fix: check user attach on reset token issue, list tokens collection-wide

PUT /api/v2/users/{id}/reset_password_tokens issues a credential for the
target user, so it now declares a parent-child def requiring attach on the
user alongside factor-password:create on the instance (mirroring the
/api/v1/service_accounts/{id}/keys pattern).

GET on the same path enumerates the user's tokens, so it checks
factor-password:list on the wildcard (list is a collection-level verb; the
path id is only a filter) instead of factor-password:read on the instance.

.claude/opencode.json

@@ -1,7 +0,0 @@
-{
-  "$schema": "https://opencode.ai/config.json",
-  "lsp": true,
-  "experimental": {
-    "disable_paste_summary": true
-  }
-}

.claude/rules/comments.md

@@ -7,6 +7,5 @@ Applies to everything in the repo — code, config, workflows.
 - **Rationale goes in prose, not source.** Why a version is pinned, why a job exists, how a subsystem fits together — that belongs in the README or the PR.
 - **Never remove pre-existing comments** when editing code. The bar above applies to comments you write, not comments already there.
 - **Never talk to the reviewer.** No comments about where a change came from, what was changed, or why the change is correct — that belongs in the PR description and is noise the moment it merges.
-- **Less is more.** When writing something intended for human consumption, (comment, commit message, reply to prompt) use as few words as possible. Pick every word meticulously to reduce the volume to a strict minimum. Be down to the point. Less is more.
 
 Language rules build on this one: [`go-comments`](go-comments.md), [`py-comments`](py-comments.md).

.claude/rules/go-contrib.md

@@ -1,16 +0,0 @@
----
-paths:
-  - "**/*.go"
----
-
-# Contribution guidelines
-
-- When making Go changes, always ensure they follow the contributing guildelines in [`docs/contributing/go/`](../../docs/contributing/go/).
-- Look for existing patterns in the codebase for any change before implementing the changes.
-- If any API contract is modified, generate the OpenAPI specs with `make gen-openapi-specs`.
-- Always keep the OpenAPI spec generated in a separate commit, so the whole commit can be dropped in case of conflicts during merge. Do not try to resolve conflict in generated files, instead just generate them again.
-- Avoid breaking function calls unncessarily into multilines for couple of arguments.
-- Try to keep most computational only logic in types package itself related to a domain type, use modules as the orchestraction layer cordinating different layers and all db queries in store layer. Check the serviceaccount modules for inspiration when confused.
-- When defining types, keep the structure of file to have any constants and variables first, then exported types and exported methods and then finally the unexported types and methods.
-- Never import types or other modules in migration files, duplicate the required type or method to keep migration free from changes.
-- Always run the gofmt tool for formating beforing commiting any changes.

.claude/rules/go-test.md

@@ -1,12 +0,0 @@
----
-paths:
-  - "**/*_test.go"
----
-
-# Go tests
-
-- **testify + table-driven.** Use `assert` / `require`; prefer table-driven cases. Tests live next to the source file.
-- **`require` vs `assert`.** `require` for anything the rest of the test cannot proceed without — setup, `require.NoError(t, err)`, nil/length checks before indexing or dereferencing. `assert` for the actual expectations, so one failed check still reports the rest.
-- **Mock with mockery.** When an interface needs mocking, list it in `.mockery.yml` and run `mockery`; never hand-write mocks. Generated mocks live in the source package's `<pkg>test` sibling (e.g. `resourcestest.NewMockAdapter(t)`).
-- **Table format.** Declare cases as `testCases := []struct{ name string; ... }` and iterate with `for _, testCase := range testCases { t.Run(testCase.name, ...) }` — the variables are named `testCases` / `testCase`. Case names are PascalCase segments joined by `_`, one segment per aspect (scenario, condition, expectation): `TimestampNotNullNoDefault`, `DropPrimaryKeyConstraint_AlterColumnNullable`, `ForeignKeyConstraint_DoesNotExist_SCreateAndDropConstraintTrue`.
-- **No hoisted test constants.** When goconst flags a repeated literal in a test, vary the fixture strings across cases instead of hoisting a constant — never introduce a shared const for test data. 

.claude/rules/pull-requests.md

@@ -2,10 +2,6 @@
 
 - **Follow the template** (`.github/pull_request_template.md`): fill in its headings (Description / Issues closed by this PR / Screenshots / Additional Information). Don't add sections the template doesn't have.
 - **Keep only the headings that apply.** Delete every heading that has nothing under it, along with its `<!--...-->` placeholder comment. The body must never contain an empty heading — if only Description applies, the body has exactly that one heading.
-- **Keep the description concise and human-readable.** A few non repetitive bullets saying what changed and why, for a reviewer skimming it — not a wall of text, not a restatement of the diff, not generated boilerplate and not the user agent conversation details.
+- **Keep the description concise and human-readable.** A few plain bullets saying what changed and why, for a reviewer skimming it — not a wall of text, not a restatement of the diff, not generated boilerplate.
 - **Reference issues with `Closes #issue-number`** under "Issues closed by this PR" so they auto-close on merge. This goes in the PR description only — never in commit messages.
-- **Breaking changes can be added in additional information section** if any.
 - **AI assistance in commits may optionally be disclosed with an `Assisted-by:` trailer** naming the model (e.g. `Assisted-by: Claude Opus 4.5`) — do NOT use a `Co-authored-by:` trailer for this.
-- **Keep the commit body short and human readable** focused on decision made if any. Commit body must not re-iterate the changes done, skip if title is sufficient in conveying the change.
-- **Use convensional commit format** for commits and PR title.
-- **Do not amend the commits once pushed.** Always create a new commit once changes are pushed to remote.

.github/CODEOWNERS

@@ -15,10 +15,6 @@
 .github @therealpandey
 go.mod @therealpandey
 
-# Security
-
-/SECURITY.md @therealpandey
-
 # Scaffold Owners
 
 /pkg/config/ @therealpandey

.gitignore

@@ -232,4 +232,3 @@ pyrightconfig.json
 # dev
 .dev/
 .claude/worktrees/
-.claude/settings.local.json

Makefile

@@ -81,13 +81,10 @@ devenv-clickhouse-clean: ## Clean all ClickHouse data from filesystem
 ##############################################################
 # go commands
 ##############################################################
-SIGNOZ_SQLSTORE_SQLITE_PATH ?= signoz.db
-SIGNOZ_APISERVER_ADDRESS    ?= 0.0.0.0:8080
-
 .PHONY: go-run-enterprise
 go-run-enterprise: ## Runs the enterprise go backend server
 	@SIGNOZ_INSTRUMENTATION_LOGS_LEVEL=debug \
-	SIGNOZ_SQLSTORE_SQLITE_PATH=$(SIGNOZ_SQLSTORE_SQLITE_PATH) \
+	SIGNOZ_SQLSTORE_SQLITE_PATH=signoz.db \
 	SIGNOZ_WEB_ENABLED=false \
 	SIGNOZ_TOKENIZER_JWT_SECRET=secret \
 	SIGNOZ_ALERTMANAGER_PROVIDER=signoz \
@@ -104,7 +101,7 @@ go-test: ## Runs go unit tests
 .PHONY: go-run-community
 go-run-community: ## Runs the community go backend server
 	@SIGNOZ_INSTRUMENTATION_LOGS_LEVEL=debug \
-	SIGNOZ_SQLSTORE_SQLITE_PATH=$(SIGNOZ_SQLSTORE_SQLITE_PATH) \
+	SIGNOZ_SQLSTORE_SQLITE_PATH=signoz.db \
 	SIGNOZ_WEB_ENABLED=false \
 	SIGNOZ_TOKENIZER_JWT_SECRET=secret \
 	SIGNOZ_ALERTMANAGER_PROVIDER=signoz \
@@ -114,28 +111,6 @@ go-run-community: ## Runs the community go backend server
 	go run -race \
 		$(GO_BUILD_CONTEXT_COMMUNITY)/*.go server
 
-.PHONY: go-stop
-go-stop: ## Stops the go backend server listening on SIGNOZ_APISERVER_ADDRESS, waiting for it to release every port it holds
-	@PORT=$(lastword $(subst :, ,$(SIGNOZ_APISERVER_ADDRESS))); \
-	PIDS=$$(lsof -ti tcp:$$PORT); \
-	if [ -z "$$PIDS" ]; then \
-		echo "No signoz server running on port $$PORT."; \
-		echo "If it's running on a different port, rerun as: make go-stop SIGNOZ_APISERVER_ADDRESS=host:port"; \
-		exit 0; \
-	fi; \
-	kill $$PIDS 2>/dev/null; \
-	for i in $$(seq 1 10); do \
-		alive=$$(for p in $$PIDS; do kill -0 $$p 2>/dev/null && echo $$p; done); \
-		[ -z "$$alive" ] && break; \
-		sleep 1; \
-	done; \
-	alive=$$(for p in $$PIDS; do kill -0 $$p 2>/dev/null && echo $$p; done); \
-	if [ -n "$$alive" ]; then \
-		echo "Graceful shutdown did not finish in 10s, sending SIGKILL to $$alive"; \
-		kill -9 $$alive 2>/dev/null; \
-	fi; \
-	echo "Stopped signoz server on port $$PORT (pid $$PIDS)"
-
 .PHONY: go-build-community $(GO_BUILD_ARCHS_COMMUNITY)
 go-build-community: ## Builds the go backend server for community
 go-build-community: $(GO_BUILD_ARCHS_COMMUNITY)
@@ -266,8 +241,3 @@ semconv-generate: ## Regenerate semantic-convention families for Go and TypeScri
 gen-mocks:
 	@echo ">> Generating mocks"
 	@mockery --config .mockery.yml
-
-.PHONY: gen-openapi-specs
-gen-openapi-specs:
-	@go run cmd/enterprise/*.go generate openapi
-	cd frontend && pnpm generate:api && cd -

SECURITY.md

@@ -1,26 +1,17 @@
 # Security Policy
 
-SigNoz is looking forward to working with security researchers across the world to keep SigNoz and our users safe. If you have found an issue in our systems/applications, please report it to us privately.
+SigNoz is looking forward to working with security researchers across the world to keep SigNoz and our users safe. If you have found an issue in our systems/applications, please reach out to us.
 
 ## Supported Versions
-
-We always recommend using the latest version of SigNoz to ensure you get all security updates.
+We always recommend using the latest version of SigNoz to ensure you get all security updates
 
 ## Reporting a Vulnerability
 
 If you believe you have found a security vulnerability within SigNoz, please let us know right away. We'll try and fix the problem as soon as possible.
 
-**Do not report vulnerabilities using public GitHub issues, discussions, or pull requests.**
+**Do not report vulnerabilities using public GitHub issues**. Instead, email <security@signoz.io> with a detailed account of the issue. Please submit one issue per email, this helps us triage vulnerabilities.
 
-Instead, report it privately through GitHub's private vulnerability reporting:
-
-1. Go to the [**Security** tab](https://github.com/SigNoz/signoz/security) of this repository.
-2. Click **Report a vulnerability**, or use [this link](https://github.com/SigNoz/signoz/security/advisories/new).
-3. Describe the issue with as much detail as you can — affected version, impact, and steps to reproduce help us triage faster. Please submit one report per vulnerability.
-
-This opens a private advisory visible only to you and the SigNoz maintainers. We'll respond there, keep you updated as we work on a fix, and coordinate disclosure. If the report is valid we'll credit you on the published advisory and request a CVE.
-
-If you're unable to use GitHub's private reporting, you can email <security@signoz.io> instead.
+Once we've received your email we'll keep you updated as we fix the vulnerability.
 
 ## Thanks
 

conf/example.yaml

@@ -138,18 +138,6 @@ sqlstore:
 
 ##################### APIServer #####################
 apiserver:
-  # The TCP address the API server listens on, in the form "host:port".
-  address: 0.0.0.0:8080
-  # Maximum duration for reading an entire request, including the body.
-  read_timeout: 60s
-  # Keep at 0; any value cuts off streaming endpoints (livetail, SSE, export_raw_data).
-  write_timeout: 0
-  # tls:
-  #   enabled: true
-  #   cert_file: /path/to/server.crt
-  #   key_file: /path/to/server.key
-  #   # Minimum TLS version: "1.2" or "1.3". Defaults to "1.2".
-  #   min_version: "1.2"
   timeout:
     # Default request timeout.
     default: 60s

docs/api/openapi.yml

@@ -8616,98 +8616,6 @@ components:
         message:
           type: string
       type: object
-    RuletypesLabelPair:
-      properties:
-        key:
-          type: string
-        value:
-          type: string
-      required:
-      - key
-      - value
-      type: object
-    RuletypesListOrder:
-      enum:
-      - asc
-      - desc
-      type: string
-    RuletypesListSort:
-      enum:
-      - updated_at
-      - created_at
-      - name
-      - state
-      - severity
-      type: string
-    RuletypesListableRule:
-      properties:
-        alert:
-          type: string
-        alertType:
-          $ref: '#/components/schemas/RuletypesAlertType'
-        createdAt:
-          format: date-time
-          type: string
-        createdBy:
-          type: string
-        description:
-          type: string
-        disabled:
-          type: boolean
-        id:
-          type: string
-        labels:
-          additionalProperties:
-            type: string
-          type: object
-        ruleType:
-          $ref: '#/components/schemas/RuletypesRuleType'
-        state:
-          $ref: '#/components/schemas/RuletypesAlertState'
-        updatedAt:
-          format: date-time
-          type: string
-        updatedBy:
-          type: string
-      required:
-      - id
-      - state
-      - alert
-      - alertType
-      - ruleType
-      type: object
-    RuletypesListableRuleViews:
-      properties:
-        views:
-          items:
-            $ref: '#/components/schemas/RuletypesRuleView'
-          type: array
-      required:
-      - views
-      type: object
-    RuletypesListableRules:
-      properties:
-        labels:
-          items:
-            $ref: '#/components/schemas/RuletypesLabelPair'
-          type: array
-        reservedKeywords:
-          items:
-            type: string
-          type: array
-        rules:
-          items:
-            $ref: '#/components/schemas/RuletypesListableRule'
-          type: array
-        total:
-          format: int64
-          type: integer
-      required:
-      - rules
-      - total
-      - labels
-      - reservedKeywords
-      type: object
     RuletypesMatchType:
       enum:
       - at_least_once
@@ -8782,16 +8690,6 @@ components:
       - ruleType
       - condition
       type: object
-    RuletypesPostableRuleView:
-      properties:
-        data:
-          $ref: '#/components/schemas/RuletypesRuleViewData'
-        name:
-          type: string
-      required:
-      - name
-      - data
-      type: object
     RuletypesQueryType:
       enum:
       - builder
@@ -8930,45 +8828,6 @@ components:
       - promql_rule
       - anomaly_rule
       type: string
-    RuletypesRuleView:
-      properties:
-        createdAt:
-          format: date-time
-          type: string
-        data:
-          $ref: '#/components/schemas/RuletypesRuleViewData'
-        id:
-          type: string
-        name:
-          type: string
-        orgId:
-          type: string
-        updatedAt:
-          format: date-time
-          type: string
-      required:
-      - id
-      - name
-      - data
-      - orgId
-      type: object
-    RuletypesRuleViewData:
-      properties:
-        order:
-          $ref: '#/components/schemas/RuletypesListOrder'
-        query:
-          type: string
-        sort:
-          $ref: '#/components/schemas/RuletypesListSort'
-        states:
-          items:
-            type: string
-          type: array
-        version:
-          type: string
-      required:
-      - version
-      type: object
     RuletypesScheduleType:
       enum:
       - hourly
@@ -20449,243 +20308,17 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - role:read
       - tokenizer:
-        - ADMIN
+        - role:read
       summary: Get users by role id
       tags:
       - users
-  /api/v2/rule_views:
-    get:
-      deprecated: false
-      description: Returns every saved view in the calling user's org. Saved views
-        are shared org-wide.
-      operationId: ListRuleViews
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/RuletypesListableRuleViews'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - VIEWER
-      - tokenizer:
-        - VIEWER
-      summary: List rule saved views
-      tags:
-      - rules
-    post:
-      deprecated: false
-      description: Persists the calling user's rule listing state (query, states,
-        sort, order) as a named, reusable view shared across the org.
-      operationId: CreateRuleView
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RuletypesPostableRuleView'
-      responses:
-        "201":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/RuletypesRuleView'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: Created
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - VIEWER
-      - tokenizer:
-        - VIEWER
-      summary: Create rule saved view
-      tags:
-      - rules
-  /api/v2/rule_views/{id}:
-    delete:
-      deprecated: false
-      description: Removes a saved view. Saved views are shared org-wide. Deleting
-        a non-existent view returns 404.
-      operationId: DeleteRuleView
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      responses:
-        "204":
-          description: No Content
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - VIEWER
-      - tokenizer:
-        - VIEWER
-      summary: Delete rule saved view
-      tags:
-      - rules
-    put:
-      deprecated: false
-      description: Replaces a saved view's name and data. Saved views are shared org-wide.
-      operationId: UpdateRuleView
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/RuletypesPostableRuleView'
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/RuletypesRuleView'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - VIEWER
-      - tokenizer:
-        - VIEWER
-      summary: Update rule saved view
-      tags:
-      - rules
   /api/v2/rules:
     get:
-      deprecated: true
-      description: 'This endpoint lists all alert rules with their current evaluation
-        state. Deprecated: use ListRulesV3, which supports filtering, sorting and
-        pagination.'
+      deprecated: false
+      description: This endpoint lists all alert rules with their current evaluation
+        state
       operationId: ListRules
       responses:
         "200":
@@ -25239,9 +24872,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:attach
+        - role:attach
       - tokenizer:
-        - ADMIN
+        - user:attach
+        - role:attach
       summary: Create user role
       tags:
       - users
@@ -25291,9 +24926,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:detach
+        - role:detach
       - tokenizer:
-        - ADMIN
+        - user:detach
+        - role:detach
       summary: Delete user role
       tags:
       - users
@@ -25354,9 +24991,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user role
       tags:
       - users
@@ -25402,9 +25039,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:list
       - tokenizer:
-        - ADMIN
+        - user:list
       summary: List users v2
       tags:
       - users
@@ -25464,9 +25101,13 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:create
+        - user:attach
+        - role:attach
       - tokenizer:
-        - ADMIN
+        - user:create
+        - user:attach
+        - role:attach
       summary: Create user
       tags:
       - users
@@ -25510,9 +25151,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:delete
       - tokenizer:
-        - ADMIN
+        - user:delete
       summary: Delete user
       tags:
       - users
@@ -25567,9 +25208,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user by user id
       tags:
       - users
@@ -25623,9 +25264,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:update
       - tokenizer:
-        - ADMIN
+        - user:update
       summary: Update user v2
       tags:
       - users
@@ -25681,9 +25322,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - factor-password:list
       - tokenizer:
-        - ADMIN
+        - factor-password:list
       summary: Get reset password token for a user
       tags:
       - users
@@ -25746,9 +25387,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - factor-password:create
+        - user:attach
       - tokenizer:
-        - ADMIN
+        - factor-password:create
+        - user:attach
       summary: Create or regenerate reset password token for a user
       tags:
       - users
@@ -25806,9 +25449,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user roles
       tags:
       - users
@@ -26467,90 +26110,6 @@ paths:
       summary: Get metric dashboards (v2)
       tags:
       - metrics
-  /api/v3/rules:
-    get:
-      deprecated: false
-      description: Returns a page of alert rules with their current evaluation state,
-        trimmed to the fields the list page renders. Supports a filter DSL (`query`),
-        a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`),
-        order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). The
-        response also carries the org's label pairs and the reserved filter keys for
-        building filter suggestions.
-      operationId: ListRulesV3
-      parameters:
-      - in: query
-        name: query
-        schema:
-          type: string
-      - in: query
-        name: states
-        schema:
-          items:
-            type: string
-          type: array
-      - in: query
-        name: sort
-        schema:
-          $ref: '#/components/schemas/RuletypesListSort'
-      - in: query
-        name: order
-        schema:
-          $ref: '#/components/schemas/RuletypesListOrder'
-      - in: query
-        name: limit
-        schema:
-          type: integer
-      - in: query
-        name: offset
-        schema:
-          type: integer
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/RuletypesListableRules'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - VIEWER
-      - tokenizer:
-        - VIEWER
-      summary: List alert rules (v3)
-      tags:
-      - rules
   /api/v3/traces/{traceID}/flamegraph:
     post:
       deprecated: false

docs/contributing/development.md

@@ -83,13 +83,7 @@ This command:
 
    You should see: `{"status":"ok"}`
 
-3. Stop it when you're done:
-   ```bash
-   make go-stop
-   ```
-
-> 💡 **Tip**: The API server runs at `http://localhost:8080/` by default. You can configure this using `apiserver.address` configuration option. See
-> [running more than one instance](#how-do-i-run-more-than-one-instance) if you need that for agentic testing.
+> 💡 **Tip**: The API server runs at `http://localhost:8080/` by default
 
 ### 4. Setting up the Frontend
 
@@ -125,36 +119,6 @@ To verify everything is working correctly:
 3. **Check Backend**: `curl http://localhost:8080/api/v1/health` (should return `{"status":"ok"}`)
 4. **Check Frontend**: Open `http://localhost:3301` in your browser
 
-## How do I run more than one instance?
-
-Handy when you keep several branches checked out as separate git worktrees. Every port
-and path below is read from the environment, so set them on the `make` call:
-
-```bash
-SIGNOZ_APISERVER_ADDRESS=0.0.0.0:8081 \
-SIGNOZ_SQLSTORE_SQLITE_PATH=/path/to/main/sqlite.db \
-SIGNOZ_INSTRUMENTATION_METRICS_READERS_PULL_EXPORTER_PROMETHEUS_PORT=9091 \
-make go-run-community
-```
-
-| Variable | Default | Why you'd change it |
-| --- | --- | --- |
-| `SIGNOZ_APISERVER_ADDRESS` | `0.0.0.0:8080` | Address the API server listens on |
-| `SIGNOZ_SQLSTORE_SQLITE_PATH` | `signoz.db` in worktree | To reuse same database |
-| `SIGNOZ_INSTRUMENTATION_METRICS_READERS_PULL_EXPORTER_PROMETHEUS_PORT` | `9090` | Bound by the Prometheus metrics exporter on startup |
-
-Point the frontend at whichever backend you want, in `frontend/.env`:
-
-```env
-VITE_FRONTEND_API_ENDPOINT=http://localhost:8081
-```
-
-Stop an instance using the address it was started on:
-
-```bash
-make go-stop SIGNOZ_APISERVER_ADDRESS=0.0.0.0:8081
-```
-
 ## How to send test data?
 
 You can now send telemetry data to your local SigNoz instance:

docs/contributing/go/authz.md

@@ -121,7 +121,7 @@ The pieces:
 - **`ResourceDef`** — declares the resource, verb, audit category, how to extract the instance ID, and how to turn that ID into selectors. ID extractors live in [pkg/types/coretypes/extractor.go](/pkg/types/coretypes/extractor.go): `PathParam("id")`, `BodyJSONPath("data.id")`, `BodyJSONArray("ids")`, and `ResponseJSONPath("data.id")` for IDs only known after the handler runs (e.g. `create`).
 - **`SecuritySchemes`** — advertises the required scope (`resource.Scope(verb)`, e.g. `serviceaccount:create`) in the OpenAPI spec.
 
-For routes that link two resources, use `AttachDetachSiblingResourceDef` (both sides are authz-checked, e.g. attaching a role to a service account requires `attach` on **both** the service account and the role). For parent-child routes (e.g. creating an API key under a service account), both sides are checked too, but with different verbs: declare a `BasicResourceDef` checking the child with `create`/`delete`, alongside an `AttachDetachParentChildResourceDef` checking the parent with `attach`/`detach` (within that def the child is only recorded for audit) — see the `/api/v1/service_accounts/{id}/keys` route in [pkg/apiserver/signozapiserver/serviceaccount.go](/pkg/apiserver/signozapiserver/serviceaccount.go).
+For routes that link two resources, use `AttachDetachSiblingResourceDef` (both sides are authz-checked, e.g. attaching a role to a service account requires `attach` on **both** the service account and the role). If the target list is optional in the payload (e.g. `userRoles` at user creation), set `OptionalTargets`: when no target ids resolve, the attach is vacuous and the def is skipped entirely — without it, the empty-id contract would check collection-level access on the target. For parent-child routes (e.g. creating an API key under a service account), both sides are checked too, but with different verbs: declare a `BasicResourceDef` checking the child with `create`/`delete`, alongside an `AttachDetachParentChildResourceDef` checking the parent with `attach`/`detach` (within that def the child is only recorded for audit) — see the `/api/v1/service_accounts/{id}/keys` route in [pkg/apiserver/signozapiserver/serviceaccount.go](/pkg/apiserver/signozapiserver/serviceaccount.go).
 
 Prefer `CheckResources` with a `ResourceDef` for anything resource-shaped. The older coarse gates `ViewAccess`/`EditAccess`/`AdminAccess` only check "does the caller hold one of these roles" and give up per-resource granularity; `OpenAccess` performs no authorization (authentication still applies); `CheckWithoutClaims` serves anonymous routes such as public dashboards.
 

docs/contributing/go/service.md

@@ -191,7 +191,7 @@ A standalone service only has the `factory.Service` lifecycle i.e it does not se
         // ... dependencies ...
     ) user.Service {
         return &service{
-            settings: factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/user"),
+            settings: factory.NewScopedProviderSettings(providerSettings, "go.signoz.io/pkg/modules/user"),
             // ... dependencies ...
             stopC:    make(chan struct{}),
         }

ee/query-service/app/server.go

@@ -3,29 +3,56 @@ package app
 import (
 	"context"
 	"fmt"
+	"net"
+	"net/http"
+	"slices"
+
+	"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux"
+	"go.opentelemetry.io/otel/propagation"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+
+	"github.com/gorilla/handlers"
+
+	"github.com/rs/cors"
+	"github.com/soheilhy/cmux"
 
 	"github.com/SigNoz/signoz/ee/query-service/app/api"
 	"github.com/SigNoz/signoz/ee/query-service/usage"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
 	"github.com/SigNoz/signoz/pkg/signoz"
+	"github.com/SigNoz/signoz/pkg/web"
 
 	"log/slog"
 
 	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
+	baseapp "github.com/SigNoz/signoz/pkg/query-service/app"
 	"github.com/SigNoz/signoz/pkg/query-service/app/clickhouseReader"
 	"github.com/SigNoz/signoz/pkg/query-service/app/integrations"
 	"github.com/SigNoz/signoz/pkg/query-service/app/logparsingpipeline"
 	"github.com/SigNoz/signoz/pkg/query-service/app/opamp"
 	opAmpModel "github.com/SigNoz/signoz/pkg/query-service/app/opamp/model"
 	baseconst "github.com/SigNoz/signoz/pkg/query-service/constants"
+	"github.com/SigNoz/signoz/pkg/query-service/healthcheck"
+	"github.com/SigNoz/signoz/pkg/query-service/utils"
 )
 
-// Server runs auxiliary servers (opamp) alongside the signoz apiserver
+// Server runs HTTP, Mux and a grpc server
 type Server struct {
+	config signoz.Config
+	signoz *signoz.SigNoz
+
+	// public http router
+	httpConn     net.Listener
+	httpServer   *http.Server
+	httpHostPort string
+
 	opampServer *opamp.Server
 
 	// Usage manager
 	usageManager *usage.Manager
+
+	unavailableChannel chan healthcheck.Status
 }
 
 // NewServer creates and initializes Server
@@ -100,11 +127,57 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 		return nil, err
 	}
 
-	// Register the legacy query-service routes on the apiserver router. The
-	// apiserver owns the HTTP server and applies the middleware chain at serve
-	// time, so these routes get the same treatment as the apiserver routes.
-	r := signoz.APIServer.Router()
-	am := middleware.NewAuthZ(signoz.Instrumentation.Logger(), signoz.Modules.OrgGetter, signoz.Authz)
+	s := &Server{
+		config:             config,
+		signoz:             signoz,
+		httpHostPort:       baseconst.HTTPHostPort,
+		unavailableChannel: make(chan healthcheck.Status),
+		usageManager:       usageManager,
+	}
+
+	httpServer, err := s.createPublicServer(apiHandler, signoz.Web)
+
+	if err != nil {
+		return nil, err
+	}
+
+	s.httpServer = httpServer
+
+	s.opampServer = opamp.InitializeServer(
+		&opAmpModel.AllAgents, agentConfMgr, signoz.Instrumentation,
+	)
+
+	return s, nil
+}
+
+// HealthCheckStatus returns health check status channel a client can subscribe to
+func (s Server) HealthCheckStatus() chan healthcheck.Status {
+	return s.unavailableChannel
+}
+
+func (s *Server) createPublicServer(apiHandler *api.APIHandler, web web.Web) (*http.Server, error) {
+	r := baseapp.NewRouter()
+	am := middleware.NewAuthZ(s.signoz.Instrumentation.Logger(), s.signoz.Modules.OrgGetter, s.signoz.Authz)
+
+	r.Use(middleware.NewRecovery(s.signoz.Instrumentation.Logger()).Wrap)
+	r.Use(otelmux.Middleware(
+		"apiserver",
+		otelmux.WithMeterProvider(s.signoz.Instrumentation.MeterProvider()),
+		otelmux.WithTracerProvider(s.signoz.Instrumentation.TracerProvider()),
+		otelmux.WithPropagators(propagation.NewCompositeTextMapPropagator(propagation.Baggage{}, propagation.TraceContext{})),
+		otelmux.WithFilter(func(r *http.Request) bool {
+			return !slices.Contains([]string{"/api/v1/health"}, r.URL.Path)
+		}),
+	))
+	r.Use(middleware.NewIdentN(s.signoz.IdentNResolver, s.signoz.Sharder, s.signoz.Instrumentation.Logger()).Wrap)
+	r.Use(middleware.NewTimeout(s.signoz.Instrumentation.Logger(),
+		s.config.APIServer.Timeout.ExcludedRoutes,
+		s.config.APIServer.Timeout.Default,
+		s.config.APIServer.Timeout.Max,
+	).Wrap)
+	r.Use(middleware.NewResource(s.signoz.Instrumentation.Logger()).Wrap)
+	r.Use(middleware.NewAudit(s.signoz.Instrumentation.Logger(), s.config.APIServer.Logging.ExcludedRoutes, s.signoz.Auditor).Wrap)
+	r.Use(middleware.NewComment().Wrap)
 
 	apiHandler.RegisterRoutes(r, am)
 	apiHandler.RegisterLogsRoutes(r, am)
@@ -115,29 +188,107 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 	apiHandler.RegisterThirdPartyApiRoutes(r, am)
 	apiHandler.RegisterTraceFunnelsRoutes(r, am)
 
-	s := &Server{
-		usageManager: usageManager,
+	err := s.signoz.APIServer.AddToRouter(r)
+	if err != nil {
+		return nil, err
 	}
 
-	s.opampServer = opamp.InitializeServer(
-		&opAmpModel.AllAgents, agentConfMgr, signoz.Instrumentation,
-	)
+	c := cors.New(cors.Options{
+		AllowedOrigins: []string{"*"},
+		AllowedMethods: []string{"GET", "DELETE", "POST", "PUT", "PATCH", "OPTIONS"},
+		AllowedHeaders: []string{"Accept", "Authorization", "Content-Type", "cache-control"},
+	})
 
-	return s, nil
+	handler := c.Handler(r)
+
+	handler = handlers.CompressHandler(handler)
+
+	err = web.AddToRouter(r)
+	if err != nil {
+		return nil, err
+	}
+
+	routePrefix := s.config.Global.ExternalPath()
+	if routePrefix != "" {
+		prefixed := http.StripPrefix(routePrefix, handler)
+		handler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			switch req.URL.Path {
+			case "/api/v1/health", "/api/v2/healthz", "/api/v2/readyz", "/api/v2/livez":
+				r.ServeHTTP(w, req)
+				return
+			}
+
+			prefixed.ServeHTTP(w, req)
+		})
+	}
+
+	return &http.Server{
+		Handler: handler,
+	}, nil
 }
 
-// Start starts the opamp websocket server. The HTTP API server is started by
-// the signoz registry.
-func (s *Server) Start(ctx context.Context) error {
-	slog.Info("Starting OpAmp Websocket server", "addr", baseconst.OpAmpWsEndpoint)
-	if err := s.opampServer.Start(baseconst.OpAmpWsEndpoint); err != nil {
+// initListeners initialises listeners of the server
+func (s *Server) initListeners() error {
+	// listen on public port
+	var err error
+	publicHostPort := s.httpHostPort
+	if publicHostPort == "" {
+		return fmt.Errorf("baseconst.HTTPHostPort is required")
+	}
+
+	s.httpConn, err = net.Listen("tcp", publicHostPort)
+	if err != nil {
 		return err
 	}
 
+	slog.Info(fmt.Sprintf("Query server started listening on %s...", s.httpHostPort))
+
+	return nil
+}
+
+// Start listening on http and private http port concurrently
+func (s *Server) Start(ctx context.Context) error {
+	err := s.initListeners()
+	if err != nil {
+		return err
+	}
+
+	var httpPort int
+	if port, err := utils.GetPort(s.httpConn.Addr()); err == nil {
+		httpPort = port
+	}
+
+	go func() {
+		slog.Info("Starting HTTP server", "port", httpPort, "addr", s.httpHostPort)
+
+		switch err := s.httpServer.Serve(s.httpConn); err {
+		case nil, http.ErrServerClosed, cmux.ErrListenerClosed:
+			// normal exit, nothing to do
+		default:
+			slog.Error("Could not start HTTP server", errors.Attr(err))
+		}
+		s.unavailableChannel <- healthcheck.Unavailable
+	}()
+
+	go func() {
+		slog.Info("Starting OpAmp Websocket server", "addr", baseconst.OpAmpWsEndpoint)
+		err := s.opampServer.Start(baseconst.OpAmpWsEndpoint)
+		if err != nil {
+			slog.Error("opamp ws server failed to start", errors.Attr(err))
+			s.unavailableChannel <- healthcheck.Unavailable
+		}
+	}()
+
 	return nil
 }
 
 func (s *Server) Stop(ctx context.Context) error {
+	if s.httpServer != nil {
+		if err := s.httpServer.Shutdown(ctx); err != nil {
+			return err
+		}
+	}
+
 	s.opampServer.Stop()
 
 	// stop usage manager

ee/sqlstore/postgressqlstore/formatter.go

@@ -23,15 +23,6 @@ func (f *formatter) JSONExtractString(column, path string) []byte {
 	return append(f.TextToJsonColumn(column), ops...)
 }
 
-func (f *formatter) JSONExtractMapValue(column, mapField, key string) []byte {
-	sql := f.TextToJsonColumn(column)
-	sql = append(sql, "->"...)
-	sql = schema.Append(f.bunf, sql, mapField)
-	sql = append(sql, "->>"...)
-	sql = schema.Append(f.bunf, sql, key)
-	return sql
-}
-
 func (f *formatter) JSONType(column, path string) []byte {
 	var sql []byte
 	sql = append(sql, "jsonb_typeof("...)

ee/sqlstore/postgressqlstore/formatter_test.go

@@ -55,39 +55,6 @@ func TestJSONExtractString(t *testing.T) {
 	}
 }
 
-func TestJSONExtractMapValue(t *testing.T) {
-	tests := []struct {
-		name     string
-		column   string
-		mapField string
-		key      string
-		expected string
-	}{
-		{
-			name:     "plain key",
-			column:   "data",
-			mapField: "labels",
-			key:      "team",
-			expected: `"data"::jsonb->'labels'->>'team'`,
-		},
-		{
-			name:     "dotted key stays one map entry",
-			column:   "data",
-			mapField: "labels",
-			key:      "k8s.cluster",
-			expected: `"data"::jsonb->'labels'->>'k8s.cluster'`,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			f := newFormatter(pgdialect.New())
-			got := string(f.JSONExtractMapValue(tt.column, tt.mapField, tt.key))
-			assert.Equal(t, tt.expected, got)
-		})
-	}
-}
-
 func TestJSONType(t *testing.T) {
 	tests := []struct {
 		name     string

frontend/src/api/generated/services/rules/index.ts

@@ -19,9 +19,7 @@ import type {
 
 import type {
 	CreateRule201,
-	CreateRuleView201,
 	DeleteRuleByIDPathParameters,
-	DeleteRuleViewPathParameters,
 	GetRuleByID200,
 	GetRuleByIDPathParameters,
 	GetRuleHistoryFilterKeys200,
@@ -42,372 +40,20 @@ import type {
 	GetRuleHistoryTopContributors200,
 	GetRuleHistoryTopContributorsParams,
 	GetRuleHistoryTopContributorsPathParameters,
-	ListRuleViews200,
 	ListRules200,
-	ListRulesV3200,
-	ListRulesV3Params,
 	PatchRuleByID200,
 	PatchRuleByIDPathParameters,
 	RenderErrorResponseDTO,
 	RuletypesPostableRuleDTO,
-	RuletypesPostableRuleViewDTO,
 	TestRule200,
 	UpdateRuleByIDPathParameters,
-	UpdateRuleView200,
-	UpdateRuleViewPathParameters,
 } from '../sigNoz.schemas';
 
 import { GeneratedAPIInstance } from '../../../generatedAPIInstance';
 import type { ErrorType, BodyType } from '../../../generatedAPIInstance';
 
