refactor(monaco): render every editor through one shared theme

docs/api/openapi.yml

@@ -11389,7 +11389,8 @@ components:
         evaluation:
           allOf:
           - $ref: '#/components/schemas/RuletypesEvaluationEnvelope'
-          description: The evaluation window, as a kind and spec.
+          description: The evaluation window, as a kind and spec. Required when schemaVersion
+            is v2alpha1; derived from evalWindow and frequency for v1.
         frequency:
           description: How often the rule is evaluated, as a Go duration such as 1m.
             Only read when schemaVersion is v1, defaulting to 1m; v2alpha1 rules set
@@ -11405,7 +11406,8 @@ components:
         notificationSettings:
           allOf:
           - $ref: '#/components/schemas/RuletypesNotificationSettings'
-          description: Grouping, re-notification and routing behaviour.
+          description: Grouping, re-notification and routing behaviour. Required when
+            schemaVersion is v2alpha1; derived from the v1 fields otherwise.
         preferredChannels:
           description: The displayName of each notification channel to notify, for
             schemaVersion v1 rules. Ignored for v2alpha1, where each threshold carries
@@ -11418,30 +11420,26 @@ components:
           - $ref: '#/components/schemas/RuletypesRuleType'
           description: 'The evaluation strategy: threshold_rule compares against thresholds,
             promql_rule evaluates a PromQL expression, anomaly_rule scores deviation
-            from seasonal history. Defaults to threshold_rule for builder and clickhouse_sql
-            queries and is forced to promql_rule for promql queries.'
+            from seasonal history. Defaults to threshold_rule for builder queries
+            and is forced to promql_rule for promql queries.'
         schemaVersion:
-          description: The rule payload schema.
-          enum:
-          - v2alpha1
+          description: 'The rule payload schema: v1 (the default when omitted) uses
+            the flat condition fields, v2alpha1 uses condition.thresholds, evaluation
+            and notificationSettings.'
           type: string
         source:
-          deprecated: true
           description: The URL of the page the rule was created from. Informational;
             it is not used for evaluation.
           type: string
         version:
-          deprecated: true
-          description: The query payload version. Nothing reads it.
+          description: The query payload version. Only v5 is accepted and it is filled
+            in when omitted.
           type: string
       required:
       - alert
       - alertType
       - ruleType
       - condition
-      - evaluation
-      - schemaVersion
-      - notificationSettings
       type: object
     RuletypesPostableRuleView:
       properties:
@@ -11530,7 +11528,8 @@ components:
         evaluation:
           allOf:
           - $ref: '#/components/schemas/RuletypesEvaluationEnvelope'
-          description: The evaluation window, as a kind and spec.
+          description: The evaluation window, as a kind and spec. Required when schemaVersion
+            is v2alpha1; derived from evalWindow and frequency for v1.
         frequency:
           description: How often the rule is evaluated, as a Go duration such as 1m.
             Only read when schemaVersion is v1, defaulting to 1m; v2alpha1 rules set
@@ -11549,7 +11548,8 @@ components:
         notificationSettings:
           allOf:
           - $ref: '#/components/schemas/RuletypesNotificationSettings'
-          description: Grouping, re-notification and routing behaviour.
+          description: Grouping, re-notification and routing behaviour. Required when
+            schemaVersion is v2alpha1; derived from the v1 fields otherwise.
         preferredChannels:
           description: The displayName of each notification channel to notify, for
             schemaVersion v1 rules. Ignored for v2alpha1, where each threshold carries
@@ -11562,15 +11562,14 @@ components:
           - $ref: '#/components/schemas/RuletypesRuleType'
           description: 'The evaluation strategy: threshold_rule compares against thresholds,
             promql_rule evaluates a PromQL expression, anomaly_rule scores deviation
-            from seasonal history. Defaults to threshold_rule for builder and clickhouse_sql
-            queries and is forced to promql_rule for promql queries.'
+            from seasonal history. Defaults to threshold_rule for builder queries
+            and is forced to promql_rule for promql queries.'
         schemaVersion:
-          description: The rule payload schema.
-          enum:
-          - v2alpha1
+          description: 'The rule payload schema: v1 (the default when omitted) uses
+            the flat condition fields, v2alpha1 uses condition.thresholds, evaluation
+            and notificationSettings.'
           type: string
         source:
-          deprecated: true
           description: The URL of the page the rule was created from. Informational;
             it is not used for evaluation.
           type: string
@@ -11585,8 +11584,8 @@ components:
         updatedBy:
           type: string
         version:
-          deprecated: true
-          description: The query payload version. Nothing reads it.
+          description: The query payload version. Only v5 is accepted and it is filled
+            in when omitted.
           type: string
       required:
       - id
@@ -11595,9 +11594,6 @@ components:
       - alertType
       - ruleType
       - condition
-      - evaluation
-      - schemaVersion
-      - notificationSettings
       type: object
     RuletypesRuleCondition:
       properties:
@@ -11647,7 +11643,8 @@ components:
             against, hourly, daily or weekly.'
         selectedQueryName:
           description: The name of the query whose result is evaluated, such as A
-            or F1. Must match a query in compositeQuery.
+            or F1. Must match a query in compositeQuery. When omitted, F1 is used
+            if present, otherwise the enabled query with the highest name.
           type: string
         target:
           description: 'schemaVersion v1 only: the value compared against, in targetUnit.
@@ -11663,11 +11660,10 @@ components:
         thresholds:
           allOf:
           - $ref: '#/components/schemas/RuletypesRuleThresholdData'
-          description: The thresholds to evaluate, as a kind and spec.
+          description: The thresholds to evaluate, as a kind and spec. Required when
+            schemaVersion is v2alpha1; derived from op, target and matchType for v1.
       required:
       - compositeQuery
-      - selectedQueryName
-      - thresholds
       type: object
     RuletypesRuleThresholdData:
       discriminator:
@@ -15064,9 +15060,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - planned-maintenance:list
+        - VIEWER
       - tokenizer:
-        - planned-maintenance:list
+        - VIEWER
       summary: List downtime schedules
       tags:
       - downtimeschedules
@@ -15121,13 +15117,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - planned-maintenance:create
-        - planned-maintenance:attach
-        - rule:attach
+        - EDITOR
       - tokenizer:
-        - planned-maintenance:create
-        - planned-maintenance:attach
-        - rule:attach
+        - EDITOR
       summary: Create downtime schedule
       tags:
       - downtimeschedules
@@ -15172,9 +15164,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - planned-maintenance:delete
+        - EDITOR
       - tokenizer:
-        - planned-maintenance:delete
+        - EDITOR
       summary: Delete downtime schedule
       tags:
       - downtimeschedules
@@ -15230,9 +15222,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - planned-maintenance:read
+        - VIEWER
       - tokenizer:
-        - planned-maintenance:read
+        - VIEWER
       summary: Get downtime schedule by ID
       tags:
       - downtimeschedules
@@ -15287,17 +15279,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - planned-maintenance:update
-        - planned-maintenance:attach
-        - planned-maintenance:detach
-        - rule:attach
-        - rule:detach
+        - EDITOR
       - tokenizer:
-        - planned-maintenance:update
-        - planned-maintenance:attach
-        - planned-maintenance:detach
-        - rule:attach
-        - rule:detach
+        - EDITOR
       summary: Update downtime schedule
       tags:
       - downtimeschedules
@@ -16708,9 +16692,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - route-policy:list
+        - VIEWER
       - tokenizer:
-        - route-policy:list
+        - VIEWER
       summary: List route policies
       tags:
       - routepolicies
@@ -16765,13 +16749,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - route-policy:create
-        - route-policy:attach
-        - notification-channel:attach
+        - ADMIN
       - tokenizer:
-        - route-policy:create
-        - route-policy:attach
-        - notification-channel:attach
+        - ADMIN
       summary: Create route policy
       tags:
       - routepolicies
@@ -16816,9 +16796,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - route-policy:delete
+        - ADMIN
       - tokenizer:
-        - route-policy:delete
+        - ADMIN
       summary: Delete route policy
       tags:
       - routepolicies
@@ -16874,9 +16854,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - route-policy:read
+        - VIEWER
       - tokenizer:
-        - route-policy:read
+        - VIEWER
       summary: Get route policy by ID
       tags:
       - routepolicies
@@ -16943,17 +16923,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - route-policy:update
-        - route-policy:attach
-        - route-policy:detach
-        - notification-channel:attach
-        - notification-channel:detach
+        - ADMIN
       - tokenizer:
-        - route-policy:update
-        - route-policy:attach
-        - route-policy:detach
-        - notification-channel:attach
-        - notification-channel:detach
+        - ADMIN
       summary: Update route policy
       tags:
       - routepolicies
@@ -24943,9 +24915,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:list
+        - VIEWER
       - tokenizer:
-        - rule:list
+        - VIEWER
       summary: List rule saved views
       tags:
       - rules
@@ -25001,9 +24973,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:list
+        - VIEWER
       - tokenizer:
-        - rule:list
+        - VIEWER
       summary: Create rule saved view
       tags:
       - rules
@@ -25055,9 +25027,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:list
+        - VIEWER
       - tokenizer:
-        - rule:list
+        - VIEWER
       summary: Delete rule saved view
       tags:
       - rules
@@ -25124,9 +25096,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:list
+        - VIEWER
       - tokenizer:
-        - rule:list
+        - VIEWER
       summary: Update rule saved view
       tags:
       - rules
@@ -25175,9 +25147,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:list
+        - VIEWER
       - tokenizer:
-        - rule:list
+        - VIEWER
       summary: List alert rules
       tags:
       - rules
@@ -25340,13 +25312,13 @@ paths:
                   schemaVersion: v2alpha1
                   version: v5
               metric_anomaly:
-                description: Wraps a builder query in the `anomaly` function with
-                  daily seasonality, so SigNoz compares each point against the forecast
-                  for that time of day. The threshold is compared against the signed
-                  anomaly score, so `below` with a target of -2 fires when an abrupt
-                  drop holds for the entire window; `requireMinPoints` guards against
-                  noisy intervals.
-                summary: Metric anomaly rule
+                description: Anomaly rules are not yet supported under schemaVersion
+                  v2alpha1, so this example uses the v1 shape. Wraps a builder query
+                  in the `anomaly` function with daily seasonality SigNoz compares
+                  each point against the forecast for that time of day. Fires when
+                  the anomaly score stays below the threshold for the entire window;
+                  `requireMinPoints` guards against noisy intervals.
+                summary: Metric anomaly rule (v1 only)
                 value:
                   alert: Anomalous drop in ingested spans
                   alertType: METRIC_BASED_ALERT
@@ -25381,36 +25353,22 @@ paths:
                           stepInterval: 21600
                         type: builder_query
                       queryType: builder
+                    matchType: all_the_times
+                    op: below
                     requireMinPoints: true
                     requiredNumPoints: 3
                     seasonality: daily
                     selectedQueryName: A
-                    thresholds:
-                      kind: basic
-                      spec:
-                      - channels:
-                        - slack-ingestion
-                        matchType: all_the_times
-                        name: warning
-                        op: below
-                        target: -2
+                    target: 2
                   description: Detect an abrupt drop in span ingestion using a z-score
                     anomaly function
-                  evaluation:
-                    kind: rolling
-                    spec:
-                      evalWindow: 24h
-                      frequency: 3h
+                  evalWindow: 24h
+                  frequency: 3h
                   labels:
                     severity: warning
-                  notificationSettings:
-                    renotify:
-                      alertStates:
-                      - firing
-                      enabled: true
-                      interval: 4h
+                  preferredChannels:
+                  - slack-ingestion
                   ruleType: anomaly_rule
-                  schemaVersion: v2alpha1
                   version: v5
               metric_promql:
                 description: PromQL expression instead of the builder. Dotted OTEL
@@ -26030,23 +25988,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       - tokenizer:
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       summary: Create alert rule
       tags:
       - rules
@@ -26091,9 +26035,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:delete
+        - EDITOR
       - tokenizer:
-        - rule:delete
+        - EDITOR
       summary: Delete alert rule
       tags:
       - rules
@@ -26149,9 +26093,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:read
+        - VIEWER
       - tokenizer:
-        - rule:read
+        - VIEWER
       summary: Get alert rule by ID
       tags:
       - rules
@@ -26320,13 +26264,13 @@ paths:
                   schemaVersion: v2alpha1
                   version: v5
               metric_anomaly:
-                description: Wraps a builder query in the `anomaly` function with
-                  daily seasonality, so SigNoz compares each point against the forecast
-                  for that time of day. The threshold is compared against the signed
-                  anomaly score, so `below` with a target of -2 fires when an abrupt
-                  drop holds for the entire window; `requireMinPoints` guards against
-                  noisy intervals.
-                summary: Metric anomaly rule
+                description: Anomaly rules are not yet supported under schemaVersion
+                  v2alpha1, so this example uses the v1 shape. Wraps a builder query
+                  in the `anomaly` function with daily seasonality SigNoz compares
+                  each point against the forecast for that time of day. Fires when
+                  the anomaly score stays below the threshold for the entire window;
+                  `requireMinPoints` guards against noisy intervals.
+                summary: Metric anomaly rule (v1 only)
                 value:
                   alert: Anomalous drop in ingested spans
                   alertType: METRIC_BASED_ALERT
@@ -26361,36 +26305,22 @@ paths:
                           stepInterval: 21600
                         type: builder_query
                       queryType: builder
+                    matchType: all_the_times
+                    op: below
                     requireMinPoints: true
                     requiredNumPoints: 3
                     seasonality: daily
                     selectedQueryName: A
-                    thresholds:
-                      kind: basic
-                      spec:
-                      - channels:
-                        - slack-ingestion
-                        matchType: all_the_times
-                        name: warning
-                        op: below
-                        target: -2
+                    target: 2
                   description: Detect an abrupt drop in span ingestion using a z-score
                     anomaly function
-                  evaluation:
-                    kind: rolling
-                    spec:
-                      evalWindow: 24h
-                      frequency: 3h
+                  evalWindow: 24h
+                  frequency: 3h
                   labels:
                     severity: warning
-                  notificationSettings:
-                    renotify:
-                      alertStates:
-                      - firing
-                      enabled: true
-                      interval: 4h
+                  preferredChannels:
+                  - slack-ingestion
                   ruleType: anomaly_rule
-                  schemaVersion: v2alpha1
                   version: v5
               metric_promql:
                 description: PromQL expression instead of the builder. Dotted OTEL
@@ -27016,27 +26946,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:update
-        - rule:attach
-        - rule:detach
-        - notification-channel:attach
-        - notification-channel:detach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       - tokenizer:
-        - rule:update
-        - rule:attach
-        - rule:detach
-        - notification-channel:attach
-        - notification-channel:detach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       summary: Patch alert rule
       tags:
       - rules
@@ -27205,13 +27117,13 @@ paths:
                   schemaVersion: v2alpha1
                   version: v5
               metric_anomaly:
-                description: Wraps a builder query in the `anomaly` function with
-                  daily seasonality, so SigNoz compares each point against the forecast
-                  for that time of day. The threshold is compared against the signed
-                  anomaly score, so `below` with a target of -2 fires when an abrupt
-                  drop holds for the entire window; `requireMinPoints` guards against
-                  noisy intervals.
-                summary: Metric anomaly rule
+                description: Anomaly rules are not yet supported under schemaVersion
+                  v2alpha1, so this example uses the v1 shape. Wraps a builder query
+                  in the `anomaly` function with daily seasonality SigNoz compares
+                  each point against the forecast for that time of day. Fires when
+                  the anomaly score stays below the threshold for the entire window;
+                  `requireMinPoints` guards against noisy intervals.
+                summary: Metric anomaly rule (v1 only)
                 value:
                   alert: Anomalous drop in ingested spans
                   alertType: METRIC_BASED_ALERT
@@ -27246,36 +27158,22 @@ paths:
                           stepInterval: 21600
                         type: builder_query
                       queryType: builder
+                    matchType: all_the_times
+                    op: below
                     requireMinPoints: true
                     requiredNumPoints: 3
                     seasonality: daily
                     selectedQueryName: A
-                    thresholds:
-                      kind: basic
-                      spec:
-                      - channels:
-                        - slack-ingestion
-                        matchType: all_the_times
-                        name: warning
-                        op: below
-                        target: -2
+                    target: 2
                   description: Detect an abrupt drop in span ingestion using a z-score
                     anomaly function
-                  evaluation:
-                    kind: rolling
-                    spec:
-                      evalWindow: 24h
-                      frequency: 3h
+                  evalWindow: 24h
+                  frequency: 3h
                   labels:
                     severity: warning
-                  notificationSettings:
-                    renotify:
-                      alertStates:
-                      - firing
-                      enabled: true
-                      interval: 4h
+                  preferredChannels:
+                  - slack-ingestion
                   ruleType: anomaly_rule
-                  schemaVersion: v2alpha1
                   version: v5
               metric_promql:
                 description: PromQL expression instead of the builder. Dotted OTEL
@@ -27889,27 +27787,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:update
-        - rule:attach
-        - rule:detach
-        - notification-channel:attach
-        - notification-channel:detach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       - tokenizer:
-        - rule:update
-        - rule:attach
-        - rule:detach
-        - notification-channel:attach
-        - notification-channel:detach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       summary: Update alert rule
       tags:
       - rules
@@ -27976,25 +27856,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:read
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       - tokenizer:
-        - rule:read
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       summary: Clone alert rule
       tags:
       - rules
@@ -28154,15 +28018,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:read
-        - logs-field:list
-        - traces-field:list
-        - metrics-field:list
+        - VIEWER
       - tokenizer:
-        - rule:read
-        - logs-field:list
-        - traces-field:list
-        - metrics-field:list
+        - VIEWER
       summary: Get rule history filter keys
       tags:
       - rules
@@ -28338,15 +28196,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:read
-        - logs-field:read
-        - traces-field:read
-        - metrics-field:read
+        - VIEWER
       - tokenizer:
-        - rule:read
-        - logs-field:read
-        - traces-field:read
-        - metrics-field:read
+        - VIEWER
       summary: Get rule history filter values
       tags:
       - rules
@@ -28419,9 +28271,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:read
+        - VIEWER
       - tokenizer:
-        - rule:read
+        - VIEWER
       summary: Get rule overall status timeline
       tags:
       - rules
@@ -28491,9 +28343,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:read
+        - VIEWER
       - tokenizer:
-        - rule:read
+        - VIEWER
       summary: Get rule history stats
       tags:
       - rules
@@ -28583,19 +28435,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:read
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - VIEWER
       - tokenizer:
-        - rule:read
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - VIEWER
       summary: Get rule history timeline
       tags:
       - rules
@@ -28668,19 +28510,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:read
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - VIEWER
       - tokenizer:
-        - rule:read
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - VIEWER
       summary: Get top contributors to rule firing
       tags:
       - rules
@@ -28844,13 +28676,13 @@ paths:
                   schemaVersion: v2alpha1
                   version: v5
               metric_anomaly:
-                description: Wraps a builder query in the `anomaly` function with
-                  daily seasonality, so SigNoz compares each point against the forecast
-                  for that time of day. The threshold is compared against the signed
-                  anomaly score, so `below` with a target of -2 fires when an abrupt
-                  drop holds for the entire window; `requireMinPoints` guards against
-                  noisy intervals.
-                summary: Metric anomaly rule
+                description: Anomaly rules are not yet supported under schemaVersion
+                  v2alpha1, so this example uses the v1 shape. Wraps a builder query
+                  in the `anomaly` function with daily seasonality SigNoz compares
+                  each point against the forecast for that time of day. Fires when
+                  the anomaly score stays below the threshold for the entire window;
+                  `requireMinPoints` guards against noisy intervals.
+                summary: Metric anomaly rule (v1 only)
                 value:
                   alert: Anomalous drop in ingested spans
                   alertType: METRIC_BASED_ALERT
@@ -28885,36 +28717,22 @@ paths:
                           stepInterval: 21600
                         type: builder_query
                       queryType: builder
+                    matchType: all_the_times
+                    op: below
                     requireMinPoints: true
                     requiredNumPoints: 3
                     seasonality: daily
                     selectedQueryName: A
-                    thresholds:
-                      kind: basic
-                      spec:
-                      - channels:
-                        - slack-ingestion
-                        matchType: all_the_times
-                        name: warning
-                        op: below
-                        target: -2
+                    target: 2
                   description: Detect an abrupt drop in span ingestion using a z-score
                     anomaly function
-                  evaluation:
-                    kind: rolling
-                    spec:
-                      evalWindow: 24h
-                      frequency: 3h
+                  evalWindow: 24h
+                  frequency: 3h
                   labels:
                     severity: warning
-                  notificationSettings:
-                    renotify:
-                      alertStates:
-                      - firing
-                      enabled: true
-                      interval: 4h
+                  preferredChannels:
+                  - slack-ingestion
                   ruleType: anomaly_rule
-                  schemaVersion: v2alpha1
                   version: v5
               metric_promql:
                 description: PromQL expression instead of the builder. Dotted OTEL
@@ -29534,23 +29352,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       - tokenizer:
-        - rule:create
-        - rule:attach
-        - notification-channel:attach
-        - logs:read
-        - traces:read
-        - metrics:read
-        - audit-logs:read
-        - meter-metrics:read
+        - EDITOR
       summary: Test alert rule
       tags:
       - rules
@@ -31645,9 +31449,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - rule:list
+        - VIEWER
       - tokenizer:
-        - rule:list
+        - VIEWER
       summary: List alert rules (v3)
       tags:
       - rules

