO?: BodyType<TypesDeprecatedUserDTO>,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<UpdateUserDeprecated200>({
-		url: `/api/v1/user/${id}`,
-		method: 'PUT',
-		headers: { 'Content-Type': 'application/json' },
-		data: typesDeprecatedUserDTO,
-		signal,
-	});
-};
-
-export const getUpdateUserDeprecatedMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof updateUserDeprecated>>,
-		TError,
-		{
-			pathParams: UpdateUserDeprecatedPathParameters;
-			data?: BodyType<TypesDeprecatedUserDTO>;
-		},
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof updateUserDeprecated>>,
-	TError,
-	{
-		pathParams: UpdateUserDeprecatedPathParameters;
-		data?: BodyType<TypesDeprecatedUserDTO>;
-	},
-	TContext
-> => {
-	const mutationKey = ['updateUserDeprecated'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof updateUserDeprecated>>,
-		{
-			pathParams: UpdateUserDeprecatedPathParameters;
-			data?: BodyType<TypesDeprecatedUserDTO>;
-		}
-	> = (props) => {
-		const { pathParams, data } = props ?? {};
-
-		return updateUserDeprecated(pathParams, data);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type UpdateUserDeprecatedMutationResult = NonNullable<
-	Awaited<ReturnType<typeof updateUserDeprecated>>
->;
-export type UpdateUserDeprecatedMutationBody =
-	| BodyType<TypesDeprecatedUserDTO>
-	| undefined;
-export type UpdateUserDeprecatedMutationError =
-	ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @deprecated
- * @summary Update user
- */
-export const useUpdateUserDeprecated = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof updateUserDeprecated>>,
-		TError,
-		{
-			pathParams: UpdateUserDeprecatedPathParameters;
-			data?: BodyType<TypesDeprecatedUserDTO>;
-		},
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof updateUserDeprecated>>,
-	TError,
-	{
-		pathParams: UpdateUserDeprecatedPathParameters;
-		data?: BodyType<TypesDeprecatedUserDTO>;
-	},
-	TContext
-> => {
-	return useMutation(getUpdateUserDeprecatedMutationOptions(options));
-};
 /**
 * This endpoint returns the user I belong to
 * @deprecated
@@ -974,6 +596,89 @@ export const useForgotPassword = <
 > => {
 	return useMutation(getForgotPasswordMutationOptions(options));
 };
+/**
+ * This endpoint resets the password using a single use reset password token
+ * @summary Reset password
+ */
+export const resetPassword = (
+	typesPostableResetPasswordDTO?: BodyType<TypesPostableResetPasswordDTO>,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<void>({
+		url: `/api/v2/factor_password/reset`,
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		data: typesPostableResetPasswordDTO,
+		signal,
+	});
+};
+
+export const getResetPasswordMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof resetPassword>>,
+		TError,
+		{ data?: BodyType<TypesPostableResetPasswordDTO> },
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof resetPassword>>,
+	TError,
+	{ data?: BodyType<TypesPostableResetPasswordDTO> },
+	TContext
+> => {
+	const mutationKey = ['resetPassword'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof resetPassword>>,
+		{ data?: BodyType<TypesPostableResetPasswordDTO> }
+	> = (props) => {
+		const { data } = props ?? {};
+
+		return resetPassword(data);
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type ResetPasswordMutationResult = NonNullable<
+	Awaited<ReturnType<typeof resetPassword>>
+>;
+export type ResetPasswordMutationBody =
+	| BodyType<TypesPostableResetPasswordDTO>
+	| undefined;
+export type ResetPasswordMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Reset password
+ */
+export const useResetPassword = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof resetPassword>>,
+		TError,
+		{ data?: BodyType<TypesPostableResetPasswordDTO> },
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof resetPassword>>,
+	TError,
+	{ data?: BodyType<TypesPostableResetPasswordDTO> },
+	TContext
+> => {
+	return useMutation(getResetPasswordMutationOptions(options));
+};
 /**
 * This endpoint verifies whether a reset password token exists and is not expired
 * @summary Verify a reset password token
--- a/frontend/src/api/v1/invite/bulk/create.ts
+++ b/frontend/src/api/v1/invite/bulk/create.ts
@@ -1,28 +0,0 @@
-import axios from 'api';
-import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
-import { AxiosError } from 'axios';
-import { ErrorV2Resp, SuccessResponseV2 } from 'types/api';
-import { UsersProps } from 'types/api/user/inviteUsers';
-
-/**
- * @deprecated Use the generated `useCreateBulkInvite` hook (or `createBulkInvite` fetcher) from
- * `api/generated/services/users` instead. This hand-written client targets the
- * same endpoint and will be removed once call sites migrate.
- *
- * Part of https://github.com/SigNoz/engineering-pod/issues/5289, add a comment or update when removing this method.
- */
-const inviteUsers = async (
-	users: UsersProps,
-): Promise<SuccessResponseV2<null>> => {
-	try {
-		const response = await axios.post(`/invite/bulk`, users);
-		return {
-			httpStatusCode: response.status,
-			data: null,
-		};
-	} catch (error) {
-		ErrorResponseHandlerV2(error as AxiosError<ErrorV2Resp>);
-	}
-};
-
-export default inviteUsers;
--- a/frontend/src/components/InviteMembers/InviteMembers.tsx
+++ b/frontend/src/components/InviteMembers/InviteMembers.tsx
@@ -80,7 +80,7 @@ function InviteMembers({
 							weight="semibold"
 							className={styles.headerCellRole}
 						>
-							Role
+							Roles
 						</Typography.Text>
 						<div className={styles.headerCellAction} />
 					</div>
@@ -108,11 +108,10 @@ function InviteMembers({

 							<div className={styles.cellRole}>
 								<RolesSelect
-									mode="single"
-									value={row.roleId || undefined}
-									onChange={(roleId): void => updateRole(row.id, roleId)}
-									placeholder="Select role"
-									allowClear={false}
+									mode="multiple"
+									value={row.roleIds}
+									onChange={(roleIds): void => updateRole(row.id, roleIds)}
+									placeholder="Select roles"
 									id={`invite-role-${row.id}`}
 								/>
 							</div>
--- a/frontend/src/components/InviteMembers/tests/InviteMembers.edgeCases.test.tsx
+++ b/frontend/src/components/InviteMembers/tests/InviteMembers.edgeCases.test.tsx
@@ -68,8 +68,8 @@ describe('InviteMembers - Edge Cases', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));
 			await expect(
@@ -100,8 +100,8 @@ describe('InviteMembers - Edge Cases', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));
 			await expect(
@@ -132,17 +132,17 @@ describe('InviteMembers - Edge Cases', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));
 			await expect(
 				screen.findByTestId('invite-api-error'),
 			).resolves.toBeInTheDocument();

-			const viewerElements = screen.getAllByText('Viewer');
+			const viewerElements = screen.getAllByTitle('Viewer');
 			await user.click(viewerElements[0]);
-			const editorOptions = await screen.findAllByText('Editor');
+			const editorOptions = await screen.findAllByTitle('Editor');
 			await user.click(editorOptions[editorOptions.length - 1]);

 			await waitFor(() => {
@@ -189,8 +189,8 @@ describe('InviteMembers - Edge Cases', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			const submitBtn = screen.getByTestId('submit-btn');
 			await user.click(submitBtn);
@@ -226,8 +226,8 @@ describe('InviteMembers - Edge Cases', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], '  alice@signoz.io  ');
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));

--- a/frontend/src/components/InviteMembers/tests/InviteMembers.rendering.test.tsx
+++ b/frontend/src/components/InviteMembers/tests/InviteMembers.rendering.test.tsx
@@ -32,14 +32,14 @@ describe('InviteMembers - Rendering', () => {
 		render(<InviteMembers />);

 		expect(screen.getByText('Email address')).toBeInTheDocument();
-		expect(screen.getByText('Role')).toBeInTheDocument();
+		expect(screen.getByText('Roles')).toBeInTheDocument();
 	});

 	it('hides header when showHeader is false', () => {
 		render(<InviteMembers showHeader={false} />);

 		expect(screen.queryByText('Email address')).not.toBeInTheDocument();
-		expect(screen.queryByText('Role')).not.toBeInTheDocument();
+		expect(screen.queryByText('Roles')).not.toBeInTheDocument();
 	});

 	it('renders add button by default', () => {
@@ -89,7 +89,7 @@ describe('InviteMembers - Rendering', () => {
 	it('renders role select for each row', () => {
 		render(<InviteMembers initialRowCount={2} />);

-		const roleSelects = screen.getAllByText('Select role');
+		const roleSelects = screen.getAllByText('Select roles');
 		expect(roleSelects).toHaveLength(2);
 	});
 });
--- a/frontend/src/components/InviteMembers/tests/InviteMembers.submission.test.tsx
+++ b/frontend/src/components/InviteMembers/tests/InviteMembers.submission.test.tsx
@@ -40,8 +40,8 @@ describe('InviteMembers - Submission', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], 'alice@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));

@@ -73,17 +73,17 @@ describe('InviteMembers - Submission', () => {
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');

 			await user.type(emailInputs[0], 'alice@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.type(emailInputs[1], 'bob@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			const editorOptions = await screen.findAllByText('Editor');
+			await user.click(screen.getAllByText('Select roles')[0]);
+			const editorOptions = await screen.findAllByTitle('Editor');
 			await user.click(editorOptions[editorOptions.length - 1]);

 			await user.type(emailInputs[2], 'charlie@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			const adminOptions = await screen.findAllByText('Admin');
+			await user.click(screen.getAllByText('Select roles')[0]);
+			const adminOptions = await screen.findAllByTitle('Admin');
 			await user.click(adminOptions[adminOptions.length - 1]);

 			await user.click(screen.getByTestId('submit-btn'));
@@ -125,8 +125,8 @@ describe('InviteMembers - Submission', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));

@@ -154,8 +154,8 @@ describe('InviteMembers - Submission', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));

@@ -218,12 +218,12 @@ describe('InviteMembers - Submission', () => {
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');

 			await user.type(emailInputs[0], 'alice@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.type(emailInputs[1], 'bob@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			const editorOptions = await screen.findAllByText('Editor');
+			await user.click(screen.getAllByText('Select roles')[0]);
+			const editorOptions = await screen.findAllByTitle('Editor');
 			await user.click(editorOptions[editorOptions.length - 1]);

 			await user.click(screen.getByTestId('submit-btn'));
@@ -276,8 +276,8 @@ describe('InviteMembers - Submission', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));

@@ -303,8 +303,8 @@ describe('InviteMembers - Submission', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));

--- a/frontend/src/components/InviteMembers/tests/InviteMembers.validation.test.tsx
+++ b/frontend/src/components/InviteMembers/tests/InviteMembers.validation.test.tsx
@@ -35,8 +35,8 @@ describe('InviteMembers - Validation', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], INVALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));

@@ -60,8 +60,8 @@ describe('InviteMembers - Validation', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], INVALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));

@@ -85,8 +85,8 @@ describe('InviteMembers - Validation', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], INVALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 			await user.click(screen.getByTestId('submit-btn'));

 			await expect(
@@ -149,8 +149,8 @@ describe('InviteMembers - Validation', () => {
 				screen.findByText('Please select roles for team members'),
 			).resolves.toBeInTheDocument();

-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await waitFor(() => {
 				expect(
@@ -204,8 +204,8 @@ describe('InviteMembers - Validation', () => {

 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));

 			await user.click(screen.getByTestId('submit-btn'));

--- a/frontend/src/components/InviteMembers/types.ts
+++ b/frontend/src/components/InviteMembers/types.ts
@@ -3,7 +3,7 @@ import { ReactNode } from 'react';
 export interface InviteMemberRow {
 	id: string;
 	email: string;
-	roleId: string;
+	roleIds: string[];
 }

 export interface InviteResult {
@@ -38,7 +38,7 @@ export interface UseInviteMembersReturn {
 	addRow: () => void;
 	removeRow: (id: string) => void;
 	updateEmail: (id: string, email: string) => void;
-	updateRole: (id: string, roleId: string | undefined) => void;
+	updateRole: (id: string, roleIds: string[]) => void;
 	reset: () => void;
 	submit: () => Promise<InviteResult[]>;

--- a/frontend/src/components/InviteMembers/useInviteMembers.ts
+++ b/frontend/src/components/InviteMembers/useInviteMembers.ts
@@ -18,11 +18,11 @@ import {
 const createEmptyRow = (): InviteMemberRow => ({
 	id: uuid(),
 	email: '',
-	roleId: '',
+	roleIds: [],
 });

 const isRowTouched = (row: InviteMemberRow): boolean =>
-	row.email.trim() !== '' || row.roleId !== '';
+	row.email.trim() !== '' || row.roleIds.length > 0;

 export function useInviteMembers(
 	options: UseInviteMembersOptions = {},
@@ -78,7 +78,7 @@ export function useInviteMembers(

 		touched.forEach((row) => {
 			const emailValid = EMAIL_REGEX.test(row.email);
-			const roleValid = row.roleId !== '';
+			const roleValid = row.roleIds.length > 0;

 			if (!emailValid || !row.email) {
 				isValid = false;
@@ -139,12 +139,12 @@ export function useInviteMembers(
 	);

 	const updateRole = useCallback(
-		(id: string, roleId: string | undefined): void => {
+		(id: string, roleIds: string[]): void => {
 			setRows((prev) => {
 				const updated = cloneDeep(prev);
 				const row = updated.find((r) => r.id === id);
 				if (row) {
-					row.roleId = roleId ?? '';
+					row.roleIds = roleIds;
 				}
 				return updated;
 			});
@@ -187,7 +187,7 @@ export function useInviteMembers(
 				await createUser({
 					email: row.email.trim(),
 					frontendBaseUrl: getBaseUrl(),
-					userRoles: [{ id: row.roleId }],
+					userRoles: row.roleIds.map((id) => ({ id })),
 				});
 				results.push({ email: row.email, success: true });
 			} catch (err) {
--- a/frontend/src/components/LogDetail/LogDetailsHeader/LogDetailsHeader.module.scss
+++ b/frontend/src/components/LogDetail/LogDetailsHeader/LogDetailsHeader.module.scss
@@ -0,0 +1,49 @@
+.header {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	width: 100%;
+	gap: 8px;
+}
+
+.tooltipContent {
+	--tooltip-z-index: 2100;
+}
+
+.dropdownContent {
+	--dropdown-menu-content-z-index: 2100;
+}
+
+.leftSection {
+	display: flex;
+	align-items: center;
+	gap: 8px;
+}
+
+.divider {
+	height: 16px;
+	margin: 0;
+}
+
+.timestamp {
+	font-family: 'Geist Mono', monospace;
+	font-size: var(--font-size-sm);
+	font-weight: var(--font-weight-normal);
+	color: var(--l1-foreground);
+	letter-spacing: -0.07px;
+}
+
+.actions {
+	display: flex;
+	align-items: center;
+	gap: 8px;
+}
+
+.arrows {
+	display: flex;
+	align-items: center;
+	gap: 2px;
+	padding: 2px 6px;
+	border-radius: 6px;
+	box-shadow: 0 1px 4px 0 rgba(0, 0, 0, 0.1);
+}
--- a/frontend/src/components/LogDetail/LogDetailsHeader/LogDetailsHeader.tsx
+++ b/frontend/src/components/LogDetail/LogDetailsHeader/LogDetailsHeader.tsx
@@ -0,0 +1,153 @@
+import { Button } from '@signozhq/ui/button';
+import { Divider } from '@signozhq/ui/divider';
+import { DropdownMenuSimple as Dropdown } from '@signozhq/ui/dropdown-menu';
+import { Typography } from '@signozhq/ui/typography';
+import { TooltipSimple } from '@signozhq/ui/tooltip';
+import { DATE_TIME_FORMATS } from 'constants/dateTimeFormats';
+import { aggregateAttributesResourcesToString } from 'container/LogDetailedView/utils';
+import { toast } from '@signozhq/ui/sonner';
+import { useCopyLogLink } from 'hooks/logs/useCopyLogLink';
+import {
+	ChevronDown,
+	ChevronUp,
+	Compass,
+	Copy,
+	Ellipsis,
+	Link,
+} from '@signozhq/icons';
+import { useTimezone } from 'providers/Timezone';
+import { ILog } from 'types/api/logs/log';
+import { MouseEvent, MouseEventHandler } from 'react';
+import { useCopyToClipboard } from 'react-use';
+
+import styles from './LogDetailsHeader.module.scss';
+
+const TOOLTIP_CONTENT_PROPS = { className: styles.tooltipContent };
+
+interface LogDetailsHeaderProps {
+	log: ILog;
+	onNavigatePrev: () => void;
+	onNavigateNext: () => void;
+	isPrevDisabled: boolean;
+	isNextDisabled: boolean;
+	showOpenInExplorer?: boolean;
+	onOpenInExplorer?: MouseEventHandler;
+}
+
+function LogDetailsHeader({
+	log,
+	onNavigatePrev,
+	onNavigateNext,
+	isPrevDisabled,
+	isNextDisabled,
+	showOpenInExplorer = false,
+	onOpenInExplorer,
+}: LogDetailsHeaderProps): JSX.Element {
+	const [, copyToClipboard] = useCopyToClipboard();
+	const { onLogCopy } = useCopyLogLink(log?.id);
+	const { formatTimezoneAdjustedTimestamp } = useTimezone();
+
+	const handleCopyLog = (): void => {
+		copyToClipboard(aggregateAttributesResourcesToString(log));
+		toast.success('Copied to clipboard', { position: 'bottom-right' });
+	};
+
+	const menuItems = [
+		{
+			key: 'copy-log',
+			label: 'Copy log',
+			icon: <Copy size={14} />,
+			onClick: handleCopyLog,
+		},
+		{
+			key: 'copy-link',
+			label: 'Copy link to log',
+			icon: <Link size={14} />,
+			onClick: (): void => onLogCopy(),
+		},
+	];
+
+	return (
+		<div className={styles.header} data-log-detail-ignore="true">
+			<div className={styles.leftSection}>
+				<Divider type="vertical" className={styles.divider} />
+				<Typography.Text
+					className={styles.timestamp}
+					data-testid="log-details-header-timestamp"
+				>
+					{formatTimezoneAdjustedTimestamp(
+						log.date ?? log.timestamp,
+						DATE_TIME_FORMATS.DASH_DATETIME,
+					)}
+				</Typography.Text>
+			</div>
+
+			<div className={styles.actions}>
+				{showOpenInExplorer && (
+					<Button
+						variant="outlined"
+						color="secondary"
+						prefix={<Compass size={16} />}
+						onClick={onOpenInExplorer}
+					>
+						Open in Explorer
+					</Button>
+				)}
+
+				<Dropdown
+					menu={{ items: menuItems }}
+					align="end"
+					className={styles.dropdownContent}
+					onClick={(e: MouseEvent): void => e.stopPropagation()}
+				>
+					<Button
+						variant="link"
+						color="secondary"
+						prefix={<Ellipsis size={16} />}
+						data-testid="log-details-header-menu"
+					/>
+				</Dropdown>
+
+				<div className={styles.arrows}>
+					<TooltipSimple
+						title="Move to previous log"
+						side="top"
+						open={isPrevDisabled ? false : undefined}
+						tooltipContentProps={TOOLTIP_CONTENT_PROPS}
+					>
+						<Button
+							variant="outlined"
+							color="secondary"
+							prefix={<ChevronUp size={14} />}
+							disabled={isPrevDisabled}
+							onClick={onNavigatePrev}
+							data-testid="log-details-header-prev"
+						/>
+					</TooltipSimple>
+					<TooltipSimple
+						title="Move to next log"
+						side="top"
+						open={isNextDisabled ? false : undefined}
+						tooltipContentProps={TOOLTIP_CONTENT_PROPS}
+					>
+						<Button
+							variant="outlined"
+							color="secondary"
+							prefix={<ChevronDown size={14} />}
+							disabled={isNextDisabled}
+							onClick={onNavigateNext}
+							data-testid="log-details-header-next"
+						/>
+					</TooltipSimple>
+				</div>
+			</div>
+		</div>
+	);
+}
+
+LogDetailsHeader.defaultProps = {
+	showOpenInExplorer: false,
+	onOpenInExplorer: undefined,
+};
+
+export default LogDetailsHeader;
--- a/frontend/src/components/LogDetail/LogDetailsHeader/useLogNavigation.ts
+++ b/frontend/src/components/LogDetail/LogDetailsHeader/useLogNavigation.ts
@@ -0,0 +1,52 @@
+import { useCallback, useMemo } from 'react';
+import { ILog } from 'types/api/logs/log';
+
+interface UseLogNavigationParams {
+	logs?: ILog[];
+	activeLogId: string;
+	onNavigateLog?: (log: ILog) => void;
+	onScrollToLog?: (id: string) => void;
+}
+
+interface UseLogNavigationReturn {
+	goToPrev: () => void;
+	goToNext: () => void;
+	isPrevDisabled: boolean;
+	isNextDisabled: boolean;
+}
+
+export function useLogNavigation({
+	logs,
+	activeLogId,
+	onNavigateLog,
+	onScrollToLog,
+}: UseLogNavigationParams): UseLogNavigationReturn {
+	const currentIndex = useMemo(
+		() => logs?.findIndex((l) => l.id === activeLogId) ?? -1,
+		[logs, activeLogId],
+	);
+
+	const canNavigate = !!logs?.length && !!onNavigateLog && currentIndex !== -1;
+	const isPrevDisabled = !canNavigate || currentIndex <= 0;
+	const isNextDisabled = !canNavigate || currentIndex >= (logs?.length ?? 0) - 1;
+
+	const goToPrev = useCallback((): void => {
+		if (isPrevDisabled || !logs) {
+			return;
+		}
+		const prev = logs[currentIndex - 1];
+		onNavigateLog?.(prev);
+		onScrollToLog?.(prev.id);
+	}, [isPrevDisabled, logs, currentIndex, onNavigateLog, onScrollToLog]);
+
+	const goToNext = useCallback((): void => {
+		if (isNextDisabled || !logs) {
+			return;
+		}
+		const next = logs[currentIndex + 1];
+		onNavigateLog?.(next);
+		onScrollToLog?.(next.id);
+	}, [isNextDisabled, logs, currentIndex, onNavigateLog, onScrollToLog]);
+
+	return { goToPrev, goToNext, isPrevDisabled, isNextDisabled };
+}
--- a/frontend/src/components/LogDetail/tests/LogDetail.test.tsx
+++ b/frontend/src/components/LogDetail/tests/LogDetail.test.tsx
@@ -0,0 +1,161 @@
+import { toast } from '@signozhq/ui/sonner';
+import { LOCALSTORAGE } from 'constants/localStorage';
+import { render, screen, userEvent } from 'tests/test-utils';
+import { ILog } from 'types/api/logs/log';
+
+import LogDetail from '..';
+import { VIEW_TYPES } from '../constants';
+import { LogDetailProps } from '../LogDetail.interfaces';
+
+jest.mock('@signozhq/ui/sonner', () => ({
+	toast: { success: jest.fn(), error: jest.fn() },
+}));
+
+// The flag to be removed later
+jest.mock('../constants', () => ({
+	...jest.requireActual('../constants'),
+	isLogDetailsV2: true,
+}));
+
+const mockLog: ILog = {
+	id: 'log-1',
+	timestamp: '2024-01-15T09:45:30Z',
+	date: '2024-01-15T09:45:30Z',
+	body: 'test log body',
+	severityText: 'INFO',
+	severityNumber: 9,
+	traceFlags: 0,
+	traceId: '',
+	spanID: '',
+	attributesString: {},
+	attributesInt: {},
+	attributesFloat: {},
+	resources_string: {},
+	scope_string: {},
+	attributes_string: {},
+	severity_text: 'INFO',
+	severity_number: 9,
+};
+
+const makeLog = (id: string): ILog => ({ ...mockLog, id });
+
+function renderDrawer(props: Partial<LogDetailProps> = {}): void {
+	render(
+		<LogDetail
+			log={mockLog}
+			selectedTab={VIEW_TYPES.OVERVIEW}
+			onAddToQuery={jest.fn()}
+			onClickActionItem={jest.fn()}
+			onClose={jest.fn()}
+			{...props}
+		/>,
+	);
+}
+
+describe('LogDetail drawer — header (isLogDetailsV2)', () => {
+	afterEach(() => {
+		jest.clearAllMocks();
+		localStorage.clear();
+	});
+
+	it('renders the revamped header when a log is provided', () => {
+		renderDrawer();
+
+		expect(screen.getByTestId('log-details-header-menu')).toBeInTheDocument();
+		expect(screen.getByTestId('log-details-header-prev')).toBeInTheDocument();
+		expect(screen.getByTestId('log-details-header-next')).toBeInTheDocument();
+	});
+
+	it('shows the log timestamp formatted (DASH_DATETIME) in the header', () => {
+		// Pin the timezone to UTC so the formatted output is deterministic across
+		// machines/CI (Jest doesn't fix a TZ).
+		localStorage.setItem(LOCALSTORAGE.PREFERRED_TIMEZONE, 'UTC');
+
+		renderDrawer();
+
+		// mockLog date is 2024-01-15T09:45:30Z → DASH_DATETIME in UTC.
+		expect(screen.getByTestId('log-details-header-timestamp')).toHaveTextContent(
+			'Jan 15, 2024 ⎯ 09:45:30',
+		);
+	});
+
+	it('copies the log link from the ⋯ menu', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+
+		renderDrawer();
+
+		await user.click(screen.getByTestId('log-details-header-menu'));
+		await user.click(await screen.findByText('Copy link to log'));
+
+		expect(toast.success).toHaveBeenCalled();
+	});
+
+	it('copies the log from the ⋯ menu', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+
+		renderDrawer();
+
+		await user.click(screen.getByTestId('log-details-header-menu'));
+		await user.click(await screen.findByText('Copy log'));
+
+		expect(toast.success).toHaveBeenCalledWith('Copied to clipboard', {
+			position: 'bottom-right',
+		});
+	});
+
+	it('shows "Open in Explorer" when a handleOpenInExplorer handler is provided', () => {
+		renderDrawer({ handleOpenInExplorer: jest.fn() });
+
+		expect(screen.getByText('Open in Explorer')).toBeInTheDocument();
+	});
+
+	it('hides "Open in Explorer" when no handleOpenInExplorer handler is provided', () => {
+		renderDrawer();
+
+		expect(screen.queryByText('Open in Explorer')).not.toBeInTheDocument();
+	});
+
+	it('navigates to the next / previous log with the Down / Up arrow keys', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+		const logs = [makeLog('log-0'), makeLog('log-1'), makeLog('log-2')];
+		const onNavigateLog = jest.fn();
+		const onScrollToLog = jest.fn();
+
+		// Active log is the middle one so both directions are available.
+		renderDrawer({ log: logs[1], logs, onNavigateLog, onScrollToLog });
+
+		await user.keyboard('{ArrowDown}');
+		expect(onNavigateLog).toHaveBeenLastCalledWith(logs[2]);
+		expect(onScrollToLog).toHaveBeenLastCalledWith('log-2');
+
+		await user.keyboard('{ArrowUp}');
+		expect(onNavigateLog).toHaveBeenLastCalledWith(logs[0]);
+		expect(onScrollToLog).toHaveBeenLastCalledWith('log-0');
+	});
+
+	it('does not navigate past the first log on ArrowUp', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+		const logs = [makeLog('log-0'), makeLog('log-1')];
+		const onNavigateLog = jest.fn();
+
+		renderDrawer({ log: logs[0], logs, onNavigateLog });
+
+		await user.keyboard('{ArrowUp}');
+		expect(onNavigateLog).not.toHaveBeenCalled();
+	});
+
+	it('navigates via the header up / down buttons and disables them at boundaries', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+		const logs = [makeLog('log-0'), makeLog('log-1')];
+		const onNavigateLog = jest.fn();
+
+		// Active log is the first one.
+		renderDrawer({ log: logs[0], logs, onNavigateLog });
+
+		expect(screen.getByTestId('log-details-header-prev')).toBeDisabled();
+		expect(screen.getByTestId('log-details-header-next')).toBeEnabled();
+
+		await user.click(screen.getByTestId('log-details-header-next'));
+		expect(onNavigateLog).toHaveBeenLastCalledWith(logs[1]);
+	});
+});
--- a/frontend/src/components/LogDetail/constants.ts
+++ b/frontend/src/components/LogDetail/constants.ts
@@ -1,3 +1,10 @@
+import getLocalStorage from 'api/browser/localstorage/get';
+import { LOCALSTORAGE } from 'constants/localStorage';
+
+// Temp feature flag before actual roll-out
+export const isLogDetailsV2 =
+	getLocalStorage(LOCALSTORAGE.LOG_DETAILS_V2) === 'true';
+
 export const VIEW_TYPES = {
 	OVERVIEW: 'OVERVIEW',
 	JSON: 'JSON',
--- a/frontend/src/components/LogDetail/index.tsx
+++ b/frontend/src/components/LogDetail/index.tsx
@@ -8,7 +8,9 @@ import { ToggleGroupSimple } from '@signozhq/ui/toggle-group';
 import { Divider } from '@signozhq/ui/divider';
 import { Typography } from '@signozhq/ui/typography';
 import cx from 'classnames';
-import { LogType } from 'components/Logs/LogStateIndicator/LogStateIndicator';
+import LogStateIndicator, {
+	LogType,
+} from 'components/Logs/LogStateIndicator/LogStateIndicator';
 import QuerySearch from 'components/QueryBuilderV2/QueryV2/QuerySearch/QuerySearch';
 import { convertExpressionToFilters } from 'components/QueryBuilderV2/utils';
 import { FeatureKeys } from 'constants/features';
@@ -23,6 +25,7 @@ import {
 } from 'container/LogDetailedView/utils';
 import useInitialQuery from 'container/LogsExplorerContext/useInitialQuery';
 import { useOptionsMenu } from 'container/OptionsMenu';
+import { FontSize } from 'container/OptionsMenu/types';
 import { useCopyLogLink } from 'hooks/logs/useCopyLogLink';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { useIsDarkMode } from 'hooks/useDarkMode';
@@ -48,8 +51,10 @@ import { ILogBody } from 'types/api/logs/log';
 import { Query, TagFilter } from 'types/api/queryBuilder/queryBuilderData';
 import { DataSource, StringOperators } from 'types/common/queryBuilder';

-import { RESOURCE_KEYS, VIEW_TYPES, VIEWS } from './constants';
+import { isLogDetailsV2, RESOURCE_KEYS, VIEW_TYPES, VIEWS } from './constants';
 import { LogDetailInnerProps, LogDetailProps } from './LogDetail.interfaces';
+import LogDetailsHeader from './LogDetailsHeader/LogDetailsHeader';
+import { useLogNavigation } from './LogDetailsHeader/useLogNavigation';

 import './LogDetails.styles.scss';

@@ -96,7 +101,8 @@ function LogDetailInner({
 				target.closest('[data-log-detail-ignore="true"]') ||
 				target.closest('.cm-tooltip-autocomplete') ||
 				target.closest('.drawer-popover') ||
-				target.closest('.query-status-popover')
+				target.closest('.query-status-popover') ||
+				target.closest('[data-radix-popper-content-wrapper]')
 			) {
 				return;
 			}
@@ -112,49 +118,30 @@ function LogDetailInner({
 		};
 	}, [onClose]);

