chore(dev): make signoz http/private/opamp ports and sqlite path configurable

#### Description

- Adds end-to-end coverage for the google authn flow
(`callbackauthn/04_google.py`): happy-path login, hd-claim mismatch
rejection, unverified-email rejection + `insecureSkipEmailVerified`
opt-in, and roleMapping defaultRole.
- The google callback authn hardcodes `https://accounts.google.com` as
its issuer and fully verifies the RS256 id_token, so a wiremock
container impersonates Google: it joins the test network under the
`accounts.google.com` alias and serves HTTPS with a certificate issued
by a new integration CA (`tests/fixtures/tls.py`), which every signoz
container now trusts via `SSL_CERT_FILE`.
- Stubs (discovery, auto-approving authorize, token, JWKS) are installed
per test via the existing `make_http_mocks` fixture with a pre-signed
id_token for the identity under test; one session-scoped RSA key signs
all tokens.

.claude/rules/pytest.md

@@ -0,0 +1,19 @@
+---
+paths:
+  - "tests/**/*.py"
+---
+
+# pytest conventions
+
+For the Python integration suite under `tests/`. Setup, running, and suite layout live in [`docs/contributing/tests/integration.md`](../../docs/contributing/tests/integration.md).
+
+- **No `_`-prefixed helper functions in test modules — this is the rule that matters most.** A reader must be able to see what a test does in its body alone, without chasing private helpers that scatter the meaning across the file. Inline the logic: an expression, a comprehension, a few repeated lines are all fine — repetition across tests is cheaper than indirection. When several tests genuinely share non-trivial setup or assertions, that is what fixtures are for — in `tests/fixtures/`, see the next rule. A module-level `_helper()` is never the answer.
+- **Fixtures live in `tests/fixtures/` — never under `integration/tests/`.** Not in test modules, not in suite `conftest.py` files. `tests/fixtures/` is the shared library (auth, signoz, clickhouse, logs/metrics/traces seeding, …): reuse what's there before writing anything new; when a new fixture is genuinely needed, add it to the matching `tests/fixtures/` module and register new modules in `tests/conftest.py` `pytest_plugins`. **The one exception: SigNoz-level fixtures in a suite's `conftest.py`.** A suite that needs its own SigNoz spun up with different envs (`create_signoz`/`create_migrator` with `env_overrides` + `cache_key` — e.g. basepath, metricreduction, querier_json_body) keeps that in its `conftest.py`; that is always okay.
+- **Fixture only when there is a lifecycle; otherwise a plain function.** A fixture earns its indirection by owning setup/teardown (`yield` + cleanup — `insert_metrics` truncating on teardown) or by provisioning a resource (containers, SigNoz instances). A stateless action or lookup (`create_saved_view`, `find_saved_view_by_name`, wiping a resource list) is a plain importable function in the matching `tests/fixtures/` module, taking `signoz`/`token` as ordinary arguments — never wrap a plain callable in a fixture-factory just to inject `signoz`.
+- **Fixtures own their cleanup.** When a test needs seeded state, put the seed + cleanup pair in a fixture (`yield`, then tear down) so tests in the same suite don't interfere — the pattern `insert_metrics` sets: yield a callable, truncate on teardown.
+- **Fixture-factory over indirect parametrization.** A fixture that yields a callable (e.g. `insert_metrics(metrics)`) is clearer than `@pytest.mark.parametrize(..., indirect=True)` + `request.param` — the value is an explicit argument, not resolved by magic.
+- **Skip at collection, not inside the test body.** Use `pytest.param(..., marks=pytest.mark.skip(reason="…"))` so a skipped case shows as SKIPPED-with-reason **and** short-circuits before its fixtures run (no environment spin-up for a test that won't execute).
+- **Test config comes from explicit `--flags`, not the environment.** Wire configuration as pytest options declared in `tests/conftest.py` (`pytest_addoption` — e.g. `--sqlstore-provider`, `--clickhouse-version`); do **not** add `os.environ` fallbacks inside tests or fixtures.
+- **snake_case parametrize ids.** `ids=["fill_gaps", "fill_zero"]`, not camelCase.
+- **Name suite files with the two-digit prefix (`NN_*.py`).** `pyproject.toml` restricts collection to `[0-9][0-9]_*.py` (plus the bootstrap `setup.py` / `run.py`) — a file that doesn't match is silently never collected.
+- **Always run pytest from `tests/`.** `--import-mode=importlib` is what allows same-basename files across suites (`querier/01_logs.py` vs `rawexportdata/01_logs.py`), but it disables pytest's implicit `sys.path` injection — `import fixtures` only resolves via `pythonpath = ["."]` from that rootdir.

.github/workflows/goci.yaml

@@ -53,6 +53,21 @@ jobs:
     with:
       PRIMUS_REF: main
       GO_VERSION: 1.24
+  semconv-generated:
+    if: |
+      github.event_name == 'merge_group' ||
+      (github.event_name == 'pull_request' && ! github.event.pull_request.head.repo.fork && github.event.pull_request.user.login != 'dependabot[bot]' && ! contains(github.event.pull_request.labels.*.name, 'safe-to-test')) ||
+      (github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'safe-to-test'))
+    runs-on: ubuntu-latest
+    steps:
+      - name: self-checkout
+        uses: actions/checkout@v4
+      - name: go-install
+        uses: actions/setup-go@v5
+        with:
+          go-version: "1.24"
+      - name: check-semconv-generated-files
+        run: go run ./scripts/semconv -check
   build:
     if: |
       github.event_name == 'merge_group' ||

.github/workflows/integrationci.yaml

@@ -58,7 +58,6 @@ jobs:
           - querierai
           - rawexportdata
           - promqlconformance
-          - promapiconformance
           - querierauthz
           - role
           - rootuser

Makefile

@@ -81,16 +81,24 @@ devenv-clickhouse-clean: ## Clean all ClickHouse data from filesystem
 ##############################################################
 # go commands
 ##############################################################
+SQLITE_PATH             ?= signoz.db
+HTTP_HOST_PORT          ?= 0.0.0.0:8080
+PRIVATE_HOST_PORT       ?= 0.0.0.0:8085
+OPAMP_WS_ENDPOINT       ?= 0.0.0.0:4320
+
 .PHONY: go-run-enterprise
 go-run-enterprise: ## Runs the enterprise go backend server
 	@SIGNOZ_INSTRUMENTATION_LOGS_LEVEL=debug \
-	SIGNOZ_SQLSTORE_SQLITE_PATH=signoz.db \
+	SIGNOZ_SQLSTORE_SQLITE_PATH=$(SQLITE_PATH) \
 	SIGNOZ_WEB_ENABLED=false \
 	SIGNOZ_TOKENIZER_JWT_SECRET=secret \
 	SIGNOZ_ALERTMANAGER_PROVIDER=signoz \
 	SIGNOZ_TELEMETRYSTORE_PROVIDER=clickhouse \
 	SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN=tcp://127.0.0.1:9000 \
 	SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_CLUSTER=cluster \
+	SIGNOZ_HTTP_HOST_PORT=$(HTTP_HOST_PORT) \
+	SIGNOZ_PRIVATE_HOST_PORT=$(PRIVATE_HOST_PORT) \
+	SIGNOZ_OPAMP_WS_ENDPOINT=$(OPAMP_WS_ENDPOINT) \
 	go run -race \
 		$(GO_BUILD_CONTEXT_ENTERPRISE)/*.go server
 
@@ -101,16 +109,30 @@ go-test: ## Runs go unit tests
 .PHONY: go-run-community
 go-run-community: ## Runs the community go backend server
 	@SIGNOZ_INSTRUMENTATION_LOGS_LEVEL=debug \
-	SIGNOZ_SQLSTORE_SQLITE_PATH=signoz.db \
+	SIGNOZ_SQLSTORE_SQLITE_PATH=$(SQLITE_PATH) \
 	SIGNOZ_WEB_ENABLED=false \
 	SIGNOZ_TOKENIZER_JWT_SECRET=secret \
 	SIGNOZ_ALERTMANAGER_PROVIDER=signoz \
 	SIGNOZ_TELEMETRYSTORE_PROVIDER=clickhouse \
 	SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN=tcp://127.0.0.1:9000 \
 	SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_CLUSTER=cluster \
+	SIGNOZ_HTTP_HOST_PORT=$(HTTP_HOST_PORT) \
+	SIGNOZ_PRIVATE_HOST_PORT=$(PRIVATE_HOST_PORT) \
+	SIGNOZ_OPAMP_WS_ENDPOINT=$(OPAMP_WS_ENDPOINT) \
 	go run -race \
 		$(GO_BUILD_CONTEXT_COMMUNITY)/*.go server
 
+.PHONY: go-stop
+go-stop: ## Stops the go backend server listening on HTTP_HOST_PORT
+	@PORT=$(lastword $(subst :, ,$(HTTP_HOST_PORT))); \
+	PIDS=$$(lsof -ti tcp:$$PORT); \
+	if [ -n "$$PIDS" ]; then \
+		kill $$PIDS; \
+		echo "Stopped signoz server on port $$PORT (pid $$PIDS)"; \
+	else \
+		echo "No signoz server running on port $$PORT"; \
+	fi
+
 .PHONY: go-build-community $(GO_BUILD_ARCHS_COMMUNITY)
 go-build-community: ## Builds the go backend server for community
 go-build-community: $(GO_BUILD_ARCHS_COMMUNITY)
@@ -233,6 +255,10 @@ py-clean: ## Clear all pycache and pytest cache from tests directory recursively
 ##############################################################
 # generate commands
 ##############################################################
+.PHONY: semconv-generate
+semconv-generate: ## Regenerate semantic-convention families for Go and TypeScript
+	@go run ./scripts/semconv
+
 .PHONY: gen-mocks
 gen-mocks:
 	@echo ">> Generating mocks"

docs/api/openapi.yml

@@ -4212,6 +4212,21 @@ components:
       - missingOptionalMetrics
       - missingRequiredAttributes
       type: object
+    InframonitoringtypesClusterFilter:
+      properties:
+        expression:
+          type: string
+        filterByNodeReadiness:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesNodeCondition'
+          nullable: true
+          type: array
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
     InframonitoringtypesClusterRecord:
       properties:
         clusterCPU:
@@ -4349,6 +4364,16 @@ components:
       - containerCannotRun
       - unknown
       type: object
+    InframonitoringtypesContainerFilter:
+      properties:
+        expression:
+          type: string
+        filterByContainerStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesContainerStatus'
+          nullable: true
+          type: array
+      type: object
     InframonitoringtypesContainerReady:
       enum:
       - ready
@@ -4448,6 +4473,16 @@ components:
       - total
       - endTimeBeforeRetention
       type: object
+    InframonitoringtypesDaemonSetFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
     InframonitoringtypesDaemonSetRecord:
       properties:
         currentNodes:
@@ -4520,6 +4555,16 @@ components:
       - total
       - endTimeBeforeRetention
       type: object
+    InframonitoringtypesDeploymentFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
     InframonitoringtypesDeploymentRecord:
       properties:
         availablePods:
@@ -4661,6 +4706,16 @@ components:
       - total
       - endTimeBeforeRetention
       type: object
+    InframonitoringtypesJobFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
     InframonitoringtypesJobRecord:
       properties:
         activePods:
@@ -4784,6 +4839,16 @@ components:
       - message
       - documentationLink
       type: object
+    InframonitoringtypesNamespaceFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
     InframonitoringtypesNamespaceRecord:
       properties:
         counts:
@@ -4865,6 +4930,21 @@ components:
       - ready
       - notReady
       type: object
+    InframonitoringtypesNodeFilter:
+      properties:
+        expression:
+          type: string
+        filterByNodeReadiness:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesNodeCondition'
+          nullable: true
+          type: array
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
     InframonitoringtypesNodeRecord:
       properties:
         condition:
@@ -4981,6 +5061,16 @@ components:
       - shutdown
       - unexpectedAdmissionError
       type: object
+    InframonitoringtypesPodFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
     InframonitoringtypesPodRecord:
       properties:
         meta:
@@ -5080,7 +5170,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesClusterFilter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5106,7 +5196,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesContainerFilter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5132,7 +5222,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesDaemonSetFilter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5158,7 +5248,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesDeploymentFilter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5210,7 +5300,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesJobFilter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5236,7 +5326,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesNamespaceFilter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5262,7 +5352,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesNodeFilter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5288,7 +5378,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesPodFilter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5314,7 +5404,7 @@ components:
           format: int64
           type: integer
         filter:
-          $ref: '#/components/schemas/Querybuildertypesv5Filter'
+          $ref: '#/components/schemas/InframonitoringtypesStatefulSetFilter'
         groupBy:
           items:
             $ref: '#/components/schemas/Querybuildertypesv5GroupByKey'
@@ -5365,6 +5455,16 @@ components:
       - list
       - grouped_list
       type: string
+    InframonitoringtypesStatefulSetFilter:
+      properties:
+        expression:
+          type: string
+        filterByPodStatus:
+          items:
+            $ref: '#/components/schemas/InframonitoringtypesPodStatus'
+          nullable: true
+          type: array
+      type: object
     InframonitoringtypesStatefulSetRecord:
       properties:
         currentPods:
@@ -8838,15 +8938,6 @@ components:
       required:
       - id
       type: object
-    TypesPostableBulkInviteRequest:
-      properties:
-        invites:
-          items:
-            $ref: '#/components/schemas/TypesPostableInvite'
-          type: array
-      required:
-      - invites
-      type: object
     TypesPostableForgotPassword:
       properties:
         email:
@@ -11454,57 +11545,6 @@ paths:
       summary: Create invite
       tags:
       - users
-  /api/v1/invite/bulk:
-    post:
-      deprecated: true
-      description: This endpoint creates a bulk invite for a user
-      operationId: CreateBulkInvite
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/TypesPostableBulkInviteRequest'
-      responses:
-        "201":
-          description: Created
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "409":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Conflict
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Create bulk invite
-      tags:
-      - users
   /api/v1/llm_pricing_rules:
     get:
       deprecated: false
@@ -12158,9 +12198,9 @@ paths:
       - dashboard
   /api/v1/resetPassword:
     post:
-      deprecated: false
+      deprecated: true
       description: This endpoint resets the password by token
-      operationId: ResetPassword
+      operationId: ResetPasswordDeprecated
       requestBody:
         content:
           application/json:
@@ -14428,177 +14468,6 @@ paths:
       summary: List users
       tags:
       - users
-  /api/v1/user/{id}:
-    delete:
-      deprecated: true
-      description: This endpoint deletes the user by id
-      operationId: DeleteUserDeprecated
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      responses:
-        "204":
-          description: No Content
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Delete user
-      tags:
-      - users
-    get:
-      deprecated: true
-      description: This endpoint returns the user by id
-      operationId: GetUserDeprecated
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/TypesDeprecatedUser'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Get user
-      tags:
-      - users
-    put:
-      deprecated: true
-      description: This endpoint updates the user by id
-      operationId: UpdateUserDeprecated
-      parameters:
-      - in: path
-        name: id
-        required: true
-        schema:
-          type: string
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/TypesDeprecatedUser'
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/TypesDeprecatedUser'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
-      summary: Update user
-      tags:
-      - users
   /api/v1/user/me:
     get:
       deprecated: true
@@ -15698,6 +15567,41 @@ paths:
       summary: Forgot password
       tags:
       - users
+  /api/v2/factor_password/reset:
+    post:
+      deprecated: false
+      description: This endpoint resets the password using a single use reset password
+        token
+      operationId: ResetPassword
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/TypesPostableResetPassword'
+      responses:
+        "204":
+          description: No Content
+        "400":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Bad Request
+        "404":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Not Found
+        "500":
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/RenderErrorResponse'
+          description: Internal Server Error
+      summary: Reset password
+      tags:
+      - users
   /api/v2/features:
     get:
       deprecated: false

