feat(licensing): add resource authz to license endpoints

docs/api/openapi.yml

@@ -5641,6 +5641,15 @@ components:
       - total
       - endTimeBeforeRetention
       type: object
+    LicensetypesGettableLicense:
+      additionalProperties: {}
+      nullable: true
+      type: object
+    LicensetypesPostableLicense:
+      properties:
+        key:
+          type: string
+      type: object
     LlmpricingruletypesGettablePricingRules:
       properties:
         items:
@@ -24061,6 +24070,166 @@ paths:
       summary: Put profile in Zeus for a deployment.
       tags:
       - zeus
+  /api/v3/licenses:
+    post:
+      deprecated: false
+      description: This endpoint validates the license key with upstream and activates
+        the license for the organization.
+      operationId: ActivateLicense
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/LicensetypesPostableLicense'
+      responses:
+        "202":
+          description: Accepted
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "409":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Conflict
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - license:create
+      - tokenizer:
+        - license:create
+      summary: Activate a license.
+      tags:
+      - licenses
+    put:
+      deprecated: false
+      description: This endpoint refreshes the active license of the organization
+        from upstream.
+      operationId: RefreshLicense
+      responses:
+        "204":
+          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key:
+        - license:update
+      - tokenizer:
+        - license:update
+      summary: Refresh the active license.
+      tags:
+      - licenses
+  /api/v3/licenses/active:
+    get:
+      deprecated: false
+      description: This endpoint gets the active license of the organization.
+      operationId: GetActiveLicense
+      responses:
+        "200":
+          content:
+            application/json:
+              schema:
+                properties:
+                  data:
+                    $ref: '#/components/schemas/LicensetypesGettableLicense'
+                  status:
+                    type: string
+                required:
+                - status
+                - data
+                type: object
+          description: OK
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "401":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Unauthorized
+        "403":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Forbidden
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      security:
+      - api_key: []
+      - tokenizer: []
+      summary: Get the active license.
+      tags:
+      - licenses
   /api/v3/metrics/dashboards:
     get:
       deprecated: false

ee/query-service/app/api/api.go

@@ -4,10 +4,10 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/SigNoz/signoz/ee/licensing/httplicensing"
 	"github.com/SigNoz/signoz/ee/query-service/usage"
 	"github.com/SigNoz/signoz/pkg/global"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
+	"github.com/SigNoz/signoz/pkg/licensing"
 	baseapp "github.com/SigNoz/signoz/pkg/query-service/app"
 	"github.com/SigNoz/signoz/pkg/query-service/app/integrations"
 	"github.com/SigNoz/signoz/pkg/query-service/app/logparsingpipeline"
@@ -42,7 +42,7 @@ func NewAPIHandler(opts APIHandlerOptions, signoz *signoz.SigNoz, config signoz.
 		IntegrationsController:        opts.IntegrationsController,
 		LogsParsingPipelineController: opts.LogsParsingPipelineController,
 		FluxInterval:                  opts.FluxInterval,
-		LicensingAPI:                  httplicensing.NewLicensingAPI(signoz.Licensing),
+		LicensingHandler:              licensing.NewHandler(signoz.Licensing),
 		Signoz:                        signoz,
 		QueryParserAPI:                queryparser.NewAPI(signoz.Instrumentation.ToProviderSettings(), signoz.QueryParser),
 	}, config)
@@ -72,14 +72,9 @@ func (ah *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 	// base overrides
 	router.HandleFunc("/api/v1/version", am.OpenAccess(ah.getVersion)).Methods(http.MethodGet)
 
-	router.HandleFunc("/api/v1/checkout", am.AdminAccess(ah.LicensingAPI.Checkout)).Methods(http.MethodPost)
+	router.HandleFunc("/api/v1/checkout", am.AdminAccess(ah.LicensingHandler.Checkout)).Methods(http.MethodPost)
 	router.HandleFunc("/api/v1/billing", am.AdminAccess(ah.getBilling)).Methods(http.MethodGet)
-	router.HandleFunc("/api/v1/portal", am.AdminAccess(ah.LicensingAPI.Portal)).Methods(http.MethodPost)
-
-	// v3
-	router.HandleFunc("/api/v3/licenses", am.AdminAccess(ah.LicensingAPI.Activate)).Methods(http.MethodPost)
-	router.HandleFunc("/api/v3/licenses", am.AdminAccess(ah.LicensingAPI.Refresh)).Methods(http.MethodPut)
-	router.HandleFunc("/api/v3/licenses/active", am.ViewAccess(ah.LicensingAPI.GetActive)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v1/portal", am.AdminAccess(ah.LicensingHandler.Portal)).Methods(http.MethodPost)
 