-	// Keyboard navigation - handle up/down arrow keys
-	// Only listen when in OVERVIEW tab
-	// eslint-disable-next-line sonarjs/cognitive-complexity
+	const { goToPrev, goToNext, isPrevDisabled, isNextDisabled } =
+		useLogNavigation({
+			logs,
+			activeLogId: log.id,
+			onNavigateLog,
+			onScrollToLog,
+		});
+
+	// Keyboard navigation - handle up/down arrow keys. Only listen in the OVERVIEW
+	// tab so we don't hijack arrow keys from the JSON editor / context view.
 	useEffect(() => {
-		if (
-			!logs ||
-			!onNavigateLog ||
-			logs.length === 0 ||
-			selectedView !== VIEW_TYPES.OVERVIEW
-		) {
-			return;
+		if (selectedView !== VIEW_TYPES.OVERVIEW) {
+			return undefined;
 		}

 		const handleKeyDown = (e: KeyboardEvent): void => {
-			const currentIndex = logs.findIndex((l) => l.id === log.id);
-			if (currentIndex === -1) {
-				return;
-			}
-
 			if (e.key === 'ArrowUp') {
 				e.preventDefault();
 				e.stopPropagation();
-				// Navigate to previous log
-				if (currentIndex > 0) {
-					const prevLog = logs[currentIndex - 1];
-					onNavigateLog(prevLog);
-					// Trigger scroll to the log element
-					if (onScrollToLog) {
-						onScrollToLog(prevLog.id);
-					}
-				}
+				goToPrev();
 			} else if (e.key === 'ArrowDown') {
 				e.preventDefault();
 				e.stopPropagation();
-				// Navigate to next log
-				if (currentIndex < logs.length - 1) {
-					const nextLog = logs[currentIndex + 1];
-					onNavigateLog(nextLog);
-					// Trigger scroll to the log element
-					if (onScrollToLog) {
-						onScrollToLog(nextLog.id);
-					}
-				}
+				goToNext();
 			}
 		};

@@ -162,7 +149,7 @@ function LogDetailInner({
 		return (): void => {
 			document.removeEventListener('keydown', handleKeyDown);
 		};
-	}, [log.id, logs, onNavigateLog, onScrollToLog, selectedView]);
+	}, [selectedView, goToPrev, goToNext]);

 	const listQuery = useMemo(() => {
 		if (!stagedQuery || stagedQuery.builder.queryData.length < 1) {
@@ -303,33 +290,6 @@ function LogDetailInner({
 	};

 	const logType = log?.attributes_string?.log_level || LogType.INFO;
-	const currentLogIndex = logs ? logs.findIndex((l) => l.id === log.id) : -1;
-	const isPrevDisabled =
-		!logs || !onNavigateLog || logs.length === 0 || currentLogIndex <= 0;
-	const isNextDisabled =
-		!logs ||
-		!onNavigateLog ||
-		logs.length === 0 ||
-		currentLogIndex === logs.length - 1;
-
-	type HandleNavigateLogParams = {
-		direction: 'next' | 'previous';
-	};
-
-	const handleNavigateLog = ({ direction }: HandleNavigateLogParams): void => {
-		if (!logs || !onNavigateLog || currentLogIndex === -1) {
-			return;
-		}
-		if (direction === 'previous' && !isPrevDisabled) {
-			const prevLog = logs[currentLogIndex - 1];
-			onNavigateLog(prevLog);
-			onScrollToLog?.(prevLog.id);
-		} else if (direction === 'next' && !isNextDisabled) {
-			const nextLog = logs[currentLogIndex + 1];
-			onNavigateLog(nextLog);
-			onScrollToLog?.(nextLog.id);
-		}
-	};

 	return (
 		<Drawer
@@ -338,57 +298,69 @@ function LogDetailInner({
 			maskClosable={false}
 			getContainer={getContainer}
 			title={
-				<div className="log-detail-drawer__title" data-log-detail-ignore="true">
-					<div className="log-detail-drawer__title-left">
-						<Divider type="vertical" className={cx('log-type-indicator', LogType)} />
-						<Typography.Text className="title">Log details</Typography.Text>
-					</div>
-					<div className="log-detail-drawer__title-right">
-						<div className="log-arrows">
-							<Tooltip
-								title={isPrevDisabled ? '' : 'Move to previous log'}
-								placement="top"
-								mouseLeaveDelay={0}
-							>
-								<Button
-									variant="outlined"
-									color="secondary"
-									prefix={<ChevronUp size={14} />}
-									className="log-arrow-btn log-arrow-btn-up"
-									disabled={isPrevDisabled}
-									onClick={(): void => handleNavigateLog({ direction: 'previous' })}
-								/>
-							</Tooltip>
-							<Tooltip
-								title={isNextDisabled ? '' : 'Move to next log'}
-								placement="top"
-								mouseLeaveDelay={0}
-							>
-								<Button
-									variant="outlined"
-									color="secondary"
-									prefix={<ChevronDown size={14} />}
-									className="log-arrow-btn log-arrow-btn-down"
-									disabled={isNextDisabled}
-									onClick={(): void => handleNavigateLog({ direction: 'next' })}
-								/>
-							</Tooltip>
+				isLogDetailsV2 ? (
+					<LogDetailsHeader
+						log={log}
+						onNavigatePrev={goToPrev}
+						onNavigateNext={goToNext}
+						isPrevDisabled={isPrevDisabled}
+						isNextDisabled={isNextDisabled}
+						showOpenInExplorer={!!handleOpenInExplorer}
+						onOpenInExplorer={handleOpenInExplorer}
+					/>
+				) : (
+					<div className="log-detail-drawer__title" data-log-detail-ignore="true">
+						<div className="log-detail-drawer__title-left">
+							<Divider type="vertical" className={cx('log-type-indicator', LogType)} />
+							<Typography.Text className="title">Log details</Typography.Text>
 						</div>
-						{handleOpenInExplorer && (
-							<div>
-								<Button
-									variant="outlined"
-									color="secondary"
-									prefix={<Compass size={16} />}
-									className="open-in-explorer-btn"
-									onClick={handleOpenInExplorer}
+						<div className="log-detail-drawer__title-right">
+							<div className="log-arrows">
+								<Tooltip
+									title={isPrevDisabled ? '' : 'Move to previous log'}
+									placement="top"
+									mouseLeaveDelay={0}
 								>
-									Open in Explorer
-								</Button>
+									<Button
+										variant="outlined"
+										color="secondary"
+										prefix={<ChevronUp size={14} />}
+										className="log-arrow-btn log-arrow-btn-up"
+										disabled={isPrevDisabled}
+										onClick={goToPrev}
+									/>
+								</Tooltip>
+								<Tooltip
+									title={isNextDisabled ? '' : 'Move to next log'}
+									placement="top"
+									mouseLeaveDelay={0}
+								>
+									<Button
+										variant="outlined"
+										color="secondary"
+										prefix={<ChevronDown size={14} />}
+										className="log-arrow-btn log-arrow-btn-down"
+										disabled={isNextDisabled}
+										onClick={goToNext}
+									/>
+								</Tooltip>
 							</div>
-						)}
+							{handleOpenInExplorer && (
+								<div>
+									<Button
+										variant="outlined"
+										color="secondary"
+										prefix={<Compass size={16} />}
+										className="open-in-explorer-btn"
+										onClick={handleOpenInExplorer}
+									>
+										Open in Explorer
+									</Button>
+								</div>
+							)}
+						</div>
 					</div>
-				</div>
+				)
 			}
 			placement="right"
 			onClose={drawerCloseHandler}
@@ -407,7 +379,15 @@ function LogDetailInner({
 				data-testid="log-detail-drawer"
 			>
 				<div className="log-detail-drawer__log">
-					<Divider type="vertical" className={cx('log-type-indicator', logType)} />
+					{isLogDetailsV2 ? (
+						<LogStateIndicator
+							severityText={log.severity_text}
+							severityNumber={log.severity_number}
+							fontSize={options?.fontSize ?? FontSize.MEDIUM}
+						/>
+					) : (
+						<Divider type="vertical" className={cx('log-type-indicator', logType)} />
+					)}
 					<Tooltip
 						title={removeEscapeCharacters(logBody)}
 						placement="left"
@@ -483,22 +463,25 @@ function LogDetailInner({
 							</Tooltip>
 						)}

-						<Tooltip
-							title={selectedView === VIEW_TYPES.JSON ? 'Copy JSON' : 'Copy Log Link'}
-							placement="topLeft"
-							aria-label={
-								selectedView === VIEW_TYPES.JSON ? 'Copy JSON' : 'Copy Log Link'
-							}
-							mouseLeaveDelay={0}
-						>
-							<Button
-								variant="link"
-								color="secondary"
-								size="sm"
-								prefix={<Copy size={12} />}
-								onClick={selectedView === VIEW_TYPES.JSON ? handleJSONCopy : onLogCopy}
-							/>
-						</Tooltip>
+						{/* V2 moves copy actions into the header ⋯ menu */}
+						{!isLogDetailsV2 && (
+							<Tooltip
+								title={selectedView === VIEW_TYPES.JSON ? 'Copy JSON' : 'Copy Log Link'}
+								placement="topLeft"
+								aria-label={
+									selectedView === VIEW_TYPES.JSON ? 'Copy JSON' : 'Copy Log Link'
+								}
+								mouseLeaveDelay={0}
+							>
+								<Button
+									variant="link"
+									color="secondary"
+									size="sm"
+									prefix={<Copy size={12} />}
+									onClick={selectedView === VIEW_TYPES.JSON ? handleJSONCopy : onLogCopy}
+								/>
+							</Tooltip>
+						)}
 					</div>
 				</div>
 				{isFilterVisible && contextQuery?.builder.queryData[0] && (
--- a/frontend/src/constants/localStorage.ts
+++ b/frontend/src/constants/localStorage.ts
@@ -13,6 +13,7 @@ export enum LOCALSTORAGE {
 	TRACES_LIST_COLUMNS = 'TRACES_LIST_COLUMNS',
 	LOGS_LIST_COLUMNS = 'LOGS_LIST_COLUMNS',
 	LOGS_LIST_COLUMN_SIZING = 'LOGS_LIST_COLUMN_SIZING',
+	LOG_DETAILS_V2 = 'LOG_DETAILS_V2',
 	LOGGED_IN_USER_NAME = 'LOGGED_IN_USER_NAME',
 	LOGGED_IN_USER_EMAIL = 'LOGGED_IN_USER_EMAIL',
 	CHAT_SUPPORT = 'CHAT_SUPPORT',
--- a/frontend/src/container/AlertHistory/AlertPopover/AlertPopover.tsx
+++ b/frontend/src/container/AlertHistory/AlertPopover/AlertPopover.tsx
@@ -29,7 +29,6 @@ function PopoverContent({
 				<Link
 					to={`${ROUTES.LOGS_EXPLORER}?${relatedLogsLink}`}
 					className="contributor-row-popover-buttons__button"
-					data-testid="alert-popover-view-logs"
 				>
 					<div className="icon">
 						<LogsIcon />
@@ -41,7 +40,6 @@ function PopoverContent({
 				<Link
 					to={`${ROUTES.TRACES_EXPLORER}?${relatedTracesLink}`}
 					className="contributor-row-popover-buttons__button"
-					data-testid="alert-popover-view-traces"
 				>
 					<div className="icon">
 						<DraftingCompass
--- a/frontend/src/container/AlertHistory/Statistics/StatsCard/StatsCard.tsx
+++ b/frontend/src/container/AlertHistory/Statistics/StatsCard/StatsCard.tsx
@@ -26,10 +26,7 @@ function ChangePercentage({
 }: ChangePercentageProps): JSX.Element {
 	if (direction > 0) {
 		return (
-			<div
-				className="change-percentage change-percentage--success"
-				data-testid="stats-card-change"
-			>
+			<div className="change-percentage change-percentage--success">
 				<div className="change-percentage__icon">
 					<ArrowDownLeft size={14} color={Color.BG_FOREST_500} />
 				</div>
@@ -41,10 +38,7 @@ function ChangePercentage({
 	}
 	if (direction < 0) {
 		return (
-			<div
-				className="change-percentage change-percentage--error"
-				data-testid="stats-card-change"
-			>
+			<div className="change-percentage change-percentage--error">
 				<div className="change-percentage__icon">
 					<ArrowUpRight size={14} color={Color.BG_CHERRY_500} />
 				</div>
@@ -56,10 +50,7 @@ function ChangePercentage({
 	}

 	return (
-		<div
-			className="change-percentage change-percentage--no-previous-data"
-			data-testid="stats-card-change"
-		>
+		<div className="change-percentage change-percentage--no-previous-data">
 			<div className="change-percentage__label">no previous data</div>
 		</div>
 	);
@@ -112,12 +103,7 @@ function StatsCard({
 	const formattedEndTimeForTooltip = convertTimestampToLocaleDateString(endTime);

 	return (
-		<div
-			className={`stats-card ${isEmpty ? 'stats-card--empty' : ''}`}
-			data-testid="stats-card"
-			data-stats-title={title}
-			data-empty={isEmpty ? 'true' : 'false'}
-		>
+		<div className={`stats-card ${isEmpty ? 'stats-card--empty' : ''}`}>
 			<div className="stats-card__title-wrapper">
 				<div className="title">{title}</div>
 				<div className="duration-indicator">
@@ -137,7 +123,7 @@ function StatsCard({
 			</div>

 			<div className="stats-card__stats">
-				<div className="count-label" data-testid="stats-card-value">
+				<div className="count-label">
 					{isEmpty ? emptyMessage : displayValue || totalCurrentCount}
 				</div>

--- a/frontend/src/container/AlertHistory/Statistics/StatsCard/StatsGraph/StatsGraph.tsx
+++ b/frontend/src/container/AlertHistory/Statistics/StatsCard/StatsGraph/StatsGraph.tsx
@@ -81,11 +81,7 @@ function StatsGraph({ timeSeries, changeDirection }: Props): JSX.Element {
 	);

 	return (
-		<div
-			style={{ height: '100%', width: '100%' }}
-			ref={graphRef}
-			data-testid="stats-card-sparkline"
-		>
+		<div style={{ height: '100%', width: '100%' }} ref={graphRef}>
 			<Uplot data={[xData, yData]} options={options} />
 		</div>
 	);
--- a/frontend/src/container/AlertHistory/Statistics/TopContributorsCard/TopContributorsCard.tsx
+++ b/frontend/src/container/AlertHistory/Statistics/TopContributorsCard/TopContributorsCard.tsx
@@ -48,16 +48,11 @@ function TopContributorsCard({

 	return (
 		<>
-			<div className="top-contributors-card" data-testid="top-contributors-card">
+			<div className="top-contributors-card">
 				<div className="top-contributors-card__header">
 					<div className="title">top contributors</div>
 					{topContributorsData.length > 3 && (
-						<Button
-							type="text"
-							className="view-all"
-							onClick={toggleViewAllDrawer}
-							data-testid="top-contributors-view-all"
-						>
+						<Button type="text" className="view-all" onClick={toggleViewAllDrawer}>
 							<div className="label">View all</div>
 							<div className="icon">
 								<ArrowRight
--- a/frontend/src/container/AlertHistory/Statistics/TopContributorsCard/TopContributorsRows.tsx
+++ b/frontend/src/container/AlertHistory/Statistics/TopContributorsCard/TopContributorsRows.tsx
@@ -68,10 +68,7 @@ function TopContributorsRows({
 					relatedTracesLink={record.relatedTracesLink}
 					relatedLogsLink={record.relatedLogsLink}
 				>
-					<div
-						className="total-contribution"
-						data-testid="top-contributors-row-count"
-					>
+					<div className="total-contribution">
 						{count}/{totalCurrentTriggers}
 					</div>
 				</ConditionalAlertPopover>
@@ -81,10 +78,7 @@ function TopContributorsRows({

 	const handleRowClick = (
 		record: AlertRuleTopContributors,
-	): HTMLAttributes<AlertRuleTimelineTableResponse> & {
-		'data-testid': string;
-	} => ({
-		'data-testid': 'top-contributors-row',
+	): HTMLAttributes<AlertRuleTimelineTableResponse> => ({
 		onClick: (): void => {
 			logEvent('Alert history: Top contributors row: Clicked', {
 				labels: record.labels,
--- a/frontend/src/container/AlertHistory/Statistics/TopContributorsCard/ViewAllDrawer.tsx
+++ b/frontend/src/container/AlertHistory/Statistics/TopContributorsCard/ViewAllDrawer.tsx
@@ -31,10 +31,7 @@ function ViewAllDrawer({
 			}}
 			title="Viewing All Contributors"
 		>
-			<div
-				className="top-contributors-card--view-all"
-				data-testid="top-contributors-drawer"
-			>
+			<div className="top-contributors-card--view-all">
 				<div className="top-contributors-card__content">
 					<TopContributorsRows
 						topContributors={topContributorsData}
--- a/frontend/src/container/AlertHistory/Timeline/GraphWrapper/GraphWrapper.tsx
+++ b/frontend/src/container/AlertHistory/Timeline/GraphWrapper/GraphWrapper.tsx
@@ -32,8 +32,8 @@ function GraphWrapper({
 	}, [data?.data]);

 	return (
-		<div className="timeline-graph" data-testid="timeline-graph">
-			<div className="timeline-graph__title" data-testid="timeline-graph-title">
+		<div className="timeline-graph">
+			<div className="timeline-graph__title">
 				{totalCurrentTriggers} triggers in {relativeTime}
 			</div>
 			<div className="timeline-graph__chart">
--- a/frontend/src/container/AlertHistory/Timeline/Table/Table.tsx
+++ b/frontend/src/container/AlertHistory/Timeline/Table/Table.tsx
@@ -118,10 +118,7 @@ function TimelineTableContent(): JSX.Element {

 	const handleRowClick = (
 		record: AlertRuleTimelineTableResponse,
-	): HTMLAttributes<AlertRuleTimelineTableResponse> & {
-		'data-testid': string;
-	} => ({
-		'data-testid': 'timeline-row',
+	): HTMLAttributes<AlertRuleTimelineTableResponse> => ({
 		onClick: (): void => {
 			void logEvent('Alert history: Timeline table row: Clicked', {
 				ruleId: record.ruleID,
@@ -131,15 +128,12 @@ function TimelineTableContent(): JSX.Element {
 	});

 	return (
-		<div className="timeline-table" data-testid="timeline-table">
+		<div className="timeline-table">
 			{/* If we don't wait to have the keys, the QuerySearch will not render them at first usage */}
 			{!isLoadingKeys && hardcodedAttributeKeys ? (
 				<div className="timeline-table__filter">
 					<div className="timeline-table__filter-row">
-						<div
-							className="timeline-table__filter-search"
-							data-testid="timeline-filter-search"
-						>
+						<div className="timeline-table__filter-search">
 							<QuerySearch
 								onChange={querySearchOnChange}
 								queryData={queryData}
@@ -161,7 +155,6 @@ function TimelineTableContent(): JSX.Element {
 					<Skeleton.Input
 						className="timeline-table__filter--loading-skeleton"
 						active
-						data-testid="timeline-filter-skeleton"
 					/>
 				</div>
 			)}
@@ -179,17 +172,14 @@ function TimelineTableContent(): JSX.Element {
 				locale={{
 					emptyText:
 						isError && apiError ? (
-							<div className="timeline-table__error" data-testid="timeline-error">
+							<div className="timeline-table__error">
 								<ErrorContent error={apiError} />
 							</div>
 						) : undefined,
 				}}
 				footer={(): JSX.Element => (
 					<div className="timeline-table__pagination">
-						<div
-							className="timeline-table__pagination-info"
-							data-testid="timeline-footer-range"
-						>
+						<div className="timeline-table__pagination-info">
 							{paginationConfig.showTotal?.(totalItems, [
 								totalItems === 0
 									? 0
--- a/frontend/src/container/AlertHistory/Timeline/Table/useTimelineTable.tsx
+++ b/frontend/src/container/AlertHistory/Timeline/Table/useTimelineTable.tsx
@@ -21,7 +21,7 @@ export const timelineTableColumns = ({
 		sorter: true,
 		width: 140,
 		render: (value): JSX.Element => (
-			<div className="alert-rule-state" data-testid="timeline-row-state">
+			<div className="alert-rule-state">
 				<AlertState state={value} showLabel />
 			</div>
 		),
@@ -30,7 +30,7 @@ export const timelineTableColumns = ({
 		title: 'LABELS',
 		dataIndex: 'labels',
 		render: (labels): JSX.Element => (
-			<div className="alert-rule-labels" data-testid="timeline-row-labels">
+			<div className="alert-rule-labels">
 				<AlertLabels labels={labels} />
 			</div>
 		),
@@ -40,10 +40,7 @@ export const timelineTableColumns = ({
 		dataIndex: 'unixMilli',
 		width: 200,
 		render: (value): JSX.Element => (
-			<div
-				className="alert-rule__created-at"
-				data-testid="timeline-row-created-at"
-			>
+			<div className="alert-rule__created-at">
 				{formatTimezoneAdjustedTimestamp(value, DATE_TIME_FORMATS.DASH_DATETIME)}
 			</div>
 		),
@@ -56,7 +53,7 @@ export const timelineTableColumns = ({
 			if (!record.relatedTracesLink && !record.relatedLogsLink) {
 				return (
 					<Tooltip title="No links available for this item">
-						<Button type="text" ghost disabled data-testid="timeline-row-actions">
+						<Button type="text" ghost disabled>
 							<Ellipsis className="dropdown-icon" size="md" />
 						</Button>
 					</Tooltip>
@@ -68,7 +65,7 @@ export const timelineTableColumns = ({
 					relatedTracesLink={record.relatedTracesLink ?? ''}
 					relatedLogsLink={record.relatedLogsLink ?? ''}
 				>
-					<Button type="text" ghost data-testid="timeline-row-actions">
+					<Button type="text" ghost>
 						<Ellipsis className="dropdown-icon" size="md" />
 					</Button>
 				</ConditionalAlertPopover>
--- a/frontend/src/container/AlertHistory/Timeline/TabsAndFilters/TabsAndFilters.tsx
+++ b/frontend/src/container/AlertHistory/Timeline/TabsAndFilters/TabsAndFilters.tsx
@@ -23,7 +23,6 @@ function TimelineTabs(): JSX.Element {
 		{
 			value: TimelineTab.OVERALL_STATUS,
 			label: 'Overall Status',
-			testId: 'timeline-tab-overall-status',
 		},
 		{
 			value: TimelineTab.TOP_5_CONTRIBUTORS,
@@ -34,7 +33,6 @@ function TimelineTabs(): JSX.Element {
 				</div>
 			),
 			disabled: true,
-			testId: 'timeline-tab-top-contributors',
 		},
 	];

@@ -59,17 +57,14 @@ function TimelineFilters(): JSX.Element {
 		{
 			value: TimelineFilter.ALL,
 			label: 'All',
-			testId: 'timeline-filter-all',
 		},
 		{
 			value: TimelineFilter.FIRED,
 			label: 'Fired',
-			testId: 'timeline-filter-fired',
 		},
 		{
 			value: TimelineFilter.RESOLVED,
 			label: 'Resolved',
-			testId: 'timeline-filter-resolved',
 		},
 	];

--- a/frontend/src/container/CreateAlertV2/EvaluationSettings/AdvancedOptions.tsx
+++ b/frontend/src/container/CreateAlertV2/EvaluationSettings/AdvancedOptions.tsx
@@ -34,7 +34,6 @@ function AdvancedOptions(): JSX.Element {
 										})
 									}
 									value={advancedOptions.sendNotificationIfDataIsMissing.toleranceLimit}
-									testId="send-notification-if-data-is-missing-input"
 								/>
 								<Typography.Text>Minutes</Typography.Text>
 							</div>
@@ -67,7 +66,6 @@ function AdvancedOptions(): JSX.Element {
 										})
 									}
 									value={advancedOptions.enforceMinimumDatapoints.minimumDatapoints}
-									testId="enforce-minimum-datapoints-input"
 								/>
 								<Typography.Text>Datapoints</Typography.Text>
 							</div>
--- a/frontend/src/container/CreateAlertV2/EvaluationSettings/EvaluationWindowPopover/EvaluationWindowPopover.tsx
+++ b/frontend/src/container/CreateAlertV2/EvaluationSettings/EvaluationWindowPopover/EvaluationWindowPopover.tsx
@@ -66,7 +66,6 @@ function EvaluationWindowPopover({
 						tabIndex={0}
 						data-value={option.value}
 						data-section-id={sectionId}
-						data-testid={`${sectionId}-option-${option.value}`}
 						onClick={(): void => onChange(option.value)}
 						onKeyDown={(e): void => {
 							if (e.key === 'Enter' || e.key === ' ') {
--- a/frontend/src/container/CreateAlertV2/Footer/Footer.tsx
+++ b/frontend/src/container/CreateAlertV2/Footer/Footer.tsx
@@ -186,7 +186,6 @@ function Footer(): JSX.Element {
 				color="primary"
 				onClick={handleSaveAlert}
 				disabled={disableButtons || Boolean(alertValidationMessage)}
-				testId="save-alert-rule-button"
 			>
 				{isCreatingAlertRule || isUpdatingAlertRule ? (
 					<Loader data-testid="save-alert-rule-loader-icon" size={14} />
@@ -219,7 +218,6 @@ function Footer(): JSX.Element {
 				color="secondary"
 				onClick={handleTestNotification}
 				disabled={disableButtons || Boolean(alertValidationMessage)}
-				testId="test-notification-button"
 			>
 				{isTestingAlertRule ? (
 					<Loader data-testid="test-notification-loader-icon" size={14} />
@@ -251,7 +249,6 @@ function Footer(): JSX.Element {
 				color="secondary"
 				onClick={handleDiscard}
 				disabled={disableButtons}
-				testId="discard-alert-rule-button"
 			>
 				<X size={14} /> Discard
 			</Button>
--- a/frontend/src/container/FormAlertRules/BasicInfo.tsx
+++ b/frontend/src/container/FormAlertRules/BasicInfo.tsx
@@ -119,7 +119,6 @@ function BasicInfo({
 					<SeveritySelect
 						getPopupContainer={popupContainer}
 						defaultValue="critical"
-						data-testid="alert-severity-select"
 						onChange={(value: unknown | string): void => {
 							const s = (value as string) || 'critical';
 							setAlertDef({
@@ -148,7 +147,6 @@ function BasicInfo({
 					]}
 				>
 					<InputSmall
-						data-testid="alert-name-input-v1"
 						onChange={(e): void => {
 							setAlertDef({
 								...alertDef,
@@ -163,7 +161,6 @@ function BasicInfo({
 					name={['annotations', 'description']}
 				>
 					<TextareaMedium
-						data-testid="alert-description-input"
 						onChange={(e): void => {
 							setAlertDef({
 								...alertDef,
--- a/frontend/src/container/FormAlertRules/QuerySection.tsx
+++ b/frontend/src/container/FormAlertRules/QuerySection.tsx
@@ -105,7 +105,7 @@ function QuerySection({
 		{
 			label: (
 				<Tooltip title="Query Builder">
-					<Button className="nav-btns" data-testid="query-builder-tab">
+					<Button className="nav-btns">
 						<Atom size={14} />
 						<Typography.Text>Query Builder</Typography.Text>
 					</Button>
@@ -122,11 +122,7 @@ function QuerySection({
 							: 'ClickHouse'
 					}
 				>
-					<Button
-						className="nav-btns"
-						disabled={isAnomalyDetection}
-						data-testid="clickhouse-tab"
-					>
+					<Button className="nav-btns" disabled={isAnomalyDetection}>
 						<Terminal size={14} />
 						<Typography.Text>ClickHouse Query</Typography.Text>
 					</Button>
@@ -166,11 +162,7 @@ function QuerySection({
 								: 'ClickHouse'
 						}
 					>
-						<Button
-							className="nav-btns"
-							disabled={isAnomalyDetection}
-							data-testid="clickhouse-tab"
-						>
+						<Button className="nav-btns" disabled={isAnomalyDetection}>
 							<Terminal size={14} />
 							<Typography.Text>ClickHouse Query</Typography.Text>
 						</Button>
@@ -188,11 +180,7 @@ function QuerySection({
 								: 'PromQL'
 						}
 					>
-						<Button
-							className="nav-btns"
-							disabled={isAnomalyDetection}
-							data-testid="promql-tab"
-						>
+						<Button className="nav-btns" disabled={isAnomalyDetection}>
 							<PromQLIcon
 								fillColor={isDarkMode ? Color.BG_VANILLA_200 : Color.BG_INK_300}
 							/>
--- a/frontend/src/container/FormAlertRules/RuleOptions.tsx
+++ b/frontend/src/container/FormAlertRules/RuleOptions.tsx
@@ -80,7 +80,6 @@ function RuleOptions({
 			defaultValue={defaultCompareOp}
 			value={alertDef.condition?.op}
 			style={{ minWidth: '120px' }}
-			data-testid="alert-threshold-op-select"
 			onChange={(value: string | unknown): void => {
 				const newOp = (value as string) || '';

@@ -117,7 +116,6 @@ function RuleOptions({
 			defaultValue={defaultMatchType}
 			style={{ minWidth: '130px' }}
 			value={alertDef.condition?.matchType}
-			data-testid="alert-threshold-match-type-select-v1"
 			onChange={(value: string | unknown): void => handleMatchOptChange(value)}
 		>
 			<Select.Option value="1">{t('option_atleastonce')}</Select.Option>
@@ -179,7 +177,6 @@ function RuleOptions({
 			style={{ minWidth: '120px' }}
 			value={alertDef.evalWindow}
 			onChange={onChangeEvalWindow}
-			data-testid="alert-eval-window-select"
 		>
 			<Select.Option value="5m0s">{t('option_5min')}</Select.Option>
 			<Select.Option value="10m0s">{t('option_10min')}</Select.Option>
@@ -197,7 +194,6 @@ function RuleOptions({
 			style={{ minWidth: '120px' }}
 			value={alertDef.evalWindow}
 			onChange={onChangeEvalWindow}
-			data-testid="alert-eval-window-select"
 		>
 			<Select.Option value="5m0s">{t('option_5min')}</Select.Option>
 			<Select.Option value="10m0s">{t('option_10min')}</Select.Option>
@@ -399,7 +395,6 @@ function RuleOptions({
 									value={alertDef?.condition?.target}
 									onChange={onChange}
 									type="number"
-									data-testid="alert-threshold-target-input"
 									onWheel={(e): void => e.currentTarget.blur()}
 								/>
 							</Form.Item>
--- a/frontend/src/container/FormAlertRules/index.tsx
+++ b/frontend/src/container/FormAlertRules/index.tsx
@@ -844,6 +844,8 @@ function FormAlertRules({

 	return (
 		<>
+			{Element}
+
 			<div
 				id="top"
 				className={`form-alert-rules-container ${
@@ -966,7 +968,6 @@ function FormAlertRules({
 								!isChannelConfigurationValid ||
 								queryStatus === 'error'
 							}
-							data-testid="alert-save-button"
 						>
 							{isNewRule ? t('button_createrule') : t('button_savechanges')}
 						</ActionButton>
@@ -980,7 +981,6 @@ function FormAlertRules({
 							}
 							type="default"
 							onClick={onTestRuleHandler}
-							data-testid="alert-test-button"
 						>
 							{' '}
 							{t('button_testrule')}
@@ -989,7 +989,6 @@ function FormAlertRules({
 							disabled={loading || false}
 							type="default"
 							onClick={onCancelHandler}
-							data-testid="alert-cancel-button"
 						>
 							{isNewRule && t('button_cancelchanges')}
 							{ruleId && !isEmpty(ruleId) && t('button_discard')}
@@ -999,7 +998,6 @@ function FormAlertRules({
 			</div>