 /**
- * Returns every saved view in the calling user's org. Saved views are shared org-wide.
- * @summary List rule saved views
- */
-export const listRuleViews = (signal?: AbortSignal) => {
-	return GeneratedAPIInstance<ListRuleViews200>({
-		url: `/api/v2/rule_views`,
-		method: 'GET',
-		signal,
-	});
-};
-
-export const getListRuleViewsQueryKey = () => {
-	return [`/api/v2/rule_views`] as const;
-};
-
-export const getListRuleViewsQueryOptions = <
-	TData = Awaited<ReturnType<typeof listRuleViews>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(options?: {
-	query?: UseQueryOptions<
-		Awaited<ReturnType<typeof listRuleViews>>,
-		TError,
-		TData
-	>;
-}) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey = queryOptions?.queryKey ?? getListRuleViewsQueryKey();
-
-	const queryFn: QueryFunction<Awaited<ReturnType<typeof listRuleViews>>> = ({
-		signal,
-	}) => listRuleViews(signal);
-
-	return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
-		Awaited<ReturnType<typeof listRuleViews>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type ListRuleViewsQueryResult = NonNullable<
-	Awaited<ReturnType<typeof listRuleViews>>
->;
-export type ListRuleViewsQueryError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary List rule saved views
- */
-
-export function useListRuleViews<
-	TData = Awaited<ReturnType<typeof listRuleViews>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(options?: {
-	query?: UseQueryOptions<
-		Awaited<ReturnType<typeof listRuleViews>>,
-		TError,
-		TData
-	>;
-}): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getListRuleViewsQueryOptions(options);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return { ...query, queryKey: queryOptions.queryKey };
-}
-
-/**
- * @summary List rule saved views
- */
-export const invalidateListRuleViews = async (
-	queryClient: QueryClient,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getListRuleViewsQueryKey() },
-		options,
-	);
-
-	return queryClient;
-};
-
-/**
- * Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.
- * @summary Create rule saved view
- */
-export const createRuleView = (
-	ruletypesPostableRuleViewDTO?: BodyType<RuletypesPostableRuleViewDTO>,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<CreateRuleView201>({
-		url: `/api/v2/rule_views`,
-		method: 'POST',
-		headers: { 'Content-Type': 'application/json' },
-		data: ruletypesPostableRuleViewDTO,
-		signal,
-	});
-};
-
-export const getCreateRuleViewMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof createRuleView>>,
-		TError,
-		{ data?: BodyType<RuletypesPostableRuleViewDTO> },
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof createRuleView>>,
-	TError,
-	{ data?: BodyType<RuletypesPostableRuleViewDTO> },
-	TContext
-> => {
-	const mutationKey = ['createRuleView'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof createRuleView>>,
-		{ data?: BodyType<RuletypesPostableRuleViewDTO> }
-	> = (props) => {
-		const { data } = props ?? {};
-
-		return createRuleView(data);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type CreateRuleViewMutationResult = NonNullable<
-	Awaited<ReturnType<typeof createRuleView>>
->;
-export type CreateRuleViewMutationBody =
-	| BodyType<RuletypesPostableRuleViewDTO>
-	| undefined;
-export type CreateRuleViewMutationError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Create rule saved view
- */
-export const useCreateRuleView = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof createRuleView>>,
-		TError,
-		{ data?: BodyType<RuletypesPostableRuleViewDTO> },
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof createRuleView>>,
-	TError,
-	{ data?: BodyType<RuletypesPostableRuleViewDTO> },
-	TContext
-> => {
-	return useMutation(getCreateRuleViewMutationOptions(options));
-};
-/**
- * Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.
- * @summary Delete rule saved view
- */
-export const deleteRuleView = (
-	{ id }: DeleteRuleViewPathParameters,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<void>({
-		url: `/api/v2/rule_views/${id}`,
-		method: 'DELETE',
-		signal,
-	});
-};
-
-export const getDeleteRuleViewMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof deleteRuleView>>,
-		TError,
-		{ pathParams: DeleteRuleViewPathParameters },
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof deleteRuleView>>,
-	TError,
-	{ pathParams: DeleteRuleViewPathParameters },
-	TContext
-> => {
-	const mutationKey = ['deleteRuleView'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof deleteRuleView>>,
-		{ pathParams: DeleteRuleViewPathParameters }
-	> = (props) => {
-		const { pathParams } = props ?? {};
-
-		return deleteRuleView(pathParams);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type DeleteRuleViewMutationResult = NonNullable<
-	Awaited<ReturnType<typeof deleteRuleView>>
->;
-
-export type DeleteRuleViewMutationError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Delete rule saved view
- */
-export const useDeleteRuleView = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof deleteRuleView>>,
-		TError,
-		{ pathParams: DeleteRuleViewPathParameters },
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof deleteRuleView>>,
-	TError,
-	{ pathParams: DeleteRuleViewPathParameters },
-	TContext
-> => {
-	return useMutation(getDeleteRuleViewMutationOptions(options));
-};
-/**
- * Replaces a saved view's name and data. Saved views are shared org-wide.
- * @summary Update rule saved view
- */
-export const updateRuleView = (
-	{ id }: UpdateRuleViewPathParameters,
-	ruletypesPostableRuleViewDTO?: BodyType<RuletypesPostableRuleViewDTO>,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<UpdateRuleView200>({
-		url: `/api/v2/rule_views/${id}`,
-		method: 'PUT',
-		headers: { 'Content-Type': 'application/json' },
-		data: ruletypesPostableRuleViewDTO,
-		signal,
-	});
-};
-
-export const getUpdateRuleViewMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof updateRuleView>>,
-		TError,
-		{
-			pathParams: UpdateRuleViewPathParameters;
-			data?: BodyType<RuletypesPostableRuleViewDTO>;
-		},
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof updateRuleView>>,
-	TError,
-	{
-		pathParams: UpdateRuleViewPathParameters;
-		data?: BodyType<RuletypesPostableRuleViewDTO>;
-	},
-	TContext
-> => {
-	const mutationKey = ['updateRuleView'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof updateRuleView>>,
-		{
-			pathParams: UpdateRuleViewPathParameters;
-			data?: BodyType<RuletypesPostableRuleViewDTO>;
-		}
-	> = (props) => {
-		const { pathParams, data } = props ?? {};
-
-		return updateRuleView(pathParams, data);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type UpdateRuleViewMutationResult = NonNullable<
-	Awaited<ReturnType<typeof updateRuleView>>
->;
-export type UpdateRuleViewMutationBody =
-	| BodyType<RuletypesPostableRuleViewDTO>
-	| undefined;
-export type UpdateRuleViewMutationError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Update rule saved view
- */
-export const useUpdateRuleView = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof updateRuleView>>,
-		TError,
-		{
-			pathParams: UpdateRuleViewPathParameters;
-			data?: BodyType<RuletypesPostableRuleViewDTO>;
-		},
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof updateRuleView>>,
-	TError,
-	{
-		pathParams: UpdateRuleViewPathParameters;
-		data?: BodyType<RuletypesPostableRuleViewDTO>;
-	},
-	TContext
-> => {
-	return useMutation(getUpdateRuleViewMutationOptions(options));
-};
-/**
- * This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.
- * @deprecated
+ * This endpoint lists all alert rules with their current evaluation state
  * @summary List alert rules
  */
 export const listRules = (signal?: AbortSignal) => {
@@ -449,7 +95,6 @@ export type ListRulesQueryResult = NonNullable<
 export type ListRulesQueryError = ErrorType<RenderErrorResponseDTO>;
 
 /**
- * @deprecated
  * @summary List alert rules
  */
 
@@ -469,7 +114,6 @@ export function useListRules<
 }
 
 /**
- * @deprecated
  * @summary List alert rules
  */
 export const invalidateListRules = async (
@@ -1724,97 +1368,3 @@ export const useTestRule = <
 > => {
 	return useMutation(getTestRuleMutationOptions(options));
 };
-/**
- * Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.
- * @summary List alert rules (v3)
- */
-export const listRulesV3 = (
-	params?: ListRulesV3Params,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<ListRulesV3200>({
-		url: `/api/v3/rules`,
-		method: 'GET',
-		params,
-		signal,
-	});
-};
-
-export const getListRulesV3QueryKey = (params?: ListRulesV3Params) => {
-	return [`/api/v3/rules`, ...(params ? [params] : [])] as const;
-};
-
-export const getListRulesV3QueryOptions = <
-	TData = Awaited<ReturnType<typeof listRulesV3>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	params?: ListRulesV3Params,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof listRulesV3>>,
-			TError,
-			TData
-		>;
-	},
-) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey = queryOptions?.queryKey ?? getListRulesV3QueryKey(params);
-
-	const queryFn: QueryFunction<Awaited<ReturnType<typeof listRulesV3>>> = ({
-		signal,
-	}) => listRulesV3(params, signal);
-
-	return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
-		Awaited<ReturnType<typeof listRulesV3>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type ListRulesV3QueryResult = NonNullable<
-	Awaited<ReturnType<typeof listRulesV3>>
->;
-export type ListRulesV3QueryError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary List alert rules (v3)
- */
-
-export function useListRulesV3<
-	TData = Awaited<ReturnType<typeof listRulesV3>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	params?: ListRulesV3Params,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof listRulesV3>>,
-			TError,
-			TData
-		>;
-	},
-): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getListRulesV3QueryOptions(params, options);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return { ...query, queryKey: queryOptions.queryKey };
-}
-
-/**
- * @summary List alert rules (v3)
- */
-export const invalidateListRulesV3 = async (
-	queryClient: QueryClient,
-	params?: ListRulesV3Params,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getListRulesV3QueryKey(params) },
-		options,
-	);
-
-	return queryClient;
-};

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -9896,149 +9896,6 @@ export interface RuletypesGettableTestRuleDTO {
 	message?: string;
 }
 
-export interface RuletypesLabelPairDTO {
-	/**
-	 * @type string
-	 */
-	key: string;
-	/**
-	 * @type string
-	 */
-	value: string;
-}
-
-export enum RuletypesListOrderDTO {
-	asc = 'asc',
-	desc = 'desc',
-}
-export enum RuletypesListSortDTO {
-	updated_at = 'updated_at',
-	created_at = 'created_at',
-	name = 'name',
-	state = 'state',
-	severity = 'severity',
-}
-export type RuletypesListableRuleDTOLabels = { [key: string]: string };
-
-export enum RuletypesRuleTypeDTO {
-	threshold_rule = 'threshold_rule',
-	promql_rule = 'promql_rule',
-	anomaly_rule = 'anomaly_rule',
-}
-export interface RuletypesListableRuleDTO {
-	/**
-	 * @type string
-	 */
-	alert: string;
-	alertType: RuletypesAlertTypeDTO;
-	/**
-	 * @type string
-	 * @format date-time
-	 */
-	createdAt?: string;
-	/**
-	 * @type string
-	 */
-	createdBy?: string;
-	/**
-	 * @type string
-	 */
-	description?: string;
-	/**
-	 * @type boolean
-	 */
-	disabled?: boolean;
-	/**
-	 * @type string
-	 */
-	id: string;
-	/**
-	 * @type object
-	 */
-	labels?: RuletypesListableRuleDTOLabels;
-	ruleType: RuletypesRuleTypeDTO;
-	state: RuletypesAlertStateDTO;
-	/**
-	 * @type string
-	 * @format date-time
-	 */
-	updatedAt?: string;
-	/**
-	 * @type string
-	 */
-	updatedBy?: string;
-}
-
-export interface RuletypesRuleViewDataDTO {
-	order?: RuletypesListOrderDTO;
-	/**
-	 * @type string
-	 */
-	query?: string;
-	sort?: RuletypesListSortDTO;
-	/**
-	 * @type array
-	 */
-	states?: string[];
-	/**
-	 * @type string
-	 */
-	version: string;
-}
-
-export interface RuletypesRuleViewDTO {
-	/**
-	 * @type string
-	 * @format date-time
-	 */
-	createdAt?: string;
-	data: RuletypesRuleViewDataDTO;
-	/**
-	 * @type string
-	 */
-	id: string;
-	/**
-	 * @type string
-	 */
-	name: string;
-	/**
-	 * @type string
-	 */
-	orgId: string;
-	/**
-	 * @type string
-	 * @format date-time
-	 */
-	updatedAt?: string;
-}
-
-export interface RuletypesListableRuleViewsDTO {
-	/**
-	 * @type array
-	 */
-	views: RuletypesRuleViewDTO[];
-}
-
-export interface RuletypesListableRulesDTO {
-	/**
-	 * @type array
-	 */
-	labels: RuletypesLabelPairDTO[];
-	/**
-	 * @type array
-	 */
-	reservedKeywords: string[];
-	/**
-	 * @type array
-	 */
-	rules: RuletypesListableRuleDTO[];
-	/**
-	 * @type integer
-	 * @format int64
-	 */
-	total: number;
-}
-
 export interface RuletypesRenotifyDTO {
 	/**
 	 * @type array,null
@@ -10135,6 +9992,11 @@ export interface RuletypesRuleConditionDTO {
 	thresholds?: RuletypesRuleThresholdDataDTO;
 }
 
+export enum RuletypesRuleTypeDTO {
+	threshold_rule = 'threshold_rule',
+	promql_rule = 'promql_rule',
+	anomaly_rule = 'anomaly_rule',
+}
 export interface RuletypesPostableRuleDTO {
 	/**
 	 * @type string
@@ -10187,14 +10049,6 @@ export interface RuletypesPostableRuleDTO {
 	version?: string;
 }
 
-export interface RuletypesPostableRuleViewDTO {
-	data: RuletypesRuleViewDataDTO;
-	/**
-	 * @type string
-	 */
-	name: string;
-}
-
 export type RuletypesRuleDTOAnnotations = { [key: string]: string };
 
 export type RuletypesRuleDTOLabels = { [key: string]: string };
@@ -13415,36 +13269,6 @@ export type GetUsersByRoleID200 = {
 	status: string;
 };
 
-export type ListRuleViews200 = {
-	data: RuletypesListableRuleViewsDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type CreateRuleView201 = {
-	data: RuletypesRuleViewDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type DeleteRuleViewPathParameters = {
-	id: string;
-};
-export type UpdateRuleViewPathParameters = {
-	id: string;
-};
-export type UpdateRuleView200 = {
-	data: RuletypesRuleViewDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
 export type ListRules200 = {
 	/**
 	 * @type array
@@ -14006,45 +13830,6 @@ export type GetMetricDashboardsV2200 = {
 	status: string;
 };
 
-export type ListRulesV3Params = {
-	/**
-	 * @type string
-	 * @description undefined
-	 */
-	query?: string;
-	/**
-	 * @type array
-	 * @description undefined
-	 */
-	states?: string[];
-	/**
-	 * @description undefined
-	 */
-	sort?: RuletypesListSortDTO;
-	/**
-	 * @description undefined
-	 */
-	order?: RuletypesListOrderDTO;
-	/**
-	 * @type integer
-	 * @description undefined
-	 */
-	limit?: number;
-	/**
-	 * @type integer
-	 * @description undefined
-	 */
-	offset?: number;
-};
-
-export type ListRulesV3200 = {
-	data: RuletypesListableRulesDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
 export type GetFlamegraphPathParameters = {
 	traceID: string;
 };

frontend/src/constants/queryBuilder.ts

@@ -614,6 +614,18 @@ export const listViewInitialLogQuery: Query = {
 	},
 };
 
+export const PANEL_TYPES_INITIAL_QUERY: Record<PANEL_TYPES, Query> = {
+	[PANEL_TYPES.TIME_SERIES]: initialQueriesMap.metrics,
+	[PANEL_TYPES.VALUE]: initialQueriesMap.metrics,
+	[PANEL_TYPES.TABLE]: initialQueriesMap.metrics,
+	[PANEL_TYPES.LIST]: listViewInitialLogQuery,
+	[PANEL_TYPES.TRACE]: initialQueriesMap.traces,
+	[PANEL_TYPES.BAR]: initialQueriesMap.metrics,
+	[PANEL_TYPES.PIE]: initialQueriesMap.metrics,
+	[PANEL_TYPES.HISTOGRAM]: initialQueriesMap.metrics,
+	[PANEL_TYPES.EMPTY_WIDGET]: initialQueriesMap.metrics,
+};
+
 export const listViewInitialTraceQuery: Query = {
 	// it should be the above commented query
 	...initialQueriesMap.traces,

frontend/src/pages/DashboardPage/DashboardContainer/Panels/utils/drilldown/__tests__/drilldown.test.ts

@@ -426,30 +426,6 @@ describe('resolvePanelContextLinks', () => {
 
 		expect(resolved[0].url).toBe('https://wiki/{{_service.name}}');
 	});
-
-	it('carries targetBlank through, defaulting to true when unset', () => {
-		const resolved = resolvePanelContextLinks(
-			[
-				{ name: 'Same tab', url: 'https://wiki/a', targetBlank: false },
-				{ name: 'New tab', url: 'https://wiki/b', targetBlank: true },
-				{ name: 'Unset', url: 'https://wiki/c' },
-				{
-					name: 'Literal',
-					url: 'https://wiki/d',
-					targetBlank: false,
-					renderVariables: false,
-				},
-			],
-			{},
-		);
-
-		expect(resolved.map((link) => link.targetBlank)).toStrictEqual([
-			false,
-			true,
-			true,
-			false,
-		]);
-	});
 });
 
 describe('stepClickTimeRange', () => {

frontend/src/pages/DashboardPage/DashboardContainer/Panels/utils/drilldown/resolvePanelContextLinks.ts

@@ -8,8 +8,6 @@ export interface ResolvedDrilldownLink {
 	id: string;
 	label: string;
 	url: string;
-	/** Opens in a new tab; links saved before the toggle existed default to true. */
-	targetBlank: boolean;
 }
 
 /**
@@ -28,16 +26,14 @@ export function resolvePanelContextLinks(
 	return usable.map((link, index) => {
 		const rawLabel = link.name || link.url || '';
 		const rawUrl = link.url ?? '';
-		const targetBlank = link.targetBlank ?? true;
 		// Only an explicit `false` opts out; undefined defaults to substitution on.
 		if (link.renderVariables === false) {
-			return { id: String(index), label: rawLabel, url: rawUrl, targetBlank };
+			return { id: String(index), label: rawLabel, url: rawUrl };
 		}
 		return {
 			id: String(index),
 			label: resolveTexts({ texts: [rawLabel], processedVariables }).fullTexts[0],
 			url: resolveContextLinkUrl(rawUrl, processedVariables),
-			targetBlank,
 		};
 	});
 }

frontend/src/pages/DashboardPage/DashboardContainer/PanelsAndSectionsLayout/Panel/DrilldownMenu/DrilldownAggregateMenu.tsx

@@ -173,7 +173,7 @@ function DrilldownAggregateMenu({
 						void logEvent(DashboardDetailEvents.DrilldownAction, {
 							action: 'contextLink',
 						});
-						openInNewTab(link.url, !!link.targetBlank);
+						openInNewTab(link.url);
 						onClose();
 					}}
 				>

frontend/src/providers/QueryBuilder.tsx

@@ -767,15 +767,10 @@ export function QueryBuilderProvider({
 							queryItem.dataSource
 						].builder.queryData;
 
-					// `dataSource` travels with the panel type's fields, but is appended to a
-					// copy: `propsRequired` is the list held in
-					// `panelTypeDataSourceFormValuesMap`, and pushing onto it grew that
-					// module-level array by one entry on every call.
-					if (propsRequired) {
-						[...propsRequired, 'dataSource'].forEach((p: any) => {
-							set(queryItem, p, get(newQueryItem, p));
-						});
-					}
+					propsRequired?.push('dataSource');
+					propsRequired?.forEach((p: any) => {
+						set(queryItem, p, get(newQueryItem, p));
+					});
 					return queryItem;
 				}
 

frontend/src/types/common/queryBuilder.ts

@@ -211,11 +211,13 @@ export enum QueryFunctionsTypes {
 	FILL_ZERO = 'fillZero',
 }
 
-/**
- * Key names of {@link PANEL_TYPES}. Derived rather than listed: the hand-written
- * version had fallen behind the enum by three members (`BAR`, `PIE`, `HISTOGRAM`).
- */
-export type PanelTypeKeys = keyof typeof PANEL_TYPES;
+export type PanelTypeKeys =
+	| 'TIME_SERIES'
+	| 'VALUE'
+	| 'TABLE'
+	| 'LIST'
+	| 'TRACE'
+	| 'EMPTY_WIDGET';
 
 export enum ReduceOperators {
 	LAST = 'last',

frontend/src/utils/navigation.ts

@@ -1,9 +1,5 @@
 import { withBasePath } from 'utils/basePath';
 
-export const openInNewTab = (path: string, newTab = true): void => {
-	if (newTab) {
-		window.open(withBasePath(path), '_blank');
-	} else {
-		window.location.assign(withBasePath(path));
-	}
+export const openInNewTab = (path: string): void => {
+	window.open(withBasePath(path), '_blank');
 };

go.mod

@@ -57,6 +57,7 @@ require (
 	github.com/segmentio/analytics-go/v3 v3.2.1
 	github.com/sethvargo/go-password v0.2.0
 	github.com/smartystreets/goconvey v1.8.1
+	github.com/soheilhy/cmux v0.1.5
 	github.com/spf13/cobra v1.10.2
 	github.com/stretchr/testify v1.11.1
 	github.com/swaggest/jsonschema-go v0.3.78

go.sum

@@ -1057,6 +1057,8 @@ github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/goconvey v1.8.1 h1:qGjIddxOk4grTu9JPOU31tVfq3cNdBlNa5sSznIX1xY=
 github.com/smartystreets/goconvey v1.8.1/go.mod h1:+/u4qLyY6x1jReYOp7GOM2FSt8aP9CzCZL03bI28W60=
+github.com/soheilhy/cmux v0.1.5 h1:jjzc5WVemNEDTLwv9tlmemhC73tI08BNOIGwBOo10Js=
+github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/sourcegraph/conc v0.3.0 h1:OQTbbt6P72L20UqAkXXuLOj79LfEanQ+YQFNpLA9ySo=
 github.com/sourcegraph/conc v0.3.0/go.mod h1:Sdozi7LEKbFPqYX2/J+iBAM6HpqSLTASQIKqDmF7Mt0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
@@ -1491,6 +1493,7 @@ golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81R
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

pkg/apiserver/apiserver.go

@@ -1,14 +1,10 @@
 package apiserver
 
 import (
-	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/gorilla/mux"
 )
 
 type APIServer interface {
-	// APIServer is a long running service serving the SigNoz API.
-	factory.ServiceWithHealthy
-
 	// Returns the mux router for the API server. Primarily used for collecting OpenAPI operations.
 	Router() *mux.Router
 

pkg/apiserver/config.go

@@ -3,16 +3,13 @@ package apiserver
 import (
 	"time"
 
-	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/factory"
-	httpserver "github.com/SigNoz/signoz/pkg/http/server"
 )
 
 // Config holds the configuration for config.
 type Config struct {
-	httpserver.Config `mapstructure:",squash" yaml:",squash"`
-	Timeout           Timeout `mapstructure:"timeout"`
-	Logging           Logging `mapstructure:"logging"`
+	Timeout Timeout `mapstructure:"timeout"`
+	Logging Logging `mapstructure:"logging"`
 }
 
 type Timeout struct {
@@ -35,10 +32,6 @@ func NewConfigFactory() factory.ConfigFactory {
 
 func newConfig() factory.Config {
 	return &Config{
-		Config: httpserver.Config{
-			Address:     "0.0.0.0:8080",
-			ReadTimeout: 60 * time.Second,
-		},
 		Timeout: Timeout{
 			Default: 60 * time.Second,
 			Max:     600 * time.Second,
@@ -59,13 +52,5 @@ func newConfig() factory.Config {
 }
 
 func (c Config) Validate() error {
-	if err := c.Config.Validate(); err != nil {
-		return err
-	}
-
-	if c.Address == "" {
-		return errors.NewInvalidInputf(errors.CodeInvalidInput, "apiserver.address is required")
-	}
-
 	return nil
 }

pkg/apiserver/config_test.go

@@ -8,18 +8,11 @@ import (
 	"github.com/SigNoz/signoz/pkg/config"
 	"github.com/SigNoz/signoz/pkg/config/envprovider"
 	"github.com/SigNoz/signoz/pkg/factory"
-	httpserver "github.com/SigNoz/signoz/pkg/http/server"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestNewWithEnvProvider(t *testing.T) {
-	t.Setenv("SIGNOZ_APISERVER_ADDRESS", "0.0.0.0:9090")
-	t.Setenv("SIGNOZ_APISERVER_READ__TIMEOUT", "80s")
-	t.Setenv("SIGNOZ_APISERVER_TLS_ENABLED", "true")
-	t.Setenv("SIGNOZ_APISERVER_TLS_CERT__FILE", "/etc/signoz/server.crt")
-	t.Setenv("SIGNOZ_APISERVER_TLS_KEY__FILE", "/etc/signoz/server.key")
-	t.Setenv("SIGNOZ_APISERVER_TLS_MIN__VERSION", "1.3")
 	t.Setenv("SIGNOZ_APISERVER_TIMEOUT_DEFAULT", "70s")
 	t.Setenv("SIGNOZ_APISERVER_TIMEOUT_MAX", "700s")
 	t.Setenv("SIGNOZ_APISERVER_TIMEOUT_EXCLUDED__ROUTES", "/excluded1,/excluded2")
@@ -45,16 +38,6 @@ func TestNewWithEnvProvider(t *testing.T) {
 	require.NoError(t, err)
 
 	expected := &Config{
-		Config: httpserver.Config{
-			Address:     "0.0.0.0:9090",
-			ReadTimeout: 80 * time.Second,
-			TLS: httpserver.TLS{
-				Enabled:    true,
-				CertFile:   "/etc/signoz/server.crt",
-				KeyFile:    "/etc/signoz/server.key",
-				MinVersion: "1.3",
-			},
-		},
 		Timeout: Timeout{
 			Default: 70 * time.Second,
 			Max:     700 * time.Second,

pkg/apiserver/signozapiserver/provider.go

@@ -2,11 +2,9 @@ package signozapiserver
 
 import (
 	"context"
-	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/alertmanager"
 	"github.com/SigNoz/signoz/pkg/apiserver"
-	"github.com/SigNoz/signoz/pkg/auditor"
 	"github.com/SigNoz/signoz/pkg/authz"
 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/flagger"
@@ -14,8 +12,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/global"
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
-	httpserver "github.com/SigNoz/signoz/pkg/http/server"
-	"github.com/SigNoz/signoz/pkg/identn"
 	"github.com/SigNoz/signoz/pkg/licensing"
 	"github.com/SigNoz/signoz/pkg/modules/aiobservability"
 	"github.com/SigNoz/signoz/pkg/modules/authdomain"
@@ -41,26 +37,23 @@ import (
 	"github.com/SigNoz/signoz/pkg/prometheus"
 	"github.com/SigNoz/signoz/pkg/querier"
 	"github.com/SigNoz/signoz/pkg/ruler"
-	"github.com/SigNoz/signoz/pkg/sharder"
 	"github.com/SigNoz/signoz/pkg/statsreporter"
 	"github.com/SigNoz/signoz/pkg/subscription"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/web"
 	"github.com/SigNoz/signoz/pkg/zeus"
 	"github.com/gorilla/mux"
 )
 
 type provider struct {
-	globalConfig               global.Config
-	web                        web.Web
+	config                     apiserver.Config
+	settings                   factory.ScopedProviderSettings
 	router                     *mux.Router
-	httpServer                 *httpserver.Server
-	healthyC                   chan struct{}
 	authzMiddleware            *middleware.AuthZ
 	authzService               authz.AuthZ
 	orgHandler                 organization.Handler
 	userHandler                user.Handler
+	userGetter                 user.Getter
 	sessionHandler             session.Handler
 	authDomainHandler          authdomain.Handler
 	authDomainModule           authdomain.Module
@@ -105,6 +98,7 @@ func NewFactory(
 	authzService authz.AuthZ,
 	orgHandler organization.Handler,
 	userHandler user.Handler,
+	userGetter user.Getter,
 	sessionHandler session.Handler,
 	authDomainHandler authdomain.Handler,
 	authDomainModule authdomain.Module,
@@ -140,11 +134,6 @@ func NewFactory(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
-	globalConfig global.Config,
-	identNResolver identn.IdentNResolver,
-	sharder sharder.Sharder,
-	auditor auditor.Auditor,
-	web web.Web,
 	quickFilterModule quickfilter.Module,
 	quickFilterHandler quickfilter.Handler,
 ) factory.ProviderFactory[apiserver.APIServer, apiserver.Config] {
@@ -157,6 +146,7 @@ func NewFactory(
 			authzService,
 			orgHandler,
 			userHandler,
+			userGetter,
 			sessionHandler,
 			authDomainHandler,
 			authDomainModule,
@@ -192,11 +182,6 @@ func NewFactory(
 			rulerHandler,
 			statsHandler,
 			savedViewHandler,
-			globalConfig,
-			identNResolver,
-			sharder,
-			auditor,
-			web,
 			quickFilterModule,
 			quickFilterHandler,
 		)
@@ -211,6 +196,7 @@ func newProvider(
 	authzService authz.AuthZ,
 	orgHandler organization.Handler,
 	userHandler user.Handler,
+	userGetter user.Getter,
 	sessionHandler session.Handler,
 	authDomainHandler authdomain.Handler,
 	authDomainModule authdomain.Module,
@@ -246,11 +232,6 @@ func newProvider(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
-	globalConfig global.Config,
-	identNResolver identn.IdentNResolver,
-	sharder sharder.Sharder,
-	auditor auditor.Auditor,
-	web web.Web,
 	quickFilterModule quickfilter.Module,
 	quickFilterHandler quickfilter.Handler,
 ) (apiserver.APIServer, error) {
@@ -258,12 +239,12 @@ func newProvider(
 	router := mux.NewRouter().UseEncodedPath()
 
 	provider := &provider{
-		globalConfig:               globalConfig,
-		web:                        web,
+		config:                     config,
+		settings:                   settings,
 		router:                     router,
-		healthyC:                   make(chan struct{}),
 		orgHandler:                 orgHandler,
 		userHandler:                userHandler,
+		userGetter:                 userGetter,
 		authzService:               authzService,
 		sessionHandler:             sessionHandler,
 		authDomainHandler:          authDomainHandler,
@@ -306,68 +287,13 @@ func newProvider(
 
 	provider.authzMiddleware = middleware.NewAuthZ(settings.Logger(), orgGetter, authzService)
 
-	router.Use(middleware.NewRecovery(settings.Logger()).Wrap)
-	router.Use(middleware.NewOtel("apiserver", providerSettings.MeterProvider, providerSettings.TracerProvider).Wrap)
-	router.Use(middleware.NewIdentN(identNResolver, sharder, settings.Logger()).Wrap)
-	router.Use(middleware.NewTimeout(settings.Logger(),
-		config.Timeout.ExcludedRoutes,
-		config.Timeout.Default,
-		config.Timeout.Max,
-	).Wrap)
-	router.Use(middleware.NewResource(settings.Logger()).Wrap)
-	router.Use(middleware.NewAudit(settings.Logger(), config.Logging.ExcludedRoutes, auditor).Wrap)
-	router.Use(middleware.NewComment().Wrap)
-
 	if err := provider.AddToRouter(router); err != nil {
 		return nil, err
 	}
 
-	httpHandler := middleware.NewCors().Wrap(router)
-	httpHandler = middleware.NewCompress().Wrap(httpHandler)
-
-	routePrefix := globalConfig.ExternalPath()
-	if routePrefix != "" {
-		prefixed := http.StripPrefix(routePrefix, httpHandler)
-		httpHandler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
-			switch req.URL.Path {
-			case "/api/v1/health", "/api/v2/healthz", "/api/v2/readyz", "/api/v2/livez":
-				router.ServeHTTP(w, req)
-				return
-			}
-
-			prefixed.ServeHTTP(w, req)
-		})
-	}
-
-	httpServer, err := httpserver.New(settings.Logger(), config.Config, httpHandler)
-	if err != nil {
-		return nil, err
-	}
-	provider.httpServer = httpServer
-
 	return provider, nil
 }
 