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -5648,6 +5648,47 @@ export interface InframonitoringtypesChecksDTO {
 	type: InframonitoringtypesCheckTypeDTO;
 }
 
+export enum InframonitoringtypesNodeConditionDTO {
+	ready = 'ready',
+	not_ready = 'not_ready',
+	no_data = 'no_data',
+}
+export enum InframonitoringtypesPodStatusDTO {
+	pending = 'pending',
+	running = 'running',
+	failed = 'failed',
+	unknown = 'unknown',
+	crashloopbackoff = 'crashloopbackoff',
+	imagepullbackoff = 'imagepullbackoff',
+	errimagepull = 'errimagepull',
+	createcontainerconfigerror = 'createcontainerconfigerror',
+	containercreating = 'containercreating',
+	oomkilled = 'oomkilled',
+	completed = 'completed',
+	error = 'error',
+	containercannotrun = 'containercannotrun',
+	evicted = 'evicted',
+	nodeaffinity = 'nodeaffinity',
+	nodelost = 'nodelost',
+	shutdown = 'shutdown',
+	unexpectedadmissionerror = 'unexpectedadmissionerror',
+	no_data = 'no_data',
+}
+export interface InframonitoringtypesClusterFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByNodeReadiness?: InframonitoringtypesNodeConditionDTO[] | null;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesClusterRecordDTOCounts = {
 	/**
 	 * @type integer
@@ -5923,21 +5964,6 @@ export interface InframonitoringtypesContainerCountsByStatusDTO {
 	waiting: number;
 }
 
-export enum InframonitoringtypesContainerReadyDTO {
-	ready = 'ready',
-	not_ready = 'not_ready',
-	no_data = 'no_data',
-}
-export type InframonitoringtypesContainerRecordDTOMetaAnyOf = {
-	[key: string]: string;
-};
-
-/**
- * @nullable
- */
-export type InframonitoringtypesContainerRecordDTOMeta =
-	InframonitoringtypesContainerRecordDTOMetaAnyOf | null;
-
 export enum InframonitoringtypesContainerStatusDTO {
 	running = 'running',
 	waiting = 'waiting',
@@ -5954,6 +5980,32 @@ export enum InframonitoringtypesContainerStatusDTO {
 	unknown = 'unknown',
 	no_data = 'no_data',
 }
+export interface InframonitoringtypesContainerFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByContainerStatus?: InframonitoringtypesContainerStatusDTO[] | null;
+}
+
+export enum InframonitoringtypesContainerReadyDTO {
+	ready = 'ready',
+	not_ready = 'not_ready',
+	no_data = 'no_data',
+}
+export type InframonitoringtypesContainerRecordDTOMetaAnyOf = {
+	[key: string]: string;
+};
+
+/**
+ * @nullable
+ */
+export type InframonitoringtypesContainerRecordDTOMeta =
+	InframonitoringtypesContainerRecordDTOMetaAnyOf | null;
+
 export interface InframonitoringtypesContainerRecordDTO {
 	containerCountsByReady: InframonitoringtypesContainerCountsByReadyDTO;
 	containerCountsByStatus: InframonitoringtypesContainerCountsByStatusDTO;
@@ -6025,6 +6077,17 @@ export interface InframonitoringtypesContainersDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
+export interface InframonitoringtypesDaemonSetFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesDaemonSetRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6110,6 +6173,17 @@ export interface InframonitoringtypesDaemonSetsDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
+export interface InframonitoringtypesDeploymentFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesDeploymentRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6272,6 +6346,17 @@ export interface InframonitoringtypesHostsDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
+export interface InframonitoringtypesJobFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesJobRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6357,6 +6442,17 @@ export interface InframonitoringtypesJobsDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
+export interface InframonitoringtypesNamespaceFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesNamespaceRecordDTOCounts = {
 	/**
 	 * @type integer
@@ -6433,11 +6529,21 @@ export interface InframonitoringtypesNamespacesDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
-export enum InframonitoringtypesNodeConditionDTO {
-	ready = 'ready',
-	not_ready = 'not_ready',
-	no_data = 'no_data',
+export interface InframonitoringtypesNodeFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByNodeReadiness?: InframonitoringtypesNodeConditionDTO[] | null;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
 }
+
 export type InframonitoringtypesNodeRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6499,6 +6605,17 @@ export interface InframonitoringtypesNodesDTO {
 	warning?: Querybuildertypesv5QueryWarnDataDTO;
 }
 
+export interface InframonitoringtypesPodFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export type InframonitoringtypesPodRecordDTOMetaAnyOf = {
 	[key: string]: string;
 };
@@ -6509,27 +6626,6 @@ export type InframonitoringtypesPodRecordDTOMetaAnyOf = {
 export type InframonitoringtypesPodRecordDTOMeta =
 	InframonitoringtypesPodRecordDTOMetaAnyOf | null;
 
-export enum InframonitoringtypesPodStatusDTO {
-	pending = 'pending',
-	running = 'running',
-	failed = 'failed',
-	unknown = 'unknown',
-	crashloopbackoff = 'crashloopbackoff',
-	imagepullbackoff = 'imagepullbackoff',
-	errimagepull = 'errimagepull',
-	createcontainerconfigerror = 'createcontainerconfigerror',
-	containercreating = 'containercreating',
-	oomkilled = 'oomkilled',
-	completed = 'completed',
-	error = 'error',
-	containercannotrun = 'containercannotrun',
-	evicted = 'evicted',
-	nodeaffinity = 'nodeaffinity',
-	nodelost = 'nodelost',
-	shutdown = 'shutdown',
-	unexpectedadmissionerror = 'unexpectedadmissionerror',
-	no_data = 'no_data',
-}
 export interface InframonitoringtypesPodRecordDTO {
 	/**
 	 * @type object,null
@@ -6606,7 +6702,7 @@ export interface InframonitoringtypesPostableClustersDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesClusterFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6633,7 +6729,7 @@ export interface InframonitoringtypesPostableContainersDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesContainerFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6660,7 +6756,7 @@ export interface InframonitoringtypesPostableDaemonSetsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesDaemonSetFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6687,7 +6783,7 @@ export interface InframonitoringtypesPostableDeploymentsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesDeploymentFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6741,7 +6837,7 @@ export interface InframonitoringtypesPostableJobsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesJobFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6768,7 +6864,7 @@ export interface InframonitoringtypesPostableNamespacesDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesNamespaceFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6795,7 +6891,7 @@ export interface InframonitoringtypesPostableNodesDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesNodeFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6822,7 +6918,7 @@ export interface InframonitoringtypesPostablePodsDTO {
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesPodFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -6843,13 +6939,24 @@ export interface InframonitoringtypesPostablePodsDTO {
 	start: number;
 }
 
+export interface InframonitoringtypesStatefulSetFilterDTO {
+	/**
+	 * @type string
+	 */
+	expression?: string;
+	/**
+	 * @type array,null
+	 */
+	filterByPodStatus?: InframonitoringtypesPodStatusDTO[] | null;
+}
+
 export interface InframonitoringtypesPostableStatefulSetsDTO {
 	/**
 	 * @type integer
 	 * @format int64
 	 */
 	end: number;
-	filter?: Querybuildertypesv5FilterDTO;
+	filter?: InframonitoringtypesStatefulSetFilterDTO;
 	/**
 	 * @type array,null
 	 */
@@ -9950,6 +10057,21 @@ export interface TypesOrganizationDTO {
 	updatedAt?: string;
 }
 
+export interface TypesPostableForgotPasswordDTO {
+	/**
+	 * @type string
+	 */
+	email: string;
+	/**
+	 * @type string
+	 */
+	frontendBaseURL?: string;
+	/**
+	 * @type string
+	 */
+	orgId: string;
+}
+
 export interface TypesPostableInviteDTO {
 	/**
 	 * @type string
@@ -9969,28 +10091,6 @@ export interface TypesPostableInviteDTO {
 	role?: string;
 }
 
-export interface TypesPostableBulkInviteRequestDTO {
-	/**
-	 * @type array
-	 */
-	invites: TypesPostableInviteDTO[];
-}
-
-export interface TypesPostableForgotPasswordDTO {
-	/**
-	 * @type string
-	 */
-	email: string;
-	/**
-	 * @type string
-	 */
-	frontendBaseURL?: string;
-	/**
-	 * @type string
-	 */
-	orgId: string;
-}
-
 export interface TypesPostableResetPasswordDTO {
 	/**
 	 * @type string
@@ -11101,31 +11201,6 @@ export type ListUsersDeprecated200 = {
 	status: string;
 };
 
-export type DeleteUserDeprecatedPathParameters = {
-	id: string;
-};
-export type GetUserDeprecatedPathParameters = {
-	id: string;
-};
-export type GetUserDeprecated200 = {
-	data: TypesDeprecatedUserDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type UpdateUserDeprecatedPathParameters = {
-	id: string;
-};
-export type UpdateUserDeprecated200 = {
-	data: TypesDeprecatedUserDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
 export type GetMyUserDeprecated200 = {
 	data: TypesDeprecatedUserDTO;
 	/**

frontend/src/api/generated/services/users/index.ts

@@ -25,7 +25,6 @@ import type {
 	CreateResetPasswordTokenPathParameters,
 	CreateUser201,
 	CreateUserRole201,
-	DeleteUserDeprecatedPathParameters,
 	DeleteUserPathParameters,
 	DeleteUserRolePathParameters,
 	GetMyUser200,
@@ -37,8 +36,6 @@ import type {
 	GetRolesByUserID200,
 	GetRolesByUserIDPathParameters,
 	GetUser200,
-	GetUserDeprecated200,
-	GetUserDeprecatedPathParameters,
 	GetUserPathParameters,
 	GetUserRole200,
 	GetUserRolePathParameters,
@@ -50,16 +47,12 @@ import type {
 	RenderErrorResponseDTO,
 	SetRoleByUserIDPathParameters,
 	TypesChangePasswordRequestDTO,
-	TypesDeprecatedUserDTO,
-	TypesPostableBulkInviteRequestDTO,
 	TypesPostableForgotPasswordDTO,
 	TypesPostableInviteDTO,
 	TypesPostableResetPasswordDTO,
 	TypesPostableRoleDTO,
 	TypesPostableVerifyResetPasswordTokenDTO,
 	TypesUpdatableUserDTO,
-	UpdateUserDeprecated200,
-	UpdateUserDeprecatedPathParameters,
 	UpdateUserPathParameters,
 } from '../sigNoz.schemas';
 
@@ -260,96 +253,12 @@ export const useCreateInvite = <
 > => {
 	return useMutation(getCreateInviteMutationOptions(options));
 };
-/**
- * This endpoint creates a bulk invite for a user
- * @deprecated
- * @summary Create bulk invite
- */
-export const createBulkInvite = (
-	typesPostableBulkInviteRequestDTO?: BodyType<TypesPostableBulkInviteRequestDTO>,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<void>({
-		url: `/api/v1/invite/bulk`,
-		method: 'POST',
-		headers: { 'Content-Type': 'application/json' },
-		data: typesPostableBulkInviteRequestDTO,
-		signal,
-	});
-};
-
-export const getCreateBulkInviteMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof createBulkInvite>>,
-		TError,
-		{ data?: BodyType<TypesPostableBulkInviteRequestDTO> },
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof createBulkInvite>>,
-	TError,
-	{ data?: BodyType<TypesPostableBulkInviteRequestDTO> },
-	TContext
-> => {
-	const mutationKey = ['createBulkInvite'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof createBulkInvite>>,
-		{ data?: BodyType<TypesPostableBulkInviteRequestDTO> }
-	> = (props) => {
-		const { data } = props ?? {};
-
-		return createBulkInvite(data);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type CreateBulkInviteMutationResult = NonNullable<
-	Awaited<ReturnType<typeof createBulkInvite>>
->;
-export type CreateBulkInviteMutationBody =
-	| BodyType<TypesPostableBulkInviteRequestDTO>
-	| undefined;
-export type CreateBulkInviteMutationError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @deprecated
- * @summary Create bulk invite
- */
-export const useCreateBulkInvite = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof createBulkInvite>>,
-		TError,
-		{ data?: BodyType<TypesPostableBulkInviteRequestDTO> },
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof createBulkInvite>>,
-	TError,
-	{ data?: BodyType<TypesPostableBulkInviteRequestDTO> },
-	TContext
-> => {
-	return useMutation(getCreateBulkInviteMutationOptions(options));
-};
 /**
  * This endpoint resets the password by token
+ * @deprecated
  * @summary Reset password
  */
-export const resetPassword = (
+export const resetPasswordDeprecated = (
 	typesPostableResetPasswordDTO?: BodyType<TypesPostableResetPasswordDTO>,
 	signal?: AbortSignal,
 ) => {
@@ -362,23 +271,23 @@ export const resetPassword = (
 	});
 };
 
-export const getResetPasswordMutationOptions = <
+export const getResetPasswordDeprecatedMutationOptions = <
 	TError = ErrorType<RenderErrorResponseDTO>,
 	TContext = unknown,
 >(options?: {
 	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof resetPassword>>,
+		Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 		TError,
 		{ data?: BodyType<TypesPostableResetPasswordDTO> },
 		TContext
 	>;
 }): UseMutationOptions<
-	Awaited<ReturnType<typeof resetPassword>>,
+	Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 	TError,
 	{ data?: BodyType<TypesPostableResetPasswordDTO> },
 	TContext
 > => {
-	const mutationKey = ['resetPassword'];
+	const mutationKey = ['resetPasswordDeprecated'];
 	const { mutation: mutationOptions } = options
 		? options.mutation &&
 			'mutationKey' in options.mutation &&
@@ -388,45 +297,47 @@ export const getResetPasswordMutationOptions = <
 		: { mutation: { mutationKey } };
 
 	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof resetPassword>>,
+		Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 		{ data?: BodyType<TypesPostableResetPasswordDTO> }
 	> = (props) => {
 		const { data } = props ?? {};
 
-		return resetPassword(data);
+		return resetPasswordDeprecated(data);
 	};
 
 	return { mutationFn, ...mutationOptions };
 };
 
-export type ResetPasswordMutationResult = NonNullable<
-	Awaited<ReturnType<typeof resetPassword>>
+export type ResetPasswordDeprecatedMutationResult = NonNullable<
+	Awaited<ReturnType<typeof resetPasswordDeprecated>>
 >;
-export type ResetPasswordMutationBody =
+export type ResetPasswordDeprecatedMutationBody =
 	| BodyType<TypesPostableResetPasswordDTO>
 	| undefined;
-export type ResetPasswordMutationError = ErrorType<RenderErrorResponseDTO>;
+export type ResetPasswordDeprecatedMutationError =
+	ErrorType<RenderErrorResponseDTO>;
 