 			<ConfirmDialog
-				testId="alert-save-confirm-dialog"
 				open={isConfirmSaveOpen}
 				onOpenChange={setIsConfirmSaveOpen}
 				title={t('confirm_save_title')}
--- a/frontend/src/container/FormAlertRules/labels/index.tsx
+++ b/frontend/src/container/FormAlertRules/labels/index.tsx
@@ -174,7 +174,6 @@ function LabelSelect({

 			<div style={{ display: 'flex', width: '100%' }}>
 				<Input
-					data-testid="alert-labels-input-v1"
 					placeholder={renderPlaceholder()}
 					onChange={handleLabelChange}
 					onKeyUp={(e): void => {
--- a/frontend/src/container/OnboardingQuestionaire/InviteTeamMembers/InviteTeamMembers.tsx
+++ b/frontend/src/container/OnboardingQuestionaire/InviteTeamMembers/InviteTeamMembers.tsx
@@ -14,7 +14,7 @@ import './InviteTeamMembers.styles.scss';

 interface TeamMember {
 	email: string;
-	role: string;
+	roles: string[];
 	name: string;
 	frontendBaseUrl: string;
 	id: string;
@@ -45,7 +45,7 @@ function InviteTeamMembers({
 	const toTeamMembers = (rows: InviteMemberRow[]): TeamMember[] =>
 		rows.map((row) => ({
 			email: row.email,
-			role: roleIdToName[row.roleId] ?? row.roleId,
+			roles: row.roleIds.map((roleId) => roleIdToName[roleId] ?? roleId),
 			name: '',
 			frontendBaseUrl: getBaseUrl(),
 			id: row.id,
--- a/frontend/src/container/OnboardingQuestionaire/InviteTeamMembers/tests/InviteTeamMembers.test.tsx
+++ b/frontend/src/container/OnboardingQuestionaire/InviteTeamMembers/tests/InviteTeamMembers.test.tsx
@@ -166,8 +166,8 @@ describe('InviteTeamMembers', () => {
 				{ email: 'user2@test.com', success: true },
 			];
 			const mockRows: InviteMemberRow[] = [
-				{ id: 'row-1', email: 'user1@test.com', roleId: 'role-viewer-id' },
-				{ id: 'row-2', email: 'user2@test.com', roleId: 'role-editor-id' },
+				{ id: 'row-1', email: 'user1@test.com', roleIds: ['role-viewer-id'] },
+				{ id: 'row-2', email: 'user2@test.com', roleIds: ['role-editor-id'] },
 			];
 			mockInviteMembersProps?.onSuccess?.(mockResults, mockRows);

@@ -177,14 +177,14 @@ describe('InviteTeamMembers', () => {
 					teamMembers: [
 						{
 							email: 'user1@test.com',
-							role: 'VIEWER',
+							roles: ['VIEWER'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-1',
 						},
 						{
 							email: 'user2@test.com',
-							role: 'EDITOR',
+							roles: ['EDITOR'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-2',
@@ -211,8 +211,8 @@ describe('InviteTeamMembers', () => {
 				{ email: 'user2@test.com', success: false, error: 'Already exists' },
 			];
 			const mockRows: InviteMemberRow[] = [
-				{ id: 'row-1', email: 'user1@test.com', roleId: 'role-viewer-id' },
-				{ id: 'row-2', email: 'user2@test.com', roleId: 'role-admin-id' },
+				{ id: 'row-1', email: 'user1@test.com', roleIds: ['role-viewer-id'] },
+				{ id: 'row-2', email: 'user2@test.com', roleIds: ['role-admin-id'] },
 			];
 			mockInviteMembersProps?.onPartialSuccess?.(mockResults, mockRows);

@@ -222,14 +222,14 @@ describe('InviteTeamMembers', () => {
 					teamMembers: [
 						{
 							email: 'user1@test.com',
-							role: 'VIEWER',
+							roles: ['VIEWER'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-1',
 						},
 						{
 							email: 'user2@test.com',
-							role: 'ADMIN',
+							roles: ['ADMIN'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-2',
@@ -252,8 +252,8 @@ describe('InviteTeamMembers', () => {
 				{ email: 'user2@test.com', success: false, error: 'Error 2' },
 			];
 			const mockRows: InviteMemberRow[] = [
-				{ id: 'row-1', email: 'user1@test.com', roleId: 'role-editor-id' },
-				{ id: 'row-2', email: 'user2@test.com', roleId: 'role-viewer-id' },
+				{ id: 'row-1', email: 'user1@test.com', roleIds: ['role-editor-id'] },
+				{ id: 'row-2', email: 'user2@test.com', roleIds: ['role-viewer-id'] },
 			];
 			mockInviteMembersProps?.onAllFailed?.(mockResults, mockRows);

@@ -263,14 +263,14 @@ describe('InviteTeamMembers', () => {
 					teamMembers: [
 						{
 							email: 'user1@test.com',
-							role: 'EDITOR',
+							roles: ['EDITOR'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-1',
 						},
 						{
 							email: 'user2@test.com',
-							role: 'VIEWER',
+							roles: ['VIEWER'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-2',
--- a/frontend/src/hooks/logs/types.ts
+++ b/frontend/src/hooks/logs/types.ts
@@ -1,4 +1,4 @@
-import { MouseEventHandler } from 'react';
+import { MouseEvent } from 'react';
 import { ILog } from 'types/api/logs/log';
 import { DataTypes } from 'types/api/queryBuilder/queryAutocompleteResponse';

@@ -11,7 +11,7 @@ export type UseCopyLogLink = {
 	isHighlighted: boolean;
 	isLogsExplorerPage: boolean;
 	activeLogId: string | null;
-	onLogCopy: MouseEventHandler<HTMLElement>;
+	onLogCopy: (event?: MouseEvent<HTMLElement>) => void;
 	onClearActiveLog: () => void;
 };

--- a/frontend/src/hooks/logs/useCopyLogLink.ts
+++ b/frontend/src/hooks/logs/useCopyLogLink.ts
@@ -1,10 +1,4 @@
-import {
-	MouseEventHandler,
-	useCallback,
-	useEffect,
-	useMemo,
-	useState,
-} from 'react';
+import { MouseEvent, useCallback, useEffect, useMemo, useState } from 'react';
 // eslint-disable-next-line no-restricted-imports
 import { useSelector } from 'react-redux';
 import { useLocation } from 'react-router-dom';
@@ -46,14 +40,14 @@ export const useCopyLogLink = (logId?: string): UseCopyLogLink => {
 		[pathname],
 	);

-	const onLogCopy: MouseEventHandler<HTMLElement> = useCallback(
-		(event) => {
+	const onLogCopy = useCallback(
+		(event?: MouseEvent<HTMLElement>): void => {
 			if (!logId) {
 				return;
 			}

-			event.preventDefault();
-			event.stopPropagation();
+			event?.preventDefault();
+			event?.stopPropagation();

 			urlQuery.delete(QueryParams.activeLogId);
 			urlQuery.delete(QueryParams.relativeTime);
@@ -66,7 +60,7 @@ export const useCopyLogLink = (logId?: string): UseCopyLogLink => {

 			setCopy(link);

-			toast.success('Copied to clipboard', { position: 'top-right' });
+			toast.success('Copied to clipboard', { position: 'bottom-right' });
 		},
 		[logId, urlQuery, minTime, maxTime, pathname, setCopy],
 	);
--- a/frontend/src/mocks-server/handlers.ts
+++ b/frontend/src/mocks-server/handlers.ts
@@ -139,27 +139,6 @@ export const handlers = [
 			return res(ctx.status(500));
 		},
 	),
-	rest.get('http://localhost/api/v1/loginPrecheck', (req, res, ctx) => {
-		const email = req.url.searchParams.get('email');
-		if (email === 'failEmail@signoz.io') {
-			return res(ctx.status(500));
-		}
-
-		return res(
-			ctx.status(200),
-			ctx.json({
-				status: 'success',
-				data: {
-					sso: true,
-					ssoUrl: '',
-					canSelfRegister: false,
-					isUser: true,
-					ssoError: '',
-				},
-			}),
-		);
-	}),
-
 	rest.get('http://localhost/api/v2/licenses', (req, res, ctx) =>
 		res(ctx.status(200), ctx.json(licensesSuccessResponse)),
 	),
@@ -194,14 +173,6 @@ export const handlers = [
 			}),
 		),
 	),
-	rest.put('http://localhost/api/v1/user/:id', (_, res, ctx) =>
-		res(
-			ctx.status(200),
-			ctx.json({
-				data: 'user updated successfully',
-			}),
-		),
-	),
 	rest.get(
 		'http://localhost/api/v3/autocomplete/aggregate_attributes',
 		(req, res, ctx) =>
--- a/frontend/src/pages/AlertDetails/AlertDetails.tsx
+++ b/frontend/src/pages/AlertDetails/AlertDetails.tsx
@@ -94,8 +94,6 @@ function AlertDetails(): JSX.Element {
 		>
 			<div
 				className={classNames('alert-details', { 'alert-details-v2': isV2Alert })}
-				data-testid="alert-details-root"
-				data-schema-version={isV2Alert ? NEW_ALERT_SCHEMA_VERSION : 'v1'}
 			>
 				<AlertBreadcrumb
 					className="alert-details__breadcrumb"
--- a/frontend/src/pages/AlertDetails/AlertHeader/ActionButtons/ActionButtons.tsx
+++ b/frontend/src/pages/AlertDetails/AlertHeader/ActionButtons/ActionButtons.tsx
@@ -117,11 +117,7 @@ function AlertActionButtons({
 			<div className="alert-action-buttons">
 				<Tooltip title={isAlertRuleDisabled ? 'Enable alert' : 'Disable alert'}>
 					{isAlertRuleDisabled !== undefined && (
-						<Switch
-							onChange={toggleAlertRule}
-							value={!isAlertRuleDisabled}
-							testId="alert-actions-toggle"
-						/>
+						<Switch onChange={toggleAlertRule} value={!isAlertRuleDisabled} />
 					)}
 				</Tooltip>
 				<CopyToClipboard textToCopy={window.location.href} />
@@ -133,7 +129,6 @@ function AlertActionButtons({
 						<Tooltip title="More options">
 							<Button
 								type="text"
-								data-testid="alert-actions-menu"
 								icon={
 									<Ellipsis
 										size={16}
--- a/frontend/src/pages/AlertDetails/AlertHeader/AlertHeader.tsx
+++ b/frontend/src/pages/AlertDetails/AlertHeader/AlertHeader.tsx
@@ -47,29 +47,21 @@ function AlertHeader({ alertDetails }: AlertHeaderProps): JSX.Element {
 		<div className="alert-info__info-wrapper">
 			<div className="top-section">
 				<div className="alert-title-wrapper">
-					<div data-testid="alert-header-state">
-						<AlertState state={alertRuleState ?? state ?? ''} />
-					</div>
-					<div className="alert-title" data-testid="alert-header-title">
+					<AlertState state={alertRuleState ?? state ?? ''} />
+					<div className="alert-title">
 						<LineClampedText text={displayName || ''} />
 					</div>
 				</div>
 			</div>
 			<div className="bottom-section">
-				{labels?.severity && (
-					<div data-testid="alert-header-severity">
-						<AlertSeverity severity={labels.severity} />
-					</div>
-				)}
+				{labels?.severity && <AlertSeverity severity={labels.severity} />}

 				{/* // TODO(shaheer): Get actual data when we are able to get alert firing from state from API */}
 				{/* <AlertStatus
 						status="firing"
 						timestamp={dayjs().subtract(1, 'd').valueOf()}
 					/> */}
-				<div data-testid="alert-header-labels">
-					<AlertLabels labels={labelsWithoutSeverity} />
-				</div>
+				<AlertLabels labels={labelsWithoutSeverity} />
 			</div>
 		</div>
 	);
--- a/frontend/src/pages/AlertDetails/hooks.tsx
+++ b/frontend/src/pages/AlertDetails/hooks.tsx
@@ -127,7 +127,7 @@ export const useRouteTabUtils = (): { routes: TabRoutes[] } => {
 		{
 			Component: EditRules,
 			name: (
-				<div className="tab-item" data-testid="alert-details-tab-overview">
+				<div className="tab-item">
 					<Table size={14} />
 					Overview
 				</div>
@@ -138,7 +138,7 @@ export const useRouteTabUtils = (): { routes: TabRoutes[] } => {
 		{
 			Component: AlertHistory,
 			name: (
-				<div className="tab-item" data-testid="alert-details-tab-history">
+				<div className="tab-item">
 					<History size={14} />
 					History
 					<BetaTag />
--- a/frontend/src/periscope/components/Tabs2/Tabs2.tsx
+++ b/frontend/src/periscope/components/Tabs2/Tabs2.tsx
@@ -13,8 +13,6 @@ interface Tab {
 	disabled?: boolean;
 	icon?: string | JSX.Element;
 	isBeta?: boolean;
-	/** Optional `data-testid` for the tab button. */
-	testId?: string;
 }

 interface TimelineTabsProps {
@@ -65,7 +63,6 @@ function Tabs2({
 						disabled={tab.disabled}
 						icon={tab.icon}
 						style={{ minWidth: buttonMinWidth }}
-						data-testid={tab.testId}
 					>
 						{tab.label}

--- a/frontend/src/types/api/user/inviteUsers.ts
+++ b/frontend/src/types/api/user/inviteUsers.ts
@@ -1,12 +0,0 @@
-import { User } from 'types/reducer/app';
-
-export interface UserProps {
-	name: User['displayName'];
-	email: User['email'];
-	role: string;
-	frontendBaseUrl: string;
-}
-
-export interface UsersProps {
-	invites: UserProps[];
-}
--- a/pkg/apiserver/signozapiserver/user.go
+++ b/pkg/apiserver/signozapiserver/user.go
@@ -27,22 +27,6 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}

-	if err := router.Handle("/api/v1/invite/bulk", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateBulkInvite), handler.OpenAPIDef{
-		ID:                 "CreateBulkInvite",
-		Tags:               []string{"users"},
-		Summary:            "Create bulk invite",
-		Description:        "This endpoint creates a bulk invite for a user",
-		Request:            new(types.PostableBulkInviteRequest),
-		RequestContentType: "application/json",
-		Response:           nil,
-		SuccessStatusCode:  http.StatusCreated,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusConflict},
-		Deprecated:         true,
-		SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v1/user", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.ListUsersDeprecated), handler.OpenAPIDef{
 		ID:                  "ListUsersDeprecated",
 		Tags:                []string{"users"},
@@ -138,30 +122,13 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		Response:            nil,
 		ResponseContentType: "",
 		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{},
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
 		Deprecated:          false,
 		SecuritySchemes:     []handler.OpenAPISecurityScheme{{Name: authtypes.IdentNProviderTokenizer.StringValue()}},
 	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/user/{id}", handler.New(provider.authzMiddleware.SelfAccess(provider.userHandler.GetUserDeprecated), handler.OpenAPIDef{
-		ID:                  "GetUserDeprecated",
-		Tags:                []string{"users"},
-		Summary:             "Get user",
-		Description:         "This endpoint returns the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.DeprecatedUser),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          true,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUser), handler.OpenAPIDef{
 		ID:                  "GetUser",
 		Tags:                []string{"users"},
@@ -179,23 +146,6 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}

-	if err := router.Handle("/api/v1/user/{id}", handler.New(provider.authzMiddleware.SelfAccess(provider.userHandler.UpdateUserDeprecated), handler.OpenAPIDef{
-		ID:                  "UpdateUserDeprecated",
-		Tags:                []string{"users"},
-		Summary:             "Update user",
-		Description:         "This endpoint updates the user by id",
-		Request:             new(types.DeprecatedUser),
-		RequestContentType:  "application/json",
-		Response:            new(types.DeprecatedUser),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          true,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.UpdateUser), handler.OpenAPIDef{
 		ID:                  "UpdateUser",
 		Tags:                []string{"users"},
@@ -213,23 +163,6 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}

-	if err := router.Handle("/api/v1/user/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUser), handler.OpenAPIDef{
-		ID:                  "DeleteUserDeprecated",
-		Tags:                []string{"users"},
-		Summary:             "Delete user",
-		Description:         "This endpoint deletes the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          true,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUser), handler.OpenAPIDef{
 		ID:                  "DeleteUser",
 		Tags:                []string{"users"},
@@ -240,7 +173,7 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		Response:            nil,
 		ResponseContentType: "",
 		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 		Deprecated:          false,
 		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
 	})).Methods(http.MethodDelete).GetError(); err != nil {
@@ -316,7 +249,7 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 	}

 	if err := router.Handle("/api/v1/resetPassword", handler.New(provider.authzMiddleware.OpenAccess(provider.userHandler.ResetPassword), handler.OpenAPIDef{
-		ID:                  "ResetPassword",
+		ID:                  "ResetPasswordDeprecated",
 		Tags:                []string{"users"},
 		Summary:             "Reset password",
 		Description:         "This endpoint resets the password by token",
@@ -326,7 +259,7 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		ResponseContentType: "",
 		SuccessStatusCode:   http.StatusNoContent,
 		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
-		Deprecated:          false,
+		Deprecated:          true,
 		SecuritySchemes:     []handler.OpenAPISecurityScheme{},
 	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
@@ -366,6 +299,23 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}

+	if err := router.Handle("/api/v2/factor_password/reset", handler.New(provider.authzMiddleware.OpenAccess(provider.userHandler.ResetPassword), handler.OpenAPIDef{
+		ID:                  "ResetPassword",
+		Tags:                []string{"users"},
+		Summary:             "Reset password",
+		Description:         "This endpoint resets the password using a single use reset password token",
+		Request:             new(types.PostableResetPassword),
+		RequestContentType:  "application/json",
+		Response:            nil,
+		ResponseContentType: "",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		Deprecated:          false,
+		SecuritySchemes:     []handler.OpenAPISecurityScheme{},
+	})).Methods(http.MethodPost).GetError(); err != nil {
+		return err
+	}
+
 	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetRolesByUserID), handler.OpenAPIDef{
 		ID:                  "GetRolesByUserID",
 		Tags:                []string{"users"},
@@ -393,7 +343,7 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		Response:            nil,
 		ResponseContentType: "",
 		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 		Deprecated:          true,
 		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
 	})).Methods(http.MethodPost).GetError(); err != nil {
@@ -410,7 +360,7 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		Response:            nil,
 		ResponseContentType: "",
 		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 		Deprecated:          true,
 		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
 	})).Methods(http.MethodDelete).GetError(); err != nil {
--- a/pkg/http/middleware/authz.go
+++ b/pkg/http/middleware/authz.go
@@ -14,7 +14,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/gorilla/mux"
 )

 const (
@@ -151,40 +150,6 @@ func (middleware *AuthZ) AdminAccess(next http.HandlerFunc) http.HandlerFunc {
 	})
 }

-func (middleware *AuthZ) SelfAccess(next http.HandlerFunc) http.HandlerFunc {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		claims, err := authtypes.ClaimsFromContext(req.Context())
-		if err != nil {
-			render.Error(rw, err)
-			return
-		}
-
-		selectors := []coretypes.Selector{
-			coretypes.TypeRole.MustSelector(authtypes.SigNozAdminRoleName),
-		}
-
-		err = middleware.authzService.CheckWithTupleCreation(
-			req.Context(),
-			claims,
-			valuer.MustNewUUID(claims.OrgID),
-			authtypes.Relation{Verb: coretypes.VerbAssignee},
-			coretypes.NewResourceRole(),
-			selectors,
-			selectors,
-		)
-
-		if err != nil {
-			id := mux.Vars(req)["id"]
-			if err := claims.IsSelfAccess(id); err != nil {
-				middleware.logger.WarnContext(req.Context(), authzDeniedMessage, slog.Any("claims", claims))
-				render.Error(rw, err)
-				return
-			}
-		}
-		next(rw, req)
-	})
-}
-
 func (middleware *AuthZ) OpenAccess(next http.HandlerFunc) http.HandlerFunc {
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 		next(rw, req)
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_postgres/integration.json
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_postgres/integration.json
@@ -5,7 +5,7 @@
  "overview": "file://overview.md",
  "supportedSignals": {
    "metrics": true,
-    "logs": true
+    "logs": false
  },
  "dataCollected": {
    "metrics": [
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudstorage/integration.json
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudstorage/integration.json
@@ -5,7 +5,7 @@
  "overview": "file://overview.md",
  "supportedSignals": {
    "metrics": true,
-    "logs": true
+    "logs": false
  },
  "dataCollected": {
    "metrics": [
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/computeengine/integration.json
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/computeengine/integration.json
@@ -5,7 +5,7 @@
  "overview": "file://overview.md",
  "supportedSignals": {
    "metrics": true,
-    "logs": true
+    "logs": false
  },
  "dataCollected": {
    "metrics": [
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/gke/integration.json
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/gke/integration.json
@@ -5,7 +5,7 @@
  "overview": "file://overview.md",
  "supportedSignals": {
    "metrics": true,
-    "logs": true
+    "logs": false
  },
  "dataCollected": {
    "metrics": [
--- a/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/memorystore_redis/integration.json
+++ b/pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/memorystore_redis/integration.json
@@ -5,7 +5,7 @@
  "overview": "file://overview.md",
  "supportedSignals": {
    "metrics": true,
-    "logs": true
+    "logs": false
  },
  "dataCollected": {
    "metrics": [
--- a/pkg/modules/inframonitoring/implinframonitoring/clusters.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/clusters.go
@@ -84,20 +84,38 @@ func buildClusterRecords(
 	return records
 }

+// getTopClusterGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status / node-readiness keysets when filtering,
+// to intersect all).
 func (m *module) getTopClusterGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableClusters,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, map[string]nodeConditionCounts, error) {

 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey            string
+		metadataMap           map[string]map[string]string
+		allMetricGroups       []rankedGroup
+		statusCounts          map[string]podStatusCounts
+		statusWarning         *qbtypes.QueryWarnData
+		nodeConditionCounts   map[string]nodeConditionCounts
+		filter                *qbtypes.Filter
+		filterByPodStatus     []inframonitoringtypes.PodStatus
+		filterByNodeReadiness []inframonitoringtypes.NodeCondition
 	)

 	orderByKey = req.OrderBy.Key.Name

+	// When filtering by pod status / node readiness, resolve the full-scope
+	// keyset(s) concurrently (pageGroups=nil spans all groups under the user
+	// filter) to intersect metadata + ranked groups below. Filters compose as AND.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -106,12 +124,37 @@ func (m *module) getTopClusterGroupsAndMetadata(
 		return err
 	})

+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
+	if len(filterByNodeReadiness) != 0 {
+		g.Go(func() error {
+			var err error
+			nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByNodeReadiness)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.ClusterNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status/readiness-matching groups. A missing
+		// metric yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning). Filters compose as AND.
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
+		}
+		if len(filterByNodeReadiness) != 0 {
+			metadataMap = intersectMap(metadataMap, nodeConditionCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.ClusterNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
 	}

 	queryNamesForOrderBy := orderByToClustersQueryNames[orderByKey]
@@ -157,10 +200,23 @@ func (m *module) getTopClusterGroupsAndMetadata(
 	})

 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, nil, err
 	}

-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status/readiness
+	// keyset. A missing metric yields an empty keyset, correctly emptying the result
+	// (the caller also surfaces the warning). Filters compose as AND.
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+	if len(filterByNodeReadiness) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, nodeConditionCounts)
+		metadataMap = intersectMap(metadataMap, nodeConditionCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
 }

 func (m *module) getClustersTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableClusters) (map[string]map[string]string, error) {
@@ -170,5 +226,9 @@ func (m *module) getClustersTableMetadata(ctx context.Context, orgID valuer.UUID
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, clustersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, clustersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }
--- a/pkg/modules/inframonitoring/implinframonitoring/containers.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/containers.go
@@ -139,20 +139,34 @@ func buildContainerRecords(
 	return records
 }

+// getTopContainerGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope container-status keyset when filtering, to intersect both).
 func (m *module) getTopContainerGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableContainers,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]containerStatusCounts, *qbtypes.QueryWarnData, error) {

 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey              string
+		metadataMap             map[string]map[string]string
+		allMetricGroups         []rankedGroup
+		statusCounts            map[string]containerStatusCounts
+		statusWarning           *qbtypes.QueryWarnData
+		filter                  *qbtypes.Filter
+		filterByContainerStatus []inframonitoringtypes.ContainerStatus
 	)

 	orderByKey = req.OrderBy.Key.Name

+	// When filtering by container status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByContainerStatus = req.Filter.FilterByContainerStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -161,12 +175,26 @@ func (m *module) getTopContainerGroupsAndMetadata(
 		return err
 	})

+	if len(filterByContainerStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupContainerStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByContainerStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.ContainerNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByContainerStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.ContainerNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}

 	queryNamesForOrderBy := orderByToContainersQueryNames[orderByKey]
@@ -212,10 +240,19 @@ func (m *module) getTopContainerGroupsAndMetadata(
 	})

 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}

-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByContainerStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }

 func (m *module) getContainersTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableContainers) (map[string]map[string]string, error) {
@@ -225,7 +262,11 @@ func (m *module) getContainersTableMetadata(ctx context.Context, orgID valuer.UU
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, containersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, containersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }

 // getPerGroupContainerStatusCountsWithReqMetricChecks gates
@@ -241,6 +282,7 @@ func (m *module) getPerGroupContainerStatusCountsWithReqMetricChecks(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByContainerStatus []inframonitoringtypes.ContainerStatus,
 ) (map[string]containerStatusCounts, *qbtypes.QueryWarnData, error) {
 	present, err := m.getMetricsExistence(ctx, containerStatusMetricNamesList)
 	if err != nil {
@@ -266,13 +308,28 @@ func (m *module) getPerGroupContainerStatusCountsWithReqMetricChecks(
 		return map[string]containerStatusCounts{}, warning, nil
 	}

-	counts, err := m.getPerGroupContainerStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups)
+	counts, err := m.getPerGroupContainerStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups, filterByContainerStatus)
 	if err != nil {
 		return nil, nil, err
 	}
 	return counts, nil, nil
 }

+// applyContainerStatusFilter adds the display-status push-down (lower(display_status)
+// IN (...)) to the outer count builder. valuer lowercases the wire value while
+// display_status is kubectl-cased, so we compare lower() on both. No-op when the
+// requested set is empty.
+func applyContainerStatusFilter(cb *sqlbuilder.SelectBuilder, filterByContainerStatus []inframonitoringtypes.ContainerStatus) {
+	if len(filterByContainerStatus) == 0 {
+		return
+	}
+	vals := make([]string, len(filterByContainerStatus))
+	for i, c := range filterByContainerStatus {
+		vals[i] = c.StringValue()
+	}
+	cb.Where(cb.In("lower(display_status)", sqlbuilder.List(vals)))
+}
+
 // getPerGroupContainerStatusCounts computes per-group counts of distinct
 // containers bucketed by their latest kubectl-style display status in window.
 // Caller must ensure the required metrics exist
@@ -297,8 +354,11 @@ func (m *module) getPerGroupContainerStatusCounts(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByContainerStatus []inframonitoringtypes.ContainerStatus,
 ) (map[string]containerStatusCounts, error) {
-	if len(pageGroups) == 0 || len(groupBy) == 0 {
+	// Empty pageGroups means "span all under user filter", allowed only in
+	// full-scope mode (filtering by status). Otherwise it's an empty page.
+	if len(groupBy) == 0 || (len(pageGroups) == 0 && len(filterByContainerStatus) == 0) {
 		return map[string]containerStatusCounts{}, nil
 	}

@@ -482,11 +542,15 @@ func (m *module) getPerGroupContainerStatusCounts(
 		countGroupBy = append(countGroupBy, col)
 	}
 	countSelectCols = append(countSelectCols, statusCountCols...)
-	countSQL := fmt.Sprintf(
-		"SELECT %s FROM container_status GROUP BY %s",
-		strings.Join(countSelectCols, ", "),
-		strings.Join(countGroupBy, ", "),
-	)
+
+	// Outer count query. Built with sqlbuilder so the status push-down uses a
+	// proper IN (keep only containers whose display status is in the requested set).
+	countBuilder := sqlbuilder.NewSelectBuilder()
+	countBuilder.Select(countSelectCols...)
+	countBuilder.From("container_status")
+	applyContainerStatusFilter(countBuilder, filterByContainerStatus)
+	countBuilder.GroupBy(countGroupBy...)
+	countSQL, countArgs := countBuilder.BuildWithFlavor(sqlbuilder.ClickHouse)

 	// Combine CTEs + outer. Arg order mirrors CTE declaration order.
 	cteFragments := []string{
@@ -499,7 +563,7 @@ func (m *module) getPerGroupContainerStatusCounts(
 	finalSQL := querybuilder.CombineCTEs(cteFragments) + countSQL
 	finalArgs := querybuilder.PrependArgs([][]any{
 		stateFpsArgs, containerStateArgs, reasonFpsArgs, reasonInnerArgs,
-	}, nil)
+	}, countArgs)

 	rows, err := m.telemetryStore.ClickhouseDB().Query(ctx, finalSQL, finalArgs...)
 	if err != nil {
--- a/pkg/modules/inframonitoring/implinframonitoring/containers_test.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/containers_test.go
@@ -0,0 +1,59 @@
+package implinframonitoring
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/inframonitoringtypes"
+	"github.com/huandu/go-sqlbuilder"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestApplyContainerStatusFilter(t *testing.T) {
+	tests := []struct {
+		name      string
+		statuses  []inframonitoringtypes.ContainerStatus
+		wantWhere bool
+		wantArgs  []any
+	}{
+		{
+			name:      "empty set yields no clause",
+			statuses:  nil,
+			wantWhere: false,
+			wantArgs:  nil,
+		},
+		{
+			name:      "single status pushes lowercased arg via IN",
+			statuses:  []inframonitoringtypes.ContainerStatus{inframonitoringtypes.ContainerStatusRunning},
+			wantWhere: true,
+			wantArgs:  []any{"running"},
+		},
+		{
+			name: "multiple statuses push lowercased args via IN",
+			statuses: []inframonitoringtypes.ContainerStatus{
+				inframonitoringtypes.ContainerStatusRunning,
+				inframonitoringtypes.ContainerStatusCrashLoopBackOff,
+			},
+			wantWhere: true,
+			wantArgs:  []any{"running", "crashloopbackoff"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cb := sqlbuilder.NewSelectBuilder()
+			cb.Select("pod_uid")
+			cb.From("container_status")
+			applyContainerStatusFilter(cb, tt.statuses)
+			sql, args := cb.BuildWithFlavor(sqlbuilder.ClickHouse)
+
+			hasWhere := strings.Contains(sql, "lower(display_status) IN (")
+			assert.Equal(t, tt.wantWhere, hasWhere)
+			if len(tt.wantArgs) == 0 {
+				assert.Empty(t, args)
+			} else {
+				assert.Equal(t, tt.wantArgs, args)
+			}
+		})
+	}
+}
--- a/pkg/modules/inframonitoring/implinframonitoring/daemonsets.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/daemonsets.go
@@ -90,20 +90,34 @@ func buildDaemonSetRecords(
 	return records
 }

+// getTopDaemonSetGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopDaemonSetGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableDaemonSets,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {

 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)

 	orderByKey = req.OrderBy.Key.Name

+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -112,12 +126,26 @@ func (m *module) getTopDaemonSetGroupsAndMetadata(
 		return err
 	})

+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.DaemonSetNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.DaemonSetNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}

 	queryNamesForOrderBy := orderByToDaemonSetsQueryNames[orderByKey]
@@ -163,10 +191,19 @@ func (m *module) getTopDaemonSetGroupsAndMetadata(
 	})

 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}

-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }

 func (m *module) getDaemonSetsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableDaemonSets) (map[string]map[string]string, error) {
@@ -176,5 +213,9 @@ func (m *module) getDaemonSetsTableMetadata(ctx context.Context, orgID valuer.UU
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, daemonSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, daemonSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }
--- a/pkg/modules/inframonitoring/implinframonitoring/deployments.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/deployments.go
@@ -82,20 +82,34 @@ func buildDeploymentRecords(
 	return records
 }

+// getTopDeploymentGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopDeploymentGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableDeployments,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {

 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)

 	orderByKey = req.OrderBy.Key.Name

+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -104,12 +118,26 @@ func (m *module) getTopDeploymentGroupsAndMetadata(
 		return err
 	})

+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.DeploymentNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.DeploymentNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}

 	queryNamesForOrderBy := orderByToDeploymentsQueryNames[orderByKey]
@@ -155,10 +183,19 @@ func (m *module) getTopDeploymentGroupsAndMetadata(
 	})

 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}

-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }

 func (m *module) getDeploymentsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableDeployments) (map[string]map[string]string, error) {
@@ -168,5 +205,9 @@ func (m *module) getDeploymentsTableMetadata(ctx context.Context, orgID valuer.U
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, deploymentsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, deploymentsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }
--- a/pkg/modules/inframonitoring/implinframonitoring/helpers.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/helpers.go
@@ -63,6 +63,33 @@ func compositeKeyFromLabels(labels map[string]string, groupBy []qbtypes.GroupByK
 	return compositeKeyFromList(parts)
 }

+// intersectMap returns the entries of m whose key is present in keep (a new
+// map). keep's value type is irrelevant — only its keys are read — so a
+// per-group counts map (already filtered by the SQL push-down) can be passed
+// directly. Used to trim metadataMap to the status-matching groups.
+func intersectMap[V any, K any](m map[string]V, keep map[string]K) map[string]V {
+	out := make(map[string]V, len(m))
+	for k, v := range m {
+		if _, ok := keep[k]; ok {
+			out[k] = v
+		}
+	}
+	return out
+}
+
+// intersectRankedGroups returns the ranked groups whose compositeKey is present
+// in keep, preserving order. Keeps status-unmatched groups out of the ranked
+// page slots.
+func intersectRankedGroups[K any](groups []rankedGroup, keep map[string]K) []rankedGroup {
+	out := make([]rankedGroup, 0, len(groups))
+	for _, g := range groups {
+		if _, ok := keep[g.compositeKey]; ok {
+			out = append(out, g)
+		}
+	}
+	return out
+}
+
 // parseAndSortGroups extracts group label maps from a ScalarData response and
 // sorts them by the ranking query's aggregation value.
 func parseAndSortGroups(
@@ -850,8 +877,10 @@ func (m *module) getPerGroupDistinctCounts(
 			valueExpr = fmt.Sprintf("(%s)", strings.Join(parts, ", "))
 		}

+		// Prefix the alias so it never collides with a groupBy col alias
+		// (e.g. clusters grouped by k8s.node.name, which is also counted).
 		selectCols = append(selectCols,
-			fmt.Sprintf("uniqExactIf(%s, %s != '') AS %s", valueExpr, extract, quoteIdentifier(attr)),
+			fmt.Sprintf("uniqExactIf(%s, %s != '') AS %s", valueExpr, extract, quoteIdentifier(fmt.Sprintf("__count_%s", attr))),
 		)
 	}
 	sb.Select(selectCols...)
--- a/pkg/modules/inframonitoring/implinframonitoring/helpers_test.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/helpers_test.go
@@ -5,6 +5,7 @@ import (

 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/stretchr/testify/assert"
 )

 func groupByKey(name string) qbtypes.GroupByKey {
@@ -88,10 +89,7 @@ func TestIsKeyInGroupByAttrs(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := isKeyInGroupByAttrs(tt.groupByAttrs, tt.key)
-			if got != tt.expectedFound {
-				t.Errorf("isKeyInGroupByAttrs(%v, %q) = %v, want %v",
-					tt.groupByAttrs, tt.key, got, tt.expectedFound)
-			}
+			assert.Equal(t, tt.expectedFound, got)
 		})
 	}
 }
@@ -156,10 +154,7 @@ func TestMergeFilterExpressions(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := mergeFilterExpressions(tt.queryFilterExpr, tt.reqFilterExpr)
-			if got != tt.expected {
-				t.Errorf("mergeFilterExpressions(%q, %q) = %q, want %q",
-					tt.queryFilterExpr, tt.reqFilterExpr, got, tt.expected)
-			}
+			assert.Equal(t, tt.expected, got)
 		})
 	}
 }
@@ -205,10 +200,7 @@ func TestCompositeKeyFromList(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := compositeKeyFromList(tt.parts)
-			if got != tt.expected {
-				t.Errorf("compositeKeyFromList(%v) = %q, want %q",
-					tt.parts, got, tt.expected)
-			}
+			assert.Equal(t, tt.expected, got)
 		})
 	}
 }
@@ -376,10 +368,81 @@ func TestCompositeKeyFromLabels(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := compositeKeyFromLabels(tt.labels, tt.groupBy)
-			if got != tt.expected {
-				t.Errorf("compositeKeyFromLabels(%v, %v) = %q, want %q",
-					tt.labels, tt.groupBy, got, tt.expected)
-			}
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestIntersectMap(t *testing.T) {
+	tests := []struct {
+		name     string
+		m        map[string]int
+		keep     map[string]podStatusCounts
+		expected map[string]int
+	}{
+		{
+			name:     "keep subset",
+			m:        map[string]int{"a": 1, "b": 2, "c": 3},
+			keep:     map[string]podStatusCounts{"a": {}, "c": {}},
+			expected: map[string]int{"a": 1, "c": 3},
+		},
+		{
+			name:     "empty keep drops everything",
+			m:        map[string]int{"a": 1, "b": 2},
+			keep:     map[string]podStatusCounts{},
+			expected: map[string]int{},
+		},
+		{
+			name:     "keep key absent from m is ignored",
+			m:        map[string]int{"a": 1},
+			keep:     map[string]podStatusCounts{"a": {}, "z": {}},
+			expected: map[string]int{"a": 1},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := intersectMap(tt.m, tt.keep)
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestIntersectRankedGroups(t *testing.T) {
+	groups := []rankedGroup{
+		{compositeKey: "a", value: 3},
+		{compositeKey: "b", value: 2},
+		{compositeKey: "c", value: 1},
+	}
+
+	tests := []struct {
+		name     string
+		groups   []rankedGroup
+		keep     map[string]podStatusCounts
+		expected []string // compositeKeys in order
+	}{
+		{
+			name:     "preserves order, drops non-matching",
+			groups:   groups,
+			keep:     map[string]podStatusCounts{"a": {}, "c": {}},
+			expected: []string{"a", "c"},
+		},
+		{
+			name:     "empty keep drops all",
+			groups:   groups,
+			keep:     map[string]podStatusCounts{},
+			expected: []string{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := intersectRankedGroups(tt.groups, tt.keep)
+			gotKeys := make([]string, 0, len(got))
+			for _, g := range got {
+				gotKeys = append(gotKeys, g.compositeKey)
+			}
+			assert.Equal(t, tt.expected, gotKeys)
 		})
 	}
 }
--- a/pkg/modules/inframonitoring/implinframonitoring/jobs.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/jobs.go
@@ -90,20 +90,34 @@ func buildJobRecords(
 	return records
 }

+// getTopJobGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopJobGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableJobs,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {

 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)

 	orderByKey = req.OrderBy.Key.Name

+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -112,12 +126,26 @@ func (m *module) getTopJobGroupsAndMetadata(
 		return err
 	})

+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.JobNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.JobNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}

 	queryNamesForOrderBy := orderByToJobsQueryNames[orderByKey]
@@ -163,10 +191,19 @@ func (m *module) getTopJobGroupsAndMetadata(
 	})

 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}

-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }

 func (m *module) getJobsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableJobs) (map[string]map[string]string, error) {
@@ -176,5 +213,9 @@ func (m *module) getJobsTableMetadata(ctx context.Context, orgID valuer.UUID, re
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, jobsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, jobsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }
--- a/pkg/modules/inframonitoring/implinframonitoring/module.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/module.go
@@ -286,11 +286,36 @@ func (m *module) ListPods(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}

-	pageGroups, metadataMap, err := m.getTopPodGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		podFilter         *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+		restartCounts     map[string]int64
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		podFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopPodGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, statusCounts, statusWarning, err := m.getTopPodGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}

+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && statusWarning != nil {
+		resp.Warning = statusWarning
+		resp.Records = []inframonitoringtypes.PodRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)

 	if len(pageGroups) == 0 {
@@ -298,20 +323,8 @@ func (m *module) ListPods(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}

-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newPodsTableListQuery())

-	var (
-		queryResp     *qbtypes.QueryRangeResponse
-		statusCounts  map[string]podStatusCounts
-		statusWarning *qbtypes.QueryWarnData
-		restartCounts map[string]int64
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -321,14 +334,18 @@ func (m *module) ListPods(ctx context.Context, orgID valuer.UUID, req *inframoni
 	})
 	g.Go(func() error {
 		var err error
-		statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		restartCounts, err = m.getPerGroupPodRestartCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		restartCounts, err = m.getPerGroupPodRestartCounts(gCtx, orgID, req.Start, req.End, podFilter, req.GroupBy, pageGroups)
 		return err
 	})
+	// When filtering, statusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, podFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}

 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -379,11 +396,37 @@ func (m *module) ListContainers(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}

-	pageGroups, metadataMap, err := m.getTopContainerGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr              string
+		containerFilter         *qbtypes.Filter
+		filterByContainerStatus []inframonitoringtypes.ContainerStatus
+		queryResp               *qbtypes.QueryRangeResponse
+		restartCounts           map[string]int64
+		readyCounts             map[string]containerReadyCounts
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		containerFilter = &req.Filter.Filter
+		filterByContainerStatus = req.Filter.FilterByContainerStatus
+	}
+
+	// getTopContainerGroupsAndMetadata fetches metadata + ranking (+ full-scope
+	// container status when filtering) concurrently, intersecting metadata/ranked
+	// groups against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, statusCounts, statusWarning, err := m.getTopContainerGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}

+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByContainerStatus) != 0 && statusWarning != nil {
+		resp.Warning = statusWarning
+		resp.Records = []inframonitoringtypes.ContainerRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)

 	if len(pageGroups) == 0 {
@@ -391,21 +434,8 @@ func (m *module) ListContainers(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}

-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newContainersTableListQuery())

-	var (
-		queryResp     *qbtypes.QueryRangeResponse
-		statusCounts  map[string]containerStatusCounts
-		statusWarning *qbtypes.QueryWarnData
-		restartCounts map[string]int64
-		readyCounts   map[string]containerReadyCounts
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -415,19 +445,23 @@ func (m *module) ListContainers(ctx context.Context, orgID valuer.UUID, req *inf
 	})
 	g.Go(func() error {
 		var err error
-		statusCounts, statusWarning, err = m.getPerGroupContainerStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		restartCounts, err = m.getPerGroupContainerRestartCounts(gCtx, orgID, req.Start, req.End, containerFilter, req.GroupBy, pageGroups)
 		return err
 	})
 	g.Go(func() error {
 		var err error
-		restartCounts, err = m.getPerGroupContainerRestartCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		readyCounts, err = m.getPerGroupContainerReadyCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		readyCounts, err = m.getPerGroupContainerReadyCounts(gCtx, orgID, req.Start, req.End, containerFilter, req.GroupBy, pageGroups)
 		return err
 	})
+	// When filtering, statusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByContainerStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupContainerStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, containerFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}

 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -478,11 +512,37 @@ func (m *module) ListNodes(ctx context.Context, orgID valuer.UUID, req *inframon
 		return resp, nil
 	}

-	pageGroups, metadataMap, err := m.getTopNodeGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr            string
+		nodeFilter            *qbtypes.Filter
+		filterByPodStatus     []inframonitoringtypes.PodStatus
+		filterByNodeReadiness []inframonitoringtypes.NodeCondition
+		queryResp             *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		nodeFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
+	}
+
+	// getTopNodeGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status / node readiness when filtering) concurrently, intersecting
+	// metadata/ranked groups against the keysets. It returns the keysets + warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, nodeConditionCounts, err := m.getTopNodeGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}

+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.NodeRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)

 	if len(pageGroups) == 0 {
@@ -490,20 +550,8 @@ func (m *module) ListNodes(ctx context.Context, orgID valuer.UUID, req *inframon
 		return resp, nil
 	}

-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newNodesTableListQuery())

-	var (
-		queryResp           *qbtypes.QueryRangeResponse
-		nodeConditionCounts map[string]nodeConditionCounts
-		podStatusCounts     map[string]podStatusCounts
-		podStatusWarning    *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -511,16 +559,24 @@ func (m *module) ListNodes(ctx context.Context, orgID valuer.UUID, req *inframon
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering by readiness, nodeConditionCounts already holds the full-scope
+	// map (a superset of the page); otherwise compute it page-scoped here.
+	if len(filterByNodeReadiness) == 0 {
+		g.Go(func() error {
+			var err error
+			nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, nodeFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
+	// When filtering by pod status, podStatusCounts already holds the full-scope
+	// map; otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, nodeFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}

 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -571,11 +627,36 @@ func (m *module) ListNamespaces(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}

-	pageGroups, metadataMap, err := m.getTopNamespaceGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		namespaceFilter   *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+		resourceCounts    map[string]map[string]int64
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		namespaceFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopNamespaceGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopNamespaceGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}

+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.NamespaceRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)

 	if len(pageGroups) == 0 {
@@ -583,20 +664,8 @@ func (m *module) ListNamespaces(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}

-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newNamespacesTableListQuery())

-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-		resourceCounts   map[string]map[string]int64
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -606,14 +675,18 @@ func (m *module) ListNamespaces(ctx context.Context, orgID valuer.UUID, req *inf
 	})
 	g.Go(func() error {
 		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups, namespaceCountAttrKeys, namespacesMetricNamesListForCounts)
+		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, namespaceFilter, req.GroupBy, pageGroups, namespaceCountAttrKeys, namespacesMetricNamesListForCounts)
 		return err
 	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, namespaceFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}

 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -663,11 +736,39 @@ func (m *module) ListClusters(ctx context.Context, orgID valuer.UUID, req *infra
 		return resp, nil
 	}

-	pageGroups, metadataMap, err := m.getTopClusterGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr             string
+		clusterFilter          *qbtypes.Filter
+		filterByPodStatus      []inframonitoringtypes.PodStatus
+		filterByNodeReadiness  []inframonitoringtypes.NodeCondition
+		queryResp              *qbtypes.QueryRangeResponse
+		nodeConditionCountsMap map[string]nodeConditionCounts
+		resourceCounts         map[string]map[string]int64
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		clusterFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
+	}
+
+	// getTopClusterGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status / node readiness when filtering) concurrently, intersecting
+	// metadata/ranked groups against the keysets. It returns the keysets + warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, nodeConditionCountsMap, err := m.getTopClusterGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}

+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.ClusterRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)

 	if len(pageGroups) == 0 {
@@ -675,23 +776,8 @@ func (m *module) ListClusters(ctx context.Context, orgID valuer.UUID, req *infra
 		return resp, nil
 	}

-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newClustersTableListQuery())

-	// With default groupBy [k8s.cluster.name], counts are bucketed per cluster;
-	// with a custom groupBy, they aggregate across clusters in that group.
-	var (
-		queryResp              *qbtypes.QueryRangeResponse
-		nodeConditionCountsMap map[string]nodeConditionCounts
-		podStatusCounts        map[string]podStatusCounts
-		podStatusWarning       *qbtypes.QueryWarnData
-		resourceCounts         map[string]map[string]int64
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -699,21 +785,29 @@ func (m *module) ListClusters(ctx context.Context, orgID valuer.UUID, req *infra
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
+	// When filtering by readiness, nodeConditionCountsMap already holds the
+	// full-scope map (a superset of the page); otherwise compute it page-scoped here.
+	if len(filterByNodeReadiness) == 0 {
+		g.Go(func() error {
+			var err error
+			nodeConditionCountsMap, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, clusterFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 	g.Go(func() error {
 		var err error
-		nodeConditionCountsMap, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups, clusterCountAttrKeys, clusterMetricNamesListForCounts)
+		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, clusterFilter, req.GroupBy, pageGroups, clusterCountAttrKeys, clusterMetricNamesListForCounts)
 		return err
 	})
+	// When filtering by pod status, podStatusCounts already holds the full-scope
+	// map; otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, clusterFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}

 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -827,7 +921,7 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in

 	// Bake the deployments base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &qbtypes.Filter{}
+		req.Filter = &inframonitoringtypes.DeploymentFilter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(deploymentsBaseFilterExpr, req.Filter.Expression)

@@ -842,11 +936,35 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 		return resp, nil
 	}

-	pageGroups, metadataMap, err := m.getTopDeploymentGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		deploymentFilter  *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		deploymentFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopDeploymentGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopDeploymentGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}

+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.DeploymentRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)

 	if len(pageGroups) == 0 {
@@ -854,19 +972,8 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 		return resp, nil
 	}

-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newDeploymentsTableListQuery())

-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -874,11 +981,15 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, deploymentFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}

 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -919,7 +1030,7 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i

 	// Bake the workload base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &qbtypes.Filter{}
+		req.Filter = &inframonitoringtypes.StatefulSetFilter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(statefulSetsBaseFilterExpr, req.Filter.Expression)

@@ -934,11 +1045,35 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 		return resp, nil
 	}

-	pageGroups, metadataMap, err := m.getTopStatefulSetGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		statefulSetFilter *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		statefulSetFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopStatefulSetGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopStatefulSetGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}

+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.StatefulSetRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)

 	if len(pageGroups) == 0 {
@@ -946,21 +1081,8 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 		return resp, nil
 	}

-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newStatefulSetsTableListQuery())

-	// Pods owned by a StatefulSet carry k8s.statefulset.name as a resource attribute,
-	// so default-groupBy gives per-statefulset status counts automatically.
-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -968,11 +1090,15 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, statefulSetFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}

 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -1013,7 +1139,7 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni

 	// Bake the jobs base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &qbtypes.Filter{}
+		req.Filter = &inframonitoringtypes.JobFilter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(jobsBaseFilterExpr, req.Filter.Expression)

@@ -1028,11 +1154,35 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}

-	pageGroups, metadataMap, err := m.getTopJobGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		jobFilter         *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		jobFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopJobGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopJobGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}

+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.JobRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)

 	if len(pageGroups) == 0 {
@@ -1040,21 +1190,8 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}

-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newJobsTableListQuery())

-	// Pods owned by a Job carry k8s.job.name as a resource attribute, so default-groupBy
-	// gives per-job status counts automatically.
-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -1062,11 +1199,15 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, jobFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}

 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -1107,7 +1248,7 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf

 	// Bake the workload base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &qbtypes.Filter{}
+		req.Filter = &inframonitoringtypes.DaemonSetFilter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(daemonSetsBaseFilterExpr, req.Filter.Expression)

@@ -1122,11 +1263,35 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}

-	pageGroups, metadataMap, err := m.getTopDaemonSetGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		daemonSetFilter   *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		daemonSetFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopDaemonSetGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopDaemonSetGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}

+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.DaemonSetRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)

 	if len(pageGroups) == 0 {
@@ -1134,21 +1299,8 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}

-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newDaemonSetsTableListQuery())

-	// Pods owned by a DaemonSet carry k8s.daemonset.name as a resource attribute,
-	// so default-groupBy gives per-daemonset status counts automatically.
-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -1156,11 +1308,15 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, daemonSetFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}

 	if err := g.Wait(); err != nil {
 		return nil, err
--- a/pkg/modules/inframonitoring/implinframonitoring/namespaces.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/namespaces.go
@@ -65,20 +65,34 @@ func buildNamespaceRecords(
 	return records
 }

+// getTopNamespaceGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopNamespaceGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableNamespaces,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {

 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)

 	orderByKey = req.OrderBy.Key.Name

+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -87,12 +101,26 @@ func (m *module) getTopNamespaceGroupsAndMetadata(
 		return err
 	})

+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.NamespaceNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.NamespaceNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}

 	queryNamesForOrderBy := orderByToNamespacesQueryNames[orderByKey]
@@ -138,10 +166,19 @@ func (m *module) getTopNamespaceGroupsAndMetadata(
 	})

 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}

-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }

 func (m *module) getNamespacesTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableNamespaces) (map[string]map[string]string, error) {
@@ -151,5 +188,9 @@ func (m *module) getNamespacesTableMetadata(ctx context.Context, orgID valuer.UU
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, namespacesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, namespacesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }
--- a/pkg/modules/inframonitoring/implinframonitoring/nodes.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/nodes.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"slices"
-	"strings"

 	"github.com/SigNoz/signoz/pkg/querybuilder"
 	"github.com/SigNoz/signoz/pkg/telemetryschema/metricstelemetryschema"
@@ -92,20 +91,38 @@ func buildNodeRecords(
 	return records
 }

+// getTopNodeGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status / node-readiness keysets when filtering,
+// to intersect all).
 func (m *module) getTopNodeGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableNodes,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, map[string]nodeConditionCounts, error) {

 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey            string
+		metadataMap           map[string]map[string]string
+		allMetricGroups       []rankedGroup
+		statusCounts          map[string]podStatusCounts
+		statusWarning         *qbtypes.QueryWarnData
+		nodeConditionCounts   map[string]nodeConditionCounts
+		filter                *qbtypes.Filter
+		filterByPodStatus     []inframonitoringtypes.PodStatus
+		filterByNodeReadiness []inframonitoringtypes.NodeCondition
 	)

 	orderByKey = req.OrderBy.Key.Name

+	// When filtering by pod status / node readiness, resolve the full-scope
+	// keyset(s) concurrently (pageGroups=nil spans all groups under the user
+	// filter) to intersect metadata + ranked groups below. Filters compose as AND.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -114,12 +131,37 @@ func (m *module) getTopNodeGroupsAndMetadata(
 		return err
 	})

+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
+	if len(filterByNodeReadiness) != 0 {
+		g.Go(func() error {
+			var err error
+			nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByNodeReadiness)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.NodeNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status/readiness-matching groups. A missing
+		// metric yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning). Filters compose as AND.
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
+		}
+		if len(filterByNodeReadiness) != 0 {
+			metadataMap = intersectMap(metadataMap, nodeConditionCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.NodeNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
 	}

 	queryNamesForOrderBy := orderByToNodesQueryNames[orderByKey]
@@ -165,10 +207,23 @@ func (m *module) getTopNodeGroupsAndMetadata(
 	})

 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, nil, err
 	}

-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status/readiness
+	// keyset. A missing metric yields an empty keyset, correctly emptying the result
+	// (the caller also surfaces the warning). Filters compose as AND.
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+	if len(filterByNodeReadiness) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, nodeConditionCounts)
+		metadataMap = intersectMap(metadataMap, nodeConditionCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
 }

 func (m *module) getNodesTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableNodes) (map[string]map[string]string, error) {
@@ -178,7 +233,11 @@ func (m *module) getNodesTableMetadata(ctx context.Context, orgID valuer.UUID, r
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, nodesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, nodesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }

 // getPerGroupNodeConditionCounts computes per-group node counts bucketed by each
@@ -192,6 +251,24 @@ func (m *module) getNodesTableMetadata(ctx context.Context, orgID valuer.UUID, r
 //	countNodesPerCondition:  per-group uniqExactIf into ready/not_ready buckets.
 //
 // Groups absent from the result map have implicit zero counts (caller default).
+// applyNodeReadinessFilter adds the readiness push-down (condition_value IN (...))
+// to the outer count builder. condition_value is numeric (1=Ready, 0=NotReady), so
+// we map each requested enum to its int. No-op when the requested set is empty.
+func applyNodeReadinessFilter(cb *sqlbuilder.SelectBuilder, filterByNodeReadiness []inframonitoringtypes.NodeCondition) {
+	if len(filterByNodeReadiness) == 0 {
+		return
+	}
+	nums := make([]int, len(filterByNodeReadiness))
+	for i, c := range filterByNodeReadiness {
+		v := inframonitoringtypes.NodeConditionNumNotReady
+		if c == inframonitoringtypes.NodeConditionReady {
+			v = inframonitoringtypes.NodeConditionNumReady
+		}
+		nums[i] = v
+	}
+	cb.Where(cb.In("condition_value", sqlbuilder.List(nums)))
+}
+
 func (m *module) getPerGroupNodeConditionCounts(
 	ctx context.Context,
 	orgID valuer.UUID,
@@ -199,8 +276,11 @@ func (m *module) getPerGroupNodeConditionCounts(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByNodeReadiness []inframonitoringtypes.NodeCondition,
 ) (map[string]nodeConditionCounts, error) {
-	if len(pageGroups) == 0 || len(groupBy) == 0 {
+	// Empty pageGroups means "span all under user filter", allowed only in
+	// full-scope mode (filtering by readiness). Otherwise it's an empty page.
+	if len(groupBy) == 0 || (len(pageGroups) == 0 && len(filterByNodeReadiness) == 0) {
 		return map[string]nodeConditionCounts{}, nil
 	}

@@ -288,11 +368,14 @@ func (m *module) getPerGroupNodeConditionCounts(
 		fmt.Sprintf("uniqExactIf(node_name, condition_value = %d) AS ready_count", inframonitoringtypes.NodeConditionNumReady),
 		fmt.Sprintf("uniqExactIf(node_name, condition_value = %d) AS not_ready_count", inframonitoringtypes.NodeConditionNumNotReady),
 	)
-	countNodesPerConditionSQL := fmt.Sprintf(
-		"SELECT %s FROM latest_condition_per_node GROUP BY %s",
-		strings.Join(countNodesPerConditionSelectCols, ", "),
-		strings.Join(countNodesPerConditionGroupBy, ", "),
-	)
+	// Outer count query. Built with sqlbuilder so the readiness push-down uses a
+	// proper IN (keep only nodes whose readiness is in the requested set).
+	countBuilder := sqlbuilder.NewSelectBuilder()
+	countBuilder.Select(countNodesPerConditionSelectCols...)
+	countBuilder.From("latest_condition_per_node")
+	applyNodeReadinessFilter(countBuilder, filterByNodeReadiness)
+	countBuilder.GroupBy(countNodesPerConditionGroupBy...)
+	countNodesPerConditionSQL, countArgs := countBuilder.BuildWithFlavor(sqlbuilder.ClickHouse)

 	// Combine CTEs + outer.
 	cteFragments := []string{
@@ -300,7 +383,7 @@ func (m *module) getPerGroupNodeConditionCounts(
 		fmt.Sprintf("latest_condition_per_node AS (%s)", latestConditionPerNodeSQL),
 	}
 	finalSQL := querybuilder.CombineCTEs(cteFragments) + countNodesPerConditionSQL
-	finalArgs := querybuilder.PrependArgs([][]any{timeSeriesFPsArgs, latestConditionPerNodeArgs}, nil)
+	finalArgs := querybuilder.PrependArgs([][]any{timeSeriesFPsArgs, latestConditionPerNodeArgs}, countArgs)

 	rows, err := m.telemetryStore.ClickhouseDB().Query(ctx, finalSQL, finalArgs...)
 	if err != nil {
--- a/pkg/modules/inframonitoring/implinframonitoring/nodes_test.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/nodes_test.go
@@ -0,0 +1,65 @@
+package implinframonitoring
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/inframonitoringtypes"
+	"github.com/huandu/go-sqlbuilder"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestApplyNodeReadinessFilter(t *testing.T) {
+	tests := []struct {
+		name      string
+		readiness []inframonitoringtypes.NodeCondition
+		wantWhere bool
+		wantArgs  []any
+	}{
+		{
+			name:      "empty set yields no clause",
+			readiness: nil,
+			wantWhere: false,
+			wantArgs:  nil,
+		},
+		{
+			name:      "ready maps to 1 via IN",
+			readiness: []inframonitoringtypes.NodeCondition{inframonitoringtypes.NodeConditionReady},
+			wantWhere: true,
+			wantArgs:  []any{inframonitoringtypes.NodeConditionNumReady},
+		},
+		{
+			name:      "not_ready maps to 0 via IN",
+			readiness: []inframonitoringtypes.NodeCondition{inframonitoringtypes.NodeConditionNotReady},
+			wantWhere: true,
+			wantArgs:  []any{inframonitoringtypes.NodeConditionNumNotReady},
+		},
+		{
+			name: "multiple conditions map to their ints via IN",
+			readiness: []inframonitoringtypes.NodeCondition{
+				inframonitoringtypes.NodeConditionReady,
+				inframonitoringtypes.NodeConditionNotReady,
+			},
+			wantWhere: true,
+			wantArgs:  []any{inframonitoringtypes.NodeConditionNumReady, inframonitoringtypes.NodeConditionNumNotReady},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cb := sqlbuilder.NewSelectBuilder()
+			cb.Select("node_name")
+			cb.From("latest_condition_per_node")
+			applyNodeReadinessFilter(cb, tt.readiness)
+			sql, args := cb.BuildWithFlavor(sqlbuilder.ClickHouse)
+
+			hasWhere := strings.Contains(sql, "condition_value IN (")
+			assert.Equal(t, tt.wantWhere, hasWhere)
+			if len(tt.wantArgs) == 0 {
+				assert.Empty(t, args)
+			} else {
+				assert.Equal(t, tt.wantArgs, args)
+			}
+		})
+	}
+}
--- a/pkg/modules/inframonitoring/implinframonitoring/pods.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/pods.go
@@ -146,24 +146,34 @@ func buildPodRecords(
 	return records
 }

-// getTopPodGroupsAndMetadata fetches the group metadata and the ordering-metric
-// ranking concurrently, then pages the ranked groups, backfilling from metadata
-// when the page extends past the metric-ranked groups. Returns the page of
-// groups and the metadata map (needed by the caller for Total and records).
+// getTopPodGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopPodGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostablePods,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {

 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)

 	orderByKey = req.OrderBy.Key.Name

+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -172,12 +182,26 @@ func (m *module) getTopPodGroupsAndMetadata(
 		return err
 	})

+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.PodNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.PodNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}

 	queryNamesForOrderBy := orderByToPodsQueryNames[orderByKey]
@@ -223,10 +247,19 @@ func (m *module) getTopPodGroupsAndMetadata(
 	})

 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}

-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }

 func (m *module) getPodsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostablePods) (map[string]map[string]string, error) {
@@ -236,7 +269,11 @@ func (m *module) getPodsTableMetadata(ctx context.Context, orgID valuer.UUID, re
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, podsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, podsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }

 // getPerGroupPodStatusCountsWithReqMetricChecks gates getPerGroupPodStatusCounts
@@ -251,6 +288,7 @@ func (m *module) getPerGroupPodStatusCountsWithReqMetricChecks(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByPodStatus []inframonitoringtypes.PodStatus,
 ) (map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
 	present, err := m.getMetricsExistence(ctx, podStatusMetricNamesList)
 	if err != nil {
@@ -276,13 +314,28 @@ func (m *module) getPerGroupPodStatusCountsWithReqMetricChecks(
 		return map[string]podStatusCounts{}, warning, nil
 	}

-	counts, err := m.getPerGroupPodStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups)
+	counts, err := m.getPerGroupPodStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups, filterByPodStatus)
 	if err != nil {
 		return nil, nil, err
 	}
 	return counts, nil, nil
 }

+// applyPodStatusFilter adds the display-status push-down (lower(display_status)
+// IN (...)) to the outer count builder. valuer lowercases the wire value while
+// display_status is kubectl-cased, so we compare lower() on both. No-op when the
+// requested set is empty.
+func applyPodStatusFilter(cb *sqlbuilder.SelectBuilder, filterByPodStatus []inframonitoringtypes.PodStatus) {
+	if len(filterByPodStatus) == 0 {
+		return
+	}
+	vals := make([]string, len(filterByPodStatus))
+	for i, s := range filterByPodStatus {
+		vals[i] = s.StringValue()
+	}
+	cb.Where(cb.In("lower(display_status)", sqlbuilder.List(vals)))
+}
+
 // getPerGroupPodStatusCounts computes per-group pod counts bucketed by each
 // pod's latest kubectl-style display status in the requested window. Caller
 // must ensure the required metrics exist (getPerGroupPodStatusCountsWithReqMetricChecks).
@@ -303,13 +356,20 @@ func (m *module) getPerGroupPodStatusCounts(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByPodStatus []inframonitoringtypes.PodStatus,
 ) (map[string]podStatusCounts, error) {
-	if len(pageGroups) == 0 || len(groupBy) == 0 {
+	// return early if no group by or (no pagegroups provided plus no filterBystatus given for a full scan)
+	if len(groupBy) == 0 || (len(pageGroups) == 0 && len(filterByPodStatus) == 0) {
 		return map[string]podStatusCounts{}, nil
 	}

+	var (
+		filterClause   *sqlbuilder.WhereClause
+		err            error
+		userFilterExpr string
+	)
+
 	// Merge user filter with page-groups IN clauses.
-	userFilterExpr := ""
 	if filter != nil {
 		userFilterExpr = filter.Expression
 	}
@@ -322,10 +382,7 @@ func (m *module) getPerGroupPodStatusCounts(
 	// CTEs, and buildFilterClause hits the metadata store + parses the
 	// expression, so we don't want to repeat it per CTE. AddWhereClause only
 	// reads the clause, so the same instance is safe to attach to each builder.
-	var (
-		filterClause *sqlbuilder.WhereClause
-		err          error
-	)
+
 	if mergedFilterExpr != "" {
 		filterClause, err = m.buildFilterClause(ctx, orgID, &qbtypes.Filter{Expression: mergedFilterExpr}, start, end)
 		if err != nil {
@@ -540,11 +597,15 @@ func (m *module) getPerGroupPodStatusCounts(
 		countGroupBy = append(countGroupBy, col)
 	}
 	countSelectCols = append(countSelectCols, statusCountCols...)
-	countSQL := fmt.Sprintf(
-		"SELECT %s FROM pod_status GROUP BY %s",
-		strings.Join(countSelectCols, ", "),
-		strings.Join(countGroupBy, ", "),
-	)
+
+	// Outer count query. Built with sqlbuilder so the status push-down uses a
+	// proper IN (keep only pods whose display status is in the requested set).
+	countBuilder := sqlbuilder.NewSelectBuilder()
+	countBuilder.Select(countSelectCols...)
+	countBuilder.From("pod_status")
+	applyPodStatusFilter(countBuilder, filterByPodStatus)
+	countBuilder.GroupBy(countGroupBy...)
+	countSQL, countArgs := countBuilder.BuildWithFlavor(sqlbuilder.ClickHouse)

 	// Combine CTEs + outer. Arg order mirrors CTE declaration order.
 	cteFragments := []string{
@@ -561,7 +622,7 @@ func (m *module) getPerGroupPodStatusCounts(
 		phaseFpsArgs, phasePerPodArgs,
 		podReasonFpsArgs, podReasonPerPodArgs,
 		containerReasonFpsArgs, containerInnerArgs,
-	}, nil)
+	}, countArgs)

 	rows, err := m.telemetryStore.ClickhouseDB().Query(ctx, finalSQL, finalArgs...)
 	if err != nil {
--- a/pkg/modules/inframonitoring/implinframonitoring/pods_test.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/pods_test.go
@@ -0,0 +1,59 @@
+package implinframonitoring
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/inframonitoringtypes"
+	"github.com/huandu/go-sqlbuilder"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestApplyPodStatusFilter(t *testing.T) {
+	tests := []struct {
+		name      string
+		statuses  []inframonitoringtypes.PodStatus
+		wantWhere bool
+		wantArgs  []any
+	}{
+		{
+			name:      "empty set yields no clause",
+			statuses:  nil,
+			wantWhere: false,
+			wantArgs:  nil,
+		},
+		{
+			name:      "single status pushes lowercased arg via IN",
+			statuses:  []inframonitoringtypes.PodStatus{inframonitoringtypes.PodStatusRunning},
+			wantWhere: true,
+			wantArgs:  []any{"running"},
+		},
+		{
+			name: "multiple statuses push lowercased args via IN",
+			statuses: []inframonitoringtypes.PodStatus{
+				inframonitoringtypes.PodStatusRunning,
+				inframonitoringtypes.PodStatusCrashLoopBackOff,
+			},
+			wantWhere: true,
+			wantArgs:  []any{"running", "crashloopbackoff"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cb := sqlbuilder.NewSelectBuilder()
+			cb.Select("pod_uid")
+			cb.From("pod_status")
+			applyPodStatusFilter(cb, tt.statuses)
+			sql, args := cb.BuildWithFlavor(sqlbuilder.ClickHouse)
+
+			hasWhere := strings.Contains(sql, "lower(display_status) IN (")
+			assert.Equal(t, tt.wantWhere, hasWhere)
+			if len(tt.wantArgs) == 0 {
+				assert.Empty(t, args)
+			} else {
+				assert.Equal(t, tt.wantArgs, args)
+			}
+		})
+	}
+}
--- a/pkg/modules/inframonitoring/implinframonitoring/statefulsets.go
+++ b/pkg/modules/inframonitoring/implinframonitoring/statefulsets.go
@@ -82,20 +82,34 @@ func buildStatefulSetRecords(
 	return records
 }

+// getTopStatefulSetGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopStatefulSetGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableStatefulSets,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {

 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)

 	orderByKey = req.OrderBy.Key.Name

+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)

 	g.Go(func() error {
@@ -104,12 +118,26 @@ func (m *module) getTopStatefulSetGroupsAndMetadata(
 		return err
 	})

+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.StatefulSetNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.StatefulSetNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}

 	queryNamesForOrderBy := orderByToStatefulSetsQueryNames[orderByKey]
@@ -155,10 +183,19 @@ func (m *module) getTopStatefulSetGroupsAndMetadata(
 	})

 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}

-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }

 func (m *module) getStatefulSetsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableStatefulSets) (map[string]map[string]string, error) {
@@ -168,5 +205,9 @@ func (m *module) getStatefulSetsTableMetadata(ctx context.Context, orgID valuer.
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, statefulSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, statefulSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }
--- a/pkg/modules/user/impluser/handler.go
+++ b/pkg/modules/user/impluser/handler.go
@@ -88,58 +88,6 @@ func (handler *handler) CreateInvite(rw http.ResponseWriter, r *http.Request) {
 	render.Success(rw, http.StatusCreated, invites[0])
 }

-func (handler *handler) CreateBulkInvite(rw http.ResponseWriter, r *http.Request) {
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	var req types.PostableBulkInviteRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	// Validate that the request contains users
-	if len(req.Invites) == 0 {
-		render.Error(rw, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "no invites provided for invitation"))
-		return
-	}
-
-	_, err = handler.setter.CreateBulkInvite(ctx, valuer.MustNewUUID(claims.OrgID), valuer.MustNewUUID(claims.IdentityID()), valuer.MustNewEmail(claims.Email), &req)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusCreated, nil)
-}
-
-func (handler *handler) GetUserDeprecated(w http.ResponseWriter, r *http.Request) {
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	id := mux.Vars(r)["id"]
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	user, err := handler.getter.GetDeprecatedUserByOrgIDAndID(ctx, valuer.MustNewUUID(claims.OrgID), valuer.MustNewUUID(id))
-	if err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	render.Success(w, http.StatusOK, user)
-}
-
 func (handler *handler) GetUser(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
@@ -284,33 +232,6 @@ func (handler *handler) ListUsers(w http.ResponseWriter, r *http.Request) {
 	render.Success(w, http.StatusOK, users)
 }

-func (handler *handler) UpdateUserDeprecated(w http.ResponseWriter, r *http.Request) {
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	id := mux.Vars(r)["id"]
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	user := types.DeprecatedUser{User: &types.User{}}
-	if err := json.NewDecoder(r.Body).Decode(&user); err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	updatedUser, err := handler.setter.UpdateUserDeprecated(ctx, valuer.MustNewUUID(claims.OrgID), id, &user)
-	if err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	render.Success(w, http.StatusOK, updatedUser)
-}
-
 func (handler *handler) UpdateUser(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
@@ -470,7 +391,7 @@ func (handler *handler) ResetPassword(w http.ResponseWriter, r *http.Request) {
 	defer cancel()

 	req := new(types.PostableResetPassword)
-	if err := json.NewDecoder(r.Body).Decode(req); err != nil {
+	if err := binding.JSON.BindBody(r.Body, req); err != nil {
 		render.Error(w, err)
 		return
 	}
--- a/pkg/modules/user/impluser/setter.go
+++ b/pkg/modules/user/impluser/setter.go
@@ -276,92 +276,6 @@ func (module *setter) CreatePendingInviteUser(ctx context.Context, identityID va
 	return user, nil
 }

-func (module *setter) UpdateUserDeprecated(ctx context.Context, orgID valuer.UUID, id string, user *types.DeprecatedUser) (*types.DeprecatedUser, error) {
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	existingUser, err := module.getter.GetDeprecatedUserByOrgIDAndID(ctx, orgID, valuer.MustNewUUID(id))
-	if err != nil {
-		return nil, err
-	}
-
-	if err := existingUser.ErrIfRoot(); err != nil {
-		return nil, errors.WithAdditionalf(err, "cannot update root user")
-	}
-
-	if err := existingUser.ErrIfDeleted(); err != nil {
-		return nil, errors.WithAdditionalf(err, "cannot update deleted user")
-	}
-
-	roleChange := user.Role != "" && user.Role != existingUser.Role
-
-	if roleChange {
-		selectors := []coretypes.Selector{
-			coretypes.TypeRole.MustSelector(authtypes.SigNozAdminRoleName),
-		}
-		err = module.authz.CheckWithTupleCreation(
-			ctx,
-			claims,
-			valuer.MustNewUUID(claims.OrgID),
-			authtypes.Relation{Verb: coretypes.VerbAssignee},
-			coretypes.NewResourceRole(),
-			selectors,
-			selectors,
-		)
-
-		if err != nil {
-			return nil, errors.New(errors.TypeForbidden, errors.CodeForbidden, "only admins can change roles")
-		}
-	}
-
-	// make sure the user is not demoting self from admin
-	if roleChange && existingUser.ID == valuer.MustNewUUID(claims.IdentityID()) && existingUser.Role == types.RoleAdmin && user.Role != types.RoleAdmin {
-		return nil, errors.New(errors.TypeForbidden, errors.CodeForbidden, "cannot change self role")
-	}
-
-	if roleChange {
-		err = module.authz.ModifyGrant(ctx,
-			orgID,
-			[]string{authtypes.MustGetSigNozManagedRoleFromExistingRole(existingUser.Role)},
-			[]string{authtypes.MustGetSigNozManagedRoleFromExistingRole(user.Role)},
-			authtypes.MustNewSubject(coretypes.NewResourceUser(), id, orgID, nil),
-		)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	existingUser.Update(user.DisplayName, user.Role)
-
-	// update the user - idempotent (this does analytics too so keeping it outside txn)
-	if err := module.UpdateAnyUserDeprecated(ctx, orgID, existingUser); err != nil {
-		return nil, err
-	}
-
-	err = module.store.RunInTx(ctx, func(ctx context.Context) error {
-		if roleChange {
-			// delete old role entries and create new ones
-			if err := module.userRoleStore.DeleteUserRoles(ctx, existingUser.ID); err != nil {
-				return err
-			}
-
-			// create new ones
-			if err := module.createUserRoleEntries(ctx, existingUser.OrgID, existingUser.ID, []string{authtypes.MustGetSigNozManagedRoleFromExistingRole(user.Role)}); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return existingUser, nil
-}
-
 func (module *setter) UpdateUser(ctx context.Context, orgID valuer.UUID, userID valuer.UUID, updatable *types.UpdatableUser) (*types.User, error) {
 	existingUser, err := module.getter.GetUserByOrgIDAndID(ctx, orgID, userID)
 	if err != nil {
@@ -401,23 +315,6 @@ func (module *setter) UpdateAnyUser(ctx context.Context, orgID valuer.UUID, user
 	return nil
 }

-func (module *setter) UpdateAnyUserDeprecated(ctx context.Context, orgID valuer.UUID, deprecateUser *types.DeprecatedUser) error {
-	user := types.NewUserFromDeprecatedUser(deprecateUser)
-	if err := module.store.UpdateUser(ctx, orgID, user); err != nil {
-		return err
-	}
-
-	traits := types.NewTraitsFromDeprecatedUser(deprecateUser)
-	module.analytics.IdentifyUser(ctx, user.OrgID.String(), user.ID.String(), traits)
-	module.analytics.TrackUser(ctx, user.OrgID.String(), user.ID.String(), "User Updated", traits)
-
-	if err := module.tokenizer.DeleteIdentity(ctx, user.ID); err != nil {
-		return err
-	}
-
-	return nil
-}
-
 func (module *setter) DeleteUser(ctx context.Context, orgID valuer.UUID, id string, deletedBy string) error {
 	user, err := module.store.GetUser(ctx, valuer.MustNewUUID(id))
 	if err != nil {
--- a/pkg/modules/user/user.go
+++ b/pkg/modules/user/user.go
@@ -34,11 +34,9 @@ type Setter interface {
 	// Initiate forgot password flow for a user
 	ForgotPassword(ctx context.Context, orgID valuer.UUID, email valuer.Email, frontendBaseURL string) error

-	UpdateUserDeprecated(ctx context.Context, orgID valuer.UUID, id string, user *types.DeprecatedUser) (*types.DeprecatedUser, error)
 	UpdateUser(ctx context.Context, orgID valuer.UUID, userID valuer.UUID, updatable *types.UpdatableUser) (*types.User, error)

 	// UpdateAnyUser updates a user and persists the changes to the database along with the analytics and identity deletion.
-	UpdateAnyUserDeprecated(ctx context.Context, orgID valuer.UUID, deprecateUser *types.DeprecatedUser) error
 	UpdateAnyUser(ctx context.Context, orgID valuer.UUID, user *types.User) error
 	DeleteUser(ctx context.Context, orgID valuer.UUID, id string, deletedBy string) error

@@ -109,16 +107,13 @@ type Getter interface {
 type Handler interface {
 	// invite
 	CreateInvite(http.ResponseWriter, *http.Request)
-	CreateBulkInvite(http.ResponseWriter, *http.Request)

 	// users
 	ListUsersDeprecated(http.ResponseWriter, *http.Request)
 	ListUsers(http.ResponseWriter, *http.Request)
 	CreateUser(http.ResponseWriter, *http.Request)
-	UpdateUserDeprecated(http.ResponseWriter, *http.Request)
 	UpdateUser(http.ResponseWriter, *http.Request)
 	DeleteUser(http.ResponseWriter, *http.Request)
-	GetUserDeprecated(http.ResponseWriter, *http.Request)
 	GetUser(http.ResponseWriter, *http.Request)
 	GetMyUserDeprecated(http.ResponseWriter, *http.Request)
 	GetMyUser(http.ResponseWriter, *http.Request)
--- a/pkg/sqlmigration/109_restructure_saved_view_spec.go
+++ b/pkg/sqlmigration/109_restructure_saved_view_spec.go
@@ -15,6 +15,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/sqlschema"
 	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types"
 )

 type restructureSavedViewSpec struct {
@@ -164,6 +165,15 @@ func (migration *restructureSavedViewSpec) Up(ctx context.Context, db *bun.DB) e
 		return err
 	}

+	var orgIDs []string
+	if err := tx.NewSelect().Model((*types.Organization)(nil)).Column("id").Scan(ctx, &orgIDs); err != nil {
+		return err
+	}
+	validOrgIDs := make(map[string]struct{}, len(orgIDs))
+	for _, id := range orgIDs {
+		validOrgIDs[id] = struct{}{}
+	}
+
 	// drop table `saved_views`
 	for _, sql := range migration.sqlschema.Operator().DropTable(savedViewsTable) {
 		if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
@@ -210,6 +220,13 @@ func (migration *restructureSavedViewSpec) Up(ctx context.Context, db *bun.DB) e
 			continue // orphaned row from a pre-existing org_id backfill gap; nothing sane to attach it to
 		}

+		// to avoid foreign key constraint issues
+		if _, ok := validOrgIDs[old.OrgID]; !ok {
+			skipped++
+			migration.settings.Logger.WarnContext(ctx, "saved view references an org that no longer exists, skipping", slog.String("org_id", old.OrgID), slog.String("saved_view_id", old.ID))
+			continue
+		}
+
 		var compositeQuery legacySavedViewCompositeQuery
 		if err := json.Unmarshal([]byte(old.Data), &compositeQuery); err != nil {
 			failed++
--- a/pkg/types/authtypes/claims.go
+++ b/pkg/types/authtypes/claims.go
@@ -72,14 +72,6 @@ func (c *Claims) LogValue() slog.Value {
 	)
 }

-func (c *Claims) IsSelfAccess(id string) error {
-	if c.UserID == id {
-		return nil
-	}
-
-	return errors.NewForbiddenf(errors.CodeForbidden, "only the user/admin can access their own resource")
-}
-
 func (c *Claims) IdentityID() string {
 	if c.Principal == PrincipalUser {
 		return c.UserID
--- a/pkg/types/inframonitoringtypes/clusters.go
+++ b/pkg/types/inframonitoringtypes/clusters.go
@@ -42,13 +42,22 @@ type ClusterRecord struct {
 type PostableClusters struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *ClusterFilter       `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }

+// ClusterFilter is the attribute filter plus optional secondary filters on the
+// derived pod display status(es) (see PodStatus; matches any listed, OR) and node
+// readiness (see NodeCondition; matches any listed, OR). Empty FilterByPodStatus / FilterByNodeReadiness = off.
+type ClusterFilter struct {
+	qbtypes.Filter        `json:",inline"`
+	FilterByPodStatus     []PodStatus     `json:"filterByPodStatus"`
+	FilterByNodeReadiness []NodeCondition `json:"filterByNodeReadiness"`
+}
+
 // Validate ensures PostableClusters contains acceptable values.
 func (req *PostableClusters) Validate() error {
 	if req == nil {
@@ -88,6 +97,19 @@ func (req *PostableClusters) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}

+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+		for _, c := range req.Filter.FilterByNodeReadiness {
+			if !c.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by node readiness: %s", c)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(ClustersValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)
--- a/pkg/types/inframonitoringtypes/containers.go
+++ b/pkg/types/inframonitoringtypes/containers.go
@@ -75,13 +75,21 @@ type ContainerRecord struct {
 type PostableContainers struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *ContainerFilter     `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }

+// ContainerFilter is the attribute filter plus an optional secondary filter on
+// the derived container display status(es) (see ContainerStatus; matches any
+// listed, OR). Empty FilterByContainerStatus = off.
+type ContainerFilter struct {
+	qbtypes.Filter          `json:",inline"`
+	FilterByContainerStatus []ContainerStatus `json:"filterByContainerStatus"`
+}
+
 // Validate ensures PostableContainers contains acceptable values.
 func (req *PostableContainers) Validate() error {
 	if req == nil {
@@ -121,6 +129,14 @@ func (req *PostableContainers) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}

+	if req.Filter != nil {
+		for _, c := range req.Filter.FilterByContainerStatus {
+			if !c.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by container status: %s", c)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(ContainersValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)
--- a/pkg/types/inframonitoringtypes/containers_constants.go
+++ b/pkg/types/inframonitoringtypes/containers_constants.go
@@ -1,6 +1,10 @@
 package inframonitoringtypes

-import "github.com/SigNoz/signoz/pkg/valuer"
+import (
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+)

 // ContainerStatus is the kubectl-style display status of a container, derived
 // from k8s.container.status.state (base) + k8s.container.status.reason (overlay).
@@ -31,6 +35,12 @@ var (
 	ContainerStatusNoData = ContainerStatus{valuer.NewString("no_data")}
 )

+// IsFilterable reports whether c is a concrete, user-filterable
+// container status: any Enum() member except the no_data sentinel.
+func (c ContainerStatus) IsFilterable() bool {
+	return c != ContainerStatusNoData && slices.Contains((ContainerStatus{}).Enum(), any(c))
+}
+
 func (ContainerStatus) Enum() []any {
 	return []any{
 		ContainerStatusRunning,
--- a/pkg/types/inframonitoringtypes/daemonsets.go
+++ b/pkg/types/inframonitoringtypes/daemonsets.go
@@ -36,13 +36,20 @@ type DaemonSetRecord struct {
 type PostableDaemonSets struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *DaemonSetFilter     `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }

+// DaemonSetFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type DaemonSetFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableDaemonSets contains acceptable values.
 func (req *PostableDaemonSets) Validate() error {
 	if req == nil {
@@ -82,6 +89,14 @@ func (req *PostableDaemonSets) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}

+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(DaemonSetsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)
--- a/pkg/types/inframonitoringtypes/deployments.go
+++ b/pkg/types/inframonitoringtypes/deployments.go
@@ -34,13 +34,20 @@ type DeploymentRecord struct {
 type PostableDeployments struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *DeploymentFilter    `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }

+// DeploymentFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type DeploymentFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableDeployments contains acceptable values.
 func (req *PostableDeployments) Validate() error {
 	if req == nil {
@@ -80,6 +87,14 @@ func (req *PostableDeployments) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}

+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(DeploymentsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)
--- a/pkg/types/inframonitoringtypes/jobs.go
+++ b/pkg/types/inframonitoringtypes/jobs.go
@@ -36,13 +36,20 @@ type JobRecord struct {
 type PostableJobs struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *JobFilter           `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }

+// JobFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type JobFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableJobs contains acceptable values.
 func (req *PostableJobs) Validate() error {
 	if req == nil {
@@ -82,6 +89,14 @@ func (req *PostableJobs) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}

+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(JobsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)
--- a/pkg/types/inframonitoringtypes/namespaces.go
+++ b/pkg/types/inframonitoringtypes/namespaces.go
@@ -34,13 +34,20 @@ type NamespaceRecord struct {
 type PostableNamespaces struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *NamespaceFilter     `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }

+// NamespaceFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type NamespaceFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableNamespaces contains acceptable values.
 func (req *PostableNamespaces) Validate() error {
 	if req == nil {
@@ -80,6 +87,14 @@ func (req *PostableNamespaces) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}

+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(NamespacesValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)
--- a/pkg/types/inframonitoringtypes/nodes.go
+++ b/pkg/types/inframonitoringtypes/nodes.go
@@ -39,13 +39,22 @@ type NodeRecord struct {
 type PostableNodes struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *NodeFilter          `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }

+// NodeFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus; matches any listed, OR) and node
+// readiness (see NodeCondition; matches any listed, OR). Empty FilterByPodStatus / FilterByNodeReadiness = off.
+type NodeFilter struct {
+	qbtypes.Filter        `json:",inline"`
+	FilterByPodStatus     []PodStatus     `json:"filterByPodStatus"`
+	FilterByNodeReadiness []NodeCondition `json:"filterByNodeReadiness"`
+}
+
 // Validate ensures PostableNodes contains acceptable values.
 func (req *PostableNodes) Validate() error {
 	if req == nil {
@@ -85,6 +94,19 @@ func (req *PostableNodes) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}

+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+		for _, c := range req.Filter.FilterByNodeReadiness {
+			if !c.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by node readiness: %s", c)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(NodesValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)
--- a/pkg/types/inframonitoringtypes/nodes_constants.go
+++ b/pkg/types/inframonitoringtypes/nodes_constants.go
@@ -1,6 +1,10 @@
 package inframonitoringtypes

-import "github.com/SigNoz/signoz/pkg/valuer"
+import (
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+)

 type NodeCondition struct {
 	valuer.String
@@ -20,6 +24,12 @@ func (NodeCondition) Enum() []any {
 	}
 }

+// IsFilterable reports whether c is a concrete, user-filterable
+// node readiness: any Enum() member except the no_data sentinel.
+func (c NodeCondition) IsFilterable() bool {
+	return c != NodeConditionNoData && slices.Contains((NodeCondition{}).Enum(), any(c))
+}
+
 // Numeric values emitted by the k8s.node.condition_ready metric
 // (source: OTel kubeletstats receiver).
 const (
--- a/pkg/types/inframonitoringtypes/pods.go
+++ b/pkg/types/inframonitoringtypes/pods.go
@@ -63,13 +63,20 @@ type PodRecord struct {
 type PostablePods struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *PodFilter           `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }

+// PodFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type PodFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostablePods contains acceptable values.
 func (req *PostablePods) Validate() error {
 	if req == nil {
@@ -109,6 +116,14 @@ func (req *PostablePods) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}

+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(PodsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)
--- a/pkg/types/inframonitoringtypes/pods_constants.go
+++ b/pkg/types/inframonitoringtypes/pods_constants.go
@@ -1,6 +1,10 @@
 package inframonitoringtypes

-import "github.com/SigNoz/signoz/pkg/valuer"
+import (
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+)

 // PodStatus is the kubectl-style pod display status, derived from
 // k8s.pod.phase + k8s.pod.status_reason + k8s.container.status.reason
@@ -66,6 +70,12 @@ func (PodStatus) Enum() []any {
 	}
 }

+// IsFilterable reports whether s is a concrete, user-filterable pod
+// status: any Enum() member except the no_data sentinel.
+func (s PodStatus) IsFilterable() bool {
+	return s != PodStatusNoData && slices.Contains((PodStatus{}).Enum(), any(s))
+}
+
 const PodNameAttrKey = "k8s.pod.name"

 const (
--- a/pkg/types/inframonitoringtypes/statefulsets.go
+++ b/pkg/types/inframonitoringtypes/statefulsets.go
@@ -34,13 +34,20 @@ type StatefulSetRecord struct {
 type PostableStatefulSets struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *StatefulSetFilter   `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }

+// StatefulSetFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type StatefulSetFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableStatefulSets contains acceptable values.
 func (req *PostableStatefulSets) Validate() error {
 	if req == nil {
@@ -80,6 +87,14 @@ func (req *PostableStatefulSets) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}

+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(StatefulSetsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)
--- a/pkg/types/user.go
+++ b/pkg/types/user.go
@@ -128,18 +128,6 @@ func NewDeprecatedUserFromUserAndRole(user *User, role Role) *DeprecatedUser {
 	}
 }

-func NewUserFromDeprecatedUser(deprecatedUser *DeprecatedUser) *User {
-	return &User{
-		Identifiable:  deprecatedUser.Identifiable,
-		DisplayName:   deprecatedUser.DisplayName,
-		Email:         deprecatedUser.Email,
-		OrgID:         deprecatedUser.OrgID,
-		IsRoot:        deprecatedUser.IsRoot,
-		Status:        deprecatedUser.Status,
-		TimeAuditable: deprecatedUser.TimeAuditable,
-	}
-}
-
 // Update applies mutable fields from the input to the user. Immutable fields
 // (email, is_root, org_id, id) are preserved. Only non-zero input fields are applied.
 func (u *User) Update(displayName string) {
@@ -149,16 +137,6 @@ func (u *User) Update(displayName string) {
 	u.UpdatedAt = time.Now()
 }

-func (u *DeprecatedUser) Update(displayName string, role Role) {
-	if displayName != "" {
-		u.DisplayName = displayName
-	}
-	if role != "" {
-		u.Role = role
-	}
-	u.UpdatedAt = time.Now()
-}
-
 func (u *User) UpdateStatus(status valuer.String) error {
 	// no updates allowed if user is in delete state
 	if err := u.ErrIfDeleted(); err != nil {
@@ -192,7 +170,7 @@ func (u *User) UpdateEmail(email valuer.Email) {
 // enrich the error with the specific operation using errors.WithAdditionalf.
 func (u *User) ErrIfRoot() error {
 	if u.IsRoot {
-		return errors.New(errors.TypeUnsupported, ErrCodeRootUserOperationUnsupported, "this operation is not supported for the root user")
+		return errors.New(errors.TypeInvalidInput, ErrCodeRootUserOperationUnsupported, "this operation is not supported for the root user")
 	}
 	return nil
 }
@@ -201,7 +179,7 @@ func (u *User) ErrIfRoot() error {
 // This error can be enriched with specific operation by the called using errors.WithAdditionalf.
 func (u *User) ErrIfDeleted() error {
 	if u.Status == UserStatusDeleted {
-		return errors.New(errors.TypeUnsupported, ErrCodeUserStatusDeleted, "unsupported operation for deleted user")
+		return errors.New(errors.TypeInvalidInput, ErrCodeUserStatusDeleted, "unsupported operation for deleted user")
 	}
 	return nil
 }
@@ -210,7 +188,7 @@ func (u *User) ErrIfDeleted() error {
 // This error can be enriched with specific operation by the called using errors.WithAdditionalf.
 func (u *User) ErrIfPending() error {
 	if u.Status == UserStatusPendingInvite {
-		return errors.New(errors.TypeUnsupported, ErrCodeUserStatusPendingInvite, "unsupported operation for pending user")
+		return errors.New(errors.TypeInvalidInput, ErrCodeUserStatusPendingInvite, "unsupported operation for pending user")
 	}
 	return nil
 }
@@ -234,17 +212,6 @@ func NewTraitsFromUser(user *User) map[string]any {
 	}
 }

-func NewTraitsFromDeprecatedUser(user *DeprecatedUser) map[string]any {
-	return map[string]any{
-		"name":         user.DisplayName,
-		"role":         user.Role,
-		"email":        user.Email.String(),
-		"display_name": user.DisplayName,
-		"status":       user.Status,
-		"created_at":   user.CreatedAt,
-	}
-}
-
 func (request *PostableRegisterOrgAndAdmin) UnmarshalJSON(data []byte) error {
 	type Alias PostableRegisterOrgAndAdmin