-func (provider *provider) Start(ctx context.Context) error {
-	// Mount the web routes last so the catch-all prefix does not shadow API
-	// routes registered on the router after construction.
-	if err := provider.web.AddToRouter(provider.router); err != nil {
-		return err
-	}
-
-	close(provider.healthyC)
-
-	return provider.httpServer.Start(ctx)
-}
-
-func (provider *provider) Stop(ctx context.Context) error {
-	return provider.httpServer.Stop(ctx)
-}
-
-func (provider *provider) Healthy() <-chan struct{} {
-	return provider.healthyC
-}
-
 func (provider *provider) Router() *mux.Router {
 	return provider.router
 }

pkg/apiserver/signozapiserver/ruler.go

@@ -15,26 +15,10 @@ func (provider *provider) addRulerRoutes(router *mux.Router) error {
 		ID:                  "ListRules",
 		Tags:                []string{"rules"},
 		Summary:             "List alert rules",
-		Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
+		Description:         "This endpoint lists all alert rules with their current evaluation state",
 		Response:            make([]*ruletypes.Rule, 0),
 		ResponseContentType: "application/json",
 		SuccessStatusCode:   http.StatusOK,
-		Deprecated:          true,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
-		return err
-	}
-
-	if err := router.Handle("/api/v3/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRulesV3), handler.OpenAPIDef{
-		ID:                  "ListRulesV3",
-		Tags:                []string{"rules"},
-		Summary:             "List alert rules (v3)",
-		Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
-		RequestQuery:        new(ruletypes.ListRulesParams),
-		Response:            new(ruletypes.ListableRules),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
 		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
 	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
@@ -132,64 +116,6 @@ func (provider *provider) addRulerRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRuleViews), handler.OpenAPIDef{
-		ID:                  "ListRuleViews",
-		Tags:                []string{"rules"},
-		Summary:             "List rule saved views",
-		Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
-		Response:            new(ruletypes.ListableRuleViews),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
-		return err
-	}
-
-	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.CreateRuleView), handler.OpenAPIDef{
-		ID:                  "CreateRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Create rule saved view",
-		Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
-		Request:             new(ruletypes.PostableRuleView),
-		RequestContentType:  "application/json",
-		Response:            new(ruletypes.RuleView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPost).GetError(); err != nil {
-		return err
-	}
-
-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.UpdateRuleView), handler.OpenAPIDef{
-		ID:                  "UpdateRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Update rule saved view",
-		Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
-		Request:             new(ruletypes.UpdatableRuleView),
-		RequestContentType:  "application/json",
-		Response:            new(ruletypes.RuleView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPut).GetError(); err != nil {
-		return err
-	}
-
-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.DeleteRuleView), handler.OpenAPIDef{
-		ID:                  "DeleteRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Delete rule saved view",
-		Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListDowntimeSchedules), handler.OpenAPIDef{
 		ID:                  "ListDowntimeSchedules",
 		Tags:                []string{"downtimeschedules"},

pkg/apiserver/signozapiserver/user.go

@@ -6,24 +6,35 @@ import (
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addUserRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.ListUsers), handler.OpenAPIDef{
-		ID:                  "ListUsers",
-		Tags:                []string{"users"},
-		Summary:             "List users v2",
-		Description:         "This endpoint lists all users for the organization",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*types.User, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.ListUsers, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListUsers",
+			Tags:                []string{"users"},
+			Summary:             "List users v2",
+			Description:         "This endpoint lists all users for the organization",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*types.User, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryAccessControl,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
@@ -61,20 +72,43 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateUser), handler.OpenAPIDef{
-		ID:                  "CreateUser",
-		Tags:                []string{"users"},
-		Summary:             "Create user",
-		Description:         "This endpoint creates a user for the organization",
-		Request:             new(authtypes.PostableUser),
-		RequestContentType:  "application/json",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateUser",
+			Tags:                []string{"users"},
+			Summary:             "Create user",
+			Description:         "This endpoint creates a user for the organization",
+			Request:             new(authtypes.PostableUser),
+			RequestContentType:  "application/json",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbCreate), coretypes.ResourceUser.Scope(coretypes.VerbAttach), coretypes.ResourceRole.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceUser,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:            coretypes.VerbAttach,
+				Category:        coretypes.ActionCategoryAccessControl,
+				SourceResource:  coretypes.ResourceUser,
+				SourceIDs:       coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector:  coretypes.WildcardSelector,
+				TargetResource:  coretypes.ResourceRole,
+				TargetIDs:       coretypes.BodyJSONArray("userRoles.#.id"),
+				TargetSelector:  provider.roleSelector,
+				OptionalTargets: true,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
@@ -95,88 +129,148 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUser), handler.OpenAPIDef{
-		ID:                  "GetUser",
-		Tags:                []string{"users"},
-		Summary:             "Get user by user id",
-		Description:         "This endpoint returns the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(authtypes.UserWithRoles),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUser",
+			Tags:                []string{"users"},
+			Summary:             "Get user by user id",
+			Description:         "This endpoint returns the user by id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(authtypes.UserWithRoles),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.UpdateUser), handler.OpenAPIDef{
-		ID:                  "UpdateUser",
-		Tags:                []string{"users"},
-		Summary:             "Update user v2",
-		Description:         "This endpoint updates the user by id",
-		Request:             new(types.UpdatableUser),
-		RequestContentType:  "application/json",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.UpdateUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateUser",
+			Tags:                []string{"users"},
+			Summary:             "Update user v2",
+			Description:         "This endpoint updates the user by id",
+			Request:             new(types.UpdatableUser),
+			RequestContentType:  "application/json",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUser), handler.OpenAPIDef{
-		ID:                  "DeleteUser",
-		Tags:                []string{"users"},
-		Summary:             "Delete user",
-		Description:         "This endpoint deletes the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.DeleteUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteUser",
+			Tags:                []string{"users"},
+			Summary:             "Delete user",
+			Description:         "This endpoint deletes the user by id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetResetPasswordToken), handler.OpenAPIDef{
-		ID:                  "GetResetPasswordToken",
-		Tags:                []string{"users"},
-		Summary:             "Get reset password token for a user",
-		Description:         "This endpoint returns the existing reset password token for a user.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.ResetPasswordToken),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetResetPasswordToken, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetResetPasswordToken",
+			Tags:                []string{"users"},
+			Summary:             "Get reset password token for a user",
+			Description:         "This endpoint returns the existing reset password token for a user.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(types.ResetPasswordToken),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceFactorPassword.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceFactorPassword,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryAccessControl,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateResetPasswordToken), handler.OpenAPIDef{
-		ID:                  "CreateResetPasswordToken",
-		Tags:                []string{"users"},
-		Summary:             "Create or regenerate reset password token for a user",
-		Description:         "This endpoint creates or regenerates a reset password token for a user. If a valid token exists, it is returned. If expired, a new one is created.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.ResetPasswordToken),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateResetPasswordToken, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateResetPasswordToken",
+			Tags:                []string{"users"},
+			Summary:             "Create or regenerate reset password token for a user",
+			Description:         "This endpoint creates or regenerates a reset password token for a user. If a valid token exists, it is returned. If expired, a new one is created.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(types.ResetPasswordToken),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceFactorPassword.Scope(coretypes.VerbCreate), coretypes.ResourceUser.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceFactorPassword,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachParentChildResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryAccessControl,
+				ParentResource: coretypes.ResourceUser,
+				ParentID:       coretypes.PathParam("id"),
+				ParentSelector: coretypes.IDSelector,
+				ChildResource:  coretypes.ResourceMetaResourceFactorPassword,
+				ChildIDs:       coretypes.OneID(coretypes.PathParam("id")),
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
@@ -248,90 +342,196 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetRolesByUserID), handler.OpenAPIDef{
-		ID:                  "GetRolesByUserID",
-		Tags:                []string{"users"},
-		Summary:             "Get user roles",
-		Description:         "This endpoint returns the user roles by user id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*authtypes.Role, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetRolesByUserID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRolesByUserID",
+			Tags:                []string{"users"},
+			Summary:             "Get user roles",
+			Description:         "This endpoint returns the user roles by user id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*authtypes.Role, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/roles/{id}/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUsersByRoleID), handler.OpenAPIDef{
-		ID:                  "GetUsersByRoleID",
-		Tags:                []string{"users"},
-		Summary:             "Get users by role id",
-		Description:         "This endpoint returns the users having the role by role id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*types.User, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/roles/{id}/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUsersByRoleID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUsersByRoleID",
+			Tags:                []string{"users"},
+			Summary:             "Get users by role id",
+			Description:         "This endpoint returns the users having the role by role id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*types.User, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceRole.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceRole,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateUserRole), handler.OpenAPIDef{
-		ID:                  "CreateUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Create user role",
-		Description:         "This endpoint assigns a role to a user",
-		Request:             new(authtypes.PostableUserRole),
-		RequestContentType:  "",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Create user role",
+			Description:         "This endpoint assigns a role to a user",
+			Request:             new(authtypes.PostableUserRole),
+			RequestContentType:  "",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbAttach), coretypes.ResourceRole.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(handler.AttachDetachSiblingResourceDef{
+			Verb:           coretypes.VerbAttach,
+			Category:       coretypes.ActionCategoryAccessControl,
+			SourceResource: coretypes.ResourceUser,
+			SourceIDs:      coretypes.OneID(coretypes.BodyJSONPath("userId")),
+			SourceSelector: coretypes.IDSelector,
+			TargetResource: coretypes.ResourceRole,
+			TargetIDs:      coretypes.OneID(coretypes.BodyJSONPath("roleId")),
+			TargetSelector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUserRole), handler.OpenAPIDef{
-		ID:                  "GetUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Get user role",
-		Description:         "This endpoint gets an existing user role",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(authtypes.UserRole),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Get user role",
+			Description:         "This endpoint gets an existing user role",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(authtypes.UserRole),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       provider.userRoleUserIDExtractor(),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUserRole), handler.OpenAPIDef{
-		ID:                  "DeleteUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Delete user role",
-		Description:         "This endpoint revokes a role from a user",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.DeleteUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Delete user role",
+			Description:         "This endpoint revokes a role from a user",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbDetach), coretypes.ResourceRole.Scope(coretypes.VerbDetach)}),
+		},
+		handler.WithResourceDefs(handler.AttachDetachSiblingResourceDef{
+			Verb:           coretypes.VerbDetach,
+			Category:       coretypes.ActionCategoryAccessControl,
+			SourceResource: coretypes.ResourceUser,
+			SourceIDs:      coretypes.OneID(provider.userRoleUserIDExtractor()),
+			SourceSelector: coretypes.IDSelector,
+			TargetResource: coretypes.ResourceRole,
+			TargetIDs:      coretypes.OneID(provider.userRoleRoleIDExtractor()),
+			TargetSelector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
 	return nil
 }
+
+func (provider *provider) userRoleUserIDExtractor() coretypes.ResourceIDExtractor {
+	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
+		if ec.Request == nil {
+			return "", nil
+		}
+
+		claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
+		if err != nil {
+			return "", err
+		}
+
+		userRoleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return "", err
+		}
+
+		userRole, err := provider.userGetter.GetUserRoleByOrgIDAndID(ec.Request.Context(), valuer.MustNewUUID(claims.OrgID), userRoleID)
+		if err != nil {
+			return "", err
+		}
+
+		return userRole.UserID.String(), nil
+	})
+}
+
+func (provider *provider) userRoleRoleIDExtractor() coretypes.ResourceIDExtractor {
+	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
+		if ec.Request == nil {
+			return "", nil
+		}
+
+		claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
+		if err != nil {
+			return "", err
+		}
+
+		userRoleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return "", err
+		}
+
+		userRole, err := provider.userGetter.GetUserRoleByOrgIDAndID(ec.Request.Context(), valuer.MustNewUUID(claims.OrgID), userRoleID)
+		if err != nil {
+			return "", err
+		}
+
+		return userRole.RoleID.String(), nil
+	})
+}

pkg/factory/registry.go

@@ -78,40 +78,6 @@ func NewRegistry(ctx context.Context, logger *slog.Logger, services ...NamedServ
 	}, nil
 }
 
-// Add registers additional services into the registry. It must be called before Start.
-func (registry *Registry) Add(ctx context.Context, services ...NamedService) error {
-	added := make([]*serviceWithState, 0, len(services))
-	for _, s := range services {
-		if _, ok := registry.servicesByName[s.Name()]; ok {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeInvalidRegistry, "cannot add service, duplicate service name %q", s.Name())
-		}
-		added = append(added, newServiceWithState(s))
-	}
-
-	for _, ss := range added {
-		registry.services = append(registry.services, ss)
-		registry.servicesByName[ss.service.Name()] = ss
-	}
-
-	for _, ss := range added {
-		for _, dep := range ss.service.DependsOn() {
-			if dep == ss.service.Name() {
-				registry.logger.ErrorContext(ctx, "ignoring self-dependency", slog.Any("service", ss.service.Name()))
-				continue
-			}
-
-			if _, ok := registry.servicesByName[dep]; !ok {
-				registry.logger.ErrorContext(ctx, "ignoring unknown dependency", slog.Any("service", ss.service.Name()), slog.Any("dependency", dep))
-				continue
-			}
-
-			ss.dependsOn = append(ss.dependsOn, dep)
-		}
-	}
-
-	return detectCyclicDeps(registry.services)
-}
-
 func (registry *Registry) Start(ctx context.Context) {
 	for _, ss := range registry.services {
 		go func(ss *serviceWithState) {

pkg/factory/registry_test.go

@@ -342,61 +342,3 @@ func TestDependsOnCycleReturnsError(t *testing.T) {
 	assert.Error(t, err)
 	assert.Contains(t, err.Error(), "dependency cycles detected")
 }
-
-func TestRegistryAdd(t *testing.T) {
-	s1 := newTestService(t)
-	s2 := newTestService(t)
-
-	registry, err := NewRegistry(context.Background(), slog.New(slog.DiscardHandler), NewNamedService(MustNewName("s1"), s1))
-	require.NoError(t, err)
-
-	require.NoError(t, registry.Add(context.Background(), NewNamedService(MustNewName("s2"), s2)))
-
-	ctx := context.Background()
-	registry.Start(ctx)
-
-	require.NoError(t, registry.AwaitHealthy(ctx))
-	byState := registry.ServicesByState()
-	assert.Len(t, byState[StateRunning], 2)
-	assert.True(t, registry.IsHealthy())
-
-	assert.NoError(t, registry.Stop(ctx))
-}
-
-func TestRegistryAddDuplicateReturnsError(t *testing.T) {
-	s1 := newTestService(t)
-
-	registry, err := NewRegistry(context.Background(), slog.New(slog.DiscardHandler), NewNamedService(MustNewName("s1"), s1))
-	require.NoError(t, err)
-
-	err = registry.Add(context.Background(), NewNamedService(MustNewName("s1"), newTestService(t)))
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "duplicate service name")
-}
-
-func TestRegistryAddWithDependency(t *testing.T) {
-	s1 := newHealthyTestService(t)
-	s2 := newTestService(t)
-
-	registry, err := NewRegistry(context.Background(), slog.New(slog.DiscardHandler), NewNamedService(MustNewName("s1"), s1))
-	require.NoError(t, err)
-
-	// s2 depends on the already registered s1.
-	require.NoError(t, registry.Add(context.Background(), NewNamedService(MustNewName("s2"), s2, MustNewName("s1"))))
-
-	ctx := context.Background()
-	registry.Start(ctx)
-
-	// s2 stays in STARTING until s1 is healthy.
-	require.Eventually(t, func() bool {
-		byState := registry.ServicesByState()
-		return len(byState[StateStarting]) == 2
-	}, time.Second, time.Millisecond)
-
-	close(s1.healthyC)
-
-	require.NoError(t, registry.AwaitHealthy(ctx))
-	assert.True(t, registry.IsHealthy())
-
-	assert.NoError(t, registry.Stop(ctx))
-}

pkg/http/handler/resourcedef.go

@@ -53,9 +53,20 @@ type AttachDetachSiblingResourceDef struct {
 	TargetResource coretypes.Resource
 	TargetIDs      coretypes.ResourceIDsExtractor
 	TargetSelector coretypes.SelectorFunc
+	// OptionalTargets drops the def when no target ids resolve, for routes where
+	// the target list is legitimately optional in the payload.
+	OptionalTargets bool
 }
 
 func (def AttachDetachSiblingResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
+	if def.OptionalTargets && def.TargetIDs.IsPhase(coretypes.PhaseRequest) {
+		// extractors are pure; on error fall through and let fill record it
+		ids, err := def.TargetIDs.Fn(ec)
+		if err == nil && len(ids) == 0 {
+			return nil
+		}
+	}
+
 	return []coretypes.ResolvedResource{
 		coretypes.NewResolvedResourceWithTarget(
 			def.Verb,

pkg/http/handler/resourcedef_test.go

@@ -0,0 +1,68 @@
+package handler
+
+import (
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func userRoleAttachDef(optionalTargets bool) AttachDetachSiblingResourceDef {
+	return AttachDetachSiblingResourceDef{
+		Verb:            coretypes.VerbAttach,
+		Category:        coretypes.ActionCategoryAccessControl,
+		SourceResource:  coretypes.ResourceUser,
+		SourceIDs:       coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+		SourceSelector:  coretypes.WildcardSelector,
+		TargetResource:  coretypes.NewResourceRole(),
+		TargetIDs:       coretypes.BodyJSONArray("userRoles.#.id"),
+		TargetSelector:  coretypes.WildcardSelector,
+		OptionalTargets: optionalTargets,
+	}
+}
+
+func TestAttachDetachSiblingResourceDefOptionalTargets(t *testing.T) {
+	t.Run("absent target list resolves to no checks", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"name":"jane"}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		assert.Empty(t, resolved)
+	})
+
+	t.Run("empty target list resolves to no checks", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"userRoles":[]}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		assert.Empty(t, resolved)
+	})
+
+	t.Run("present targets resolve the attach as usual", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"userRoles":[{"id":"role-a"},{"id":"role-b"}]}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		require.Len(t, resolved, 1)
+
+		withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+		require.True(t, ok)
+		assert.NoError(t, resolved[0].Err())
+		assert.Equal(t, []string{"role-a", "role-b"}, withTarget.TargetIDs())
+	})
+
+	t.Run("malformed target entry still fails closed", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"userRoles":[{"id":""}]}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		require.Len(t, resolved, 1)
+
+		withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+		require.True(t, ok)
+		assert.Equal(t, []string{""}, withTarget.TargetIDs())
+	})
+
+	t.Run("without the flag the empty-id contract is preserved", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"name":"jane"}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(false)}, ec)
+		require.Len(t, resolved, 1)
+
+		withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+		require.True(t, ok)
+		assert.Equal(t, []string{""}, withTarget.TargetIDs())
+	})
+}

pkg/http/middleware/compress.go

@@ -1,17 +0,0 @@
-package middleware
-
-import (
-	"net/http"
-
-	gorillahandlers "github.com/gorilla/handlers"
-)
-
-type Compress struct{}
-
-func NewCompress() *Compress {
-	return &Compress{}
-}
-
-func (middleware *Compress) Wrap(next http.Handler) http.Handler {
-	return gorillahandlers.CompressHandler(next)
-}

pkg/http/middleware/cors.go

@@ -1,25 +0,0 @@
-package middleware
-
-import (
-	"net/http"
-
-	"github.com/rs/cors"
-)
-
-type Cors struct {
-	cors *cors.Cors
-}
-
-func NewCors() *Cors {
-	return &Cors{
-		cors: cors.New(cors.Options{
-			AllowedOrigins: []string{"*"},
-			AllowedMethods: []string{"GET", "DELETE", "POST", "PUT", "PATCH", "OPTIONS"},
-			AllowedHeaders: []string{"Accept", "Authorization", "Content-Type", "cache-control"},
-		}),
-	}
-}
-
-func (middleware *Cors) Wrap(next http.Handler) http.Handler {
-	return middleware.cors.Handler(next)
-}

pkg/http/middleware/otel.go

@@ -1,43 +0,0 @@
-package middleware
-
-import (
-	"net/http"
-	"slices"
-
-	"github.com/gorilla/mux"
-	"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux"
-	"go.opentelemetry.io/otel/metric"
-	"go.opentelemetry.io/otel/propagation"
-	"go.opentelemetry.io/otel/trace"
-)
-
-// defaultExcludedRoutes are the health endpoints kept out of tracing/metrics to
-// avoid drowning telemetry in probe traffic.
-var defaultExcludedRoutes = []string{
-	"/api/v1/health",
-	"/api/v2/healthz",
-	"/api/v2/readyz",
-	"/api/v2/livez",
-}
-
-type Otel struct {
-	wrap mux.MiddlewareFunc
-}
-
-func NewOtel(service string, meterProvider metric.MeterProvider, tracerProvider trace.TracerProvider) *Otel {
-	return &Otel{
-		wrap: otelmux.Middleware(
-			service,
-			otelmux.WithMeterProvider(meterProvider),
-			otelmux.WithTracerProvider(tracerProvider),
-			otelmux.WithPropagators(propagation.NewCompositeTextMapPropagator(propagation.Baggage{}, propagation.TraceContext{})),
-			otelmux.WithFilter(func(r *http.Request) bool {
-				return !slices.Contains(defaultExcludedRoutes, r.URL.Path)
-			}),
-		),
-	}
-}
-
-func (middleware *Otel) Wrap(next http.Handler) http.Handler {
-	return middleware.wrap(next)
-}

pkg/http/server/config.go

@@ -1,89 +1,9 @@
 package server
 
-import (
-	"crypto/tls"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-)
-
-var tlsVersions = map[string]uint16{
-	"1.2": tls.VersionTLS12,
-	"1.3": tls.VersionTLS13,
-}
-
+// Config holds the configuration for http.
 type Config struct {
-	// Address specifies the TCP address for the server to listen on, in the form "host:port".
+	//Address specifies the TCP address for the server to listen on, in the form "host:port".
 	// If empty, ":http" (port 80) is used. The service names are defined in RFC 6335 and assigned by IANA.
 	// See net.Dial for details of the address format.
 	Address string `mapstructure:"address"`
-
-	// ReadTimeout bounds reading an entire request, including the body. Zero means no timeout.
-	ReadTimeout time.Duration `mapstructure:"read_timeout"`
-
-	// WriteTimeout bounds writing the response. Zero means no timeout, required for
-	// streaming endpoints that hold the connection open.
-	WriteTimeout time.Duration `mapstructure:"write_timeout"`
-
-	TLS TLS `mapstructure:"tls"`
-}
-
-type TLS struct {
-	Enabled bool `mapstructure:"enabled"`
-
-	// The full path to the certificate file.
-	CertFile string `mapstructure:"cert_file"`
-
-	// The full path to the key file.
-	KeyFile string `mapstructure:"key_file"`
-
-	// MinVersion is the minimum acceptable TLS version, "1.2" or "1.3". Empty uses the Go default.
-	MinVersion string `mapstructure:"min_version"`
-}
-
-func (c Config) Validate() error {
-	if !c.TLS.Enabled {
-		return nil
-	}
-
-	if c.TLS.CertFile == "" || c.TLS.KeyFile == "" {
-		return errors.NewInvalidInputf(errors.CodeInvalidInput, "tls::cert_file and tls::key_file are required when tls is enabled")
-	}
-
-	_, err := tlsVersion(c.TLS.MinVersion)
-	if err != nil {
-		return err
-	}
-
-	return nil
-}
-
-func (tlsConfig TLS) Config() (*tls.Config, error) {
-	cert, err := tls.LoadX509KeyPair(tlsConfig.CertFile, tlsConfig.KeyFile)
-	if err != nil {
-		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "cannot load tls::cert_file and tls::key_file: %v", err)
-	}
-
-	minVersion, err := tlsVersion(tlsConfig.MinVersion)
-	if err != nil {
-		return nil, err
-	}
-
-	return &tls.Config{
-		Certificates: []tls.Certificate{cert},
-		MinVersion:   minVersion,
-	}, nil
-}
-
-func tlsVersion(name string) (uint16, error) {
-	if name == "" {
-		return 0, nil
-	}
-
-	version, ok := tlsVersions[name]
-	if !ok {
-		return 0, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid tls version %q, must be \"1.2\" or \"1.3\"", name)
-	}
-
-	return version, nil
 }

pkg/http/server/server.go

@@ -28,30 +28,17 @@ func New(logger *slog.Logger, cfg Config, handler http.Handler) (*Server, error)
 		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "cannot build http server, logger is required")
 	}
 
-	if err := cfg.Validate(); err != nil {
-		return nil, err
-	}
-
 	srv := &http.Server{
 		Addr:           cfg.Address,
 		Handler:        handler,
-		ReadTimeout:    cfg.ReadTimeout,
-		WriteTimeout:   cfg.WriteTimeout,
+		ReadTimeout:    10 * time.Second,
+		WriteTimeout:   10 * time.Second,
 		MaxHeaderBytes: 1 << 20,
 	}
 
-	if cfg.TLS.Enabled {
-		tlsConfig, err := cfg.TLS.Config()
-		if err != nil {
-			return nil, err
-		}
-
-		srv.TLSConfig = tlsConfig
-	}
-
 	return &Server{
 		srv:     srv,
-		logger:  logger.With(slog.String("pkg", "github.com/SigNoz/signoz/pkg/http/server")),
+		logger:  logger.With(slog.String("pkg", "go.signoz.io/pkg/http/server")),
 		handler: handler,
 		cfg:     cfg,
 	}, nil
@@ -59,18 +46,11 @@ func New(logger *slog.Logger, cfg Config, handler http.Handler) (*Server, error)
 
 func (server *Server) Start(ctx context.Context) error {
 	server.logger.InfoContext(ctx, "starting http server", slog.String("address", server.srv.Addr))
-
-	var err error
-	if server.cfg.TLS.Enabled {
-		// The certificate is already loaded in TLSConfig, so ListenAndServeTLS needs no file paths.
-		err = server.srv.ListenAndServeTLS("", "")
-	} else {
-		err = server.srv.ListenAndServe()
-	}
-
-	if err != nil && err != http.ErrServerClosed {
-		server.logger.ErrorContext(ctx, "failed to start server", errors.Attr(err))
-		return err
+	if err := server.srv.ListenAndServe(); err != nil {
+		if err != http.ErrServerClosed {
+			server.logger.ErrorContext(ctx, "failed to start server", errors.Attr(err))
+			return err
+		}
 	}
 	return nil
 }

pkg/http/server/server_test.go

@@ -1,243 +0,0 @@
-package server
-
-import (
-	"context"
-	"crypto/ecdsa"
-	"crypto/elliptic"
-	"crypto/rand"
-	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/pem"
-	"io"
-	"log/slog"
-	"math/big"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNew(t *testing.T) {
-	logger := slog.New(slog.DiscardHandler)
-	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
-	certFile, keyFile := writeSelfSignedCert(t)
-
-	corruptFile := filepath.Join(t.TempDir(), "corrupt.crt")
-	require.NoError(t, os.WriteFile(corruptFile, []byte("not a pem"), 0o644))
-
-	testCases := []struct {
-		name       string
-		config     Config
-		err        bool
-		minVersion uint16
-	}{
-		{
-			name:   "TLSDisabled",
-			config: Config{},
-		},
-		{
-			name:   "TLSDisabled_WithCertAndKey",
-			config: Config{TLS: TLS{CertFile: "ignored.crt", KeyFile: "ignored.key"}},
-		},
-		{
-			name:   "TLSEnabled_WithoutCertAndKey",
-			config: Config{TLS: TLS{Enabled: true}},
-			err:    true,
-		},
-		{
-			name:   "TLSEnabled_WithoutKey",
-			config: Config{TLS: TLS{Enabled: true, CertFile: "server.crt"}},
-			err:    true,
-		},
-		{
-			name:   "TLSEnabled_WithoutCert",
-			config: Config{TLS: TLS{Enabled: true, KeyFile: "server.key"}},
-			err:    true,
-		},
-		{
-			name:   "TLSEnabled_InvalidMinVersion",
-			config: Config{TLS: TLS{Enabled: true, CertFile: "tls.crt", KeyFile: "tls.key", MinVersion: "1.1"}},
-			err:    true,
-		},
-		{
-			name:   "TLSEnabled_MissingFiles",
-			config: Config{TLS: TLS{Enabled: true, CertFile: "missing.crt", KeyFile: "missing.key"}},
-			err:    true,
-		},
-		{
-			name:   "TLSEnabled_CorruptCertFile",
-			config: Config{TLS: TLS{Enabled: true, CertFile: corruptFile, KeyFile: keyFile}},
-			err:    true,
-		},
-		{
-			name:   "TLSEnabled_DefaultVersions",
-			config: Config{TLS: TLS{Enabled: true, CertFile: certFile, KeyFile: keyFile}},
-		},
-		{
-			name:       "TLSEnabled_WithMin",
-			config:     Config{TLS: TLS{Enabled: true, CertFile: certFile, KeyFile: keyFile, MinVersion: "1.3"}},
-			minVersion: tls.VersionTLS13,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			server, err := New(logger, testCase.config, handler)
-			if testCase.err {
-				assert.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			if !testCase.config.TLS.Enabled {
-				assert.Nil(t, server.srv.TLSConfig)
-				return
-			}
-
-			require.NotNil(t, server.srv.TLSConfig)
-			assert.Len(t, server.srv.TLSConfig.Certificates, 1)
-			assert.Equal(t, testCase.minVersion, server.srv.TLSConfig.MinVersion)
-		})
-	}
-}
-
-func TestStartWithTLS(t *testing.T) {
-	certFile, keyFile := writeSelfSignedCert(t)
-	addr := freeAddr(t)
-
-	server, err := New(
-		slog.New(slog.DiscardHandler),
-		Config{Address: addr, TLS: TLS{Enabled: true, CertFile: certFile, KeyFile: keyFile}},
-		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { _, _ = w.Write([]byte("ok")) }),
-	)
-	require.NoError(t, err)
-
-	errC := make(chan error, 1)
-	go func() { errC <- server.Start(context.Background()) }()
-
-	certPEM, err := os.ReadFile(certFile)
-	require.NoError(t, err)
-	pool := x509.NewCertPool()
-	require.True(t, pool.AppendCertsFromPEM(certPEM))
-	client := &http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{RootCAs: pool}}}
-
-	var (
-		statusCode int
-		body       []byte
-		tlsVersion uint16
-	)
-	require.Eventually(t, func() bool {
-		resp, err := client.Get("https://" + addr)
-		if err != nil {
-			return false
-		}
-		defer func() { _ = resp.Body.Close() }()
-
-		body, err = io.ReadAll(resp.Body)
-		if err != nil {
-			return false
-		}
-
-		statusCode = resp.StatusCode
-		if resp.TLS != nil {
-			tlsVersion = resp.TLS.Version
-		}
-		return true
-	}, 5*time.Second, 25*time.Millisecond)
-
-	assert.Equal(t, http.StatusOK, statusCode)
-	assert.Equal(t, "ok", string(body))
-	assert.GreaterOrEqual(t, tlsVersion, uint16(tls.VersionTLS12))
-
-	plainResp, err := http.Get("http://" + addr)
-	require.NoError(t, err)
-	_ = plainResp.Body.Close()
-	assert.Equal(t, http.StatusBadRequest, plainResp.StatusCode)
-
-	require.NoError(t, server.Stop(context.Background()))
-	require.NoError(t, <-errC)
-}
-
-func TestStartWithoutTLS(t *testing.T) {
-	addr := freeAddr(t)
-
-	server, err := New(
-		slog.New(slog.DiscardHandler),
-		Config{Address: addr},
-		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { _, _ = w.Write([]byte("pong")) }),
-	)
-	require.NoError(t, err)
-
-	errC := make(chan error, 1)
-	go func() { errC <- server.Start(context.Background()) }()
-
-	var (
-		statusCode    int
-		tlsNegotiated bool
-	)
-	require.Eventually(t, func() bool {
-		resp, err := http.Get("http://" + addr)
-		if err != nil {
-			return false
-		}
-		defer func() { _ = resp.Body.Close() }()
-
-		statusCode = resp.StatusCode
-		tlsNegotiated = resp.TLS != nil
-		return true
-	}, 5*time.Second, 25*time.Millisecond)
-
-	assert.Equal(t, http.StatusOK, statusCode)
-	assert.False(t, tlsNegotiated)
-
-	require.NoError(t, server.Stop(context.Background()))
-	require.NoError(t, <-errC)
-}
-
-func freeAddr(t *testing.T) string {
-	t.Helper()
-
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	require.NoError(t, err)
-	defer func() { _ = listener.Close() }()
-
-	return listener.Addr().String()
-}
-
-func writeSelfSignedCert(t *testing.T) (string, string) {
-	t.Helper()
-
-	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
-	require.NoError(t, err)
-
-	template := &x509.Certificate{
-		SerialNumber: big.NewInt(1),
-		Subject:      pkix.Name{CommonName: "localhost"},
-		NotBefore:    time.Now().Add(-time.Hour),
-		NotAfter:     time.Now().Add(time.Hour),
-		KeyUsage:     x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		IPAddresses:  []net.IP{net.ParseIP("127.0.0.1")},
-	}
-
-	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
-	require.NoError(t, err)
-
-	keyDER, err := x509.MarshalECPrivateKey(key)
-	require.NoError(t, err)
-
-	dir := t.TempDir()
-	certFile := filepath.Join(dir, "server.crt")
-	keyFile := filepath.Join(dir, "server.key")
-
-	require.NoError(t, os.WriteFile(certFile, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o644))
-	require.NoError(t, os.WriteFile(keyFile, pem.EncodeToMemory(&pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}), 0o600))
-
-	return certFile, keyFile
-}

pkg/modules/dashboard/impldashboard/listfilter.go

@@ -4,17 +4,41 @@ import (
 	"strings"
 
 	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/parser/filterquery/sqlcompiler"
 	"github.com/SigNoz/signoz/pkg/sqlstore"
 	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
 )
 
-// Compile wraps compiler errors in the dashboard list filter error code.
-func Compile(query string, formatter sqlstore.SQLFormatter) (*sqlcompiler.Compiled, error) {
-	compiled, errs := sqlcompiler.Compile(query, formatter, dashboardFieldResolver{})
+type Compiled struct {
+	SQL  string
+	Args []any
+}
+
+func (c Compiled) IsEmpty() bool {
+	return c.SQL == ""
+}
+
+// Compile always returns a non-nil *Compiled. An empty query (or one that
+// produces no SQL) yields a Compiled with an empty SQL — callers gate on
+// SQL != "" rather than a nil check.
+//
+// A `key OP value` term compiles to a DSL predicate; a bare word is a
+// case-insensitive substring search over the dashboard name, description, and tag
+// keys/values. They compose through AND/OR/NOT, so `prod payment` matches both
+// words (implicit AND) and `prod OR name = 'x'` mixes free text with a filter. A
+// quoted token matches literally, e.g. `"prod payment"`.
+func Compile(query string, formatter sqlstore.SQLFormatter) (*Compiled, error) {
+	if len(strings.TrimSpace(query)) == 0 {
+		return &Compiled{}, nil
+	}
+
+	sql, args, errs := newVisitor(formatter).compile(query)
 	if len(errs) > 0 {
 		return nil, errors.NewInvalidInputf(dashboardtypes.ErrCodeDashboardListFilterInvalid,
 			"invalid filter query: %s", strings.Join(errs, "; "))
 	}
-	return compiled, nil
+
+	return &Compiled{
+		SQL:  sql,
+		Args: args,
+	}, nil
 }

pkg/modules/dashboard/impldashboard/listfilter_resolver.go

@@ -1,125 +0,0 @@
-package impldashboard
-
-import (
-	"strings"
-
-	grammar "github.com/SigNoz/signoz/pkg/parser/filterquery/grammar"
-	"github.com/SigNoz/signoz/pkg/parser/filterquery/sqlcompiler"
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
-	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	sqlbuilder "github.com/huandu/go-sqlbuilder"
-)
-
-// dashboardFieldResolver maps dashboard list DSL keys; a non-reserved key is a tag key matched case-insensitively.
-type dashboardFieldResolver struct{}
-
-func (r dashboardFieldResolver) ResolveComparison(v *sqlcompiler.Visitor, rawKey string, operation qbtypesv5.FilterOperator, ctx *grammar.ComparisonContext) string {
-	key := strings.ToLower(rawKey)
-
-	if allowedOperations, isReserved := dashboardtypes.ReservedOps[dashboardtypes.DSLKey(key)]; isReserved {
-		return r.resolveReservedKey(v, ctx, operation, dashboardtypes.DSLKey(key), allowedOperations)
-	}
-
-	if _, allowed := dashboardtypes.TagKeyOps[operation]; !allowed {
-		v.AddError("operator %s is not allowed on a tag-key filter", sqlcompiler.OperationName(operation))
-		return ""
-	}
-	return r.buildTagComparison(v, ctx, operation, key)
-}
-
-func (r dashboardFieldResolver) resolveReservedKey(v *sqlcompiler.Visitor, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key dashboardtypes.DSLKey, allowedOperations map[qbtypesv5.FilterOperator]struct{}) string {
-	if _, allowed := allowedOperations[operation]; !allowed {
-		v.AddError("operator %s is not allowed for key %q", sqlcompiler.OperationName(operation), key)
-		return ""
-	}
-	switch key {
-	case dashboardtypes.DSLKeyName:
-		columnExpression := string(v.Formatter.JSONExtractString("dashboard.data", "$.spec.display.name"))
-		return v.BuildStringOperation(v.Sb, ctx, operation, columnExpression, string(key))
-	case dashboardtypes.DSLKeyDescription:
-		columnExpression := string(v.Formatter.JSONExtractString("dashboard.data", "$.spec.display.description"))
-		return v.BuildStringOperation(v.Sb, ctx, operation, columnExpression, string(key))
-	case dashboardtypes.DSLKeyCreatedAt:
-		return v.BuildTimestampComparison(ctx, operation, "dashboard.created_at")
-	case dashboardtypes.DSLKeyUpdatedAt:
-		return v.BuildTimestampComparison(ctx, operation, "dashboard.updated_at")
-	case dashboardtypes.DSLKeyCreatedBy:
-		return v.BuildStringOperation(v.Sb, ctx, operation, "dashboard.created_by", string(key))
-	case dashboardtypes.DSLKeyLocked:
-		return v.BuildBoolComparison(ctx, operation, "dashboard.locked")
-	}
-	v.AddError("no handler for reserved key %q", key)
-	return ""
-}
-
-func (dashboardFieldResolver) buildTagComparison(v *sqlcompiler.Visitor, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, tagKey string) string {
-	subqueryBuilder := sqlbuilder.NewSelectBuilder()
-
-	if operation == qbtypesv5.FilterOperatorExists || operation == qbtypesv5.FilterOperatorNotExists {
-		buildSubqueryForTagKey(subqueryBuilder, tagKey)
-	} else {
-		// Value predicates take the positive operator; negation toggles the EXISTS wrapper.
-		positiveOperation := operation
-		if operation.IsNegativeOperator() {
-			positiveOperation = operation.Inverse()
-		}
-		valuePredicate := v.BuildStringOperation(subqueryBuilder, ctx, positiveOperation, "t.value", tagKey)
-		if valuePredicate == "" {
-			return ""
-		}
-		buildSubqueryForTagKeyAndValue(subqueryBuilder, tagKey, valuePredicate)
-	}
-
-	if operation.IsNegativeOperator() {
-		return v.Sb.NotExists(subqueryBuilder)
-	}
-	return v.Sb.Exists(subqueryBuilder)
-}
-
-func buildSubqueryForTagKey(subqueryBuilder *sqlbuilder.SelectBuilder, tagKey string) *sqlbuilder.SelectBuilder {
-	const dashboardTagKind = `"dashboard"`
-
-	return subqueryBuilder.
-		Select("1").
-		From("tag_relation tr").
-		Join("tag t", "t.id = tr.tag_id").
-		Where(
-			subqueryBuilder.Equal("tr.kind", dashboardTagKind),
-			"tr.resource_id = dashboard.id",
-			"LOWER(t.key) = LOWER("+subqueryBuilder.Var(tagKey)+")",
-		)
-}
-
-func buildSubqueryForTagKeyAndValue(subqueryBuilder *sqlbuilder.SelectBuilder, tagKey, valuePredicate string) *sqlbuilder.SelectBuilder {
-	return buildSubqueryForTagKey(subqueryBuilder, tagKey).Where(valuePredicate)
-}
-
-// ResolveFreeText searches name, description and tag keys/values.
-func (dashboardFieldResolver) ResolveFreeText(v *sqlcompiler.Visitor, value string) string {
-	nameColumn := string(v.Formatter.JSONExtractString("dashboard.data", "$.spec.display.name"))
-	descriptionColumn := string(v.Formatter.JSONExtractString("dashboard.data", "$.spec.display.description"))
-	namePredicate := v.BuildFreeTextContains(v.Sb, nameColumn, value)
-	descriptionPredicate := v.BuildFreeTextContains(v.Sb, descriptionColumn, value)
-
-	subqueryBuilder := sqlbuilder.NewSelectBuilder()
-	keyPredicate := v.BuildFreeTextContains(subqueryBuilder, "t.key", value)
-	valuePredicate := v.BuildFreeTextContains(subqueryBuilder, "t.value", value)
-	buildSubqueryForFreeTextTag(subqueryBuilder, keyPredicate, valuePredicate)
-	tagPredicate := v.Sb.Exists(subqueryBuilder)
-
-	return v.Sb.Or(namePredicate, descriptionPredicate, tagPredicate)
-}
-
-func buildSubqueryForFreeTextTag(subqueryBuilder *sqlbuilder.SelectBuilder, keyPredicate, valuePredicate string) *sqlbuilder.SelectBuilder {
-	const dashboardTagKind = `"dashboard"`
-
-	return subqueryBuilder.
-		Select("1").
-		From("tag_relation tr").
-		Join("tag t", "t.id = tr.tag_id").
-		Where(
-			subqueryBuilder.Equal("tr.kind", dashboardTagKind),
-			"tr.resource_id = dashboard.id",
-			subqueryBuilder.Or(keyPredicate, valuePredicate),
-		)
-}

pkg/modules/dashboard/impldashboard/listfilter_test.go

@@ -559,16 +559,6 @@ func TestCompile_Rejections(t *testing.T) {
 			dslQueryToCompile:        `created_at >= 'not-a-date'`,
 			expectedErrShouldContain: "RFC3339",
 		},
-		{
-			subtestName:              "rejects LIKE pattern ending in an unescaped backslash",
-			dslQueryToCompile:        `name LIKE 'prod\\'`,
-			expectedErrShouldContain: "must not end with an unescaped backslash",
-		},
-		{
-			subtestName:              "rejects ILIKE pattern ending in an unescaped backslash",
-			dslQueryToCompile:        `name ILIKE '%\\'`,
-			expectedErrShouldContain: "must not end with an unescaped backslash",
-		},
 		{
 			subtestName:              "rejects REGEXP — not yet supported",
 			dslQueryToCompile:        `name REGEXP '.*'`,
@@ -582,19 +572,8 @@ func TestCompile_Rejections(t *testing.T) {
 	})
 }
 