 /**
+ * @deprecated
  * @summary Reset password
  */
-export const useResetPassword = <
+export const useResetPasswordDeprecated = <
 	TError = ErrorType<RenderErrorResponseDTO>,
 	TContext = unknown,
 >(options?: {
 	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof resetPassword>>,
+		Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 		TError,
 		{ data?: BodyType<TypesPostableResetPasswordDTO> },
 		TContext
 	>;
 }): UseMutationResult<
-	Awaited<ReturnType<typeof resetPassword>>,
+	Awaited<ReturnType<typeof resetPasswordDeprecated>>,
 	TError,
 	{ data?: BodyType<TypesPostableResetPasswordDTO> },
 	TContext
 > => {
-	return useMutation(getResetPasswordMutationOptions(options));
+	return useMutation(getResetPasswordDeprecatedMutationOptions(options));
 };
 /**
  * This endpoint lists all users
@@ -515,295 +426,6 @@ export const invalidateListUsersDeprecated = async (
 	return queryClient;
 };
 
-/**
- * This endpoint deletes the user by id
- * @deprecated
- * @summary Delete user
- */
-export const deleteUserDeprecated = (
-	{ id }: DeleteUserDeprecatedPathParameters,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<void>({
-		url: `/api/v1/user/${id}`,
-		method: 'DELETE',
-		signal,
-	});
-};
-
-export const getDeleteUserDeprecatedMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof deleteUserDeprecated>>,
-		TError,
-		{ pathParams: DeleteUserDeprecatedPathParameters },
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof deleteUserDeprecated>>,
-	TError,
-	{ pathParams: DeleteUserDeprecatedPathParameters },
-	TContext
-> => {
-	const mutationKey = ['deleteUserDeprecated'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof deleteUserDeprecated>>,
-		{ pathParams: DeleteUserDeprecatedPathParameters }
-	> = (props) => {
-		const { pathParams } = props ?? {};
-
-		return deleteUserDeprecated(pathParams);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type DeleteUserDeprecatedMutationResult = NonNullable<
-	Awaited<ReturnType<typeof deleteUserDeprecated>>
->;
-
-export type DeleteUserDeprecatedMutationError =
-	ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @deprecated
- * @summary Delete user
- */
-export const useDeleteUserDeprecated = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof deleteUserDeprecated>>,
-		TError,
-		{ pathParams: DeleteUserDeprecatedPathParameters },
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof deleteUserDeprecated>>,
-	TError,
-	{ pathParams: DeleteUserDeprecatedPathParameters },
-	TContext
-> => {
-	return useMutation(getDeleteUserDeprecatedMutationOptions(options));
-};
-/**
- * This endpoint returns the user by id
- * @deprecated
- * @summary Get user
- */
-export const getUserDeprecated = (
-	{ id }: GetUserDeprecatedPathParameters,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<GetUserDeprecated200>({
-		url: `/api/v1/user/${id}`,
-		method: 'GET',
-		signal,
-	});
-};
-
-export const getGetUserDeprecatedQueryKey = ({
-	id,
-}: GetUserDeprecatedPathParameters) => {
-	return [`/api/v1/user/${id}`] as const;
-};
-
-export const getGetUserDeprecatedQueryOptions = <
-	TData = Awaited<ReturnType<typeof getUserDeprecated>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ id }: GetUserDeprecatedPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getUserDeprecated>>,
-			TError,
-			TData
-		>;
-	},
-) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey =
-		queryOptions?.queryKey ?? getGetUserDeprecatedQueryKey({ id });
-
-	const queryFn: QueryFunction<
-		Awaited<ReturnType<typeof getUserDeprecated>>
-	> = ({ signal }) => getUserDeprecated({ id }, signal);
-
-	return {
-		queryKey,
-		queryFn,
-		enabled: !!id,
-		...queryOptions,
-	} as UseQueryOptions<
-		Awaited<ReturnType<typeof getUserDeprecated>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type GetUserDeprecatedQueryResult = NonNullable<
-	Awaited<ReturnType<typeof getUserDeprecated>>
->;
-export type GetUserDeprecatedQueryError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @deprecated
- * @summary Get user
- */
-
-export function useGetUserDeprecated<
-	TData = Awaited<ReturnType<typeof getUserDeprecated>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ id }: GetUserDeprecatedPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getUserDeprecated>>,
-			TError,
-			TData
-		>;
-	},
-): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getGetUserDeprecatedQueryOptions({ id }, options);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return { ...query, queryKey: queryOptions.queryKey };
-}
-
-/**
- * @deprecated
- * @summary Get user
- */
-export const invalidateGetUserDeprecated = async (
-	queryClient: QueryClient,
-	{ id }: GetUserDeprecatedPathParameters,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getGetUserDeprecatedQueryKey({ id }) },
-		options,
-	);
-
-	return queryClient;
-};
-
-/**
- * This endpoint updates the user by id
- * @deprecated
- * @summary Update user
- */
-export const updateUserDeprecated = (
-	{ id }: UpdateUserDeprecatedPathParameters,
-	typesDeprecatedUserDTO?: BodyType<TypesDeprecatedUserDTO>,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<UpdateUserDeprecated200>({
-		url: `/api/v1/user/${id}`,
-		method: 'PUT',
-		headers: { 'Content-Type': 'application/json' },
-		data: typesDeprecatedUserDTO,
-		signal,
-	});
-};
-
-export const getUpdateUserDeprecatedMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof updateUserDeprecated>>,
-		TError,
-		{
-			pathParams: UpdateUserDeprecatedPathParameters;
-			data?: BodyType<TypesDeprecatedUserDTO>;
-		},
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof updateUserDeprecated>>,
-	TError,
-	{
-		pathParams: UpdateUserDeprecatedPathParameters;
-		data?: BodyType<TypesDeprecatedUserDTO>;
-	},
-	TContext
-> => {
-	const mutationKey = ['updateUserDeprecated'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof updateUserDeprecated>>,
-		{
-			pathParams: UpdateUserDeprecatedPathParameters;
-			data?: BodyType<TypesDeprecatedUserDTO>;
-		}
-	> = (props) => {
-		const { pathParams, data } = props ?? {};
-
-		return updateUserDeprecated(pathParams, data);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type UpdateUserDeprecatedMutationResult = NonNullable<
-	Awaited<ReturnType<typeof updateUserDeprecated>>
->;
-export type UpdateUserDeprecatedMutationBody =
-	| BodyType<TypesDeprecatedUserDTO>
-	| undefined;
-export type UpdateUserDeprecatedMutationError =
-	ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @deprecated
- * @summary Update user
- */
-export const useUpdateUserDeprecated = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof updateUserDeprecated>>,
-		TError,
-		{
-			pathParams: UpdateUserDeprecatedPathParameters;
-			data?: BodyType<TypesDeprecatedUserDTO>;
-		},
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof updateUserDeprecated>>,
-	TError,
-	{
-		pathParams: UpdateUserDeprecatedPathParameters;
-		data?: BodyType<TypesDeprecatedUserDTO>;
-	},
-	TContext
-> => {
-	return useMutation(getUpdateUserDeprecatedMutationOptions(options));
-};
 /**
  * This endpoint returns the user I belong to
  * @deprecated
@@ -974,6 +596,89 @@ export const useForgotPassword = <
 > => {
 	return useMutation(getForgotPasswordMutationOptions(options));
 };
+/**
+ * This endpoint resets the password using a single use reset password token
+ * @summary Reset password
+ */
+export const resetPassword = (
+	typesPostableResetPasswordDTO?: BodyType<TypesPostableResetPasswordDTO>,
+	signal?: AbortSignal,
+) => {
+	return GeneratedAPIInstance<void>({
+		url: `/api/v2/factor_password/reset`,
+		method: 'POST',
+		headers: { 'Content-Type': 'application/json' },
+		data: typesPostableResetPasswordDTO,
+		signal,
+	});
+};
+
+export const getResetPasswordMutationOptions = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof resetPassword>>,
+		TError,
+		{ data?: BodyType<TypesPostableResetPasswordDTO> },
+		TContext
+	>;
+}): UseMutationOptions<
+	Awaited<ReturnType<typeof resetPassword>>,
+	TError,
+	{ data?: BodyType<TypesPostableResetPasswordDTO> },
+	TContext
+> => {
+	const mutationKey = ['resetPassword'];
+	const { mutation: mutationOptions } = options
+		? options.mutation &&
+			'mutationKey' in options.mutation &&
+			options.mutation.mutationKey
+			? options
+			: { ...options, mutation: { ...options.mutation, mutationKey } }
+		: { mutation: { mutationKey } };
+
+	const mutationFn: MutationFunction<
+		Awaited<ReturnType<typeof resetPassword>>,
+		{ data?: BodyType<TypesPostableResetPasswordDTO> }
+	> = (props) => {
+		const { data } = props ?? {};
+
+		return resetPassword(data);
+	};
+
+	return { mutationFn, ...mutationOptions };
+};
+
+export type ResetPasswordMutationResult = NonNullable<
+	Awaited<ReturnType<typeof resetPassword>>
+>;
+export type ResetPasswordMutationBody =
+	| BodyType<TypesPostableResetPasswordDTO>
+	| undefined;
+export type ResetPasswordMutationError = ErrorType<RenderErrorResponseDTO>;
+
+/**
+ * @summary Reset password
+ */
+export const useResetPassword = <
+	TError = ErrorType<RenderErrorResponseDTO>,
+	TContext = unknown,
+>(options?: {
+	mutation?: UseMutationOptions<
+		Awaited<ReturnType<typeof resetPassword>>,
+		TError,
+		{ data?: BodyType<TypesPostableResetPasswordDTO> },
+		TContext
+	>;
+}): UseMutationResult<
+	Awaited<ReturnType<typeof resetPassword>>,
+	TError,
+	{ data?: BodyType<TypesPostableResetPasswordDTO> },
+	TContext
+> => {
+	return useMutation(getResetPasswordMutationOptions(options));
+};
 /**
  * This endpoint verifies whether a reset password token exists and is not expired
  * @summary Verify a reset password token

frontend/src/api/v1/invite/bulk/create.ts

@@ -1,28 +0,0 @@
-import axios from 'api';
-import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
-import { AxiosError } from 'axios';
-import { ErrorV2Resp, SuccessResponseV2 } from 'types/api';
-import { UsersProps } from 'types/api/user/inviteUsers';
-
-/**
- * @deprecated Use the generated `useCreateBulkInvite` hook (or `createBulkInvite` fetcher) from
- * `api/generated/services/users` instead. This hand-written client targets the
- * same endpoint and will be removed once call sites migrate.
- *
- * Part of https://github.com/SigNoz/engineering-pod/issues/5289, add a comment or update when removing this method.
- */
-const inviteUsers = async (
-	users: UsersProps,
-): Promise<SuccessResponseV2<null>> => {
-	try {
-		const response = await axios.post(`/invite/bulk`, users);
-		return {
-			httpStatusCode: response.status,
-			data: null,
-		};
-	} catch (error) {
-		ErrorResponseHandlerV2(error as AxiosError<ErrorV2Resp>);
-	}
-};
-
-export default inviteUsers;

frontend/src/components/InviteMembers/InviteMembers.tsx

@@ -80,7 +80,7 @@ function InviteMembers({
 							weight="semibold"
 							className={styles.headerCellRole}
 						>
-							Role
+							Roles
 						</Typography.Text>
 						<div className={styles.headerCellAction} />
 					</div>
@@ -108,11 +108,10 @@ function InviteMembers({
 
 							<div className={styles.cellRole}>
 								<RolesSelect
-									mode="single"
-									value={row.roleId || undefined}
-									onChange={(roleId): void => updateRole(row.id, roleId)}
-									placeholder="Select role"
-									allowClear={false}
+									mode="multiple"
+									value={row.roleIds}
+									onChange={(roleIds): void => updateRole(row.id, roleIds)}
+									placeholder="Select roles"
 									id={`invite-role-${row.id}`}
 								/>
 							</div>

frontend/src/components/InviteMembers/__tests__/InviteMembers.edgeCases.test.tsx

@@ -68,8 +68,8 @@ describe('InviteMembers - Edge Cases', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 			await expect(
@@ -100,8 +100,8 @@ describe('InviteMembers - Edge Cases', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 			await expect(
@@ -132,17 +132,17 @@ describe('InviteMembers - Edge Cases', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 			await expect(
 				screen.findByTestId('invite-api-error'),
 			).resolves.toBeInTheDocument();
 
-			const viewerElements = screen.getAllByText('Viewer');
+			const viewerElements = screen.getAllByTitle('Viewer');
 			await user.click(viewerElements[0]);
-			const editorOptions = await screen.findAllByText('Editor');
+			const editorOptions = await screen.findAllByTitle('Editor');
 			await user.click(editorOptions[editorOptions.length - 1]);
 
 			await waitFor(() => {
@@ -189,8 +189,8 @@ describe('InviteMembers - Edge Cases', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			const submitBtn = screen.getByTestId('submit-btn');
 			await user.click(submitBtn);
@@ -226,8 +226,8 @@ describe('InviteMembers - Edge Cases', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], '  alice@signoz.io  ');
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 

frontend/src/components/InviteMembers/__tests__/InviteMembers.rendering.test.tsx

@@ -32,14 +32,14 @@ describe('InviteMembers - Rendering', () => {
 		render(<InviteMembers />);
 
 		expect(screen.getByText('Email address')).toBeInTheDocument();
-		expect(screen.getByText('Role')).toBeInTheDocument();
+		expect(screen.getByText('Roles')).toBeInTheDocument();
 	});
 
 	it('hides header when showHeader is false', () => {
 		render(<InviteMembers showHeader={false} />);
 
 		expect(screen.queryByText('Email address')).not.toBeInTheDocument();
-		expect(screen.queryByText('Role')).not.toBeInTheDocument();
+		expect(screen.queryByText('Roles')).not.toBeInTheDocument();
 	});
 
 	it('renders add button by default', () => {
@@ -89,7 +89,7 @@ describe('InviteMembers - Rendering', () => {
 	it('renders role select for each row', () => {
 		render(<InviteMembers initialRowCount={2} />);
 
-		const roleSelects = screen.getAllByText('Select role');
+		const roleSelects = screen.getAllByText('Select roles');
 		expect(roleSelects).toHaveLength(2);
 	});
 });

frontend/src/components/InviteMembers/__tests__/InviteMembers.submission.test.tsx