 	// v4
 	router.HandleFunc("/api/v4/query_range", am.ViewAccess(ah.queryRangeV4)).Methods(http.MethodPost)

frontend/src/api/generated/services/licenses/index.ts

@@ -0,0 +1,268 @@
+/**
+ * ! Do not edit manually
+ * * The file has been auto-generated using Orval for SigNoz
+ * * regenerate with 'pnpm generate:api'
+ * SigNoz
+ */
+import { useMutation, useQuery } from 'react-query';
+import type {
+	InvalidateOptions,
+	MutationFunction,
+	QueryClient,
+	QueryFunction,
+	QueryKey,
+	UseMutationOptions,
+	UseMutationResult,
+	UseQueryOptions,
+	UseQueryResult,
+} from 'react-query';
+
+import type {
+	GetActiveLicense200,
+	LicensetypesPostableLicenseDTO,
+	RenderErrorResponseDTO,
+} from '../sigNoz.schemas';
+
+import { GeneratedAPIInstance } from '../../../generatedAPIInstance';
+import type { ErrorType, BodyType } from '../../../generatedAPIInstance';
+
+/**
+ * This endpoint validates the license key with upstream and activates the license for the organization.
+ * @summary Activate a license.
+ */
+export const activateLicense = (
+	licensetypesPostableLicenseDTO?: BodyType<LicensetypesPostableLicenseDTO>,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<void>({
+		url: `/api/v3/licenses`,
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		data: licensetypesPostableLicenseDTO,
+		signal,
+	});
+};
+
+export const getActivateLicenseMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof activateLicense>>,
+		TError,
+		{ data?: BodyType<LicensetypesPostableLicenseDTO> },
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof activateLicense>>,
+	TError,
+	{ data?: BodyType<LicensetypesPostableLicenseDTO> },
+	TContext
+> => {
+	const mutationKey = ['activateLicense'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof activateLicense>>,
+		{ data?: BodyType<LicensetypesPostableLicenseDTO> }
+	> = (props) => {
+		const { data } = props ?? {};
+
+		return activateLicense(data);
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type ActivateLicenseMutationResult = NonNullable<
+	Awaited<ReturnType<typeof activateLicense>>
+>;
+export type ActivateLicenseMutationBody =
+	| BodyType<LicensetypesPostableLicenseDTO>
+	| undefined;
+export type ActivateLicenseMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Activate a license.
+ */
+export const useActivateLicense = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof activateLicense>>,
+		TError,
+		{ data?: BodyType<LicensetypesPostableLicenseDTO> },
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof activateLicense>>,
+	TError,
+	{ data?: BodyType<LicensetypesPostableLicenseDTO> },
+	TContext
+> => {
+	return useMutation(getActivateLicenseMutationOptions(options));
+};
+/**
+ * This endpoint refreshes the active license of the organization from upstream.
+ * @summary Refresh the active license.
+ */
+export const refreshLicense = (signal?: AbortSignal) => {
+	return GeneratedAPIInstance<void>({
+		url: `/api/v3/licenses`,
+		method: 'PUT',
+		signal,
+	});
+};
+
+export const getRefreshLicenseMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof refreshLicense>>,
+		TError,
+		void,
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof refreshLicense>>,
+	TError,
+	void,
+	TContext
+> => {
+	const mutationKey = ['refreshLicense'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof refreshLicense>>,
+		void
+	> = () => {
+		return refreshLicense();
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type RefreshLicenseMutationResult = NonNullable<
+	Awaited<ReturnType<typeof refreshLicense>>
+>;
+
+export type RefreshLicenseMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Refresh the active license.
+ */
+export const useRefreshLicense = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof refreshLicense>>,
+		TError,
+		void,
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof refreshLicense>>,
+	TError,
+	void,
+	TContext
+> => {
+	return useMutation(getRefreshLicenseMutationOptions(options));
+};
+/**
+ * This endpoint gets the active license of the organization.
+ * @summary Get the active license.
+ */
+export const getActiveLicense = (signal?: AbortSignal) => {
+	return GeneratedAPIInstance<GetActiveLicense200>({
+		url: `/api/v3/licenses/active`,
+		method: 'GET',
+		signal,
+	});
+};
+
+export const getGetActiveLicenseQueryKey = () => {
+	return [`/api/v3/licenses/active`] as const;
+};
+
+export const getGetActiveLicenseQueryOptions = <
+	TData = Awaited<ReturnType<typeof getActiveLicense>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(options?: {
+	query?: UseQueryOptions<
+		Awaited<ReturnType<typeof getActiveLicense>>,
+		TError,
+		TData
+	>;
+}) => {
+	const { query: queryOptions } = options ?? {};
+
+	const queryKey = queryOptions?.queryKey ?? getGetActiveLicenseQueryKey();
+
+	const queryFn: QueryFunction<Awaited<ReturnType<typeof getActiveLicense>>> = ({
+		signal,
+	}) => getActiveLicense(signal);
+
+	return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
+		Awaited<ReturnType<typeof getActiveLicense>>,
+		TError,
+		TData
+	> & { queryKey: QueryKey };
+};
+
+export type GetActiveLicenseQueryResult = NonNullable<
+	Awaited<ReturnType<typeof getActiveLicense>>
+>;
+export type GetActiveLicenseQueryError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Get the active license.
+ */
+
+export function useGetActiveLicense<
+	TData = Awaited<ReturnType<typeof getActiveLicense>>,
+	TError = ErrorType<RenderErrorResponseDTO>,
+>(options?: {
+	query?: UseQueryOptions<
+		Awaited<ReturnType<typeof getActiveLicense>>,
+		TError,
+		TData
+	>;
+}): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
+	const queryOptions = getGetActiveLicenseQueryOptions(options);
+
+	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
+		queryKey: QueryKey;
+	};
+
+	return { ...query, queryKey: queryOptions.queryKey };
+}
+
+/**
+ * @summary Get the active license.
+ */
+export const invalidateGetActiveLicense = async (
+	queryClient: QueryClient,
+	options?: InvalidateOptions,
+): Promise<QueryClient> => {
+	await queryClient.invalidateQueries(
+		{ queryKey: getGetActiveLicenseQueryKey() },
+		options,
+	);
+
+	return queryClient;
+};