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -12584,12 +12584,6 @@ export type RuletypesPostableRuleDTOAnnotations = { [key: string]: string };
  */
 export type RuletypesPostableRuleDTOLabels = { [key: string]: string };
 
-/**
- * The rule payload schema.
- */
-export enum RuletypesPostableRuleDTOSchemaVersion {
-	v2alpha1 = 'v2alpha1',
-}
 export enum RuletypesSeasonalityDTO {
 	hourly = 'hourly',
 	daily = 'daily',
@@ -12666,9 +12660,9 @@ export interface RuletypesRuleConditionDTO {
 	seasonality?: RuletypesSeasonalityDTO;
 	/**
 	 * @type string
-	 * @description The name of the query whose result is evaluated, such as A or F1. Must match a query in compositeQuery.
+	 * @description The name of the query whose result is evaluated, such as A or F1. Must match a query in compositeQuery. When omitted, F1 is used if present, otherwise the enabled query with the highest name.
 	 */
-	selectedQueryName: string;
+	selectedQueryName?: string;
 	/**
 	 * @type number,null
 	 * @format double
@@ -12681,9 +12675,9 @@ export interface RuletypesRuleConditionDTO {
 	 */
 	targetUnit?: string;
 	/**
-	 * @description The thresholds to evaluate, as a kind and spec.
+	 * @description The thresholds to evaluate, as a kind and spec. Required when schemaVersion is v2alpha1; derived from op, target and matchType for v1.
 	 */
-	thresholds: RuletypesRuleThresholdDataDTO;
+	thresholds?: RuletypesRuleThresholdDataDTO;
 }
 
 export interface RuletypesPostableRuleDTO {
@@ -12721,9 +12715,9 @@ export interface RuletypesPostableRuleDTO {
 	 */
 	evalWindow?: string;
 	/**
-	 * @description The evaluation window, as a kind and spec.
+	 * @description The evaluation window, as a kind and spec. Required when schemaVersion is v2alpha1; derived from evalWindow and frequency for v1.
 	 */
-	evaluation: RuletypesEvaluationEnvelopeDTO;
+	evaluation?: RuletypesEvaluationEnvelopeDTO;
 	/**
 	 * @type string
 	 * @description How often the rule is evaluated, as a Go duration such as 1m. Only read when schemaVersion is v1, defaulting to 1m; v2alpha1 rules set it in evaluation.spec instead.
@@ -12735,24 +12729,23 @@ export interface RuletypesPostableRuleDTO {
 	 */
 	labels?: RuletypesPostableRuleDTOLabels;
 	/**
-	 * @description Grouping, re-notification and routing behaviour.
+	 * @description Grouping, re-notification and routing behaviour. Required when schemaVersion is v2alpha1; derived from the v1 fields otherwise.
 	 */
-	notificationSettings: RuletypesNotificationSettingsDTO;
+	notificationSettings?: RuletypesNotificationSettingsDTO;
 	/**
 	 * @type array
 	 * @description The displayName of each notification channel to notify, for schemaVersion v1 rules. Ignored for v2alpha1, where each threshold carries its own channels.
 	 */
 	preferredChannels?: string[];
 	/**
-	 * @description The evaluation strategy: threshold_rule compares against thresholds, promql_rule evaluates a PromQL expression, anomaly_rule scores deviation from seasonal history. Defaults to threshold_rule for builder and clickhouse_sql queries and is forced to promql_rule for promql queries.
+	 * @description The evaluation strategy: threshold_rule compares against thresholds, promql_rule evaluates a PromQL expression, anomaly_rule scores deviation from seasonal history. Defaults to threshold_rule for builder queries and is forced to promql_rule for promql queries.
 	 */
 	ruleType: RuletypesRuleTypeDTO;
 	/**
-	 * @enum v2alpha1
 	 * @type string
-	 * @description The rule payload schema.
+	 * @description The rule payload schema: v1 (the default when omitted) uses the flat condition fields, v2alpha1 uses condition.thresholds, evaluation and notificationSettings.
 	 */
-	schemaVersion: RuletypesPostableRuleDTOSchemaVersion;
+	schemaVersion?: string;
 	/**
 	 * @type string
 	 * @description The URL of the page the rule was created from. Informational; it is not used for evaluation.
@@ -12760,7 +12753,7 @@ export interface RuletypesPostableRuleDTO {
 	source?: string;
 	/**
 	 * @type string
-	 * @description The query payload version. Nothing reads it.
+	 * @description The query payload version. Only v5 is accepted and it is filled in when omitted.
 	 */
 	version?: string;
 }
@@ -12783,12 +12776,6 @@ export type RuletypesRuleDTOAnnotations = { [key: string]: string };
  */
 export type RuletypesRuleDTOLabels = { [key: string]: string };
 
-/**
- * The rule payload schema.
- */
-export enum RuletypesRuleDTOSchemaVersion {
-	v2alpha1 = 'v2alpha1',
-}
 export interface RuletypesRuleDTO {
 	/**
 	 * @type string
@@ -12833,9 +12820,9 @@ export interface RuletypesRuleDTO {
 	 */
 	evalWindow?: string;
 	/**
-	 * @description The evaluation window, as a kind and spec.
+	 * @description The evaluation window, as a kind and spec. Required when schemaVersion is v2alpha1; derived from evalWindow and frequency for v1.
 	 */
-	evaluation: RuletypesEvaluationEnvelopeDTO;
+	evaluation?: RuletypesEvaluationEnvelopeDTO;
 	/**
 	 * @type string
 	 * @description How often the rule is evaluated, as a Go duration such as 1m. Only read when schemaVersion is v1, defaulting to 1m; v2alpha1 rules set it in evaluation.spec instead.
@@ -12852,24 +12839,23 @@ export interface RuletypesRuleDTO {
 	 */
 	labels?: RuletypesRuleDTOLabels;
 	/**
-	 * @description Grouping, re-notification and routing behaviour.
+	 * @description Grouping, re-notification and routing behaviour. Required when schemaVersion is v2alpha1; derived from the v1 fields otherwise.
 	 */
-	notificationSettings: RuletypesNotificationSettingsDTO;
+	notificationSettings?: RuletypesNotificationSettingsDTO;
 	/**
 	 * @type array
 	 * @description The displayName of each notification channel to notify, for schemaVersion v1 rules. Ignored for v2alpha1, where each threshold carries its own channels.
 	 */
 	preferredChannels?: string[];
 	/**
-	 * @description The evaluation strategy: threshold_rule compares against thresholds, promql_rule evaluates a PromQL expression, anomaly_rule scores deviation from seasonal history. Defaults to threshold_rule for builder and clickhouse_sql queries and is forced to promql_rule for promql queries.
+	 * @description The evaluation strategy: threshold_rule compares against thresholds, promql_rule evaluates a PromQL expression, anomaly_rule scores deviation from seasonal history. Defaults to threshold_rule for builder queries and is forced to promql_rule for promql queries.
 	 */
 	ruleType: RuletypesRuleTypeDTO;
 	/**
-	 * @enum v2alpha1
 	 * @type string
-	 * @description The rule payload schema.
+	 * @description The rule payload schema: v1 (the default when omitted) uses the flat condition fields, v2alpha1 uses condition.thresholds, evaluation and notificationSettings.
 	 */
-	schemaVersion: RuletypesRuleDTOSchemaVersion;
+	schemaVersion?: string;
 	/**
 	 * @type string
 	 * @description The URL of the page the rule was created from. Informational; it is not used for evaluation.
@@ -12890,7 +12876,7 @@ export interface RuletypesRuleDTO {
 	updatedBy?: string;
 	/**
 	 * @type string
-	 * @description The query payload version. Nothing reads it.
+	 * @description The query payload version. Only v5 is accepted and it is filled in when omitted.
 	 */
 	version?: string;
 }

frontend/src/components/Editor/index.tsx

@@ -1,6 +1,6 @@
 import { useMemo } from 'react';
-import MEditor, { EditorProps } from '@monaco-editor/react';
-import { useIsDarkMode } from 'hooks/useDarkMode';
+import { EditorProps } from '@monaco-editor/react';
+import MonacoEditor from 'lib/monaco/MonacoEditor';
 
 function Editor({
 	value,
@@ -10,8 +10,6 @@ function Editor({
 	height,
 	options,
 }: MEditorProps): JSX.Element {
-	const isDarkMode = useIsDarkMode();
-
 	const onChangeHandler = (newValue?: string): void => {
 		if (readOnly) {
 			return;
@@ -28,8 +26,7 @@ function Editor({
 	);
 
 	return (
-		<MEditor
-			theme={isDarkMode ? 'vs-dark' : 'vs-light'}
+		<MonacoEditor
 			language={language}
 			value={value}
 			options={editorOptions}

frontend/src/container/LLMObservability/AttributeMapping/TestTab/TestTab.tsx

@@ -1,17 +1,11 @@
-import MEditor from '@monaco-editor/react';
 import { Play, RotateCcw } from '@signozhq/icons';
 import { Button } from '@signozhq/ui/button';
 import { Callout } from '@signozhq/ui/callout';
-import { useIsDarkMode } from 'hooks/useDarkMode';
+import MonacoEditor from 'lib/monaco/MonacoEditor';
 
 import styles from './TestTab.module.scss';
 import JsonEditorSkeleton from './JsonEditorSkeleton';
 import TestResult from './TestResult';
-import {
-	defineSignozJsonTheme,
-	SIGNOZ_JSON_THEME_DARK,
-	SIGNOZ_JSON_THEME_LIGHT,
-} from './jsonEditorTheme';
 import { UseTestSpanMapper } from './useTestSpanMapper';
 
 interface TestTabProps {
@@ -32,7 +26,6 @@ function TestTab({ spanTest }: TestTabProps): JSX.Element {
 		error,
 		validationError,
 	} = spanTest;
-	const isDarkMode = useIsDarkMode();
 
 	function renderResults(): JSX.Element {
 		if (error) {
@@ -122,14 +115,12 @@ function TestTab({ spanTest }: TestTabProps): JSX.Element {
 					data-testid="test-span-input"
 					aria-label="Sample span JSON"
 				>
-					<MEditor
+					<MonacoEditor
 						language="json"
 						value={input}
 						onChange={(value): void => setInput(value ?? '')}
 						height="100%"
 						loading={<JsonEditorSkeleton />}
-						theme={isDarkMode ? SIGNOZ_JSON_THEME_DARK : SIGNOZ_JSON_THEME_LIGHT}
-						beforeMount={defineSignozJsonTheme}
 						options={{
 							minimap: { enabled: false },
 							fontSize: 12,

frontend/src/container/LLMObservability/AttributeMapping/TestTab/jsonEditorTheme.ts

@@ -1,38 +0,0 @@
-//TODO: This is a local theme for now, but ideally for the editor as well. Just like prettyViewer, we have a theme. We should have a theme for the editor as well.
-import { Monaco } from '@monaco-editor/react';
-import { Color } from '@signozhq/design-tokens';
-
-export const SIGNOZ_JSON_THEME_DARK = 'signoz-attr-mapping-json-dark';
-export const SIGNOZ_JSON_THEME_LIGHT = 'signoz-attr-mapping-json-light';
-
-const SHARED_THEME = {
-	inherit: true,
-	colors: {
-		'editor.background': '#00000000', // transparent — inherit the panel bg
-	},
-	fontFamily: 'SF Mono, Geist Mono, Fira Code, monospace',
-	fontSize: 12,
-	fontWeight: 'normal',
-	lineHeight: 18,
-	letterSpacing: -0.06,
-};
-
-export function defineSignozJsonTheme(monaco: Monaco): void {
-	monaco.editor.defineTheme(SIGNOZ_JSON_THEME_DARK, {
-		...SHARED_THEME,
-		base: 'vs-dark',
-		rules: [
-			{ token: 'string.key.json', foreground: Color.BG_ROBIN_400 },
-			{ token: 'string.value.json', foreground: Color.BG_VANILLA_400 },
-		],
-	});
-
-	monaco.editor.defineTheme(SIGNOZ_JSON_THEME_LIGHT, {
-		...SHARED_THEME,
-		base: 'vs',
-		rules: [
-			{ token: 'string.key.json', foreground: Color.BG_ROBIN_500 },
-			{ token: 'string.value.json', foreground: Color.BG_INK_400 },
-		],
-	});
-}

frontend/src/container/QueryBuilder/rawQueryEditors/ClickHouse/query.tsx

@@ -1,10 +1,8 @@
 import { ChangeEvent, useCallback } from 'react';
-import MEditor, { Monaco } from '@monaco-editor/react';
-import { Color } from '@signozhq/design-tokens';
 import { Input } from 'antd';
 import { LEGEND } from 'constants/global';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
-import { useIsDarkMode } from 'hooks/useDarkMode';
+import MonacoEditor from 'lib/monaco/MonacoEditor';
 import { IClickHouseQuery } from 'types/api/queryBuilder/queryBuilderData';
 import { EQueryType } from 'types/common/dashboard';
 import { getFormatedLegend } from 'utils/getFormatedLegend';
@@ -71,22 +69,6 @@ function ClickHouseQueryBuilder({
 		[handleUpdateQuery],
 	);
 
-	const isDarkMode = useIsDarkMode();
-
-	function setEditorTheme(monaco: Monaco): void {
-		monaco.editor.defineTheme('my-theme', {
-			base: 'vs-dark',
-			inherit: true,
-			rules: [
-				{ token: 'string.key.json', foreground: Color.BG_VANILLA_400 },
-				{ token: 'string.value.json', foreground: Color.BG_ROBIN_400 },
-			],
-			colors: {
-				'editor.background': Color.BG_INK_300,
-			},
-		});
-	}
-
 	return (
 		<QueryHeader
 			name={queryData?.name}
@@ -95,15 +77,13 @@ function ClickHouseQueryBuilder({
 			onDelete={handleRemoveQuery}
 			deletable={deletable}
 		>
-			<MEditor
+			<MonacoEditor
 				language="sql"
 				height="200px"
 				onChange={handleUpdateEditor}
 				value={queryData?.query}
 				onMount={(_, monaco): void => {
-					document.fonts.ready.then(() => {
-						monaco.editor.remeasureFonts();
-					});
+					void document.fonts.ready.then(() => monaco.editor.remeasureFonts());
 				}}
 				options={{
 					scrollbar: {
@@ -115,8 +95,6 @@ function ClickHouseQueryBuilder({
 					fontSize: 14,
 					fontFamily: 'Space Mono',
 				}}
-				theme={isDarkMode ? 'my-theme' : 'light'}
-				beforeMount={setEditorTheme}
 			/>
 			<Input
 				onChange={handleUpdateInput}

frontend/src/container/RolesSettings/CreateEditRolePage/components/JsonEditor.tsx

@@ -7,7 +7,7 @@ import {
 	useRef,
 } from 'react';
 import { useCopyToClipboard } from 'react-use';
-import MEditor, { Monaco, OnMount } from '@monaco-editor/react';
+import { Monaco, OnMount } from '@monaco-editor/react';
 import { Color } from '@signozhq/design-tokens';
 import { Check, Copy } from '@signozhq/icons';
 import { Button } from '@signozhq/ui/button';
@@ -15,12 +15,9 @@ import { Tooltip } from '@signozhq/ui/tooltip';
 import { Typography } from '@signozhq/ui/typography';
 import type { AuthtypesTransactionGroupDTO } from 'api/generated/services/sigNoz.schemas';
 import { useIsDarkMode } from 'hooks/useDarkMode';
+import { EDITABLE_EDITOR_OPTIONS } from 'lib/monaco/editorOptions';
+import MonacoEditor from 'lib/monaco/MonacoEditor';
 
-import {
-	defineJsonTheme,
-	EDITABLE_EDITOR_OPTIONS,
-	JSON_THEME_DARK,
-} from '../../monaco.config';
 import {
 	transformResourcePermissionsToTransactionGroups,
 	transformTransactionGroupsToResourcePermissions,
@@ -34,7 +31,7 @@ import {
 import styles from './JsonEditor.module.scss';
 import { JsonEditorProps, JsonEditorRef } from './JsonEditor.types';
 
-type MonacoEditor = Parameters<OnMount>[0];
+type MonacoEditorInstance = Parameters<OnMount>[0];
 
 const JsonEditor = forwardRef<JsonEditorRef, JsonEditorProps>(
 	function JsonEditor({ resources, mode, onChange, onValidityChange }, ref) {
@@ -50,7 +47,7 @@ const JsonEditor = forwardRef<JsonEditorRef, JsonEditorProps>(
 		});
 		const prevModeRef = useRef(mode);
 		const completionDisposableRef = useRef<{ dispose(): void } | null>(null);
-		const editorRef = useRef<MonacoEditor | null>(null);
+		const editorRef = useRef<MonacoEditorInstance | null>(null);
 		const markersListenerRef = useRef<{ dispose(): void } | null>(null);
 
 		const hasError = parseError !== null || schemaErrors.length > 0;
@@ -100,7 +97,6 @@ const JsonEditor = forwardRef<JsonEditorRef, JsonEditorProps>(
 		);
 
 		const configureMonaco = useCallback((monaco: Monaco): void => {
-			defineJsonTheme(monaco);
 			registerJsonSchema(monaco);
 			completionDisposableRef.current = registerCompletionProvider(monaco);
 		}, []);
@@ -184,7 +180,7 @@ const JsonEditor = forwardRef<JsonEditorRef, JsonEditorProps>(
 							</Button>
 						</Tooltip>
 					</div>
-					<MEditor
+					<MonacoEditor
 						value={jsonBuffer}
 						language="json"
 						path={ROLE_PERMISSIONS_MODEL_PATH}
@@ -192,7 +188,6 @@ const JsonEditor = forwardRef<JsonEditorRef, JsonEditorProps>(
 						onChange={handleEditorChange}
 						onMount={handleEditorMount}
 						height="100%"
-						theme={isDarkMode ? JSON_THEME_DARK : 'light'}
 						beforeMount={configureMonaco}
 					/>
 				</div>
@@ -225,7 +220,11 @@ const JsonEditor = forwardRef<JsonEditorRef, JsonEditorProps>(
 								className={styles.jsonEditorErrorMessage}
 							>
 								{schemaErrors[0]}
-								{schemaErrors.length > 1 && ` (+${schemaErrors.length - 1} more)`}
+								{schemaErrors.length > 1 && (
+									<span className="translate-safe">
+										{` (+${schemaErrors.length - 1} more)`}
+									</span>
+								)}
 							</Typography>
 						</div>
 					)}

frontend/src/container/RolesSettings/ViewRolePage/ReadOnlyJsonViewer.tsx

@@ -1,17 +1,13 @@
 import { useCallback, useEffect, useMemo, useState } from 'react';
 import { useCopyToClipboard } from 'react-use';
-import MEditor from '@monaco-editor/react';
 import { Color } from '@signozhq/design-tokens';
 import { Check, Copy } from '@signozhq/icons';
 import { Button } from '@signozhq/ui/button';
 import { Tooltip } from '@signozhq/ui/tooltip';
 import { useIsDarkMode } from 'hooks/useDarkMode';
+import { READONLY_EDITOR_OPTIONS } from 'lib/monaco/editorOptions';
+import MonacoEditor from 'lib/monaco/MonacoEditor';
 