@@ -40,8 +40,8 @@ describe('InviteMembers - Submission', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], 'alice@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 
@@ -73,17 +73,17 @@ describe('InviteMembers - Submission', () => {
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 
 			await user.type(emailInputs[0], 'alice@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.type(emailInputs[1], 'bob@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			const editorOptions = await screen.findAllByText('Editor');
+			await user.click(screen.getAllByText('Select roles')[0]);
+			const editorOptions = await screen.findAllByTitle('Editor');
 			await user.click(editorOptions[editorOptions.length - 1]);
 
 			await user.type(emailInputs[2], 'charlie@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			const adminOptions = await screen.findAllByText('Admin');
+			await user.click(screen.getAllByText('Select roles')[0]);
+			const adminOptions = await screen.findAllByTitle('Admin');
 			await user.click(adminOptions[adminOptions.length - 1]);
 
 			await user.click(screen.getByTestId('submit-btn'));
@@ -125,8 +125,8 @@ describe('InviteMembers - Submission', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 
@@ -154,8 +154,8 @@ describe('InviteMembers - Submission', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 
@@ -218,12 +218,12 @@ describe('InviteMembers - Submission', () => {
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 
 			await user.type(emailInputs[0], 'alice@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.type(emailInputs[1], 'bob@signoz.io');
-			await user.click(screen.getAllByText('Select role')[0]);
-			const editorOptions = await screen.findAllByText('Editor');
+			await user.click(screen.getAllByText('Select roles')[0]);
+			const editorOptions = await screen.findAllByTitle('Editor');
 			await user.click(editorOptions[editorOptions.length - 1]);
 
 			await user.click(screen.getByTestId('submit-btn'));
@@ -276,8 +276,8 @@ describe('InviteMembers - Submission', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 
@@ -303,8 +303,8 @@ describe('InviteMembers - Submission', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 

frontend/src/components/InviteMembers/__tests__/InviteMembers.validation.test.tsx

@@ -35,8 +35,8 @@ describe('InviteMembers - Validation', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], INVALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 
@@ -60,8 +60,8 @@ describe('InviteMembers - Validation', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], INVALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 
@@ -85,8 +85,8 @@ describe('InviteMembers - Validation', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], INVALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 			await user.click(screen.getByTestId('submit-btn'));
 
 			await expect(
@@ -149,8 +149,8 @@ describe('InviteMembers - Validation', () => {
 				screen.findByText('Please select roles for team members'),
 			).resolves.toBeInTheDocument();
 
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await waitFor(() => {
 				expect(
@@ -204,8 +204,8 @@ describe('InviteMembers - Validation', () => {
 
 			const emailInputs = screen.getAllByPlaceholderText('e.g. john@signoz.io');
 			await user.type(emailInputs[0], VALID_EMAIL);
-			await user.click(screen.getAllByText('Select role')[0]);
-			await user.click(await screen.findByText('Viewer'));
+			await user.click(screen.getAllByText('Select roles')[0]);
+			await user.click(await screen.findByTitle('Viewer'));
 
 			await user.click(screen.getByTestId('submit-btn'));
 

frontend/src/components/InviteMembers/types.ts

@@ -3,7 +3,7 @@ import { ReactNode } from 'react';
 export interface InviteMemberRow {
 	id: string;
 	email: string;
-	roleId: string;
+	roleIds: string[];
 }
 
 export interface InviteResult {
@@ -38,7 +38,7 @@ export interface UseInviteMembersReturn {
 	addRow: () => void;
 	removeRow: (id: string) => void;
 	updateEmail: (id: string, email: string) => void;
-	updateRole: (id: string, roleId: string | undefined) => void;
+	updateRole: (id: string, roleIds: string[]) => void;
 	reset: () => void;
 	submit: () => Promise<InviteResult[]>;
 

frontend/src/components/InviteMembers/useInviteMembers.ts

@@ -18,11 +18,11 @@ import {
 const createEmptyRow = (): InviteMemberRow => ({
 	id: uuid(),
 	email: '',
-	roleId: '',
+	roleIds: [],
 });
 
 const isRowTouched = (row: InviteMemberRow): boolean =>
-	row.email.trim() !== '' || row.roleId !== '';
+	row.email.trim() !== '' || row.roleIds.length > 0;
 
 export function useInviteMembers(
 	options: UseInviteMembersOptions = {},
@@ -78,7 +78,7 @@ export function useInviteMembers(
 
 		touched.forEach((row) => {
 			const emailValid = EMAIL_REGEX.test(row.email);
-			const roleValid = row.roleId !== '';
+			const roleValid = row.roleIds.length > 0;
 
 			if (!emailValid || !row.email) {
 				isValid = false;
@@ -139,12 +139,12 @@ export function useInviteMembers(
 	);
 
 	const updateRole = useCallback(
-		(id: string, roleId: string | undefined): void => {
+		(id: string, roleIds: string[]): void => {
 			setRows((prev) => {
 				const updated = cloneDeep(prev);
 				const row = updated.find((r) => r.id === id);
 				if (row) {
-					row.roleId = roleId ?? '';
+					row.roleIds = roleIds;
 				}
 				return updated;
 			});
@@ -187,7 +187,7 @@ export function useInviteMembers(
 				await createUser({
 					email: row.email.trim(),
 					frontendBaseUrl: getBaseUrl(),
-					userRoles: [{ id: row.roleId }],
+					userRoles: row.roleIds.map((id) => ({ id })),
 				});
 				results.push({ email: row.email, success: true });
 			} catch (err) {

frontend/src/components/LogDetail/LogDetailsHeader/LogDetailsHeader.module.scss

@@ -0,0 +1,49 @@
+.header {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	width: 100%;
+	gap: 8px;
+}
+
+.tooltipContent {
+	--tooltip-z-index: 2100;
+}
+
+.dropdownContent {
+	--dropdown-menu-content-z-index: 2100;
+}
+
+.leftSection {
+	display: flex;
+	align-items: center;
+	gap: 8px;
+}
+
+.divider {
+	height: 16px;
+	margin: 0;
+}
+
+.timestamp {
+	font-family: 'Geist Mono', monospace;
+	font-size: var(--font-size-sm);
+	font-weight: var(--font-weight-normal);
+	color: var(--l1-foreground);
+	letter-spacing: -0.07px;
+}
+
+.actions {
+	display: flex;
+	align-items: center;
+	gap: 8px;
+}
+
+.arrows {
+	display: flex;
+	align-items: center;
+	gap: 2px;
+	padding: 2px 6px;
+	border-radius: 6px;
+	box-shadow: 0 1px 4px 0 rgba(0, 0, 0, 0.1);
+}

frontend/src/components/LogDetail/LogDetailsHeader/LogDetailsHeader.tsx

@@ -0,0 +1,153 @@
+import { Button } from '@signozhq/ui/button';
+import { Divider } from '@signozhq/ui/divider';
+import { DropdownMenuSimple as Dropdown } from '@signozhq/ui/dropdown-menu';
+import { Typography } from '@signozhq/ui/typography';
+import { TooltipSimple } from '@signozhq/ui/tooltip';
+import { DATE_TIME_FORMATS } from 'constants/dateTimeFormats';
+import { aggregateAttributesResourcesToString } from 'container/LogDetailedView/utils';
+import { toast } from '@signozhq/ui/sonner';
+import { useCopyLogLink } from 'hooks/logs/useCopyLogLink';
+import {
+	ChevronDown,
+	ChevronUp,
+	Compass,
+	Copy,
+	Ellipsis,
+	Link,
+} from '@signozhq/icons';
+import { useTimezone } from 'providers/Timezone';
+import { ILog } from 'types/api/logs/log';
+import { MouseEvent, MouseEventHandler } from 'react';
+import { useCopyToClipboard } from 'react-use';
+
+import styles from './LogDetailsHeader.module.scss';
+
+const TOOLTIP_CONTENT_PROPS = { className: styles.tooltipContent };
+
+interface LogDetailsHeaderProps {
+	log: ILog;
+	onNavigatePrev: () => void;
+	onNavigateNext: () => void;
+	isPrevDisabled: boolean;
+	isNextDisabled: boolean;
+	showOpenInExplorer?: boolean;
+	onOpenInExplorer?: MouseEventHandler;
+}
+
+function LogDetailsHeader({
+	log,
+	onNavigatePrev,
+	onNavigateNext,
+	isPrevDisabled,
+	isNextDisabled,
+	showOpenInExplorer = false,
+	onOpenInExplorer,
+}: LogDetailsHeaderProps): JSX.Element {
+	const [, copyToClipboard] = useCopyToClipboard();
+	const { onLogCopy } = useCopyLogLink(log?.id);
+	const { formatTimezoneAdjustedTimestamp } = useTimezone();
+
+	const handleCopyLog = (): void => {
+		copyToClipboard(aggregateAttributesResourcesToString(log));
+		toast.success('Copied to clipboard', { position: 'bottom-right' });
+	};
+
+	const menuItems = [
+		{
+			key: 'copy-log',
+			label: 'Copy log',
+			icon: <Copy size={14} />,
+			onClick: handleCopyLog,
+		},
+		{
+			key: 'copy-link',
+			label: 'Copy link to log',
+			icon: <Link size={14} />,
+			onClick: (): void => onLogCopy(),
+		},
+	];
+
+	return (
+		<div className={styles.header} data-log-detail-ignore="true">
+			<div className={styles.leftSection}>
+				<Divider type="vertical" className={styles.divider} />
+				<Typography.Text
+					className={styles.timestamp}
+					data-testid="log-details-header-timestamp"
+				>
+					{formatTimezoneAdjustedTimestamp(
+						log.date ?? log.timestamp,
+						DATE_TIME_FORMATS.DASH_DATETIME,
+					)}
+				</Typography.Text>
+			</div>
+
+			<div className={styles.actions}>
+				{showOpenInExplorer && (
+					<Button
+						variant="outlined"
+						color="secondary"
+						prefix={<Compass size={16} />}
+						onClick={onOpenInExplorer}
+					>
+						Open in Explorer
+					</Button>
+				)}
+
+				<Dropdown
+					menu={{ items: menuItems }}
+					align="end"
+					className={styles.dropdownContent}
+					onClick={(e: MouseEvent): void => e.stopPropagation()}
+				>
+					<Button
+						variant="link"
+						color="secondary"
+						prefix={<Ellipsis size={16} />}
+						data-testid="log-details-header-menu"
+					/>
+				</Dropdown>
+
+				<div className={styles.arrows}>
+					<TooltipSimple
+						title="Move to previous log"
+						side="top"
+						open={isPrevDisabled ? false : undefined}
+						tooltipContentProps={TOOLTIP_CONTENT_PROPS}
+					>
+						<Button
+							variant="outlined"
+							color="secondary"
+							prefix={<ChevronUp size={14} />}
+							disabled={isPrevDisabled}
+							onClick={onNavigatePrev}
+							data-testid="log-details-header-prev"
+						/>
+					</TooltipSimple>
+					<TooltipSimple
+						title="Move to next log"
+						side="top"
+						open={isNextDisabled ? false : undefined}
+						tooltipContentProps={TOOLTIP_CONTENT_PROPS}
+					>
+						<Button
+							variant="outlined"
+							color="secondary"
+							prefix={<ChevronDown size={14} />}
+							disabled={isNextDisabled}
+							onClick={onNavigateNext}
+							data-testid="log-details-header-next"
+						/>
+					</TooltipSimple>
+				</div>
+			</div>
+		</div>
+	);
+}
+
+LogDetailsHeader.defaultProps = {
+	showOpenInExplorer: false,
+	onOpenInExplorer: undefined,
+};
+
+export default LogDetailsHeader;

frontend/src/components/LogDetail/LogDetailsHeader/useLogNavigation.ts

@@ -0,0 +1,52 @@
+import { useCallback, useMemo } from 'react';
+import { ILog } from 'types/api/logs/log';
+
+interface UseLogNavigationParams {
+	logs?: ILog[];
+	activeLogId: string;
+	onNavigateLog?: (log: ILog) => void;
+	onScrollToLog?: (id: string) => void;
+}
+
+interface UseLogNavigationReturn {
+	goToPrev: () => void;
+	goToNext: () => void;
+	isPrevDisabled: boolean;
+	isNextDisabled: boolean;
+}
+
+export function useLogNavigation({
+	logs,
+	activeLogId,
+	onNavigateLog,
+	onScrollToLog,
+}: UseLogNavigationParams): UseLogNavigationReturn {
+	const currentIndex = useMemo(
+		() => logs?.findIndex((l) => l.id === activeLogId) ?? -1,
+		[logs, activeLogId],
+	);
+
+	const canNavigate = !!logs?.length && !!onNavigateLog && currentIndex !== -1;
+	const isPrevDisabled = !canNavigate || currentIndex <= 0;
+	const isNextDisabled = !canNavigate || currentIndex >= (logs?.length ?? 0) - 1;
+
+	const goToPrev = useCallback((): void => {
+		if (isPrevDisabled || !logs) {
+			return;
+		}
+		const prev = logs[currentIndex - 1];
+		onNavigateLog?.(prev);
+		onScrollToLog?.(prev.id);
+	}, [isPrevDisabled, logs, currentIndex, onNavigateLog, onScrollToLog]);
+
+	const goToNext = useCallback((): void => {
+		if (isNextDisabled || !logs) {
+			return;
+		}
+		const next = logs[currentIndex + 1];
+		onNavigateLog?.(next);
+		onScrollToLog?.(next.id);
+	}, [isNextDisabled, logs, currentIndex, onNavigateLog, onScrollToLog]);
+
+	return { goToPrev, goToNext, isPrevDisabled, isNextDisabled };
+}