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -7171,6 +7171,21 @@ export interface InframonitoringtypesVolumesDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
+export type LicensetypesGettableLicenseDTOAnyOf = { [key: string]: unknown };
+
+/**
+ * @nullable
+ */
+export type LicensetypesGettableLicenseDTO =
+	LicensetypesGettableLicenseDTOAnyOf | null;
+
+export interface LicensetypesPostableLicenseDTO {
+	/**
+	 * @type string
+	 */
+	key?: string;
+}
+
 /**
  * @nullable
  */
@@ -12399,6 +12414,14 @@ export type GetHosts200 = {
 	status: string;
 };
 
+export type GetActiveLicense200 = {
+	data: LicensetypesGettableLicenseDTO | null;
+	/**
+	 * @type string
+	 */
+	status: string;
+};
+
 export type GetMetricDashboardsV2Params = {
 	/**
 	 * @type string

pkg/apiserver/signozapiserver/licensing.go

@@ -0,0 +1,84 @@
+package signozapiserver
+
+import (
+	"net/http"
+
+	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types/licensetypes"
+	"github.com/gorilla/mux"
+)
+
+func (provider *provider) addLicensingRoutes(router *mux.Router) error {
+	if err := router.Handle("/api/v3/licenses", handler.New(
+		provider.authzMiddleware.CheckResources(provider.licensingHandler.Activate, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ActivateLicense",
+			Tags:                []string{"licenses"},
+			Summary:             "Activate a license.",
+			Description:         "This endpoint validates the license key with upstream and activates the license for the organization.",
+			Request:             new(licensetypes.PostableLicense),
+			RequestContentType:  "application/json",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusAccepted,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound, http.StatusConflict},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLicense.Scope(coretypes.VerbCreate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLicense,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v3/licenses", handler.New(
+		provider.authzMiddleware.CheckResources(provider.licensingHandler.Refresh, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "RefreshLicense",
+			Tags:                []string{"licenses"},
+			Summary:             "Refresh the active license.",
+			Description:         "This endpoint refreshes the active license of the organization from upstream.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLicense.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLicense,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
+		return err
+	}
+
+	if err := router.Handle("/api/v3/licenses/active", handler.New(provider.authzMiddleware.OpenAccess(provider.licensingHandler.GetActive), handler.OpenAPIDef{
+		ID:                  "GetActiveLicense",
+		Tags:                []string{"licenses"},
+		Summary:             "Get the active license.",
+		Description:         "This endpoint gets the active license of the organization.",
+		Request:             nil,
+		RequestContentType:  "",
+		Response:            new(licensetypes.GettableLicense),
+		ResponseContentType: "application/json",
+		SuccessStatusCode:   http.StatusOK,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusNotFound},
+		Deprecated:          false,
+		SecuritySchemes:     newScopedSecuritySchemes(nil),
+	})).Methods(http.MethodGet).GetError(); err != nil {
+		return err
+	}
+
+	return nil
+}