-import {
-	defineJsonTheme,
-	JSON_THEME_DARK,
-	READONLY_EDITOR_OPTIONS,
-} from '../monaco.config';
 import { RolePermissionsData } from '../types';
 import { transformResourcePermissionsToTransactionGroups } from '../hooks/useRolePermissions';
 
@@ -79,13 +75,11 @@ function ReadOnlyJsonViewer({
 						</Button>
 					</Tooltip>
 				</div>
-				<MEditor
+				<MonacoEditor
 					value={jsonContent}
 					language="json"
 					options={READONLY_EDITOR_OPTIONS}
 					height="100%"
-					theme={isDarkMode ? JSON_THEME_DARK : 'light'}
-					beforeMount={defineJsonTheme}
 				/>
 			</div>
 		</div>

frontend/src/lib/authz/hooks/useAuthZ/permissions.type.ts

@@ -21,15 +21,7 @@ export default {
 			{
 				kind: 'notification-channel',
 				type: 'metaresource',
-				allowedVerbs: [
-					'attach',
-					'create',
-					'delete',
-					'detach',
-					'list',
-					'read',
-					'update',
-				],
+				allowedVerbs: ['create', 'delete', 'list', 'read', 'update'],
 			},
 			{
 				kind: 'quick-filter',

frontend/src/lib/monaco/MonacoEditor.tsx

@@ -0,0 +1,25 @@
+import { useCallback } from 'react';
+import MEditor, { EditorProps, Monaco } from '@monaco-editor/react';
+
+import { EDITOR_THEME, registerEditorTheme } from './editorTheme';
+
+export type MonacoEditorProps = Omit<EditorProps, 'theme'>;
+
+function MonacoEditor({
+	beforeMount,
+	...props
+}: MonacoEditorProps): JSX.Element {
+	const handleBeforeMount = useCallback(
+		(monaco: Monaco): void => {
+			registerEditorTheme(monaco);
+			beforeMount?.(monaco);
+		},
+		[beforeMount],
+	);
+
+	return (
+		<MEditor {...props} theme={EDITOR_THEME} beforeMount={handleBeforeMount} />
+	);
+}
+
+export default MonacoEditor;

frontend/src/lib/monaco/__tests__/MonacoEditor.test.tsx

@@ -0,0 +1,58 @@
+import type { EditorProps, Monaco } from '@monaco-editor/react';
+import { render } from '@testing-library/react';
+
+import { EDITOR_THEME, registerEditorTheme } from '../editorTheme';
+import MonacoEditor from '../MonacoEditor';
+
+const editorProps = jest.fn();
+
+jest.mock('@monaco-editor/react', () => ({
+	__esModule: true,
+	default: (props: EditorProps): JSX.Element => {
+		editorProps(props);
+		return <div data-testid="monaco" />;
+	},
+}));
+
+jest.mock('../editorTheme', () => ({
+	EDITOR_THEME: 'signoz',
+	registerEditorTheme: jest.fn(),
+}));
+
+function lastProps(): EditorProps {
+	return editorProps.mock.calls[editorProps.mock.calls.length - 1][0];
+}
+
+describe('MonacoEditor', () => {
+	beforeEach(() => {
+		editorProps.mockClear();
+		jest.mocked(registerEditorTheme).mockClear();
+	});
+
+	it('renders with the shared theme and forwards the other props', () => {
+		render(<MonacoEditor language="json" value="{}" height="100%" />);
+
+		expect(lastProps()).toMatchObject({
+			theme: EDITOR_THEME,
+			language: 'json',
+			value: '{}',
+			height: '100%',
+		});
+	});
+
+	it('registers the theme before the caller sets up monaco', () => {
+		const calls: string[] = [];
+		jest
+			.mocked(registerEditorTheme)
+			.mockImplementation(() => calls.push('theme'));
+		const beforeMount = jest.fn(() => calls.push('caller'));
+		const monaco = {} as Monaco;
+
+		render(<MonacoEditor beforeMount={beforeMount} />);
+		lastProps().beforeMount?.(monaco);
+
+		expect(registerEditorTheme).toHaveBeenCalledWith(monaco);
+		expect(beforeMount).toHaveBeenCalledWith(monaco);
+		expect(calls).toStrictEqual(['theme', 'caller']);
+	});
+});

frontend/src/lib/monaco/__tests__/editorTheme.test.ts

@@ -0,0 +1,138 @@
+import type { Monaco } from '@monaco-editor/react';
+
+type EditorThemeModule = typeof import('../editorTheme');
+
+const DARK_TOKENS = {
+	'--l1-background': '#0b0c0e',
+	'--l1-foreground': '#eceef2',
+	'--bg-vanilla-400': '#c0c1c3',
+	'--bg-robin-400': '#7190f9',
+};
+
+const LIGHT_TOKENS = {
+	'--l1-background': '#ffffff',
+	'--l1-foreground': '#121317',
+	'--bg-vanilla-400': '#c0c1c3',
+	'--bg-robin-400': '#7190f9',
+};
+
+function setTokens(tokens: Record<string, string>): void {
+	Object.entries(tokens).forEach(([name, value]) => {
+		document.body.style.setProperty(name, value);
+	});
+}
+
+function createMonaco(): { monaco: Monaco; defineTheme: jest.Mock } {
+	const defineTheme = jest.fn();
+	return {
+		monaco: { editor: { defineTheme } } as unknown as Monaco,
+		defineTheme,
+	};
+}
+
+function loadModule(): EditorThemeModule {
+	let mod: EditorThemeModule | undefined;
+	jest.isolateModules(() => {
+		mod = jest.requireActual<EditorThemeModule>('../editorTheme');
+	});
+	return mod as EditorThemeModule;
+}
+
+async function flushMutations(): Promise<void> {
+	await Promise.resolve();
+}
+
+describe('registerEditorTheme', () => {
+	afterEach(() => {
+		document.body.removeAttribute('style');
+		document.body.className = '';
+	});
+
+	it('defines a dark theme with the JSON token colours on a dark surface', () => {
+		setTokens(DARK_TOKENS);
+		const { registerEditorTheme, EDITOR_THEME } = loadModule();
+		const { monaco, defineTheme } = createMonaco();
+
+		registerEditorTheme(monaco);
+
+		expect(defineTheme).toHaveBeenCalledTimes(1);
+		expect(defineTheme).toHaveBeenCalledWith(EDITOR_THEME, {
+			base: 'vs-dark',
+			inherit: true,
+			rules: [
+				{ token: 'string.key.json', foreground: 'c0c1c3' },
+				{ token: 'string.value.json', foreground: '7190f9' },
+			],
+			colors: {
+				'editor.background': '#0b0c0e',
+				'editor.foreground': '#eceef2',
+			},
+		});
+	});
+
+	it('keeps the vs palette on a light surface', () => {
+		setTokens(LIGHT_TOKENS);
+		const { registerEditorTheme } = loadModule();
+		const { monaco, defineTheme } = createMonaco();
+
+		registerEditorTheme(monaco);
+
+		expect(defineTheme).toHaveBeenCalledWith(
+			expect.any(String),
+			expect.objectContaining({
+				base: 'vs',
+				rules: [],
+				colors: {
+					'editor.background': '#ffffff',
+					'editor.foreground': '#121317',
+				},
+			}),
+		);
+	});
+
+	it('redefines the theme when the body class switches the tokens', async () => {
+		setTokens(DARK_TOKENS);
+		const { registerEditorTheme } = loadModule();
+		const { monaco, defineTheme } = createMonaco();
+		registerEditorTheme(monaco);
+
+		setTokens(LIGHT_TOKENS);
+		document.body.classList.add('lightMode');
+		await flushMutations();
+
+		expect(defineTheme).toHaveBeenCalledTimes(2);
+		expect(defineTheme).toHaveBeenLastCalledWith(
+			expect.any(String),
+			expect.objectContaining({ base: 'vs' }),
+		);
+	});
+
+	it('ignores body class changes that leave the tokens alone', async () => {
+		setTokens(DARK_TOKENS);
+		const { registerEditorTheme } = loadModule();
+		const { monaco, defineTheme } = createMonaco();
+		registerEditorTheme(monaco);
+
+		document.body.classList.add('ant-scrolling-effect');
+		await flushMutations();
+
+		expect(defineTheme).toHaveBeenCalledTimes(1);
+	});
+
+	it('watches the body once however many editors mount', async () => {
+		const observe = jest.spyOn(MutationObserver.prototype, 'observe');
+		setTokens(DARK_TOKENS);
+		const { registerEditorTheme } = loadModule();
+		const { monaco, defineTheme } = createMonaco();
+		registerEditorTheme(monaco);
+		registerEditorTheme(monaco);
+
+		setTokens(LIGHT_TOKENS);
+		document.body.classList.add('lightMode');
+		await flushMutations();
+
+		expect(observe).toHaveBeenCalledTimes(1);
+		expect(defineTheme).toHaveBeenCalledTimes(2);
+		observe.mockRestore();
+	});
+});

frontend/src/lib/monaco/editorOptions.ts

@@ -1,24 +1,7 @@
 import { Monaco } from '@monaco-editor/react';
-import { Color } from '@signozhq/design-tokens';
 
 type EditorOptions = Parameters<Monaco['editor']['create']>[1];
 
-export const JSON_THEME_DARK = 'json-theme-dark';
-
-export function defineJsonTheme(monaco: Monaco): void {
-	monaco.editor.defineTheme(JSON_THEME_DARK, {
-		base: 'vs-dark',
-		inherit: true,
-		rules: [
-			{ token: 'string.key.json', foreground: Color.BG_VANILLA_400 },
-			{ token: 'string.value.json', foreground: Color.BG_ROBIN_400 },
-		],
-		colors: {
-			'editor.background': Color.BG_INK_400,
-		},
-	});
-}
-
 const BASE_EDITOR_OPTIONS: EditorOptions = {
 	automaticLayout: true,
 	wordWrap: 'on',

frontend/src/lib/monaco/editorTheme.ts

@@ -0,0 +1,78 @@
+import type { Monaco } from '@monaco-editor/react';
+
+export const EDITOR_THEME = 'signoz';
+
+let definedBackground: string | undefined;
+let bodyClassObserver: MutationObserver | undefined;
+
+function token(name: string): string {
+	return getComputedStyle(document.body)
+		.getPropertyValue(name)
+		.trim()
+		.replace('#', '');
+}
+
+function isDark(hex: string): boolean {
+	if (hex.length < 6) {
+		return true;
+	}
+	const r = parseInt(hex.slice(0, 2), 16);
+	const g = parseInt(hex.slice(2, 4), 16);
+	const b = parseInt(hex.slice(4, 6), 16);
+	return 0.299 * r + 0.587 * g + 0.114 * b < 128;
+}
+
+function defineEditorTheme(monaco: Monaco): void {
+	const background = token('--l1-background');
+	if (background === definedBackground) {
+		return;
+	}
+	definedBackground = background;
+
+	const foreground = token('--l1-foreground');
+	const keyColor = token('--bg-vanilla-400');
+	const valueColor = token('--bg-robin-400');
+
+	// Both token colours are picked to read on a dark surface, so on a light one
+	// they wash out, the keys worst of all. Monaco's own `vs` palette is built
+	// for that surface, so let it keep its colours there, as the role viewer does.
+	const rules: { token: string; foreground: string }[] = [];
+	if (isDark(background)) {
+		if (keyColor) {
+			rules.push({ token: 'string.key.json', foreground: keyColor });
+		}
+		if (valueColor) {
+			rules.push({ token: 'string.value.json', foreground: valueColor });
+		}
+	}
+
+	const colors: Record<string, string> = {};
+	if (background) {
+		colors['editor.background'] = `#${background}`;
+	}
+	if (foreground) {
+		colors['editor.foreground'] = `#${foreground}`;
+	}
+
+	monaco.editor.defineTheme(EDITOR_THEME, {
+		base: isDark(background) ? 'vs-dark' : 'vs',
+		inherit: true,
+		rules,
+		colors,
+	});
+}
+
+// Monaco has a single theme for every editor on the page, and the design tokens
+// switch with the body's `dark` class, so the theme follows that class instead
+// of being defined per editor.
+export function registerEditorTheme(monaco: Monaco): void {
+	defineEditorTheme(monaco);
+	if (bodyClassObserver) {
+		return;
+	}
+	bodyClassObserver = new MutationObserver(() => defineEditorTheme(monaco));
+	bodyClassObserver.observe(document.body, {
+		attributes: true,
+		attributeFilter: ['class'],
+	});
+}

frontend/src/lib/monaco/jsonEditorTheme.ts

@@ -1,52 +0,0 @@
-import type { Monaco } from '@monaco-editor/react';
-
-export const JSON_EDITOR_THEME = 'signoz-json';
-
-function token(el: HTMLElement, name: string): string {
-	return getComputedStyle(el).getPropertyValue(name).trim().replace('#', '');
-}
-
-function isDark(hex: string): boolean {
-	if (hex.length < 6) {
-		return true;
-	}
-	const r = parseInt(hex.slice(0, 2), 16);
-	const g = parseInt(hex.slice(2, 4), 16);
-	const b = parseInt(hex.slice(4, 6), 16);
-	return 0.299 * r + 0.587 * g + 0.114 * b < 128;
-}
-
-export function defineJsonEditorTheme(monaco: Monaco, el: HTMLElement): void {
-	const background = token(el, '--l1-background');
-	const foreground = token(el, '--l1-foreground');
-	const keyColor = token(el, '--bg-vanilla-400');
-	const valueColor = token(el, '--bg-robin-400');
-
-	// Both token colours are picked to read on a dark surface, so on a light one
-	// they wash out, the keys worst of all. Monaco's own `vs` palette is built
-	// for that surface, so let it keep its colours there, as the role viewer does.
-	const rules: { token: string; foreground: string }[] = [];
-	if (isDark(background)) {
-		if (keyColor) {
-			rules.push({ token: 'string.key.json', foreground: keyColor });
-		}
-		if (valueColor) {
-			rules.push({ token: 'string.value.json', foreground: valueColor });
-		}
-	}
-
-	const colors: Record<string, string> = {};
-	if (background) {
-		colors['editor.background'] = `#${background}`;
-	}
-	if (foreground) {
-		colors['editor.foreground'] = `#${foreground}`;
-	}
-
-	monaco.editor.defineTheme(JSON_EDITOR_THEME, {
-		base: isDark(background) ? 'vs-dark' : 'vs',
-		inherit: true,
-		rules,
-		colors,
-	});
-}

frontend/src/mocks-server/__mockdata__/alert_rules.ts

@@ -1,10 +1,8 @@
 import {
 	RuletypesAlertStateDTO,
 	RuletypesAlertTypeDTO,
-	RuletypesEvaluationRollingDTOKind,
 	RuletypesPanelTypeDTO,
 	RuletypesQueryTypeDTO,
-	RuletypesRuleDTOSchemaVersion,
 	RuletypesRuleTypeDTO,
 } from 'api/generated/services/sigNoz.schemas';
 import type {
@@ -40,12 +38,6 @@ const make = (
 	evalWindow: '5m0s',
 	frequency: '1m0s',
 	ruleType: RuletypesRuleTypeDTO.threshold_rule,
-	schemaVersion: RuletypesRuleDTOSchemaVersion.v2alpha1,
-	evaluation: {
-		kind: RuletypesEvaluationRollingDTOKind.rolling,
-		spec: { evalWindow: '5m0s', frequency: '1m0s' },
-	},
-	notificationSettings: { usePolicy: false, renotify: { enabled: false } },
 	...overrides,
 });
 

frontend/src/pages/AlertList/NotificationChannels/components/ChannelJsonDialog/ChannelJsonDialog.tsx

@@ -1,15 +1,11 @@
 import { useCallback, useEffect, useMemo, useState } from 'react';
 import { useCopyToClipboard } from 'react-use';
-import MEditor from '@monaco-editor/react';
 import { DrawerWrapper } from '@signozhq/ui/drawer';
 import { useGetNotificationChannel } from 'api/generated/services/channels';
 import ErrorEmptyState from 'components/Alerts/ErrorEmptyState';
 import Spinner from 'components/Spinner';
-import { READONLY_EDITOR_OPTIONS } from 'container/RolesSettings/monaco.config';
-import {
-	defineJsonEditorTheme,
-	JSON_EDITOR_THEME,
-} from 'lib/monaco/jsonEditorTheme';
+import { READONLY_EDITOR_OPTIONS } from 'lib/monaco/editorOptions';
+import MonacoEditor from 'lib/monaco/MonacoEditor';
 
 import { channelToJson, hasSecrets } from '../../utils/channelJson';
 import styles from './ChannelJsonDialog.module.scss';
@@ -92,18 +88,11 @@ function ChannelJsonDialog({
 					/>
 
 					<div className={styles.editor}>
-						<MEditor
+						<MonacoEditor
 							value={json}
 							language="json"
 							options={READONLY_EDITOR_OPTIONS}
 							height="100%"
-							theme="vs-dark"
-							// the same theme the dashboard JSON drawer uses: it reads the
-							// page's own tokens, so it follows light and dark
-							onMount={(editor, monaco): void => {
-								defineJsonEditorTheme(monaco, editor.getContainerDomNode());
-								monaco.editor.setTheme(JSON_EDITOR_THEME);
-							}}
 						/>
 					</div>
 				</div>

frontend/src/pages/AlertList/stories/__story_mockdata__/alerts.ts

@@ -18,7 +18,6 @@ import {
 	RuletypesMatchTypeDTO,
 	RuletypesPanelTypeDTO,
 	RuletypesQueryTypeDTO,
-	RuletypesRuleDTOSchemaVersion,
 	RuletypesRuleTypeDTO,
 	RuletypesSeasonalityDTO,
 	RuletypesThresholdBasicDTOKind,
@@ -35,6 +34,7 @@ import {
 	type AlertmanagertypesGettableNotificationChannelDTO,
 	type AlertmanagertypesListedNotificationChannelDTO,
 } from 'api/generated/services/sigNoz.schemas';
+import { NEW_ALERT_SCHEMA_VERSION } from 'types/api/alerts/alertTypesV2';
 
 const MINUTE = 60 * 1000;
 const HOUR = 60 * MINUTE;
@@ -388,18 +388,18 @@ const buildRule = (index: number, shape: RuleShape): RuletypesRuleDTO => {
 		},
 		evalWindow: isAnomaly ? '1h0m0s' : '5m0s',
 		frequency: '1m0s',
-		evaluation: {
-			kind: RuletypesEvaluationRollingDTOKind.rolling,
-			spec: { evalWindow: isAnomaly ? '1h0m0s' : '5m0s', frequency: '1m0s' },
-		},
+		...(isAnomaly && {
+			evaluation: {
+				kind: RuletypesEvaluationRollingDTOKind.rolling,
+				spec: { evalWindow: '1h0m0s', frequency: '1m0s' },
+			},
+		}),
 		createdAt: ago((index + 3) * DAY),
 		updatedAt: ago((index + 1) * HOUR),
 		createdBy: 'ada@signoz.io',
 		updatedBy: 'grace@signoz.io',
-		// classic rows predate schemaVersion, which the spec now requires
-		schemaVersion: (shape.schema === 'classic'
-			? undefined
-			: RuletypesRuleDTOSchemaVersion.v2alpha1) as RuletypesRuleDTOSchemaVersion,
+		schemaVersion:
+			shape.schema === 'classic' ? undefined : NEW_ALERT_SCHEMA_VERSION,
 		version: 'v5',
 		source: 'http://localhost/alerts',
 		preferredChannels: ['ops-slack'],

frontend/src/pages/DashboardPage/DashboardContainer/DashboardPageToolbar/JsonEditorDrawer/JsonEditorDrawer.tsx