frontend/src/components/LogDetail/__tests__/LogDetail.test.tsx

@@ -0,0 +1,161 @@
+import { toast } from '@signozhq/ui/sonner';
+import { LOCALSTORAGE } from 'constants/localStorage';
+import { render, screen, userEvent } from 'tests/test-utils';
+import { ILog } from 'types/api/logs/log';
+
+import LogDetail from '..';
+import { VIEW_TYPES } from '../constants';
+import { LogDetailProps } from '../LogDetail.interfaces';
+
+jest.mock('@signozhq/ui/sonner', () => ({
+	toast: { success: jest.fn(), error: jest.fn() },
+}));
+
+// The flag to be removed later
+jest.mock('../constants', () => ({
+	...jest.requireActual('../constants'),
+	isLogDetailsV2: true,
+}));
+
+const mockLog: ILog = {
+	id: 'log-1',
+	timestamp: '2024-01-15T09:45:30Z',
+	date: '2024-01-15T09:45:30Z',
+	body: 'test log body',
+	severityText: 'INFO',
+	severityNumber: 9,
+	traceFlags: 0,
+	traceId: '',
+	spanID: '',
+	attributesString: {},
+	attributesInt: {},
+	attributesFloat: {},
+	resources_string: {},
+	scope_string: {},
+	attributes_string: {},
+	severity_text: 'INFO',
+	severity_number: 9,
+};
+
+const makeLog = (id: string): ILog => ({ ...mockLog, id });
+
+function renderDrawer(props: Partial<LogDetailProps> = {}): void {
+	render(
+		<LogDetail
+			log={mockLog}
+			selectedTab={VIEW_TYPES.OVERVIEW}
+			onAddToQuery={jest.fn()}
+			onClickActionItem={jest.fn()}
+			onClose={jest.fn()}
+			{...props}
+		/>,
+	);
+}
+
+describe('LogDetail drawer — header (isLogDetailsV2)', () => {
+	afterEach(() => {
+		jest.clearAllMocks();
+		localStorage.clear();
+	});
+
+	it('renders the revamped header when a log is provided', () => {
+		renderDrawer();
+
+		expect(screen.getByTestId('log-details-header-menu')).toBeInTheDocument();
+		expect(screen.getByTestId('log-details-header-prev')).toBeInTheDocument();
+		expect(screen.getByTestId('log-details-header-next')).toBeInTheDocument();
+	});
+
+	it('shows the log timestamp formatted (DASH_DATETIME) in the header', () => {
+		// Pin the timezone to UTC so the formatted output is deterministic across
+		// machines/CI (Jest doesn't fix a TZ).
+		localStorage.setItem(LOCALSTORAGE.PREFERRED_TIMEZONE, 'UTC');
+
+		renderDrawer();
+
+		// mockLog date is 2024-01-15T09:45:30Z → DASH_DATETIME in UTC.
+		expect(screen.getByTestId('log-details-header-timestamp')).toHaveTextContent(
+			'Jan 15, 2024 ⎯ 09:45:30',
+		);
+	});
+
+	it('copies the log link from the ⋯ menu', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+
+		renderDrawer();
+
+		await user.click(screen.getByTestId('log-details-header-menu'));
+		await user.click(await screen.findByText('Copy link to log'));
+
+		expect(toast.success).toHaveBeenCalled();
+	});
+
+	it('copies the log from the ⋯ menu', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+
+		renderDrawer();
+
+		await user.click(screen.getByTestId('log-details-header-menu'));
+		await user.click(await screen.findByText('Copy log'));
+
+		expect(toast.success).toHaveBeenCalledWith('Copied to clipboard', {
+			position: 'bottom-right',
+		});
+	});
+
+	it('shows "Open in Explorer" when a handleOpenInExplorer handler is provided', () => {
+		renderDrawer({ handleOpenInExplorer: jest.fn() });
+
+		expect(screen.getByText('Open in Explorer')).toBeInTheDocument();
+	});
+
+	it('hides "Open in Explorer" when no handleOpenInExplorer handler is provided', () => {
+		renderDrawer();
+
+		expect(screen.queryByText('Open in Explorer')).not.toBeInTheDocument();
+	});
+
+	it('navigates to the next / previous log with the Down / Up arrow keys', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+		const logs = [makeLog('log-0'), makeLog('log-1'), makeLog('log-2')];
+		const onNavigateLog = jest.fn();
+		const onScrollToLog = jest.fn();
+
+		// Active log is the middle one so both directions are available.
+		renderDrawer({ log: logs[1], logs, onNavigateLog, onScrollToLog });
+
+		await user.keyboard('{ArrowDown}');
+		expect(onNavigateLog).toHaveBeenLastCalledWith(logs[2]);
+		expect(onScrollToLog).toHaveBeenLastCalledWith('log-2');
+
+		await user.keyboard('{ArrowUp}');
+		expect(onNavigateLog).toHaveBeenLastCalledWith(logs[0]);
+		expect(onScrollToLog).toHaveBeenLastCalledWith('log-0');
+	});
+
+	it('does not navigate past the first log on ArrowUp', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+		const logs = [makeLog('log-0'), makeLog('log-1')];
+		const onNavigateLog = jest.fn();
+
+		renderDrawer({ log: logs[0], logs, onNavigateLog });
+
+		await user.keyboard('{ArrowUp}');
+		expect(onNavigateLog).not.toHaveBeenCalled();
+	});
+
+	it('navigates via the header up / down buttons and disables them at boundaries', async () => {
+		const user = userEvent.setup({ pointerEventsCheck: 0 });
+		const logs = [makeLog('log-0'), makeLog('log-1')];
+		const onNavigateLog = jest.fn();
+
+		// Active log is the first one.
+		renderDrawer({ log: logs[0], logs, onNavigateLog });
+
+		expect(screen.getByTestId('log-details-header-prev')).toBeDisabled();
+		expect(screen.getByTestId('log-details-header-next')).toBeEnabled();
+
+		await user.click(screen.getByTestId('log-details-header-next'));
+		expect(onNavigateLog).toHaveBeenLastCalledWith(logs[1]);
+	});
+});

frontend/src/components/LogDetail/constants.ts

@@ -1,3 +1,10 @@
+import getLocalStorage from 'api/browser/localstorage/get';
+import { LOCALSTORAGE } from 'constants/localStorage';
+
+// Temp feature flag before actual roll-out
+export const isLogDetailsV2 =
+	getLocalStorage(LOCALSTORAGE.LOG_DETAILS_V2) === 'true';
+
 export const VIEW_TYPES = {
 	OVERVIEW: 'OVERVIEW',
 	JSON: 'JSON',

frontend/src/components/LogDetail/index.tsx

@@ -8,7 +8,9 @@ import { ToggleGroupSimple } from '@signozhq/ui/toggle-group';
 import { Divider } from '@signozhq/ui/divider';
 import { Typography } from '@signozhq/ui/typography';
 import cx from 'classnames';
-import { LogType } from 'components/Logs/LogStateIndicator/LogStateIndicator';
+import LogStateIndicator, {
+	LogType,
+} from 'components/Logs/LogStateIndicator/LogStateIndicator';
 import QuerySearch from 'components/QueryBuilderV2/QueryV2/QuerySearch/QuerySearch';
 import { convertExpressionToFilters } from 'components/QueryBuilderV2/utils';
 import { FeatureKeys } from 'constants/features';
@@ -23,6 +25,7 @@ import {
 } from 'container/LogDetailedView/utils';
 import useInitialQuery from 'container/LogsExplorerContext/useInitialQuery';
 import { useOptionsMenu } from 'container/OptionsMenu';
+import { FontSize } from 'container/OptionsMenu/types';
 import { useCopyLogLink } from 'hooks/logs/useCopyLogLink';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { useIsDarkMode } from 'hooks/useDarkMode';
@@ -48,8 +51,10 @@ import { ILogBody } from 'types/api/logs/log';
 import { Query, TagFilter } from 'types/api/queryBuilder/queryBuilderData';
 import { DataSource, StringOperators } from 'types/common/queryBuilder';
 
-import { RESOURCE_KEYS, VIEW_TYPES, VIEWS } from './constants';
+import { isLogDetailsV2, RESOURCE_KEYS, VIEW_TYPES, VIEWS } from './constants';
 import { LogDetailInnerProps, LogDetailProps } from './LogDetail.interfaces';
+import LogDetailsHeader from './LogDetailsHeader/LogDetailsHeader';
+import { useLogNavigation } from './LogDetailsHeader/useLogNavigation';
 
 import './LogDetails.styles.scss';
 
@@ -96,7 +101,8 @@ function LogDetailInner({
 				target.closest('[data-log-detail-ignore="true"]') ||
 				target.closest('.cm-tooltip-autocomplete') ||
 				target.closest('.drawer-popover') ||
-				target.closest('.query-status-popover')
+				target.closest('.query-status-popover') ||
+				target.closest('[data-radix-popper-content-wrapper]')
 			) {
 				return;
 			}
@@ -112,49 +118,30 @@ function LogDetailInner({
 		};
 	}, [onClose]);
 
-	// Keyboard navigation - handle up/down arrow keys
-	// Only listen when in OVERVIEW tab
-	// eslint-disable-next-line sonarjs/cognitive-complexity
+	const { goToPrev, goToNext, isPrevDisabled, isNextDisabled } =
+		useLogNavigation({
+			logs,
+			activeLogId: log.id,
+			onNavigateLog,
+			onScrollToLog,
+		});
+
+	// Keyboard navigation - handle up/down arrow keys. Only listen in the OVERVIEW
+	// tab so we don't hijack arrow keys from the JSON editor / context view.
 	useEffect(() => {
-		if (
-			!logs ||
-			!onNavigateLog ||
-			logs.length === 0 ||
-			selectedView !== VIEW_TYPES.OVERVIEW
-		) {
-			return;
+		if (selectedView !== VIEW_TYPES.OVERVIEW) {
+			return undefined;
 		}
 
 		const handleKeyDown = (e: KeyboardEvent): void => {
-			const currentIndex = logs.findIndex((l) => l.id === log.id);
-			if (currentIndex === -1) {
-				return;
-			}
-
 			if (e.key === 'ArrowUp') {
 				e.preventDefault();
 				e.stopPropagation();
-				// Navigate to previous log
-				if (currentIndex > 0) {
-					const prevLog = logs[currentIndex - 1];
-					onNavigateLog(prevLog);
-					// Trigger scroll to the log element
-					if (onScrollToLog) {
-						onScrollToLog(prevLog.id);
-					}
-				}
+				goToPrev();
 			} else if (e.key === 'ArrowDown') {
 				e.preventDefault();
 				e.stopPropagation();
-				// Navigate to next log
-				if (currentIndex < logs.length - 1) {
-					const nextLog = logs[currentIndex + 1];
-					onNavigateLog(nextLog);
-					// Trigger scroll to the log element
-					if (onScrollToLog) {
-						onScrollToLog(nextLog.id);
-					}
-				}
+				goToNext();
 			}
 		};
 
@@ -162,7 +149,7 @@ function LogDetailInner({
 		return (): void => {
 			document.removeEventListener('keydown', handleKeyDown);
 		};
-	}, [log.id, logs, onNavigateLog, onScrollToLog, selectedView]);
+	}, [selectedView, goToPrev, goToNext]);
 
 	const listQuery = useMemo(() => {
 		if (!stagedQuery || stagedQuery.builder.queryData.length < 1) {
@@ -303,33 +290,6 @@ function LogDetailInner({
 	};
 
 	const logType = log?.attributes_string?.log_level || LogType.INFO;
-	const currentLogIndex = logs ? logs.findIndex((l) => l.id === log.id) : -1;
-	const isPrevDisabled =
-		!logs || !onNavigateLog || logs.length === 0 || currentLogIndex <= 0;
-	const isNextDisabled =
-		!logs ||
-		!onNavigateLog ||
-		logs.length === 0 ||
-		currentLogIndex === logs.length - 1;
-
-	type HandleNavigateLogParams = {
-		direction: 'next' | 'previous';
-	};
-
-	const handleNavigateLog = ({ direction }: HandleNavigateLogParams): void => {
-		if (!logs || !onNavigateLog || currentLogIndex === -1) {
-			return;
-		}
-		if (direction === 'previous' && !isPrevDisabled) {
-			const prevLog = logs[currentLogIndex - 1];
-			onNavigateLog(prevLog);
-			onScrollToLog?.(prevLog.id);
-		} else if (direction === 'next' && !isNextDisabled) {
-			const nextLog = logs[currentLogIndex + 1];
-			onNavigateLog(nextLog);
-			onScrollToLog?.(nextLog.id);
-		}
-	};
 
 	return (
 		<Drawer
@@ -338,57 +298,69 @@ function LogDetailInner({
 			maskClosable={false}
 			getContainer={getContainer}
 			title={
-				<div className="log-detail-drawer__title" data-log-detail-ignore="true">
-					<div className="log-detail-drawer__title-left">
-						<Divider type="vertical" className={cx('log-type-indicator', LogType)} />
-						<Typography.Text className="title">Log details</Typography.Text>
-					</div>
-					<div className="log-detail-drawer__title-right">
-						<div className="log-arrows">
-							<Tooltip
-								title={isPrevDisabled ? '' : 'Move to previous log'}
-								placement="top"
-								mouseLeaveDelay={0}
-							>
-								<Button
-									variant="outlined"
-									color="secondary"
-									prefix={<ChevronUp size={14} />}
-									className="log-arrow-btn log-arrow-btn-up"
-									disabled={isPrevDisabled}
-									onClick={(): void => handleNavigateLog({ direction: 'previous' })}
-								/>
-							</Tooltip>
-							<Tooltip
-								title={isNextDisabled ? '' : 'Move to next log'}
-								placement="top"
-								mouseLeaveDelay={0}
-							>
-								<Button
-									variant="outlined"
-									color="secondary"
-									prefix={<ChevronDown size={14} />}
-									className="log-arrow-btn log-arrow-btn-down"
-									disabled={isNextDisabled}
-									onClick={(): void => handleNavigateLog({ direction: 'next' })}
-								/>
-							</Tooltip>
+				isLogDetailsV2 ? (
+					<LogDetailsHeader
+						log={log}
+						onNavigatePrev={goToPrev}
+						onNavigateNext={goToNext}
+						isPrevDisabled={isPrevDisabled}
+						isNextDisabled={isNextDisabled}
+						showOpenInExplorer={!!handleOpenInExplorer}
+						onOpenInExplorer={handleOpenInExplorer}
+					/>
+				) : (
+					<div className="log-detail-drawer__title" data-log-detail-ignore="true">
+						<div className="log-detail-drawer__title-left">
+							<Divider type="vertical" className={cx('log-type-indicator', LogType)} />
+							<Typography.Text className="title">Log details</Typography.Text>
 						</div>
-						{handleOpenInExplorer && (
-							<div>
-								<Button
-									variant="outlined"
-									color="secondary"
-									prefix={<Compass size={16} />}
-									className="open-in-explorer-btn"
-									onClick={handleOpenInExplorer}
+						<div className="log-detail-drawer__title-right">
+							<div className="log-arrows">
+								<Tooltip
+									title={isPrevDisabled ? '' : 'Move to previous log'}
+									placement="top"
+									mouseLeaveDelay={0}
 								>
-									Open in Explorer
-								</Button>
+									<Button
+										variant="outlined"
+										color="secondary"
+										prefix={<ChevronUp size={14} />}
+										className="log-arrow-btn log-arrow-btn-up"
+										disabled={isPrevDisabled}
+										onClick={goToPrev}
+									/>
+								</Tooltip>
+								<Tooltip
+									title={isNextDisabled ? '' : 'Move to next log'}
+									placement="top"
+									mouseLeaveDelay={0}
+								>
+									<Button
+										variant="outlined"
+										color="secondary"
+										prefix={<ChevronDown size={14} />}
+										className="log-arrow-btn log-arrow-btn-down"
+										disabled={isNextDisabled}
+										onClick={goToNext}
+									/>
+								</Tooltip>
 							</div>
-						)}
+							{handleOpenInExplorer && (
+								<div>
+									<Button
+										variant="outlined"
+										color="secondary"
+										prefix={<Compass size={16} />}
+										className="open-in-explorer-btn"
+										onClick={handleOpenInExplorer}
+									>
+										Open in Explorer
+									</Button>
+								</div>
+							)}
+						</div>
 					</div>
-				</div>
+				)
 			}
 			placement="right"
 			onClose={drawerCloseHandler}
@@ -407,7 +379,15 @@ function LogDetailInner({
 				data-testid="log-detail-drawer"
 			>
 				<div className="log-detail-drawer__log">
-					<Divider type="vertical" className={cx('log-type-indicator', logType)} />
+					{isLogDetailsV2 ? (
+						<LogStateIndicator
+							severityText={log.severity_text}
+							severityNumber={log.severity_number}
+							fontSize={options?.fontSize ?? FontSize.MEDIUM}
+						/>
+					) : (
+						<Divider type="vertical" className={cx('log-type-indicator', logType)} />
+					)}
 					<Tooltip
 						title={removeEscapeCharacters(logBody)}
 						placement="left"
@@ -483,22 +463,25 @@ function LogDetailInner({
 							</Tooltip>
 						)}
 