pkg/apiserver/signozapiserver/provider.go

@@ -12,6 +12,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/global"
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/http/middleware"
+	"github.com/SigNoz/signoz/pkg/licensing"
 	"github.com/SigNoz/signoz/pkg/modules/aiobservability"
 	"github.com/SigNoz/signoz/pkg/modules/authdomain"
 	"github.com/SigNoz/signoz/pkg/modules/cloudintegration"
@@ -67,6 +68,7 @@ type provider struct {
 	authzHandler               authz.Handler
 	rawDataExportHandler       rawdataexport.Handler
 	zeusHandler                zeus.Handler
+	licensingHandler           licensing.Handler
 	querierHandler             querier.Handler
 	serviceAccountHandler      serviceaccount.Handler
 	serviceAccountGetter       serviceaccount.Getter
@@ -105,6 +107,7 @@ func NewFactory(
 	authzHandler authz.Handler,
 	rawDataExportHandler rawdataexport.Handler,
 	zeusHandler zeus.Handler,
+	licensingHandler licensing.Handler,
 	querierHandler querier.Handler,
 	serviceAccountHandler serviceaccount.Handler,
 	serviceAccountGetter serviceaccount.Getter,
@@ -146,6 +149,7 @@ func NewFactory(
 			authzHandler,
 			rawDataExportHandler,
 			zeusHandler,
+			licensingHandler,
 			querierHandler,
 			serviceAccountHandler,
 			serviceAccountGetter,
@@ -189,6 +193,7 @@ func newProvider(
 	authzHandler authz.Handler,
 	rawDataExportHandler rawdataexport.Handler,
 	zeusHandler zeus.Handler,
+	licensingHandler licensing.Handler,
 	querierHandler querier.Handler,
 	serviceAccountHandler serviceaccount.Handler,
 	serviceAccountGetter serviceaccount.Getter,
@@ -231,6 +236,7 @@ func newProvider(
 		authzHandler:               authzHandler,
 		rawDataExportHandler:       rawDataExportHandler,
 		zeusHandler:                zeusHandler,
+		licensingHandler:           licensingHandler,
 		querierHandler:             querierHandler,
 		serviceAccountHandler:      serviceAccountHandler,
 		serviceAccountGetter:       serviceAccountGetter,
@@ -332,6 +338,10 @@ func (provider *provider) AddToRouter(router *mux.Router) error {
 		return err
 	}
 
+	if err := provider.addLicensingRoutes(router); err != nil {
+		return err
+	}
+
 	if err := provider.addZeusRoutes(router); err != nil {
 		return err
 	}

pkg/licensing/handler.go

@@ -1,4 +1,4 @@
-package httplicensing
+package licensing
 
 import (
 	"context"
@@ -8,21 +8,20 @@ import (
 
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/http/render"
-	"github.com/SigNoz/signoz/pkg/licensing"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/licensetypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
-type licensingAPI struct {
-	licensing licensing.Licensing
+type handler struct {
+	licensing Licensing
 }
 
-func NewLicensingAPI(licensing licensing.Licensing) licensing.API {
-	return &licensingAPI{licensing: licensing}
+func NewHandler(licensing Licensing) Handler {
+	return &handler{licensing: licensing}
 }
 
-func (api *licensingAPI) Activate(rw http.ResponseWriter, r *http.Request) {
+func (handler *handler) Activate(rw http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
 
@@ -45,7 +44,7 @@ func (api *licensingAPI) Activate(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = api.licensing.Activate(r.Context(), orgID, req.Key)
+	err = handler.licensing.Activate(r.Context(), orgID, req.Key)
 	if err != nil {
 		render.Error(rw, err)
 		return
@@ -54,7 +53,7 @@ func (api *licensingAPI) Activate(rw http.ResponseWriter, r *http.Request) {
 	render.Success(rw, http.StatusAccepted, nil)
 }
 
-func (api *licensingAPI) GetActive(rw http.ResponseWriter, r *http.Request) {
+func (handler *handler) GetActive(rw http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
 
@@ -70,7 +69,7 @@ func (api *licensingAPI) GetActive(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	license, err := api.licensing.GetActive(r.Context(), orgID)
+	license, err := handler.licensing.GetActive(r.Context(), orgID)
 	if err != nil {
 		render.Error(rw, err)
 		return
@@ -80,7 +79,7 @@ func (api *licensingAPI) GetActive(rw http.ResponseWriter, r *http.Request) {
 	render.Success(rw, http.StatusOK, gettableLicense)
 }
 
-func (api *licensingAPI) Refresh(rw http.ResponseWriter, r *http.Request) {
+func (handler *handler) Refresh(rw http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
 
@@ -96,7 +95,7 @@ func (api *licensingAPI) Refresh(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = api.licensing.Refresh(r.Context(), orgID)
+	err = handler.licensing.Refresh(r.Context(), orgID)
 	if err != nil {
 		render.Error(rw, err)
 		return
@@ -105,7 +104,7 @@ func (api *licensingAPI) Refresh(rw http.ResponseWriter, r *http.Request) {
 	render.Success(rw, http.StatusNoContent, nil)
 }
 