-func TestCompileTrailingLiteralBackslash(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{
-			subtestName:       "escaped trailing backslash compiles",
-			dslQueryToCompile: `name LIKE '%\\\\'`,
-			expectedSQL:       `json_extract("dashboard"."data", '$.spec.display.name') LIKE ? ESCAPE '\'`,
-			expectedArgs:      []any{`%\\`},
-		},
-	})
-}
-
 // Every key in dashboardtypes.ReservedOps must have a matching case in
-// resolveReservedKey; a key that's reserved but unhandled falls
+// visitComparisonForReservedKeys; a key that's reserved but unhandled falls
 // through to the "no handler for reserved key" error. Equal is accepted by all
 // reserved keys, so `key = 'x'` always reaches the dispatch switch — a missing
 // handler surfaces as that error regardless of whether the value type-checks.
@@ -604,7 +583,7 @@ func TestCompileReservedKeysAllHandled(t *testing.T) {
 			_, err := Compile(string(key)+` = 'x'`, formatter(t))
 			if err != nil {
 				assert.NotContains(t, err.Error(), "no handler for reserved key",
-					"reserved key %q has no handler in resolveReservedKey", key)
+					"reserved key %q has no handler in visitComparisonForReservedKeys", key)
 			}
 		})
 	}

pkg/modules/dashboard/impldashboard/listfilter_visitor.go

@@ -0,0 +1,631 @@
+package impldashboard
+
+import (
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/parser/filterquery"
+	grammar "github.com/SigNoz/signoz/pkg/parser/filterquery/grammar"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
+	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/antlr4-go/antlr/v4"
+	sqlbuilder "github.com/huandu/go-sqlbuilder"
+)
+
+// bunPlaceholderFlavor is any flavor that renders `?` placeholders, which bun
+// re-binds to the actual backend (e.g. `$1` for Postgres) at query time.
+const bunPlaceholderFlavor = sqlbuilder.SQLite
+
+type visitor struct {
+	grammar.BaseFilterQueryVisitor
+	selectBuilder *sqlbuilder.SelectBuilder
+	formatter     sqlstore.SQLFormatter
+	errors        []string
+}
+
+func newVisitor(formatter sqlstore.SQLFormatter) *visitor {
+	return &visitor{
+		selectBuilder: sqlbuilder.NewSelectBuilder(),
+		formatter:     formatter,
+	}
+}
+
+// compile builds `?`-placeholder WHERE SQL + args for bun. Each term is either a
+// `key OP value` comparison or a bare token that becomes a free-text search; the
+// two compose through the boolean grammar (AND/OR/NOT). Malformed input is
+// returned as errors.
+func (v *visitor) compile(query string) (string, []any, []string) {
+	tree, _, collector := filterquery.Parse(query)
+	if len(collector.Errors) > 0 {
+		return "", nil, collector.Errors
+	}
+	condition, _ := v.visit(tree).(string)
+	if len(v.errors) > 0 {
+		return "", nil, v.errors
+	}
+	if condition == "" {
+		return "", nil, nil
+	}
+	sql, arguments := v.selectBuilder.Args.CompileWithFlavor(condition, bunPlaceholderFlavor)
+	return sql, arguments, nil
+}
+
+func (v *visitor) visit(tree antlr.ParseTree) any {
+	if tree == nil {
+		return nil
+	}
+	return tree.Accept(v)
+}
+
+// ════════════════════════════════════════════════════════════════════════
+// methods from grammar.BaseFilterQueryVisitor that are overridden
+// ════════════════════════════════════════════════════════════════════════
+
+func (v *visitor) VisitQuery(ctx *grammar.QueryContext) any {
+	return v.visit(ctx.Expression())
+}
+
+func (v *visitor) VisitExpression(ctx *grammar.ExpressionContext) any {
+	return v.visit(ctx.OrExpression())
+}
+
+func (v *visitor) VisitOrExpression(ctx *grammar.OrExpressionContext) any {
+	parts := ctx.AllAndExpression()
+	conditions := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if condition, ok := v.visit(part).(string); ok && condition != "" {
+			conditions = append(conditions, condition)
+		}
+	}
+	switch len(conditions) {
+	case 0:
+		return ""
+	case 1:
+		return conditions[0]
+	default:
+		return v.selectBuilder.Or(conditions...)
+	}
+}
+
+func (v *visitor) VisitAndExpression(ctx *grammar.AndExpressionContext) any {
+	parts := ctx.AllUnaryExpression()
+	conditions := make([]string, 0, len(parts))
+	for _, part := range parts {
+		if condition, ok := v.visit(part).(string); ok && condition != "" {
+			conditions = append(conditions, condition)
+		}
+	}
+	switch len(conditions) {
+	case 0:
+		return ""
+	case 1:
+		return conditions[0]
+	default:
+		return v.selectBuilder.And(conditions...)
+	}
+}
+
+func (v *visitor) VisitUnaryExpression(ctx *grammar.UnaryExpressionContext) any {
+	condition, _ := v.visit(ctx.Primary()).(string)
+	if condition == "" {
+		return ""
+	}
+	if ctx.NOT() != nil {
+		return fmt.Sprintf("NOT (%s)", condition)
+	}
+	return condition
+}
+
+func (v *visitor) VisitPrimary(ctx *grammar.PrimaryContext) any {
+	if ctx.OrExpression() != nil {
+		return v.visit(ctx.OrExpression())
+	}
+	if ctx.Comparison() != nil {
+		return v.visit(ctx.Comparison())
+	}
+	// A lone key/value/full-text token is a free-text term, composed with any
+	// comparisons through the boolean grammar. A quoted token matches its contents
+	// literally — the escape hatch for a phrase or a term that looks like DSL.
+	return v.buildFreeTextTerm(trimQuotes(ctx.GetText()))
+}
+
+// VisitComparison dispatches a single `key OP value` term. A key that matches
+// a reserved DSL key (name, description, etc.) becomes a column-level
+// predicate; any other identifier is treated as a tag key — the operator
+// applies to the tag's value, with a case-insensitive match on the tag's key.
+func (v *visitor) VisitComparison(ctx *grammar.ComparisonContext) any {
+	key := strings.ToLower(strings.TrimSpace(ctx.Key().GetText()))
+
+	operation, ok := v.extractOperation(ctx)
+	if !ok {
+		return ""
+	}
+
+	if allowedOperations, isReserved := dashboardtypes.ReservedOps[dashboardtypes.DSLKey(key)]; isReserved {
+		return v.visitComparisonForReservedKeys(ctx, operation, dashboardtypes.DSLKey(key), allowedOperations)
+	}
+	return v.visitComparisonForTags(ctx, operation, key)
+}
+
+func (v *visitor) visitComparisonForReservedKeys(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key dashboardtypes.DSLKey, allowedOperations map[qbtypesv5.FilterOperator]struct{}) string {
+	if _, allowed := allowedOperations[operation]; !allowed {
+		v.addError("operator %s is not allowed for key %q", operationName(operation), key)
+		return ""
+	}
+	switch key {
+	case dashboardtypes.DSLKeyName:
+		return v.buildJSONStringComparison(ctx, operation, dashboardtypes.DSLKeyName, "$.spec.display.name")
+	case dashboardtypes.DSLKeyDescription:
+		return v.buildJSONStringComparison(ctx, operation, dashboardtypes.DSLKeyDescription, "$.spec.display.description")
+	case dashboardtypes.DSLKeyCreatedAt:
+		return v.buildTimestampComparison(ctx, operation, "dashboard.created_at")
+	case dashboardtypes.DSLKeyUpdatedAt:
+		return v.buildTimestampComparison(ctx, operation, "dashboard.updated_at")
+	case dashboardtypes.DSLKeyCreatedBy:
+		return v.buildStringComparison(ctx, operation, dashboardtypes.DSLKeyCreatedBy, "dashboard.created_by")
+	case dashboardtypes.DSLKeyLocked:
+		return v.buildBoolComparison(ctx, operation, "dashboard.locked")
+	}
+	// Unreachable for real input: every dashboardtypes.ReservedOps key has a case above, and
+	// TestCompileReservedKeysAllHandled guards that the two stay in sync.
+	v.addError("no handler for reserved key %q", key)
+	return ""
+}
+
+func (v *visitor) visitComparisonForTags(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, tagKey string) string {
+	if _, allowed := dashboardtypes.TagKeyOps[operation]; !allowed {
+		v.addError("operator %s is not allowed on a tag-key filter", operationName(operation))
+		return ""
+	}
+	return v.buildTagComparison(ctx, operation, tagKey)
+}
+
+func (v *visitor) extractOperation(ctx *grammar.ComparisonContext) (qbtypesv5.FilterOperator, bool) {
+	// For operators that take an optional leading NOT, Inverse() maps each to
+	// its Not<X> counterpart.
+	maybeNot := func(operation qbtypesv5.FilterOperator) qbtypesv5.FilterOperator {
+		if ctx.NOT() != nil {
+			return operation.Inverse()
+		}
+		return operation
+	}
+	switch {
+	case ctx.EQUALS() != nil:
+		return qbtypesv5.FilterOperatorEqual, true
+	case ctx.NOT_EQUALS() != nil, ctx.NEQ() != nil:
+		return qbtypesv5.FilterOperatorNotEqual, true
+	case ctx.LT() != nil:
+		return qbtypesv5.FilterOperatorLessThan, true
+	case ctx.LE() != nil:
+		return qbtypesv5.FilterOperatorLessThanOrEq, true
+	case ctx.GT() != nil:
+		return qbtypesv5.FilterOperatorGreaterThan, true
+	case ctx.GE() != nil:
+		return qbtypesv5.FilterOperatorGreaterThanOrEq, true
+	case ctx.BETWEEN() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorBetween), true
+	case ctx.LIKE() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorLike), true
+	case ctx.ILIKE() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorILike), true
+	case ctx.CONTAINS() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorContains), true
+	case ctx.REGEXP() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorRegexp), true
+	case ctx.InClause() != nil:
+		return qbtypesv5.FilterOperatorIn, true
+	case ctx.NotInClause() != nil:
+		return qbtypesv5.FilterOperatorNotIn, true
+	case ctx.EXISTS() != nil:
+		return maybeNot(qbtypesv5.FilterOperatorExists), true
+	}
+	v.addError("could not determine operator in expression %q", ctx.GetText())
+	return qbtypesv5.FilterOperatorUnknown, false
+}
+
+// ─── per-key emitters ────────────────────────────────────────────────────────
+
+func (v *visitor) buildJSONStringComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key dashboardtypes.DSLKey, jsonPath string) string {
+	columnExpression := string(v.formatter.JSONExtractString("dashboard.data", jsonPath))
+	return v.buildStringOperation(v.selectBuilder, ctx, operation, columnExpression, string(key))
+}
+
+func (v *visitor) buildStringComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key dashboardtypes.DSLKey, columnExpression string) string {
+	return v.buildStringOperation(v.selectBuilder, ctx, operation, columnExpression, string(key))
+}
+
+// buildStringOperation covers all the operators the spec allows on text-shaped keys
+// (name, description, created_by, and a tag's value). Placeholders are interned
+// into builder — the outer builder for column predicates, the subquery builder for
+// tag-value predicates — so nested EXISTS arguments thread correctly.
+func (v *visitor) buildStringOperation(builder *sqlbuilder.SelectBuilder, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression, keyForError string) string {
+	switch operation {
+	case qbtypesv5.FilterOperatorEqual:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		return builder.Equal(columnExpression, val)
+	case qbtypesv5.FilterOperatorNotEqual:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		return builder.NotEqual(columnExpression, val)
+	case qbtypesv5.FilterOperatorLike, qbtypesv5.FilterOperatorNotLike:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		like := "LIKE"
+		if operation == qbtypesv5.FilterOperatorNotLike {
+			like = "NOT LIKE"
+		}
+		// The user's % and _ stay as wildcards; ESCAPE pins backslash as the escape
+		// char so a literal `\` in the pattern is read the same on both dialects —
+		// Postgres defaults to `\`, SQLite has no default escape.
+		return fmt.Sprintf("%s %s %s ESCAPE '\\'", columnExpression, like, builder.Var(val))
+	case qbtypesv5.FilterOperatorILike, qbtypesv5.FilterOperatorNotILike:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		// SQLite has no ILIKE keyword and Postgres LIKE is case-sensitive — emit
+		// LOWER(col) LIKE LOWER(?) so behavior is identical on both dialects. ESCAPE
+		// pins backslash as the escape char (Postgres default; SQLite has none).
+		lowerColumn := string(v.formatter.LowerExpression(columnExpression))
+		like := "LIKE"
+		if operation == qbtypesv5.FilterOperatorNotILike {
+			like = "NOT LIKE"
+		}
+		return fmt.Sprintf("%s %s LOWER(%s) ESCAPE '\\'", lowerColumn, like, builder.Var(val))
+	case qbtypesv5.FilterOperatorContains, qbtypesv5.FilterOperatorNotContains:
+		val, ok := v.extractSingleStringValue(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		like := "LIKE"
+		if operation == qbtypesv5.FilterOperatorNotContains {
+			like = "NOT LIKE"
+		}
+		// Escape the user's % and _ so they match literally, then wrap in wildcards.
+		// ESCAPE declares the backslash the escaper injected as the escape char —
+		// needed on SQLite (no default) and a harmless restatement of the Postgres default.
+		escaped := v.formatter.EscapeLikePattern(val)
+		return fmt.Sprintf("%s %s %s ESCAPE '\\'", columnExpression, like, builder.Var("%"+escaped+"%"))
+	case qbtypesv5.FilterOperatorRegexp, qbtypesv5.FilterOperatorNotRegexp:
+		v.addError("REGEXP filtering on %q is not yet supported", keyForError)
+		return ""
+	case qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn:
+		values, ok := v.extractStringValueList(ctx, keyForError)
+		if !ok {
+			return ""
+		}
+		arguments := make([]any, len(values))
+		for i, s := range values {
+			arguments[i] = s
+		}
+		if operation == qbtypesv5.FilterOperatorNotIn {
+			return builder.NotIn(columnExpression, arguments...)
+		}
+		return builder.In(columnExpression, arguments...)
+	}
+	v.addError("operator %s on %q is not implemented", operationName(operation), keyForError)
+	return ""
+}
+
+func (v *visitor) buildTimestampComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression string) string {
+	switch operation {
+	case qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
+		qbtypesv5.FilterOperatorLessThan, qbtypesv5.FilterOperatorLessThanOrEq,
+		qbtypesv5.FilterOperatorGreaterThan, qbtypesv5.FilterOperatorGreaterThanOrEq:
+		t, ok := v.extractSingleTimestampValue(ctx)
+		if !ok {
+			return ""
+		}
+		switch operation {
+		case qbtypesv5.FilterOperatorEqual:
+			return v.selectBuilder.Equal(columnExpression, t)
+		case qbtypesv5.FilterOperatorNotEqual:
+			return v.selectBuilder.NotEqual(columnExpression, t)
+		case qbtypesv5.FilterOperatorLessThan:
+			return v.selectBuilder.LessThan(columnExpression, t)
+		case qbtypesv5.FilterOperatorLessThanOrEq:
+			return v.selectBuilder.LessEqualThan(columnExpression, t)
+		case qbtypesv5.FilterOperatorGreaterThan:
+			return v.selectBuilder.GreaterThan(columnExpression, t)
+		case qbtypesv5.FilterOperatorGreaterThanOrEq:
+			return v.selectBuilder.GreaterEqualThan(columnExpression, t)
+		}
+	case qbtypesv5.FilterOperatorBetween, qbtypesv5.FilterOperatorNotBetween:
+		timestamps, ok := v.extractTwoTimestampValues(ctx)
+		if !ok {
+			return ""
+		}
+		if operation == qbtypesv5.FilterOperatorNotBetween {
+			return v.selectBuilder.NotBetween(columnExpression, timestamps[0], timestamps[1])
+		}
+		return v.selectBuilder.Between(columnExpression, timestamps[0], timestamps[1])
+	}
+	v.addError("operator %s on timestamp is not implemented", operationName(operation))
+	return ""
+}
+
+func (v *visitor) buildBoolComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression string) string {
+	b, ok := v.extractSingleBoolValue(ctx)
+	if !ok {
+		return ""
+	}
+	if operation == qbtypesv5.FilterOperatorNotEqual {
+		return v.selectBuilder.NotEqual(columnExpression, b)
+	}
+	return v.selectBuilder.Equal(columnExpression, b)
+}
+
+func (v *visitor) buildTagComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, tagKey string) string {
+	subqueryBuilder := sqlbuilder.NewSelectBuilder()
+
+	if operation == qbtypesv5.FilterOperatorExists || operation == qbtypesv5.FilterOperatorNotExists {
+		buildSubqueryForTagKey(subqueryBuilder, tagKey)
+	} else {
+		// All other tag operators take the positive form of the value predicate
+		// and toggle the EXISTS wrapper for negation. Inverse() flips Not<X> → <X>.
+		positiveOperation := operation
+		if operation.IsNegativeOperator() {
+			positiveOperation = operation.Inverse()
+		}
+		valuePredicate := v.buildStringOperation(subqueryBuilder, ctx, positiveOperation, "t.value", tagKey)
+		if valuePredicate == "" {
+			return ""
+		}
+		buildSubqueryForTagKeyAndValue(subqueryBuilder, tagKey, valuePredicate)
+	}
+
+	if operation.IsNegativeOperator() {
+		return v.selectBuilder.NotExists(subqueryBuilder)
+	}
+	return v.selectBuilder.Exists(subqueryBuilder)
+}
+
+func buildSubqueryForTagKey(subqueryBuilder *sqlbuilder.SelectBuilder, tagKey string) *sqlbuilder.SelectBuilder {
+	const dashboardTagKind = `"dashboard"`
+
+	return subqueryBuilder.
+		Select("1").
+		From("tag_relation tr").
+		Join("tag t", "t.id = tr.tag_id").
+		Where(
+			subqueryBuilder.Equal("tr.kind", dashboardTagKind),
+			"tr.resource_id = dashboard.id",
+			"LOWER(t.key) = LOWER("+subqueryBuilder.Var(tagKey)+")",
+		)
+}
+
+func buildSubqueryForTagKeyAndValue(subqueryBuilder *sqlbuilder.SelectBuilder, tagKey, valuePredicate string) *sqlbuilder.SelectBuilder {
+	return buildSubqueryForTagKey(subqueryBuilder, tagKey).Where(valuePredicate)
+}
+
+// ─── free-text search ────────────────────────────────────────────────────────
+
+// buildFreeTextTerm matches value as a case-insensitive substring of the
+// dashboard name, description, or any tag key/value.
+func (v *visitor) buildFreeTextTerm(value string) string {
+	nameColumn := string(v.formatter.JSONExtractString("dashboard.data", "$.spec.display.name"))
+	descriptionColumn := string(v.formatter.JSONExtractString("dashboard.data", "$.spec.display.description"))
+	namePredicate := v.buildFreeTextContains(v.selectBuilder, nameColumn, value)
+	descriptionPredicate := v.buildFreeTextContains(v.selectBuilder, descriptionColumn, value)
+
+	subqueryBuilder := sqlbuilder.NewSelectBuilder()
+	keyPredicate := v.buildFreeTextContains(subqueryBuilder, "t.key", value)
+	valuePredicate := v.buildFreeTextContains(subqueryBuilder, "t.value", value)
+	buildSubqueryForFreeTextTag(subqueryBuilder, keyPredicate, valuePredicate)
+	tagPredicate := v.selectBuilder.Exists(subqueryBuilder)
+
+	return v.selectBuilder.Or(namePredicate, descriptionPredicate, tagPredicate)
+}
+
+// buildFreeTextContains emits a case-insensitive contains as
+// LOWER(COALESCE(col, '')) LIKE LOWER(?), identical on SQLite and Postgres.
+// COALESCE keeps a NULL column (an absent description) false rather than NULL —
+// otherwise `NOT (…)` goes NULL and drops every description-less dashboard. The
+// value's % and _ are escaped, and ESCAPE pins backslash as the escape char.
+func (v *visitor) buildFreeTextContains(builder *sqlbuilder.SelectBuilder, columnExpression, value string) string {
+	lowerColumn := string(v.formatter.LowerExpression("COALESCE(" + columnExpression + ", '')"))
+	pattern := "%" + v.formatter.EscapeLikePattern(value) + "%"
+	return fmt.Sprintf("%s LIKE LOWER(%s) ESCAPE '\\'", lowerColumn, builder.Var(pattern))
+}
+
+func buildSubqueryForFreeTextTag(subqueryBuilder *sqlbuilder.SelectBuilder, keyPredicate, valuePredicate string) *sqlbuilder.SelectBuilder {
+	const dashboardTagKind = `"dashboard"`
+
+	return subqueryBuilder.
+		Select("1").
+		From("tag_relation tr").
+		Join("tag t", "t.id = tr.tag_id").
+		Where(
+			subqueryBuilder.Equal("tr.kind", dashboardTagKind),
+			"tr.resource_id = dashboard.id",
+			subqueryBuilder.Or(keyPredicate, valuePredicate),
+		)
+}
+
+// ─── value extraction helpers ───────────────────────────────────────────────
+
+func (v *visitor) addError(format string, arguments ...any) {
+	v.errors = append(v.errors, fmt.Sprintf(format, arguments...))
+}
+
+func (v *visitor) extractSingleStringValue(ctx *grammar.ComparisonContext, keyForError string) (string, bool) {
+	values := ctx.AllValue()
+	if len(values) != 1 {
+		v.addError("expected exactly one value for %q", keyForError)
+		return "", false
+	}
+	return v.extractStringValue(values[0], keyForError)
+}
+
+func (v *visitor) extractSingleBoolValue(ctx *grammar.ComparisonContext) (bool, bool) {
+	values := ctx.AllValue()
+	if len(values) != 1 {
+		v.addError("expected a single boolean (true/false)")
+		return false, false
+	}
+	return v.extractBoolValue(values[0])
+}
+
+func (v *visitor) extractSingleTimestampValue(ctx *grammar.ComparisonContext) (time.Time, bool) {
+	values := ctx.AllValue()
+	if len(values) != 1 {
+		v.addError("expected a single RFC3339 timestamp")
+		return time.Time{}, false
+	}
+	return v.extractTimestampValue(values[0])
+}
+
+func (v *visitor) extractTwoTimestampValues(ctx *grammar.ComparisonContext) ([2]time.Time, bool) {
+	values := ctx.AllValue()
+	if len(values) != 2 {
+		v.addError("BETWEEN expects two RFC3339 timestamps")
+		return [2]time.Time{}, false
+	}
+	a, ok1 := v.extractTimestampValue(values[0])
+	b, ok2 := v.extractTimestampValue(values[1])
+	if !ok1 || !ok2 {
+		return [2]time.Time{}, false
+	}
+	return [2]time.Time{a, b}, true
+}
+
+func (v *visitor) extractStringValueList(ctx *grammar.ComparisonContext, keyForError string) ([]string, bool) {
+	var valuesCtx []grammar.IValueContext
+	switch {
+	case ctx.InClause() != nil:
+		inClause := ctx.InClause()
+		if inClause.ValueList() != nil {
+			valuesCtx = inClause.ValueList().AllValue()
+		} else {
+			valuesCtx = []grammar.IValueContext{inClause.Value()}
+		}
+	case ctx.NotInClause() != nil:
+		notInClause := ctx.NotInClause()
+		if notInClause.ValueList() != nil {
+			valuesCtx = notInClause.ValueList().AllValue()
+		} else {
+			valuesCtx = []grammar.IValueContext{notInClause.Value()}
+		}
+	default:
+		v.addError("IN clause is missing for %q", keyForError)
+		return nil, false
+	}
+	if len(valuesCtx) == 0 {
+		v.addError("IN list for %q is empty", keyForError)
+		return nil, false
+	}
+	out := make([]string, 0, len(valuesCtx))
+	for _, valueContext := range valuesCtx {
+		s, ok := v.extractStringValue(valueContext, keyForError)
+		if !ok {
+			return nil, false
+		}
+		out = append(out, s)
+	}
+	return out, true
+}
+
+func (v *visitor) extractStringValue(ctx grammar.IValueContext, keyForError string) (string, bool) {
+	if ctx.QUOTED_TEXT() != nil {
+		return trimQuotes(ctx.QUOTED_TEXT().GetText()), true
+	}
+	if ctx.KEY() != nil {
+		// Bare tokens are accepted as strings, mirroring the FilterQuery lexer's
+		// treatment of unquoted identifiers on the value side.
+		return ctx.KEY().GetText(), true
+	}
+	v.addError("expected a string value for %q, got %q", keyForError, ctx.GetText())
+	return "", false
+}
+
+func (v *visitor) extractBoolValue(ctx grammar.IValueContext) (bool, bool) {
+	if ctx.BOOL() == nil {
+		v.addError("expected a boolean (true/false), got %q", ctx.GetText())
+		return false, false
+	}
+	return strings.EqualFold(ctx.BOOL().GetText(), "true"), true
+}
+
+func (v *visitor) extractTimestampValue(ctx grammar.IValueContext) (time.Time, bool) {
+	if ctx.QUOTED_TEXT() == nil {
+		v.addError("expected an RFC3339 timestamp string, got %q", ctx.GetText())
+		return time.Time{}, false
+	}
+	raw := trimQuotes(ctx.QUOTED_TEXT().GetText())
+	t, err := time.Parse(time.RFC3339, raw)
+	if err != nil {
+		v.addError("invalid RFC3339 timestamp %q: %s", raw, err.Error())
+		return time.Time{}, false
+	}
+	return t, true
+}
+
+// ─── operator spelling ───────────────────────────────────────────────────────
+
+// operationName returns the user-facing spelling of a FilterOperator, used only in
+// error messages — go-sqlbuilder's Cond helpers emit the SQL keywords.
+func operationName(operation qbtypesv5.FilterOperator) string {
+	switch operation {
+	case qbtypesv5.FilterOperatorEqual:
+		return "="
+	case qbtypesv5.FilterOperatorNotEqual:
+		return "!="
+	case qbtypesv5.FilterOperatorLessThan:
+		return "<"
+	case qbtypesv5.FilterOperatorLessThanOrEq:
+		return "<="
+	case qbtypesv5.FilterOperatorGreaterThan:
+		return ">"
+	case qbtypesv5.FilterOperatorGreaterThanOrEq:
+		return ">="
+	case qbtypesv5.FilterOperatorBetween:
+		return "BETWEEN"
+	case qbtypesv5.FilterOperatorNotBetween:
+		return "NOT BETWEEN"
+	case qbtypesv5.FilterOperatorLike:
+		return "LIKE"
+	case qbtypesv5.FilterOperatorNotLike:
+		return "NOT LIKE"
+	case qbtypesv5.FilterOperatorILike:
+		return "ILIKE"
+	case qbtypesv5.FilterOperatorNotILike:
+		return "NOT ILIKE"
+	case qbtypesv5.FilterOperatorContains:
+		return "CONTAINS"
+	case qbtypesv5.FilterOperatorNotContains:
+		return "NOT CONTAINS"
+	case qbtypesv5.FilterOperatorRegexp:
+		return "REGEXP"
+	case qbtypesv5.FilterOperatorNotRegexp:
+		return "NOT REGEXP"
+	case qbtypesv5.FilterOperatorIn:
+		return "IN"
+	case qbtypesv5.FilterOperatorNotIn:
+		return "NOT IN"
+	case qbtypesv5.FilterOperatorExists:
+		return "EXISTS"
+	case qbtypesv5.FilterOperatorNotExists:
+		return "NOT EXISTS"
+	}
+	return "?"
+}
+
+func trimQuotes(s string) string {
+	if len(s) >= 2 {
+		if (s[0] == '"' && s[len(s)-1] == '"') || (s[0] == '\'' && s[len(s)-1] == '\'') {
+			s = s[1 : len(s)-1]
+		}
+	}
+	s = strings.ReplaceAll(s, `\\`, `\`)
+	s = strings.ReplaceAll(s, `\'`, `'`)
+	return s
+}