-						<Tooltip
-							title={selectedView === VIEW_TYPES.JSON ? 'Copy JSON' : 'Copy Log Link'}
-							placement="topLeft"
-							aria-label={
-								selectedView === VIEW_TYPES.JSON ? 'Copy JSON' : 'Copy Log Link'
-							}
-							mouseLeaveDelay={0}
-						>
-							<Button
-								variant="link"
-								color="secondary"
-								size="sm"
-								prefix={<Copy size={12} />}
-								onClick={selectedView === VIEW_TYPES.JSON ? handleJSONCopy : onLogCopy}
-							/>
-						</Tooltip>
+						{/* V2 moves copy actions into the header ⋯ menu */}
+						{!isLogDetailsV2 && (
+							<Tooltip
+								title={selectedView === VIEW_TYPES.JSON ? 'Copy JSON' : 'Copy Log Link'}
+								placement="topLeft"
+								aria-label={
+									selectedView === VIEW_TYPES.JSON ? 'Copy JSON' : 'Copy Log Link'
+								}
+								mouseLeaveDelay={0}
+							>
+								<Button
+									variant="link"
+									color="secondary"
+									size="sm"
+									prefix={<Copy size={12} />}
+									onClick={selectedView === VIEW_TYPES.JSON ? handleJSONCopy : onLogCopy}
+								/>
+							</Tooltip>
+						)}
 					</div>
 				</div>
 				{isFilterVisible && contextQuery?.builder.queryData[0] && (

frontend/src/constants/generated/semconvFamilies.gen.ts

@@ -0,0 +1,32 @@
+// Code generated by scripts/semconv. DO NOT EDIT.
+
+export type SemconvFamily = {
+	readonly current: string;
+	readonly old: readonly string[];
+	readonly kind: 'attribute' | 'metric';
+	readonly contexts: readonly string[];
+	readonly signals: readonly string[];
+	readonly applyToMetrics: readonly string[];
+	readonly valueMap: Readonly<Record<string, string>>;
+};
+
+export const SEMCONV_FAMILIES: readonly SemconvFamily[] = [
+	{
+		current: 'db.system.name',
+		old: ['db.system'],
+		kind: 'attribute',
+		contexts: [],
+		signals: [],
+		applyToMetrics: [],
+		valueMap: {},
+	},
+	{
+		current: 'deployment.environment.name',
+		old: ['deployment.environment'],
+		kind: 'attribute',
+		contexts: [],
+		signals: [],
+		applyToMetrics: [],
+		valueMap: {},
+	},
+] as const;

frontend/src/constants/localStorage.ts

@@ -13,6 +13,7 @@ export enum LOCALSTORAGE {
 	TRACES_LIST_COLUMNS = 'TRACES_LIST_COLUMNS',
 	LOGS_LIST_COLUMNS = 'LOGS_LIST_COLUMNS',
 	LOGS_LIST_COLUMN_SIZING = 'LOGS_LIST_COLUMN_SIZING',
+	LOG_DETAILS_V2 = 'LOG_DETAILS_V2',
 	LOGGED_IN_USER_NAME = 'LOGGED_IN_USER_NAME',
 	LOGGED_IN_USER_EMAIL = 'LOGGED_IN_USER_EMAIL',
 	CHAT_SUPPORT = 'CHAT_SUPPORT',

frontend/src/container/OnboardingQuestionaire/InviteTeamMembers/InviteTeamMembers.tsx

@@ -14,7 +14,7 @@ import './InviteTeamMembers.styles.scss';
 
 interface TeamMember {
 	email: string;
-	role: string;
+	roles: string[];
 	name: string;
 	frontendBaseUrl: string;
 	id: string;
@@ -45,7 +45,7 @@ function InviteTeamMembers({
 	const toTeamMembers = (rows: InviteMemberRow[]): TeamMember[] =>
 		rows.map((row) => ({
 			email: row.email,
-			role: roleIdToName[row.roleId] ?? row.roleId,
+			roles: row.roleIds.map((roleId) => roleIdToName[roleId] ?? roleId),
 			name: '',
 			frontendBaseUrl: getBaseUrl(),
 			id: row.id,

frontend/src/container/OnboardingQuestionaire/InviteTeamMembers/__tests__/InviteTeamMembers.test.tsx

@@ -166,8 +166,8 @@ describe('InviteTeamMembers', () => {
 				{ email: 'user2@test.com', success: true },
 			];
 			const mockRows: InviteMemberRow[] = [
-				{ id: 'row-1', email: 'user1@test.com', roleId: 'role-viewer-id' },
-				{ id: 'row-2', email: 'user2@test.com', roleId: 'role-editor-id' },
+				{ id: 'row-1', email: 'user1@test.com', roleIds: ['role-viewer-id'] },
+				{ id: 'row-2', email: 'user2@test.com', roleIds: ['role-editor-id'] },
 			];
 			mockInviteMembersProps?.onSuccess?.(mockResults, mockRows);
 
@@ -177,14 +177,14 @@ describe('InviteTeamMembers', () => {
 					teamMembers: [
 						{
 							email: 'user1@test.com',
-							role: 'VIEWER',
+							roles: ['VIEWER'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-1',
 						},
 						{
 							email: 'user2@test.com',
-							role: 'EDITOR',
+							roles: ['EDITOR'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-2',
@@ -211,8 +211,8 @@ describe('InviteTeamMembers', () => {
 				{ email: 'user2@test.com', success: false, error: 'Already exists' },
 			];
 			const mockRows: InviteMemberRow[] = [
-				{ id: 'row-1', email: 'user1@test.com', roleId: 'role-viewer-id' },
-				{ id: 'row-2', email: 'user2@test.com', roleId: 'role-admin-id' },
+				{ id: 'row-1', email: 'user1@test.com', roleIds: ['role-viewer-id'] },
+				{ id: 'row-2', email: 'user2@test.com', roleIds: ['role-admin-id'] },
 			];
 			mockInviteMembersProps?.onPartialSuccess?.(mockResults, mockRows);
 
@@ -222,14 +222,14 @@ describe('InviteTeamMembers', () => {
 					teamMembers: [
 						{
 							email: 'user1@test.com',
-							role: 'VIEWER',
+							roles: ['VIEWER'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-1',
 						},
 						{
 							email: 'user2@test.com',
-							role: 'ADMIN',
+							roles: ['ADMIN'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-2',
@@ -252,8 +252,8 @@ describe('InviteTeamMembers', () => {
 				{ email: 'user2@test.com', success: false, error: 'Error 2' },
 			];
 			const mockRows: InviteMemberRow[] = [
-				{ id: 'row-1', email: 'user1@test.com', roleId: 'role-editor-id' },
-				{ id: 'row-2', email: 'user2@test.com', roleId: 'role-viewer-id' },
+				{ id: 'row-1', email: 'user1@test.com', roleIds: ['role-editor-id'] },
+				{ id: 'row-2', email: 'user2@test.com', roleIds: ['role-viewer-id'] },
 			];
 			mockInviteMembersProps?.onAllFailed?.(mockResults, mockRows);
 
@@ -263,14 +263,14 @@ describe('InviteTeamMembers', () => {
 					teamMembers: [
 						{
 							email: 'user1@test.com',
-							role: 'EDITOR',
+							roles: ['EDITOR'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-1',
 						},
 						{
 							email: 'user2@test.com',
-							role: 'VIEWER',
+							roles: ['VIEWER'],
 							name: '',
 							frontendBaseUrl: 'http://localhost:3301',
 							id: 'row-2',

frontend/src/hooks/logs/types.ts

@@ -1,4 +1,4 @@
-import { MouseEventHandler } from 'react';
+import { MouseEvent } from 'react';
 import { ILog } from 'types/api/logs/log';
 import { DataTypes } from 'types/api/queryBuilder/queryAutocompleteResponse';
 
@@ -11,7 +11,7 @@ export type UseCopyLogLink = {
 	isHighlighted: boolean;
 	isLogsExplorerPage: boolean;
 	activeLogId: string | null;
-	onLogCopy: MouseEventHandler<HTMLElement>;
+	onLogCopy: (event?: MouseEvent<HTMLElement>) => void;
 	onClearActiveLog: () => void;
 };
 

frontend/src/hooks/logs/useCopyLogLink.ts

@@ -1,10 +1,4 @@
-import {
-	MouseEventHandler,
-	useCallback,
-	useEffect,
-	useMemo,
-	useState,
-} from 'react';
+import { MouseEvent, useCallback, useEffect, useMemo, useState } from 'react';
 // eslint-disable-next-line no-restricted-imports
 import { useSelector } from 'react-redux';
 import { useLocation } from 'react-router-dom';
@@ -46,14 +40,14 @@ export const useCopyLogLink = (logId?: string): UseCopyLogLink => {
 		[pathname],
 	);
 
-	const onLogCopy: MouseEventHandler<HTMLElement> = useCallback(
-		(event) => {
+	const onLogCopy = useCallback(
+		(event?: MouseEvent<HTMLElement>): void => {
 			if (!logId) {
 				return;
 			}
 
-			event.preventDefault();
-			event.stopPropagation();
+			event?.preventDefault();
+			event?.stopPropagation();
 
 			urlQuery.delete(QueryParams.activeLogId);
 			urlQuery.delete(QueryParams.relativeTime);
@@ -66,7 +60,7 @@ export const useCopyLogLink = (logId?: string): UseCopyLogLink => {
 
 			setCopy(link);
 
-			toast.success('Copied to clipboard', { position: 'top-right' });
+			toast.success('Copied to clipboard', { position: 'bottom-right' });
 		},
 		[logId, urlQuery, minTime, maxTime, pathname, setCopy],
 	);

frontend/src/mocks-server/handlers.ts

@@ -139,27 +139,6 @@ export const handlers = [
 			return res(ctx.status(500));
 		},
 	),
-	rest.get('http://localhost/api/v1/loginPrecheck', (req, res, ctx) => {
-		const email = req.url.searchParams.get('email');
-		if (email === 'failEmail@signoz.io') {
-			return res(ctx.status(500));
-		}
-
-		return res(
-			ctx.status(200),
-			ctx.json({
-				status: 'success',
-				data: {
-					sso: true,
-					ssoUrl: '',
-					canSelfRegister: false,
-					isUser: true,
-					ssoError: '',
-				},
-			}),
-		);
-	}),
-
 	rest.get('http://localhost/api/v2/licenses', (req, res, ctx) =>
 		res(ctx.status(200), ctx.json(licensesSuccessResponse)),
 	),
@@ -194,14 +173,6 @@ export const handlers = [
 			}),
 		),
 	),
-	rest.put('http://localhost/api/v1/user/:id', (_, res, ctx) =>
-		res(
-			ctx.status(200),
-			ctx.json({
-				data: 'user updated successfully',
-			}),
-		),
-	),
 	rest.get(
 		'http://localhost/api/v3/autocomplete/aggregate_attributes',
 		(req, res, ctx) =>

frontend/src/types/api/user/inviteUsers.ts

@@ -1,12 +0,0 @@
-import { User } from 'types/reducer/app';
-
-export interface UserProps {
-	name: User['displayName'];
-	email: User['email'];
-	role: string;
-	frontendBaseUrl: string;
-}
-
-export interface UsersProps {
-	invites: UserProps[];
-}

pkg/apiserver/signozapiserver/user.go

@@ -27,22 +27,6 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/invite/bulk", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateBulkInvite), handler.OpenAPIDef{
-		ID:                 "CreateBulkInvite",
-		Tags:               []string{"users"},
-		Summary:            "Create bulk invite",
-		Description:        "This endpoint creates a bulk invite for a user",
-		Request:            new(types.PostableBulkInviteRequest),
-		RequestContentType: "application/json",
-		Response:           nil,
-		SuccessStatusCode:  http.StatusCreated,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusConflict},
-		Deprecated:         true,
-		SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v1/user", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.ListUsersDeprecated), handler.OpenAPIDef{
 		ID:                  "ListUsersDeprecated",
 		Tags:                []string{"users"},
@@ -145,23 +129,6 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/user/{id}", handler.New(provider.authzMiddleware.SelfAccess(provider.userHandler.GetUserDeprecated), handler.OpenAPIDef{
-		ID:                  "GetUserDeprecated",
-		Tags:                []string{"users"},
-		Summary:             "Get user",
-		Description:         "This endpoint returns the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.DeprecatedUser),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          true,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUser), handler.OpenAPIDef{
 		ID:                  "GetUser",
 		Tags:                []string{"users"},
@@ -179,23 +146,6 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/user/{id}", handler.New(provider.authzMiddleware.SelfAccess(provider.userHandler.UpdateUserDeprecated), handler.OpenAPIDef{
-		ID:                  "UpdateUserDeprecated",
-		Tags:                []string{"users"},
-		Summary:             "Update user",
-		Description:         "This endpoint updates the user by id",
-		Request:             new(types.DeprecatedUser),
-		RequestContentType:  "application/json",
-		Response:            new(types.DeprecatedUser),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          true,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.UpdateUser), handler.OpenAPIDef{
 		ID:                  "UpdateUser",
 		Tags:                []string{"users"},
@@ -213,23 +163,6 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/user/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUser), handler.OpenAPIDef{
-		ID:                  "DeleteUserDeprecated",
-		Tags:                []string{"users"},
-		Summary:             "Delete user",
-		Description:         "This endpoint deletes the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          true,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUser), handler.OpenAPIDef{
 		ID:                  "DeleteUser",
 		Tags:                []string{"users"},
@@ -316,7 +249,7 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 	}
 
 	if err := router.Handle("/api/v1/resetPassword", handler.New(provider.authzMiddleware.OpenAccess(provider.userHandler.ResetPassword), handler.OpenAPIDef{
-		ID:                  "ResetPassword",
+		ID:                  "ResetPasswordDeprecated",
 		Tags:                []string{"users"},
 		Summary:             "Reset password",
 		Description:         "This endpoint resets the password by token",
@@ -326,7 +259,7 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		ResponseContentType: "",
 		SuccessStatusCode:   http.StatusNoContent,
 		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
-		Deprecated:          false,
+		Deprecated:          true,
 		SecuritySchemes:     []handler.OpenAPISecurityScheme{},
 	})).Methods(http.MethodPost).GetError(); err != nil {
 		return err
@@ -366,6 +299,23 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
+	if err := router.Handle("/api/v2/factor_password/reset", handler.New(provider.authzMiddleware.OpenAccess(provider.userHandler.ResetPassword), handler.OpenAPIDef{
+		ID:                  "ResetPassword",
+		Tags:                []string{"users"},
+		Summary:             "Reset password",
+		Description:         "This endpoint resets the password using a single use reset password token",
+		Request:             new(types.PostableResetPassword),
+		RequestContentType:  "application/json",
+		Response:            nil,
+		ResponseContentType: "",
+		SuccessStatusCode:   http.StatusNoContent,
+		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+		Deprecated:          false,
+		SecuritySchemes:     []handler.OpenAPISecurityScheme{},
+	})).Methods(http.MethodPost).GetError(); err != nil {
+		return err
+	}
+
 	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetRolesByUserID), handler.OpenAPIDef{
 		ID:                  "GetRolesByUserID",
 		Tags:                []string{"users"},

pkg/http/middleware/authz.go

@@ -14,7 +14,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/gorilla/mux"
 )
 
 const (
@@ -151,40 +150,6 @@ func (middleware *AuthZ) AdminAccess(next http.HandlerFunc) http.HandlerFunc {
 	})
 }
 