--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -24,6 +24,8 @@ pytest_plugins = [
    "fixtures.browser",
    "fixtures.keycloak",
    "fixtures.idp",
+    "fixtures.googleidp",
+    "fixtures.tls",
    "fixtures.notification_channel",
    "fixtures.maildev",
    "fixtures.alerts",
--- a/tests/e2e/fixtures/alert-history.ts
+++ b/tests/e2e/fixtures/alert-history.ts
@@ -1,451 +0,0 @@
-import type { Browser } from '@playwright/test';
-
-import {
-	createEmailChannelViaApi,
-	createLogsAlertViaApi,
-	createMetricAlertViaApi,
-	createNoDataAlertViaApi,
-	createTracesAlertViaApi,
-	deleteAlertViaApi,
-	deleteChannelViaApi,
-	readTimelineTotal,
-	seedAlertHistoryLogs,
-	seedAlertHistoryMetrics,
-	seedAlertHistoryTraces,
-	setRuleDisabledViaApi,
-	waitForTimelineEntries,
-	waitForTimelineStates,
-} from '../helpers/alerts';
-import { expect, test as base, withAdminPage } from './alert-rules';
-
-// Worker-scoped alert-history fixtures. Extends `alert-rules`, so a spec that
-// imports `test` from here also gets `alertChannel` / `alertList` / `ownedRules`
-// — the details specs need a history seed *and* their own throwaway rules.
-//
-// Every history row has to come from the ruler actually evaluating a rule (there
-// is no seeder endpoint for `rule_state_history_v0`), so each fixture pays a
-// real ruler wait: ~20-35s for the logs fixtures, ~10s for metrics, ~105s for
-// the firing→resolved wave. Worker scope means one wait per worker instead of
-// one per test, and Playwright creates each fixture lazily — a spec that never
-// asks for `resolvedHistory` never pays its 105s.
-//
-// See `tests/e2e/specs/alerts/alerts-e2e-coverage.md` §3 for the recipes and the
-// empirically-measured timings each budget here is derived from.
-
-/** Distinct `service.name` values SEED-A seeds ⇒ its timeline row count. */
-const SEED_A_SERVICES = 25;
-
-/** SEED-F seeds fewer services and a 1m window so it resolves inside ~105s. */
-const SEED_F_SERVICES = 3;
-
-/** SEED-E's group-by values ⇒ a 2-row history that fits on one page. */
-const SEED_E_HOSTS = ['host-0', 'host-1'];
-
-/** SEED-H seeds just enough services to prove the traces link; keeps the wait short. */
-const SEED_H_SERVICES = 3;
-
-/** Non-severity label on SEED-C, so the v1 header's labels row is non-empty. */
-export const SEED_C_TEAM_LABEL = 'e2e-platform';
-
-export interface AlertHistorySeed {
-	/** v2 (`schemaVersion: v2alpha1`) rule — the default history subject. */
-	ruleId: string;
-	/** Legacy v1 rule over the same logs. Its `threshold.name` is `warning`. */
-	ruleIdV1: string;
-	channelName: string;
-	/** The `body CONTAINS` marker both rules match. */
-	marker: string;
-	/** The seeded `service.name` values, in creation order. */
-	services: string[];
-	/** Baseline `total` for {@link ruleId}, read after the rule was frozen. */
-	total: number;
-	/** Baseline `total` for {@link ruleIdV1}. */
-	totalV1: number;
-}
-
-export interface MetricsHistorySeed {
-	ruleId: string;
-	channelName: string;
-	metricName: string;
-	hosts: string[];
-	total: number;
-}
-
-export interface TracesHistorySeed {
-	ruleId: string;
-	channelName: string;
-	/** The span `name` the rule matches (`name = '<marker>'`). */
-	marker: string;
-	services: string[];
-	total: number;
-}
-
-export interface ResolvedHistorySeed {
-	ruleId: string;
-	channelName: string;
-	marker: string;
-	services: string[];
-	/** Rows in the `firing` state — equals `stats.totalCurrentTriggers`. */
-	firingCount: number;
-	/** Rows in the `inactive` state, i.e. what the `Resolved` filter shows. */
-	resolvedCount: number;
-}
-
-export interface NoDataHistorySeed {
-	ruleId: string;
-	channelName: string;
-}
-
-export interface EmptyHistorySeed {
-	ruleId: string;
-	channelName: string;
-}
-
-async function cleanup(
-	browser: Browser,
-	{ ruleIds, channelId }: { ruleIds: string[]; channelId?: string },
-): Promise<void> {
-	await withAdminPage(browser, async (page) => {
-		for (const id of ruleIds) {
-			// eslint-disable-next-line no-await-in-loop
-			await deleteAlertViaApi(page, id);
-		}
-		if (channelId) {
-			await deleteChannelViaApi(page, channelId);
-		}
-	});
-}
-
-export const test = base.extend<
-	// eslint-disable-next-line @typescript-eslint/ban-types
-	{},
-	{
-		alertHistory: AlertHistorySeed;
-		metricsHistory: MetricsHistorySeed;
-		tracesHistory: TracesHistorySeed;
-		resolvedHistory: ResolvedHistorySeed;
-		noDataHistory: NoDataHistorySeed;
-		emptyHistory: EmptyHistorySeed;
-	}
->({
-	/**
-	 * SEED-A (25-row firing history, v2) **plus** SEED-C (the same logs seen
-	 * through a legacy v1 rule). Both rules share one seeded log batch, so the
-	 * two ruler waves overlap and the fixture costs roughly one wait, not two.
-	 */
-	alertHistory: [
-		async ({ browser }, use) => {
-			const stamp = Date.now();
-			const marker = `e2e alert history ${stamp}`;
-			let channelId = '';
-			let ruleId = '';
-			let ruleIdV1 = '';
-
-			const seed = await withAdminPage(browser, async (page) => {
-				const channel = await createEmailChannelViaApi(page, `e2e-ah-ch-${stamp}`);
-				channelId = channel.id;
-
-				// Seed and create in the same breath: the rules only fire while the
-				// records are inside the 5m eval window.
-				const services = await seedAlertHistoryLogs(page, {
-					marker,
-					services: SEED_A_SERVICES,
-					servicePrefix: `e2e-ah-svc`,
-				});
-
-				ruleId = await createLogsAlertViaApi(page, {
-					name: `e2e-ah-rule-v2-${stamp}`,
-					marker,
-					channels: [channel.name],
-					schema: 'v2',
-				});
-				ruleIdV1 = await createLogsAlertViaApi(page, {
-					name: `e2e-ah-rule-v1-${stamp}`,
-					marker,
-					channels: [channel.name],
-					schema: 'v1',
-					// The v1 header renders `labels` minus `severity`, so without a
-					// second label its labels row is present but empty (AD-02).
-					extraLabels: { team: SEED_C_TEAM_LABEL },
-				});
-
-				await waitForTimelineEntries(page, ruleId, { min: SEED_A_SERVICES });
-				await waitForTimelineEntries(page, ruleIdV1, { min: SEED_A_SERVICES });
-
-				// Freeze both before the eval window rolls past the seeded records —
-				// otherwise the resolve wave doubles `total` mid-suite.
-				await setRuleDisabledViaApi(page, ruleId, true);
-				await setRuleDisabledViaApi(page, ruleIdV1, true);
-
-				return {
-					ruleId,
-					ruleIdV1,
-					channelName: channel.name,
-					marker,
-					services,
-					total: await readTimelineTotal(page, ruleId),
-					totalV1: await readTimelineTotal(page, ruleIdV1),
-				};
-			});
-
-			if (seed.total !== SEED_A_SERVICES) {
-				// A different total means the fixture is not what the scenarios were
-				// written against — most likely the resolve wave landed before the
-				// PATCH froze the rule. Fail loudly here rather than let every
-				// downstream count assertion fail with a confusing off-by-N.
-				throw new Error(
-					`SEED-A expected ${SEED_A_SERVICES} timeline rows, got ${seed.total}`,
-				);
-			}
-
-			await use(seed);
-
-			await cleanup(browser, { ruleIds: [ruleId, ruleIdV1], channelId });
-		},
-		{ scope: 'worker', timeout: 240_000 },
-	],
-
-	/**
-	 * SEED-E — a metrics rule over two hosts. Two things SEED-A can't give:
-	 * history rows with **no** related links (links are derived from the rule's
-	 * signal), and a 2-row history that fits on a single page.
-	 */
-	metricsHistory: [
-		async ({ browser }, use) => {
-			const stamp = Date.now();
-			const metricName = `e2e_ah_probe_metric_${stamp}`;
-			let channelId = '';
-			let ruleId = '';
-
-			const seed = await withAdminPage(browser, async (page) => {
-				const channel = await createEmailChannelViaApi(
-					page,
-					`e2e-ah-metrics-ch-${stamp}`,
-				);
-				channelId = channel.id;
-
-				await seedAlertHistoryMetrics(page, {
-					metricName,
-					hosts: SEED_E_HOSTS,
-				});
-
-				ruleId = await createMetricAlertViaApi(page, {
-					name: `e2e-ah-metrics-rule-${stamp}`,
-					metricName,
-					channels: [channel.name],
-				});
-
-				await waitForTimelineEntries(page, ruleId, {
-					min: SEED_E_HOSTS.length,
-					timeoutMs: 120_000,
-				});
-				await setRuleDisabledViaApi(page, ruleId, true);
-
-				return {
-					ruleId,
-					channelName: channel.name,
-					metricName,
-					hosts: SEED_E_HOSTS,
-					total: await readTimelineTotal(page, ruleId),
-				};
-			});
-
-			await use(seed);
-
-			await cleanup(browser, { ruleIds: [ruleId], channelId });
-		},
-		{ scope: 'worker', timeout: 240_000 },
-	],
-
-	/**
-	 * SEED-H — a traces rule over seeded spans. The only fixture whose history
-	 * rows carry `relatedTracesLink`: the backend derives the link from the
-	 * rule's signal and returns either a logs link or a traces link, never both,
-	 * so the "View Traces" popover entry is unreachable from SEED-A.
-	 */
-	tracesHistory: [
-		async ({ browser }, use) => {
-			const stamp = Date.now();
-			const marker = `e2e-aht-span-${stamp}`;
-			let channelId = '';
-			let ruleId = '';
-
-			const seed = await withAdminPage(browser, async (page) => {
-				const channel = await createEmailChannelViaApi(
-					page,
-					`e2e-ah-traces-ch-${stamp}`,
-				);
-				channelId = channel.id;
-
-				const services = await seedAlertHistoryTraces(page, {
-					marker,
-					services: SEED_H_SERVICES,
-					servicePrefix: 'e2e-aht-svc',
-				});
-
-				ruleId = await createTracesAlertViaApi(page, {
-					name: `e2e-ah-traces-rule-${stamp}`,
-					marker,
-					channels: [channel.name],
-				});
-
-				await waitForTimelineEntries(page, ruleId, { min: SEED_H_SERVICES });
-				// Same reason as SEED-A: freeze before the eval window rolls past the
-				// seeded spans and the resolve wave doubles `total`.
-				await setRuleDisabledViaApi(page, ruleId, true);
-
-				return {
-					ruleId,
-					channelName: channel.name,
-					marker,
-					services,
-					total: await readTimelineTotal(page, ruleId),
-				};
-			});
-
-			await use(seed);
-
-			await cleanup(browser, { ruleIds: [ruleId], channelId });
-		},
-		{ scope: 'worker', timeout: 240_000 },
-	],
-
-	/**
-	 * SEED-F — firing **and** resolved, without touching the seeder: a 1m eval
-	 * window means the seeded records fall out of it fast, so the rule resolves
-	 * on its own in ~105s. This is the only fixture that produces a non-zero
-	 * average resolution time and a 3-segment overall-status graph.
-	 */
-	resolvedHistory: [
-		async ({ browser }, use) => {
-			const stamp = Date.now();
-			const marker = `e2e alert resolved ${stamp}`;
-			let channelId = '';
-			let ruleId = '';
-
-			const seed = await withAdminPage(browser, async (page) => {
-				const channel = await createEmailChannelViaApi(
-					page,
-					`e2e-ah-resolved-ch-${stamp}`,
-				);
-				channelId = channel.id;
-
-				const services = await seedAlertHistoryLogs(page, {
-					marker,
-					services: SEED_F_SERVICES,
-					ageSeconds: 40,
-					minAgeSeconds: 28,
-					servicePrefix: 'e2e-ahr-svc',
-				});
-
-				ruleId = await createLogsAlertViaApi(page, {
-					name: `e2e-ah-resolved-rule-${stamp}`,
-					marker,
-					channels: [channel.name],
-					evalWindow: '1m0s',
-				});
-
-				const timeline = await waitForTimelineStates(page, ruleId, {
-					states: {
-						firing: SEED_F_SERVICES,
-						inactive: SEED_F_SERVICES,
-					},
-				});
-				await setRuleDisabledViaApi(page, ruleId, true);
-
-				return {
-					ruleId,
-					channelName: channel.name,
-					marker,
-					services,
-					firingCount: timeline.items.filter((i) => i.state === 'firing').length,
-					resolvedCount: timeline.items.filter((i) => i.state === 'inactive').length,
-				};
-			});
-
-			await use(seed);
-
-			await cleanup(browser, { ruleIds: [ruleId], channelId });
-		},
-		{ scope: 'worker', timeout: 300_000 },
-	],
-
-	/**
-	 * SEED-G — a `nodata` row, reached the same way
-	 * `integration/testdata/alerts/test_scenarios/no_data_rule_test` does:
-	 * `alertOnAbsent` on a query that matches nothing.
-	 */
-	noDataHistory: [
-		async ({ browser }, use) => {
-			const stamp = Date.now();
-			let channelId = '';
-			let ruleId = '';
-
-			const seed = await withAdminPage(browser, async (page) => {
-				const channel = await createEmailChannelViaApi(
-					page,
-					`e2e-ah-nodata-ch-${stamp}`,
-				);
-				channelId = channel.id;
-
-				ruleId = await createNoDataAlertViaApi(page, {
-					name: `e2e-ah-nodata-rule-${stamp}`,
-					// Deliberately unseeded — the query must match nothing.
-					marker: `e2e alert nodata ${stamp}`,
-					channels: [channel.name],
-				});
-
-				await waitForTimelineEntries(page, ruleId, {
-					min: 1,
-					state: 'nodata',
-					timeoutMs: 180_000,
-				});
-				await setRuleDisabledViaApi(page, ruleId, true);
-
-				return { ruleId, channelName: channel.name };
-			});
-
-			await use(seed);
-
-			await cleanup(browser, { ruleIds: [ruleId], channelId });
-		},
-		{ scope: 'worker', timeout: 300_000 },
-	],
-
-	/**
-	 * A rule that will never have history: its query matches nothing and it is
-	 * disabled immediately. Covers "no history yet" (empty table, zero stats) and
-	 * "no key suggestions" without waiting on the ruler at all.
-	 */
-	emptyHistory: [
-		async ({ browser }, use) => {
-			const stamp = Date.now();
-			let channelId = '';
-			let ruleId = '';
-
-			const seed = await withAdminPage(browser, async (page) => {
-				const channel = await createEmailChannelViaApi(
-					page,
-					`e2e-ah-empty-ch-${stamp}`,
-				);
-				channelId = channel.id;
-
-				ruleId = await createLogsAlertViaApi(page, {
-					name: `e2e-ah-empty-rule-${stamp}`,
-					marker: `e2e alert never seeded ${stamp}`,
-					channels: [channel.name],
-				});
-				await setRuleDisabledViaApi(page, ruleId, true);
-
-				return { ruleId, channelName: channel.name };
-			});
-
-			await use(seed);
-
-			await cleanup(browser, { ruleIds: [ruleId], channelId });
-		},
-		{ scope: 'worker', timeout: 120_000 },
-	],
-});
-
-export { expect };
--- a/tests/e2e/fixtures/alert-rules.ts
+++ b/tests/e2e/fixtures/alert-rules.ts
@@ -1,214 +0,0 @@
-import type { Browser, Page } from '@playwright/test';
-
-import {
-	type AlertSchema,
-	createEmailChannelViaApi,
-	createLogsAlertViaApi,
-	createThresholdAlertViaApi,
-	deleteAlertViaApi,
-	deleteChannelViaApi,
-	type LogsAlertSeed,
-	seedAlertRules,
-	type ThresholdAlertSeed,
-} from '../helpers/alerts';
-import { newAdminContext } from '../helpers/auth';
-import { expect, test as base } from './auth';
-
-// Alert *rule* fixtures — the API-only half of the alerts suite. Nothing here
-// waits on the ruler: a rule is created and that's it. History rows need real
-// evaluations, so those fixtures live in `fixtures/alert-history.ts`, which
-// extends this module — a spec importing from there gets both sets.
-//
-// Scopes, and why:
-//   `alertChannel` — worker. Every rule payload has to reference a channel by
-//     name, and one channel serves the whole worker.
-//   `alertList`    — worker. SEED-B, the read-only rule list the `tests/alerts/
-//     list` specs page, search and sort through. Names and label values are
-//     stamped per worker so parallel batches never count each other's rules.
-//   `ownedRules`   — test. Scenarios that rename/toggle/clone/delete a rule seed
-//     their own and have it removed when they finish; mutating a shared seed
-//     would break every scenario scheduled after it.
-
-export interface AlertChannel {
-	id: string;
-	name: string;
-}
-
-export interface AlertListSeed {
-	channelName: string;
-	/** Rules are named `<namePrefix>-NN` — unique to this worker's batch. */
-	namePrefix: string;
-	/** Rules seeded ⇒ the `of N` total once the list is scoped to the prefix. */
-	count: number;
-	/** `team` label on the odd-indexed half of the batch, i.e. `count / 2` rules. */
-	paymentsLabel: string;
-	ruleIds: string[];
-}
-
-export interface OwnedRules {
-	/** Seed a metric threshold rule this test owns. */
-	threshold(
-		name: string,
-		overrides?: Partial<Omit<ThresholdAlertSeed, 'name'>>,
-	): Promise<string>;
-	/**
-	 * Seed a logs rule this test owns. No telemetry is seeded for its marker, so
-	 * it never fires — enough for anything about the details shell.
-	 *
-	 * `schema: 'v1'` posts the legacy payload and is SEED-RV1; the condition
-	 * overrides exist so a v1 *prefill* assertion can be made against values the
-	 * create form would not have produced by itself.
-	 */
-	logs(
-		options: {
-			name: string;
-			schema?: AlertSchema;
-			marker?: string;
-		} & Partial<
-			Pick<
-				LogsAlertSeed,
-				'severity' | 'extraLabels' | 'evalWindow' | 'target' | 'op' | 'matchType'
-			>
-		>,
-	): Promise<string>;
-	/**
-	 * Track a rule the *app* created (Clone / Duplicate) so teardown removes it
-	 * too. Lives here because the id may legitimately be missing and a
-	 * conditional inside a test body is a lint error.
-	 */
-	register(response: { json: () => Promise<unknown> }): Promise<void>;
-}
-
-/** SEED-B size. 12 over a pinned page size of 10 ⇒ a short second page. */
-const LIST_SEED_COUNT = 12;
-
-/**
- * Run `body` on a throwaway admin page. Worker hooks can't use the test-scoped
- * `authedPage`, and every API helper needs a page whose context carries the
- * admin storage state.
- */
-export async function withAdminPage<T>(
-	browser: Browser,
-	body: (page: Page) => Promise<T>,
-): Promise<T> {
-	const ctx = await newAdminContext(browser);
-	const page = await ctx.newPage();
-	try {
-		return await body(page);
-	} finally {
-		await ctx.close();
-	}
-}
-
-async function deleteRules(browser: Browser, ids: string[]): Promise<void> {
-	if (ids.length === 0) {
-		return;
-	}
-	await withAdminPage(browser, async (page) => {
-		for (const id of ids) {
-			// eslint-disable-next-line no-await-in-loop
-			await deleteAlertViaApi(page, id);
-		}
-	});
-}
-
-export const test = base.extend<
-	{ ownedRules: OwnedRules },
-	{ alertChannel: AlertChannel; alertList: AlertListSeed }
->({
-	alertChannel: [
-		async ({ browser }, use, workerInfo) => {
-			const channel = await withAdminPage(browser, (page) =>
-				createEmailChannelViaApi(
-					page,
-					`e2e-alerts-ch-w${workerInfo.workerIndex}-${Date.now()}`,
-				),
-			);
-
-			await use(channel);
-
-			await withAdminPage(browser, (page) =>
-				deleteChannelViaApi(page, channel.id),
-			);
-		},
-		{ scope: 'worker' },
-	],
-
-	alertList: [
-		async ({ browser, alertChannel }, use, workerInfo) => {
-			const stamp = `w${workerInfo.workerIndex}-${Date.now()}`;
-			const namePrefix = `e2e-alert-list-${stamp}`;
-			const teamSuffix = `-${stamp}`;
-
-			const ruleIds = await withAdminPage(browser, (page) =>
-				seedAlertRules(page, {
-					count: LIST_SEED_COUNT,
-					channelName: alertChannel.name,
-					namePrefix,
-					teamSuffix,
-				}),
-			);
-
-			await use({
-				channelName: alertChannel.name,
-				namePrefix,
-				count: LIST_SEED_COUNT,
-				paymentsLabel: `payments${teamSuffix}`,
-				ruleIds,
-			});
-
-			await deleteRules(browser, ruleIds);
-		},
-		{ scope: 'worker', timeout: 120_000 },
-	],
-
-	ownedRules: async ({ browser, alertChannel }, use) => {
-		const ids = new Set<string>();
-
-		const seed = async (
-			create: (page: Page) => Promise<string>,
-		): Promise<string> => {
-			const id = await withAdminPage(browser, create);
-			ids.add(id);
-			return id;
-		};
-
-		await use({
-			threshold: (name, overrides = {}) =>
-				seed((page) =>
-					createThresholdAlertViaApi(page, {
-						name,
-						target: 42,
-						channels: [alertChannel.name],
-						labels: { severity: 'critical' },
-						...overrides,
-					}),
-				),
-
-			logs: ({ name, schema = 'v2', marker, ...overrides }) =>
-				seed((page) =>
-					createLogsAlertViaApi(page, {
-						name,
-						marker: marker ?? `e2e alert never seeded ${name}`,
-						channels: [alertChannel.name],
-						schema,
-						...overrides,
-					}),
-				),
-
-			register: async (response) => {
-				const body = (await response.json()) as { data?: { id?: string } };
-				const id = body.data?.id;
-				if (id) {
-					ids.add(String(id));
-				}
-			},
-		});
-
-		// Best-effort: `deleteAlertViaApi` tolerates a rule a scenario already
-		// deleted through the UI.
-		await deleteRules(browser, [...ids]);
-	},
-});
-
-export { expect };
--- a/tests/e2e/fixtures/auth.ts
+++ b/tests/e2e/fixtures/auth.ts
@@ -1,11 +1,81 @@
-import { test as base, expect, type Page } from '@playwright/test';
+import {
+	test as base,
+	expect,
+	type Browser,
+	type BrowserContext,
+	type Page,
+} from '@playwright/test';

-import { ADMIN, storageStateFor, type User } from '../helpers/auth';
+export type User = { email: string; password: string };

-// The login flow and the per-worker session cache live in `helpers/auth.ts` so
-// worker-scoped fixtures and suite hooks share one login with this fixture.
-export { ADMIN };
-export type { User };
+// Default user — admin from the pytest bootstrap (.env.local) or staging .env.
+export const ADMIN: User = {
+	email: process.env.SIGNOZ_E2E_USERNAME!,
+	password: process.env.SIGNOZ_E2E_PASSWORD!,
+};
+
+// Per-worker storageState cache. One login per unique user per worker.
+// Promise-valued so concurrent requests share the same in-flight work.
+// Held in memory only — no .auth/ dir, no JSON on disk.
+type StorageState = Awaited<ReturnType<BrowserContext['storageState']>>;
+const storageByUser = new Map<string, Promise<StorageState>>();
+
+async function storageFor(browser: Browser, user: User): Promise<StorageState> {
+	const cached = storageByUser.get(user.email);
+	if (cached) {
+		return cached;
+	}
+
+	const task = (async () => {
+		const ctx = await browser.newContext();
+		const page = await ctx.newPage();
+		await login(page, user);
+		await pinSidenav(page);
+		const state = await ctx.storageState();
+		await ctx.close();
+		return state;
+	})();
+
+	storageByUser.set(user.email, task);
+	return task;
+}
+
+async function login(page: Page, user: User): Promise<void> {
+	if (!user.email || !user.password) {
+		throw new Error(
+			'User credentials missing. Set SIGNOZ_E2E_USERNAME / SIGNOZ_E2E_PASSWORD ' +
+				'(pytest bootstrap writes them to .env.local), or pass a User via test.use({ user: ... }).',
+		);
+	}
+	await page.goto('/login?password=Y');
+	await page.getByTestId('email').fill(user.email);
+	await page.getByTestId('initiate_login').click();
+	await page.getByTestId('password').fill(user.password);
+	await page.getByRole('button', { name: 'Sign in with Password' }).click();
+	// Post-login lands somewhere different depending on whether the org is
+	// licensed (onboarding flow on ENTERPRISE) or not (legacy "Hello there"
+	// welcome). Wait for URL to move off /login — whichever page follows
+	// is fine, each spec navigates to the feature under test anyway.
+	await page.waitForURL((url) => !url.pathname.startsWith('/login'));
+}
+
+// Pin the nav suite-wide: unpinned it flies out on hover and overlays content.
+// Server-side pref, so set once per user at login.
+async function pinSidenav(page: Page): Promise<void> {
+	const token = await page.evaluate(
+		// eslint-disable-next-line @typescript-eslint/no-explicit-any
+		() => (globalThis as any).localStorage.getItem('AUTH_TOKEN') || '',
+	);
+	const res = await page.request.put('/api/v1/user/preferences/sidenav_pinned', {
+		data: { value: true },
+		headers: { Authorization: `Bearer ${token}` },
+	});
+	if (!res.ok()) {
+		throw new Error(
+			`PUT /api/v1/user/preferences/sidenav_pinned ${res.status()}: ${await res.text()}`,
+		);
+	}
+}

 export const test = base.extend<{
 	/**
@@ -25,7 +95,7 @@ export const test = base.extend<{
 	user: [ADMIN, { option: true }],