pkg/parser/filterquery/sqlcompiler/compiler.go

@@ -1,514 +0,0 @@
-// Package sqlcompiler compiles list-page filter queries to relational-store WHERE clauses; telemetry queries stay on querybuilder's ClickHouse visitor.
-package sqlcompiler
-
-import (
-	"fmt"
-	"strings"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/parser/filterquery"
-	grammar "github.com/SigNoz/signoz/pkg/parser/filterquery/grammar"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/antlr4-go/antlr/v4"
-	sqlbuilder "github.com/huandu/go-sqlbuilder"
-)
-
-// bunPlaceholderFlavor is any flavor that renders the `?` placeholders bun expects.
-const bunPlaceholderFlavor = sqlbuilder.SQLite
-
-// FieldResolver is the per-feature policy: which keys exist and what each maps to.
-type FieldResolver interface {
-	// ResolveComparison builds the predicate for one `key OP value` term; key keeps the user's casing.
-	ResolveComparison(v *Visitor, key string, operation qbtypesv5.FilterOperator, ctx *grammar.ComparisonContext) string
-	// ResolveFreeText builds the predicate for a bare token.
-	ResolveFreeText(v *Visitor, value string) string
-}
-
-// Compiled is a `?`-placeholder WHERE clause with its bun bind args.
-type Compiled struct {
-	SQL  string
-	Args []any
-}
-
-func (c Compiled) IsEmpty() bool {
-	return c.SQL == ""
-}
-
-// Compile on success returns a non-nil *Compiled, empty for an empty query; callers gate on IsEmpty, not nil.
-func Compile(query string, formatter sqlstore.SQLFormatter, resolver FieldResolver) (*Compiled, []string) {
-	if len(strings.TrimSpace(query)) == 0 {
-		return &Compiled{}, nil
-	}
-
-	v := &Visitor{
-		Sb:        sqlbuilder.NewSelectBuilder(),
-		Formatter: formatter,
-		resolver:  resolver,
-	}
-
-	tree, _, collector := filterquery.Parse(query)
-	if len(collector.Errors) > 0 {
-		return nil, collector.Errors
-	}
-	condition, _ := v.visit(tree).(string)
-	if len(v.errors) > 0 {
-		return nil, v.errors
-	}
-	if condition == "" {
-		return &Compiled{}, nil
-	}
-	sql, arguments := v.Sb.Args.CompileWithFlavor(condition, bunPlaceholderFlavor)
-	return &Compiled{SQL: sql, Args: arguments}, nil
-}
-
-// Visitor walks the parse tree and carries the per-compile SQL state; the
-// FieldResolver calls its helpers back to build each predicate.
-type Visitor struct {
-	grammar.BaseFilterQueryVisitor
-	Sb        *sqlbuilder.SelectBuilder
-	Formatter sqlstore.SQLFormatter
-	errors    []string
-	resolver  FieldResolver
-}
-
-func (v *Visitor) visit(tree antlr.ParseTree) any {
-	if tree == nil {
-		return nil
-	}
-	return tree.Accept(v)
-}
-
-func (v *Visitor) VisitQuery(ctx *grammar.QueryContext) any {
-	return v.visit(ctx.Expression())
-}
-
-func (v *Visitor) VisitExpression(ctx *grammar.ExpressionContext) any {
-	return v.visit(ctx.OrExpression())
-}
-
-func (v *Visitor) VisitOrExpression(ctx *grammar.OrExpressionContext) any {
-	parts := ctx.AllAndExpression()
-	conditions := make([]string, 0, len(parts))
-	for _, part := range parts {
-		if condition, ok := v.visit(part).(string); ok && condition != "" {
-			conditions = append(conditions, condition)
-		}
-	}
-	switch len(conditions) {
-	case 0:
-		return ""
-	case 1:
-		return conditions[0]
-	default:
-		return v.Sb.Or(conditions...)
-	}
-}
-
-func (v *Visitor) VisitAndExpression(ctx *grammar.AndExpressionContext) any {
-	parts := ctx.AllUnaryExpression()
-	conditions := make([]string, 0, len(parts))
-	for _, part := range parts {
-		if condition, ok := v.visit(part).(string); ok && condition != "" {
-			conditions = append(conditions, condition)
-		}
-	}
-	switch len(conditions) {
-	case 0:
-		return ""
-	case 1:
-		return conditions[0]
-	default:
-		return v.Sb.And(conditions...)
-	}
-}
-
-func (v *Visitor) VisitUnaryExpression(ctx *grammar.UnaryExpressionContext) any {
-	condition, _ := v.visit(ctx.Primary()).(string)
-	if condition == "" {
-		return ""
-	}
-	if ctx.NOT() != nil {
-		return fmt.Sprintf("NOT (%s)", condition)
-	}
-	return condition
-}
-
-func (v *Visitor) VisitPrimary(ctx *grammar.PrimaryContext) any {
-	if ctx.OrExpression() != nil {
-		return v.visit(ctx.OrExpression())
-	}
-	if ctx.Comparison() != nil {
-		return v.visit(ctx.Comparison())
-	}
-	// A quoted lone token matches its contents literally, the escape hatch for a phrase that looks like DSL.
-	return v.resolver.ResolveFreeText(v, trimQuotes(ctx.GetText()))
-}
-
-func (v *Visitor) VisitComparison(ctx *grammar.ComparisonContext) any {
-	key := strings.TrimSpace(ctx.Key().GetText())
-	operation, ok := v.extractOperation(ctx)
-	if !ok {
-		return ""
-	}
-	return v.resolver.ResolveComparison(v, key, operation, ctx)
-}
-
-func (v *Visitor) extractOperation(ctx *grammar.ComparisonContext) (qbtypesv5.FilterOperator, bool) {
-	maybeNot := func(operation qbtypesv5.FilterOperator) qbtypesv5.FilterOperator {
-		if ctx.NOT() != nil {
-			return operation.Inverse()
-		}
-		return operation
-	}
-	switch {
-	case ctx.EQUALS() != nil:
-		return qbtypesv5.FilterOperatorEqual, true
-	case ctx.NOT_EQUALS() != nil, ctx.NEQ() != nil:
-		return qbtypesv5.FilterOperatorNotEqual, true
-	case ctx.LT() != nil:
-		return qbtypesv5.FilterOperatorLessThan, true
-	case ctx.LE() != nil:
-		return qbtypesv5.FilterOperatorLessThanOrEq, true
-	case ctx.GT() != nil:
-		return qbtypesv5.FilterOperatorGreaterThan, true
-	case ctx.GE() != nil:
-		return qbtypesv5.FilterOperatorGreaterThanOrEq, true
-	case ctx.BETWEEN() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorBetween), true
-	case ctx.LIKE() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorLike), true
-	case ctx.ILIKE() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorILike), true
-	case ctx.CONTAINS() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorContains), true
-	case ctx.REGEXP() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorRegexp), true
-	case ctx.InClause() != nil:
-		return qbtypesv5.FilterOperatorIn, true
-	case ctx.NotInClause() != nil:
-		return qbtypesv5.FilterOperatorNotIn, true
-	case ctx.EXISTS() != nil:
-		return maybeNot(qbtypesv5.FilterOperatorExists), true
-	}
-	v.AddError("could not determine operator in expression %q", ctx.GetText())
-	return qbtypesv5.FilterOperatorUnknown, false
-}
-
-// ─── predicate builders ──────────────────────────────────────────────────────
-
-// BuildStringOperation interns placeholders into sb so nested subquery arguments thread correctly.
-func (v *Visitor) BuildStringOperation(sb *sqlbuilder.SelectBuilder, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression, keyForError string) string {
-	switch operation {
-	case qbtypesv5.FilterOperatorEqual:
-		val, ok := v.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		return sb.Equal(columnExpression, val)
-	case qbtypesv5.FilterOperatorNotEqual:
-		val, ok := v.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		return sb.NotEqual(columnExpression, val)
-	case qbtypesv5.FilterOperatorLike, qbtypesv5.FilterOperatorNotLike:
-		val, ok := v.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		if endsWithDanglingEscape(val) {
-			v.AddError("LIKE pattern for %q must not end with an unescaped backslash, use \\\\ to match a literal backslash", keyForError)
-			return ""
-		}
-		like := "LIKE"
-		if operation == qbtypesv5.FilterOperatorNotLike {
-			like = "NOT LIKE"
-		}
-		// ESCAPE pins backslash as the escape char (the Postgres default, SQLite has none).
-		return fmt.Sprintf("%s %s %s ESCAPE '\\'", columnExpression, like, sb.Var(val))
-	case qbtypesv5.FilterOperatorILike, qbtypesv5.FilterOperatorNotILike:
-		val, ok := v.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		if endsWithDanglingEscape(val) {
-			v.AddError("ILIKE pattern for %q must not end with an unescaped backslash, use \\\\ to match a literal backslash", keyForError)
-			return ""
-		}
-		// SQLite has no ILIKE and Postgres LIKE is case-sensitive, so LOWER both sides.
-		lowerColumn := string(v.Formatter.LowerExpression(columnExpression))
-		like := "LIKE"
-		if operation == qbtypesv5.FilterOperatorNotILike {
-			like = "NOT LIKE"
-		}
-		return fmt.Sprintf("%s %s LOWER(%s) ESCAPE '\\'", lowerColumn, like, sb.Var(val))
-	case qbtypesv5.FilterOperatorContains, qbtypesv5.FilterOperatorNotContains:
-		val, ok := v.ExtractSingleStringValue(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		like := "LIKE"
-		if operation == qbtypesv5.FilterOperatorNotContains {
-			like = "NOT LIKE"
-		}
-		// Escape the user's % and _ so they match literally, then wrap in wildcards.
-		escaped := v.Formatter.EscapeLikePattern(val)
-		return fmt.Sprintf("%s %s %s ESCAPE '\\'", columnExpression, like, sb.Var(fmt.Sprintf("%%%s%%", escaped)))
-	case qbtypesv5.FilterOperatorRegexp, qbtypesv5.FilterOperatorNotRegexp:
-		v.AddError("REGEXP filtering on %q is not supported", keyForError)
-		return ""
-	case qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn:
-		values, ok := v.ExtractStringValueList(ctx, keyForError)
-		if !ok {
-			return ""
-		}
-		arguments := make([]any, len(values))
-		for i, s := range values {
-			arguments[i] = s
-		}
-		if operation == qbtypesv5.FilterOperatorNotIn {
-			return sb.NotIn(columnExpression, arguments...)
-		}
-		return sb.In(columnExpression, arguments...)
-	}
-	v.AddError("operator %s on %q is not implemented", OperationName(operation), keyForError)
-	return ""
-}
-
-func (v *Visitor) BuildTimestampComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression string) string {
-	switch operation {
-	case qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
-		qbtypesv5.FilterOperatorLessThan, qbtypesv5.FilterOperatorLessThanOrEq,
-		qbtypesv5.FilterOperatorGreaterThan, qbtypesv5.FilterOperatorGreaterThanOrEq:
-		t, ok := v.extractSingleTimestampValue(ctx)
-		if !ok {
-			return ""
-		}
-		switch operation {
-		case qbtypesv5.FilterOperatorEqual:
-			return v.Sb.Equal(columnExpression, t)
-		case qbtypesv5.FilterOperatorNotEqual:
-			return v.Sb.NotEqual(columnExpression, t)
-		case qbtypesv5.FilterOperatorLessThan:
-			return v.Sb.LessThan(columnExpression, t)
-		case qbtypesv5.FilterOperatorLessThanOrEq:
-			return v.Sb.LessEqualThan(columnExpression, t)
-		case qbtypesv5.FilterOperatorGreaterThan:
-			return v.Sb.GreaterThan(columnExpression, t)
-		case qbtypesv5.FilterOperatorGreaterThanOrEq:
-			return v.Sb.GreaterEqualThan(columnExpression, t)
-		}
-	case qbtypesv5.FilterOperatorBetween, qbtypesv5.FilterOperatorNotBetween:
-		timestamps, ok := v.extractTwoTimestampValues(ctx)
-		if !ok {
-			return ""
-		}
-		if operation == qbtypesv5.FilterOperatorNotBetween {
-			return v.Sb.NotBetween(columnExpression, timestamps[0], timestamps[1])
-		}
-		return v.Sb.Between(columnExpression, timestamps[0], timestamps[1])
-	}
-	v.AddError("operator %s on timestamp is not implemented", OperationName(operation))
-	return ""
-}
-
-func (v *Visitor) BuildBoolComparison(ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, columnExpression string) string {
-	value, ok := v.extractSingleBoolValue(ctx)
-	if !ok {
-		return ""
-	}
-	if operation == qbtypesv5.FilterOperatorNotEqual {
-		return v.Sb.NotEqual(columnExpression, value)
-	}
-	return v.Sb.Equal(columnExpression, value)
-}
-
-// BuildFreeTextContains COALESCEs the column so NOT (...) does not go NULL and drop rows where it is absent.
-func (v *Visitor) BuildFreeTextContains(sb *sqlbuilder.SelectBuilder, columnExpression, value string) string {
-	lowerColumn := string(v.Formatter.LowerExpression(fmt.Sprintf("COALESCE(%s, '')", columnExpression)))
-	pattern := fmt.Sprintf("%%%s%%", v.Formatter.EscapeLikePattern(value))
-	return fmt.Sprintf("%s LIKE LOWER(%s) ESCAPE '\\'", lowerColumn, sb.Var(pattern))
-}
-
-// A pattern ending in an unescaped backslash never matches on sqlite and errors on Postgres.
-func endsWithDanglingEscape(value string) bool {
-	trailing := len(value) - len(strings.TrimRight(value, `\`))
-	return trailing%2 == 1
-}
-
-// ─── value extraction helpers ────────────────────────────────────────────────
-
-func (v *Visitor) AddError(format string, arguments ...any) {
-	v.errors = append(v.errors, fmt.Sprintf(format, arguments...))
-}
-
-func (v *Visitor) ExtractSingleStringValue(ctx *grammar.ComparisonContext, keyForError string) (string, bool) {
-	values := ctx.AllValue()
-	if len(values) != 1 {
-		v.AddError("expected exactly one value for %q", keyForError)
-		return "", false
-	}
-	return v.extractStringValue(values[0], keyForError)
-}
-
-func (v *Visitor) ExtractStringValueList(ctx *grammar.ComparisonContext, keyForError string) ([]string, bool) {
-	var valuesCtx []grammar.IValueContext
-	switch {
-	case ctx.InClause() != nil:
-		inClause := ctx.InClause()
-		if inClause.ValueList() != nil {
-			valuesCtx = inClause.ValueList().AllValue()
-		} else {
-			valuesCtx = []grammar.IValueContext{inClause.Value()}
-		}
-	case ctx.NotInClause() != nil:
-		notInClause := ctx.NotInClause()
-		if notInClause.ValueList() != nil {
-			valuesCtx = notInClause.ValueList().AllValue()
-		} else {
-			valuesCtx = []grammar.IValueContext{notInClause.Value()}
-		}
-	default:
-		v.AddError("IN clause is missing for %q", keyForError)
-		return nil, false
-	}
-	if len(valuesCtx) == 0 {
-		v.AddError("IN list for %q is empty", keyForError)
-		return nil, false
-	}
-	out := make([]string, 0, len(valuesCtx))
-	for _, valueContext := range valuesCtx {
-		s, ok := v.extractStringValue(valueContext, keyForError)
-		if !ok {
-			return nil, false
-		}
-		out = append(out, s)
-	}
-	return out, true
-}
-
-func (v *Visitor) extractSingleBoolValue(ctx *grammar.ComparisonContext) (bool, bool) {
-	values := ctx.AllValue()
-	if len(values) != 1 {
-		v.AddError("expected a single boolean (true/false)")
-		return false, false
-	}
-	return v.extractBoolValue(values[0])
-}
-
-func (v *Visitor) extractSingleTimestampValue(ctx *grammar.ComparisonContext) (time.Time, bool) {
-	values := ctx.AllValue()
-	if len(values) != 1 {
-		v.AddError("expected a single RFC3339 timestamp")
-		return time.Time{}, false
-	}
-	return v.extractTimestampValue(values[0])
-}
-
-func (v *Visitor) extractTwoTimestampValues(ctx *grammar.ComparisonContext) ([2]time.Time, bool) {
-	values := ctx.AllValue()
-	if len(values) != 2 {
-		v.AddError("BETWEEN expects two RFC3339 timestamps")
-		return [2]time.Time{}, false
-	}
-	first, ok1 := v.extractTimestampValue(values[0])
-	second, ok2 := v.extractTimestampValue(values[1])
-	if !ok1 || !ok2 {
-		return [2]time.Time{}, false
-	}
-	return [2]time.Time{first, second}, true
-}
-
-func (v *Visitor) extractStringValue(ctx grammar.IValueContext, keyForError string) (string, bool) {
-	if ctx.QUOTED_TEXT() != nil {
-		return trimQuotes(ctx.QUOTED_TEXT().GetText()), true
-	}
-	if ctx.KEY() != nil {
-		return ctx.KEY().GetText(), true
-	}
-	v.AddError("expected a string value for %q, got %q", keyForError, ctx.GetText())
-	return "", false
-}
-
-func (v *Visitor) extractBoolValue(ctx grammar.IValueContext) (bool, bool) {
-	if ctx.BOOL() == nil {
-		v.AddError("expected a boolean (true/false), got %q", ctx.GetText())
-		return false, false
-	}
-	return strings.EqualFold(ctx.BOOL().GetText(), "true"), true
-}
-
-func (v *Visitor) extractTimestampValue(ctx grammar.IValueContext) (time.Time, bool) {
-	if ctx.QUOTED_TEXT() == nil {
-		v.AddError("expected an RFC3339 timestamp string, got %q", ctx.GetText())
-		return time.Time{}, false
-	}
-	raw := trimQuotes(ctx.QUOTED_TEXT().GetText())
-	t, err := time.Parse(time.RFC3339, raw)
-	if err != nil {
-		v.AddError("invalid RFC3339 timestamp %q: %s", raw, err.Error())
-		return time.Time{}, false
-	}
-	return t, true
-}
-
-// ─── operator spelling ───────────────────────────────────────────────────────
-
-// OperationName is the user-facing spelling, used only in error messages.
-func OperationName(operation qbtypesv5.FilterOperator) string {
-	switch operation {
-	case qbtypesv5.FilterOperatorEqual:
-		return "="
-	case qbtypesv5.FilterOperatorNotEqual:
-		return "!="
-	case qbtypesv5.FilterOperatorLessThan:
-		return "<"
-	case qbtypesv5.FilterOperatorLessThanOrEq:
-		return "<="
-	case qbtypesv5.FilterOperatorGreaterThan:
-		return ">"
-	case qbtypesv5.FilterOperatorGreaterThanOrEq:
-		return ">="
-	case qbtypesv5.FilterOperatorBetween:
-		return "BETWEEN"
-	case qbtypesv5.FilterOperatorNotBetween:
-		return "NOT BETWEEN"
-	case qbtypesv5.FilterOperatorLike:
-		return "LIKE"
-	case qbtypesv5.FilterOperatorNotLike:
-		return "NOT LIKE"
-	case qbtypesv5.FilterOperatorILike:
-		return "ILIKE"
-	case qbtypesv5.FilterOperatorNotILike:
-		return "NOT ILIKE"
-	case qbtypesv5.FilterOperatorContains:
-		return "CONTAINS"
-	case qbtypesv5.FilterOperatorNotContains:
-		return "NOT CONTAINS"
-	case qbtypesv5.FilterOperatorRegexp:
-		return "REGEXP"
-	case qbtypesv5.FilterOperatorNotRegexp:
-		return "NOT REGEXP"
-	case qbtypesv5.FilterOperatorIn:
-		return "IN"
-	case qbtypesv5.FilterOperatorNotIn:
-		return "NOT IN"
-	case qbtypesv5.FilterOperatorExists:
-		return "EXISTS"
-	case qbtypesv5.FilterOperatorNotExists:
-		return "NOT EXISTS"
-	}
-	return "?"
-}
-
-func trimQuotes(s string) string {
-	if len(s) >= 2 {
-		if (s[0] == '"' && s[len(s)-1] == '"') || (s[0] == '\'' && s[len(s)-1] == '\'') {
-			s = s[1 : len(s)-1]
-		}
-	}
-	s = strings.ReplaceAll(s, `\\`, `\`)
-	s = strings.ReplaceAll(s, `\'`, `'`)
-	return s
-}

pkg/parser/filterquery/sqlcompiler/compiler_test.go

@@ -1,29 +0,0 @@
-package sqlcompiler
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-)
-
-func TestEndsWithDanglingEscape(t *testing.T) {
-	testCases := []struct {
-		value string
-		want  bool
-	}{
-		{value: "", want: false},
-		{value: `\`, want: true},
-		{value: `\\`, want: false},
-		{value: `\\\`, want: true},
-		{value: `abc`, want: false},
-		{value: `abc\`, want: true},
-		{value: `abc\\`, want: false},
-		{value: `a\b\\`, want: false},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.value, func(t *testing.T) {
-			assert.Equal(t, tc.want, endsWithDanglingEscape(tc.value))
-		})
-	}
-}

pkg/pprof/httppprof/provider.go

@@ -6,7 +6,6 @@ import (
 	"net/http"
 	nethttppprof "net/http/pprof"
 	runtimepprof "runtime/pprof"
-	"time"
 
 	"github.com/SigNoz/signoz/pkg/factory"
 	httpserver "github.com/SigNoz/signoz/pkg/http/server"
@@ -24,7 +23,7 @@ func NewFactory() factory.ProviderFactory[pprof.PProf, pprof.Config] {
 func New(_ context.Context, settings factory.ProviderSettings, config pprof.Config) (pprof.PProf, error) {
 	server, err := httpserver.New(
 		settings.Logger.With(slog.String("pkg", "github.com/SigNoz/signoz/pkg/pprof/httppprof")),
-		httpserver.Config{Address: config.Address, ReadTimeout: 10 * time.Second, WriteTimeout: 10 * time.Second},
+		httpserver.Config{Address: config.Address},
 		newHandler(),
 	)
 	if err != nil {

pkg/query-service/app/http_handler.go

@@ -4070,20 +4070,20 @@ func (aH *APIHandler) RegisterTraceFunnelsRoutes(router *mux.Router, am *middlew
 		Methods(http.MethodPut)
 
 	// Analytics endpoints
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/validate", am.ViewAccess(aH.handleValidateTraces)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/overview", am.ViewAccess(aH.handleFunnelAnalytics)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps", am.ViewAccess(aH.handleStepAnalytics)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps/overview", am.ViewAccess(aH.handleFunnelStepAnalytics)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/slow-traces", am.ViewAccess(aH.handleFunnelSlowTraces)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/error-traces", am.ViewAccess(aH.handleFunnelErrorTraces)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/validate", aH.handleValidateTraces).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/overview", aH.handleFunnelAnalytics).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps", aH.handleStepAnalytics).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/steps/overview", aH.handleFunnelStepAnalytics).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/slow-traces", aH.handleFunnelSlowTraces).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/{funnel_id}/analytics/error-traces", aH.handleFunnelErrorTraces).Methods("POST")
 
 	// Analytics endpoints
-	traceFunnelsRouter.HandleFunc("/analytics/validate", am.ViewAccess(aH.handleValidateTracesWithPayload)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/overview", am.ViewAccess(aH.handleFunnelAnalyticsWithPayload)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/steps", am.ViewAccess(aH.handleStepAnalyticsWithPayload)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/steps/overview", am.ViewAccess(aH.handleFunnelStepAnalyticsWithPayload)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/slow-traces", am.ViewAccess(aH.handleFunnelSlowTracesWithPayload)).Methods("POST")
-	traceFunnelsRouter.HandleFunc("/analytics/error-traces", am.ViewAccess(aH.handleFunnelErrorTracesWithPayload)).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/validate", aH.handleValidateTracesWithPayload).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/overview", aH.handleFunnelAnalyticsWithPayload).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/steps", aH.handleStepAnalyticsWithPayload).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/steps/overview", aH.handleFunnelStepAnalyticsWithPayload).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/slow-traces", aH.handleFunnelSlowTracesWithPayload).Methods("POST")
+	traceFunnelsRouter.HandleFunc("/analytics/error-traces", aH.handleFunnelErrorTracesWithPayload).Methods("POST")
 }
 
 func (aH *APIHandler) handleValidateTraces(w http.ResponseWriter, r *http.Request) {

pkg/query-service/app/server.go

@@ -2,9 +2,19 @@ package app
 
 import (
 	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"slices"
 
+	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/queryparser"
 
+	"github.com/gorilla/handlers"
+
+	"github.com/rs/cors"
+	"github.com/soheilhy/cmux"
+
 	"github.com/SigNoz/signoz/pkg/http/middleware"
 	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
 	"github.com/SigNoz/signoz/pkg/query-service/app/clickhouseReader"
@@ -13,15 +23,31 @@ import (
 	"github.com/SigNoz/signoz/pkg/query-service/app/opamp"
 	opAmpModel "github.com/SigNoz/signoz/pkg/query-service/app/opamp/model"
 	"github.com/SigNoz/signoz/pkg/signoz"
+	"github.com/SigNoz/signoz/pkg/web"
 
 	"log/slog"
 
+	"go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux"
+	"go.opentelemetry.io/otel/propagation"
+
 	"github.com/SigNoz/signoz/pkg/query-service/constants"
+	"github.com/SigNoz/signoz/pkg/query-service/healthcheck"
+	"github.com/SigNoz/signoz/pkg/query-service/utils"
 )
 
-// Server runs auxiliary servers (opamp) alongside the signoz apiserver
+// Server runs HTTP, Mux and a grpc server
 type Server struct {
+	config signoz.Config
+	signoz *signoz.SigNoz
+
+	// public http router
+	httpConn     net.Listener
+	httpServer   *http.Server
+	httpHostPort string
+
 	opampServer *opamp.Server
+
+	unavailableChannel chan healthcheck.Status
 }
 
 // NewServer creates and initializes Server
@@ -64,20 +90,20 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 		return nil, err
 	}
 
-	// Register the legacy query-service routes on the apiserver router. The
-	// apiserver owns the HTTP server and applies the middleware chain at serve
-	// time, so these routes get the same treatment as the apiserver routes.
-	r := signoz.APIServer.Router()
-	am := middleware.NewAuthZ(signoz.Instrumentation.Logger(), signoz.Modules.OrgGetter, signoz.Authz)
+	s := &Server{
+		config:             config,
+		signoz:             signoz,
+		httpHostPort:       constants.HTTPHostPort,
+		unavailableChannel: make(chan healthcheck.Status),
+	}
 
-	apiHandler.RegisterRoutes(r, am)
-	apiHandler.RegisterLogsRoutes(r, am)
-	apiHandler.RegisterIntegrationRoutes(r, am)
-	apiHandler.RegisterQueryRangeV3Routes(r, am)
-	apiHandler.RegisterQueryRangeV4Routes(r, am)
-	apiHandler.RegisterMessagingQueuesRoutes(r, am)
-	apiHandler.RegisterThirdPartyApiRoutes(r, am)
-	apiHandler.RegisterTraceFunnelsRoutes(r, am)
+	httpServer, err := s.createPublicServer(apiHandler, signoz.Web)
+
+	if err != nil {
+		return nil, err
+	}
+
+	s.httpServer = httpServer
 
 	opAmpModel.Init(signoz.SQLStore, signoz.Instrumentation.Logger(), signoz.Modules.OrgGetter)
 
@@ -95,8 +121,6 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 		return nil, err
 	}
 
-	s := &Server{}
-
 	s.opampServer = opamp.InitializeServer(
 		&opAmpModel.AllAgents,
 		agentConfMgr,
@@ -106,18 +130,146 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 	return s, nil
 }
 
-// Start starts the opamp websocket server. The HTTP API server is started by
-// the signoz registry.
-func (s *Server) Start(ctx context.Context) error {
-	slog.Info("Starting OpAmp Websocket server", "addr", constants.OpAmpWsEndpoint)
-	if err := s.opampServer.Start(constants.OpAmpWsEndpoint); err != nil {
+// HealthCheckStatus returns health check status channel a client can subscribe to
+func (s Server) HealthCheckStatus() chan healthcheck.Status {
+	return s.unavailableChannel
+}
+
+func (s *Server) createPublicServer(api *APIHandler, web web.Web) (*http.Server, error) {
+	r := NewRouter()
+
+	r.Use(middleware.NewRecovery(s.signoz.Instrumentation.Logger()).Wrap)
+	r.Use(otelmux.Middleware(
+		"apiserver",
+		otelmux.WithMeterProvider(s.signoz.Instrumentation.MeterProvider()),
+		otelmux.WithTracerProvider(s.signoz.Instrumentation.TracerProvider()),
+		otelmux.WithPropagators(propagation.NewCompositeTextMapPropagator(propagation.Baggage{}, propagation.TraceContext{})),
+		otelmux.WithFilter(func(r *http.Request) bool {
+			return !slices.Contains([]string{"/api/v1/health"}, r.URL.Path)
+		}),
+	))
+	r.Use(middleware.NewIdentN(s.signoz.IdentNResolver, s.signoz.Sharder, s.signoz.Instrumentation.Logger()).Wrap)
+	r.Use(middleware.NewTimeout(s.signoz.Instrumentation.Logger(),
+		s.config.APIServer.Timeout.ExcludedRoutes,
+		s.config.APIServer.Timeout.Default,
+		s.config.APIServer.Timeout.Max,
+	).Wrap)
+	r.Use(middleware.NewResource(s.signoz.Instrumentation.Logger()).Wrap)
+	r.Use(middleware.NewAudit(s.signoz.Instrumentation.Logger(), s.config.APIServer.Logging.ExcludedRoutes, s.signoz.Auditor).Wrap)
+	r.Use(middleware.NewComment().Wrap)
+
+	am := middleware.NewAuthZ(s.signoz.Instrumentation.Logger(), s.signoz.Modules.OrgGetter, s.signoz.Authz)
+
+	api.RegisterRoutes(r, am)
+	api.RegisterLogsRoutes(r, am)
+	api.RegisterIntegrationRoutes(r, am)
+	api.RegisterQueryRangeV3Routes(r, am)
+	api.RegisterQueryRangeV4Routes(r, am)
+	api.RegisterMessagingQueuesRoutes(r, am)
+	api.RegisterThirdPartyApiRoutes(r, am)
+	api.RegisterTraceFunnelsRoutes(r, am)
+
+	err := s.signoz.APIServer.AddToRouter(r)
+	if err != nil {
+		return nil, err
+	}
+
+	c := cors.New(cors.Options{
+		AllowedOrigins: []string{"*"},
+		AllowedMethods: []string{"GET", "DELETE", "POST", "PUT", "PATCH", "OPTIONS"},
+		AllowedHeaders: []string{"Accept", "Authorization", "Content-Type", "cache-control"},
+	})
+
+	handler := c.Handler(r)
+
+	handler = handlers.CompressHandler(handler)
+
+	err = web.AddToRouter(r)
+	if err != nil {
+		return nil, err
+	}
+
+	routePrefix := s.config.Global.ExternalPath()
+	if routePrefix != "" {
+		prefixed := http.StripPrefix(routePrefix, handler)
+		handler = http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
+			switch req.URL.Path {
+			case "/api/v1/health", "/api/v2/healthz", "/api/v2/readyz", "/api/v2/livez":
+				r.ServeHTTP(w, req)
+				return
+			}
+
+			prefixed.ServeHTTP(w, req)
+		})
+	}
+
+	return &http.Server{
+		Handler: handler,
+	}, nil
+}
+
+// initListeners initialises listeners of the server
+func (s *Server) initListeners() error {
+	// listen on public port
+	var err error
+	publicHostPort := s.httpHostPort
+	if publicHostPort == "" {
+		return fmt.Errorf("constants.HTTPHostPort is required")
+	}
+
+	s.httpConn, err = net.Listen("tcp", publicHostPort)
+	if err != nil {
 		return err
 	}
 
+	slog.Info(fmt.Sprintf("Query server started listening on %s...", s.httpHostPort))
+
+	return nil
+}
+
+// Start listening on http and private http port concurrently
+func (s *Server) Start(ctx context.Context) error {
+	err := s.initListeners()
+	if err != nil {
+		return err
+	}
+
+	var httpPort int
+	if port, err := utils.GetPort(s.httpConn.Addr()); err == nil {
+		httpPort = port
+	}
+
+	go func() {
+		slog.Info("Starting HTTP server", "port", httpPort, "addr", s.httpHostPort)
+
+		switch err := s.httpServer.Serve(s.httpConn); err {
+		case nil, http.ErrServerClosed, cmux.ErrListenerClosed:
+			// normal exit, nothing to do
+		default:
+			slog.Error("Could not start HTTP server", errors.Attr(err))
+		}
+		s.unavailableChannel <- healthcheck.Unavailable
+	}()
+
+	go func() {
+		slog.Info("Starting OpAmp Websocket server", "addr", constants.OpAmpWsEndpoint)
+		err := s.opampServer.Start(constants.OpAmpWsEndpoint)
+		if err != nil {
+			slog.Error("opamp ws server failed to start", errors.Attr(err))
+			s.unavailableChannel <- healthcheck.Unavailable
+		}
+	}()
+
 	return nil
 }
 
 func (s *Server) Stop(ctx context.Context) error {
+	if s.httpServer != nil {
+		if err := s.httpServer.Shutdown(context.Background()); err != nil {
+			return err
+		}
+	}
+
 	s.opampServer.Stop()
 
 	return nil

pkg/query-service/constants/constants.go

@@ -10,7 +10,11 @@ import (
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
-const OpAmpWsEndpoint = "0.0.0.0:4320" // address for opamp websocket
+const (
+	HTTPHostPort    = "0.0.0.0:8080" // Address to serve http (query service)
+	PrivateHostPort = "0.0.0.0:8085" // Address to server internal services like alert manager
+	OpAmpWsEndpoint = "0.0.0.0:4320" // address for opamp websocket
+)
 
 const MaxAllowedPointsInTimeSeries = 300
 

pkg/query-service/healthcheck/handler.go

@@ -0,0 +1,12 @@
+package healthcheck
+
+const (
+	// Unavailable indicates the service is not able to handle requests
+	Unavailable Status = iota
+	// Ready indicates the service is ready to handle requests
+	Ready
+	// Broken indicates that the healthcheck itself is broken, not serving HTTP
+	Broken
+)
+
+type Status int

pkg/query-service/rules/manager.go

@@ -718,8 +718,8 @@ func (m *Manager) Rules() []Rule {
 
 // TriggeredAlerts returns the list of the manager's rules.
 func (m *Manager) TriggeredAlerts() []*ruletypes.NamedAlert {
-	m.mtx.RLock()
-	defer m.mtx.RUnlock()
+	// m.mtx.RLock()
+	// defer m.mtx.RUnlock()
 
 	namedAlerts := []*ruletypes.NamedAlert{}
 
@@ -851,8 +851,6 @@ func (m *Manager) ListRuleStates(ctx context.Context) (*ruletypes.GettableRules,
 	// initiate response object
 	resp := make([]*ruletypes.GettableRule, 0)
 
-	stateByRuleID := m.snapshotRuleStates()
-
 	for _, s := range storedRules {
 
 		ruleResponse := ruletypes.GettableRule{}
@@ -865,11 +863,11 @@ func (m *Manager) ListRuleStates(ctx context.Context) (*ruletypes.GettableRules,
 		ruleResponse.Id = s.ID.StringValue()
 
 		// fetch state of rule from memory
-		if state, ok := stateByRuleID[ruleResponse.Id]; !ok {
+		if rm, ok := m.rules[ruleResponse.Id]; !ok {
 			ruleResponse.State = ruletypes.StateDisabled
 			ruleResponse.Disabled = true
 		} else {
-			ruleResponse.State = state
+			ruleResponse.State = rm.State()
 		}
 		ruleResponse.CreatedAt = s.CreatedAt
 		ruleResponse.CreatedBy = &s.CreatedBy
@@ -881,84 +879,6 @@ func (m *Manager) ListRuleStates(ctx context.Context) (*ruletypes.GettableRules,
 	return &ruletypes.GettableRules{Rules: resp}, nil
 }
 
-// ListRules' total counts what is pageable after corrupt-row drops and the states filter.
-func (m *Manager) ListRules(ctx context.Context, params *ruletypes.ListRulesParams) (*ruletypes.ListableRules, error) {
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	states, err := params.AlertStates()
-	if err != nil {
-		return nil, err
-	}
-	stateFilter := make(map[ruletypes.AlertState]struct{}, len(states))
-	for _, state := range states {
-		stateFilter[state] = struct{}{}
-	}
-
-	storedRules, err := m.ruleStore.GetStoredRulesMatching(ctx, claims.OrgID, params.Query)
-	if err != nil {
-		return nil, err
-	}
-
-	stateByRuleID := m.snapshotRuleStates()
-
-	listableRules := make([]*ruletypes.ListableRule, 0, len(storedRules))
-	for _, s := range storedRules {
-		gettable := ruletypes.GettableRule{}
-		if err := json.Unmarshal([]byte(s.Data), &gettable); err != nil {
-			m.logger.ErrorContext(ctx, "failed to unmarshal rule from db", slog.String("rule.id", s.ID.StringValue()), errors.Attr(err))
-			continue
-		}
-
-		gettable.Id = s.ID.StringValue()
-		if state, ok := stateByRuleID[gettable.Id]; ok {
-			gettable.State = state
-		} else {
-			gettable.State = ruletypes.StateDisabled
-			gettable.Disabled = true
-		}
-		if len(stateFilter) > 0 {
-			if _, ok := stateFilter[gettable.State]; !ok {
-				continue
-			}
-		}
-
-		gettable.CreatedAt = s.CreatedAt
-		gettable.CreatedBy = &s.CreatedBy
-		gettable.UpdatedAt = s.UpdatedAt
-		gettable.UpdatedBy = &s.UpdatedBy
-		listableRules = append(listableRules, ruletypes.NewListableRule(&gettable))
-	}
-
-	total := int64(len(listableRules))
-	ruletypes.SortListableRules(listableRules, params.Sort, params.Order)
-
-	start := min(params.Offset, len(listableRules))
-	end := min(start+params.Limit, len(listableRules))
-	currentPageRules := listableRules[start:end]
-
-	rawLabels, err := m.ruleStore.GetStoredRuleLabels(ctx, claims.OrgID)
-	if err != nil {
-		return nil, err
-	}
-	labelPairs := ruletypes.NewLabelPairsFromRawJSON(rawLabels, ruletypes.MaxListLabelPairs)
-
-	return ruletypes.NewListableRules(currentPageRules, total, labelPairs), nil
-}
-
-func (m *Manager) snapshotRuleStates() map[string]ruletypes.AlertState {
-	m.mtx.RLock()
-	defer m.mtx.RUnlock()
-
-	states := make(map[string]ruletypes.AlertState, len(m.rules))
-	for id, rule := range m.rules {
-		states[id] = rule.State()
-	}
-	return states
-}
-
 func (m *Manager) GetRule(ctx context.Context, id valuer.UUID) (*ruletypes.GettableRule, error) {
 	claims, err := authtypes.ClaimsFromContext(ctx)
 	if err != nil {
@@ -979,10 +899,7 @@ func (m *Manager) GetRule(ctx context.Context, id valuer.UUID) (*ruletypes.Getta
 	}
 	r.Id = id.StringValue()
 	// fetch state of rule from memory
-	m.mtx.RLock()
-	rm, ok := m.rules[r.Id]
-	m.mtx.RUnlock()
-	if !ok {
+	if rm, ok := m.rules[r.Id]; !ok {
 		r.State = ruletypes.StateDisabled
 		r.Disabled = true
 	} else {

pkg/ruler/handler.go

@@ -4,7 +4,6 @@ import "net/http"
 
 type Handler interface {
 	ListRules(http.ResponseWriter, *http.Request)
-	ListRulesV3(http.ResponseWriter, *http.Request)
 	GetRuleByID(http.ResponseWriter, *http.Request)
 	CreateRule(http.ResponseWriter, *http.Request)
 	UpdateRuleByID(http.ResponseWriter, *http.Request)
@@ -12,11 +11,6 @@ type Handler interface {
 	PatchRuleByID(http.ResponseWriter, *http.Request)
 	TestRule(http.ResponseWriter, *http.Request)
 
-	ListRuleViews(http.ResponseWriter, *http.Request)
-	CreateRuleView(http.ResponseWriter, *http.Request)
-	UpdateRuleView(http.ResponseWriter, *http.Request)
-	DeleteRuleView(http.ResponseWriter, *http.Request)
-
 	ListDowntimeSchedules(http.ResponseWriter, *http.Request)
 	GetDowntimeScheduleByID(http.ResponseWriter, *http.Request)
 	CreateDowntimeSchedule(http.ResponseWriter, *http.Request)

pkg/ruler/ruler.go

@@ -17,9 +17,6 @@ type Ruler interface {
 	// ListRuleStates returns all rules with their current evaluation state.
 	ListRuleStates(ctx context.Context) (*ruletypes.GettableRules, error)
 
-	// ListRules returns a filtered, sorted page of rules with state, plus label pairs and reserved filter keys.
-	ListRules(ctx context.Context, params *ruletypes.ListRulesParams) (*ruletypes.ListableRules, error)
-
 	// GetRule returns a single rule by ID.
 	GetRule(ctx context.Context, id valuer.UUID) (*ruletypes.GettableRule, error)
 
@@ -49,9 +46,4 @@ type Ruler interface {
 	// TODO: expose downtime CRUD as methods on Ruler directly instead of leaking the
 	// store interface. The handler should not call store methods directly.
 	MaintenanceStore() alertmanagertypes.MaintenanceStore
-
-	CreateRuleView(ctx context.Context, orgID valuer.UUID, postable ruletypes.PostableRuleView) (*ruletypes.RuleView, error)
-	ListRuleViews(ctx context.Context, orgID valuer.UUID) (*ruletypes.ListableRuleViews, error)
-	UpdateRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatable ruletypes.UpdatableRuleView) (*ruletypes.RuleView, error)
-	DeleteRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error
 }

pkg/ruler/rulestore/rulestoretest/rule.go

@@ -64,16 +64,6 @@ func (m *MockSQLRuleStore) GetStoredRules(ctx context.Context, orgID string) ([]
 	return m.ruleStore.GetStoredRules(ctx, orgID)
 }
 