-func (api *licensingAPI) Checkout(rw http.ResponseWriter, r *http.Request) {
+func (handler *handler) Checkout(rw http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
 
@@ -127,7 +126,7 @@ func (api *licensingAPI) Checkout(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	gettableSubscription, err := api.licensing.Checkout(ctx, orgID, req)
+	gettableSubscription, err := handler.licensing.Checkout(ctx, orgID, req)
 	if err != nil {
 		render.Error(rw, err)
 		return
@@ -136,7 +135,7 @@ func (api *licensingAPI) Checkout(rw http.ResponseWriter, r *http.Request) {
 	render.Success(rw, http.StatusCreated, gettableSubscription)
 }
 
-func (api *licensingAPI) Portal(rw http.ResponseWriter, r *http.Request) {
+func (handler *handler) Portal(rw http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
 
@@ -158,7 +157,7 @@ func (api *licensingAPI) Portal(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	gettableSubscription, err := api.licensing.Portal(ctx, orgID, req)
+	gettableSubscription, err := handler.licensing.Portal(ctx, orgID, req)
 	if err != nil {
 		render.Error(rw, err)
 		return

pkg/licensing/licensing.go

@@ -37,7 +37,7 @@ type Licensing interface {
 	statsreporter.StatsCollector
 }
 
-type API interface {
+type Handler interface {
 	Activate(http.ResponseWriter, *http.Request)
 	Refresh(http.ResponseWriter, *http.Request)
 	GetActive(http.ResponseWriter, *http.Request)

pkg/licensing/nooplicensing/api.go

@@ -1,35 +0,0 @@
-package nooplicensing
-
-import (
-	"net/http"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/http/render"
-	"github.com/SigNoz/signoz/pkg/licensing"
-)
-
-type noopLicensingAPI struct{}
-
-func NewLicenseAPI() licensing.API {
-	return &noopLicensingAPI{}
-}
-
-func (api *noopLicensingAPI) Activate(rw http.ResponseWriter, r *http.Request) {
-	render.Error(rw, errors.New(errors.TypeUnsupported, licensing.ErrCodeUnsupported, "not implemented"))
-}
-
-func (api *noopLicensingAPI) GetActive(rw http.ResponseWriter, r *http.Request) {
-	render.Error(rw, errors.New(errors.TypeUnsupported, licensing.ErrCodeUnsupported, "not implemented"))
-}
-
-func (api *noopLicensingAPI) Refresh(rw http.ResponseWriter, r *http.Request) {
-	render.Error(rw, errors.New(errors.TypeUnsupported, licensing.ErrCodeUnsupported, "not implemented"))
-}
-
-func (api *noopLicensingAPI) Checkout(rw http.ResponseWriter, r *http.Request) {
-	render.Error(rw, errors.New(errors.TypeUnsupported, licensing.ErrCodeUnsupported, "not implemented"))
-}
-
-func (api *noopLicensingAPI) Portal(rw http.ResponseWriter, r *http.Request) {
-	render.Error(rw, errors.New(errors.TypeUnsupported, licensing.ErrCodeUnsupported, "not implemented"))
-}

pkg/query-service/app/http_handler.go

@@ -119,7 +119,7 @@ type APIHandler struct {
 	// Websocket connection upgrader
 	Upgrader *websocket.Upgrader
 
-	LicensingAPI licensing.API
+	LicensingHandler licensing.Handler
 
 	QueryParserAPI *queryparser.API
 
@@ -139,7 +139,7 @@ type APIHandlerOpts struct {
 	// Flux Interval
 	FluxInterval time.Duration
 
-	LicensingAPI licensing.API
+	LicensingHandler licensing.Handler
 
 	QueryParserAPI *queryparser.API
 
@@ -176,7 +176,7 @@ func NewAPIHandler(opts APIHandlerOpts, config signoz.Config) (*APIHandler, erro
 		LogsParsingPipelineController: opts.LogsParsingPipelineController,
 		querier:                       querier,
 		querierV2:                     querierv2,
-		LicensingAPI:                  opts.LicensingAPI,
+		LicensingHandler:              opts.LicensingHandler,
 		Signoz:                        opts.Signoz,
 		QueryParserAPI:                opts.QueryParserAPI,
 	}
@@ -457,13 +457,6 @@ func (aH *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 
 	router.HandleFunc("/api/v1/register", am.OpenAccess(aH.registerUser)).Methods(http.MethodPost)
 