-func (middleware *AuthZ) SelfAccess(next http.HandlerFunc) http.HandlerFunc {
-	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
-		claims, err := authtypes.ClaimsFromContext(req.Context())
-		if err != nil {
-			render.Error(rw, err)
-			return
-		}
-
-		selectors := []coretypes.Selector{
-			coretypes.TypeRole.MustSelector(authtypes.SigNozAdminRoleName),
-		}
-
-		err = middleware.authzService.CheckWithTupleCreation(
-			req.Context(),
-			claims,
-			valuer.MustNewUUID(claims.OrgID),
-			authtypes.Relation{Verb: coretypes.VerbAssignee},
-			coretypes.NewResourceRole(),
-			selectors,
-			selectors,
-		)
-
-		if err != nil {
-			id := mux.Vars(req)["id"]
-			if err := claims.IsSelfAccess(id); err != nil {
-				middleware.logger.WarnContext(req.Context(), authzDeniedMessage, slog.Any("claims", claims))
-				render.Error(rw, err)
-				return
-			}
-		}
-		next(rw, req)
-	})
-}
-
 func (middleware *AuthZ) OpenAccess(next http.HandlerFunc) http.HandlerFunc {
 	return http.HandlerFunc(func(rw http.ResponseWriter, req *http.Request) {
 		next(rw, req)

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudsql_postgres/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": true
+    "logs": false
   },
   "dataCollected": {
     "metrics": [

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/cloudstorage/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": true
+    "logs": false
   },
   "dataCollected": {
     "metrics": [

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/computeengine/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": true
+    "logs": false
   },
   "dataCollected": {
     "metrics": [

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/gke/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": true
+    "logs": false
   },
   "dataCollected": {
     "metrics": [

pkg/modules/cloudintegration/implcloudintegration/fs/definitions/gcp/memorystore_redis/integration.json

@@ -5,7 +5,7 @@
   "overview": "file://overview.md",
   "supportedSignals": {
     "metrics": true,
-    "logs": true
+    "logs": false
   },
   "dataCollected": {
     "metrics": [

pkg/modules/inframonitoring/implinframonitoring/clusters.go

@@ -84,20 +84,38 @@ func buildClusterRecords(
 	return records
 }
 
+// getTopClusterGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status / node-readiness keysets when filtering,
+// to intersect all).
 func (m *module) getTopClusterGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableClusters,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, map[string]nodeConditionCounts, error) {
 
 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey            string
+		metadataMap           map[string]map[string]string
+		allMetricGroups       []rankedGroup
+		statusCounts          map[string]podStatusCounts
+		statusWarning         *qbtypes.QueryWarnData
+		nodeConditionCounts   map[string]nodeConditionCounts
+		filter                *qbtypes.Filter
+		filterByPodStatus     []inframonitoringtypes.PodStatus
+		filterByNodeReadiness []inframonitoringtypes.NodeCondition
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
+	// When filtering by pod status / node readiness, resolve the full-scope
+	// keyset(s) concurrently (pageGroups=nil spans all groups under the user
+	// filter) to intersect metadata + ranked groups below. Filters compose as AND.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -106,12 +124,37 @@ func (m *module) getTopClusterGroupsAndMetadata(
 		return err
 	})
 
+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
+	if len(filterByNodeReadiness) != 0 {
+		g.Go(func() error {
+			var err error
+			nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByNodeReadiness)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.ClusterNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status/readiness-matching groups. A missing
+		// metric yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning). Filters compose as AND.
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
+		}
+		if len(filterByNodeReadiness) != 0 {
+			metadataMap = intersectMap(metadataMap, nodeConditionCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.ClusterNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
 	}
 
 	queryNamesForOrderBy := orderByToClustersQueryNames[orderByKey]
@@ -157,10 +200,23 @@ func (m *module) getTopClusterGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, nil, err
 	}
 
-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status/readiness
+	// keyset. A missing metric yields an empty keyset, correctly emptying the result
+	// (the caller also surfaces the warning). Filters compose as AND.
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+	if len(filterByNodeReadiness) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, nodeConditionCounts)
+		metadataMap = intersectMap(metadataMap, nodeConditionCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
 }
 
 func (m *module) getClustersTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableClusters) (map[string]map[string]string, error) {
@@ -170,5 +226,9 @@ func (m *module) getClustersTableMetadata(ctx context.Context, orgID valuer.UUID
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, clustersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, clustersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/containers.go

@@ -139,20 +139,34 @@ func buildContainerRecords(
 	return records
 }
 
+// getTopContainerGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope container-status keyset when filtering, to intersect both).
 func (m *module) getTopContainerGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableContainers,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]containerStatusCounts, *qbtypes.QueryWarnData, error) {
 
 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey              string
+		metadataMap             map[string]map[string]string
+		allMetricGroups         []rankedGroup
+		statusCounts            map[string]containerStatusCounts
+		statusWarning           *qbtypes.QueryWarnData
+		filter                  *qbtypes.Filter
+		filterByContainerStatus []inframonitoringtypes.ContainerStatus
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
+	// When filtering by container status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByContainerStatus = req.Filter.FilterByContainerStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -161,12 +175,26 @@ func (m *module) getTopContainerGroupsAndMetadata(
 		return err
 	})
 
+	if len(filterByContainerStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupContainerStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByContainerStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.ContainerNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByContainerStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.ContainerNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}
 
 	queryNamesForOrderBy := orderByToContainersQueryNames[orderByKey]
@@ -212,10 +240,19 @@ func (m *module) getTopContainerGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 
-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByContainerStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }
 
 func (m *module) getContainersTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableContainers) (map[string]map[string]string, error) {
@@ -225,7 +262,11 @@ func (m *module) getContainersTableMetadata(ctx context.Context, orgID valuer.UU
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, containersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, containersTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }
 
 // getPerGroupContainerStatusCountsWithReqMetricChecks gates
@@ -241,6 +282,7 @@ func (m *module) getPerGroupContainerStatusCountsWithReqMetricChecks(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByContainerStatus []inframonitoringtypes.ContainerStatus,
 ) (map[string]containerStatusCounts, *qbtypes.QueryWarnData, error) {
 	present, err := m.getMetricsExistence(ctx, containerStatusMetricNamesList)
 	if err != nil {
@@ -266,13 +308,28 @@ func (m *module) getPerGroupContainerStatusCountsWithReqMetricChecks(
 		return map[string]containerStatusCounts{}, warning, nil
 	}
 
-	counts, err := m.getPerGroupContainerStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups)
+	counts, err := m.getPerGroupContainerStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups, filterByContainerStatus)
 	if err != nil {
 		return nil, nil, err
 	}
 	return counts, nil, nil
 }
 
+// applyContainerStatusFilter adds the display-status push-down (lower(display_status)
+// IN (...)) to the outer count builder. valuer lowercases the wire value while
+// display_status is kubectl-cased, so we compare lower() on both. No-op when the
+// requested set is empty.
+func applyContainerStatusFilter(cb *sqlbuilder.SelectBuilder, filterByContainerStatus []inframonitoringtypes.ContainerStatus) {
+	if len(filterByContainerStatus) == 0 {
+		return
+	}
+	vals := make([]string, len(filterByContainerStatus))
+	for i, c := range filterByContainerStatus {
+		vals[i] = c.StringValue()
+	}
+	cb.Where(cb.In("lower(display_status)", sqlbuilder.List(vals)))
+}
+
 // getPerGroupContainerStatusCounts computes per-group counts of distinct
 // containers bucketed by their latest kubectl-style display status in window.
 // Caller must ensure the required metrics exist
@@ -297,8 +354,11 @@ func (m *module) getPerGroupContainerStatusCounts(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByContainerStatus []inframonitoringtypes.ContainerStatus,
 ) (map[string]containerStatusCounts, error) {
-	if len(pageGroups) == 0 || len(groupBy) == 0 {
+	// Empty pageGroups means "span all under user filter", allowed only in
+	// full-scope mode (filtering by status). Otherwise it's an empty page.
+	if len(groupBy) == 0 || (len(pageGroups) == 0 && len(filterByContainerStatus) == 0) {
 		return map[string]containerStatusCounts{}, nil
 	}
 
@@ -482,11 +542,15 @@ func (m *module) getPerGroupContainerStatusCounts(
 		countGroupBy = append(countGroupBy, col)
 	}
 	countSelectCols = append(countSelectCols, statusCountCols...)
-	countSQL := fmt.Sprintf(
-		"SELECT %s FROM container_status GROUP BY %s",
-		strings.Join(countSelectCols, ", "),
-		strings.Join(countGroupBy, ", "),
-	)
+
+	// Outer count query. Built with sqlbuilder so the status push-down uses a
+	// proper IN (keep only containers whose display status is in the requested set).
+	countBuilder := sqlbuilder.NewSelectBuilder()
+	countBuilder.Select(countSelectCols...)
+	countBuilder.From("container_status")
+	applyContainerStatusFilter(countBuilder, filterByContainerStatus)
+	countBuilder.GroupBy(countGroupBy...)
+	countSQL, countArgs := countBuilder.BuildWithFlavor(sqlbuilder.ClickHouse)
 
 	// Combine CTEs + outer. Arg order mirrors CTE declaration order.
 	cteFragments := []string{
@@ -499,7 +563,7 @@ func (m *module) getPerGroupContainerStatusCounts(
 	finalSQL := querybuilder.CombineCTEs(cteFragments) + countSQL
 	finalArgs := querybuilder.PrependArgs([][]any{
 		stateFpsArgs, containerStateArgs, reasonFpsArgs, reasonInnerArgs,
-	}, nil)
+	}, countArgs)
 
 	rows, err := m.telemetryStore.ClickhouseDB().Query(ctx, finalSQL, finalArgs...)
 	if err != nil {

pkg/modules/inframonitoring/implinframonitoring/containers_test.go

@@ -0,0 +1,59 @@
+package implinframonitoring
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/inframonitoringtypes"
+	"github.com/huandu/go-sqlbuilder"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestApplyContainerStatusFilter(t *testing.T) {
+	tests := []struct {
+		name      string
+		statuses  []inframonitoringtypes.ContainerStatus
+		wantWhere bool
+		wantArgs  []any
+	}{
+		{
+			name:      "empty set yields no clause",
+			statuses:  nil,
+			wantWhere: false,
+			wantArgs:  nil,
+		},
+		{
+			name:      "single status pushes lowercased arg via IN",
+			statuses:  []inframonitoringtypes.ContainerStatus{inframonitoringtypes.ContainerStatusRunning},
+			wantWhere: true,
+			wantArgs:  []any{"running"},
+		},
+		{
+			name: "multiple statuses push lowercased args via IN",
+			statuses: []inframonitoringtypes.ContainerStatus{
+				inframonitoringtypes.ContainerStatusRunning,
+				inframonitoringtypes.ContainerStatusCrashLoopBackOff,
+			},
+			wantWhere: true,
+			wantArgs:  []any{"running", "crashloopbackoff"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cb := sqlbuilder.NewSelectBuilder()
+			cb.Select("pod_uid")
+			cb.From("container_status")
+			applyContainerStatusFilter(cb, tt.statuses)
+			sql, args := cb.BuildWithFlavor(sqlbuilder.ClickHouse)
+
+			hasWhere := strings.Contains(sql, "lower(display_status) IN (")
+			assert.Equal(t, tt.wantWhere, hasWhere)
+			if len(tt.wantArgs) == 0 {
+				assert.Empty(t, args)
+			} else {
+				assert.Equal(t, tt.wantArgs, args)
+			}
+		})
+	}
+}

pkg/modules/inframonitoring/implinframonitoring/daemonsets.go

@@ -90,20 +90,34 @@ func buildDaemonSetRecords(
 	return records
 }
 
+// getTopDaemonSetGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopDaemonSetGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableDaemonSets,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
 
 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -112,12 +126,26 @@ func (m *module) getTopDaemonSetGroupsAndMetadata(
 		return err
 	})
 
+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.DaemonSetNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.DaemonSetNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}
 
 	queryNamesForOrderBy := orderByToDaemonSetsQueryNames[orderByKey]
@@ -163,10 +191,19 @@ func (m *module) getTopDaemonSetGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 
-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }
 
 func (m *module) getDaemonSetsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableDaemonSets) (map[string]map[string]string, error) {
@@ -176,5 +213,9 @@ func (m *module) getDaemonSetsTableMetadata(ctx context.Context, orgID valuer.UU
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, daemonSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, daemonSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/deployments.go

@@ -82,20 +82,34 @@ func buildDeploymentRecords(
 	return records
 }
 
+// getTopDeploymentGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopDeploymentGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableDeployments,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
 
 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -104,12 +118,26 @@ func (m *module) getTopDeploymentGroupsAndMetadata(
 		return err
 	})
 
+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.DeploymentNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.DeploymentNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}
 
 	queryNamesForOrderBy := orderByToDeploymentsQueryNames[orderByKey]
@@ -155,10 +183,19 @@ func (m *module) getTopDeploymentGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 
-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }
 
 func (m *module) getDeploymentsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableDeployments) (map[string]map[string]string, error) {
@@ -168,5 +205,9 @@ func (m *module) getDeploymentsTableMetadata(ctx context.Context, orgID valuer.U
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, deploymentsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, deploymentsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/helpers.go

@@ -63,6 +63,33 @@ func compositeKeyFromLabels(labels map[string]string, groupBy []qbtypes.GroupByK
 	return compositeKeyFromList(parts)
 }
 
+// intersectMap returns the entries of m whose key is present in keep (a new
+// map). keep's value type is irrelevant — only its keys are read — so a
+// per-group counts map (already filtered by the SQL push-down) can be passed
+// directly. Used to trim metadataMap to the status-matching groups.
+func intersectMap[V any, K any](m map[string]V, keep map[string]K) map[string]V {
+	out := make(map[string]V, len(m))
+	for k, v := range m {
+		if _, ok := keep[k]; ok {
+			out[k] = v
+		}
+	}
+	return out
+}
+
+// intersectRankedGroups returns the ranked groups whose compositeKey is present
+// in keep, preserving order. Keeps status-unmatched groups out of the ranked
+// page slots.
+func intersectRankedGroups[K any](groups []rankedGroup, keep map[string]K) []rankedGroup {
+	out := make([]rankedGroup, 0, len(groups))
+	for _, g := range groups {
+		if _, ok := keep[g.compositeKey]; ok {
+			out = append(out, g)
+		}
+	}
+	return out
+}
+
 // parseAndSortGroups extracts group label maps from a ScalarData response and
 // sorts them by the ranking query's aggregation value.
 func parseAndSortGroups(
@@ -850,8 +877,10 @@ func (m *module) getPerGroupDistinctCounts(
 			valueExpr = fmt.Sprintf("(%s)", strings.Join(parts, ", "))
 		}
 
+		// Prefix the alias so it never collides with a groupBy col alias
+		// (e.g. clusters grouped by k8s.node.name, which is also counted).
 		selectCols = append(selectCols,
-			fmt.Sprintf("uniqExactIf(%s, %s != '') AS %s", valueExpr, extract, quoteIdentifier(attr)),
+			fmt.Sprintf("uniqExactIf(%s, %s != '') AS %s", valueExpr, extract, quoteIdentifier(fmt.Sprintf("__count_%s", attr))),
 		)
 	}
 	sb.Select(selectCols...)