 	authedPage: async ({ browser, user }, use) => {
-		const storageState = await storageStateFor(browser, user);
+		const storageState = await storageFor(browser, user);
 		const ctx = await browser.newContext({ storageState });
 		const page = await ctx.newPage();
 		// Opt-in CPU throttling to reproduce GitHub-Linux-runner conditions on
--- a/tests/e2e/helpers/alert-forms.ts
+++ b/tests/e2e/helpers/alert-forms.ts
@@ -1,738 +0,0 @@
-import { expect, type Locator, type Page } from '@playwright/test';
-
-// Helpers for the alert *create* and *edit* forms — two different form
-// implementations behind one feature. Rule *seeding* lives in
-// `helpers/alerts.ts`; this module is about driving the UI, so nothing here talks
-// to the rules API except through the browser.
-//
-// The single most important thing to know before using any of this: v1 and v2
-// are not two skins over one form, they are two components with different
-// selectors, different save gates and different success feedback. Every helper
-// below is therefore named for the form it drives (`v1…` / `v2…`) unless it is
-// genuinely shared, and the shared set is small.
-
-// ─── Routes ────────────────────────────────────────────────────────────────
-
-export const ALERTS_NEW_PATH = '/alerts/new';
-
-/**
- * The standalone edit route. Distinct from `/alerts/overview`, which renders the
- * *same* editor inside the details shell. The two are not interchangeable for v2
- * rules — see `edit/v2.spec.ts` EV2-12.
- */
-export const ALERT_EDIT_PATH = '/alerts/edit';
-
-// ─── Enums mirrored from the frontend ──────────────────────────────────────
-
-/**
- * URL values of `AlertTypes` (`frontend/src/types/api/alerts/alertTypes.ts`).
- * Note `METRICS` maps to the *singular* `METRIC_BASED_ALERT` — the enum key and
- * its value disagree in the source, and the URL carries the value.
- */
-export const AlertType = {
-	METRICS: 'METRIC_BASED_ALERT',
-	LOGS: 'LOGS_BASED_ALERT',
-	TRACES: 'TRACES_BASED_ALERT',
-	EXCEPTIONS: 'EXCEPTIONS_BASED_ALERT',
-	ANOMALY: 'ANOMALY_BASED_ALERT',
-} as const;
-
-export type AlertTypeValue = (typeof AlertType)[keyof typeof AlertType];
-
-/** `AlertDetectionTypes` (`frontend/src/container/FormAlertRules/index.tsx:78-81`). */
-export const RuleType = {
-	THRESHOLD: 'threshold_rule',
-	ANOMALY: 'anomaly_rule',
-} as const;
-
-/**
- * `AlertThresholdOperator` (`CreateAlertV2/context/types.ts:97-105`) and its
- * dropdown labels (`context/constants.ts:123-137`).
- *
- * Threshold-alert operators only. Anomaly alerts render a different, shorter
- * list (`ANOMALY_THRESHOLD_OPERATOR_OPTIONS`) with relabelled entries.
- */
-export const ThresholdOperator = {
-	ABOVE: { value: 'above', label: 'ABOVE' },
-	BELOW: { value: 'below', label: 'BELOW' },
-	EQUAL_TO: { value: 'equal', label: 'EQUAL TO' },
-	NOT_EQUAL_TO: { value: 'not_equal', label: 'NOT EQUAL TO' },
-	ABOVE_OR_EQUAL_TO: { value: 'above_or_equal', label: 'ABOVE OR EQUAL TO' },
-	BELOW_OR_EQUAL_TO: { value: 'below_or_equal', label: 'BELOW OR EQUAL TO' },
-} as const;
-
-/**
- * `AlertThresholdMatchType` (`CreateAlertV2/context/types.ts:105-111`) and its
- * dropdown labels (`context/constants.ts:136-142`).
- *
- * Watch the plural: the enum *key* is `ALL_THE_TIME` but the wire value is
- * `all_the_times`, and the API rejects the singular outright — the same
- * key/value mismatch as `METRICS_BASED_ALERT` → `METRIC_BASED_ALERT`.
- */
-export const ThresholdMatchType = {
-	AT_LEAST_ONCE: { value: 'at_least_once', label: 'AT LEAST ONCE' },
-	ALL_THE_TIME: { value: 'all_the_times', label: 'ALL THE TIME' },
-	ON_AVERAGE: { value: 'on_average', label: 'ON AVERAGE' },
-	IN_TOTAL: { value: 'in_total', label: 'IN TOTAL' },
-	LAST: { value: 'last', label: 'LAST' },
-} as const;
-
-/**
- * `AlertListTabs` (`frontend/src/pages/AlertList/types.ts:7-9`). The values are
- * space-less — the tab *labels* read "Triggered Alerts" but the `tab` URL param
- * is `TriggeredAlerts`, and asserting the label form silently fails.
- */
-export const AlertListTab = {
-	TRIGGERED_ALERTS: 'TriggeredAlerts',
-	ALERT_RULES: 'AlertRules',
-	CONFIGURATION: 'Configuration',
-} as const;
-
-/**
- * The four cards a stock stack shows, in render order
- * (`CreateAlertRule/SelectAlertType/config.ts:10-31`). Anomaly is `unshift`ed to
- * the **front** of this list when the `ANOMALY_DETECTION` feature flag is active,
- * so both the count and the order change when it is enabled.
- */
-export const STOCK_ALERT_TYPE_CARDS: AlertTypeValue[] = [
-	AlertType.METRICS,
-	AlertType.LOGS,
-	AlertType.TRACES,
-	AlertType.EXCEPTIONS,
-];
-
-// ─── Navigation ────────────────────────────────────────────────────────────
-
-/**
- * Open the bare type-selection page. `isTypeSelectionMode` is
- * `!alertType && !ruleType && !compositeQuery`
- * (`container/CreateAlertRule/index.tsx:39-41`), so *any* of those three params
- * skips this page — including a stale `compositeQuery` left in the URL.
- */
-export async function gotoAlertTypeSelection(page: Page): Promise<void> {
-	await page.goto(ALERTS_NEW_PATH);
-	await expect(alertTypeCard(page, AlertType.METRICS)).toBeVisible();
-}
-
-export function alertTypeCard(page: Page, type: AlertTypeValue): Locator {
-	return page.getByTestId(`alert-type-card-${type}`);
-}
-
-export function alertTypeCards(page: Page): Locator {
-	return page.locator('[data-testid^="alert-type-card-"]');
-}
-
-/**
- * Whether the anomaly card is on the page, i.e. whether `ANOMALY_DETECTION` is
- * active for this stack. It **is** active on the pytest-bootstrapped integration
- * stack, so every card-count assertion has to branch on it rather than hard-code
- * 4.
- */
-export async function hasAnomalyAlertTypeCard(page: Page): Promise<boolean> {
-	return (await alertTypeCard(page, AlertType.ANOMALY).count()) > 0;
-}
-
-/**
- * Assert the type-selection page shows exactly the expected set of cards: the
- * four stock ones, plus anomaly *first* when the flag is on (`getOptionList`
- * `unshift`s it, `SelectAlertType/config.ts:33-40`).
- *
- * Written as an exact set rather than "at least four" so that adding a fifth
- * signal still fails this assertion — the flag branch is the only slack.
- */
-export async function expectAlertTypeCardSet(page: Page): Promise<void> {
-	const anomaly = await hasAnomalyAlertTypeCard(page);
-	const expected = anomaly
-		? [AlertType.ANOMALY, ...STOCK_ALERT_TYPE_CARDS]
-		: STOCK_ALERT_TYPE_CARDS;
-
-	const cards = alertTypeCards(page);
-	await expect(cards).toHaveCount(expected.length);
-
-	// Read the testids positionally so order is asserted too — anomaly being
-	// unshifted rather than appended is the behaviour worth pinning.
-	const rendered: (string | null)[] = [];
-	for (let i = 0; i < expected.length; i += 1) {
-		// eslint-disable-next-line no-await-in-loop
-		rendered.push(await cards.nth(i).getAttribute('data-testid'));
-	}
-	expect(rendered).toEqual(expected.map((type) => `alert-type-card-${type}`));
-}
-
-export interface CreateAlertUrlOptions {
-	alertType?: AlertTypeValue;
-	ruleType?: string;
-	/** Sets `showClassicCreateAlertsPage=true` ⇒ the v1 classic form. */
-	classic?: boolean;
-	/** Merged in last, so it can override anything above. */
-	params?: Record<string, string>;
-}
-
-export function createAlertUrl({
-	alertType = AlertType.LOGS,
-	ruleType = RuleType.THRESHOLD,
-	classic = false,
-	params = {},
-}: CreateAlertUrlOptions = {}): string {
-	const search = new URLSearchParams({ alertType, ruleType });
-	if (classic) {
-		search.set('showClassicCreateAlertsPage', 'true');
-	}
-	for (const [key, value] of Object.entries(params)) {
-		search.set(key, value);
-	}
-	return `${ALERTS_NEW_PATH}?${search.toString()}`;
-}
-
-/**
- * Open the **v2** builder and wait until it has settled. The wait is two-part on
- * purpose: the header proves the builder mounted, and the `compositeQuery` in the
- * URL proves `useShareBuilderUrl` has finished serialising the default query —
- * without the second half, an assertion on the URL races the builder's own
- * rewrite (the same trap `gotoAlertOverview` documents).
- */
-export async function gotoCreateAlertV2(
-	page: Page,
-	options: Omit<CreateAlertUrlOptions, 'classic'> = {},
-): Promise<void> {
-	await page.goto(createAlertUrl({ ...options, classic: false }));
-	await expect(page.getByTestId('alert-name-input')).toBeVisible();
-	await page.waitForURL(/compositeQuery=/, { timeout: 15_000 });
-}
-
-/** Open the **v1** classic create form and wait for its primary action. */
-export async function gotoCreateAlertV1(
-	page: Page,
-	options: Omit<CreateAlertUrlOptions, 'classic'> = {},
-): Promise<void> {
-	await page.goto(createAlertUrl({ ...options, classic: true }));
-	await expect(v1SaveButton(page)).toBeVisible();
-}
-
-// ─── v2 builder ────────────────────────────────────────────────────────────
-
-/**
- * Footer buttons. The disabled Save/Test buttons are wrapped in a `<span>` inside
- * an antd `Tooltip` (`CreateAlertV2/Footer/Footer.tsx:198-204`) — the wrapper is
- * why {@link v2SaveTooltip} exists instead of reading a `title` attribute, and
- * why these are testids rather than accessible names: the name lookup also
- * matched the wrapper in some states.
- */
-export function v2SaveButton(page: Page): Locator {
-	return page.getByTestId('save-alert-rule-button');
-}
-
-export function v2TestButton(page: Page): Locator {
-	return page.getByTestId('test-notification-button');
-}
-
-export function v2DiscardButton(page: Page): Locator {
-	return page.getByTestId('discard-alert-rule-button');
-}
-
-/**
- * Click the v2 Discard button — via `dispatchEvent`, because a real click cannot
- * reach it.
- *
- * The footer is `position: fixed; left: 63px` (the *collapsed* nav rail width) and
- * Discard is its left-most control, so the button occupies roughly x 75-170 at the
- * bottom of the viewport. The side navigation occupies x 0-240 whenever it is
- * 240px wide, which is: always when pinned — the default — and transiently when
- * not pinned, because a mouse travelling toward the button crosses the rail and
- * triggers `:not(.pinned).is-hovered`. Either way `document.elementFromPoint` at
- * the button's centre returns the nav's `.nav-item-data`, so the nav swallows the
- * click.
- *
- * `{ force: true }` does **not** help: it skips Playwright's actionability wait
- * but still delivers a real mouse event at those coordinates, which the nav
- * receives. `dispatchEvent('click')` bypasses hit-testing entirely and React's
- * delegated handler fires normally — verified: the page navigates to `/alerts`.
- *
- * This is a workaround for a **product** bug, not for a flaky test.
- * `create/edge.spec.ts` CE-09 is the skipped scenario that asserts the fixed
- * behaviour; unskipping it and reverting this helper to `.click()` belong in the
- * same commit as the fix.
- */
-export async function v2ClickDiscard(page: Page): Promise<void> {
-	await v2DiscardButton(page).dispatchEvent('click');
-}
-
-/**
- * Whether the side navigation currently overlaps a point — the mechanism behind
- * {@link v2ClickDiscard}. Used by CE-09, which asserts the *absence* of that
- * overlap and is skipped until the footer is fixed.
- */
-export async function elementAtPointClassName(
-	page: Page,
-	x: number,
-	y: number,
-): Promise<string> {
-	return page.evaluate(
-		([px, py]) => {
-			const el = document.elementFromPoint(px as number, py as number);
-			return el ? String(el.className) : '';
-		},
-		[x, y],
-	);
-}
-
-/**
- * Hover the (disabled) Save button and return the antd tooltip's text — this is
- * the only way to read `validateCreateAlertState`'s message, since the button
- * cannot be clicked while a message exists.
- */
-export async function v2SaveTooltip(page: Page): Promise<string> {
-	// The tooltip anchors to the wrapper span, not the disabled button: a disabled
-	// button emits no pointer events, so hovering it directly never opens.
-	await v2SaveButton(page).locator('xpath=..').hover();
-	const tooltip = page.locator('.ant-tooltip-inner').first();
-	await expect(tooltip).toBeVisible();
-	return (await tooltip.innerText()).trim();
-}
-
-/**
- * Threshold rows. There is **no** `threshold-item-<id>` testid — the row is a bare
- * `className="threshold-item"` (`AlertCondition/ThresholdItem.tsx`), so rows are
- * addressed positionally.
- */
-export function thresholdRows(page: Page): Locator {
-	return page.locator('.threshold-item');
-}
-
-export function thresholdRow(page: Page, index: number): Locator {
-	return thresholdRows(page).nth(index);
-}
-
-/**
- * Pick a notification channel by exact name in one of the two channel selects —
- * v2's per-threshold one and v1's single `alert-channel-select`. Both are
- * `mode="multiple"` antd selects over the *same* global channel list, so both need
- * exactly this sequence; the shared body is why this is one function rather than
- * two near-copies.
- *
- * The list must be **searched**, not scrolled. Channels are global while the
- * `alertChannel` fixture is worker-scoped, so a shared stack accumulates one
- * channel per worker (plus anything a killed run leaked) and antd virtualises the
- * dropdown: measured on this stack, 31 channels render **10** options into the DOM,
- * and the wanted one is simply not there. Clicking by name without filtering first
- * is therefore not a slow path, it is a missing element — and it was the single
- * biggest source of flake in this suite. It fails as a plain click timeout
- * ("waiting for locator … .ant-select-item-option …"), which reads like a renamed
- * testid rather than a virtualised list.
- */
-async function pickChannelByName(
-	page: Page,
-	select: Locator,
-	channelName: string,
-): Promise<void> {
-	const tagsBefore = await selectedTags(select).count();
-	await select.click();
-	await expect(select).toHaveClass(/ant-select-open/);
-
-	// `fill` on the combobox input rather than `keyboard.type`: the query is a ~30
-	// character channel name and every keystroke re-runs antd's filter, so typing it
-	// costs ~2.5 s per pick — CV2-09 makes four of them, which was a quarter of that
-	// test's 30 s budget. `fill` sets the value in one input event, which is all
-	// rc-select's search needs.
-	await select.locator('input[role="combobox"]').fill(channelName);
-	const dropdown = await ownDropdown(page, select);
-	await dropdown
-		.locator('.ant-select-item-option')
-		.filter({ hasText: channelName })
-		.first()
-		.click();
-
-	// A multi-select stays open after a pick and its dropdown overlays the controls
-	// below, which the next interaction would otherwise hit instead.
-	await page.keyboard.press('Escape');
-
-	// Wait for *this* select to report itself closed before returning. antd removes
-	// `.ant-select-dropdown-hidden` only after the close transition, so a caller that
-	// immediately opens the next row's select races a still-visible stale list: the
-	// option lookup then resolves inside the previous row's dropdown and the click
-	// fails with "element is not stable" followed by "element is not visible".
-	await expect(select).not.toHaveClass(/ant-select-open/);
-
-	// Fail here rather than three assertions later: a silently-missed pick shows up
-	// as "Save is still disabled", which points at the validator instead of at this.
-	//
-	// Counted, not name-matched: v2's select sets `maxTagTextLength={10}`
-	// (`ThresholdItem.tsx:140`) so its tag reads `e2e-alerts…`, and v1's passes
-	// `optionLabelProp="label"` to options that carry no `label` prop, so its tag
-	// renders empty. Neither can ever contain the full channel name. The name itself
-	// is verified where it actually matters — in the request body (CV2-20, CV1-08).
-	await expect(selectedTags(select)).toHaveCount(tagsBefore + 1);
-}
-
-/** Assign a notification channel to the Nth v2 threshold. */
-export async function selectThresholdChannel(
-	page: Page,
-	index: number,
-	channelName: string,
-): Promise<void> {
-	await pickChannelByName(
-		page,
-		page.getByTestId('threshold-notification-channel-select').nth(index),
-		channelName,
-	);
-}
-
-/**
- * The currently-open antd dropdown. Scoping option lookups to it matters because
- * antd keeps previously-opened dropdowns in the DOM with
- * `.ant-select-dropdown-hidden`, so an unscoped `.ant-select-item-option` can
- * resolve into a stale list.
- *
- * Adequate when only one select is ever open on the page. When several selects of
- * the *same kind* exist — the per-threshold channel selects — use
- * {@link ownDropdown} instead: `-hidden` is applied only after the close
- * transition, so "the open dropdown" is briefly ambiguous.
- */
-export function openDropdown(page: Page): Locator {
-	return page.locator('.ant-select-dropdown:not(.ant-select-dropdown-hidden)');
-}
-
-/**
- * The dropdown belonging to one specific antd select, resolved through the
- * combobox's `aria-controls` → the listbox id it owns.
- *
- * This is the only unambiguous way to address one of several sibling selects'
- * option lists. Filtering on "the visible dropdown" is not enough: with four
- * threshold rows, row N's list is still mid-close while row N+1's opens, so the
- * option lookup lands in the wrong list and the click fails with "element is not
- * stable" and then "element is not visible".
- */
-export async function ownDropdown(
-	page: Page,
-	select: Locator,
-): Promise<Locator> {
-	const listId = await select
-		.locator('input[role="combobox"]')
-		.getAttribute('aria-controls');
-	if (!listId) {
-		throw new Error(
-			'select has no aria-controls — not an antd combobox, or not yet opened',
-		);
-	}
-	return page
-		.locator('.ant-select-dropdown')
-		.filter({ has: page.locator(`[id="${listId}"]`) });
-}
-
-/**
- * An option in the open dropdown, matched on its **exact** label. Substring
- * matching is wrong here: `hasText: 'EQUAL TO'` also matches `NOT EQUAL TO`.
- */
-export function dropdownOption(page: Page, label: string): Locator {
-	return openDropdown(page)
-		.locator('.ant-select-item-option')
-		.filter({ has: page.getByText(label, { exact: true }) });
-}
-
-/**
- * Read an antd multi-select's chosen values, for asserting what a threshold row
- * ended up pointing at.
- */
-export function selectedTags(scope: Locator): Locator {
-	return scope.locator('.ant-select-selection-item-content');
-}
-
-/**
- * Add a label through the v2 header editor. The input is a single field with two
- * phases — key, then value, each committed with Enter
- * (`CreateAlertHeader/LabelsInput.tsx:25-93`) — and a `key:value` string in the
- * first phase is accepted as a shortcut. This helper drives the two-phase path
- * because that is what a user does.
- */
-export async function addAlertLabel(
-	page: Page,
-	key: string,
-	value: string,
-): Promise<void> {
-	await page.getByTestId('alert-add-label-button').click();
-	const input = page.getByTestId('alert-add-label-input');
-	await input.fill(key);
-	await input.press('Enter');
-	await input.fill(value);
-	await input.press('Enter');
-
-	// Committing a label does *not* close the editor — `isAdding` stays true so a
-	// user can type several in a row, which means `alert-add-label-button` is still
-	// unmounted. Escape (with both fields empty) is what closes it, and without this
-	// a second call to this helper waits forever for the add button.
-	await input.press('Escape');
-	await expect(page.getByTestId('alert-add-label-button')).toBeVisible();
-}
-
-/**
- * The toggle inside an `AdvancedOptionItem` (repeat notifications, send-if-missing,
- * enforce-minimum-datapoints). The `Switch` there carries no testid of its own, so
- * it is reached through the container's — hence the container testid being the
- * documented handle rather than the switch.
- */
-export function advancedOptionToggle(
-	page: Page,
-	containerTestId: string,
-): Locator {
-	return page.getByTestId(containerTestId).locator('[role="switch"]');
-}
-
-// ─── Evaluation window + cadence ───────────────────────────────────────────
-
-/**
- * Rolling-window presets (`EvaluationSettings/constants.ts:9-18`) paired with the
- * button label each one produces. A value *outside* this set collapses to `custom`
- * on load (`utils.tsx:86-96`), which is what makes it a prefill assertion worth
- * having: `10m0s` proves the seed was read, `7m0s` proves the fallback fired.
- */
-export const EVALUATION_WINDOW_PRESETS = {
-	'5m0s': 'Last 5 minutes',
-	'10m0s': 'Last 10 minutes',
-	'15m0s': 'Last 15 minutes',
-	'30m0s': 'Last 30 minutes',
-	'1h0m0s': 'Last 1 hour',
-	'2h0m0s': 'Last 2 hours',
-	'4h0m0s': 'Last 4 hours',
-} as const;
-
-export function evaluationSettingsButton(page: Page): Locator {
-	return page.getByTestId('evaluation-settings-button');
-}
-
-/**
- * Open the evaluation-window popover. It is an antd `Popover`, so its content is
- * only in the DOM while open — every option lookup has to come after this.
- */
-export async function openEvaluationSettings(page: Page): Promise<void> {
-	await evaluationSettingsButton(page).click();
-	await expect(page.locator('.evaluation-window-popover')).toBeVisible();
-}
-
-/**
- * A popover option. The popover renders two lists from one component, keyed by
- * `data-section-id` — `window-type` (Rolling / Cumulative) and `timeframe` — and
- * the testid carries both, so `timeframe-option-10m0s` cannot collide with a
- * window-type value.
- */
-export function evaluationWindowOption(
-	page: Page,
-	section: 'window-type' | 'timeframe',
-	value: string,
-): Locator {
-	return page.getByTestId(`${section}-option-${value}`);
-}
-
-/**
- * Pick a rolling timeframe and wait for the trigger button to reflect it. The wait
- * matters: the popover closes on its own animation, and a spec that immediately
- * clicks Save can otherwise post the previous window.
- */
-export async function selectEvaluationTimeframe(
-	page: Page,
-	value: keyof typeof EVALUATION_WINDOW_PRESETS,
-): Promise<void> {
-	await openEvaluationSettings(page);
-	await evaluationWindowOption(page, 'timeframe', value).click();
-	await expect(evaluationSettingsButton(page)).toContainText(
-		EVALUATION_WINDOW_PRESETS[value],
-	);
-	await page.keyboard.press('Escape');
-}
-
-/**
- * Expand the ADVANCED OPTIONS panel inside the alert-condition section.
- *
- * antd's `Collapse` renders its panel children lazily, so `evaluation-cadence-*`
- * and the two `AdvancedOptionItem` containers do not exist in the DOM at all until
- * this runs — an assertion on them without it fails as "not found" rather than as
- * "not visible", which reads like a missing testid.
- */
-export async function expandAdvancedOptions(page: Page): Promise<void> {
-	const header = page.getByRole('button', { name: /ADVANCED OPTIONS/i });
-	if ((await header.getAttribute('aria-expanded')) !== 'true') {
-		await header.click();
-	}
-	await expect(page.getByTestId('evaluation-cadence-input-group')).toBeVisible();
-}
-
-/** The cadence duration field — `evaluation.spec.frequency`'s UI half. */
-export function evaluationCadenceInput(page: Page): Locator {
-	return page.getByTestId('evaluation-cadence-duration-input');
-}
-
-export function evaluationCadenceUnitSelect(page: Page): Locator {
-	return page.getByTestId('evaluation-cadence-unit-select');
-}
-
-export function labelPill(page: Page, key: string, value: string): Locator {
-	return page.getByTestId(`label-pill-${key}-${value}`);
-}
-
-// ─── v1 classic form ───────────────────────────────────────────────────────
-
-// Every locator below addresses a testid added to the classic form for this suite.
-// Before those, each of these was an antd label or role lookup. If one stops
-// resolving, the testid was dropped from the component, not renamed here.
-
-/**
- * The v1 primary action. Its *label* is mode-dependent — *Create Rule* when
- * `isNewRule`, *Save Rule* when editing (`FormAlertRules/index.tsx:970`) — so
- * scenarios that care about the mode assert the text; the locator itself does not.
- */
-export function v1SaveButton(page: Page): Locator {
-	return page.getByTestId('alert-save-button');
-}
-
-export function v1TestButton(page: Page): Locator {
-	return page.getByTestId('alert-test-button');
-}
-
-/** *Cancel* on create, *Discard* on edit (`FormAlertRules/index.tsx:991-992`). */
-export function v1CancelButton(page: Page): Locator {
-	return page.getByTestId('alert-cancel-button');
-}
-
-export function v1NameInput(page: Page): Locator {
-	return page.getByTestId('alert-name-input-v1');
-}
-
-export function v1DescriptionInput(page: Page): Locator {
-	return page.getByTestId('alert-description-input');
-}
-
-export function v1SeveritySelect(page: Page): Locator {
-	return page.getByTestId('alert-severity-select');
-}
-
-/** The four `RuleOptions` controls, in the order the condition sentence reads. */
-export function v1OperatorSelect(page: Page): Locator {
-	return page.getByTestId('alert-threshold-op-select');
-}
-
-export function v1MatchTypeSelect(page: Page): Locator {
-	return page.getByTestId('alert-threshold-match-type-select-v1');
-}
-
-export function v1EvalWindowSelect(page: Page): Locator {
-	return page.getByTestId('alert-eval-window-select');
-}
-
-/**
- * The threshold value. antd's `InputNumber` spreads unknown props straight onto
- * its inner `<input>` (rc-input-number), *not* onto the `.ant-input-number`
- * wrapper — so the testid is already the field and looking for an `input`
- * underneath it finds nothing.
- */
-export function v1ThresholdInput(page: Page): Locator {
-	return page.getByTestId('alert-threshold-target-input');
-}
-
-export function v1BroadcastSwitch(page: Page): Locator {
-	return page.getByTestId('alert-broadcast-to-all-channels');
-}
-
-export function v1ChannelSelect(page: Page): Locator {
-	return page.getByTestId('alert-channel-select');
-}
-
-/**
- * Pick a channel in the classic form. Deliberately **not** {@link v1SelectOption}:
- * that helper scrolls to nothing and clicks the option by label, which cannot work
- * on a virtualised list — see {@link pickChannelByName} for the measurement. The
- * other v1 selects (operator, match type, evaluation window, severity) have a
- * handful of options each and no search box, so they keep using `v1SelectOption`.
- */
-export async function v1SelectChannel(
-	page: Page,
-	channelName: string,
-): Promise<void> {
-	await pickChannelByName(page, v1ChannelSelect(page), channelName);
-}
-
-/**
- * v1 gates every save behind a confirm dialog: the Save button only opens it
- * (`FormAlertRules/index.tsx:653-655`), and both the field validation and the
- * request live in `saveRule`, which the dialog's OK invokes (`:1007-1010`).
- * A spec that clicks Save and waits for a POST without this step will time out —
- * and one that expects a *validation error* without it will too.
- */
-export function v1ConfirmDialog(page: Page): Locator {
-	return page.getByTestId('alert-save-confirm-dialog');
-}
-
-export async function v1ConfirmSave(page: Page): Promise<void> {
-	await expect(v1ConfirmDialog(page)).toBeVisible();
-	await v1ConfirmDialog(page).getByRole('button', { name: 'OK' }).click();
-}
-
-/** Dismiss the confirm dialog without saving — the CV1-07 half that must not POST. */
-export async function v1CancelSave(page: Page): Promise<void> {
-	await expect(v1ConfirmDialog(page)).toBeVisible();
-	await v1ConfirmDialog(page).getByRole('button', { name: 'Cancel' }).click();
-	await expect(v1ConfirmDialog(page)).toBeHidden();
-}
-
-/**
- * Pick an option in one of v1's antd selects. Scoped through {@link ownDropdown}
- * because the condition sentence puts four selects side by side, and matched on
- * the exact label because several share option text (*Above* / *Below* appear in
- * both the operator and the match-type lists in the anomaly variant).
- */
-export async function v1SelectOption(
-	page: Page,
-	select: Locator,
-	label: string,
-): Promise<void> {
-	await select.click();
-	const dropdown = await ownDropdown(page, select);
-	await dropdown
-		.locator('.ant-select-item-option')
-		.filter({ has: page.getByText(label, { exact: true }) })
-		.first()
-		.click();
-
-	// The channel select is `mode="multiple"` (`ChannelSelect/index.tsx:91`), so it
-	// stays open after a pick and its list overlays the controls below — which the
-	// next interaction would hit instead of its target. Escape closes it; on the
-	// single selects it is a no-op.
-	await page.keyboard.press('Escape');
-	await expect(select).not.toHaveClass(/ant-select-open/);
-}
-
-/** Switch the v1 query section to another query mode (`QuerySection.tsx`). */
-export async function v1SelectQueryMode(
-	page: Page,
-	mode: 'query-builder' | 'promql' | 'clickhouse',
-): Promise<void> {
-	await page.getByTestId(`${mode}-tab`).click();
-}
-
-// ─── SEED-CH1: a stack with no notification channels ───────────────────────
-
-/**
- * Route-stub `GET /api/v1/channels` to an empty list for this page only.
- *
- * This is the **one** place the alerts suite mocks the network, and it is a
- * deliberate exception to the standing no-stubbing rule. The justification: zero
- * channels is a real product state — every fresh install has it — and it is the
- * only state that reaches the `disabled` broadcast switch and
- * the empty-channel dropdown content. It cannot be produced server-side, because
- * `alertChannel` is worker-scoped and parallel workers share one stack, so
- * deleting the channel would break every other scenario running at that moment.
- *
- * Both forms read the same endpoint through `api/channels/getAll`, so one stub
- * covers v1 and v2.
- */
-export async function stubNoChannels(page: Page): Promise<void> {
-	await page.route('**/api/v1/channels', async (route) => {
-		if (route.request().method() !== 'GET') {
-			await route.fallback();
-			return;
-		}
-		await route.fulfill({
-			status: 200,
-			contentType: 'application/json',
-			body: JSON.stringify({ status: 'success', data: [] }),
-		});
-	});
-}
--- a/tests/e2e/helpers/alerts.ts
+++ b/tests/e2e/helpers/alerts.ts
--- a/tests/e2e/helpers/auth.ts
+++ b/tests/e2e/helpers/auth.ts
@@ -1,123 +1,34 @@
-import type { Browser, BrowserContext, Page } from '@playwright/test';
-
-export type User = { email: string; password: string };
-
-/** Default user — admin from the pytest bootstrap (.env.local) or staging .env. */
-export const ADMIN: User = {
-	email: process.env.SIGNOZ_E2E_USERNAME!,
-	password: process.env.SIGNOZ_E2E_PASSWORD!,
-};
+import type { Browser, BrowserContext } from '@playwright/test';

 /**
- * `browser.newContext()` only inherits `use.baseURL` while a *test* is in
- * scope. Worker-scoped fixtures (and their teardown) run outside that, where a
- * relative `page.goto('/login')` fails with "Cannot navigate to invalid URL" —
- * so pass it explicitly whenever we know it. Left empty when the var is unset
- * so the config's staging default still applies inside a test.
- */
-const contextDefaults: { baseURL?: string } = process.env.SIGNOZ_E2E_BASE_URL
-	? { baseURL: process.env.SIGNOZ_E2E_BASE_URL }
-	: {};
-
-// Per-worker storageState cache. One UI login per unique user per worker
-// process, shared by everything in that worker: the `authedPage` fixture, the
-// worker-scoped seed fixtures, and their teardown. Promise-valued so concurrent
-// callers await the same in-flight login rather than racing several of their
-// own. Held in memory only — no .auth/ dir, no JSON on disk.
-//
-// This cache is why `newAdminContext` is cheap. It used to log in through the
-// UI on every call, and the alerts fixtures call it a dozen-plus times per
-// worker (channel, rule list, five history seeds, one per owned rule, plus a
-// teardown for each) — a couple of seconds each, paid over and over for a
-// session that never changes.
-type StorageState = Awaited<ReturnType<BrowserContext['storageState']>>;
-const storageByUser = new Map<string, Promise<StorageState>>();
-
-async function login(page: Page, user: User): Promise<void> {
-	if (!user.email || !user.password) {
-		throw new Error(
-			'User credentials missing. Set SIGNOZ_E2E_USERNAME / SIGNOZ_E2E_PASSWORD ' +
-				'(pytest bootstrap writes them to .env.local), or pass a User via test.use({ user: ... }).',
-		);
-	}
-	await page.goto('/login?password=Y');
-	await page.getByTestId('email').fill(user.email);
-	await page.getByTestId('initiate_login').click();
-	await page.getByTestId('password').fill(user.password);
-	await page.getByRole('button', { name: 'Sign in with Password' }).click();
-	// Post-login lands somewhere different depending on whether the org is
-	// licensed (onboarding flow on ENTERPRISE) or not (legacy "Hello there"
-	// welcome). Wait for URL to move off /login — whichever page follows
-	// is fine, each spec navigates to the feature under test anyway.
-	await page.waitForURL((url) => !url.pathname.startsWith('/login'));
-}
-
-// Pin the nav suite-wide: unpinned it flies out on hover and overlays content.
-// Server-side pref, so set once per user at login.
-async function pinSidenav(page: Page): Promise<void> {
-	const token = await page.evaluate(
-		// eslint-disable-next-line @typescript-eslint/no-explicit-any
-		() => (globalThis as any).localStorage.getItem('AUTH_TOKEN') || '',
-	);
-	const res = await page.request.put('/api/v1/user/preferences/sidenav_pinned', {
-		data: { value: true },
-		headers: { Authorization: `Bearer ${token}` },
-	});
-	if (!res.ok()) {
-		const text = await res.text();
-		// Two workers logging in at the same moment both insert the preference and
-		// the loser gets a 500 on `uq_user_preference_name_user_id`. The write it
-		// lost to set the same value, so the preference *is* pinned — treat the
-		// duplicate as success rather than failing an unrelated test.
-		if (text.includes('uq_user_preference_name_user_id')) {
-			return;
-		}
-		throw new Error(
-			`PUT /api/v1/user/preferences/sidenav_pinned ${res.status()}: ${text}`,
-		);
-	}
-}
-
-/**
- * Authenticated storage state for `user`, logging in once per worker. Callers
- * hand the result to `browser.newContext({ storageState })`.
- */
-export function storageStateFor(
-	browser: Browser,
-	user: User = ADMIN,
-): Promise<StorageState> {
-	const cached = storageByUser.get(user.email);
-	if (cached) {
-		return cached;
-	}
-
-	const task = (async () => {
-		const ctx = await browser.newContext(contextDefaults);
-		const page = await ctx.newPage();
-		await login(page, user);
-		await pinSidenav(page);
-		const state = await ctx.storageState();
-		await ctx.close();
-		return state;
-	})();
-
-	storageByUser.set(user.email, task);
-	return task;
-}
-
-/**
- * Build an authenticated admin `BrowserContext`. Used by suite hooks
- * (`test.beforeAll` / `test.afterAll`) and worker-scoped fixtures, where the
- * test-scoped `authedPage` fixture from `fixtures/auth.ts` is not reachable.
+ * Build a fresh authenticated `BrowserContext` via UI login. Used by suite
+ * hooks (`test.beforeAll` / `test.afterAll`), where the test-scoped
+ * `authedPage` fixture from `fixtures/auth.ts` is not reachable.
 *
- * Reuses this worker's cached session, so only the first call in a worker pays
- * for a login. The caller owns the context and must close it.
+ * Each call performs one fresh login (~1s). The per-worker storageState
+ * cache in `fixtures/auth.ts` is intentionally not shared here — keeping
+ * this helper standalone avoids coupling suite hooks to the fixture's
+ * private cache.
 */
 export async function newAdminContext(
 	browser: Browser,
 ): Promise<BrowserContext> {
-	return browser.newContext({
-		...contextDefaults,
-		storageState: await storageStateFor(browser, ADMIN),
-	});
+	const email = process.env.SIGNOZ_E2E_USERNAME;
+	const password = process.env.SIGNOZ_E2E_PASSWORD;
+	if (!email || !password) {
+		throw new Error(
+			'SIGNOZ_E2E_USERNAME / SIGNOZ_E2E_PASSWORD must be set ' +
+				'(pytest bootstrap writes them to .env.local).',
+		);
+	}
+	const ctx = await browser.newContext();
+	const page = await ctx.newPage();
+	await page.goto('/login?password=Y');
+	await page.getByTestId('email').fill(email);
+	await page.getByTestId('initiate_login').click();
+	await page.getByTestId('password').fill(password);
+	await page.getByRole('button', { name: 'Sign in with Password' }).click();
+	await page.waitForURL((url) => !url.pathname.startsWith('/login'));
+	await page.close();
+	return ctx;
 }
--- a/tests/e2e/helpers/common.ts
+++ b/tests/e2e/helpers/common.ts
@@ -1,4 +1,4 @@
-import type { Page, Request } from '@playwright/test';
+import type { Page } from '@playwright/test';