-	router.HandleFunc("/api/v3/licenses", am.ViewAccess(func(rw http.ResponseWriter, req *http.Request) {
-		render.Success(rw, http.StatusOK, []any{})
-	})).Methods(http.MethodGet)
-	router.HandleFunc("/api/v3/licenses/active", am.ViewAccess(func(rw http.ResponseWriter, req *http.Request) {
-		aH.LicensingAPI.Activate(rw, req)
-	})).Methods(http.MethodGet)
-
 	router.HandleFunc("/api/v1/span_percentile", am.ViewAccess(aH.Signoz.Handlers.SpanPercentile.GetSpanPercentileDetails)).Methods(http.MethodPost)
 
 	// Query Filter Analyzer api used to extract metric names and grouping columns from a query

pkg/query-service/app/server.go

@@ -16,7 +16,7 @@ import (
 	"github.com/soheilhy/cmux"
 
 	"github.com/SigNoz/signoz/pkg/http/middleware"
-	"github.com/SigNoz/signoz/pkg/licensing/nooplicensing"
+	"github.com/SigNoz/signoz/pkg/licensing"
 	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
 	"github.com/SigNoz/signoz/pkg/query-service/app/clickhouseReader"
 	"github.com/SigNoz/signoz/pkg/query-service/app/integrations"
@@ -84,7 +84,7 @@ func NewServer(config signoz.Config, signoz *signoz.SigNoz) (*Server, error) {
 		IntegrationsController:        integrationsController,
 		LogsParsingPipelineController: logParsingPipelineController,
 		FluxInterval:                  config.Querier.FluxInterval,
-		LicensingAPI:                  nooplicensing.NewLicenseAPI(),
+		LicensingHandler:              licensing.NewHandler(signoz.Licensing),
 		Signoz:                        signoz,
 		QueryParserAPI:                queryparser.NewAPI(signoz.Instrumentation.ToProviderSettings(), signoz.QueryParser),
 	}, config)

pkg/signoz/handler.go

@@ -77,6 +77,7 @@ type Handlers struct {
 	AIObservability         aiobservability.Handler
 	AuthzHandler            authz.Handler
 	ZeusHandler             zeus.Handler
+	LicensingHandler        licensing.Handler
 	QuerierHandler          querier.Handler
 	ServiceAccountHandler   serviceaccount.Handler
 	RegistryHandler         factory.Handler
@@ -95,7 +96,7 @@ func NewHandlers(
 	providerSettings factory.ProviderSettings,
 	analytics analytics.Analytics,
 	querierHandler querier.Handler,
-	licensing licensing.Licensing,
+	licensingService licensing.Licensing,
 	global global.Global,
 	flaggerService flagger.Flagger,
 	gatewayService gateway.Gateway,
@@ -125,7 +126,8 @@ func NewHandlers(
 		Fields:                  implfields.NewHandler(providerSettings, telemetryMetadataStore),
 		AIObservability:         implaiobservability.NewHandler(telemetryMetadataStore),
 		AuthzHandler:            signozauthzapi.NewHandler(authz),
-		ZeusHandler:             zeus.NewHandler(zeusService, licensing),
+		ZeusHandler:             zeus.NewHandler(zeusService, licensingService),
+		LicensingHandler:        licensing.NewHandler(licensingService),
 		QuerierHandler:          querierHandler,
 		ServiceAccountHandler:   implserviceaccount.NewHandler(modules.ServiceAccount, modules.ServiceAccountGetter),
 		RegistryHandler:         registryHandler,

pkg/signoz/openapi.go

@@ -17,6 +17,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/global"
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/instrumentation"
+	"github.com/SigNoz/signoz/pkg/licensing"
 	"github.com/SigNoz/signoz/pkg/modules/aiobservability"
 	"github.com/SigNoz/signoz/pkg/modules/authdomain"
 	"github.com/SigNoz/signoz/pkg/modules/cloudintegration"
@@ -80,6 +81,7 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ authz.Handler }{},
 		struct{ rawdataexport.Handler }{},
 		struct{ zeus.Handler }{},
+		struct{ licensing.Handler }{},
 		struct{ querier.Handler }{},
 		struct{ serviceaccount.Handler }{},
 		struct{ serviceaccount.Getter }{},

pkg/signoz/provider.go

@@ -244,6 +244,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewDeleteOrphanUserRolesFactory(),
 		sqlmigration.NewMigrateLambdaDashboardsFactory(),
 		sqlmigration.NewAddAuthDomainTuplesFactory(sqlstore),
+		sqlmigration.NewAddLicenseTuplesFactory(sqlstore),
 	)
 }
 