-// GetStoredRulesMatching implements ruletypes.RuleStore - delegates to underlying ruleStore to trigger SQL.
-func (m *MockSQLRuleStore) GetStoredRulesMatching(ctx context.Context, orgID string, query string) ([]*ruletypes.StorableRule, error) {
-	return m.ruleStore.GetStoredRulesMatching(ctx, orgID, query)
-}
-
-// GetStoredRuleLabels implements ruletypes.RuleStore - delegates to underlying ruleStore to trigger SQL.
-func (m *MockSQLRuleStore) GetStoredRuleLabels(ctx context.Context, orgID string) ([]string, error) {
-	return m.ruleStore.GetStoredRuleLabels(ctx, orgID)
-}
-
 // GetStoredRulesByMetricName implements ruletypes.RuleStore - delegates to underlying ruleStore.
 func (m *MockSQLRuleStore) GetStoredRulesByMetricName(ctx context.Context, orgID string, metricName string) ([]ruletypes.RuleAlert, error) {
 	return m.ruleStore.GetStoredRulesByMetricName(ctx, orgID, metricName)

pkg/ruler/rulestore/sqlrulestore/filterquery.go

@@ -1,20 +0,0 @@
-package sqlrulestore
-
-import (
-	"strings"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/parser/filterquery/sqlcompiler"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/ruletypes"
-)
-
-// Compile wraps compiler errors in the rules list filter error code.
-func Compile(query string, formatter sqlstore.SQLFormatter) (*sqlcompiler.Compiled, error) {
-	compiled, errs := sqlcompiler.Compile(query, formatter, ruleFieldResolver{})
-	if len(errs) > 0 {
-		return nil, errors.NewInvalidInputf(ruletypes.ErrCodeRuleListFilterInvalid,
-			"invalid filter query: %s", strings.Join(errs, "; "))
-	}
-	return compiled, nil
-}

pkg/ruler/rulestore/sqlrulestore/filterquery_resolver.go

@@ -1,168 +0,0 @@
-package sqlrulestore
-
-import (
-	"fmt"
-	"slices"
-	"strings"
-
-	grammar "github.com/SigNoz/signoz/pkg/parser/filterquery/grammar"
-	"github.com/SigNoz/signoz/pkg/parser/filterquery/sqlcompiler"
-	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/SigNoz/signoz/pkg/types/ruletypes"
-)
-
-const (
-	ruleDataColumn  = "rule.data"
-	ruleLabelsField = "labels"
-	nameJSONPath    = "$.alert"
-	descriptionPath = "$.description"
-	labelsJSONPath  = "$.labels"
-	alertTypePath   = "$.alertType"
-	ruleTypePath    = "$.ruleType"
-)
-
-// ruleFieldResolver maps rule list DSL keys; label keys are case-sensitive and unknown keys are rejected.
-type ruleFieldResolver struct{}
-
-func (r ruleFieldResolver) ResolveComparison(v *sqlcompiler.Visitor, rawKey string, operation qbtypesv5.FilterOperator, ctx *grammar.ComparisonContext) string {
-	key := strings.ToLower(rawKey)
-
-	if allowedOperations, isReserved := ruletypes.ReservedOps[ruletypes.DSLKey(key)]; isReserved {
-		return r.resolveReservedKey(v, ctx, operation, ruletypes.DSLKey(key), allowedOperations)
-	}
-
-	if strings.HasPrefix(key, ruletypes.DSLLabelsKeyPrefix) {
-		labelKey := rawKey[len(ruletypes.DSLLabelsKeyPrefix):]
-		if labelKey == "" {
-			v.AddError("labels filter is missing a key, use labels.<key>")
-			return ""
-		}
-		if _, allowed := ruletypes.LabelsKeyOps[operation]; !allowed {
-			v.AddError("operator %s is not allowed on a labels.<key> filter", sqlcompiler.OperationName(operation))
-			return ""
-		}
-		return r.labelComparison(v, ctx, operation, labelKey)
-	}
-
-	v.AddError("unknown filter key %q, use one of the reserved keys or labels.<key>", rawKey)
-	return ""
-}
-
-func (r ruleFieldResolver) resolveReservedKey(v *sqlcompiler.Visitor, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key ruletypes.DSLKey, allowedOperations map[qbtypesv5.FilterOperator]struct{}) string {
-	if _, allowed := allowedOperations[operation]; !allowed {
-		v.AddError("operator %s is not allowed for key %q", sqlcompiler.OperationName(operation), key)
-		return ""
-	}
-	switch key {
-	case ruletypes.DSLKeyName:
-		columnExpression := string(v.Formatter.JSONExtractString(ruleDataColumn, nameJSONPath))
-		return v.BuildStringOperation(v.Sb, ctx, operation, columnExpression, string(key))
-	case ruletypes.DSLKeySeverity:
-		// severity is an alias for labels.severity, sharing its missing-label semantics.
-		return r.labelComparison(v, ctx, operation, "severity")
-	case ruletypes.DSLKeyCreatedBy:
-		return v.BuildStringOperation(v.Sb, ctx, operation, "rule.created_by", string(key))
-	case ruletypes.DSLKeyUpdatedBy:
-		return v.BuildStringOperation(v.Sb, ctx, operation, "rule.updated_by", string(key))
-	case ruletypes.DSLKeyCreatedAt:
-		return v.BuildTimestampComparison(ctx, operation, "rule.created_at")
-	case ruletypes.DSLKeyUpdatedAt:
-		return v.BuildTimestampComparison(ctx, operation, "rule.updated_at")
-	case ruletypes.DSLKeyAlertType:
-		return r.enumComparison(v, ctx, operation, key, alertTypePath, alertTypeValues)
-	case ruletypes.DSLKeyRuleType:
-		return r.enumComparison(v, ctx, operation, key, ruleTypePath, ruleTypeValues)
-	}
-	v.AddError("no handler for reserved key %q", key)
-	return ""
-}
-
-// A missing label evaluates as the empty string for every value operator; EXISTS/NOT EXISTS test the raw extraction.
-func (ruleFieldResolver) labelComparison(v *sqlcompiler.Visitor, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, labelKey string) string {
-	columnExpression := string(v.Formatter.JSONExtractMapValue(ruleDataColumn, ruleLabelsField, labelKey))
-
-	switch operation {
-	case qbtypesv5.FilterOperatorExists:
-		return fmt.Sprintf("%s IS NOT NULL", columnExpression)
-	case qbtypesv5.FilterOperatorNotExists:
-		return fmt.Sprintf("%s IS NULL", columnExpression)
-	}
-
-	keyForError := ruletypes.DSLLabelsKeyPrefix + labelKey
-	columnExpression = fmt.Sprintf("COALESCE(%s, '')", columnExpression)
-	return v.BuildStringOperation(v.Sb, ctx, operation, columnExpression, keyForError)
-}
-
-func (ruleFieldResolver) enumComparison(v *sqlcompiler.Visitor, ctx *grammar.ComparisonContext, operation qbtypesv5.FilterOperator, key ruletypes.DSLKey, jsonPath string, allowedValues []string) string {
-	columnExpression := string(v.Formatter.JSONExtractString(ruleDataColumn, jsonPath))
-
-	var values []string
-	switch operation {
-	case qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual:
-		value, ok := v.ExtractSingleStringValue(ctx, string(key))
-		if !ok {
-			return ""
-		}
-		values = []string{value}
-	case qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn:
-		list, ok := v.ExtractStringValueList(ctx, string(key))
-		if !ok {
-			return ""
-		}
-		values = list
-	default:
-		v.AddError("operator %s on %q is not implemented", sqlcompiler.OperationName(operation), key)
-		return ""
-	}
-
-	for _, value := range values {
-		if !slices.Contains(allowedValues, value) {
-			v.AddError("invalid value %q for %q, expected one of: %s", value, key, strings.Join(allowedValues, ", "))
-			return ""
-		}
-	}
-
-	arguments := make([]any, len(values))
-	for i, s := range values {
-		arguments[i] = s
-	}
-	switch operation {
-	case qbtypesv5.FilterOperatorEqual:
-		return v.Sb.Equal(columnExpression, arguments[0])
-	case qbtypesv5.FilterOperatorNotEqual:
-		return v.Sb.NotEqual(columnExpression, arguments[0])
-	case qbtypesv5.FilterOperatorNotIn:
-		return v.Sb.NotIn(columnExpression, arguments...)
-	default:
-		return v.Sb.In(columnExpression, arguments...)
-	}
-}
-
-// ResolveFreeText searches name, description and the raw labels JSON (which also matches label keys).
-func (ruleFieldResolver) ResolveFreeText(v *sqlcompiler.Visitor, value string) string {
-	nameColumn := string(v.Formatter.JSONExtractString(ruleDataColumn, nameJSONPath))
-	descriptionColumn := string(v.Formatter.JSONExtractString(ruleDataColumn, descriptionPath))
-	labelsColumn := string(v.Formatter.JSONExtractString(ruleDataColumn, labelsJSONPath))
-
-	return v.Sb.Or(
-		v.BuildFreeTextContains(v.Sb, nameColumn, value),
-		v.BuildFreeTextContains(v.Sb, descriptionColumn, value),
-		v.BuildFreeTextContains(v.Sb, labelsColumn, value),
-	)
-}
-
-var alertTypeValues = func() []string {
-	values := make([]string, 0, 4)
-	for _, value := range (ruletypes.AlertType("")).Enum() {
-		values = append(values, string(value.(ruletypes.AlertType)))
-	}
-	return values
-}()
-
-var ruleTypeValues = func() []string {
-	values := make([]string, 0, 3)
-	for _, value := range (ruletypes.RuleType{}).Enum() {
-		values = append(values, value.(ruletypes.RuleType).StringValue())
-	}
-	return values
-}()

pkg/ruler/rulestore/sqlrulestore/filterquery_test.go

@@ -1,407 +0,0 @@
-package sqlrulestore
-
-import (
-	"strings"
-	"testing"
-	"time"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/sqlstore/sqlstoretest"
-	"github.com/SigNoz/signoz/pkg/types/ruletypes"
-)
-
-type compileCase struct {
-	subtestName              string
-	dslQueryToCompile        string
-	emptyQueryExpected       bool
-	expectedSQL              string
-	expectedArgs             []any
-	expectedErrShouldContain string
-}
-
-func runCompileCases(t *testing.T, cases []compileCase) {
-	t.Helper()
-	for _, c := range cases {
-		t.Run(c.subtestName, func(t *testing.T) {
-			out, err := Compile(c.dslQueryToCompile, formatter(t))
-
-			if c.expectedErrShouldContain != "" {
-				require.Error(t, err)
-				assert.Contains(t, strings.ToLower(err.Error()), strings.ToLower(c.expectedErrShouldContain))
-				return
-			}
-
-			require.NoError(t, err)
-			if c.emptyQueryExpected {
-				assert.True(t, out.IsEmpty())
-				return
-			}
-			require.NotNil(t, out)
-
-			if c.expectedSQL != "" {
-				assert.Equal(t, normalizeSQL(c.expectedSQL), normalizeSQL(out.SQL))
-			}
-			if c.expectedArgs != nil {
-				require.Len(t, out.Args, len(c.expectedArgs))
-				for i, want := range c.expectedArgs {
-					// Equal instants can differ in *Location, so compare via .Equal() instead of DeepEqual.
-					if wantT, ok := want.(time.Time); ok {
-						gotT, ok := out.Args[i].(time.Time)
-						require.True(t, ok, "arg[%d]: want time.Time, got %T", i, out.Args[i])
-						assert.True(t, wantT.Equal(gotT), "arg[%d]: want %s, got %s", i, wantT, gotT)
-						continue
-					}
-					assert.Equal(t, want, out.Args[i], "arg[%d]", i)
-				}
-			}
-		})
-	}
-}
-
-func TestCompileEmpty(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{subtestName: "empty query yields nil", dslQueryToCompile: "", emptyQueryExpected: true},
-		{subtestName: "whitespace query yields nil", dslQueryToCompile: "   ", emptyQueryExpected: true},
-	})
-}
-
-func TestCompileName(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{
-			subtestName:       "name equals",
-			dslQueryToCompile: "name = 'payment latency'",
-			expectedSQL:       `json_extract("rule"."data", '$.alert') = ?`,
-			expectedArgs:      []any{"payment latency"},
-		},
-		{
-			subtestName:       "name contains escapes wildcards",
-			dslQueryToCompile: "name CONTAINS '50%'",
-			expectedSQL:       `json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\'`,
-			expectedArgs:      []any{`%50\%%`},
-		},
-		{
-			subtestName:       "name ilike",
-			dslQueryToCompile: "name ILIKE 'Prod%'",
-			expectedSQL:       `lower(json_extract("rule"."data", '$.alert')) LIKE LOWER(?) ESCAPE '\'`,
-			expectedArgs:      []any{"Prod%"},
-		},
-		{
-			subtestName:       "name in list",
-			dslQueryToCompile: "name IN ['a', 'b']",
-			expectedSQL:       `json_extract("rule"."data", '$.alert') IN (?, ?)`,
-			expectedArgs:      []any{"a", "b"},
-		},
-		{
-			subtestName:              "range operator rejected on name",
-			dslQueryToCompile:        "name > 'x'",
-			expectedErrShouldContain: `operator > is not allowed for key "name"`,
-		},
-		{
-			subtestName:              "regexp rejected on name",
-			dslQueryToCompile:        "name REGEXP 'x.*'",
-			expectedErrShouldContain: `operator REGEXP is not allowed for key "name"`,
-		},
-	})
-}
-
-func TestCompileSeverityAndLabels(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{
-			subtestName:       "severity equals targets labels map",
-			dslQueryToCompile: "severity = 'critical'",
-			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') = ?`,
-			expectedArgs:      []any{"critical"},
-		},
-		{
-			subtestName:       "severity negation treats a missing label as empty string",
-			dslQueryToCompile: "severity != 'critical'",
-			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') <> ?`,
-			expectedArgs:      []any{"critical"},
-		},
-		{
-			subtestName:       "severity != empty string excludes rules without severity",
-			dslQueryToCompile: "severity != ''",
-			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') <> ?`,
-			expectedArgs:      []any{""},
-		},
-		{
-			subtestName:       "severity exists through the alias",
-			dslQueryToCompile: "severity EXISTS",
-			expectedSQL:       `json_extract("rule"."data", '$.labels."severity"') IS NOT NULL`,
-		},
-		{
-			subtestName:       "severity not exists through the alias",
-			dslQueryToCompile: "severity NOT EXISTS",
-			expectedSQL:       `json_extract("rule"."data", '$.labels."severity"') IS NULL`,
-		},
-		{
-			subtestName:       "label equals",
-			dslQueryToCompile: "labels.team = 'infra'",
-			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."team"'), '') = ?`,
-			expectedArgs:      []any{"infra"},
-		},
-		{
-			subtestName:       "dotted label key is one map entry",
-			dslQueryToCompile: "labels.k8s.cluster = 'prod-1'",
-			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."k8s.cluster"'), '') = ?`,
-			expectedArgs:      []any{"prod-1"},
-		},
-		{
-			subtestName:       "label key keeps its case",
-			dslQueryToCompile: "labels.Team = 'infra'",
-			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."Team"'), '') = ?`,
-			expectedArgs:      []any{"infra"},
-		},
-		{
-			subtestName:       "label exists",
-			dslQueryToCompile: "labels.team EXISTS",
-			expectedSQL:       `json_extract("rule"."data", '$.labels."team"') IS NOT NULL`,
-		},
-		{
-			subtestName:       "label not exists",
-			dslQueryToCompile: "labels.team NOT EXISTS",
-			expectedSQL:       `json_extract("rule"."data", '$.labels."team"') IS NULL`,
-		},
-		{
-			subtestName:       "label not contains includes label-less rules",
-			dslQueryToCompile: "labels.team NOT CONTAINS 'infra'",
-			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."team"'), '') NOT LIKE ? ESCAPE '\'`,
-			expectedArgs:      []any{"%infra%"},
-		},
-		{
-			subtestName:       "label not in includes label-less rules",
-			dslQueryToCompile: "labels.team NOT IN ['a', 'b']",
-			expectedSQL:       `COALESCE(json_extract("rule"."data", '$.labels."team"'), '') NOT IN (?, ?)`,
-			expectedArgs:      []any{"a", "b"},
-		},
-	})
-}
-
-func TestCompileEnums(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{
-			subtestName:       "alert_type equals",
-			dslQueryToCompile: "alert_type = 'LOGS_BASED_ALERT'",
-			expectedSQL:       `json_extract("rule"."data", '$.alertType') = ?`,
-			expectedArgs:      []any{"LOGS_BASED_ALERT"},
-		},
-		{
-			subtestName:       "rule_type in list",
-			dslQueryToCompile: "rule_type IN ['threshold_rule', 'promql_rule']",
-			expectedSQL:       `json_extract("rule"."data", '$.ruleType') IN (?, ?)`,
-			expectedArgs:      []any{"threshold_rule", "promql_rule"},
-		},
-		{
-			subtestName:              "invalid alert_type value rejected",
-			dslQueryToCompile:        "alert_type = 'bogus'",
-			expectedErrShouldContain: `invalid value "bogus" for "alert_type"`,
-		},
-		{
-			subtestName:              "contains rejected on rule_type",
-			dslQueryToCompile:        "rule_type CONTAINS 'thresh'",
-			expectedErrShouldContain: `operator CONTAINS is not allowed for key "rule_type"`,
-		},
-	})
-}
-
-func TestCompileAuditColumns(t *testing.T) {
-	createdAt, err := time.Parse(time.RFC3339, "2026-01-02T15:04:05Z")
-	require.NoError(t, err)
-	updatedFrom, err := time.Parse(time.RFC3339, "2026-02-01T00:00:00Z")
-	require.NoError(t, err)
-	updatedTo, err := time.Parse(time.RFC3339, "2026-03-01T00:00:00Z")
-	require.NoError(t, err)
-
-	runCompileCases(t, []compileCase{
-		{
-			subtestName:       "created_by equals",
-			dslQueryToCompile: "created_by = 'nikhil@signoz.io'",
-			expectedSQL:       `rule.created_by = ?`,
-			expectedArgs:      []any{"nikhil@signoz.io"},
-		},
-		{
-			subtestName:       "created_at range",
-			dslQueryToCompile: "created_at >= '2026-01-02T15:04:05Z'",
-			expectedSQL:       `rule.created_at >= ?`,
-			expectedArgs:      []any{createdAt},
-		},
-		{
-			subtestName:       "updated_at between",
-			dslQueryToCompile: "updated_at BETWEEN '2026-02-01T00:00:00Z' AND '2026-03-01T00:00:00Z'",
-			expectedSQL:       `rule.updated_at BETWEEN ? AND ?`,
-			expectedArgs:      []any{updatedFrom, updatedTo},
-		},
-		{
-			subtestName:              "non-timestamp rejected on created_at",
-			dslQueryToCompile:        "created_at >= 'yesterday'",
-			expectedErrShouldContain: "invalid RFC3339 timestamp",
-		},
-	})
-}
-
-func TestCompileFreeText(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{
-			subtestName:       "bare word searches name, description and labels",
-			dslQueryToCompile: "payment",
-			expectedSQL: `(lower(COALESCE(json_extract("rule"."data", '$.alert'), '')) LIKE LOWER(?) ESCAPE '\' ` +
-				`OR lower(COALESCE(json_extract("rule"."data", '$.description'), '')) LIKE LOWER(?) ESCAPE '\' ` +
-				`OR lower(COALESCE(json_extract("rule"."data", '$.labels'), '')) LIKE LOWER(?) ESCAPE '\')`,
-			expectedArgs: []any{"%payment%", "%payment%", "%payment%"},
-		},
-	})
-}
-
-func TestCompileComposition(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{
-			subtestName:       "and of label and column",
-			dslQueryToCompile: "labels.team = 'infra' AND created_by = 'x'",
-			expectedSQL:       `(COALESCE(json_extract("rule"."data", '$.labels."team"'), '') = ? AND rule.created_by = ?)`,
-			expectedArgs:      []any{"infra", "x"},
-		},
-		{
-			subtestName:       "not wraps the inner predicate",
-			dslQueryToCompile: "NOT (name = 'x')",
-			expectedSQL:       `NOT (json_extract("rule"."data", '$.alert') = ?)`,
-			expectedArgs:      []any{"x"},
-		},
-		{
-			subtestName:       "or of name and severity",
-			dslQueryToCompile: "name CONTAINS 'pay' OR severity = 'critical'",
-			expectedSQL:       `(json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\' OR COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') = ?)`,
-			expectedArgs:      []any{"%pay%", "critical"},
-		},
-	})
-}
-
-func TestCompileComplexExamples(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{
-			subtestName: "name CONTAINS + label = + severity IN + created_by !=",
-			dslQueryToCompile: `name CONTAINS 'latency' AND labels.team = 'payments' ` +
-				`AND severity IN ['critical', 'error'] AND created_by != 'ops@signoz.io'`,
-			expectedSQL: `(json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\' ` +
-				`AND COALESCE(json_extract("rule"."data", '$.labels."team"'), '') = ? ` +
-				`AND COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') IN (?, ?) ` +
-				`AND rule.created_by <> ?)`,
-			expectedArgs: []any{"%latency%", "payments", "critical", "error", "ops@signoz.io"},
-		},
-		{
-			subtestName: "nested OR / AND with parens",
-			dslQueryToCompile: `(labels.env IN ['prod', 'staging'] OR name LIKE '%prod%') ` +
-				`AND (severity = 'critical' OR labels.team EXISTS)`,
-			expectedSQL: `((COALESCE(json_extract("rule"."data", '$.labels."env"'), '') IN (?, ?) ` +
-				`OR json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\') ` +
-				`AND (COALESCE(json_extract("rule"."data", '$.labels."severity"'), '') = ? ` +
-				`OR json_extract("rule"."data", '$.labels."team"') IS NOT NULL))`,
-			expectedArgs: []any{"prod", "staging", "%prod%", "critical"},
-		},
-		{
-			subtestName:       "NOT over a group ANDed with an enum",
-			dslQueryToCompile: `NOT (labels.team = 'infra' OR name CONTAINS 'cpu') AND alert_type = 'METRIC_BASED_ALERT'`,
-			expectedSQL: `(NOT ((COALESCE(json_extract("rule"."data", '$.labels."team"'), '') = ? ` +
-				`OR json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\')) ` +
-				`AND json_extract("rule"."data", '$.alertType') = ?)`,
-			expectedArgs: []any{"infra", "%cpu%", "METRIC_BASED_ALERT"},
-		},
-		{
-			subtestName: "free text with three-level nesting and a timestamp",
-			dslQueryToCompile: `prod AND (name ILIKE '%pay%' ` +
-				`OR (labels.team != 'infra' AND updated_at > '2026-01-02T15:04:05Z'))`,
-			expectedSQL: `((lower(COALESCE(json_extract("rule"."data", '$.alert'), '')) LIKE LOWER(?) ESCAPE '\' ` +
-				`OR lower(COALESCE(json_extract("rule"."data", '$.description'), '')) LIKE LOWER(?) ESCAPE '\' ` +
-				`OR lower(COALESCE(json_extract("rule"."data", '$.labels'), '')) LIKE LOWER(?) ESCAPE '\') ` +
-				`AND (lower(json_extract("rule"."data", '$.alert')) LIKE LOWER(?) ESCAPE '\' ` +
-				`OR (COALESCE(json_extract("rule"."data", '$.labels."team"'), '') <> ? AND rule.updated_at > ?)))`,
-			expectedArgs: []any{"%prod%", "%prod%", "%prod%", "%pay%", "infra",
-				time.Date(2026, 1, 2, 15, 4, 5, 0, time.UTC)},
-		},
-	})
-}
-
-func TestCompileErrors(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{
-			subtestName:              "unknown key rejected instead of matching nothing",
-			dslQueryToCompile:        "team = 'infra'",
-			expectedErrShouldContain: `unknown filter key "team"`,
-		},
-		{
-			subtestName:              "state is not a DSL key",
-			dslQueryToCompile:        "state = 'firing'",
-			expectedErrShouldContain: `unknown filter key "state"`,
-		},
-		{
-			subtestName:              "syntax error surfaces position",
-			dslQueryToCompile:        "created_by ==== (((",
-			expectedErrShouldContain: "syntax error",
-		},
-		{
-			subtestName:              "like pattern with dangling escape rejected",
-			dslQueryToCompile:        `name LIKE 'prod\\'`,
-			expectedErrShouldContain: "must not end with an unescaped backslash",
-		},
-		{
-			subtestName:              "ilike pattern with dangling escape rejected",
-			dslQueryToCompile:        `name ILIKE '%\\'`,
-			expectedErrShouldContain: "must not end with an unescaped backslash",
-		},
-		{
-			subtestName:              "label like pattern with dangling escape rejected",
-			dslQueryToCompile:        `labels.team NOT LIKE 'infra\\'`,
-			expectedErrShouldContain: "must not end with an unescaped backslash",
-		},
-	})
-}
-
-func TestCompileTrailingLiteralBackslash(t *testing.T) {
-	runCompileCases(t, []compileCase{
-		{
-			subtestName:       "escaped trailing backslash compiles",
-			dslQueryToCompile: `name LIKE '%\\\\'`,
-			expectedSQL:       `json_extract("rule"."data", '$.alert') LIKE ? ESCAPE '\'`,
-			expectedArgs:      []any{`%\\`},
-		},
-	})
-}
-
-// Guards that every ruletypes.ReservedOps key has a case in resolveReservedKey.
-func TestCompileReservedKeysAllHandled(t *testing.T) {
-	sampleQueries := map[ruletypes.DSLKey]string{
-		ruletypes.DSLKeyName:      "name = 'x'",
-		ruletypes.DSLKeySeverity:  "severity = 'critical'",
-		ruletypes.DSLKeyCreatedBy: "created_by = 'x'",
-		ruletypes.DSLKeyUpdatedBy: "updated_by = 'x'",
-		ruletypes.DSLKeyCreatedAt: "created_at >= '2026-01-02T15:04:05Z'",
-		ruletypes.DSLKeyUpdatedAt: "updated_at >= '2026-01-02T15:04:05Z'",
-		ruletypes.DSLKeyAlertType: "alert_type = 'METRIC_BASED_ALERT'",
-		ruletypes.DSLKeyRuleType:  "rule_type = 'threshold_rule'",
-	}
-
-	for key := range ruletypes.ReservedOps {
-		query, ok := sampleQueries[key]
-		require.True(t, ok, "no sample query for reserved key %q, add one", key)
-
-		out, err := Compile(query, formatter(t))
-		require.NoError(t, err, "reserved key %q failed to compile", key)
-		assert.False(t, out.IsEmpty(), "reserved key %q compiled to empty SQL", key)
-	}
-}
-
-func formatter(t *testing.T) sqlstore.SQLFormatter {
-	t.Helper()
-	p := sqlstoretest.New(sqlstore.Config{Provider: "sqlite"}, sqlmock.QueryMatcherEqual)
-	return p.Formatter()
-}
-
-func normalizeSQL(s string) string {
-	s = strings.Join(strings.Fields(s), " ")
-	s = strings.ReplaceAll(s, "( ", "(")
-	s = strings.ReplaceAll(s, " )", ")")
-	return s
-}

pkg/ruler/rulestore/sqlrulestore/rule.go

@@ -3,7 +3,6 @@ package sqlrulestore
 import (
 	"context"
 	"encoding/json"
-	"fmt"
 	"log/slog"
 	"slices"
 
@@ -90,46 +89,6 @@ func (r *rule) DeleteRule(ctx context.Context, orgID valuer.UUID, id valuer.UUID
 	return nil
 }
 
-func (r *rule) GetStoredRulesMatching(ctx context.Context, orgID string, query string) ([]*ruletypes.StorableRule, error) {
-	compiled, err := Compile(query, r.sqlstore.Formatter())
-	if err != nil {
-		return nil, err
-	}
-
-	rules := make([]*ruletypes.StorableRule, 0)
-	q := r.sqlstore.
-		BunDB().
-		NewSelect().
-		Model(&rules).
-		Where("org_id = ?", orgID)
-	if !compiled.IsEmpty() {
-		q = q.Where(compiled.SQL, compiled.Args...)
-	}
-	if err := q.Scan(ctx); err != nil {
-		return nil, err
-	}
-
-	return rules, nil
-}
-
-func (r *rule) GetStoredRuleLabels(ctx context.Context, orgID string) ([]string, error) {
-	labelsExpression := string(r.sqlstore.Formatter().JSONExtractString("rule.data", "$.labels"))
-
-	labels := make([]string, 0)
-	err := r.sqlstore.
-		BunDB().
-		NewSelect().
-		Model((*ruletypes.StorableRule)(nil)).
-		ColumnExpr(fmt.Sprintf("COALESCE(%s, '')", labelsExpression)).
-		Where("org_id = ?", orgID).
-		Scan(ctx, &labels)
-	if err != nil {
-		return nil, err
-	}
-
-	return labels, nil
-}
-
 func (r *rule) GetStoredRules(ctx context.Context, orgID string) ([]*ruletypes.StorableRule, error) {
 	rules := make([]*ruletypes.StorableRule, 0)
 	err := r.sqlstore.

pkg/ruler/rulestore/sqlrulestore/rule_view.go

@@ -1,93 +0,0 @@
-package sqlrulestore
-
-import (
-	"context"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	ruletypes "github.com/SigNoz/signoz/pkg/types/ruletypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
-
-func (r *rule) CreateRuleView(ctx context.Context, view *ruletypes.RuleView) error {
-	_, err := r.sqlstore.
-		BunDBCtx(ctx).
-		NewInsert().
-		Model(view).
-		Exec(ctx)
-	if err != nil {
-		return r.sqlstore.WrapAlreadyExistsErrf(err, errors.CodeAlreadyExists, "rule view with id %s already exists", view.ID)
-	}
-	return nil
-}
-
-func (r *rule) GetRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*ruletypes.RuleView, error) {
-	view := new(ruletypes.RuleView)
-	err := r.sqlstore.
-		BunDB().
-		NewSelect().
-		Model(view).
-		Where("id = ?", id).
-		Where("org_id = ?", orgID).
-		Scan(ctx)
-	if err != nil {
-		return nil, r.sqlstore.WrapNotFoundErrf(err, ruletypes.ErrCodeRuleViewNotFound, "rule view with id %s doesn't exist", id)
-	}
-	return view, nil
-}
-
-func (r *rule) ListRuleViews(ctx context.Context, orgID valuer.UUID) ([]*ruletypes.RuleView, error) {
-	views := make([]*ruletypes.RuleView, 0)
-	err := r.sqlstore.
-		BunDB().
-		NewSelect().
-		Model(&views).
-		Where("org_id = ?", orgID).
-		OrderExpr("updated_at DESC").
-		Scan(ctx)
-	if err != nil {
-		return nil, errors.WrapInternalf(err, errors.CodeInternal, "couldn't list rule views")
-	}
-	return views, nil
-}
-
-func (r *rule) UpdateRuleView(ctx context.Context, view *ruletypes.RuleView) error {
-	res, err := r.sqlstore.
-		BunDBCtx(ctx).
-		NewUpdate().
-		Model(view).
-		WherePK().
-		Where("org_id = ?", view.OrgID).
-		Exec(ctx)
-	if err != nil {
-		return errors.WrapInternalf(err, errors.CodeInternal, "couldn't update rule view")
-	}
-	rows, err := res.RowsAffected()
-	if err != nil {
-		return errors.WrapInternalf(err, errors.CodeInternal, "couldn't read rule view update result")
-	}
-	if rows == 0 {
-		return errors.Newf(errors.TypeNotFound, ruletypes.ErrCodeRuleViewNotFound, "rule view with id %s doesn't exist", view.ID)
-	}
-	return nil
-}
-
-func (r *rule) DeleteRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
-	res, err := r.sqlstore.
-		BunDBCtx(ctx).
-		NewDelete().
-		Model(new(ruletypes.RuleView)).
-		Where("id = ?", id).
-		Where("org_id = ?", orgID).
-		Exec(ctx)
-	if err != nil {
-		return errors.WrapInternalf(err, errors.CodeInternal, "couldn't delete rule view")
-	}
-	rows, err := res.RowsAffected()
-	if err != nil {
-		return errors.WrapInternalf(err, errors.CodeInternal, "couldn't read rule view delete result")
-	}
-	if rows == 0 {
-		return errors.Newf(errors.TypeNotFound, ruletypes.ErrCodeRuleViewNotFound, "rule view with id %s doesn't exist", id)
-	}
-	return nil
-}

pkg/ruler/signozruler/handler.go

@@ -43,29 +43,6 @@ func (handler *handler) ListRules(rw http.ResponseWriter, req *http.Request) {
 	render.Success(rw, http.StatusOK, view)
 }
 
-func (handler *handler) ListRulesV3(rw http.ResponseWriter, req *http.Request) {
-	ctx, cancel := context.WithTimeout(req.Context(), 30*time.Second)
-	defer cancel()
-
-	params := new(ruletypes.ListRulesParams)
-	if err := binding.Query.BindQuery(req.URL.Query(), params); err != nil {
-		render.Error(rw, err)
-		return
-	}
-	if err := params.Validate(); err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	listableRules, err := handler.ruler.ListRules(ctx, params)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusOK, listableRules)
-}
-
 func (handler *handler) GetRuleByID(rw http.ResponseWriter, req *http.Request) {
 	ctx, cancel := context.WithTimeout(req.Context(), 30*time.Second)
 	defer cancel()
@@ -345,122 +322,3 @@ func (handler *handler) DeleteDowntimeScheduleByID(rw http.ResponseWriter, req *
 
 	render.Success(rw, http.StatusNoContent, nil)
 }
-
-func (handler *handler) ListRuleViews(rw http.ResponseWriter, req *http.Request) {
-	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
-	defer cancel()
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-	orgID, err := valuer.NewUUID(claims.OrgID)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	views, err := handler.ruler.ListRuleViews(ctx, orgID)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusOK, views)
-}
-
-func (handler *handler) CreateRuleView(rw http.ResponseWriter, req *http.Request) {
-	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
-	defer cancel()
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-	orgID, err := valuer.NewUUID(claims.OrgID)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	var postable ruletypes.PostableRuleView
-	if err := binding.JSON.BindBody(req.Body, &postable); err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	view, err := handler.ruler.CreateRuleView(ctx, orgID, postable)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusCreated, view)
-}
-
-func (handler *handler) UpdateRuleView(rw http.ResponseWriter, req *http.Request) {
-	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
-	defer cancel()
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-	orgID, err := valuer.NewUUID(claims.OrgID)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	id, err := valuer.NewUUID(mux.Vars(req)["id"])
-	if err != nil {
-		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "id is not a valid uuid-v7"))
-		return
-	}
-
-	var updatable ruletypes.UpdatableRuleView
-	if err := binding.JSON.BindBody(req.Body, &updatable); err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	view, err := handler.ruler.UpdateRuleView(ctx, orgID, id, updatable)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusOK, view)
-}
-
-func (handler *handler) DeleteRuleView(rw http.ResponseWriter, req *http.Request) {
-	ctx, cancel := context.WithTimeout(req.Context(), 10*time.Second)
-	defer cancel()
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-	orgID, err := valuer.NewUUID(claims.OrgID)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	id, err := valuer.NewUUID(mux.Vars(req)["id"])
-	if err != nil {
-		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "id is not a valid uuid-v7"))
-		return
-	}
-
-	if err := handler.ruler.DeleteRuleView(ctx, orgID, id); err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusNoContent, nil)
-}

pkg/ruler/signozruler/provider.go

@@ -116,10 +116,6 @@ func (provider *provider) ListRuleStates(ctx context.Context) (*ruletypes.Gettab
 	return provider.manager.ListRuleStates(ctx)
 }
 
-func (provider *provider) ListRules(ctx context.Context, params *ruletypes.ListRulesParams) (*ruletypes.ListableRules, error) {
-	return provider.manager.ListRules(ctx, params)
-}
-
 func (provider *provider) GetRule(ctx context.Context, id valuer.UUID) (*ruletypes.GettableRule, error) {
 	return provider.manager.GetRule(ctx, id)
 }
@@ -147,41 +143,3 @@ func (provider *provider) TestNotification(ctx context.Context, orgID valuer.UUI
 func (provider *provider) MaintenanceStore() alertmanagertypes.MaintenanceStore {
 	return provider.manager.MaintenanceStore()
 }
-
-func (provider *provider) CreateRuleView(ctx context.Context, orgID valuer.UUID, postable ruletypes.PostableRuleView) (*ruletypes.RuleView, error) {
-	if err := postable.Validate(); err != nil {
-		return nil, err
-	}
-	view := postable.NewRuleView(orgID)
-	if err := provider.ruleStore.CreateRuleView(ctx, view); err != nil {
-		return nil, err
-	}
-	return view, nil
-}
-
-func (provider *provider) ListRuleViews(ctx context.Context, orgID valuer.UUID) (*ruletypes.ListableRuleViews, error) {
-	views, err := provider.ruleStore.ListRuleViews(ctx, orgID)
-	if err != nil {
-		return nil, err
-	}
-	return &ruletypes.ListableRuleViews{Views: views}, nil
-}
-
-func (provider *provider) UpdateRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatable ruletypes.UpdatableRuleView) (*ruletypes.RuleView, error) {
-	if err := updatable.Validate(); err != nil {
-		return nil, err
-	}
-	view, err := provider.ruleStore.GetRuleView(ctx, orgID, id)
-	if err != nil {
-		return nil, err
-	}
-	view.Update(updatable)
-	if err := provider.ruleStore.UpdateRuleView(ctx, view); err != nil {
-		return nil, err
-	}
-	return view, nil
-}
-
-func (provider *provider) DeleteRuleView(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
-	return provider.ruleStore.DeleteRuleView(ctx, orgID, id)
-}

pkg/signoz/openapi.go

@@ -10,14 +10,12 @@ import (
 	"github.com/SigNoz/signoz/pkg/alertmanager"
 	"github.com/SigNoz/signoz/pkg/apiserver"
 	"github.com/SigNoz/signoz/pkg/apiserver/signozapiserver"
-	"github.com/SigNoz/signoz/pkg/auditor"
 	"github.com/SigNoz/signoz/pkg/authz"
 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/flagger"
 	"github.com/SigNoz/signoz/pkg/gateway"
 	"github.com/SigNoz/signoz/pkg/global"
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/identn"
 	"github.com/SigNoz/signoz/pkg/instrumentation"
 	"github.com/SigNoz/signoz/pkg/licensing"
 	"github.com/SigNoz/signoz/pkg/modules/aiobservability"
@@ -44,11 +42,9 @@ import (
 	"github.com/SigNoz/signoz/pkg/prometheus"
 	"github.com/SigNoz/signoz/pkg/querier"
 	"github.com/SigNoz/signoz/pkg/ruler"
-	"github.com/SigNoz/signoz/pkg/sharder"
 	"github.com/SigNoz/signoz/pkg/statsreporter"
 	"github.com/SigNoz/signoz/pkg/subscription"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/web"
 	"github.com/SigNoz/signoz/pkg/zeus"
 	"github.com/swaggest/jsonschema-go"
 	"github.com/swaggest/openapi-go"
@@ -70,6 +66,7 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ authz.AuthZ }{},
 		struct{ organization.Handler }{},
 		struct{ user.Handler }{},
+		struct{ user.Getter }{},
 		struct{ session.Handler }{},
 		struct{ authdomain.Handler }{},
 		struct{ authdomain.Module }{},
@@ -105,11 +102,6 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ ruler.Handler }{},
 		struct{ statsreporter.Handler }{},
 		struct{ savedview.Handler }{},
-		global.Config{},
-		struct{ identn.IdentNResolver }{},
-		struct{ sharder.Sharder }{},
-		struct{ auditor.Auditor }{},
-		struct{ web.Web }{},
 		struct{ quickfilter.Module }{},
 		struct{ quickfilter.Handler }{},
 	).New(ctx, instrumentation.ToProviderSettings(), apiserver.Config{})

pkg/signoz/provider.go

@@ -254,7 +254,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddIngestionTuplesFactory(sqlstore),
 		sqlmigration.NewAddSubscriptionTuplesFactory(sqlstore),
 		sqlmigration.NewNormalizeQuickFilterFieldsFactory(sqlstore),
-		sqlmigration.NewAddRuleViewFactory(sqlstore, sqlschema),
+		sqlmigration.NewAddUserTuplesFactory(sqlstore),
 	)
 }
 