@@ -1,5 +1,4 @@
 import { KeyboardEvent, useCallback } from 'react';
-import MEditor from '@monaco-editor/react';
 import { TriangleAlert } from '@signozhq/icons';
 import { Button } from '@signozhq/ui/button';
 import { Tooltip } from '@signozhq/ui/tooltip';
@@ -12,10 +11,7 @@ import { DashboardDetailEvents } from 'pages/DashboardPage/constants/events';
 import { useCopyToClipboard } from 'react-use';
 import { toast } from '@signozhq/ui/sonner';
 
-import {
-	defineJsonEditorTheme,
-	JSON_EDITOR_THEME,
-} from 'lib/monaco/jsonEditorTheme';
+import MonacoEditor from 'lib/monaco/MonacoEditor';
 import styles from './JsonEditorDrawer.module.scss';
 import JsonEditorToolbar from './JsonEditorToolbar';
 import { useJsonEditor } from './useJsonEditor';
@@ -213,7 +209,7 @@ function JsonEditorDrawer({
 					onReset={reset}
 				/>
 				<div className={styles.editor}>
-					<MEditor
+					<MonacoEditor
 						language="json"
 						height="100%"
 						value={draft}
@@ -225,10 +221,7 @@ function JsonEditorDrawer({
 							fontSize: 13,
 							fontFamily: 'Space Mono',
 						}}
-						theme="vs-dark"
-						onMount={(editor, monaco): void => {
-							defineJsonEditorTheme(monaco, editor.getContainerDomNode());
-							monaco.editor.setTheme(JSON_EDITOR_THEME);
+						onMount={(_editor, monaco): void => {
 							void document.fonts.ready.then(() => monaco.editor.remeasureFonts());
 						}}
 					/>

frontend/src/pages/DashboardPage/PanelEditorPage/stories/PanelEditorPage.stories.tsx

@@ -1,11 +1,13 @@
 import type { ComponentType } from 'react';
 import type { Meta, StoryObj } from '@storybook/react-vite';
 import { Route } from 'react-router-dom';
+import * as monaco from 'monaco-editor';
 import ROUTES from 'constants/routes';
-import { screen, userEvent, within } from 'storybook/test';
+import { screen, userEvent, waitFor, within } from 'storybook/test';
 
 import { storyMocks } from '@/storybook/controls/defineStoryMocks';
 import type { PageStoryArgs } from '@/storybook/runtime/resolveStory';
+import { waitForMonacoText } from '@/storybook/visual/waitForMonacoText';
 
 import { panelEditorMocks, savePanel } from './PanelEditorPage.stories.mocks';
 
@@ -249,3 +251,43 @@ export const TextPanelSavedToast: Story = {
 	args: { panel: 'new', newPanelKind: 'text' },
 	play: PanelSavedToast.play,
 };
+
+const CLICKHOUSE_QUERY =
+	'SELECT toStartOfInterval(timestamp, INTERVAL 1 MINUTE) AS ts, serviceName, count() AS calls FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp > now() - INTERVAL 1 HOUR GROUP BY ts, serviceName ORDER BY ts';
+
+/**
+ * The ClickHouse Query tab with a query written in its SQL editor, over the
+ * panel the editor opened on.
+ */
+export const ClickHouseQuery: Story = {
+	play: async ({ canvasElement }): Promise<void> => {
+		const tab = await within(canvasElement).findByRole(
+			'tab',
+			{ name: /ClickHouse Query/ },
+			{ timeout: 10000 },
+		);
+
+		await userEvent.click(tab);
+
+		// Typing into Monaco's hidden textarea never reaches its model in this runner.
+		const model = await waitFor(
+			() => {
+				const found = monaco.editor
+					.getModels()
+					.find((candidate) => candidate.getLanguageId() === 'sql');
+
+				if (!found) {
+					throw new Error('The SQL editor has not mounted');
+				}
+
+				return found;
+			},
+			{ timeout: 15000 },
+		);
+
+		model.setValue(CLICKHOUSE_QUERY);
+		await waitForMonacoText(canvasElement);
+		await userEvent.unhover(tab);
+		(document.activeElement as HTMLElement | null)?.blur();
+	},
+};

frontend/src/pages/DashboardsListPage/components/NewDashboardModal/JsonEditor.tsx

@@ -1,10 +1,8 @@
 import { useState } from 'react';
-import MEditor, { Monaco } from '@monaco-editor/react';
-import { Color } from '@signozhq/design-tokens';
 import { Button } from '@signozhq/ui/button';
 import { DialogWrapper } from '@signozhq/ui/dialog';
 import { Maximize2 } from '@signozhq/icons';
-import { useIsDarkMode } from 'hooks/useDarkMode';
+import MonacoEditor from 'lib/monaco/MonacoEditor';
 
 import styles from './NewDashboardModal.module.scss';
 
@@ -15,18 +13,6 @@ interface Props {
 	height?: string;
 }
 
-const defineTheme = (monaco: Monaco): void => {
-	monaco.editor.defineTheme('my-theme', {
-		base: 'vs-dark',
-		inherit: true,
-		rules: [
-			{ token: 'string.key.json', foreground: Color.BG_VANILLA_400 },
-			{ token: 'string.value.json', foreground: Color.BG_ROBIN_400 },
-		],
-		colors: { 'editor.background': Color.BG_INK_300 },
-	});
-};
-
 // JSON editor with a one-click "expand" into an extra-wide modal for easier
 // editing/review. The expanded editor shares the same value, so edits persist.
 function JsonEditor({
@@ -35,11 +21,10 @@ function JsonEditor({
 	readOnly = false,
 	height = '38vh',
 }: Props): JSX.Element {
-	const isDarkMode = useIsDarkMode();
 	const [expanded, setExpanded] = useState(false);
 
 	const renderEditor = (editorHeight: string): JSX.Element => (
-		<MEditor
+		<MonacoEditor
 			language="json"
 			height={editorHeight}
 			value={value}
@@ -51,8 +36,6 @@ function JsonEditor({
 				fontSize: 14,
 				fontFamily: 'Space Mono',
 			}}
-			theme={isDarkMode ? 'my-theme' : 'light'}
-			beforeMount={defineTheme}
 		/>
 	);
 

frontend/src/pages/LLMObservability/AttributeMapping/stories/AttributeMapping.stories.tsx

@@ -3,6 +3,7 @@ import { expect, screen, userEvent, waitFor, within } from 'storybook/test';
 
 import { storyMocks } from '@/storybook/controls/defineStoryMocks';
 import type { PageStoryArgs } from '@/storybook/runtime/resolveStory';
+import { waitForMonacoText } from '@/storybook/visual/waitForMonacoText';
 
 import LLMObservabilityPage from '../../index';
 import {
@@ -101,3 +102,21 @@ export const ChangesSavedToast: Story = {
 		}
 	},
 };
+
+/**
+ * The Test tab: the JSON editor pre-filled with the sample span, before any run.
+ */
+export const TestTab: Story = {
+	play: async ({ canvasElement }): Promise<void> => {
+		const tab = await within(canvasElement).findByRole(
+			'tab',
+			{ name: 'Test' },
+			{ timeout: 10000 },
+		);
+
+		await userEvent.click(tab);
+		await waitForMonacoText(canvasElement);
+		await userEvent.unhover(tab);
+		(document.activeElement as HTMLElement | null)?.blur();
+	},
+};

frontend/src/pages/TraceDetailsV3/stories/TraceDetailsV3.stories.tsx

@@ -12,6 +12,7 @@ import {
 
 import { storyMocks } from '@/storybook/controls/defineStoryMocks';
 import type { PageStoryArgs } from '@/storybook/runtime/resolveStory';
+import { waitForMonacoText } from '@/storybook/visual/waitForMonacoText';
 
 import {
 	focusSpanIndex,
@@ -325,3 +326,19 @@ export const TraceExportCancelledToast: Story = {
 		await userEvent.click(await screen.findByTestId('trace-download-cancel'));
 	},
 };
+
+/** The span panel switched from the pretty view to the span's raw JSON. */
+export const SpanJsonView: Story = {
+	play: async ({ canvasElement }): Promise<void> => {
+		const option = await within(canvasElement).findByTestId(
+			'data-viewer-view-mode-button-json',
+			undefined,
+			untilLoaded,
+		);
+
+		await userEvent.click(option);
+		await waitForMonacoText(canvasElement);
+		await userEvent.unhover(option);
+		(document.activeElement as HTMLElement | null)?.blur();
+	},
+};

frontend/src/periscope/components/JsonView/JsonView.tsx

@@ -1,9 +1,8 @@
 import { useState } from 'react';
-import MEditor, { EditorProps, Monaco } from '@monaco-editor/react';
-import { Color } from '@signozhq/design-tokens';
+import { EditorProps } from '@monaco-editor/react';
 import { Switch } from '@signozhq/ui/switch';
 import { Typography } from '@signozhq/ui/typography';
-import { useIsDarkMode } from 'hooks/useDarkMode';
+import MonacoEditor from 'lib/monaco/MonacoEditor';
 
 import './JsonView.styles.scss';
 
@@ -38,36 +37,16 @@ const editorOptions: EditorProps['options'] = {
 	folding: false,
 };
 
-function setEditorTheme(monaco: Monaco): void {
-	monaco.editor.defineTheme('signoz-dark', {
-		base: 'vs-dark',
-		inherit: true,
-		rules: [
-			{ token: 'string.key.json', foreground: Color.BG_VANILLA_400 },
-			{ token: 'string.value.json', foreground: Color.BG_ROBIN_400 },
-		],
-		colors: {
-			'editor.background': '#00000000', // transparent
-		},
-		fontFamily: 'SF Mono, Geist Mono, Fira Code, monospace',
-		fontSize: 12,
-		fontWeight: 'normal',
-		lineHeight: 18,
-		letterSpacing: -0.06,
-	});
-}
-
 function JsonView({
 	data,
 	height = '575px',
 	fontSize = 12,
 }: JsonViewProps): JSX.Element {
 	const [isWrapWord, setIsWrapWord] = useState(true);
-	const isDarkMode = useIsDarkMode();
 
 	return (
 		<div className="json-view">
-			<MEditor
+			<MonacoEditor
 				value={data}
 				language="json"
 				options={{
@@ -77,8 +56,6 @@ function JsonView({
 				}}
 				onChange={(): void => {}}
 				height={height}
-				theme={isDarkMode ? 'signoz-dark' : 'light'}
-				beforeMount={setEditorTheme}
 			/>
 			<div className="json-view__footer">
 				<div className="json-view__wrap-toggle">

frontend/src/storybook/visual/waitForMonacoText.ts

@@ -0,0 +1,26 @@
+import { waitFor } from 'storybook/test';
+
+/**
+ * Monaco mounts its container before its language loads, so the editor is on
+ * screen while still blank or uncoloured. Waits for text with at least two
+ * token colours, which only exists once the tokenizer has run.
+ */
+export const waitForMonacoText = async (
+	canvasElement: HTMLElement,
+): Promise<void> => {
+	await waitFor(
+		() => {
+			const lines = canvasElement.querySelector('.monaco-editor .view-lines');
+			const tokens = new Set(
+				Array.from(lines?.querySelectorAll('span[class^="mtk"]') ?? []).map(
+					(token) => token.className,
+				),
+			);
+
+			if (!lines?.textContent?.trim() || tokens.size < 2) {
+				throw new Error('Monaco has not rendered its text');
+			}
+		},
+		{ timeout: 15_000 },
+	);
+};

pkg/alertmanager/alertmanager.go

@@ -34,9 +34,6 @@ type Alertmanager interface {
 	// ListChannels lists all channels for the organization.
 	ListChannels(context.Context, string) ([]*alertmanagertypes.Channel, error)
 
-	// GetChannelIDsByNames resolves display names to channel ids and rejects unknown names.
-	GetChannelIDsByNames(context.Context, string, []string) ([]string, error)
-
 	// ListAllChannels lists all channels for all organizations. It is used by the legacy alertmanager only.
 	ListAllChannels(context.Context) ([]*alertmanagertypes.Channel, error)
 

pkg/alertmanager/alertmanagertest/alertmanager.go

@@ -1023,80 +1023,6 @@ func (_c *MockAlertmanager_GetChannelByID_Call) RunAndReturn(run func(context1 c
 	return _c
 }
 
-// GetChannelIDsByNames provides a mock function for the type MockAlertmanager
-func (_mock *MockAlertmanager) GetChannelIDsByNames(context1 context.Context, s string, strings []string) ([]string, error) {
-	ret := _mock.Called(context1, s, strings)
-
-	if len(ret) == 0 {
-		panic("no return value specified for GetChannelIDsByNames")
-	}
-
-	var r0 []string
-	var r1 error
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, []string) ([]string, error)); ok {
-		return returnFunc(context1, s, strings)
-	}
-	if returnFunc, ok := ret.Get(0).(func(context.Context, string, []string) []string); ok {
-		r0 = returnFunc(context1, s, strings)
-	} else {
-		if ret.Get(0) != nil {
-			r0 = ret.Get(0).([]string)
-		}
-	}
-	if returnFunc, ok := ret.Get(1).(func(context.Context, string, []string) error); ok {
-		r1 = returnFunc(context1, s, strings)
-	} else {
-		r1 = ret.Error(1)
-	}
-	return r0, r1
-}
-
-// MockAlertmanager_GetChannelIDsByNames_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetChannelIDsByNames'
-type MockAlertmanager_GetChannelIDsByNames_Call struct {
-	*mock.Call
-}
-
-// GetChannelIDsByNames is a helper method to define mock.On call
-//   - context1 context.Context
-//   - s string
-//   - strings []string
-func (_e *MockAlertmanager_Expecter) GetChannelIDsByNames(context1 any, s any, strings any) *MockAlertmanager_GetChannelIDsByNames_Call {
-	return &MockAlertmanager_GetChannelIDsByNames_Call{Call: _e.mock.On("GetChannelIDsByNames", context1, s, strings)}
-}
-
-func (_c *MockAlertmanager_GetChannelIDsByNames_Call) Run(run func(context1 context.Context, s string, strings []string)) *MockAlertmanager_GetChannelIDsByNames_Call {
-	_c.Call.Run(func(args mock.Arguments) {
-		var arg0 context.Context
-		if args[0] != nil {
-			arg0 = args[0].(context.Context)
-		}
-		var arg1 string
-		if args[1] != nil {
-			arg1 = args[1].(string)
-		}
-		var arg2 []string
-		if args[2] != nil {
-			arg2 = args[2].([]string)
-		}
-		run(
-			arg0,
-			arg1,
-			arg2,
-		)
-	})
-	return _c
-}
-
-func (_c *MockAlertmanager_GetChannelIDsByNames_Call) Return(strings1 []string, err error) *MockAlertmanager_GetChannelIDsByNames_Call {
-	_c.Call.Return(strings1, err)
-	return _c
-}
-
-func (_c *MockAlertmanager_GetChannelIDsByNames_Call) RunAndReturn(run func(context1 context.Context, s string, strings []string) ([]string, error)) *MockAlertmanager_GetChannelIDsByNames_Call {
-	_c.Call.Return(run)
-	return _c
-}
-
 // GetConfig provides a mock function for the type MockAlertmanager
 func (_mock *MockAlertmanager) GetConfig(context1 context.Context, s string) (*alertmanagertypes.Config, error) {
 	ret := _mock.Called(context1, s)

pkg/alertmanager/signozalertmanager/provider.go

@@ -147,19 +147,6 @@ func (provider *provider) ListChannels(ctx context.Context, orgID string) ([]*al
 	return channels, err
 }
 
-func (provider *provider) GetChannelIDsByNames(ctx context.Context, orgID string, names []string) ([]string, error) {
-	if len(names) == 0 {
-		return nil, nil
-	}
-
-	channels, _, err := provider.configStore.ListChannels(ctx, orgID, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	return alertmanagertypes.MapChannelNamesToIDs(channels, names)
-}
-
 func (provider *provider) ListNotificationChannels(ctx context.Context, orgID string, params *alertmanagertypes.ListChannelsParams) (*alertmanagertypes.ListableNotificationChannel, error) {
 	channels, total, err := provider.configStore.ListChannels(ctx, orgID, params)
 	if err != nil {
@@ -541,10 +528,6 @@ func (provider *provider) CreateRoutePolicy(ctx context.Context, routeRequest *a
 		return nil, err
 	}
 
-	if _, err := provider.GetChannelIDsByNames(ctx, orgID.String(), routeRequest.Channels); err != nil {
-		return nil, err
-	}
-
 	route := alertmanagertypes.RoutePolicy{
 		Expression:     routeRequest.Expression,
 		ExpressionKind: routeRequest.ExpressionKind,
@@ -737,10 +720,6 @@ func (provider *provider) UpdateRoutePolicyByID(ctx context.Context, routeID str
 		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid route: %v", err)
 	}
 