@@ -334,6 +335,7 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.AuthzHandler,
 			handlers.RawDataExport,
 			handlers.ZeusHandler,
+			handlers.LicensingHandler,
 			handlers.QuerierHandler,
 			handlers.ServiceAccountHandler,
 			modules.ServiceAccountGetter,

pkg/sqlmigration/118_add_license_tuples.go

@@ -0,0 +1,159 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addLicenseTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddLicenseTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_license_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addLicenseTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addLicenseTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addLicenseTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "metaresource", "license", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "license", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "license", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "license", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "license", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
+	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
+		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
+		if err != nil {
+			return err
+		}
+		managedRoleGroups[roleName] = string(data)
+	}
+
+	for _, orgID := range orgIDs {
+		for roleName, data := range managedRoleGroups {
+			if _, err := tx.NewUpdate().
+				Model(new(roles)).
+				Set("transaction_groups = ?", data).
+				Where("org_id = ?", orgID).
+				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
+				Where("name = ?", roleName).
+				Exec(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addLicenseTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/types/coretypes/registry_managed_role.go

@@ -64,10 +64,10 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindFactorPassword}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindFactorPassword}, WildCardSelectorString)},
 		// license — admin only.
-		// Uniform LCRUD shape; actual ee routes are POST /api/v3/licenses (create
-		// = Activate), PUT /api/v3/licenses (update = Refresh), GET
-		// /api/v3/licenses/active (read; currently exposed as ViewAccess on the
-		// route side). delete and list are placeholders for shape parity, no
+		// Uniform LCRUD shape; routes are POST /api/v3/licenses (create =
+		// Activate) and PUT /api/v3/licenses (update = Refresh). GET
+		// /api/v3/licenses/active is OpenAccess, so the read grant is not
+		// route-enforced. delete and list are placeholders for shape parity, no
 		// route serves them today.
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLicense}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLicense}, WildCardSelectorString)},

tests/fixtures/auth.py

@@ -453,3 +453,34 @@ def change_user_role(
         timeout=5,
     )
     assert response.status_code == HTTPStatus.CREATED, response.text
+
+
+def license_mapping(license_id: str, key: str, valid_from: int) -> Mapping:
+    return Mapping(
+        request=MappingRequest(
+            method=HttpMethods.GET,
+            url="/v2/licenses/me",
+            headers={"X-Signoz-Cloud-Api-Key": {WireMockMatchers.EQUAL_TO: key}},
+        ),
+        response=MappingResponse(
+            status=200,
+            json_body={
+                "status": "success",
+                "data": {
+                    "id": license_id,
+                    "key": key,
+                    "valid_from": valid_from,
+                    "valid_until": -1,
+                    "status": "VALID",
+                    "state": "EVALUATING",
+                    "plan": {
+                        "name": "ENTERPRISE",
+                    },
+                    "platform": "CLOUD",
+                    "features": [],
+                    "event_queue": {},
+                },
+            },
+        ),
+        persistent=False,
+    )