@@ -320,13 +320,14 @@ func NewQuerierProviderFactories(telemetryStore telemetrystore.TelemetryStore, p
 	)
 }
 
-func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
+func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
 	return factory.MustNewNamedMap(
 		signozapiserver.NewFactory(
 			orgGetter,
 			authz,
 			implorganization.NewHandler(modules.OrgGetter, modules.OrgSetter),
 			impluser.NewHandler(modules.UserSetter, modules.UserGetter),
+			modules.UserGetter,
 			implsession.NewHandler(modules.Session, globalConfig),
 			implauthdomain.NewHandler(modules.AuthDomain),
 			modules.AuthDomain,
@@ -362,11 +363,6 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.RulerHandler,
 			handlers.StatsHandler,
 			handlers.SavedView,
-			globalConfig,
-			identNResolver,
-			sharder,
-			auditor,
-			web,
 			modules.QuickFilter,
 			handlers.QuickFilter,
 		),

pkg/signoz/provider_test.go

@@ -102,10 +102,6 @@ func TestNewProviderFactories(t *testing.T) {
 			Handlers{},
 			global.Config{},
 			nil,
-			nil,
-			nil,
-			nil,
-			nil,
 		)
 	})
 }

pkg/signoz/signoz.go

@@ -635,20 +635,13 @@ func New(
 		ctx,
 		providerSettings,
 		config.APIServer,
-		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web),
+		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway),
 		"signoz",
 	)
 	if err != nil {
 		return nil, err
 	}
 
-	// Register the API server with the registry so its lifecycle is managed
-	// alongside the other services and it shows up in the health endpoint.
-	err = registry.Add(ctx, factory.NewNamedService(factory.MustNewName("apiserver"), apiserverInstance))
-	if err != nil {
-		return nil, err
-	}
-
 	return &SigNoz{
 		Registry:               registry,
 		Analytics:              analytics,

pkg/sqlmigration/127_add_rule_view.go

@@ -1,78 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlschema"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addRuleView struct {
-	sqlstore  sqlstore.SQLStore
-	sqlschema sqlschema.SQLSchema
-}
-
-func NewAddRuleViewFactory(sqlstore sqlstore.SQLStore, sqlschema sqlschema.SQLSchema) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_rule_view"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addRuleView{
-			sqlstore:  sqlstore,
-			sqlschema: sqlschema,
-		}, nil
-	})
-}
-
-func (migration *addRuleView) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addRuleView) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	sqls := migration.sqlschema.Operator().CreateTable(&sqlschema.Table{
-		Name: "rule_view",
-		Columns: []*sqlschema.Column{
-			{Name: "id", DataType: sqlschema.DataTypeText, Nullable: false},
-			{Name: "name", DataType: sqlschema.DataTypeText, Nullable: false},
-			{Name: "data", DataType: sqlschema.DataTypeText, Nullable: false},
-			{Name: "org_id", DataType: sqlschema.DataTypeText, Nullable: false},
-			{Name: "created_at", DataType: sqlschema.DataTypeTimestamp, Nullable: false},
-			{Name: "updated_at", DataType: sqlschema.DataTypeTimestamp, Nullable: false},
-		},
-		PrimaryKeyConstraint: &sqlschema.PrimaryKeyConstraint{ColumnNames: []sqlschema.ColumnName{"id"}},
-		ForeignKeyConstraints: []*sqlschema.ForeignKeyConstraint{
-			{
-				ReferencingColumnName: sqlschema.ColumnName("org_id"),
-				ReferencedTableName:   sqlschema.TableName("organizations"),
-				ReferencedColumnName:  sqlschema.ColumnName("id"),
-			},
-		},
-	})
-
-	for _, sql := range sqls {
-		if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
-			return err
-		}
-	}
-
-	if _, err := tx.NewCreateIndex().
-		Table("rule_view").
-		Column("org_id").
-		Index("idx_rule_view_org_id").
-		IfNotExists().
-		Exec(ctx); err != nil {
-		return err
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addRuleView) Down(_ context.Context, _ *bun.DB) error {
-	return nil
-}

pkg/sqlmigration/127_add_user_tuples.go

@@ -0,0 +1,144 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addUserTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddUserTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_user_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addUserTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addUserTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addUserTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	// user and factor-password moved from the legacy AdminAccess role gate to
+	// CheckResources, which on enterprise requires real tuples -- existing orgs
+	// never had these written, only new orgs get them from the registry at
+	// bootstrap. The managed-role transaction groups stored per org already
+	// carry these transactions, so no re-sync is needed here.
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "user", "user", "create"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "read"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "update"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "delete"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "list"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "attach"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "detach"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addUserTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/sqlstore/sqlitesqlstore/formatter.go

@@ -1,7 +1,6 @@
 package sqlitesqlstore
 
 import (
-	"fmt"
 	"strings"
 
 	"github.com/SigNoz/signoz/pkg/sqlstore"
@@ -26,12 +25,6 @@ func (f *formatter) JSONExtractString(column, path string) []byte {
 	return sql
 }
 
-func (f *formatter) JSONExtractMapValue(column, mapField, key string) []byte {
-	// Quote the key as one path segment; a double quote in it is inexpressible in sqlite JSON paths.
-	escapedKey := strings.NewReplacer(`\`, `\\`).Replace(key)
-	return f.JSONExtractString(column, fmt.Sprintf(`$.%s."%s"`, mapField, escapedKey))
-}
-
 func (f *formatter) JSONType(column, path string) []byte {
 	var sql []byte
 	sql = append(sql, "json_type("...)

pkg/sqlstore/sqlstore.go

@@ -114,9 +114,6 @@ type SQLFormatter interface {
 	// JSONKeys return extracted key from json as well as alias to be used for select and where clause
 	JSONKeys(column, path, alias string) ([]byte, []byte)
 
-	// JSONExtractMapValue extracts one key's value from a JSON object field; dots in the key are not path nesting.
-	JSONExtractMapValue(column, mapField, key string) []byte
-
 	// TextToJsonColumn converts a text column to JSON type
 	TextToJsonColumn(column string) []byte
 

pkg/sqlstore/sqlstoretest/formatter.go

@@ -1,7 +1,6 @@
 package sqlstoretest
 
 import (
-	"fmt"
 	"strings"
 
 	"github.com/SigNoz/signoz/pkg/sqlstore"
@@ -26,11 +25,6 @@ func (f *formatter) JSONExtractString(column, path string) []byte {
 	return sql
 }
 
-func (f *formatter) JSONExtractMapValue(column, mapField, key string) []byte {
-	escapedKey := strings.NewReplacer(`\`, `\\`).Replace(key)
-	return f.JSONExtractString(column, fmt.Sprintf(`$.%s."%s"`, mapField, escapedKey))
-}
-
 func (f *formatter) JSONType(column, path string) []byte {
 	var sql []byte
 	sql = append(sql, "json_type("...)

pkg/types/ruletypes/list.go

@@ -1,147 +0,0 @@
-package ruletypes
-
-import (
-	"slices"
-	"unicode/utf8"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
-
-const (
-	DefaultListLimit = 20
-	MaxListLimit     = 5000
-	MaxListQueryLen  = 1024
-)
-
-var ErrCodeRuleListInvalid = errors.MustNewCode("rule_list_invalid")
-
-type ListSort struct{ valuer.String }
-
-var (
-	ListSortUpdatedAt = ListSort{valuer.NewString("updated_at")}
-	ListSortCreatedAt = ListSort{valuer.NewString("created_at")}
-	ListSortName      = ListSort{valuer.NewString("name")}
-	ListSortState     = ListSort{valuer.NewString("state")}
-	ListSortSeverity  = ListSort{valuer.NewString("severity")}
-)
-
-func (ListSort) Enum() []any {
-	return []any{ListSortUpdatedAt, ListSortCreatedAt, ListSortName, ListSortState, ListSortSeverity}
-}
-
-func (s ListSort) IsValid() bool {
-	return slices.ContainsFunc(s.Enum(), func(v any) bool { return v == s })
-}
-
-type ListOrder struct{ valuer.String }
-
-var (
-	ListOrderAsc  = ListOrder{valuer.NewString("asc")}
-	ListOrderDesc = ListOrder{valuer.NewString("desc")}
-)
-
-func (ListOrder) Enum() []any {
-	return []any{ListOrderAsc, ListOrderDesc}
-}
-
-func (o ListOrder) IsValid() bool {
-	return slices.ContainsFunc(o.Enum(), func(v any) bool { return v == o })
-}
-
-// ListFilter is the rule listing state shared by the v3 list params and saved views.
-type ListFilter struct {
-	Query string `query:"query" json:"query"`
-	// gin cannot bind a slice of valuer enums; AlertStates converts these.
-	States []string  `query:"states" json:"states" nullable:"false"`
-	Sort   ListSort  `query:"sort" json:"sort"`
-	Order  ListOrder `query:"order" json:"order"`
-}
-
-// Validate normalizes in place; zero sort/order get the defaults, nil states an empty slice.
-func (f *ListFilter) Validate() error {
-	if f.States == nil {
-		f.States = []string{}
-	}
-
-	if n := utf8.RuneCountInString(f.Query); n > MaxListQueryLen {
-		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
-			"query cannot be longer than %d characters, got %d", MaxListQueryLen, n)
-	}
-
-	if _, err := f.AlertStates(); err != nil {
-		return err
-	}
-
-	if f.Sort.IsZero() {
-		f.Sort = ListSortUpdatedAt
-	} else if !f.Sort.IsValid() {
-		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
-			"invalid sort %q, expected one of: `updated_at`, `created_at`, `name`, `state`, `severity`", f.Sort)
-	}
-
-	if f.Order.IsZero() {
-		f.Order = ListOrderDesc
-	} else if !f.Order.IsValid() {
-		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
-			"invalid order %q, expected `asc` or `desc`", f.Order)
-	}
-
-	return nil
-}
-
-// AlertStates parses States; empty means no state filtering.
-func (f *ListFilter) AlertStates() ([]AlertState, error) {
-	if len(f.States) == 0 {
-		return nil, nil
-	}
-
-	states := make([]AlertState, 0, len(f.States))
-	for _, raw := range f.States {
-		state, err := parseAlertState(raw)
-		if err != nil {
-			return nil, err
-		}
-		states = append(states, state)
-	}
-
-	return states, nil
-}
-
-func parseAlertState(raw string) (AlertState, error) {
-	state := AlertState{valuer.NewString(raw)}
-	if !slices.Contains(state.Enum(), any(state)) {
-		return AlertState{}, errors.NewInvalidInputf(ErrCodeRuleListInvalid,
-			"invalid state %q, expected one of: `firing`, `pending`, `recovering`, `inactive`, `nodata`, `disabled`", raw)
-	}
-	return state, nil
-}
-
-type ListRulesParams struct {
-	ListFilter
-	Limit  int `query:"limit"`
-	Offset int `query:"offset"`
-}
-
-// Validate normalizes in place; an over-max limit is clamped, not rejected.
-func (p *ListRulesParams) Validate() error {
-	if err := p.ListFilter.Validate(); err != nil {
-		return err
-	}
-
-	if p.Limit == 0 {
-		p.Limit = DefaultListLimit
-	} else if p.Limit < 0 {
-		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
-			"invalid limit %d, must be a positive integer", p.Limit)
-	} else if p.Limit > MaxListLimit {
-		p.Limit = MaxListLimit
-	}
-
-	if p.Offset < 0 {
-		return errors.NewInvalidInputf(ErrCodeRuleListInvalid,
-			"invalid offset %d, must be a non-negative integer", p.Offset)
-	}
-
-	return nil
-}

pkg/types/ruletypes/list_filter.go

@@ -1,100 +0,0 @@
-package ruletypes
-
-import (
-	"slices"
-	"strings"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-)
-
-var ErrCodeRuleListFilterInvalid = errors.MustNewCode("rule_list_filter_invalid")
-
-// DSLKey is a reserved (column-level) key in the rule list filter DSL.
-type DSLKey string
-
-const (
-	DSLKeyName      DSLKey = "name"
-	DSLKeySeverity  DSLKey = "severity"
-	DSLKeyCreatedBy DSLKey = "created_by"
-	DSLKeyUpdatedBy DSLKey = "updated_by"
-	DSLKeyCreatedAt DSLKey = "created_at"
-	DSLKeyUpdatedAt DSLKey = "updated_at"
-	DSLKeyAlertType DSLKey = "alert_type"
-	DSLKeyRuleType  DSLKey = "rule_type"
-
-	// Label keys under this prefix are matched exactly (case-sensitive).
-	DSLLabelsKeyPrefix = "labels."
-
-	// Advertised in reservedKeywords; not itself a filterable key.
-	DSLKeyLabelsPlaceholder DSLKey = "labels.<key>"
-)
-
-func ReservedFilterKeys() []DSLKey {
-	keys := make([]DSLKey, 0, len(ReservedOps)+1)
-	for key := range ReservedOps {
-		keys = append(keys, key)
-	}
-	keys = append(keys, DSLKeyLabelsPlaceholder)
-	slices.SortFunc(keys, func(a, b DSLKey) int {
-		return strings.Compare(string(a), string(b))
-	})
-	return keys
-}
-
-// ReservedOps lists the operators each reserved DSL key accepts; `labels.<key>` terms use LabelsKeyOps.
-var ReservedOps = map[DSLKey]map[qbtypesv5.FilterOperator]struct{}{
-	DSLKeyName: stringSearchOps(),
-	// severity aliases labels.severity, so it takes the labels operator set.
-	DSLKeySeverity:  LabelsKeyOps,
-	DSLKeyCreatedBy: stringSearchOps(),
-	DSLKeyUpdatedBy: stringSearchOps(),
-	DSLKeyCreatedAt: numericRangeOps(),
-	DSLKeyUpdatedAt: numericRangeOps(),
-	DSLKeyAlertType: enumOps(),
-	DSLKeyRuleType:  enumOps(),
-}
-
-// LabelsKeyOps operators target the label's value; EXISTS/NOT EXISTS test its presence.
-var LabelsKeyOps = opsSet(
-	qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
-	qbtypesv5.FilterOperatorLike, qbtypesv5.FilterOperatorNotLike,
-	qbtypesv5.FilterOperatorILike, qbtypesv5.FilterOperatorNotILike,
-	qbtypesv5.FilterOperatorContains, qbtypesv5.FilterOperatorNotContains,
-	qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn,
-	qbtypesv5.FilterOperatorExists, qbtypesv5.FilterOperatorNotExists,
-)
-
-func stringSearchOps() map[qbtypesv5.FilterOperator]struct{} {
-	return opsSet(
-		qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
-		qbtypesv5.FilterOperatorLike, qbtypesv5.FilterOperatorNotLike,
-		qbtypesv5.FilterOperatorILike, qbtypesv5.FilterOperatorNotILike,
-		qbtypesv5.FilterOperatorContains, qbtypesv5.FilterOperatorNotContains,
-		qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn,
-	)
-}
-
-func numericRangeOps() map[qbtypesv5.FilterOperator]struct{} {
-	return opsSet(
-		qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
-		qbtypesv5.FilterOperatorLessThan, qbtypesv5.FilterOperatorLessThanOrEq,
-		qbtypesv5.FilterOperatorGreaterThan, qbtypesv5.FilterOperatorGreaterThanOrEq,
-		qbtypesv5.FilterOperatorBetween, qbtypesv5.FilterOperatorNotBetween,
-	)
-}
-
-func enumOps() map[qbtypesv5.FilterOperator]struct{} {
-	return opsSet(
-		qbtypesv5.FilterOperatorEqual, qbtypesv5.FilterOperatorNotEqual,
-		qbtypesv5.FilterOperatorIn, qbtypesv5.FilterOperatorNotIn,
-	)
-}
-
-func opsSet(ops ...qbtypesv5.FilterOperator) map[qbtypesv5.FilterOperator]struct{} {
-	m := make(map[qbtypesv5.FilterOperator]struct{}, len(ops))
-	for _, op := range ops {
-		m[op] = struct{}{}
-	}
-	return m
-}

pkg/types/ruletypes/list_filter_test.go

@@ -1,34 +0,0 @@
-package ruletypes
-
-import (
-	"testing"
-
-	qbtypesv5 "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/stretchr/testify/assert"
-)
-
-func TestReservedFilterKeys(t *testing.T) {
-	assert.Equal(t, []DSLKey{
-		DSLKeyAlertType,
-		DSLKeyCreatedAt,
-		DSLKeyCreatedBy,
-		DSLKeyLabelsPlaceholder,
-		DSLKeyName,
-		DSLKeyRuleType,
-		DSLKeySeverity,
-		DSLKeyUpdatedAt,
-		DSLKeyUpdatedBy,
-	}, ReservedFilterKeys())
-}
-
-func TestFilterOpsExcludeRegexp(t *testing.T) {
-	for key, ops := range ReservedOps {
-		assert.NotEmpty(t, ops, "key %q has no operators", key)
-		assert.NotContains(t, ops, qbtypesv5.FilterOperatorRegexp, "key %q allows REGEXP", key)
-		assert.NotContains(t, ops, qbtypesv5.FilterOperatorNotRegexp, "key %q allows NOT REGEXP", key)
-	}
-	assert.NotContains(t, LabelsKeyOps, qbtypesv5.FilterOperatorRegexp)
-	assert.NotContains(t, LabelsKeyOps, qbtypesv5.FilterOperatorNotRegexp)
-	assert.Contains(t, LabelsKeyOps, qbtypesv5.FilterOperatorExists)
-	assert.Contains(t, LabelsKeyOps, qbtypesv5.FilterOperatorNotExists)
-}

pkg/types/ruletypes/list_test.go

@@ -1,126 +0,0 @@
-package ruletypes
-
-import (
-	"strings"
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestListRulesParamsValidate(t *testing.T) {
-	testCases := []struct {
-		name      string
-		params    ListRulesParams
-		wantErr   string
-		wantSort  ListSort
-		wantOrder ListOrder
-		wantLimit int
-	}{
-		{
-			name:      "empty params get defaults",
-			params:    ListRulesParams{},
-			wantSort:  ListSortUpdatedAt,
-			wantOrder: ListOrderDesc,
-			wantLimit: DefaultListLimit,
-		},
-		{
-			name:      "explicit values kept",
-			params:    ListRulesParams{ListFilter: ListFilter{Sort: ListSortSeverity, Order: ListOrderAsc}, Limit: 50, Offset: 100},
-			wantSort:  ListSortSeverity,
-			wantOrder: ListOrderAsc,
-			wantLimit: 50,
-		},
-		{
-			name:      "over-max limit clamped",
-			params:    ListRulesParams{Limit: MaxListLimit + 1},
-			wantSort:  ListSortUpdatedAt,
-			wantOrder: ListOrderDesc,
-			wantLimit: MaxListLimit,
-		},
-		{
-			name:    "invalid state rejected",
-			params:  ListRulesParams{ListFilter: ListFilter{States: []string{"bogus"}}},
-			wantErr: `invalid state "bogus"`,
-		},
-		{
-			name:    "invalid sort rejected",
-			params:  ListRulesParams{ListFilter: ListFilter{Sort: ListSort{valuer.NewString("bogus")}}},
-			wantErr: "invalid sort",
-		},
-		{
-			name:    "invalid order rejected",
-			params:  ListRulesParams{ListFilter: ListFilter{Order: ListOrder{valuer.NewString("bogus")}}},
-			wantErr: "invalid order",
-		},
-		{
-			name:    "negative limit rejected",
-			params:  ListRulesParams{Limit: -1},
-			wantErr: "invalid limit",
-		},
-		{
-			name:    "negative offset rejected",
-			params:  ListRulesParams{Offset: -1},
-			wantErr: "invalid offset",
-		},
-		{
-			name:    "over-long query rejected",
-			params:  ListRulesParams{ListFilter: ListFilter{Query: strings.Repeat("a", MaxListQueryLen+1)}},
-			wantErr: "query cannot be longer",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			err := tc.params.Validate()
-			if tc.wantErr != "" {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), tc.wantErr)
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, tc.wantSort, tc.params.Sort)
-			assert.Equal(t, tc.wantOrder, tc.params.Order)
-			assert.Equal(t, tc.wantLimit, tc.params.Limit)
-		})
-	}
-}
-
-func TestListRulesParamsAlertStates(t *testing.T) {
-	testCases := []struct {
-		name       string
-		states     []string
-		wantErr    string
-		wantStates []AlertState
-	}{
-		{
-			name:       "valid states parsed to typed values",
-			states:     []string{"firing", "pending"},
-			wantStates: []AlertState{StateFiring, StatePending},
-		},
-		{
-			name:   "absent states mean no filtering",
-			states: nil,
-		},
-		{
-			name:    "invalid state rejected",
-			states:  []string{"bogus"},
-			wantErr: `invalid state "bogus"`,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			params := ListRulesParams{ListFilter: ListFilter{States: tc.states}}
-			states, err := params.AlertStates()
-			if tc.wantErr != "" {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), tc.wantErr)
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, tc.wantStates, states)
-		})
-	}
-}

pkg/types/ruletypes/listable_rule.go

@@ -1,162 +0,0 @@
-package ruletypes
-
-import (
-	"cmp"
-	"encoding/json"
-	"slices"
-	"strings"
-
-	"github.com/SigNoz/signoz/pkg/types"
-)
-
-const MaxListLabelPairs = 1000
-
-// ListableRule is the slim per-row shape of the list endpoint; the full rule stays behind get-by-id.
-type ListableRule struct {
-	Id          string            `json:"id" required:"true"`
-	State       AlertState        `json:"state" required:"true"`
-	AlertName   string            `json:"alert" required:"true"`
-	Description string            `json:"description,omitempty"`
-	AlertType   AlertType         `json:"alertType" required:"true"`
-	RuleType    RuleType          `json:"ruleType" required:"true"`
-	Disabled    bool              `json:"disabled"`
-	Labels      map[string]string `json:"labels,omitempty"`
-	types.TimeAuditable
-	types.UserAuditable
-}
-
-func NewListableRule(rule *GettableRule) *ListableRule {
-	listable := &ListableRule{
-		Id:          rule.Id,
-		State:       rule.State,
-		AlertName:   rule.AlertName,
-		Description: rule.Description,
-		AlertType:   rule.AlertType,
-		RuleType:    rule.RuleType,
-		Disabled:    rule.Disabled,
-		Labels:      rule.Labels,
-		TimeAuditable: types.TimeAuditable{
-			CreatedAt: rule.CreatedAt,
-			UpdatedAt: rule.UpdatedAt,
-		},
-	}
-	if rule.CreatedBy != nil {
-		listable.CreatedBy = *rule.CreatedBy
-	}
-	if rule.UpdatedBy != nil {
-		listable.UpdatedBy = *rule.UpdatedBy
-	}
-	return listable
-}
-
-// LabelPair is one distinct label key/value observed on the org's rules.
-type LabelPair struct {
-	Key   string `json:"key" required:"true"`
-	Value string `json:"value" required:"true"`
-}
-
-type ListableRules struct {
-	Rules            []*ListableRule `json:"rules" required:"true" nullable:"false"`
-	Total            int64           `json:"total" required:"true"`
-	Labels           []LabelPair     `json:"labels" required:"true" nullable:"false"`
-	ReservedKeywords []DSLKey        `json:"reservedKeywords" required:"true" nullable:"false"`
-}
-
-func NewListableRules(rules []*ListableRule, total int64, labels []LabelPair) *ListableRules {
-	return &ListableRules{
-		Rules:            rules,
-		Total:            total,
-		Labels:           labels,
-		ReservedKeywords: ReservedFilterKeys(),
-	}
-}
-
-// Display priority, worst first; NOT AlertState.Severity(), which ranks disabled/nodata above firing.
-var stateDisplayRank = map[AlertState]int{
-	StateFiring:     5,
-	StatePending:    4,
-	StateRecovering: 3,
-	StateNoData:     2,
-	StateInactive:   1,
-	StateDisabled:   0,
-}
-
-var severityDisplayRank = map[string]int{
-	"critical": 4,
-	"error":    3,
-	"warning":  2,
-	"info":     1,
-}
-
-// Ties break on name then id ascending (order applies to the primary key only) so pages stay stable.
-func SortListableRules(rules []*ListableRule, sortBy ListSort, order ListOrder) {
-	direction := 1
-	if order == ListOrderDesc {
-		direction = -1
-	}
-	slices.SortStableFunc(rules, func(a, b *ListableRule) int {
-		if c := direction * compareListableRules(a, b, sortBy); c != 0 {
-			return c
-		}
-		if c := strings.Compare(strings.ToLower(a.AlertName), strings.ToLower(b.AlertName)); c != 0 {
-			return c
-		}
-		return strings.Compare(a.Id, b.Id)
-	})
-}
-
-func compareListableRules(a, b *ListableRule, sortBy ListSort) int {
-	switch sortBy {
-	case ListSortName:
-		return strings.Compare(strings.ToLower(a.AlertName), strings.ToLower(b.AlertName))
-	case ListSortCreatedAt:
-		return a.CreatedAt.Compare(b.CreatedAt)
-	case ListSortState:
-		return cmp.Compare(stateDisplayRank[a.State], stateDisplayRank[b.State])
-	case ListSortSeverity:
-		severityA := a.Labels["severity"]
-		severityB := b.Labels["severity"]
-		rankA := severityDisplayRank[strings.ToLower(severityA)]
-		rankB := severityDisplayRank[strings.ToLower(severityB)]
-		if rankA != rankB {
-			return cmp.Compare(rankA, rankB)
-		}
-		if rankA == 0 {
-			return strings.Compare(strings.ToLower(severityA), strings.ToLower(severityB))
-		}
-		return 0
-	}
-	return a.UpdatedAt.Compare(b.UpdatedAt)
-}
-
-// NewLabelPairsFromRawJSON skips blank or malformed entries and caps the result at limit.
-func NewLabelPairsFromRawJSON(raws []string, limit int) []LabelPair {
-	set := make(map[LabelPair]struct{})
-	for _, raw := range raws {
-		if raw == "" || raw == "null" {
-			continue
-		}
-		labels := make(map[string]string)
-		if err := json.Unmarshal([]byte(raw), &labels); err != nil {
-			continue
-		}
-		for key, value := range labels {
-			set[LabelPair{Key: key, Value: value}] = struct{}{}
-		}
-	}
-
-	pairs := make([]LabelPair, 0, len(set))
-	for pair := range set {
-		pairs = append(pairs, pair)
-	}
-	slices.SortFunc(pairs, func(a, b LabelPair) int {
-		if c := strings.Compare(a.Key, b.Key); c != 0 {
-			return c
-		}
-		return strings.Compare(a.Value, b.Value)
-	})
-	if len(pairs) > limit {
-		pairs = pairs[:limit]
-	}
-	return pairs
-}

pkg/types/ruletypes/listable_rule_test.go

@@ -1,163 +0,0 @@
-package ruletypes
-
-import (
-	"testing"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/stretchr/testify/assert"
-)
-
-func listableRule(name string, state AlertState, severity string, updatedAt time.Time) *ListableRule {
-	rule := &ListableRule{
-		AlertName: name,
-		State:     state,
-		TimeAuditable: types.TimeAuditable{
-			UpdatedAt: updatedAt,
-		},
-	}
-	if severity != "" {
-		rule.Labels = map[string]string{"severity": severity}
-	}
-	return rule
-}
-
-func names(rules []*ListableRule) []string {
-	out := make([]string, 0, len(rules))
-	for _, rule := range rules {
-		out = append(out, rule.AlertName)
-	}
-	return out
-}
-
-func TestSortListableRules(t *testing.T) {
-	base := time.Date(2026, 9, 1, 0, 0, 0, 0, time.UTC)
-
-	testCases := []struct {
-		name      string
-		rules     []*ListableRule
-		sortBy    ListSort
-		order     ListOrder
-		wantNames []string
-	}{
-		{
-			name: "state desc is display priority firing first",
-			rules: []*ListableRule{
-				listableRule("disabled", StateDisabled, "", base),
-				listableRule("nodata", StateNoData, "", base),
-				listableRule("firing", StateFiring, "", base),
-				listableRule("inactive", StateInactive, "", base),
-				listableRule("pending", StatePending, "", base),
-				listableRule("recovering", StateRecovering, "", base),
-			},
-			sortBy:    ListSortState,
-			order:     ListOrderDesc,
-			wantNames: []string{"firing", "pending", "recovering", "nodata", "inactive", "disabled"},
-		},
-		{
-			name: "severity desc ranks known values then custom ones lexically",
-			rules: []*ListableRule{
-				listableRule("warn", StateInactive, "warning", base),
-				listableRule("custom-b", StateInactive, "bbb", base),
-				listableRule("crit", StateInactive, "critical", base),
-				listableRule("custom-a", StateInactive, "aaa", base),
-				listableRule("none", StateInactive, "", base),
-			},
-			sortBy: ListSortSeverity,
-			order:  ListOrderDesc,
-			// desc flips the lexical compare between custom values too
-			wantNames: []string{"crit", "warn", "custom-b", "custom-a", "none"},
-		},
-		{
-			name: "name asc is case-insensitive",
-			rules: []*ListableRule{
-				listableRule("banana", StateInactive, "", base),
-				listableRule("Apple", StateInactive, "", base),
-				listableRule("cherry", StateInactive, "", base),
-			},
-			sortBy:    ListSortName,
-			order:     ListOrderAsc,
-			wantNames: []string{"Apple", "banana", "cherry"},
-		},
-		{
-			name: "updated_at desc puts newest first",
-			rules: []*ListableRule{
-				listableRule("old", StateInactive, "", base),
-				listableRule("new", StateInactive, "", base.Add(time.Hour)),
-			},
-			sortBy:    ListSortUpdatedAt,
-			order:     ListOrderDesc,
-			wantNames: []string{"new", "old"},
-		},
-		{
-			name: "state desc ties break on name asc",
-			rules: []*ListableRule{
-				listableRule("banana", StateFiring, "", base),
-				listableRule("zebra", StateDisabled, "", base),
-				listableRule("Apple", StateFiring, "", base),
-				listableRule("cherry", StateFiring, "", base),
-			},
-			sortBy:    ListSortState,
-			order:     ListOrderDesc,
-			wantNames: []string{"Apple", "banana", "cherry", "zebra"},
-		},
-		{
-			name: "state asc flips buckets but tiebreak stays name asc",
-			rules: []*ListableRule{
-				listableRule("banana", StateFiring, "", base),
-				listableRule("zebra", StateDisabled, "", base),
-				listableRule("Apple", StateFiring, "", base),
-				listableRule("cherry", StateFiring, "", base),
-			},
-			sortBy:    ListSortState,
-			order:     ListOrderAsc,
-			wantNames: []string{"zebra", "Apple", "banana", "cherry"},
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			SortListableRules(tc.rules, tc.sortBy, tc.order)
-			assert.Equal(t, tc.wantNames, names(tc.rules))
-		})
-	}
-}
-
-func TestSortListableRulesIdTiebreak(t *testing.T) {
-	base := time.Date(2026, 9, 1, 0, 0, 0, 0, time.UTC)
-
-	for _, order := range []ListOrder{ListOrderAsc, ListOrderDesc} {
-		t.Run(order.StringValue(), func(t *testing.T) {
-			older := listableRule("dup", StateFiring, "", base)
-			older.Id = "01aaa"
-			newer := listableRule("dup", StateFiring, "", base)
-			newer.Id = "01bbb"
-
-			rules := []*ListableRule{newer, older}
-			SortListableRules(rules, ListSortState, order)
-			assert.Equal(t, []string{"01aaa", "01bbb"}, []string{rules[0].Id, rules[1].Id})
-		})
-	}
-}
-
-func TestNewLabelPairsFromRawJSON(t *testing.T) {
-	pairs := NewLabelPairsFromRawJSON([]string{
-		`{"team":"infra","severity":"critical"}`,
-		`{"team":"infra"}`,
-		`{"team":"payments"}`,
-		"",
-		"null",
-		"not-json",
-	}, MaxListLabelPairs)
-
-	assert.Equal(t, []LabelPair{
-		{Key: "severity", Value: "critical"},
-		{Key: "team", Value: "infra"},
-		{Key: "team", Value: "payments"},
-	}, pairs)
-}
-
-func TestNewLabelPairsFromRawJSONCap(t *testing.T) {
-	pairs := NewLabelPairsFromRawJSON([]string{`{"a":"1","b":"2","c":"3"}`}, 2)
-	assert.Len(t, pairs, 2)
-}

pkg/types/ruletypes/rule.go

@@ -11,8 +11,7 @@ import (
 )
 
 type StorableRule struct {
-	// The alias must stay rule: the list filter compiler emits rule.<col> refs.
-	bun.BaseModel `bun:"table:rule,alias:rule"`
+	bun.BaseModel `bun:"table:rule"`
 	types.Identifiable
 	types.TimeAuditable
 	types.UserAuditable
@@ -59,16 +58,6 @@ type RuleStore interface {
 	EditRule(context.Context, *StorableRule, func(context.Context) error) error
 	DeleteRule(context.Context, valuer.UUID, valuer.UUID, func(context.Context) error) error
 	GetStoredRules(context.Context, string) ([]*StorableRule, error)
-	// GetStoredRulesMatching returns the org's rules matching a list filter query; an empty query matches all.
-	GetStoredRulesMatching(context.Context, string, string) ([]*StorableRule, error)
-	// GetStoredRuleLabels returns each rule's labels as raw JSON text, empty string when absent.
-	GetStoredRuleLabels(context.Context, string) ([]string, error)
 	GetStoredRule(context.Context, valuer.UUID, valuer.UUID) (*StorableRule, error)
 	GetStoredRulesByMetricName(context.Context, string, string) ([]RuleAlert, error)
-
-	CreateRuleView(context.Context, *RuleView) error
-	GetRuleView(context.Context, valuer.UUID, valuer.UUID) (*RuleView, error)
-	ListRuleViews(context.Context, valuer.UUID) ([]*RuleView, error)
-	UpdateRuleView(context.Context, *RuleView) error
-	DeleteRuleView(context.Context, valuer.UUID, valuer.UUID) error
 }