-	if _, err := provider.GetChannelIDsByNames(ctx, orgID.String(), route.Channels); err != nil {
-		return nil, err
-	}
-
 	existingRoute, err := provider.notificationManager.GetRoutePolicyByID(ctx, claims.OrgID, routeID)
 	if err != nil {
 		return nil, errors.NewInvalidInputf(errors.CodeNotFound, "route not found: %v", err)

pkg/apiserver/signozapiserver/alertmanager.go

@@ -4,7 +4,6 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/ruler"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
@@ -331,167 +330,88 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetAllRoutePolicies, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetAllRoutePolicies",
-			Tags:                []string{"routepolicies"},
-			Summary:             "List route policies",
-			Description:         "This endpoint lists all route policies for the organization",
-			Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRoutePolicy,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetAllRoutePolicies), handler.OpenAPIDef{
+		ID:                  "GetAllRoutePolicies",
+		Tags:                []string{"routepolicies"},
+		Summary:             "List route policies",
+		Description:         "This endpoint lists all route policies for the organization",
+		Request:             nil,
+		RequestContentType:  "",
+		Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetRoutePolicyByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetRoutePolicyByID",
-			Tags:                []string{"routepolicies"},
-			Summary:             "Get route policy by ID",
-			Description:         "This endpoint returns a route policy by ID",
-			Response:            new(alertmanagertypes.GettableRoutePolicy),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRoutePolicy,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetRoutePolicyByID), handler.OpenAPIDef{
+		ID:                  "GetRoutePolicyByID",
+		Tags:                []string{"routepolicies"},
+		Summary:             "Get route policy by ID",
+		Description:         "This endpoint returns a route policy by ID",
+		Request:             nil,
+		RequestContentType:  "",
+		Response:            new(alertmanagertypes.GettableRoutePolicy),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.CreateRoutePolicy, authtypes.SigNozAdminRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CreateRoutePolicy",
-			Tags:                []string{"routepolicies"},
-			Summary:             "Create route policy",
-			Description:         "This endpoint creates a route policy",
-			Request:             new(alertmanagertypes.PostableRoutePolicy),
-			RequestContentType:  "application/json",
-			Response:            new(alertmanagertypes.GettableRoutePolicy),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes: newScopedSecuritySchemes([]string{
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-			}),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRoutePolicy,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.ResponseJSONPath("data.id"),
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
-				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewCreateRoutePolicyChannelAttachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.CreateRoutePolicy), handler.OpenAPIDef{
+		ID:                  "CreateRoutePolicy",
+		Tags:                []string{"routepolicies"},
+		Summary:             "Create route policy",
+		Description:         "This endpoint creates a route policy",
+		Request:             new(alertmanagertypes.PostableRoutePolicy),
+		RequestContentType:  "application/json",
+		Response:            new(alertmanagertypes.GettableRoutePolicy),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.UpdateRoutePolicy, authtypes.SigNozAdminRoleName),
-		handler.OpenAPIDef{
-			ID:                  "UpdateRoutePolicy",
-			Tags:                []string{"routepolicies"},
-			Summary:             "Update route policy",
-			Description:         "This endpoint updates a route policy by ID",
-			Request:             new(alertmanagertypes.PostableRoutePolicy),
-			RequestContentType:  "application/json",
-			Response:            new(alertmanagertypes.GettableRoutePolicy),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes([]string{
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbUpdate),
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbDetach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
-			}),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRoutePolicy,
-				Verb:     coretypes.VerbUpdate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewUpdateRoutePolicyChannelAttachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbDetach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewUpdateRoutePolicyChannelDetachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-		),
-	)).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.UpdateRoutePolicy), handler.OpenAPIDef{
+		ID:                  "UpdateRoutePolicy",
+		Tags:                []string{"routepolicies"},
+		Summary:             "Update route policy",
+		Description:         "This endpoint updates a route policy by ID",
+		Request:             new(alertmanagertypes.PostableRoutePolicy),
+		RequestContentType:  "application/json",
+		Response:            new(alertmanagertypes.GettableRoutePolicy),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.DeleteRoutePolicyByID, authtypes.SigNozAdminRoleName),
-		handler.OpenAPIDef{
-			ID:                "DeleteRoutePolicyByID",
-			Tags:              []string{"routepolicies"},
-			Summary:           "Delete route policy",
-			Description:       "This endpoint deletes a route policy by ID",
-			SuccessStatusCode: http.StatusNoContent,
-			ErrorStatusCodes:  []int{http.StatusNotFound},
-			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbDelete)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRoutePolicy,
-			Verb:     coretypes.VerbDelete,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.DeleteRoutePolicyByID), handler.OpenAPIDef{
+		ID:                  "DeleteRoutePolicyByID",
+		Tags:                []string{"routepolicies"},
+		Summary:             "Delete route policy",
+		Description:         "This endpoint deletes a route policy by ID",
+		Request:             nil,
+		RequestContentType:  "",
+		Response:            nil,
+		ResponseContentType: "",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		Deprecated:          false,
+		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 

pkg/apiserver/signozapiserver/provider.go

@@ -91,11 +91,9 @@ type provider struct {
 	ruleStateHistoryHandler    rulestatehistory.Handler
 	spanMapperHandler          spanmapper.Handler
 	alertmanagerHandler        alertmanager.Handler
-	alertmanagerService        alertmanager.Alertmanager
 	prometheusHandler          prometheus.Handler
 	traceDetailHandler         tracedetail.Handler
 	rulerHandler               ruler.Handler
-	rulerService               ruler.Ruler
 	llmPricingRuleHandler      llmpricingrule.Handler
 	statsHandler               statsreporter.Handler
 	savedViewHandler           savedview.Handler
@@ -138,12 +136,10 @@ func NewFactory(
 	ruleStateHistoryHandler rulestatehistory.Handler,
 	spanMapperHandler spanmapper.Handler,
 	alertmanagerHandler alertmanager.Handler,
-	alertmanagerService alertmanager.Alertmanager,
 	prometheusHandler prometheus.Handler,
 	llmPricingRuleHandler llmpricingrule.Handler,
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
-	rulerService ruler.Ruler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
 	globalConfig global.Config,
@@ -193,12 +189,10 @@ func NewFactory(
 			ruleStateHistoryHandler,
 			spanMapperHandler,
 			alertmanagerHandler,
-			alertmanagerService,
 			prometheusHandler,
 			llmPricingRuleHandler,
 			traceDetailHandler,
 			rulerHandler,
-			rulerService,
 			statsHandler,
 			savedViewHandler,
 			globalConfig,
@@ -250,12 +244,10 @@ func newProvider(
 	ruleStateHistoryHandler rulestatehistory.Handler,
 	spanMapperHandler spanmapper.Handler,
 	alertmanagerHandler alertmanager.Handler,
-	alertmanagerService alertmanager.Alertmanager,
 	prometheusHandler prometheus.Handler,
 	llmPricingRuleHandler llmpricingrule.Handler,
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
-	rulerService ruler.Ruler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
 	globalConfig global.Config,
@@ -307,11 +299,9 @@ func newProvider(
 		ruleStateHistoryHandler:    ruleStateHistoryHandler,
 		spanMapperHandler:          spanMapperHandler,
 		alertmanagerHandler:        alertmanagerHandler,
-		alertmanagerService:        alertmanagerService,
 		prometheusHandler:          prometheusHandler,
 		traceDetailHandler:         traceDetailHandler,
 		rulerHandler:               rulerHandler,
-		rulerService:               rulerService,
 		llmPricingRuleHandler:      llmPricingRuleHandler,
 		statsHandler:               statsHandler,
 		savedViewHandler:           savedViewHandler,

pkg/apiserver/signozapiserver/ruler.go

@@ -4,633 +4,273 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/ruler"
+	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addRulerRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/rules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "ListRules",
-			Tags:                []string{"rules"},
-			Summary:             "List alert rules",
-			Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
-			Response:            make([]*ruletypes.Rule, 0),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			Deprecated:          true,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRules), handler.OpenAPIDef{
+		ID:                  "ListRules",
+		Tags:                []string{"rules"},
+		Summary:             "List alert rules",
+		Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
+		Response:            make([]*ruletypes.Rule, 0),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		Deprecated:          true,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v3/rules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRulesV3, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "ListRulesV3",
-			Tags:                []string{"rules"},
-			Summary:             "List alert rules (v3)",
-			Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). In the filter DSL, a non-reserved key is matched as a rule label directly (`team = infra`); a key that collides with a reserved keyword matches either interpretation (negative operators exclude both), and `labels.<key>` targets only the label. The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
-			RequestQuery:        new(ruletypes.ListRulesParams),
-			Response:            new(ruletypes.ListableRules),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v3/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRulesV3), handler.OpenAPIDef{
+		ID:                  "ListRulesV3",
+		Tags:                []string{"rules"},
+		Summary:             "List alert rules (v3)",
+		Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). In the filter DSL, a non-reserved key is matched as a rule label directly (`team = infra`); a key that collides with a reserved keyword matches either interpretation (negative operators exclude both), and `labels.<key>` targets only the label. The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
+		RequestQuery:        new(ruletypes.ListRulesParams),
+		Response:            new(ruletypes.ListableRules),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetRuleByID",
-			Tags:                []string{"rules"},
-			Summary:             "Get alert rule by ID",
-			Description:         "This endpoint returns an alert rule by ID",
-			Response:            new(ruletypes.Rule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetRuleByID), handler.OpenAPIDef{
+		ID:                  "GetRuleByID",
+		Tags:                []string{"rules"},
+		Summary:             "Get alert rule by ID",
+		Description:         "This endpoint returns an alert rule by ID",
+		Response:            new(ruletypes.Rule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CreateRule",
-			Tags:                []string{"rules"},
-			Summary:             "Create alert rule",
-			Description:         "This endpoint creates a new alert rule",
-			Request:             new(ruletypes.PostableRule),
-			RequestContentType:  "application/json",
-			RequestExamples:     postableRuleExamples(),
-			Response:            new(ruletypes.Rule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.ResponseJSONPath("data.id"),
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewCreateRuleChannelAttachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewRuleBodyTelemetryResources(),
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateRule), handler.OpenAPIDef{
+		ID:                  "CreateRule",
+		Tags:                []string{"rules"},
+		Summary:             "Create alert rule",
+		Description:         "This endpoint creates a new alert rule",
+		Request:             new(ruletypes.PostableRule),
+		RequestContentType:  "application/json",
+		RequestExamples:     postableRuleExamples(),
+		Response:            new(ruletypes.Rule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}/clone", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.CloneRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CloneRuleByID",
-			Tags:                []string{"rules"},
-			Summary:             "Clone alert rule",
-			Description:         "This endpoint creates a new alert rule from the stored definition of an existing one. The clone keeps every modeled field of the source, including its enabled/disabled state, and gets the source's name suffixed with \" - Copy\" (or a bumped \" - Copy (n)\" counter when the source is itself a copy). The clone is owned by the caller.",
-			Response:            new(ruletypes.Rule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbRead,
-				Category: coretypes.ActionCategoryDataAccess,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.ResponseJSONPath("data.id"),
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewCloneRuleChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewRuleQueryTelemetryResources(provider.rulerService),
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
-		return err
-	}
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                 "UpdateRuleByID",
-			Tags:               []string{"rules"},
-			Summary:            "Update alert rule",
-			Description:        "This endpoint updates an alert rule by ID",
-			Request:            new(ruletypes.PostableRule),
-			RequestContentType: "application/json",
-			RequestExamples:    postableRuleExamples(),
-			SuccessStatusCode:  http.StatusNoContent,
-			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbUpdate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewReplaceRuleChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbDetach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewReplaceRuleChannelDetachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewRuleBodyTelemetryResources(),
-			},
-		),
-	)).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}/clone", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CloneRuleByID), handler.OpenAPIDef{
+		ID:                  "CloneRuleByID",
+		Tags:                []string{"rules"},
+		Summary:             "Clone alert rule",
+		Description:         "This endpoint creates a new alert rule from the stored definition of an existing one. The clone keeps every modeled field of the source, including its enabled/disabled state, and gets the source's name suffixed with \" - Copy\" (or a bumped \" - Copy (n)\" counter when the source is itself a copy). The clone is owned by the caller.",
+		Response:            new(ruletypes.Rule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                "DeleteRuleByID",
-			Tags:              []string{"rules"},
-			Summary:           "Delete alert rule",
-			Description:       "This endpoint deletes an alert rule by ID",
-			SuccessStatusCode: http.StatusNoContent,
-			ErrorStatusCodes:  []int{http.StatusNotFound},
-			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDelete)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbDelete,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateRuleByID), handler.OpenAPIDef{
+		ID:                 "UpdateRuleByID",
+		Tags:               []string{"rules"},
+		Summary:            "Update alert rule",
+		Description:        "This endpoint updates an alert rule by ID",
+		Request:            new(ruletypes.PostableRule),
+		RequestContentType: "application/json",
+		RequestExamples:    postableRuleExamples(),
+		SuccessStatusCode:  http.StatusNoContent,
+		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.PatchRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "PatchRuleByID",
-			Tags:                []string{"rules"},
-			Summary:             "Patch alert rule",
-			Description:         "This endpoint applies a partial update to an alert rule by ID",
-			Request:             new(ruletypes.PostableRule),
-			RequestContentType:  "application/json",
-			RequestExamples:     postableRuleExamples(),
-			Response:            new(ruletypes.Rule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbUpdate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewPatchRuleChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbDetach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewPatchRuleChannelDetachExtractor(provider.alertmanagerService, provider.rulerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewOptionalRuleBodyTelemetryResources(),
-				Optional:  true,
-			},
-		),
-	)).Methods(http.MethodPatch).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteRuleByID), handler.OpenAPIDef{
+		ID:                "DeleteRuleByID",
+		Tags:              []string{"rules"},
+		Summary:           "Delete alert rule",
+		Description:       "This endpoint deletes an alert rule by ID",
+		SuccessStatusCode: http.StatusNoContent,
+		ErrorStatusCodes:  []int{http.StatusNotFound},
+		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/test", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.TestRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "TestRule",
-			Tags:                []string{"rules"},
-			Summary:             "Test alert rule",
-			Description:         "This endpoint fires a test notification for the given rule definition",
-			Request:             new(ruletypes.PostableRule),
-			RequestContentType:  "application/json",
-			RequestExamples:     postableRuleExamples(),
-			Response:            new(ruletypes.GettableTestRule),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes: newScopedSecuritySchemes(append([]string{
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
-			}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourceRule,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourceRule,
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
-				TargetIDs:      ruler.NewCreateRuleChannelAttachExtractor(provider.alertmanagerService),
-				TargetSelector: coretypes.IDSelector,
-			},
-			handler.TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  querybuilder.TelemetrySelector,
-				Resources: ruler.NewRuleBodyTelemetryResources(),
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.PatchRuleByID), handler.OpenAPIDef{
+		ID:                  "PatchRuleByID",
+		Tags:                []string{"rules"},
+		Summary:             "Patch alert rule",
+		Description:         "This endpoint applies a partial update to an alert rule by ID",
+		Request:             new(ruletypes.PostableRule),
+		RequestContentType:  "application/json",
+		RequestExamples:     postableRuleExamples(),
+		Response:            new(ruletypes.Rule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRuleViews, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "ListRuleViews",
-			Tags:                []string{"rules"},
-			Summary:             "List rule saved views",
-			Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
-			Response:            new(ruletypes.ListableRuleViews),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/test", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.TestRule), handler.OpenAPIDef{
+		ID:                  "TestRule",
+		Tags:                []string{"rules"},
+		Summary:             "Test alert rule",
+		Description:         "This endpoint fires a test notification for the given rule definition",
+		Request:             new(ruletypes.PostableRule),
+		RequestContentType:  "application/json",
+		RequestExamples:     postableRuleExamples(),
+		Response:            new(ruletypes.GettableTestRule),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CreateRuleView",
-			Tags:                []string{"rules"},
-			Summary:             "Create rule saved view",
-			Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
-			Request:             new(ruletypes.PostableRuleView),
-			RequestContentType:  "application/json",
-			Response:            new(ruletypes.RuleView),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRuleViews), handler.OpenAPIDef{
+		ID:                  "ListRuleViews",
+		Tags:                []string{"rules"},
+		Summary:             "List rule saved views",
+		Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
+		Response:            new(ruletypes.ListableRuleViews),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "UpdateRuleView",
-			Tags:                []string{"rules"},
-			Summary:             "Update rule saved view",
-			Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
-			Request:             new(ruletypes.UpdatableRuleView),
-			RequestContentType:  "application/json",
-			Response:            new(ruletypes.RuleView),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.CreateRuleView), handler.OpenAPIDef{
+		ID:                  "CreateRuleView",
+		Tags:                []string{"rules"},
+		Summary:             "Create rule saved view",
+		Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
+		Request:             new(ruletypes.PostableRuleView),
+		RequestContentType:  "application/json",
+		Response:            new(ruletypes.RuleView),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "DeleteRuleView",
-			Tags:                []string{"rules"},
-			Summary:             "Delete rule saved view",
-			Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusNoContent,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.UpdateRuleView), handler.OpenAPIDef{
+		ID:                  "UpdateRuleView",
+		Tags:                []string{"rules"},
+		Summary:             "Update rule saved view",
+		Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
+		Request:             new(ruletypes.UpdatableRuleView),
+		RequestContentType:  "application/json",
+		Response:            new(ruletypes.RuleView),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListDowntimeSchedules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "ListDowntimeSchedules",
-			Tags:                []string{"downtimeschedules"},
-			Summary:             "List downtime schedules",
-			Description:         "This endpoint lists all planned maintenance / downtime schedules",
-			RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
-			Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.DeleteRuleView), handler.OpenAPIDef{
+		ID:                  "DeleteRuleView",
+		Tags:                []string{"rules"},
+		Summary:             "Delete rule saved view",
+		Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetDowntimeScheduleByID",
-			Tags:                []string{"downtimeschedules"},
-			Summary:             "Get downtime schedule by ID",
-			Description:         "This endpoint returns a downtime schedule by ID",
-			Response:            new(alertmanagertypes.PlannedMaintenance),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusNotFound},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListDowntimeSchedules), handler.OpenAPIDef{
+		ID:                  "ListDowntimeSchedules",
+		Tags:                []string{"downtimeschedules"},
+		Summary:             "List downtime schedules",
+		Description:         "This endpoint lists all planned maintenance / downtime schedules",
+		RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
+		Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateDowntimeSchedule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                  "CreateDowntimeSchedule",
-			Tags:                []string{"downtimeschedules"},
-			Summary:             "Create downtime schedule",
-			Description:         "This endpoint creates a new planned maintenance / downtime schedule",
-			Request:             new(alertmanagertypes.PostablePlannedMaintenance),
-			RequestContentType:  "application/json",
-			Response:            new(alertmanagertypes.PlannedMaintenance),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusCreated,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			SecuritySchemes: newScopedSecuritySchemes([]string{
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbCreate),
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-			}),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				Verb:     coretypes.VerbCreate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.ResponseJSONPath("data.id"),
-				Selector: coretypes.WildcardSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
-				SourceSelector: coretypes.WildcardSelector,
-				TargetResource: coretypes.ResourceMetaResourceRule,
-				TargetIDs:      ruler.DowntimeRuleIDsExtractor,
-				TargetSelector: ruler.DowntimeRuleSelector,
-			},
-		),
-	)).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetDowntimeScheduleByID), handler.OpenAPIDef{
+		ID:                  "GetDowntimeScheduleByID",
+		Tags:                []string{"downtimeschedules"},
+		Summary:             "Get downtime schedule by ID",
+		Description:         "This endpoint returns a downtime schedule by ID",
+		Response:            new(alertmanagertypes.PlannedMaintenance),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusNotFound},
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                 "UpdateDowntimeScheduleByID",
-			Tags:               []string{"downtimeschedules"},
-			Summary:            "Update downtime schedule",
-			Description:        "This endpoint updates a downtime schedule by ID",
-			Request:            new(alertmanagertypes.PostablePlannedMaintenance),
-			RequestContentType: "application/json",
-			SuccessStatusCode:  http.StatusNoContent,
-			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-			SecuritySchemes: newScopedSecuritySchemes([]string{
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbUpdate),
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbDetach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
-				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
-			}),
-		},
-		handler.WithResourceDefs(
-			handler.BasicResourceDef{
-				Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				Verb:     coretypes.VerbUpdate,
-				Category: coretypes.ActionCategoryConfigurationChange,
-				ID:       coretypes.PathParam("id"),
-				Selector: coretypes.IDSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbAttach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceRule,
-				TargetIDs:      ruler.NewDowntimeRuleAttachExtractor(provider.rulerService),
-				TargetSelector: ruler.DowntimeRuleSelector,
-			},
-			handler.AttachDetachSiblingResourceDef{
-				Verb:           coretypes.VerbDetach,
-				Category:       coretypes.ActionCategoryConfigurationChange,
-				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
-				SourceSelector: coretypes.IDSelector,
-				TargetResource: coretypes.ResourceMetaResourceRule,
-				TargetIDs:      ruler.NewDowntimeRuleDetachExtractor(provider.rulerService),
-				TargetSelector: ruler.DowntimeRuleSelector,
-			},
-		),
-	)).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateDowntimeSchedule), handler.OpenAPIDef{
+		ID:                  "CreateDowntimeSchedule",
+		Tags:                []string{"downtimeschedules"},
+		Summary:             "Create downtime schedule",
+		Description:         "This endpoint creates a new planned maintenance / downtime schedule",
+		Request:             new(alertmanagertypes.PostablePlannedMaintenance),
+		RequestContentType:  "application/json",
+		Response:            new(alertmanagertypes.PlannedMaintenance),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusCreated,
+		ErrorStatusCodes:    []int{http.StatusBadRequest},
+		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
-		handler.OpenAPIDef{
-			ID:                "DeleteDowntimeScheduleByID",
-			Tags:              []string{"downtimeschedules"},
-			Summary:           "Delete downtime schedule",
-			Description:       "This endpoint deletes a downtime schedule by ID",
-			SuccessStatusCode: http.StatusNoContent,
-			ErrorStatusCodes:  []int{http.StatusNotFound},
-			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbDelete)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
-			Verb:     coretypes.VerbDelete,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateDowntimeScheduleByID), handler.OpenAPIDef{
+		ID:                 "UpdateDowntimeScheduleByID",
+		Tags:               []string{"downtimeschedules"},
+		Summary:            "Update downtime schedule",
+		Description:        "This endpoint updates a downtime schedule by ID",
+		Request:            new(alertmanagertypes.PostablePlannedMaintenance),
+		RequestContentType: "application/json",
+		SuccessStatusCode:  http.StatusNoContent,
+		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodPut).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteDowntimeScheduleByID), handler.OpenAPIDef{
+		ID:                "DeleteDowntimeScheduleByID",
+		Tags:              []string{"downtimeschedules"},
+		Summary:           "Delete downtime schedule",
+		Description:       "This endpoint deletes a downtime schedule by ID",
+		SuccessStatusCode: http.StatusNoContent,
+		ErrorStatusCodes:  []int{http.StatusNotFound},
+		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
+	})).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 