tests/integration/tests/passwordauthn/09_license_authz.py

@@ -0,0 +1,186 @@
+import http
+from collections.abc import Callable
+
+import requests
+from wiremock.client import Mapping
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    change_user_role,
+    create_active_user,
+    license_mapping,
+)
+from fixtures.role import transaction_group
+
+_EDITOR_EMAIL = "editor+licenseauthz@integration.test"
+_EDITOR_PASSWORD = "password123Z$"
+_VIEWER_EMAIL = "viewer+licenseauthz@integration.test"
+_VIEWER_PASSWORD = "password123Z$"
+
+_ACTOR_ROLE_NAME = "license-fga-actor"
+_ACTOR_EMAIL = "customrole+licenseauthz@integration.test"
+_ACTOR_PASSWORD = "password123Z$"
+
+_LICENSE_ID = "0196360e-90cd-7a74-8313-1aa815ce2a69"
+_LICENSE_KEY = "secret-key-authz"
+
+
+def test_admin_can_activate_license(
+    signoz: types.SigNoz,
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+) -> None:
+    make_http_mocks(signoz.zeus, [license_mapping(_LICENSE_ID, _LICENSE_KEY, valid_from=1732146930)])
+
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    for email, role, password, name in (
+        (_EDITOR_EMAIL, "signoz-editor", _EDITOR_PASSWORD, "license authz editor"),
+        (_VIEWER_EMAIL, "signoz-viewer", _VIEWER_PASSWORD, "license authz viewer"),
+    ):
+        create_active_user(signoz, admin_token, email=email, role=role, password=password, name=name)
+
+    response = requests.post(
+        url=signoz.self.host_configs["8080"].get("/api/v3/licenses"),
+        json={"key": _LICENSE_KEY},
+        headers={"Authorization": "Bearer " + admin_token},
+        timeout=5,
+    )
+
+    assert response.status_code == http.HTTPStatus.ACCEPTED, response.text
+
+
+def test_editor_and_viewer_forbidden(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    for email, password in ((_EDITOR_EMAIL, _EDITOR_PASSWORD), (_VIEWER_EMAIL, _VIEWER_PASSWORD)):
+        token = get_token(email, password)
+
+        response = requests.post(
+            url=signoz.self.host_configs["8080"].get("/api/v3/licenses"),
+            json={"key": _LICENSE_KEY},
+            headers={"Authorization": "Bearer " + token},
+            timeout=5,
+        )
+        assert response.status_code == http.HTTPStatus.FORBIDDEN, f"{email} activate: expected 403, got {response.status_code}: {response.text}"
+
+        response = requests.put(
+            url=signoz.self.host_configs["8080"].get("/api/v3/licenses"),
+            headers={"Authorization": "Bearer " + token},
+            timeout=5,
+        )
+        assert response.status_code == http.HTTPStatus.FORBIDDEN, f"{email} refresh: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_all_roles_can_get_active_license(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    for email, password in (
+        (USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD),
+        (_EDITOR_EMAIL, _EDITOR_PASSWORD),
+        (_VIEWER_EMAIL, _VIEWER_PASSWORD),
+    ):
+        token = get_token(email, password)
+
+        response = requests.get(
+            url=signoz.self.host_configs["8080"].get("/api/v3/licenses/active"),
+            headers={"Authorization": "Bearer " + token},
+            timeout=5,
+        )
+        assert response.status_code == http.HTTPStatus.OK, f"{email} get active: expected 200, got {response.status_code}: {response.text}"
+        assert response.json()["data"]["key"] == _LICENSE_KEY
+
+
+def test_admin_can_refresh_license(
+    signoz: types.SigNoz,
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+) -> None:
+    make_http_mocks(signoz.zeus, [license_mapping(_LICENSE_ID, _LICENSE_KEY, valid_from=1732146931)])
+
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.put(
+        url=signoz.self.host_configs["8080"].get("/api/v3/licenses"),
+        headers={"Authorization": "Bearer " + admin_token},
+        timeout=5,
+    )
+    assert response.status_code == http.HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(
+        url=signoz.self.host_configs["8080"].get("/api/v3/licenses/active"),
+        headers={"Authorization": "Bearer " + admin_token},
+        timeout=5,
+    )
+    assert response.status_code == http.HTTPStatus.OK, response.text
+    assert response.json()["data"]["valid_from"] == 1732146931
+
+
+def test_custom_role_license_grant(
+    signoz: types.SigNoz,
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    role_id = create_role(admin_token, _ACTOR_ROLE_NAME)
+    user_id = create_active_user(
+        signoz,
+        admin_token,
+        email=_ACTOR_EMAIL,
+        role="signoz-viewer",
+        password=_ACTOR_PASSWORD,
+        name="license authz custom role actor",
+    )
+    change_user_role(signoz, admin_token, user_id, "signoz-viewer", _ACTOR_ROLE_NAME)
+
+    actor_token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    response = requests.put(
+        url=signoz.self.host_configs["8080"].get("/api/v3/licenses"),
+        headers={"Authorization": "Bearer " + actor_token},
+        timeout=5,
+    )
+    assert response.status_code == http.HTTPStatus.FORBIDDEN, f"refresh without grant: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        url=signoz.self.host_configs["8080"].get(f"/api/v1/roles/{role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("update", "metaresource", "license", ["*"]),
+            ],
+        },
+        headers={"Authorization": "Bearer " + admin_token},
+        timeout=5,
+    )
+    assert response.status_code == http.HTTPStatus.NO_CONTENT, response.text
+
+    make_http_mocks(signoz.zeus, [license_mapping(_LICENSE_ID, _LICENSE_KEY, valid_from=1732146932)])
+
+    response = requests.put(
+        url=signoz.self.host_configs["8080"].get("/api/v3/licenses"),
+        headers={"Authorization": "Bearer " + actor_token},
+        timeout=5,
+    )
+    assert response.status_code == http.HTTPStatus.NO_CONTENT, f"refresh with grant: expected 204, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        url=signoz.self.host_configs["8080"].get(f"/api/v1/roles/{role_id}"),
+        json={"description": "", "transactionGroups": []},
+        headers={"Authorization": "Bearer " + admin_token},
+        timeout=5,
+    )
+    assert response.status_code == http.HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.put(
+        url=signoz.self.host_configs["8080"].get("/api/v3/licenses"),
+        headers={"Authorization": "Bearer " + actor_token},
+        timeout=5,
+    )
+    assert response.status_code == http.HTTPStatus.FORBIDDEN, f"refresh after revoke: expected 403, got {response.status_code}: {response.text}"