pkg/types/ruletypes/rule_view.go

@@ -1,110 +0,0 @@
-package ruletypes
-
-import (
-	"bytes"
-	"encoding/json"
-	"strings"
-	"time"
-	"unicode/utf8"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/uptrace/bun"
-)
-
-const (
-	RuleViewSchemaVersion = "v1"
-	MaxRuleViewNameLen    = 64
-)
-
-var (
-	ErrCodeRuleViewInvalidInput = errors.MustNewCode("rule_view_invalid_input")
-	ErrCodeRuleViewNotFound     = errors.MustNewCode("rule_view_not_found")
-)
-
-type RuleView struct {
-	bun.BaseModel `bun:"table:rule_view,alias:rule_view"`
-
-	types.Identifiable
-	types.TimeAuditable
-
-	Name  string       `bun:"name,type:text,notnull" json:"name" required:"true"`
-	Data  RuleViewData `bun:"data,type:text,notnull" json:"data" required:"true"`
-	OrgID valuer.UUID  `bun:"org_id,type:text,notnull" json:"orgId" required:"true"`
-}
-
-// RuleViewData holds the rule listing state (ListRulesParams minus pagination) a view replays.
-type RuleViewData struct {
-	Version string `json:"version" required:"true"`
-	ListFilter
-}
-
-func (d *RuleViewData) Validate() error {
-	if d.Version != RuleViewSchemaVersion {
-		return errors.NewInvalidInputf(ErrCodeRuleViewInvalidInput,
-			"version must be %q, got %q", RuleViewSchemaVersion, d.Version)
-	}
-	return d.ListFilter.Validate()
-}
-
-type PostableRuleView struct {
-	Name string       `json:"name" required:"true"`
-	Data RuleViewData `json:"data" required:"true"`
-}
-
-func (p *PostableRuleView) UnmarshalJSON(data []byte) error {
-	dec := json.NewDecoder(bytes.NewReader(data))
-	dec.DisallowUnknownFields()
-	type alias PostableRuleView
-	var tmp alias
-	if err := dec.Decode(&tmp); err != nil {
-		return errors.WrapInvalidInputf(err, ErrCodeRuleViewInvalidInput, "invalid saved view request body").WithAdditional(err.Error())
-	}
-	*p = PostableRuleView(tmp)
-	return p.Validate()
-}
-
-func (p *PostableRuleView) Validate() error {
-	if err := validateRuleViewName(p.Name); err != nil {
-		return err
-	}
-	return p.Data.Validate()
-}
-
-func (p PostableRuleView) NewRuleView(orgID valuer.UUID) *RuleView {
-	now := time.Now()
-	return &RuleView{
-		Identifiable:  types.Identifiable{ID: valuer.GenerateUUID()},
-		TimeAuditable: types.TimeAuditable{CreatedAt: now, UpdatedAt: now},
-		OrgID:         orgID,
-		Name:          p.Name,
-		Data:          p.Data,
-	}
-}
-
-type UpdatableRuleView = PostableRuleView
-
-func (v *RuleView) Update(updateable UpdatableRuleView) {
-	v.Name = updateable.Name
-	v.Data = updateable.Data
-	v.UpdatedAt = time.Now()
-}
-
-type ListableRuleViews struct {
-	Views []*RuleView `json:"views" required:"true" nullable:"false"`
-}
-
-func validateRuleViewName(name string) error {
-	if strings.TrimSpace(name) == "" {
-		return errors.NewInvalidInputf(ErrCodeRuleViewInvalidInput, "name is required")
-	}
-	if name != strings.TrimSpace(name) {
-		return errors.NewInvalidInputf(ErrCodeRuleViewInvalidInput, "name must not have leading or trailing whitespace")
-	}
-	if n := utf8.RuneCountInString(name); n > MaxRuleViewNameLen {
-		return errors.NewInvalidInputf(ErrCodeRuleViewInvalidInput,
-			"name must be at most %d characters, got %d", MaxRuleViewNameLen, n)
-	}
-	return nil
-}

pkg/types/ruletypes/rule_view_test.go

@@ -1,184 +0,0 @@
-package ruletypes
-
-import (
-	"encoding/json"
-	"strings"
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestRuleViewDataValidate(t *testing.T) {
-	cases := []struct {
-		description string
-		data        RuleViewData
-		expectError bool
-	}{
-		{
-			description: "valid with all fields set",
-			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Query: "name CONTAINS 'prod'", States: []string{"firing", "pending"}, Sort: ListSortName, Order: ListOrderAsc}},
-			expectError: false,
-		},
-		{
-			description: "valid with zero states, sort and order",
-			data:        RuleViewData{Version: RuleViewSchemaVersion},
-			expectError: false,
-		},
-		{
-			description: "query over the cap is rejected",
-			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Query: strings.Repeat("x", MaxListQueryLen+1)}},
-			expectError: true,
-		},
-		{
-			description: "wrong version is rejected",
-			data:        RuleViewData{Version: "v2"},
-			expectError: true,
-		},
-		{
-			description: "empty version is rejected",
-			data:        RuleViewData{},
-			expectError: true,
-		},
-		{
-			description: "unknown state is rejected",
-			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{States: []string{"exploding"}}},
-			expectError: true,
-		},
-		{
-			description: "unknown sort is rejected",
-			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Sort: ListSort{valuer.NewString("bogus")}}},
-			expectError: true,
-		},
-		{
-			description: "unknown order is rejected",
-			data:        RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Order: ListOrder{valuer.NewString("sideways")}}},
-			expectError: true,
-		},
-	}
-
-	for _, c := range cases {
-		t.Run(c.description, func(t *testing.T) {
-			err := c.data.Validate()
-			if c.expectError {
-				assert.Error(t, err)
-			} else {
-				assert.NoError(t, err)
-			}
-		})
-	}
-}
-
-func TestRuleViewDataValidateDefaults(t *testing.T) {
-	data := RuleViewData{Version: RuleViewSchemaVersion}
-	require.NoError(t, data.Validate())
-	assert.Equal(t, ListSortUpdatedAt, data.Sort)
-	assert.Equal(t, ListOrderDesc, data.Order)
-	assert.Equal(t, []string{}, data.States)
-}
-
-func TestPostableRuleViewUnmarshalJSON(t *testing.T) {
-	cases := []struct {
-		description    string
-		body           string
-		expectError    bool
-		expectedErrMsg string
-		expectedName   string
-	}{
-		{
-			description:  "valid body keeps name as-is",
-			body:         `{"name":"my view","data":{"version":"v1","query":"severity = 'critical'","states":["firing"],"sort":"name","order":"asc"}}`,
-			expectError:  false,
-			expectedName: "my view",
-		},
-		{
-			description:    "name with surrounding whitespace is rejected",
-			body:           `{"name":"  my view  ","data":{"version":"v1"}}`,
-			expectError:    true,
-			expectedErrMsg: "name must not have leading or trailing whitespace",
-		},
-		{
-			description: "unknown field is rejected",
-			body:        `{"name":"my view","data":{"version":"v1"},"extra":true}`,
-			expectError: true,
-		},
-		{
-			description:    "blank name is rejected",
-			body:           `{"name":"   ","data":{"version":"v1"}}`,
-			expectError:    true,
-			expectedErrMsg: "name is required",
-		},
-		{
-			description:    "name over max length is rejected",
-			body:           `{"name":"` + strings.Repeat("x", MaxRuleViewNameLen+1) + `","data":{"version":"v1"}}`,
-			expectError:    true,
-			expectedErrMsg: "name must be at most",
-		},
-		{
-			description: "invalid data version is rejected",
-			body:        `{"name":"my view","data":{"version":"v9"}}`,
-			expectError: true,
-		},
-		{
-			description:    "invalid state is rejected",
-			body:           `{"name":"my view","data":{"version":"v1","states":["exploding"]}}`,
-			expectError:    true,
-			expectedErrMsg: "invalid state",
-		},
-	}
-
-	for _, c := range cases {
-		t.Run(c.description, func(t *testing.T) {
-			var p PostableRuleView
-			err := json.Unmarshal([]byte(c.body), &p)
-			if c.expectError {
-				assert.Error(t, err)
-				if c.expectedErrMsg != "" {
-					assert.ErrorContains(t, err, c.expectedErrMsg)
-				}
-				return
-			}
-			require.NoError(t, err)
-			assert.Equal(t, c.expectedName, p.Name)
-		})
-	}
-}
-
-func TestPostableRuleViewNewRuleView(t *testing.T) {
-	orgID := valuer.GenerateUUID()
-	postable := PostableRuleView{
-		Name: "my view",
-		Data: RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{States: []string{"firing"}, Sort: ListSortName, Order: ListOrderAsc}},
-	}
-
-	view := postable.NewRuleView(orgID)
-
-	assert.Equal(t, orgID, view.OrgID)
-	assert.Equal(t, "my view", view.Name)
-	assert.Equal(t, postable.Data, view.Data)
-	assert.False(t, view.ID.IsZero())
-	assert.False(t, view.CreatedAt.IsZero())
-	assert.Equal(t, view.CreatedAt, view.UpdatedAt)
-}
-
-func TestRuleViewUpdate(t *testing.T) {
-	orgID := valuer.GenerateUUID()
-	view := PostableRuleView{
-		Name: "original",
-		Data: RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{Sort: ListSortName, Order: ListOrderAsc}},
-	}.NewRuleView(orgID)
-	createdAt := view.CreatedAt
-
-	view.Update(UpdatableRuleView{
-		Name: "renamed",
-		Data: RuleViewData{Version: RuleViewSchemaVersion, ListFilter: ListFilter{States: []string{"disabled"}, Sort: ListSortCreatedAt, Order: ListOrderDesc}},
-	})
-
-	assert.Equal(t, "renamed", view.Name)
-	assert.Equal(t, []string{"disabled"}, view.Data.States)
-	assert.Equal(t, ListSortCreatedAt, view.Data.Sort)
-	assert.Equal(t, ListOrderDesc, view.Data.Order)
-	assert.Equal(t, createdAt, view.CreatedAt)
-	assert.True(t, view.UpdatedAt.After(createdAt))
-}

tests/fixtures/alerts.py

@@ -19,7 +19,6 @@ from fixtures.logger import setup_logger
 from fixtures.logs import Logs
 from fixtures.maildev import get_all_mails, verify_email_received
 from fixtures.metrics import Metrics
-from fixtures.notification_channel import ensure_notification_channel
 from fixtures.traces import Traces
 
 logger = setup_logger(__name__)
@@ -89,70 +88,6 @@ def create_alert_rule_with_channel(
     return _create_alert_rule_with_channel
 
 
-def delete_all_rules(signoz: types.SigNoz, token: str) -> None:
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/rules"),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    for rule in response.json()["data"]:
-        delete_response = requests.delete(
-            signoz.self.host_configs["8080"].get(f"/api/v1/rules/{rule['id']}"),
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        )
-        assert delete_response.status_code == HTTPStatus.OK, f"failed to delete rule {rule['id']}: {delete_response.text}"
-
-
-@pytest.fixture(name="seed_alert_rules", scope="function")
-def seed_alert_rules(
-    signoz: types.SigNoz,
-    get_token: Callable[[str, str], str],
-    create_alert_rule: Callable[[dict], str],
-) -> Callable[[dict, list[dict]], None]:
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # Cleanup is owned by create_alert_rule, which deletes the rules it created.
-    def _seed_alert_rules(channel_config: dict, rules: list[dict]) -> None:
-        delete_all_rules(signoz, admin_token)
-        ensure_notification_channel(signoz, admin_token, channel_config)
-        for rule in rules:
-            create_alert_rule(rule)
-
-    return _seed_alert_rules
-
-
-@pytest.fixture(name="create_rule_view", scope="function")
-def create_rule_view(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> Callable[[dict], dict]:
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    view_ids = []
-
-    def _create_rule_view(view: dict) -> dict:
-        response = requests.post(
-            signoz.self.host_configs["8080"].get("/api/v2/rule_views"),
-            json=view,
-            headers={"Authorization": f"Bearer {admin_token}"},
-            timeout=5,
-        )
-        assert response.status_code == HTTPStatus.CREATED, f"Failed to create rule view, api returned {response.status_code} with response: {response.text}"
-        created = response.json()["data"]
-        view_ids.append(created["id"])
-        return created
-
-    yield _create_rule_view
-    # A view the test already deleted returns 404; only real failures are logged.
-    for view_id in view_ids:
-        response = requests.delete(
-            signoz.self.host_configs["8080"].get(f"/api/v2/rule_views/{view_id}"),
-            headers={"Authorization": f"Bearer {admin_token}"},
-            timeout=5,
-        )
-        if response.status_code not in (HTTPStatus.NO_CONTENT, HTTPStatus.NOT_FOUND):
-            logger.error("Error deleting rule view: %s", {"view_id": view_id, "response": response.text})
-
-
 def labels_to_map(labels: list[dict]) -> dict[str, str]:
     """Converts the label list shape of the v2 rule history APIs to a plain map."""
     return {label["key"]["name"]: label["value"] for label in labels or []}

tests/fixtures/notification_channel.py

@@ -35,26 +35,6 @@ EMAIL_TRANSPORT_KEYS = [
 ]
 
 
-def ensure_notification_channel(signoz: types.SigNoz, token: str, channel_config: dict) -> None:
-    # Deliberately no teardown: the stock channel fixture's teardown is broken, so channels are reused idempotently.
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/channels"),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    if channel_config["name"] in [channel["name"] for channel in response.json()["data"] or []]:
-        return
-
-    create_response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/channels"),
-        json=channel_config,
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert create_response.status_code == HTTPStatus.CREATED, f"failed to create channel: {create_response.text}"
-
-
 def assert_email_channel_payload_clean(payload: str) -> None:
     receiver = json.loads(payload)
     for email_config in receiver["email_configs"]:

tests/integration/tests/alerts/06_list_rules_v3.py

@@ -1,542 +0,0 @@
-from collections.abc import Callable
-from http import HTTPStatus
-
-import requests
-
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.types import Operation, SigNoz
-
-BASE_URL = "/api/v3/rules"
-
-SEED_CHANNEL = {"name": "list-rules-v3-channel", "email_configs": [{"to": "list-rules-v3@integration.test"}]}
-
-EVALUATION = {"kind": "rolling", "spec": {"evalWindow": "5m0s", "frequency": "1m"}}
-
-NOTIFICATION_SETTINGS = {
-    "groupBy": [],
-    "usePolicy": False,
-    "renotify": {"enabled": False, "interval": "30m", "alertStates": []},
-}
-
-METRIC_CONDITION = {
-    "thresholds": {
-        "kind": "basic",
-        "spec": [{"name": "critical", "target": 90, "matchType": "at_least_once", "op": "above", "channels": ["list-rules-v3-channel"]}],
-    },
-    "compositeQuery": {
-        "queryType": "builder",
-        "panelType": "graph",
-        "queries": [
-            {
-                "type": "builder_query",
-                "spec": {
-                    "name": "A",
-                    "signal": "metrics",
-                    "aggregations": [{"metricName": "list_rules_v3_cpu", "timeAggregation": "avg", "spaceAggregation": "max"}],
-                },
-            }
-        ],
-    },
-    "selectedQueryName": "A",
-}
-
-LOGS_CONDITION = {
-    "thresholds": {
-        "kind": "basic",
-        "spec": [{"name": "critical", "target": 100, "matchType": "at_least_once", "op": "above", "channels": ["list-rules-v3-channel"]}],
-    },
-    "compositeQuery": {
-        "queryType": "builder",
-        "panelType": "graph",
-        "queries": [
-            {
-                "type": "builder_query",
-                "spec": {
-                    "name": "A",
-                    "signal": "logs",
-                    "aggregations": [{"expression": "count()"}],
-                    "filter": {"expression": ""},
-                },
-            }
-        ],
-    },
-    "selectedQueryName": "A",
-}
-
-PROMQL_CONDITION = {
-    "thresholds": {
-        "kind": "basic",
-        "spec": [{"name": "critical", "target": 1, "matchType": "at_least_once", "op": "below", "channels": ["list-rules-v3-channel"]}],
-    },
-    "compositeQuery": {
-        "queryType": "promql",
-        "panelType": "graph",
-        "queries": [{"type": "promql", "spec": {"name": "A", "query": '{"list_rules_v3_up"}'}}],
-    },
-    "selectedQueryName": "A",
-}
-
-SEED_RULES = [
-    {
-        "alert": "payment latency high",
-        "description": "p99 latency guard",
-        "alertType": "METRIC_BASED_ALERT",
-        "ruleType": "threshold_rule",
-        "condition": METRIC_CONDITION,
-        "labels": {"severity": "critical", "team": "payments", "k8s.cluster": "prod-1"},
-        "annotations": {"summary": "s", "description": "d"},
-        "evaluation": EVALUATION,
-        "notificationSettings": NOTIFICATION_SETTINGS,
-        "version": "v5",
-        "schemaVersion": "v2alpha1",
-    },
-    {
-        "alert": "payment gateway errors",
-        "description": "error rate watch",
-        "alertType": "LOGS_BASED_ALERT",
-        "ruleType": "threshold_rule",
-        "condition": LOGS_CONDITION,
-        "labels": {"severity": "warning", "team": "payments"},
-        "annotations": {"summary": "s", "description": "d"},
-        "evaluation": EVALUATION,
-        "notificationSettings": NOTIFICATION_SETTINGS,
-        "version": "v5",
-        "schemaVersion": "v2alpha1",
-    },
-    {
-        "alert": "checkout conversion drop",
-        "description": "funnel watcher",
-        "alertType": "METRIC_BASED_ALERT",
-        "ruleType": "threshold_rule",
-        "condition": METRIC_CONDITION,
-        "labels": {"severity": "important", "team": "checkout"},
-        "annotations": {"summary": "s", "description": "d"},
-        "disabled": True,
-        "evaluation": EVALUATION,
-        "notificationSettings": NOTIFICATION_SETTINGS,
-        "version": "v5",
-        "schemaVersion": "v2alpha1",
-    },
-    {
-        "alert": "infra cpu saturation",
-        "description": "node headroom",
-        "alertType": "METRIC_BASED_ALERT",
-        "ruleType": "threshold_rule",
-        "condition": METRIC_CONDITION,
-        "labels": {"team": "infra"},
-        "annotations": {"summary": "s", "description": "d"},
-        "evaluation": EVALUATION,
-        "notificationSettings": NOTIFICATION_SETTINGS,
-        "version": "v5",
-        "schemaVersion": "v2alpha1",
-    },
-    {
-        "alert": "prom uptime probe",
-        "description": "blackbox liveness",
-        "alertType": "METRIC_BASED_ALERT",
-        "ruleType": "promql_rule",
-        "condition": PROMQL_CONDITION,
-        "labels": {},
-        "annotations": {"summary": "s", "description": "d"},
-        "evaluation": EVALUATION,
-        "notificationSettings": NOTIFICATION_SETTINGS,
-        "version": "v5",
-        "schemaVersion": "v2alpha1",
-    },
-]
-
-RESERVED_KEYWORDS = [
-    "alert_type",
-    "created_at",
-    "created_by",
-    "labels.<key>",
-    "name",
-    "rule_type",
-    "severity",
-    "updated_at",
-    "updated_by",
-]
-
-
-def test_envelope_and_slim_rows(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()["data"]
-
-    assert data["total"] == 5
-    assert len(data["rules"]) == 5
-    assert data["reservedKeywords"] == RESERVED_KEYWORDS
-
-    label_pairs = [(pair["key"], pair["value"]) for pair in data["labels"]]
-    assert label_pairs == sorted(label_pairs), "label pairs must be sorted by key then value"
-    for expected_pair in [
-        ("k8s.cluster", "prod-1"),
-        ("severity", "critical"),
-        ("severity", "important"),
-        ("severity", "warning"),
-        ("team", "checkout"),
-        ("team", "infra"),
-        ("team", "payments"),
-    ]:
-        assert expected_pair in label_pairs, f"missing label pair {expected_pair}"
-
-    by_name = {rule["alert"]: rule for rule in data["rules"]}
-    assert set(by_name) == {r["alert"] for r in SEED_RULES}
-
-    for rule in data["rules"]:
-        for forbidden_field in ("condition", "annotations", "notificationSettings", "evaluation", "source", "version", "schemaVersion"):
-            assert forbidden_field not in rule, f"slim row leaked {forbidden_field}"
-        for required_field in ("id", "state", "alert", "alertType", "ruleType", "createdAt", "updatedAt"):
-            assert required_field in rule, f"slim row missing {required_field}"
-        assert rule["createdBy"] == USER_ADMIN_EMAIL
-        assert rule["updatedBy"] == USER_ADMIN_EMAIL
-
-    assert by_name["checkout conversion drop"]["state"] == "disabled"
-    assert by_name["checkout conversion drop"]["disabled"] is True
-    assert by_name["payment latency high"]["state"] == "inactive"
-    assert by_name["payment latency high"]["description"] == "p99 latency guard"
-    assert by_name["payment latency high"]["labels"] == {"severity": "critical", "team": "payments", "k8s.cluster": "prod-1"}
-    assert by_name["payment gateway errors"]["alertType"] == "LOGS_BASED_ALERT"
-    assert by_name["prom uptime probe"]["ruleType"] == "promql_rule"
-
-
-def test_query_filters(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
-
-    cases = [
-        ("name = 'payment latency high'", {"payment latency high"}),
-        ("name CONTAINS 'payment'", {"payment latency high", "payment gateway errors"}),
-        # free text goes through LOWER() on both dialects, so a case mismatch must still match
-        ("PAYMENT", {"payment latency high", "payment gateway errors"}),
-        # free text also matches the description field
-        ("blackbox", {"prom uptime probe"}),
-        (f"created_by = '{USER_ADMIN_EMAIL}'", {r["alert"] for r in SEED_RULES}),
-        ("created_at >= '2020-01-01T00:00:00Z'", {r["alert"] for r in SEED_RULES}),
-        ("created_at < '2020-01-01T00:00:00Z'", set()),
-        ("alert_type = 'LOGS_BASED_ALERT'", {"payment gateway errors"}),
-        ("rule_type = 'promql_rule'", {"prom uptime probe"}),
-        ("rule_type IN ['threshold_rule']", {"payment latency high", "payment gateway errors", "checkout conversion drop", "infra cpu saturation"}),
-        ("labels.team = 'payments'", {"payment latency high", "payment gateway errors"}),
-        ("labels.k8s.cluster = 'prod-1'", {"payment latency high"}),
-        ("labels.team EXISTS", {"payment latency high", "payment gateway errors", "checkout conversion drop", "infra cpu saturation"}),
-        ("labels.team NOT EXISTS", {"prom uptime probe"}),
-        ("NOT (labels.team EXISTS)", {"prom uptime probe"}),
-        (
-            "(labels.team = 'payments' OR labels.team = 'infra') AND name NOT CONTAINS 'gateway'",
-            {"payment latency high", "infra cpu saturation"},
-        ),
-    ]
-
-    for query, expected_names in cases:
-        response = requests.get(
-            signoz.self.host_configs["8080"].get(BASE_URL),
-            params={"query": query},
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        )
-        assert response.status_code == HTTPStatus.OK, f"query {query!r}: {response.text}"
-        data = response.json()["data"]
-        assert {rule["alert"] for rule in data["rules"]} == expected_names, f"query {query!r}"
-        assert data["total"] == len(expected_names), f"query {query!r}: total mismatch"
-
-
-def test_label_missing_semantics(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
-
-    # A missing label uniformly evaluates as the empty string for value
-    # operators; presence is expressed with EXISTS / NOT EXISTS.
-    cases = [
-        ("severity = ''", {"infra cpu saturation", "prom uptime probe"}),
-        ("severity != ''", {"payment latency high", "payment gateway errors", "checkout conversion drop"}),
-        ("severity != 'critical'", {"payment gateway errors", "checkout conversion drop", "infra cpu saturation", "prom uptime probe"}),
-        ("severity EXISTS", {"payment latency high", "payment gateway errors", "checkout conversion drop"}),
-        ("severity NOT EXISTS", {"infra cpu saturation", "prom uptime probe"}),
-        ("severity = 'critical'", {"payment latency high"}),
-        ("severity IN ['critical', 'warning']", {"payment latency high", "payment gateway errors"}),
-        ("labels.team != 'payments'", {"checkout conversion drop", "infra cpu saturation", "prom uptime probe"}),
-        ("labels.team NOT IN ['payments']", {"checkout conversion drop", "infra cpu saturation", "prom uptime probe"}),
-        ("labels.team NOT CONTAINS 'pay'", {"checkout conversion drop", "infra cpu saturation", "prom uptime probe"}),
-    ]
-
-    for query, expected_names in cases:
-        response = requests.get(
-            signoz.self.host_configs["8080"].get(BASE_URL),
-            params={"query": query},
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        )
-        assert response.status_code == HTTPStatus.OK, f"query {query!r}: {response.text}"
-        data = response.json()["data"]
-        assert {rule["alert"] for rule in data["rules"]} == expected_names, f"query {query!r}"
-        assert data["total"] == len(expected_names), f"query {query!r}: total mismatch"
-
-
-def test_states_param(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
-
-    # No telemetry is seeded, so enabled rules sit at inactive and the one
-    # disabled rule reads disabled, deterministic without waiting on evals.
-    cases = [
-        ({"states": ["disabled"]}, {"checkout conversion drop"}),
-        ({"states": ["inactive"]}, {"payment latency high", "payment gateway errors", "infra cpu saturation", "prom uptime probe"}),
-        ({"states": ["inactive", "disabled"]}, {r["alert"] for r in SEED_RULES}),
-        ({"states": ["firing"]}, set()),
-        ({"states": ["disabled"], "query": "labels.team = 'checkout'"}, {"checkout conversion drop"}),
-        ({"states": ["disabled"], "query": "labels.team = 'payments'"}, set()),
-    ]
-
-    for params, expected_names in cases:
-        response = requests.get(
-            signoz.self.host_configs["8080"].get(BASE_URL),
-            params=params,
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        )
-        assert response.status_code == HTTPStatus.OK, f"params {params!r}: {response.text}"
-        data = response.json()["data"]
-        assert {rule["alert"] for rule in data["rules"]} == expected_names, f"params {params!r}"
-        assert data["total"] == len(expected_names), f"params {params!r}: total mismatch"
-
-
-def test_sorting(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        params={"sort": "name", "order": "asc"},
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    assert [rule["alert"] for rule in response.json()["data"]["rules"]] == [
-        "checkout conversion drop",
-        "infra cpu saturation",
-        "payment gateway errors",
-        "payment latency high",
-        "prom uptime probe",
-    ]
-
-    # state display priority: inactive (rank 1) outranks disabled (rank 0);
-    # the four inactive rules tie on state and must break on name asc
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        params={"sort": "state", "order": "desc"},
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    assert [rule["alert"] for rule in response.json()["data"]["rules"]] == [
-        "infra cpu saturation",
-        "payment gateway errors",
-        "payment latency high",
-        "prom uptime probe",
-        "checkout conversion drop",
-    ]
-
-    # asc flips the state buckets but the name tiebreak stays ascending
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        params={"sort": "state", "order": "asc"},
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    assert [rule["alert"] for rule in response.json()["data"]["rules"]] == [
-        "checkout conversion drop",
-        "infra cpu saturation",
-        "payment gateway errors",
-        "payment latency high",
-        "prom uptime probe",
-    ]
-
-    # severity: known ranks first (critical > warning), then custom values
-    # lexically, then rules without severity tie and break on name asc
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        params={"sort": "severity", "order": "desc"},
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    assert [rule["alert"] for rule in response.json()["data"]["rules"]] == [
-        "payment latency high",
-        "payment gateway errors",
-        "checkout conversion drop",
-        "infra cpu saturation",
-        "prom uptime probe",
-    ]
-
-    for order in ("asc", "desc"):
-        response = requests.get(
-            signoz.self.host_configs["8080"].get(BASE_URL),
-            params={"sort": "created_at", "order": order},
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        )
-        assert response.status_code == HTTPStatus.OK
-        created_ats = [rule["createdAt"] for rule in response.json()["data"]["rules"]]
-        assert created_ats == sorted(created_ats, reverse=order == "desc"), f"created_at {order} not monotonic"
-
-
-def test_pagination(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
-
-    pages = []
-    for offset in (0, 2, 4):
-        response = requests.get(
-            signoz.self.host_configs["8080"].get(BASE_URL),
-            params={"sort": "name", "order": "asc", "limit": 2, "offset": offset},
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        )
-        assert response.status_code == HTTPStatus.OK
-        data = response.json()["data"]
-        assert data["total"] == 5, f"offset {offset}: total must stay the full filtered count"
-        pages.append([rule["alert"] for rule in data["rules"]])
-
-    assert [len(page) for page in pages] == [2, 2, 1]
-    flattened = [name for page in pages for name in page]
-    assert len(flattened) == len(set(flattened)), "pages must be disjoint"
-    assert set(flattened) == {r["alert"] for r in SEED_RULES}
-
-    # state sort is almost all ties (four inactive rules); the name/id tiebreak
-    # must keep the pages disjoint and in the same order on every request
-    tie_pages = []
-    for offset in (0, 2, 4):
-        response = requests.get(
-            signoz.self.host_configs["8080"].get(BASE_URL),
-            params={"sort": "state", "order": "desc", "limit": 2, "offset": offset},
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        )
-        assert response.status_code == HTTPStatus.OK
-        tie_pages.append([rule["alert"] for rule in response.json()["data"]["rules"]])
-
-    assert [name for page in tie_pages for name in page] == [
-        "infra cpu saturation",
-        "payment gateway errors",
-        "payment latency high",
-        "prom uptime probe",
-        "checkout conversion drop",
-    ], "tied rows must not shuffle between page requests"
-
-    # a past-the-end offset returns an empty page but keeps the real total
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        params={"limit": 2, "offset": 50},
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()["data"]
-    assert data["rules"] == []
-    assert data["total"] == 5
-
-    # an over-max limit is clamped, not rejected
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        params={"limit": 6000},
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["data"]["total"] == 5
-
-
-def test_error_contract(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    cases = [
-        ({"query": "created_by ==== ((("}, "rule_list_filter_invalid", "invalid filter query:"),
-        ({"query": "team = 'infra'"}, "rule_list_filter_invalid", 'unknown filter key "team"'),
-        ({"query": "state = 'firing'"}, "rule_list_filter_invalid", 'unknown filter key "state"'),
-        ({"query": "alert_type = 'bogus'"}, "rule_list_filter_invalid", "METRIC_BASED_ALERT"),
-        ({"query": "name REGEXP 'x.*'"}, "rule_list_filter_invalid", "operator REGEXP is not allowed"),
-        ({"query": "created_at >= 'yesterday'"}, "rule_list_filter_invalid", "invalid RFC3339 timestamp"),
-        ({"query": "name LIKE 'prod\\\\'"}, "rule_list_filter_invalid", "must not end with an unescaped backslash"),
-        ({"states": ["bogus"]}, "rule_list_invalid", 'invalid state "bogus"'),
-        ({"sort": "bogus"}, "rule_list_invalid", "invalid sort"),
-        ({"order": "bogus"}, "rule_list_invalid", "invalid order"),
-        ({"limit": -1}, "rule_list_invalid", "invalid limit"),
-        ({"offset": -1}, "rule_list_invalid", "invalid offset"),
-    ]
-
-    for params, expected_code, expected_message_part in cases:
-        response = requests.get(
-            signoz.self.host_configs["8080"].get(BASE_URL),
-            params=params,
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        )
-        assert response.status_code == HTTPStatus.BAD_REQUEST, f"params {params!r}: {response.text}"
-        error = response.json()["error"]
-        assert error["code"] == expected_code, f"params {params!r}"
-        assert expected_message_part in error["message"], f"params {params!r}: {error['message']}"
-
-
-def test_v2_list_still_serves_bare_array(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    seed_alert_rules: Callable[[dict, list[dict]], None],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    seed_alert_rules(SEED_CHANNEL, SEED_RULES)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/rules"),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()["data"]
-    assert isinstance(data, list), "deprecated v2 must keep returning a bare array"
-    assert {rule["alert"] for rule in data} == {r["alert"] for r in SEED_RULES}

tests/integration/tests/alerts/07_rule_views.py

@@ -1,269 +0,0 @@
-import uuid
-from collections.abc import Callable
-from http import HTTPStatus
-
-import pytest
-import requests
-
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.types import Operation, SigNoz
-
-BASE_URL = "/api/v2/rule_views"
-
-
-@pytest.mark.parametrize(
-    ("body", "expected_code", "expected_message"),
-    [
-        ({"data": {"version": "v1"}}, "rule_view_invalid_input", "name is required"),
-        ({"name": "   ", "data": {"version": "v1"}}, "rule_view_invalid_input", "name is required"),
-        (
-            {"name": "  Storage  ", "data": {"version": "v1"}},
-            "rule_view_invalid_input",
-            "name must not have leading or trailing whitespace",
-        ),
-        (
-            {"name": "x" * 65, "data": {"version": "v1"}},
-            "rule_view_invalid_input",
-            "name must be at most 64 characters, got 65",
-        ),
-        (
-            {"name": "wrong-version", "data": {"version": "v2"}},
-            "rule_view_invalid_input",
-            'version must be "v1", got "v2"',
-        ),
-        (
-            {"name": "missing-version", "data": {}},
-            "rule_view_invalid_input",
-            'version must be "v1", got ""',
-        ),
-        (
-            {"name": "bad-state", "data": {"version": "v1", "states": ["exploding"]}},
-            "rule_list_invalid",
-            'invalid state "exploding"',
-        ),
-        (
-            {"name": "bad-sort", "data": {"version": "v1", "sort": "bogus"}},
-            "rule_list_invalid",
-            "invalid sort",
-        ),
-        (
-            {"name": "bad-order", "data": {"version": "v1", "order": "bogus"}},
-            "rule_list_invalid",
-            "invalid order",
-        ),
-        (
-            {"name": "long-query", "data": {"version": "v1", "query": "x" * 1025}},
-            "rule_list_invalid",
-            "query cannot be longer than 1024 characters",
-        ),
-        (
-            {"name": "rejects-unknown", "data": {"version": "v1"}, "unknownfield": "boom"},
-            "rule_view_invalid_input",
-            "invalid saved view request body",
-        ),
-    ],
-    ids=[
-        "missing_name",
-        "blank_name",
-        "whitespace_name",
-        "name_too_long",
-        "wrong_schema_version",
-        "missing_version",
-        "invalid_state",
-        "invalid_sort",
-        "invalid_order",
-        "query_too_long",
-        "unknown_field",
-    ],
-)
-def test_create_rejects_invalid_body(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    body: dict,
-    expected_code: str,
-    expected_message: str,
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.post(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        json=body,
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-
-    assert response.status_code == HTTPStatus.BAD_REQUEST
-    assert response.json()["error"]["code"] == expected_code
-    assert expected_message in response.json()["error"]["message"]
-
-
-def test_update_rejects_malformed_id(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"{BASE_URL}/not-a-uuid"),
-        json={"name": "x", "data": {"version": "v1"}},
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-
-    assert response.status_code == HTTPStatus.BAD_REQUEST
-
-
-def test_update_missing_view_returns_not_found(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{uuid.uuid4()}"),
-        json={"name": "x", "data": {"version": "v1"}},
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-
-    assert response.status_code == HTTPStatus.NOT_FOUND
-    assert response.json()["error"]["code"] == "rule_view_not_found"
-
-
-def test_delete_rejects_malformed_id(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"{BASE_URL}/not-a-uuid"),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-
-    assert response.status_code == HTTPStatus.BAD_REQUEST
-
-
-def test_delete_missing_view_returns_not_found(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{uuid.uuid4()}"),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-
-    assert response.status_code == HTTPStatus.NOT_FOUND
-    assert response.json()["error"]["code"] == "rule_view_not_found"
-
-
-def test_rule_view_lifecycle(
-    signoz: SigNoz,
-    create_user_admin: Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    create_rule_view: Callable[[dict], dict],
-):
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # List assertions filter on this test's names so foreign views never interfere.
-    owned_names = {"Critical Prod", "Critical Staging", "Disabled"}
-
-    created = create_rule_view(
-        {
-            "name": "Critical Prod",
-            "data": {
-                "version": "v1",
-                "query": "name CONTAINS 'prod' AND severity = 'critical'",
-                "states": ["firing", "pending"],
-                "sort": "name",
-                "order": "asc",
-            },
-        }
-    )
-    view_id = created["id"]
-    assert created["name"] == "Critical Prod"
-    assert created["data"]["version"] == "v1"
-    assert created["data"]["query"] == "name CONTAINS 'prod' AND severity = 'critical'"
-    assert created["data"]["states"] == ["firing", "pending"]
-
-    # Omitted states, sort and order are normalized on save: [] and the list defaults, never null.
-    disabled = create_rule_view({"name": "Disabled", "data": {"version": "v1"}})
-    assert disabled["name"] == "Disabled"
-    assert disabled["data"]["states"] == []
-    assert disabled["data"]["sort"] == "updated_at"
-    assert disabled["data"]["order"] == "desc"
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    views = [v for v in response.json()["data"]["views"] if v["name"] in owned_names]
-    assert {v["name"] for v in views} == {"Critical Prod", "Disabled"}
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
-        json={
-            "name": "Critical Staging",
-            "data": {
-                "version": "v1",
-                "query": "name CONTAINS 'staging'",
-                "states": ["firing"],
-                "sort": "created_at",
-                "order": "desc",
-            },
-        },
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    updated = response.json()["data"]
-    assert updated["id"] == view_id
-    assert updated["name"] == "Critical Staging"
-    assert updated["data"]["query"] == "name CONTAINS 'staging'"
-    assert updated["data"]["states"] == ["firing"]
-    assert updated["data"]["sort"] == "created_at"
-    assert updated["data"]["order"] == "desc"
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    listed = {v["name"]: v for v in response.json()["data"]["views"] if v["name"] in owned_names}
-    assert set(listed) == {"Critical Staging", "Disabled"}
-    assert listed["Critical Staging"]["data"]["query"] == "name CONTAINS 'staging'"
-
-    assert (
-        requests.delete(
-            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        ).status_code
-        == HTTPStatus.NO_CONTENT
-    )
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(BASE_URL),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=5,
-    )
-    assert {v["name"] for v in response.json()["data"]["views"] if v["name"] in owned_names} == {"Disabled"}
-
-    assert (
-        requests.delete(
-            signoz.self.host_configs["8080"].get(f"{BASE_URL}/{view_id}"),
-            headers={"Authorization": f"Bearer {token}"},
-            timeout=5,
-        ).status_code
-        == HTTPStatus.NOT_FOUND
-    )