pkg/apiserver/signozapiserver/ruler_examples.go

@@ -221,15 +221,16 @@ func postableRuleExamples() []handler.OpenAPIExample {
 		},
 		{
 			Name:        "metric_anomaly",
-			Summary:     "Metric anomaly rule",
-			Description: "Wraps a builder query in the `anomaly` function with daily seasonality, so SigNoz compares each point against the forecast for that time of day. The threshold is compared against the signed anomaly score, so `below` with a target of -2 fires when an abrupt drop holds for the entire window; `requireMinPoints` guards against noisy intervals.",
+			Summary:     "Metric anomaly rule (v1 only)",
+			Description: "Anomaly rules are not yet supported under schemaVersion v2alpha1, so this example uses the v1 shape. Wraps a builder query in the `anomaly` function with daily seasonality SigNoz compares each point against the forecast for that time of day. Fires when the anomaly score stays below the threshold for the entire window; `requireMinPoints` guards against noisy intervals.",
 			Value: map[string]any{
-				"alert":         "Anomalous drop in ingested spans",
-				"alertType":     "METRIC_BASED_ALERT",
-				"description":   "Detect an abrupt drop in span ingestion using a z-score anomaly function",
-				"ruleType":      "anomaly_rule",
-				"version":       "v5",
-				"schemaVersion": "v2alpha1",
+				"alert":       "Anomalous drop in ingested spans",
+				"alertType":   "METRIC_BASED_ALERT",
+				"description": "Detect an abrupt drop in span ingestion using a z-score anomaly function",
+				"ruleType":    "anomaly_rule",
+				"version":     "v5",
+				"evalWindow":  "24h",
+				"frequency":   "3h",
 				"condition": map[string]any{
 					"compositeQuery": map[string]any{
 						"queryType": "builder",
@@ -255,29 +256,17 @@ func postableRuleExamples() []handler.OpenAPIExample {
 							},
 						},
 					},
+					"op":                "below",
+					"matchType":         "all_the_times",
+					"target":            2,
 					"algorithm":         "standard",
 					"seasonality":       "daily",
 					"selectedQueryName": "A",
 					"requireMinPoints":  true,
 					"requiredNumPoints": 3,
-					"thresholds": map[string]any{
-						"kind": "basic",
-						"spec": []any{
-							map[string]any{
-								"name":      "warning",
-								"op":        "below",
-								"matchType": "all_the_times",
-								"target":    -2,
-								"channels":  []any{"slack-ingestion"},
-							},
-						},
-					},
 				},
-				"evaluation": rolling("24h", "3h"),
-				"notificationSettings": map[string]any{
-					"renotify": renotify("4h", "firing"),
-				},
-				"labels": map[string]any{"severity": "warning"},
+				"labels":            map[string]any{"severity": "warning"},
+				"preferredChannels": []any{"slack-ingestion"},
 				"annotations": map[string]any{
 					"description": "Ingestion rate for tenant {{$tenant_id}} is anomalously low (z-score {{$value}}).",
 					"summary":     "Span ingestion anomaly",

pkg/apiserver/signozapiserver/rulestatehistory.go

@@ -4,10 +4,7 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/ruler"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/rulestatehistorytypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/gorilla/mux"
@@ -16,7 +13,7 @@ import (
 func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 
 	if err := router.Handle("/api/v2/rules/{id}/history/stats", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryStats, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryStats),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryStats",
 			Tags:                []string{"rules"},
@@ -27,21 +24,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/timeline", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTimeline",
 			Tags:                []string{"rules"},
@@ -52,26 +41,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}, handler.TelemetryResourceDef{
-			Verb:      coretypes.VerbRead,
-			Category:  coretypes.ActionCategoryDataAccess,
-			Selector:  querybuilder.TelemetrySelector,
-			Resources: ruler.NewRuleQueryTelemetryResources(provider.rulerService),
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/top_contributors", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryContributors, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryContributors),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTopContributors",
 			Tags:                []string{"rules"},
@@ -82,26 +58,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, telemetryReadScopes()...)),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}, handler.TelemetryResourceDef{
-			Verb:      coretypes.VerbRead,
-			Category:  coretypes.ActionCategoryDataAccess,
-			Selector:  querybuilder.TelemetrySelector,
-			Resources: ruler.NewRuleQueryTelemetryResources(provider.rulerService),
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/filter_keys", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterKeys",
 			Tags:                []string{"rules"},
@@ -112,26 +75,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, buildFieldScopes(coretypes.VerbList)...)),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}, handler.TelemetryResourceDef{
-			Verb:      coretypes.VerbList,
-			Category:  coretypes.ActionCategoryDataAccess,
-			Selector:  coretypes.WildcardSelector,
-			Resources: ruler.NewRuleQueryFieldResources(provider.rulerService),
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/filter_values", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterValues",
 			Tags:                []string{"rules"},
@@ -142,26 +92,13 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, buildFieldScopes(coretypes.VerbRead)...)),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}, handler.TelemetryResourceDef{
-			Verb:      coretypes.VerbRead,
-			Category:  coretypes.ActionCategoryDataAccess,
-			Selector:  coretypes.WildcardSelector,
-			Resources: ruler.NewRuleQueryFieldResources(provider.rulerService),
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/overall_status", handler.New(
-		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryOverallStatus",
 			Tags:                []string{"rules"},
@@ -172,26 +109,10 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+		})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	return nil
 }
-
-func buildFieldScopes(verb coretypes.Verb) []string {
-	return []string{
-		coretypes.ResourceMetaResourceLogsField.Scope(verb),
-		coretypes.ResourceMetaResourceTracesField.Scope(verb),
-		coretypes.ResourceMetaResourceMetricsField.Scope(verb),
-	}
-}

pkg/http/handler/resourcedef.go

@@ -109,8 +109,6 @@ type TelemetryResourceDef struct {
 	Category  coretypes.ActionCategory
 	Selector  coretypes.SelectorFunc
 	Resources coretypes.ResourceExtractor
-	// Optional skips the check instead of failing when the request carries no telemetry resources.
-	Optional bool
 }
 
 func (def TelemetryResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
@@ -118,9 +116,6 @@ func (def TelemetryResourceDef) resolveRequest(ec coretypes.ExtractorContext) []
 	if err != nil {
 		return []coretypes.ResolvedResource{coretypes.NewResolvedResourceWithError(def.Verb, def.Category, err)}
 	}
-	if len(refs) == 0 && def.Optional {
-		return nil
-	}
 	if len(refs) == 0 {
 		return []coretypes.ResolvedResource{coretypes.NewResolvedResourceWithError(
 			def.Verb,

pkg/http/handler/resourcedef_test.go

@@ -69,43 +69,3 @@ func TestAttachDetachSiblingResourceDefKeepsEmptySingleID(t *testing.T) {
 	require.True(t, ok)
 	assert.Equal(t, []string{""}, withTarget.TargetIDs())
 }
-
-func TestTelemetryResourceDefWithoutResources(t *testing.T) {
-	testCases := []struct {
-		name     string
-		optional bool
-		wantLen  int
-		wantErr  bool
-	}{
-		{
-			name:     "Required_Errors",
-			optional: false,
-			wantLen:  1,
-			wantErr:  true,
-		},
-		{
-			name:     "Optional_ResolvesNothing",
-			optional: true,
-			wantLen:  0,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			def := TelemetryResourceDef{
-				Verb:      coretypes.VerbRead,
-				Category:  coretypes.ActionCategoryDataAccess,
-				Selector:  coretypes.WildcardSelector,
-				Resources: func(coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) { return nil, nil },
-				Optional:  testCase.optional,
-			}
-
-			resolved := ResolveRequest([]ResourceDef{def}, coretypes.ExtractorContext{})
-
-			require.Len(t, resolved, testCase.wantLen)
-			if testCase.wantErr {
-				assert.Error(t, resolved[0].Err())
-			}
-		})
-	}
-}

pkg/query-service/rules/manager.go

@@ -1043,24 +1043,29 @@ func (m *Manager) PatchRule(ctx context.Context, ruleStr string, id valuer.UUID)
 		return nil, err
 	}
 
-	storedRule, err := ruletypes.NewPatchedPostableRule([]byte(storedJSON.Data), []byte(ruleStr))
-	if err != nil {
+	storedRule := ruletypes.PostableRule{}
+	if err := json.Unmarshal([]byte(storedJSON.Data), &storedRule); err != nil {
+		m.logger.ErrorContext(ctx, "failed to unmarshal rule from db", slog.String("rule.id", id.StringValue()), errors.Attr(err))
+		return nil, err
+	}
+
+	if err := json.Unmarshal([]byte(ruleStr), &storedRule); err != nil {
 		m.logger.ErrorContext(ctx, "failed to unmarshal patched rule with given id", slog.String("rule.id", id.StringValue()), errors.Attr(err))
 		return nil, err
 	}
 	if err := storedRule.Validate(); err != nil {
 		return nil, err
 	}
-	if err := m.validateChannels(ctx, claims.OrgID, storedRule); err != nil {
+	if err := m.validateChannels(ctx, claims.OrgID, &storedRule); err != nil {
 		return nil, err
 	}
 	// deploy or un-deploy task according to patched (new) rule state
-	if err := m.syncRuleStateWithTask(ctx, orgID, taskName, storedRule); err != nil {
+	if err := m.syncRuleStateWithTask(ctx, orgID, taskName, &storedRule); err != nil {
 		m.logger.ErrorContext(ctx, "failed to sync stored rule state with the task", slog.String("task.name", taskName), errors.Attr(err))
 		return nil, err
 	}
 
-	newStoredJson, err := json.Marshal(storedRule)
+	newStoredJson, err := json.Marshal(&storedRule)
 	if err != nil {
 		m.logger.ErrorContext(ctx, "failed to marshal new stored rule with given id", slog.String("rule.id", id.StringValue()), errors.Attr(err))
 		return nil, err
@@ -1073,7 +1078,7 @@ func (m *Manager) PatchRule(ctx context.Context, ruleStr string, id valuer.UUID)
 
 	err = m.ruleStore.EditRule(ctx, storedJSON, func(ctx context.Context) error { return nil })
 	if err != nil {
-		if err := m.syncRuleStateWithTask(ctx, orgID, taskName, storedRule); err != nil {
+		if err := m.syncRuleStateWithTask(ctx, orgID, taskName, &storedRule); err != nil {
 			m.logger.ErrorContext(ctx, "failed to restore rule after patch failure", "task_name", taskName, errors.Attr(err))
 		}
 		return nil, err
@@ -1082,7 +1087,7 @@ func (m *Manager) PatchRule(ctx context.Context, ruleStr string, id valuer.UUID)
 	// prepare http response
 	response := ruletypes.GettableRule{
 		Id:           id.StringValue(),
-		PostableRule: *storedRule,
+		PostableRule: storedRule,
 	}
 
 	// fetch state of rule from memory

pkg/ruler/authz.go

@@ -1,463 +0,0 @@
-package ruler
-
-import (
-	"context"
-	"encoding/json"
-
-	"github.com/SigNoz/signoz/pkg/alertmanager"
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/SigNoz/signoz/pkg/types/ruletypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/gorilla/mux"
-	"github.com/tidwall/gjson"
-)
-
-const (
-	attachedSide diffSide = iota
-	detachedSide
-)
-
-type diffSide int
-
-type incomingChannelsFunc func(stored *ruletypes.GettableRule, body []byte) ([]string, error)
-
-var DowntimeRuleIDsExtractor = coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-	ids, err := coretypes.BodyJSONArray("alertIds").Fn(ec)
-	if err != nil {
-		return nil, err
-	}
-
-	return defaultToAllRules(ids), nil
-}}
-
-var DowntimeRuleSelector coretypes.SelectorFunc = func(ctx context.Context, resource coretypes.Resource, id string, orgID valuer.UUID) ([]coretypes.Selector, error) {
-	if id == coretypes.WildCardSelectorString {
-		return coretypes.WildcardSelector(ctx, resource, id, orgID)
-	}
-
-	return coretypes.IDSelector(ctx, resource, id, orgID)
-}
-
-func NewDowntimeRuleAttachExtractor(rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newDowntimeDiffExtractor(rulerService, attachedSide)
-}
-
-func NewDowntimeRuleDetachExtractor(rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newDowntimeDiffExtractor(rulerService, detachedSide)
-}
-
-func newDowntimeDiffExtractor(rulerService Ruler, side diffSide) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		scheduleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
-		if err != nil {
-			return nil, err
-		}
-
-		stored, err := rulerService.MaintenanceStore().GetPlannedMaintenanceByID(ec.Request.Context(), scheduleID)
-		if err != nil {
-			return nil, err
-		}
-
-		incoming, err := DowntimeRuleIDsExtractor.Fn(ec)
-		if err != nil {
-			return nil, err
-		}
-
-		attached, detached := diffDowntimeRuleLinks(stored.RuleIDs, incoming)
-		if side == detachedSide {
-			return detached, nil
-		}
-
-		return attached, nil
-	}}
-}
-
-func NewCreateRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		names, err := parseRuleChannels(ec.RequestBody)
-		if err != nil {
-			return nil, err
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), names)
-	}}
-}
-
-func NewCloneRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		stored, err := fetchStoredRule(ec, rulerService)
-		if err != nil {
-			return nil, err
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), stored.Channels())
-	}}
-}
-
-func NewReplaceRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parseReplacedRuleChannels, attachedSide)
-}
-
-func NewReplaceRuleChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parseReplacedRuleChannels, detachedSide)
-}
-
-func NewPatchRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parsePatchedRuleChannels, attachedSide)
-}
-
-func NewPatchRuleChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
-	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parsePatchedRuleChannels, detachedSide)
-}
-
-func newRuleChannelDiffExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler, incoming incomingChannelsFunc, side diffSide) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		stored, err := fetchStoredRule(ec, rulerService)
-		if err != nil {
-			return nil, err
-		}
-
-		incomingNames, err := incoming(stored, ec.RequestBody)
-		if err != nil {
-			return nil, err
-		}
-
-		attached, detached := diffLinks(stored.Channels(), incomingNames)
-		if side == detachedSide {
-			return resolveStoredChannelIDs(ctx, alertmanagerService, orgID, detached)
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), attached)
-	}}
-}
-
-func parseReplacedRuleChannels(_ *ruletypes.GettableRule, body []byte) ([]string, error) {
-	return parseRuleChannels(body)
-}
-
-func parsePatchedRuleChannels(stored *ruletypes.GettableRule, body []byte) ([]string, error) {
-	patched, err := applyRulePatch(stored, body)
-	if err != nil {
-		return nil, err
-	}
-
-	return patched.Channels(), nil
-}
-
-func applyRulePatch(stored *ruletypes.GettableRule, body []byte) (*ruletypes.PostableRule, error) {
-	encoded, err := json.Marshal(stored.PostableRule)
-	if err != nil {
-		return nil, err
-	}
-
-	return ruletypes.NewPatchedPostableRule(encoded, body)
-}
-
-func parseRuleChannels(body []byte) ([]string, error) {
-	rule := new(ruletypes.PostableRule)
-	if err := json.Unmarshal(body, rule); err != nil {
-		return nil, err
-	}
-
-	return rule.Channels(), nil
-}
-
-func diffDowntimeRuleLinks(stored, incoming []string) (attached, detached []string) {
-	return diffLinks(defaultToAllRules(stored), incoming)
-}
-
-func defaultToAllRules(ids []string) []string {
-	if len(ids) == 0 {
-		return []string{coretypes.WildCardSelectorString}
-	}
-
-	return ids
-}
-
-func NewCreateRoutePolicyChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		names, err := coretypes.BodyJSONArray("channels").Fn(ec)
-		if err != nil {
-			return nil, err
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), names)
-	}}
-}
-
-func NewUpdateRoutePolicyChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
-	return newRoutePolicyDiffExtractor(alertmanagerService, attachedSide)
-}
-
-func NewUpdateRoutePolicyChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
-	return newRoutePolicyDiffExtractor(alertmanagerService, detachedSide)
-}
-
-func newRoutePolicyDiffExtractor(alertmanagerService alertmanager.Alertmanager, side diffSide) coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
-			return nil, nil
-		}
-
-		ctx := ec.Request.Context()
-		orgID, err := orgIDFromContext(ctx)
-		if err != nil {
-			return nil, err
-		}
-
-		stored, err := alertmanagerService.GetRoutePolicyByID(ctx, mux.Vars(ec.Request)["id"])
-		if err != nil {
-			return nil, err
-		}
-
-		incoming, err := coretypes.BodyJSONArray("channels").Fn(ec)
-		if err != nil {
-			return nil, err
-		}
-
-		attached, detached := diffLinks(stored.Channels, incoming)
-		if side == detachedSide {
-			return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), detached)
-		}
-
-		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), attached)
-	}}
-}
-
-func resolveStoredChannelIDs(ctx context.Context, alertmanagerService alertmanager.Alertmanager, orgID valuer.UUID, names []string) ([]string, error) {
-	if len(names) == 0 {
-		return nil, nil
-	}
-
-	idByName, err := mapChannelIDsByName(ctx, alertmanagerService, orgID)
-	if err != nil {
-		return nil, err
-	}
-
-	ids := make([]string, 0, len(names))
-	for _, name := range names {
-		if id, ok := idByName[name]; ok {
-			ids = append(ids, id)
-		}
-	}
-
-	return ids, nil
-}
-
-func mapChannelIDsByName(ctx context.Context, alertmanagerService alertmanager.Alertmanager, orgID valuer.UUID) (map[string]string, error) {
-	channels, err := alertmanagerService.ListChannels(ctx, orgID.StringValue())
-	if err != nil {
-		return nil, err
-	}
-
-	idByName := make(map[string]string, len(channels))
-	for _, channel := range channels {
-		idByName[channel.DisplayName] = channel.ID.StringValue()
-	}
-
-	return idByName, nil
-}
-
-func orgIDFromContext(ctx context.Context) (valuer.UUID, error) {
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		return valuer.UUID{}, err
-	}
-
-	return valuer.NewUUID(claims.OrgID)
-}
-
-func NewRuleQueryTelemetryResources(rulerService Ruler) coretypes.ResourceExtractor {
-	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-		body, err := fetchStoredCompositeQuery(ec, rulerService)
-		if err != nil {
-			return nil, err
-		}
-
-		return querybuilder.QueryRangeResources(coretypes.ExtractorContext{Request: ec.Request, RequestBody: body})
-	}
-}
-
-func NewRuleQueryFieldResources(rulerService Ruler) coretypes.ResourceExtractor {
-	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-		body, err := fetchStoredCompositeQuery(ec, rulerService)
-		if err != nil {
-			return nil, err
-		}
-
-		return mapFieldResources(body)
-	}
-}
-
-func NewRuleBodyTelemetryResources() coretypes.ResourceExtractor {
-	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-		compositeQuery := gjson.GetBytes(ec.RequestBody, "condition.compositeQuery")
-		if !compositeQuery.Exists() {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "condition.compositeQuery is required")
-		}
-
-		body, err := json.Marshal(map[string]json.RawMessage{"compositeQuery": json.RawMessage(compositeQuery.Raw)})
-		if err != nil {
-			return nil, err
-		}
-
-		return querybuilder.QueryRangeResources(coretypes.ExtractorContext{Request: ec.Request, RequestBody: body})
-	}
-}
-
-func NewOptionalRuleBodyTelemetryResources() coretypes.ResourceExtractor {
-	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-		if !gjson.GetBytes(ec.RequestBody, "condition.compositeQuery").Exists() {
-			return nil, nil
-		}
-
-		return NewRuleBodyTelemetryResources()(ec)
-	}
-}
-
-func fetchStoredRule(ec coretypes.ExtractorContext, rulerService Ruler) (*ruletypes.GettableRule, error) {
-	ruleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
-	if err != nil {
-		return nil, err
-	}
-
-	return rulerService.GetRule(ec.Request.Context(), ruleID)
-}
-
-func fetchStoredCompositeQuery(ec coretypes.ExtractorContext, rulerService Ruler) ([]byte, error) {
-	if ec.Request == nil {
-		return nil, nil
-	}
-
-	stored, err := fetchStoredRule(ec, rulerService)
-	if err != nil {
-		return nil, err
-	}
-
-	return json.Marshal(map[string]any{"compositeQuery": stored.RuleCondition.CompositeQuery})
-}
-
-func mapFieldResources(body []byte) ([]coretypes.ResourceWithID, error) {
-	telemetry, err := querybuilder.QueryRangeResources(coretypes.ExtractorContext{RequestBody: body})
-	if err != nil {
-		return nil, err
-	}
-
-	seen := make(map[string]struct{}, 3)
-	refs := make([]coretypes.ResourceWithID, 0, 3)
-	for _, ref := range telemetry {
-		field, err := fieldResourceForKind(ref.Resource.Kind())
-		if err != nil {
-			return nil, err
-		}
-
-		kind := field.Kind().String()
-		if _, ok := seen[kind]; ok {
-			continue
-		}
-		seen[kind] = struct{}{}
-		refs = append(refs, coretypes.ResourceWithID{Resource: field})
-	}
-
-	return refs, nil
-}
-
-func fieldResourceForKind(kind coretypes.Kind) (coretypes.Resource, error) {
-	switch kind {
-	case coretypes.KindLogs, coretypes.KindAuditLogs:
-		return coretypes.ResourceMetaResourceLogsField, nil
-	case coretypes.KindTraces:
-		return coretypes.ResourceMetaResourceTracesField, nil
-	case coretypes.KindMetrics, coretypes.KindMeterMetrics:
-		return coretypes.ResourceMetaResourceMetricsField, nil
-	default:
-		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "no field resource for telemetry kind %q", kind.String())
-	}
-}
-
-func diffLinks(stored, incoming []string) (attached, detached []string) {
-	storedSet := make(map[string]struct{}, len(stored))
-	for _, id := range stored {
-		storedSet[id] = struct{}{}
-	}
-
-	incomingSet := make(map[string]struct{}, len(incoming))
-	for _, id := range incoming {
-		incomingSet[id] = struct{}{}
-	}
-
-	seen := make(map[string]struct{}, len(incoming))
-	attached = make([]string, 0, len(incoming))
-	for _, id := range incoming {
-		if _, ok := storedSet[id]; ok {
-			continue
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		attached = append(attached, id)
-	}
-
-	clear(seen)
-	detached = make([]string, 0, len(stored))
-	for _, id := range stored {
-		if _, ok := incomingSet[id]; ok {
-			continue
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		detached = append(detached, id)
-	}
-
-	return attached, detached
-}