 // Shared helpers used across feature-specific helper modules (dashboards,
 // trace-details, …). Keep this to genuinely cross-feature utilities.
@@ -18,108 +18,6 @@ export function seederUrl(): string {
 	return url;
 }

-// ─── Console / network noise ──────────────────────────────────────────────
-
-// Requests the bootstrap stack always fails, on every page, for reasons that
-// have nothing to do with the feature under test. Keep this list tiny and give
-// every entry a reason — it is a deny-list of *environment* noise, never of real
-// application errors.
-const HARNESS_FAILING_REQUESTS = [
-	// Zeus is a WireMock stub with no /api/v2/zeus/hosts mapping, so the app
-	// shell's workspace-URL lookup 404s on every page load. It reaches the console
-	// three ways: the resource-load error, the AxiosError, and the literal `any`
-	// that `api/ErrorResponseHandler.ts`'s fallback branch logs.
-	'/api/v2/zeus/hosts',
-	// The app shell polls GitHub for the latest release. Unauthenticated calls
-	// from CI/dev machines get rate-limited (403), which has nothing to do with
-	// the page under test.
-	'api.github.com',
-];
-
-// The console side of {@link HARNESS_FAILING_REQUESTS}. Browsers log a
-// resource-load error without the URL, so these have to be matched on text —
-// which is why the URL list above is the precise half of the check.
-const HARNESS_CONSOLE_NOISE = [
-	'Failed to load resource: the server responded with a status of 404 (Not Found)',
-	'Failed to load resource: the server responded with a status of 403',
-	'Request failed with status code 404',
-	'client never received a response, or request never left',
-	'any',
-];
-
-export interface ConsoleWatch {
-	/** Console `error` entries and uncaught page errors, harness noise removed. */
-	errors: string[];
-	/** `"<status> <method> <url>"` for every 4xx/5xx, harness noise removed. */
-	failedResponses: string[];
-}
-
-/**
- * Watch a page for console errors and failed requests. Call **before** the first
- * navigation; the returned object fills in as the page runs, so assert on it at
- * the end of the scenario.
- *
- * Console text alone is a weak signal (the harness's Zeus 404 produces three
- * generic-looking entries), so the failed-response list is the precise half:
- * text matching is deliberately loose while the URL check stays strict.
- */
-export function watchConsole(
-	page: Page,
-	/**
-	 * Extra substrings to ignore. Use this — with a comment naming the defect —
-	 * for a *known application* bug that is out of the spec's scope, so the rest
-	 * of the console assertion keeps its value instead of being deleted.
-	 */
-	options: { ignore?: string[] } = {},
-): ConsoleWatch {
-	const watch: ConsoleWatch = { errors: [], failedResponses: [] };
-	const noise = [...HARNESS_CONSOLE_NOISE, ...(options.ignore ?? [])];
-	const isNoise = (text: string): boolean =>
-		noise.some((entry) => text.includes(entry));
-
-	page.on('console', (msg) => {
-		if (msg.type() === 'error' && !isNoise(msg.text())) {
-			watch.errors.push(msg.text());
-		}
-	});
-	page.on('pageerror', (err) => {
-		if (!isNoise(String(err))) {
-			watch.errors.push(String(err));
-		}
-	});
-	page.on('response', (res) => {
-		if (res.status() < 400) {
-			return;
-		}
-		const url = res.url();
-		if (HARNESS_FAILING_REQUESTS.some((entry) => url.includes(entry))) {
-			return;
-		}
-		watch.failedResponses.push(
-			`${res.status()} ${res.request().method()} ${url}`,
-		);
-	});
-	return watch;
-}
-
-// ─── Network capture ──────────────────────────────────────────────────────
-
-/**
- * Every request the page issues from now on. Call **before** the first
- * navigation — the returned array fills in as the page runs, so filter it at the
- * end of the scenario ("endpoint called exactly once", "no legacy route used").
- */
-export function collectRequests(page: Page): Request[] {
-	const requests: Request[] = [];
-	page.on('request', (request) => requests.push(request));
-	return requests;
-}
-
-/** A request's URL, parsed — the readable way to reach `searchParams`. */
-export function requestUrl(request: Request): URL {
-	return new URL(request.url());
-}
-
 // ─── Auth ────────────────────────────────────────────────────────────────

 // Read the app JWT from the context's stored auth state. No navigation needed:
--- a/tests/e2e/package.json
+++ b/tests/e2e/package.json
@@ -5,12 +5,7 @@
  "main": "index.js",
  "scripts": {
    "preinstall": "npx only-allow pnpm",
-    "env:start": "cd .. && uv run pytest --basetemp=./tmp/ -vv --reuse --rebuild --capture=no --with-web e2e/bootstrap/setup.py::test_setup",
-    "env:stop": "cd .. && uv run pytest --basetemp=./tmp/ -vv --teardown --capture=no e2e/bootstrap/setup.py::test_teardown",
-    "env:clean": "rm -rf ../tmp ../.pytest_cache .env.local artifacts && echo 'Cleaned. Run docker container prune if needed.'",
    "test": "playwright test",
-    "test:local": "pnpm env:start && pnpm test",
-    "test:all": "playwright test",
    "test:staging": "SIGNOZ_E2E_BASE_URL=https://app.us.staging.signoz.cloud playwright test",
    "test:ui": "playwright test --ui",
    "test:headed": "playwright test --headed",
--- a/tests/e2e/playwright.config.ts
+++ b/tests/e2e/playwright.config.ts
@@ -1,37 +1,15 @@
 import { defineConfig, devices } from '@playwright/test';
 import dotenv from 'dotenv';
-import fs from 'fs';
-import os from 'os';
 import path from 'path';

-// Precedence, lowest to highest:
-//   .env        — user-provided defaults (staging creds)
-//   .env.local  — written by tests/e2e/bootstrap/setup.py when the pytest
-//                 lifecycle brings the backend up locally, so it must win over
-//                 any stale .env value
-//   the real environment — anything the caller exported on purpose, e.g.
-//                 `SIGNOZ_E2E_BASE_URL=http://127.0.0.1:3301 pnpm test` to run
-//                 against a locally served frontend, or the vars pytest injects
-//                 when it shells out to `pnpm test`.
-//
-// This is deliberately *not* `dotenv.config({ override: true })`: that flag
-// makes the file beat process.env, so an exported SIGNOZ_E2E_BASE_URL was
-// silently discarded and every run went to whatever .env.local pointed at.
-// Parsing by hand is the only way to get ".env.local beats .env" without also
-// getting ".env.local beats the caller".
-const exported = new Set(Object.keys(process.env));
-for (const file of ['.env', '.env.local']) {
-	const filePath = path.resolve(__dirname, file);
-	if (!fs.existsSync(filePath)) {
-		continue;
-	}
-	const parsed = dotenv.parse(fs.readFileSync(filePath));
-	for (const [key, value] of Object.entries(parsed)) {
-		if (!exported.has(key)) {
-			process.env[key] = value;
-		}
-	}
-}
+// .env holds user-provided defaults (staging creds).
+// .env.local is written by tests/e2e/bootstrap/setup.py when the pytest
+// lifecycle brings the backend up locally; override=true so local-backend
+// coordinates win over any stale .env values. Subprocess-injected env
+// (e.g. when pytest shells out to `pnpm test`) still takes priority —
+// dotenv doesn't touch vars that are already set in process.env.
+dotenv.config({ path: path.resolve(__dirname, '.env') });
+dotenv.config({ path: path.resolve(__dirname, '.env.local'), override: true });

 export default defineConfig({
 	testDir: './tests',
@@ -55,17 +33,8 @@ export default defineConfig({
 	// Retry on CI only
 	retries: process.env.CI ? 2 : 0,

-	// Workers. Playwright's local default is `cpus / 2`, which on a 32-core box is
-	// 16 — and 16 is strictly worse than 6 here, because every worker's browser
-	// shares one SigNoz container: measured on `tests/alerts/{create,edit}` at
-	// `--repeat-each=3` (224 tests), 16 workers took 128 s with 3 failures while 6
-	// took 119 s with none. Past ~6 the extra workers only add queueing, which shows
-	// up as 4-6 s app mounts and save requests that outlive the test timeout — i.e.
-	// as flakes that look like product bugs. Capped rather than fixed at 6 so a
-	// 4-core laptop still gets `cpus / 2`.
-	workers: process.env.CI
-		? 2
-		: Math.max(1, Math.min(6, Math.floor(os.cpus().length / 2))),
+	// Workers
+	workers: process.env.CI ? 2 : undefined,

 	// The SPA hydrates slowly on CI, so the 5s expect default fires mid-load.
 	expect: { timeout: 15_000 },
--- a/tests/e2e/tests/alerts/alerts.spec.ts
+++ b/tests/e2e/tests/alerts/alerts.spec.ts
@@ -0,0 +1,67 @@
+import { expect, test } from '../../fixtures/auth';
+import {
+	createEmailChannelViaApi,
+	createThresholdAlertViaApi,
+	deleteAlertViaApi,
+	deleteChannelViaApi,
+	gotoAlertOverview,
+} from '../../helpers/alerts';
+import { newAdminContext } from '../../helpers/auth';
+
+test('TC-01 alerts page — tabs render', async ({ authedPage: page }) => {
+	await page.goto('/alerts');
+	await expect(page.getByRole('tab', { name: /alert rules/i })).toBeVisible();
+	await expect(page.getByRole('tab', { name: /configuration/i })).toBeVisible();
+});
+
+test.describe('alerts — threshold persists on edit-page load', () => {
+	const TARGET = 245;
+	let ruleId: string;
+	let channelId: string;
+
+	test.beforeAll(async ({ browser }) => {
+		const ctx = await newAdminContext(browser);
+		const page = await ctx.newPage();
+		try {
+			const stamp = Date.now();
+			const channel = await createEmailChannelViaApi(
+				page,
+				`e2e-threshold-persistence-ch-${stamp}`,
+			);
+			channelId = channel.id;
+			ruleId = await createThresholdAlertViaApi(page, {
+				name: `e2e-threshold-persistence-${stamp}`,
+				target: TARGET,
+				channels: [channel.name],
+			});
+		} finally {
+			await ctx.close();
+		}
+	});
+
+	test.afterAll(async ({ browser }) => {
+		const ctx = await newAdminContext(browser);
+		const page = await ctx.newPage();
+		try {
+			if (ruleId) {
+				await deleteAlertViaApi(page, ruleId);
+			}
+			if (channelId) {
+				await deleteChannelViaApi(page, channelId);
+			}
+		} finally {
+			await ctx.close();
+		}
+	});
+
+	test('TC-02 edit page shows the saved threshold value', async ({
+		authedPage: page,
+	}) => {
+		await gotoAlertOverview(page, ruleId);
+
+		// The condition editor should show the persisted target once loaded.
+		await expect(page.getByTestId('threshold-value-input')).toHaveValue(
+			String(TARGET),
+		);
+	});
+});
--- a/tests/e2e/tests/alerts/channels/edit.spec.ts
+++ b/tests/e2e/tests/alerts/channels/edit.spec.ts
@@ -1,45 +0,0 @@
-import { expect, test } from '../../../fixtures/auth';
-import {
-	createEmailChannelViaApi,
-	deleteChannelViaApi,
-} from '../../../helpers/alerts';
-
-test.describe('Notification channels — edit', () => {
-	// Regression guard for engineering-pod#5509: after channels moved from
-	// /settings/channels to /alerts/channels, the edit container still parsed the
-	// channel id out of the old pathname, so every save PUT went to an empty id
-	// and no edit ever persisted. Nothing in the suite navigated into the edit
-	// page, so the whole class of "edits silently do nothing" was invisible.
-	test('NC-01 an edited recipient persists after reload', async ({
-		authedPage: page,
-	}) => {
-		// The channel *name* is read-only on the edit page, so the editable field
-		// this exercises is the email recipient.
-		const name = `e2e-nc-${Date.now()}`;
-		const updatedTo = 'e2e-updated@signoz.test';
-		const { id } = await createEmailChannelViaApi(page, name);
-
-		try {
-			await page.goto(`/alerts/channels/edit/${id}`);
-
-			const toBox = page.getByRole('textbox', { name: 'To' });
-			await expect(toBox).toHaveValue('e2e@signoz.test');
-			await toBox.fill(updatedTo);
-
-			await Promise.all([
-				page.waitForResponse(
-					(r) =>
-						r.url().includes('/api/v1/channels') && r.request().method() === 'PUT',
-				),
-				page.getByTestId('save-channel-button').click(),
-			]);
-
-			await page.goto(`/alerts/channels/edit/${id}`);
-			await expect(page.getByRole('textbox', { name: 'To' })).toHaveValue(
-				updatedTo,
-			);
-		} finally {
-			await deleteChannelViaApi(page, id);
-		}
-	});
-});
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
vikrantgupta25	8b2a5ecb14	fix(user): return 400 instead of 501 for protected user states ErrIfRoot, ErrIfDeleted and ErrIfPending used TypeUnsupported, which maps to 501. That code means the server lacks the functionality, which is how the noop providers use it for edition gating. These guards are business rules present in every build, so 501 was never accurate. They now use TypeInvalidInput, matching ErrIfNotPending which already did. No status code expresses "permanently rejected for every caller", so the meaning stays in the machine readable error code that each guard already carries. Assisted-by: Claude Fable 5	2026-08-10 14:41:21 +05:30
Pandey	cd8346a91a	test(callbackauthn): cover the google authn flow end to end (#12486 ) #### Description - Adds end-to-end coverage for the google authn flow (`callbackauthn/04_google.py`): happy-path login, hd-claim mismatch rejection, unverified-email rejection + `insecureSkipEmailVerified` opt-in, and roleMapping defaultRole. - The google callback authn hardcodes `https://accounts.google.com` as its issuer and fully verifies the RS256 id_token, so a wiremock container impersonates Google: it joins the test network under the `accounts.google.com` alias and serves HTTPS with a certificate issued by a new integration CA (`tests/fixtures/tls.py`), which every signoz container now trusts via `SSL_CERT_FILE`. - Stubs (discovery, auto-approving authorize, token, JWKS) are installed per test via the existing `make_http_mocks` fixture with a pre-signed id_token for the identity under test; one session-scoped RSA key signs all tokens.	2026-08-10 08:35:58 +00:00
Vikrant Gupta	db5f4b4cd5	feat(user): add v2 reset password endpoint (#12489 ) #### Description - `POST /api/v1/resetPassword` was the last password endpoint with no v2 equivalent. Adds `POST /api/v2/factor_password/reset`, next to the existing `/factor_password/forgot`, so the whole recovery flow lives under one namespace. - v1 keeps working and is now marked deprecated. Both routes share the same handler, so behaviour is identical. - A malformed request body now returns a structured 400 instead of a 500. This applies to v1 too, since the handler is shared. #### Issues closed by this PR Contributes to SigNoz/platform-pod#2667 #### Additional Information - The generated frontend client is included because CI re-runs `pnpm generate:api` and fails on drift. The UI still calls v1; moving it to the new `useResetPassword` hook is a separate PR to keep review ownership split. - Not fixed here: a reset doesn't revoke existing sessions, though a voluntary password change does. Worth its own ticket.	2026-08-10 08:27:46 +00:00
Aditya Singh	3bd9b2a96a	feat(log-details): update log details header (#12310 ) ## Pull Request --- ### 📄 Summary > Why does this change exist? > What problem does it solve, and why is this the right approach? Slice 1 of the log-details drawer revamp, a reworked drawer header, gated behind the new `isLogDetailsV2` flag (ships off). Highlights and the DataViewer land in the following stacked PRs. Change points - Added a new Log Details Header with: - A formatted timestamp based on the user's timezone - A ⋯ menu with Copy log and Copy link to log - Up/down arrows to move between logs - An optional Open in Explorer button - Moved the log navigation logic into a separate `useLogNavigation` hook - Updated the Log Details drawer: - Shows the new header when the feature flag is on (otherwise keeps the old title) - Replaced the WARN/ERROR divider with `LogStateIndicator`, which shows colors for all log levels - Moved the copy actions into the ⋯ menu and removed the old inline copy button in V2 - Uses the new navigation hook for both keyboard shortcuts and header arrows - Updated the copy link handler: - `onLogCopy` now accepts an optional click event, so it can be called from the ⋯ menu - Moved the "Copied to clipboard" toast from the top-right to the bottom-right - Everything is gated behind feature flag for now #### Screenshots / Screen Recordings (if applicable) https://github.com/user-attachments/assets/4a73e299-4715-4feb-81e3-762fdc3d0757 #### Issues closed by this PR > Reference issues using `Closes #issue-number` to enable automatic closure on merge. --- ### ✅ Change Type _Select all that apply_ - [ ] ✨ Feature - [ ] 🐛 Bug fix - [ ] ♻️ Refactor - [ ] 🛠️ Infra / Tooling - [ ] 🧪 Test-only --- ### 🐛 Bug Context > Required if this PR fixes a bug #### Root Cause > What caused the issue? > Regression, faulty assumption, edge case, refactor, etc. #### Fix Strategy > How does this PR address the root cause? --- ### 🧪 Testing Strategy > How was this change validated? - Tests added/updated: - Manual verification: - Edge cases covered: --- ### ⚠️ Risk & Impact Assessment > What could break? How do we recover? - Blast radius: - Potential regressions: - Rollback plan: --- ### 📝 Changelog > Fill only if this affects users, APIs, UI, or documented behavior > Use N/A for internal or non-user-facing changes \| Field \| Value \| \|------\|-------\| \| Deployment Type \| Cloud / OSS / Enterprise \| \| Change Type \| Feature / Bug Fix / Maintenance \| \| Description \| User-facing summary \| --- ### 📋 Checklist - [ ] Tests added or explicitly not required - [ ] Manually tested - [ ] Breaking changes documented - [ ] Backward compatibility considered --- ## 👀 Notes for Reviewers <!-- Anything reviewers should keep in mind while reviewing --> ---	2026-08-10 06:54:54 +00:00
Pandey	c4e6487e0d	chore(frontend): remove the loginPrecheck mock for a removed endpoint (#12485 ) #### Description - Removes the msw mock for `/api/v1/loginPrecheck` — the endpoint no longer exists in the backend and nothing in the frontend calls it anymore; the login flow runs on `/api/v2/sessions/context`.	2026-08-10 06:33:29 +00:00
Vikrant Gupta	40aa322cc3	feat(invite): accept multiple roles per invited member (#12476 ) Some checks failed build-staging / prepare (push) Has been cancelled Details cacheci / tests (push) Has been cancelled Details Release Drafter / update_release_draft (push) Has been cancelled Details build-staging / js-build (push) Has been cancelled Details build-staging / go-build (push) Has been cancelled Details build-staging / staging (push) Has been cancelled Details #### Description - Invited members can now be given more than one role. The picker was single-select even though `POST /api/v2/users` has accepted a list of roles since custom roles landed. - Frontend only — nothing changed on the backend, the grant chain was already multi-role. - Onboarding analytics now emits `teamMembers[].roles` as a list, replacing the singular `role` key. #### Issues closed by this PR Closes SigNoz/platform-pod#2920 #### Screenshots / Screen Recordings #### Members Page https://github.com/user-attachments/assets/8b556549-789c-4ddf-b4af-5994eccc75f3 #### Onboarding Flow https://github.com/user-attachments/assets/a6dde5d3-e9b4-48c1-965f-352bb0a6a89f #### Additional Information - A row still requires at least one role to be considered valid. - Existing invite tests moved to `findByTitle` for role options, matching how `EditMemberDrawer` already drives the multi-select.	2026-08-08 20:59:52 +00:00
Vikrant Gupta	2a2b393146	chore(user): remove the deprecated user by id endpoints (#12474 ) #### Description - Removes `GET`, `PUT` and `DELETE /api/v1/user/{id}` — all deprecated and superseded by `/api/v2/users/{id}`, which the frontend already uses. - Drops the dead code this leaves behind: the `SelfAccess` middleware and `Claims.IsSelfAccess` (no callers left), the deprecated update setters, and three `DeprecatedUser` helpers. - Points the integration tests that deleted users at `DELETE /api/v2/users/{id}`. #### Issues closed by this PR Contributes to SigNoz/platform-pod#2667 #### Additional Information - Behaviour change: the removed `GET`/`PUT` were `SelfAccess`, the v2 equivalents are `AdminAccess`. Self-serve reads and updates go through `/api/v2/users/me`, which is what the UI already calls — but worth a second pair of eyes. - `DELETE /api/v1/user/{id}` was the most widely reached of the three. Please confirm nothing external (zeus) still calls it before merging. - OpenAPI spec and the generated frontend client are regenerated, not hand-edited.	2026-08-08 20:51:14 +00:00
Vikrant Gupta	b904aca1a8	chore(user): remove the deprecated bulk invite endpoint (#12473 ) #### Description - Removes `POST /api/v1/invite/bulk` — already deprecated, superseded by `POST /api/v1/invite`, and no callers left. - `Setter.CreateBulkInvite` stays; `CreateInvite` still delegates to it for the single-invite case. #### Issues closed by this PR Contributes to SigNoz/platform-pod#2667 #### Additional Information - OpenAPI spec and the generated frontend client are regenerated, not hand-edited. - The `integrationci / fmtlint` failure here is not from this PR — `make py-lint` is broken on `main`. Fixed separately in #12475; this PR needs that merged (or a rebase on it) to go green. - First of three PRs splitting a v1 user-API cleanup. The other two also regenerate the spec and generated client, so whichever merges second needs the generators re-run.	2026-08-08 20:24:55 +00:00
Vikrant Gupta	530c050b71	fix(tests): call Metrics.load_from_file directly in the pods filter test (#12475 ) #### Description - `make py-lint` is failing on `main` with `F821 Undefined name _load_pods_metrics` at `inframonitoring/02_pods.py:471`, which blocks every open PR. - `test_pods_filter_pagination_and_ordering` calls a helper that no longer exists. Replaced with `Metrics.load_from_file(get_testdata_file_path(...))`, matching the two other tests that seed `pods_phases.jsonl`. #### Additional Information - How it broke: #12460 replaced the module-level `_load_pods_metrics` with a `load_pods_metrics` fixture, then #12462 dropped that fixture in favour of calling `Metrics.load_from_file` directly. #12278 branched before either landed and merged after, re-introducing one call to the long-gone helper. Git merged cleanly because the branches touched different lines, so nothing flagged it. - No behaviour change: the broken call passed no `start_time`, so no placeholder substitution happened; `load_from_file` with `label_substitutions=None` does the same earliest-to-`base_time` rebase. The replacement is byte-identical to the two sibling call sites for the same dataset.	2026-08-08 19:35:18 +00:00
Swapnil Nakade	bfa174ce2a	refactor: removing logs support for gcp integration services (#12471 ) Some checks failed build-staging / prepare (push) Has been cancelled Details build-staging / js-build (push) Has been cancelled Details build-staging / go-build (push) Has been cancelled Details build-staging / staging (push) Has been cancelled Details cacheci / tests (push) Has been cancelled Details Release Drafter / update_release_draft (push) Has been cancelled Details <!--A few plain bullets saying what changed and why, for a reviewer skimming it - not a wall of text, not a restatement of the diff, not generated boilerplate.--> #### Description Disabling logs support for all GCP integration services. Reasons: 1. googlecloudpubsubpush receiver needs to reach Alpha stability, thus not included in contrib build -> can't suggest for logs 2. signoz otel collector includes this receiver in the build but it needs upgrade to v0.158.0 for a metrics related [fix](https://github.com/open-telemetry/opentelemetry-collector-contrib/pull/49826) -> needs more testing hence can't suggest either Decision was taken to go ahead without logs for now - follow [ticket here](https://github.com/SigNoz/platform-pod/issues/2901) for details. <!--Reference issues using `Closes #issue-number` to enable automatic closure on merge. --> #### Contributes to https://github.com/SigNoz/platform-pod/issues/2901 <!--Anything reviewers should keep in mind while reviewing --> #### Additional Information The explanation above should be enough <!--Please delete paragraphs that you did not use before submitting.-->	2026-08-08 11:03:25 +00:00
Nikhil Mantri	85bf5ce644	feat(infra-monitoring): filter by pod status (#12278 ) ## Pull Request --- ### 📄 Summary Adds a `filterByPodStatus` secondary filter to the v2 infra-monitoring list APIs (pods, nodes, namespaces, clusters, deployments, statefulsets, jobs, daemonsets). Pod status is a derived kubectl-style value (`k8s.pod.phase` + status reasons, resolved via `argMax`), not a real label, so it can't go through the normal query-builder filter. This PR resolves the full-scope status keyset up-front and intersects it with the metadata + ranked groups, keeping `total` and pagination correct. - Multi-select: the field is an array, pushed down as `WHERE lower(display_status) IN (...)` (OR within status, AND with the attribute filter). - When the optional status metrics were never ingested, the endpoint returns a non-blocking warning + empty page instead of silently filtering everything out. #### Screenshots / Screen Recordings (if applicable) N/A — backend + generated FE API types only; the UI is a separate change. #### Issues closed by this PR Part of SigNoz/engineering-pod#5778. --- ### ✅ Change Type - [x] ✨ Feature - [ ] 🐛 Bug fix - [x] ♻️ Refactor - [ ] 🛠️ Infra / Tooling - [ ] 🧪 Test-only --- ### 🐛 Bug Context N/A — not a bug fix. --- ### 🧪 Testing Strategy - Tests added/updated: - Unit test for the status push-down (`applyPodStatusFilter`, built with go-sqlbuilder). - Integration tests across all 8 entity APIs: list mode, grouped mode, validation, missing-metric warning, and multi-select union. - Manual verification: smoke-tested against staging data (single, multi, and grouped filters). - Edge cases covered: missing status metric → warning + empty; grouped mode keeps a group if ≥1 pod matches; multi-select returns the union of the selected statuses. --- ### ⚠️ Risk & Impact Assessment - Blast radius: v2 infra-monitoring list endpoints only. - Potential regressions: none when the filter is unset (empty = off, fully additive). When set, an extra status query runs; it is gated behind the filter being present. - Rollback plan: revert the PR — no schema or data migrations involved. --- ### 📝 Changelog \| Field \| Value \| \|------\|-------\| \| Deployment Type \| OSS, Cloud, Enterprise \| \| Change Type \| Feature \| \| Description \| v2 infra-monitoring lists can now be filtered by pod status (multi-select). \| --- ### 📋 Checklist - [x] Tests added or explicitly not required - [x] Manually tested - [x] Breaking changes documented - [x] Backward compatibility considered --- ## 👀 Notes for Reviewers - `filterByPodStatus` is optional and additive — no change to existing responses when omitted. - The status keyset is resolved once at full scope, then intersected — this is what keeps `total`/pagination correct despite status being a post-aggregation value. - OpenAPI spec + FE API types are regenerated (scalar → array); no hand-written FE.	2026-08-08 10:56:48 +00:00
Nikhil Mantri	a654f648ee	fix(infra-monitoring): the count query's alias collision when groupBy overlaps counted attrs (#12451 ) ## Pull Request --- ### 📄 Summary The infra-monitoring v2 clusters/namespaces list APIs 500 with ClickHouse error 179 (`MULTIPLE_EXPRESSIONS_FOR_ALIAS`) when the request groups by an attribute that is also a counted resource attribute (e.g. clusters grouped by `k8s.node.name` or `k8s.namespace.name`, namespaces grouped by `k8s.deployment.name`). Root cause: `getPerGroupDistinctCounts` aliases each `uniqExactIf(...)` count column with the bare attr key, which collides with the groupBy column alias for the same key. Fix: alias count columns as `__count_<attr>`. Row scanning is positional and the result map is keyed in Go from `attrNames`, so nothing downstream changes. Integration tests: clusters API grouped by `k8s.namespace.name` and namespaces API grouped by `k8s.deployment.name`, with exact per-group `counts` assertions (identity-tuple semantics). Both reproduce the 500 on the pre-fix build and pass on the fixed build. #### Issues closed by this PR Closes https://github.com/SigNoz/pulse-pod/issues/245 ### ✅ Change Type _Select all that apply_ - [ ] ✨ Feature - [x] 🐛 Bug fix - [ ] ♻️ Refactor - [ ] 🛠️ Infra / Tooling - [ ] 🧪 Test-only --- ### 🧪 Testing Strategy - Tests added/updated: Yes — integration (`04_namespaces.py`, `05_clusters.py`): new groupBy-on-counted-attr cases + per-group `counts` assertions on existing cases - Manual verification: Yes — replayed the failing production query with the fixed aliasing against ClickHouse - Edge cases covered: groupBy overlapping a counted attr; same-named deployment across namespaces counted as distinct entities --- ### ⚠️ Risk & Impact Assessment - Blast radius: Infrastructure Monitoring — clusters & namespaces list APIs (counts query) - Potential regressions: None — SQL alias rename only; scanning is positional and result map keys are unchanged - Rollback plan: Revert this commit --- ### 📝 Changelog \| Field \| Value \| \|------\|-------\| \| Deployment Type \| Cloud / OSS / Enterprise \| \| Change Type \| Bug Fix \| \| Description \| Fixed a 500 error in Infrastructure Monitoring clusters/namespaces APIs when grouping by an attribute that is also part of the resource counts (e.g. node, namespace, or deployment name). \| --- ### 📋 Checklist - [x] Tests added or explicitly not required - [x] Manually tested - [ ] Breaking changes documented - [x] Backward compatibility considered	2026-08-08 10:51:40 +00:00
Nikhil Soni	a81c7d3f97	fix(sqlmigration): skip saved views with dangling org_id in migration 109 (#12469 ) ## Summary - `restructureSavedViewSpec` (migration 109) bulk-inserts legacy `saved_views` rows into the new `saved_view` table, which has an enforced `org_id -> organizations(id)` FK (sqlite runs with `foreign_keys=ON`). - Some tenants hit `constraint failed: FOREIGN KEY constraint failed (787)` on startup because a row's `org_id` didn't match any live organization -- e.g. an org deleted before the old table had a cascading FK, or an install where `org_id` was never backfilled (`015_update_dashboards_savedviews` only backfills it when there's exactly one org). - Fix: fetch live organization IDs up front inside the same transaction, and skip (with a `WarnContext` log, counted in `skipped`) any row whose non-empty `org_id` isn't among them -- same treatment as the existing empty-`org_id` skip. Followup to https://github.com/SigNoz/signoz/pull/12342 Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-08 07:03:40 +00:00