pkg/ruler/authz_test.go

@@ -1,588 +0,0 @@
-package ruler
-
-import (
-	"context"
-	"encoding/json"
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/alertmanager/alertmanagertest"
-	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/SigNoz/signoz/pkg/types/ruletypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/mock"
-	"github.com/stretchr/testify/require"
-)
-
-func TestDiffLinks(t *testing.T) {
-	testCases := []struct {
-		name         string
-		stored       []string
-		incoming     []string
-		wantAttached []string
-		wantDetached []string
-	}{
-		{
-			name:         "BothEmpty_NothingChanges",
-			wantAttached: []string{},
-			wantDetached: []string{},
-		},
-		{
-			name:         "NoStored_EverythingAttaches",
-			incoming:     []string{"slack", "pager"},
-			wantAttached: []string{"slack", "pager"},
-			wantDetached: []string{},
-		},
-		{
-			name:         "NoIncoming_EverythingDetaches",
-			stored:       []string{"slack", "pager"},
-			wantAttached: []string{},
-			wantDetached: []string{"slack", "pager"},
-		},
-		{
-			name:         "Unchanged_NothingChanges",
-			stored:       []string{"slack", "pager"},
-			incoming:     []string{"pager", "slack"},
-			wantAttached: []string{},
-			wantDetached: []string{},
-		},
-		{
-			name:         "OneAddedOneRemoved_BothSidesReported",
-			stored:       []string{"slack", "pager"},
-			incoming:     []string{"slack", "email"},
-			wantAttached: []string{"email"},
-			wantDetached: []string{"pager"},
-		},
-		{
-			name:         "DuplicateIncoming_CollapsedOnce",
-			incoming:     []string{"slack", "slack"},
-			wantAttached: []string{"slack"},
-			wantDetached: []string{},
-		},
-		{
-			name:         "DuplicateStored_CollapsedOnce",
-			stored:       []string{"pager", "pager"},
-			wantAttached: []string{},
-			wantDetached: []string{"pager"},
-		},
-		{
-			name:         "IncomingOrderPreserved",
-			stored:       []string{"keep"},
-			incoming:     []string{"zebra", "keep", "apple"},
-			wantAttached: []string{"zebra", "apple"},
-			wantDetached: []string{},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			attached, detached := diffLinks(testCase.stored, testCase.incoming)
-
-			assert.Equal(t, testCase.wantAttached, attached)
-			assert.Equal(t, testCase.wantDetached, detached)
-		})
-	}
-}
-
-func TestDiffDowntimeRuleLinks(t *testing.T) {
-	testCases := []struct {
-		name         string
-		stored       []string
-		incoming     []string
-		wantAttached []string
-		wantDetached []string
-	}{
-		{
-			name:         "AllToAll_NoChange",
-			stored:       nil,
-			incoming:     []string{"*"},
-			wantAttached: []string{},
-			wantDetached: []string{},
-		},
-		{
-			name:         "NarrowFromAllToOne_DetachesAllAttachesOne",
-			stored:       nil,
-			incoming:     []string{"r1"},
-			wantAttached: []string{"r1"},
-			wantDetached: []string{"*"},
-		},
-		{
-			name:         "WidenFromOneToAll_DetachesOneAttachesAll",
-			stored:       []string{"r1"},
-			incoming:     []string{"*"},
-			wantAttached: []string{"*"},
-			wantDetached: []string{"r1"},
-		},
-		{
-			name:         "SwapRules_DiffsIDs",
-			stored:       []string{"r1"},
-			incoming:     []string{"r2"},
-			wantAttached: []string{"r2"},
-			wantDetached: []string{"r1"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			attached, detached := diffDowntimeRuleLinks(testCase.stored, testCase.incoming)
-
-			assert.ElementsMatch(t, testCase.wantAttached, attached)
-			assert.ElementsMatch(t, testCase.wantDetached, detached)
-		})
-	}
-}
-
-func TestDowntimeRuleIDsExtractor(t *testing.T) {
-	testCases := []struct {
-		name    string
-		body    string
-		wantIDs []string
-	}{
-		{
-			name:    "MissingAlertIds_AllRules",
-			body:    `{"name": "window"}`,
-			wantIDs: []string{"*"},
-		},
-		{
-			name:    "EmptyAlertIds_AllRules",
-			body:    `{"alertIds": []}`,
-			wantIDs: []string{"*"},
-		},
-		{
-			name:    "ExplicitAlertIds_Kept",
-			body:    `{"alertIds": ["r1", "r2"]}`,
-			wantIDs: []string{"r1", "r2"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			ids, err := DowntimeRuleIDsExtractor.Fn(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.wantIDs, ids)
-		})
-	}
-}
-
-func TestMapFieldResources(t *testing.T) {
-	testCases := []struct {
-		name      string
-		body      string
-		wantKinds []coretypes.Kind
-		wantErr   bool
-	}{
-		{
-			name:      "Builder_Logs_LogsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindLogsField},
-		},
-		{
-			name:      "Builder_Traces_TracesField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"traces"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindTracesField},
-		},
-		{
-			name:      "Builder_Metrics_MetricsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"metrics"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "SubQuery_Metrics_MetricsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_sub_query","spec":{"signal":"metrics"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "BuilderAI_TracesField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_ai_query","spec":{}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindTracesField},
-		},
-		{
-			name:      "PromQL_MetricsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"promql","spec":{}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "ClickHouseSQL_AllThreeFields",
-			body:      `{"compositeQuery":{"queries":[{"type":"clickhouse_sql","spec":{}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindLogsField, coretypes.KindTracesField, coretypes.KindMetricsField},
-		},
-		{
-			name:      "Builder_AuditLogs_LogsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs","source":"audit"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindLogsField},
-		},
-		{
-			name:      "Builder_MeterMetrics_MetricsField",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"metrics","source":"meter"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "TwoBuilderSameSignal_Deduped",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"metrics"}},{"type":"builder_query","spec":{"signal":"metrics"}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
-		},
-		{
-			name:      "FormulaAlongsideBuilder_FormulaSkipped",
-			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs"}},{"type":"builder_formula","spec":{}}]}}`,
-			wantKinds: []coretypes.Kind{coretypes.KindLogsField},
-		},
-		{
-			name:    "NoQueries_Errors",
-			body:    `{"compositeQuery":{"queries":[]}}`,
-			wantErr: true,
-		},
-		{
-			name:    "UnknownSignal_Errors",
-			body:    `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"events"}}]}}`,
-			wantErr: true,
-		},
-		{
-			name:    "UnknownQueryType_Errors",
-			body:    `{"compositeQuery":{"queries":[{"type":"graphql","spec":{}}]}}`,
-			wantErr: true,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			refs, err := mapFieldResources([]byte(testCase.body))
-
-			if testCase.wantErr {
-				assert.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			kinds := make([]coretypes.Kind, 0, len(refs))
-			for _, ref := range refs {
-				kinds = append(kinds, ref.Resource.Kind())
-			}
-			assert.Equal(t, testCase.wantKinds, kinds)
-		})
-	}
-}
-
-func v1RuleJSON(preferredChannels string) string {
-	return `{
-		"alert": "TestAlert",
-		"version": "v5",
-		"condition": {
-			"compositeQuery": {
-				"queryType": "builder",
-				"queries": [{
-					"type": "builder_query",
-					"spec": {
-						"name": "A",
-						"signal": "metrics",
-						"aggregations": [{"metricName": "cpu", "spaceAggregation": "p50"}],
-						"stepInterval": "5m"
-					}
-				}]
-			},
-			"target": 10.0,
-			"matchType": "1",
-			"op": "1"
-		}` + preferredChannels + `
-	}`
-}
-
-func v2RuleJSON(channels string) string {
-	return `{
-		"alert": "TestAlert",
-		"version": "v5",
-		"schemaVersion": "v2alpha1",
-		"ruleType": "threshold_rule",
-		"condition": {
-			"compositeQuery": {
-				"queryType": "builder",
-				"queries": [{
-					"type": "builder_query",
-					"spec": {
-						"name": "A",
-						"signal": "metrics",
-						"aggregations": [{"metricName": "cpu", "spaceAggregation": "p50"}],
-						"stepInterval": "5m"
-					}
-				}]
-			},
-			"thresholds": {
-				"kind": "basic",
-				"spec": [{"name": "critical", "target": 90.0, "matchType": "1", "op": "1", "channels": ` + channels + `}]
-			}
-		},
-		"evaluation": {
-			"kind": "rolling",
-			"spec": {"evalWindow": "5m", "frequency": "1m"}
-		},
-		"notificationSettings": {
-			"renotify": {"enabled": true, "interval": "4h", "alertStates": ["firing"]}
-		}
-	}`
-}
-
-func TestParseRuleChannels(t *testing.T) {
-	testCases := []struct {
-		name         string
-		body         string
-		wantChannels []string
-		wantErr      bool
-	}{
-		{
-			name:         "V1PreferredChannels_FoldedIntoThresholds",
-			body:         v1RuleJSON(`, "preferredChannels": ["slack", "pager"]`),
-			wantChannels: []string{"slack", "pager"},
-		},
-		{
-			name:         "V1NoChannels_Empty",
-			body:         v1RuleJSON(""),
-			wantChannels: nil,
-		},
-		{
-			name:         "V2ThresholdChannels_ReadDirectly",
-			body:         v2RuleJSON(`["email"]`),
-			wantChannels: []string{"email"},
-		},
-		{
-			name:         "V2EmptyChannels_Empty",
-			body:         v2RuleJSON(`[]`),
-			wantChannels: nil,
-		},
-		{
-			name:    "NotJSON_Errors",
-			body:    "not json",
-			wantErr: true,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			channels, err := parseRuleChannels([]byte(testCase.body))
-
-			if testCase.wantErr {
-				assert.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.wantChannels, channels)
-		})
-	}
-}
-
-func TestIncomingRuleChannels(t *testing.T) {
-	testCases := []struct {
-		name            string
-		incoming        incomingChannelsFunc
-		stored          string
-		body            string
-		wantChannels    []string
-		wantStoredAfter []string
-	}{
-		{
-			name:            "Replaced_IgnoresStored",
-			incoming:        parseReplacedRuleChannels,
-			stored:          v2RuleJSON(`["slack"]`),
-			body:            v2RuleJSON(`["pager"]`),
-			wantChannels:    []string{"pager"},
-			wantStoredAfter: []string{"slack"},
-		},
-		{
-			name:            "Patched_OmitsCondition_StoredChannelsSurvive",
-			incoming:        parsePatchedRuleChannels,
-			stored:          v2RuleJSON(`["slack"]`),
-			body:            `{"disabled": true}`,
-			wantChannels:    []string{"slack"},
-			wantStoredAfter: []string{"slack"},
-		},
-		{
-			name:            "Patched_SetsChannels_StoredChannelsReplaced",
-			incoming:        parsePatchedRuleChannels,
-			stored:          v2RuleJSON(`["slack"]`),
-			body:            v2RuleJSON(`["pager"]`),
-			wantChannels:    []string{"pager"},
-			wantStoredAfter: []string{"slack"},
-		},
-		{
-			name:            "Patched_EmptiesChannels_NoChannelsLeft",
-			incoming:        parsePatchedRuleChannels,
-			stored:          v2RuleJSON(`["slack"]`),
-			body:            v2RuleJSON(`[]`),
-			wantChannels:    nil,
-			wantStoredAfter: []string{"slack"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			stored := new(ruletypes.GettableRule)
-			require.NoError(t, json.Unmarshal([]byte(testCase.stored), &stored.PostableRule))
-
-			channels, err := testCase.incoming(stored, []byte(testCase.body))
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.wantChannels, channels)
-			assert.Equal(t, testCase.wantStoredAfter, stored.Channels())
-		})
-	}
-}
-
-func TestRuleBodyTelemetryResources(t *testing.T) {
-	testCases := []struct {
-		name     string
-		body     string
-		wantKind coretypes.Kind
-		wantID   string
-		wantErr  bool
-	}{
-		{
-			name:     "V5Body_NoFilter_MetricsWildcard",
-			body:     v2RuleJSON(`[]`),
-			wantKind: coretypes.KindMetrics,
-			wantID:   "builder_query/*",
-		},
-		{
-			name:     "V1Body_PreferredChannels_MetricsWildcard",
-			body:     v1RuleJSON(`, "preferredChannels": ["slack"]`),
-			wantKind: coretypes.KindMetrics,
-			wantID:   "builder_query/*",
-		},
-		{
-			name:    "MissingCondition_Errors",
-			body:    `{"alert": "TestAlert", "version": "v5"}`,
-			wantErr: true,
-		},
-		{
-			name:    "NotJSON_Errors",
-			body:    "not json",
-			wantErr: true,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			refs, err := NewRuleBodyTelemetryResources()(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
-
-			if testCase.wantErr {
-				assert.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			require.Len(t, refs, 1)
-			assert.Equal(t, testCase.wantKind, refs[0].Resource.Kind())
-			assert.Equal(t, testCase.wantID, refs[0].ID)
-		})
-	}
-}
-
-func TestApplyRulePatch(t *testing.T) {
-	logsQuery := `{"condition": {"compositeQuery": {"queryType": "builder", "queries": [{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "stepInterval": "5m"}}]}}}`
-	testCases := []struct {
-		name         string
-		body         string
-		wantSignal   string
-		wantChannels []string
-	}{
-		{
-			name:         "BodyWithoutCondition_KeepsStoredQueryAndChannels",
-			body:         `{"disabled": true}`,
-			wantSignal:   "metrics",
-			wantChannels: []string{"slack"},
-		},
-		{
-			name:         "BodyWithNewQuery_ReplacesSignalKeepsThresholds",
-			body:         logsQuery,
-			wantSignal:   "logs",
-			wantChannels: []string{"slack"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			stored := new(ruletypes.GettableRule)
-			require.NoError(t, json.Unmarshal([]byte(v2RuleJSON(`["slack"]`)), &stored.PostableRule))
-
-			patched, err := applyRulePatch(stored, []byte(testCase.body))
-
-			require.NoError(t, err)
-			require.NotNil(t, patched.RuleCondition)
-			require.NotNil(t, patched.RuleCondition.CompositeQuery)
-			encoded, err := json.Marshal(patched.RuleCondition.CompositeQuery)
-			require.NoError(t, err)
-			assert.Contains(t, string(encoded), `"signal":"`+testCase.wantSignal+`"`)
-			assert.Equal(t, testCase.wantChannels, patched.Channels())
-		})
-	}
-}
-
-func TestOptionalRuleBodyTelemetryResources(t *testing.T) {
-	testCases := []struct {
-		name     string
-		body     string
-		wantRefs int
-	}{
-		{
-			name:     "BodyWithoutCondition_NoResources",
-			body:     `{"disabled": true}`,
-			wantRefs: 0,
-		},
-		{
-			name:     "BodyWithQuery_MetricsResource",
-			body:     v2RuleJSON(`[]`),
-			wantRefs: 1,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			refs, err := NewOptionalRuleBodyTelemetryResources()(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
-
-			require.NoError(t, err)
-			assert.Len(t, refs, testCase.wantRefs)
-		})
-	}
-}
-
-func TestResolveStoredChannelIDs(t *testing.T) {
-	channels := []*alertmanagertypes.Channel{
-		{Identifiable: types.Identifiable{ID: valuer.GenerateUUID()}, Name: "slack", DisplayName: "slack"},
-	}
-	testCases := []struct {
-		name    string
-		names   []string
-		wantIDs []string
-	}{
-		{
-			name:    "KnownName_Resolved",
-			names:   []string{"slack"},
-			wantIDs: []string{channels[0].ID.StringValue()},
-		},
-		{
-			name:    "UnknownName_Skipped",
-			names:   []string{"slack", "gone"},
-			wantIDs: []string{channels[0].ID.StringValue()},
-		},
-		{
-			name:    "NoNames_NoLookup",
-			names:   nil,
-			wantIDs: nil,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			alertmanagerService := alertmanagertest.NewMockAlertmanager(t)
-			if len(testCase.names) > 0 {
-				alertmanagerService.EXPECT().ListChannels(mock.Anything, mock.Anything).Return(channels, nil)
-			}
-
-			ids, err := resolveStoredChannelIDs(context.Background(), alertmanagerService, valuer.GenerateUUID(), testCase.names)
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.wantIDs, ids)
-		})
-	}
-}

pkg/signoz/openapi.go

@@ -100,12 +100,10 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ rulestatehistory.Handler }{},
 		struct{ spanmapper.Handler }{},
 		struct{ alertmanager.Handler }{},
-		struct{ alertmanager.Alertmanager }{},
 		struct{ prometheus.Handler }{},
 		struct{ llmpricingrule.Handler }{},
 		struct{ tracedetail.Handler }{},
 		struct{ ruler.Handler }{},
-		struct{ ruler.Ruler }{},
 		struct{ statsreporter.Handler }{},
 		struct{ savedview.Handler }{},
 		global.Config{},

pkg/signoz/provider.go

@@ -48,7 +48,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/prometheus/clickhouseprometheusv2"
 	"github.com/SigNoz/signoz/pkg/querier"
 	"github.com/SigNoz/signoz/pkg/querier/signozquerier"
-	"github.com/SigNoz/signoz/pkg/ruler"
 	"github.com/SigNoz/signoz/pkg/sharder"
 	"github.com/SigNoz/signoz/pkg/sharder/noopsharder"
 	"github.com/SigNoz/signoz/pkg/sharder/singlesharder"
@@ -267,9 +266,6 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddMetricsFieldTuplesFactory(sqlstore),
 		sqlmigration.NewAddGCPConnectionMethodFactory(),
 		sqlmigration.NewDeleteOrphanSARolesFactory(),
-		sqlmigration.NewAddRoutePolicyTuplesFactory(sqlstore),
-		sqlmigration.NewAddDowntimeTuplesFactory(sqlstore),
-		sqlmigration.NewAddRuleTuplesFactory(sqlstore),
 	)
 }
 
@@ -334,7 +330,7 @@ func NewQuerierProviderFactories(telemetryStore telemetrystore.TelemetryStore, p
 	)
 }
 
-func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web, alertmanagerService alertmanager.Alertmanager, rulerService ruler.Ruler) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
+func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
 	return factory.MustNewNamedMap(
 		signozapiserver.NewFactory(
 			orgGetter,
@@ -371,12 +367,10 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.RuleStateHistory,
 			handlers.SpanMapperHandler,
 			handlers.AlertmanagerHandler,
-			alertmanagerService,
 			handlers.PrometheusHandler,
 			handlers.LLMPricingRuleHandler,
 			handlers.TraceDetail,
 			handlers.RulerHandler,
-			rulerService,
 			handlers.StatsHandler,
 			handlers.SavedView,
 			globalConfig,

pkg/signoz/provider_test.go

@@ -106,8 +106,6 @@ func TestNewProviderFactories(t *testing.T) {
 			nil,
 			nil,
 			nil,
-			nil,
-			nil,
 		)
 	})
 }

pkg/signoz/signoz.go

@@ -622,7 +622,7 @@ func New(
 		ctx,
 		providerSettings,
 		config.APIServer,
-		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web, alertmanager, rulerInstance),
+		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web),
 		"signoz",
 	)
 	if err != nil {

pkg/sqlmigration/140_add_route_policy_tuples.go

@@ -1,173 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/oklog/ulid/v2"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/dialect"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addRoutePolicyTuples struct {
-	sqlstore sqlstore.SQLStore
-}
-
-func NewAddRoutePolicyTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_route_policy_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addRoutePolicyTuples{sqlstore: sqlstore}, nil
-	})
-}
-
-func (migration *addRoutePolicyTuples) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addRoutePolicyTuples) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var storeID string
-	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
-	if err != nil {
-		return err
-	}
-
-	var orgIDs []string
-	err = tx.NewSelect().
-		Table("organizations").
-		Column("id").
-		Scan(ctx, &orgIDs)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
-
-	crudVerbs := []string{"create", "read", "update", "delete", "list"}
-	readVerbs := []string{"read", "list"}
-	linkVerbs := []string{"attach", "detach"}
-
-	tuples := make([]migrationTuple, 0, 15)
-	for _, verb := range crudVerbs {
-		tuples = append(tuples, migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "route-policy", verb})
-	}
-	for _, verb := range readVerbs {
-		tuples = append(tuples,
-			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "route-policy", verb},
-			migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "route-policy", verb},
-		)
-	}
-	for _, verb := range linkVerbs {
-		tuples = append(tuples,
-			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "route-policy", verb},
-			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "notification-channel", verb},
-			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "notification-channel", verb},
-		)
-	}
-
-	for _, orgID := range orgIDs {
-		for _, tuple := range tuples {
-			entropy := ulid.DefaultEntropy()
-			now := time.Now().UTC()
-			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
-
-			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
-			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
-
-			if isPG {
-				user := "role:" + roleSubject + "#assignee"
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			} else {
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			}
-		}
-	}
-
-	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
-	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
-		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
-		if err != nil {
-			return err
-		}
-		managedRoleGroups[roleName] = string(data)
-	}
-
-	for _, orgID := range orgIDs {
-		for roleName, data := range managedRoleGroups {
-			if _, err := tx.NewUpdate().
-				Model(new(roles)).
-				Set("transaction_groups = ?", data).
-				Where("org_id = ?", orgID).
-				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
-				Where("name = ?", roleName).
-				Exec(ctx); err != nil {
-				return err
-			}
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addRoutePolicyTuples) Down(context.Context, *bun.DB) error {
-	return nil
-}

pkg/sqlmigration/141_add_downtime_tuples.go

@@ -1,174 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/oklog/ulid/v2"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/dialect"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addDowntimeTuples struct {
-	sqlstore sqlstore.SQLStore
-}
-
-func NewAddDowntimeTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_downtime_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addDowntimeTuples{sqlstore: sqlstore}, nil
-	})
-}
-
-func (migration *addDowntimeTuples) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addDowntimeTuples) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var storeID string
-	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
-	if err != nil {
-		return err
-	}
-
-	var orgIDs []string
-	err = tx.NewSelect().
-		Table("organizations").
-		Column("id").
-		Scan(ctx, &orgIDs)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
-
-	crudVerbs := []string{"create", "read", "update", "delete", "list"}
-	readVerbs := []string{"read", "list"}
-	linkVerbs := []string{"attach", "detach"}
-
-	tuples := make([]migrationTuple, 0, 20)
-	for _, verb := range crudVerbs {
-		tuples = append(tuples,
-			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "planned-maintenance", verb},
-			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "planned-maintenance", verb},
-		)
-	}
-	for _, verb := range readVerbs {
-		tuples = append(tuples, migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "planned-maintenance", verb})
-	}
-	for _, objectName := range []string{"planned-maintenance", "rule"} {
-		for _, verb := range linkVerbs {
-			tuples = append(tuples,
-				migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", objectName, verb},
-				migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", objectName, verb},
-			)
-		}
-	}
-
-	for _, orgID := range orgIDs {
-		for _, tuple := range tuples {
-			entropy := ulid.DefaultEntropy()
-			now := time.Now().UTC()
-			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
-
-			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
-			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
-
-			if isPG {
-				user := "role:" + roleSubject + "#assignee"
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			} else {
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			}
-		}
-	}
-
-	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
-	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
-		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
-		if err != nil {
-			return err
-		}
-		managedRoleGroups[roleName] = string(data)
-	}
-
-	for _, orgID := range orgIDs {
-		for roleName, data := range managedRoleGroups {
-			if _, err := tx.NewUpdate().
-				Model(new(roles)).
-				Set("transaction_groups = ?", data).
-				Where("org_id = ?", orgID).
-				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
-				Where("name = ?", roleName).
-				Exec(ctx); err != nil {
-				return err
-			}
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addDowntimeTuples) Down(context.Context, *bun.DB) error {
-	return nil
-}

pkg/sqlmigration/142_add_rule_tuples.go

@@ -1,140 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"database/sql"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/oklog/ulid/v2"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/dialect"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addRuleTuples struct {
-	sqlstore sqlstore.SQLStore
-}
-
-func NewAddRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addRuleTuples{sqlstore: sqlstore}, nil
-	})
-}
-
-func (migration *addRuleTuples) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addRuleTuples) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var storeID string
-	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
-	if err != nil {
-		return err
-	}
-
-	var orgIDs []string
-	err = tx.NewSelect().
-		Table("organizations").
-		Column("id").
-		Scan(ctx, &orgIDs)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
-
-	crudVerbs := []string{"create", "read", "update", "delete", "list"}
-	readVerbs := []string{"read", "list"}
-
-	tuples := make([]migrationTuple, 0, 12)
-	for _, verb := range crudVerbs {
-		tuples = append(tuples,
-			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "rule", verb},
-			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "rule", verb},
-		)
-	}
-	for _, verb := range readVerbs {
-		tuples = append(tuples, migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "rule", verb})
-	}
-
-	for _, orgID := range orgIDs {
-		for _, tuple := range tuples {
-			entropy := ulid.DefaultEntropy()
-			now := time.Now().UTC()
-			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
-
-			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
-			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
-
-			if isPG {
-				user := "role:" + roleSubject + "#assignee"
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			} else {
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			}
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addRuleTuples) Down(context.Context, *bun.DB) error {
-	return nil
-}

pkg/types/alertmanagertypes/channel.go

@@ -150,24 +150,6 @@ func NewConfigFromChannels(globalConfig GlobalConfig, routeConfig RouteConfig, c
 	return cfg, nil
 }
 
-func MapChannelNamesToIDs(channels Channels, names []string) ([]string, error) {
-	idByName := make(map[string]string, len(channels))
-	for _, channel := range channels {
-		idByName[channel.DisplayName] = channel.ID.StringValue()
-	}
-
-	ids := make([]string, 0, len(names))
-	for _, name := range names {
-		id, ok := idByName[name]
-		if !ok {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "notification channel %q does not exist", name)
-		}
-		ids = append(ids, id)
-	}
-
-	return ids, nil
-}
-
 func NewStatsFromChannels(channels Channels) map[string]any {
 	stats := make(map[string]any)
 	for _, channel := range channels {

pkg/types/alertmanagertypes/channel_test.go

@@ -6,12 +6,9 @@ import (
 	"testing"
 	"time"
 
-	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/prometheus/alertmanager/config"
 	"github.com/prometheus/common/model"
 	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
 )
 
 func TestNewConfigFromChannels(t *testing.T) {
@@ -299,36 +296,3 @@ func TestNewChannelFromReceiverGoogleChat(t *testing.T) {
 		channel.Data,
 	)
 }
-
-func TestMapChannelNamesToIDs(t *testing.T) {
-	slackID := valuer.GenerateUUID()
-	pagerID := valuer.GenerateUUID()
-	channels := Channels{
-		{Identifiable: types.Identifiable{ID: slackID}, DisplayName: "slack"},
-		{Identifiable: types.Identifiable{ID: pagerID}, DisplayName: "pager"},
-	}
-
-	testCases := []struct {
-		name    string
-		names   []string
-		want    []string
-		wantErr bool
-	}{
-		{name: "AllKnown_IDsInRequestOrder", names: []string{"pager", "slack"}, want: []string{pagerID.StringValue(), slackID.StringValue()}},
-		{name: "UnknownName_Errors", names: []string{"slack", "missing"}, wantErr: true},
-		{name: "NoNames_Empty", names: nil, want: []string{}},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			got, err := MapChannelNamesToIDs(channels, testCase.names)
-			if testCase.wantErr {
-				require.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			assert.Equal(t, testCase.want, got)
-		})
-	}
-}

pkg/types/coretypes/registry_managed_role.go

@@ -134,16 +134,12 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		// rule — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		// saved-view — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
@@ -176,16 +172,12 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		// route-policy — admin writes, viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		// apdex-setting — admin updates, viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindApdexSetting}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindApdexSetting}, WildCardSelectorString)},
@@ -249,16 +241,12 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		// rule — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		// saved-view — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
@@ -294,8 +282,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// notification-channel — read only (admin writes)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
-		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
-		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		// route-policy — read only (admin writes)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},

pkg/types/coretypes/registry_resource.go

@@ -48,7 +48,7 @@ var (
 	ResourceRole                                         = NewResourceRole()
 	ResourceServiceAccount                               = NewResourceServiceAccount()
 	ResourceUser                                         = NewResourceUser()
-	ResourceMetaResourceNotificationChannel              = NewResourceMetaResource(KindNotificationChannel)
+	ResourceMetaResourceNotificationChannel              = NewResourceMetaResource(KindNotificationChannel, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceRoutePolicy                      = NewResourceMetaResource(KindRoutePolicy)
 	ResourceMetaResourceApdexSetting                     = NewResourceMetaResource(KindApdexSetting)
 	ResourceMetaResourceAuthDomain                       = NewResourceMetaResource(KindAuthDomain)

pkg/types/ruletypes/alerting.go

@@ -117,10 +117,10 @@ type RuleCondition struct {
 	TargetUnit        string               `json:"targetUnit,omitempty" description:"schemaVersion v1 only: the unit of target, such as percent or ms. Converted to compositeQuery.unit before comparison when the two differ."`
 	Algorithm         string               `json:"algorithm,omitempty" description:"anomaly_rule only: the anomaly detection algorithm. The supported value is standard."`
 	Seasonality       Seasonality          `json:"seasonality,omitzero" description:"anomaly_rule only: the seasonal period the history is compared against, hourly, daily or weekly."`
-	SelectedQuery     string               `json:"selectedQueryName,omitempty" required:"true" description:"The name of the query whose result is evaluated, such as A or F1. Must match a query in compositeQuery."`
+	SelectedQuery     string               `json:"selectedQueryName,omitempty" description:"The name of the query whose result is evaluated, such as A or F1. Must match a query in compositeQuery. When omitted, F1 is used if present, otherwise the enabled query with the highest name."`
 	RequireMinPoints  bool                 `json:"requireMinPoints,omitempty" description:"Whether a series is skipped until it has at least requiredNumPoints points in the window. Defaults to false."`
 	RequiredNumPoints int                  `json:"requiredNumPoints,omitempty" description:"The minimum number of points a series needs before it is evaluated. Must be greater than 0 when requireMinPoints is true."`
-	Thresholds        *RuleThresholdData   `json:"thresholds,omitempty" required:"true" description:"The thresholds to evaluate, as a kind and spec."`
+	Thresholds        *RuleThresholdData   `json:"thresholds,omitempty" description:"The thresholds to evaluate, as a kind and spec. Required when schemaVersion is v2alpha1; derived from op, target and matchType for v1."`
 }
 
 func (rc *RuleCondition) SelectedQueryName() string {

pkg/types/ruletypes/api_params.go

@@ -9,7 +9,6 @@ import (
 	"unicode/utf8"
 
 	"github.com/prometheus/alertmanager/config"
-	"github.com/swaggest/jsonschema-go"
 
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/types"
@@ -64,7 +63,7 @@ type PostableRule struct {
 	AlertName   valuer.DisplayName  `json:"alert" required:"true" description:"The display name of the alert rule."`
 	AlertType   AlertType           `json:"alertType" required:"true" description:"The signal the rule evaluates: METRIC_BASED_ALERT, TRACES_BASED_ALERT, LOGS_BASED_ALERT, EXCEPTIONS_BASED_ALERT or AI_TRACES_BASED_ALERT."`
 	Description string              `json:"description,omitempty" description:"A human readable description of what the rule monitors."`
-	RuleType    RuleType            `json:"ruleType" required:"true" description:"The evaluation strategy: threshold_rule compares against thresholds, promql_rule evaluates a PromQL expression, anomaly_rule scores deviation from seasonal history. Defaults to threshold_rule for builder and clickhouse_sql queries and is forced to promql_rule for promql queries."`
+	RuleType    RuleType            `json:"ruleType" required:"true" description:"The evaluation strategy: threshold_rule compares against thresholds, promql_rule evaluates a PromQL expression, anomaly_rule scores deviation from seasonal history. Defaults to threshold_rule for builder queries and is forced to promql_rule for promql queries."`
 	EvalWindow  valuer.TextDuration `json:"evalWindow,omitzero" description:"The lookback window as a Go duration such as 5m. Only read when schemaVersion is v1, defaulting to 5m; v2alpha1 rules set it in evaluation.spec instead."`
 	Frequency   valuer.TextDuration `json:"frequency,omitzero" description:"How often the rule is evaluated, as a Go duration such as 1m. Only read when schemaVersion is v1, defaulting to 1m; v2alpha1 rules set it in evaluation.spec instead."`
 
@@ -78,12 +77,12 @@ type PostableRule struct {
 
 	PreferredChannels []string `json:"preferredChannels,omitempty" description:"The displayName of each notification channel to notify, for schemaVersion v1 rules. Ignored for v2alpha1, where each threshold carries its own channels."`
 
-	Version string `json:"version" description:"The query payload version. Nothing reads it."`
+	Version string `json:"version" description:"The query payload version. Only v5 is accepted and it is filled in when omitted."`
 
-	Evaluation    *EvaluationEnvelope `json:"evaluation,omitempty" required:"true" description:"The evaluation window, as a kind and spec."`
-	SchemaVersion string              `json:"schemaVersion,omitempty" required:"true" enum:"v2alpha1" description:"The rule payload schema."`
+	Evaluation    *EvaluationEnvelope `json:"evaluation,omitempty" description:"The evaluation window, as a kind and spec. Required when schemaVersion is v2alpha1; derived from evalWindow and frequency for v1."`
+	SchemaVersion string              `json:"schemaVersion,omitempty" description:"The rule payload schema: v1 (the default when omitted) uses the flat condition fields, v2alpha1 uses condition.thresholds, evaluation and notificationSettings."`
 
-	NotificationSettings *NotificationSettings `json:"notificationSettings,omitempty" required:"true" description:"Grouping, re-notification and routing behaviour."`
+	NotificationSettings *NotificationSettings `json:"notificationSettings,omitempty" description:"Grouping, re-notification and routing behaviour. Required when schemaVersion is v2alpha1; derived from the v1 fields otherwise."`
 }
 
 type NotificationSettings struct {
@@ -336,32 +335,6 @@ func (r *PostableRule) UnmarshalJSON(bytes []byte) error {
 	return r.validate()
 }
 
-func NewPatchedPostableRule(stored, patch []byte) (*PostableRule, error) {
-	patched := new(PostableRule)
-	if err := json.Unmarshal(stored, patched); err != nil {
-		return nil, err
-	}
-
-	if err := json.Unmarshal(patch, patched); err != nil {
-		return nil, err
-	}
-
-	return patched, nil
-}
-
-var _ jsonschema.Preparer = PostableRule{}
-
-// PrepareJSONSchema marks version and source deprecated: nothing reads them,
-// they stay only so existing clients keep a stable schema.
-func (PostableRule) PrepareJSONSchema(schema *jsonschema.Schema) error {
-	for _, name := range []string{"version", "source"} {
-		if property, ok := schema.Properties[name]; ok && property.TypeObject != nil {
-			property.TypeObject.WithDeprecated(true)
-		}
-	}
-	return nil
-}
-
 func isValidLabelName(ln string) bool {
 	if len(ln) == 0 {
 		return false

tests/integration/testdata/role/managed_role_transactions.json

@@ -188,9 +188,7 @@
         "read",
         "update",
         "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
       ]
     },
     {
@@ -201,9 +199,7 @@
         "read",
         "update",
         "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
       ]
     },
     {
@@ -260,9 +256,7 @@
         "read",
         "update",
         "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
       ]
     },
     {
@@ -273,9 +267,7 @@
         "read",
         "update",
         "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
       ]
     },
     {
@@ -424,9 +416,7 @@
         "read",
         "update",
         "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
       ]
     },
     {
@@ -437,9 +427,7 @@
         "read",
         "update",
         "delete",
-        "list",
-        "attach",
-        "detach"
+        "list"
       ]
     },
     {
@@ -504,9 +492,7 @@
       "kind": "notification-channel",
       "verbs": [
         "read",
-        "list",
-        "attach",
-        "detach"
+        "list"
       ]
     },
     {