pkg/modules/inframonitoring/implinframonitoring/helpers_test.go

@@ -5,6 +5,7 @@ import (
 
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/stretchr/testify/assert"
 )
 
 func groupByKey(name string) qbtypes.GroupByKey {
@@ -88,10 +89,7 @@ func TestIsKeyInGroupByAttrs(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := isKeyInGroupByAttrs(tt.groupByAttrs, tt.key)
-			if got != tt.expectedFound {
-				t.Errorf("isKeyInGroupByAttrs(%v, %q) = %v, want %v",
-					tt.groupByAttrs, tt.key, got, tt.expectedFound)
-			}
+			assert.Equal(t, tt.expectedFound, got)
 		})
 	}
 }
@@ -156,10 +154,7 @@ func TestMergeFilterExpressions(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := mergeFilterExpressions(tt.queryFilterExpr, tt.reqFilterExpr)
-			if got != tt.expected {
-				t.Errorf("mergeFilterExpressions(%q, %q) = %q, want %q",
-					tt.queryFilterExpr, tt.reqFilterExpr, got, tt.expected)
-			}
+			assert.Equal(t, tt.expected, got)
 		})
 	}
 }
@@ -205,10 +200,7 @@ func TestCompositeKeyFromList(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := compositeKeyFromList(tt.parts)
-			if got != tt.expected {
-				t.Errorf("compositeKeyFromList(%v) = %q, want %q",
-					tt.parts, got, tt.expected)
-			}
+			assert.Equal(t, tt.expected, got)
 		})
 	}
 }
@@ -376,10 +368,81 @@ func TestCompositeKeyFromLabels(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			got := compositeKeyFromLabels(tt.labels, tt.groupBy)
-			if got != tt.expected {
-				t.Errorf("compositeKeyFromLabels(%v, %v) = %q, want %q",
-					tt.labels, tt.groupBy, got, tt.expected)
-			}
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestIntersectMap(t *testing.T) {
+	tests := []struct {
+		name     string
+		m        map[string]int
+		keep     map[string]podStatusCounts
+		expected map[string]int
+	}{
+		{
+			name:     "keep subset",
+			m:        map[string]int{"a": 1, "b": 2, "c": 3},
+			keep:     map[string]podStatusCounts{"a": {}, "c": {}},
+			expected: map[string]int{"a": 1, "c": 3},
+		},
+		{
+			name:     "empty keep drops everything",
+			m:        map[string]int{"a": 1, "b": 2},
+			keep:     map[string]podStatusCounts{},
+			expected: map[string]int{},
+		},
+		{
+			name:     "keep key absent from m is ignored",
+			m:        map[string]int{"a": 1},
+			keep:     map[string]podStatusCounts{"a": {}, "z": {}},
+			expected: map[string]int{"a": 1},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := intersectMap(tt.m, tt.keep)
+			assert.Equal(t, tt.expected, got)
+		})
+	}
+}
+
+func TestIntersectRankedGroups(t *testing.T) {
+	groups := []rankedGroup{
+		{compositeKey: "a", value: 3},
+		{compositeKey: "b", value: 2},
+		{compositeKey: "c", value: 1},
+	}
+
+	tests := []struct {
+		name     string
+		groups   []rankedGroup
+		keep     map[string]podStatusCounts
+		expected []string // compositeKeys in order
+	}{
+		{
+			name:     "preserves order, drops non-matching",
+			groups:   groups,
+			keep:     map[string]podStatusCounts{"a": {}, "c": {}},
+			expected: []string{"a", "c"},
+		},
+		{
+			name:     "empty keep drops all",
+			groups:   groups,
+			keep:     map[string]podStatusCounts{},
+			expected: []string{},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := intersectRankedGroups(tt.groups, tt.keep)
+			gotKeys := make([]string, 0, len(got))
+			for _, g := range got {
+				gotKeys = append(gotKeys, g.compositeKey)
+			}
+			assert.Equal(t, tt.expected, gotKeys)
 		})
 	}
 }

pkg/modules/inframonitoring/implinframonitoring/jobs.go

@@ -90,20 +90,34 @@ func buildJobRecords(
 	return records
 }
 
+// getTopJobGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopJobGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableJobs,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
 
 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -112,12 +126,26 @@ func (m *module) getTopJobGroupsAndMetadata(
 		return err
 	})
 
+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.JobNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.JobNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}
 
 	queryNamesForOrderBy := orderByToJobsQueryNames[orderByKey]
@@ -163,10 +191,19 @@ func (m *module) getTopJobGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 
-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }
 
 func (m *module) getJobsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableJobs) (map[string]map[string]string, error) {
@@ -176,5 +213,9 @@ func (m *module) getJobsTableMetadata(ctx context.Context, orgID valuer.UUID, re
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, jobsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, jobsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/module.go

@@ -286,11 +286,36 @@ func (m *module) ListPods(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}
 
-	pageGroups, metadataMap, err := m.getTopPodGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		podFilter         *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+		restartCounts     map[string]int64
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		podFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopPodGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, statusCounts, statusWarning, err := m.getTopPodGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && statusWarning != nil {
+		resp.Warning = statusWarning
+		resp.Records = []inframonitoringtypes.PodRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -298,20 +323,8 @@ func (m *module) ListPods(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}
 
-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newPodsTableListQuery())
 
-	var (
-		queryResp     *qbtypes.QueryRangeResponse
-		statusCounts  map[string]podStatusCounts
-		statusWarning *qbtypes.QueryWarnData
-		restartCounts map[string]int64
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -321,14 +334,18 @@ func (m *module) ListPods(ctx context.Context, orgID valuer.UUID, req *inframoni
 	})
 	g.Go(func() error {
 		var err error
-		statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		restartCounts, err = m.getPerGroupPodRestartCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		restartCounts, err = m.getPerGroupPodRestartCounts(gCtx, orgID, req.Start, req.End, podFilter, req.GroupBy, pageGroups)
 		return err
 	})
+	// When filtering, statusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, podFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -379,11 +396,37 @@ func (m *module) ListContainers(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
-	pageGroups, metadataMap, err := m.getTopContainerGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr              string
+		containerFilter         *qbtypes.Filter
+		filterByContainerStatus []inframonitoringtypes.ContainerStatus
+		queryResp               *qbtypes.QueryRangeResponse
+		restartCounts           map[string]int64
+		readyCounts             map[string]containerReadyCounts
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		containerFilter = &req.Filter.Filter
+		filterByContainerStatus = req.Filter.FilterByContainerStatus
+	}
+
+	// getTopContainerGroupsAndMetadata fetches metadata + ranking (+ full-scope
+	// container status when filtering) concurrently, intersecting metadata/ranked
+	// groups against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, statusCounts, statusWarning, err := m.getTopContainerGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByContainerStatus) != 0 && statusWarning != nil {
+		resp.Warning = statusWarning
+		resp.Records = []inframonitoringtypes.ContainerRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -391,21 +434,8 @@ func (m *module) ListContainers(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newContainersTableListQuery())
 
-	var (
-		queryResp     *qbtypes.QueryRangeResponse
-		statusCounts  map[string]containerStatusCounts
-		statusWarning *qbtypes.QueryWarnData
-		restartCounts map[string]int64
-		readyCounts   map[string]containerReadyCounts
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -415,19 +445,23 @@ func (m *module) ListContainers(ctx context.Context, orgID valuer.UUID, req *inf
 	})
 	g.Go(func() error {
 		var err error
-		statusCounts, statusWarning, err = m.getPerGroupContainerStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		restartCounts, err = m.getPerGroupContainerRestartCounts(gCtx, orgID, req.Start, req.End, containerFilter, req.GroupBy, pageGroups)
 		return err
 	})
 	g.Go(func() error {
 		var err error
-		restartCounts, err = m.getPerGroupContainerRestartCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		readyCounts, err = m.getPerGroupContainerReadyCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
+		readyCounts, err = m.getPerGroupContainerReadyCounts(gCtx, orgID, req.Start, req.End, containerFilter, req.GroupBy, pageGroups)
 		return err
 	})
+	// When filtering, statusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByContainerStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupContainerStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, containerFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -478,11 +512,37 @@ func (m *module) ListNodes(ctx context.Context, orgID valuer.UUID, req *inframon
 		return resp, nil
 	}
 
-	pageGroups, metadataMap, err := m.getTopNodeGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr            string
+		nodeFilter            *qbtypes.Filter
+		filterByPodStatus     []inframonitoringtypes.PodStatus
+		filterByNodeReadiness []inframonitoringtypes.NodeCondition
+		queryResp             *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		nodeFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
+	}
+
+	// getTopNodeGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status / node readiness when filtering) concurrently, intersecting
+	// metadata/ranked groups against the keysets. It returns the keysets + warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, nodeConditionCounts, err := m.getTopNodeGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.NodeRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -490,20 +550,8 @@ func (m *module) ListNodes(ctx context.Context, orgID valuer.UUID, req *inframon
 		return resp, nil
 	}
 
-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newNodesTableListQuery())
 
-	var (
-		queryResp           *qbtypes.QueryRangeResponse
-		nodeConditionCounts map[string]nodeConditionCounts
-		podStatusCounts     map[string]podStatusCounts
-		podStatusWarning    *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -511,16 +559,24 @@ func (m *module) ListNodes(ctx context.Context, orgID valuer.UUID, req *inframon
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering by readiness, nodeConditionCounts already holds the full-scope
+	// map (a superset of the page); otherwise compute it page-scoped here.
+	if len(filterByNodeReadiness) == 0 {
+		g.Go(func() error {
+			var err error
+			nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, nodeFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
+	// When filtering by pod status, podStatusCounts already holds the full-scope
+	// map; otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, nodeFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -571,11 +627,36 @@ func (m *module) ListNamespaces(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
-	pageGroups, metadataMap, err := m.getTopNamespaceGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		namespaceFilter   *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+		resourceCounts    map[string]map[string]int64
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		namespaceFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopNamespaceGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopNamespaceGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.NamespaceRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -583,20 +664,8 @@ func (m *module) ListNamespaces(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newNamespacesTableListQuery())
 
-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-		resourceCounts   map[string]map[string]int64
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -606,14 +675,18 @@ func (m *module) ListNamespaces(ctx context.Context, orgID valuer.UUID, req *inf
 	})
 	g.Go(func() error {
 		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups, namespaceCountAttrKeys, namespacesMetricNamesListForCounts)
+		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, namespaceFilter, req.GroupBy, pageGroups, namespaceCountAttrKeys, namespacesMetricNamesListForCounts)
 		return err
 	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, namespaceFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -663,11 +736,39 @@ func (m *module) ListClusters(ctx context.Context, orgID valuer.UUID, req *infra
 		return resp, nil
 	}
 
-	pageGroups, metadataMap, err := m.getTopClusterGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr             string
+		clusterFilter          *qbtypes.Filter
+		filterByPodStatus      []inframonitoringtypes.PodStatus
+		filterByNodeReadiness  []inframonitoringtypes.NodeCondition
+		queryResp              *qbtypes.QueryRangeResponse
+		nodeConditionCountsMap map[string]nodeConditionCounts
+		resourceCounts         map[string]map[string]int64
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		clusterFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
+	}
+
+	// getTopClusterGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status / node readiness when filtering) concurrently, intersecting
+	// metadata/ranked groups against the keysets. It returns the keysets + warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, nodeConditionCountsMap, err := m.getTopClusterGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.ClusterRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -675,23 +776,8 @@ func (m *module) ListClusters(ctx context.Context, orgID valuer.UUID, req *infra
 		return resp, nil
 	}
 
-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newClustersTableListQuery())
 
-	// With default groupBy [k8s.cluster.name], counts are bucketed per cluster;
-	// with a custom groupBy, they aggregate across clusters in that group.
-	var (
-		queryResp              *qbtypes.QueryRangeResponse
-		nodeConditionCountsMap map[string]nodeConditionCounts
-		podStatusCounts        map[string]podStatusCounts
-		podStatusWarning       *qbtypes.QueryWarnData
-		resourceCounts         map[string]map[string]int64
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -699,21 +785,29 @@ func (m *module) ListClusters(ctx context.Context, orgID valuer.UUID, req *infra
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
+	// When filtering by readiness, nodeConditionCountsMap already holds the
+	// full-scope map (a superset of the page); otherwise compute it page-scoped here.
+	if len(filterByNodeReadiness) == 0 {
+		g.Go(func() error {
+			var err error
+			nodeConditionCountsMap, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, clusterFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 	g.Go(func() error {
 		var err error
-		nodeConditionCountsMap, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
-	g.Go(func() error {
-		var err error
-		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups, clusterCountAttrKeys, clusterMetricNamesListForCounts)
+		resourceCounts, err = m.getPerGroupDistinctCounts(gCtx, orgID, req.Start, req.End, clusterFilter, req.GroupBy, pageGroups, clusterCountAttrKeys, clusterMetricNamesListForCounts)
 		return err
 	})
+	// When filtering by pod status, podStatusCounts already holds the full-scope
+	// map; otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, clusterFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -827,7 +921,7 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 
 	// Bake the deployments base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &qbtypes.Filter{}
+		req.Filter = &inframonitoringtypes.DeploymentFilter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(deploymentsBaseFilterExpr, req.Filter.Expression)
 
@@ -842,11 +936,35 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 		return resp, nil
 	}
 
-	pageGroups, metadataMap, err := m.getTopDeploymentGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		deploymentFilter  *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		deploymentFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopDeploymentGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopDeploymentGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.DeploymentRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -854,19 +972,8 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 		return resp, nil
 	}
 
-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newDeploymentsTableListQuery())
 
-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -874,11 +981,15 @@ func (m *module) ListDeployments(ctx context.Context, orgID valuer.UUID, req *in
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, deploymentFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -919,7 +1030,7 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 
 	// Bake the workload base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &qbtypes.Filter{}
+		req.Filter = &inframonitoringtypes.StatefulSetFilter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(statefulSetsBaseFilterExpr, req.Filter.Expression)
 
@@ -934,11 +1045,35 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 		return resp, nil
 	}
 
-	pageGroups, metadataMap, err := m.getTopStatefulSetGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		statefulSetFilter *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		statefulSetFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopStatefulSetGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopStatefulSetGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.StatefulSetRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -946,21 +1081,8 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 		return resp, nil
 	}
 
-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newStatefulSetsTableListQuery())
 
-	// Pods owned by a StatefulSet carry k8s.statefulset.name as a resource attribute,
-	// so default-groupBy gives per-statefulset status counts automatically.
-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -968,11 +1090,15 @@ func (m *module) ListStatefulSets(ctx context.Context, orgID valuer.UUID, req *i
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, statefulSetFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -1013,7 +1139,7 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 
 	// Bake the jobs base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &qbtypes.Filter{}
+		req.Filter = &inframonitoringtypes.JobFilter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(jobsBaseFilterExpr, req.Filter.Expression)
 
@@ -1028,11 +1154,35 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}
 
-	pageGroups, metadataMap, err := m.getTopJobGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		jobFilter         *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		jobFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopJobGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopJobGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.JobRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -1040,21 +1190,8 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 		return resp, nil
 	}
 
-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newJobsTableListQuery())
 
-	// Pods owned by a Job carry k8s.job.name as a resource attribute, so default-groupBy
-	// gives per-job status counts automatically.
-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -1062,11 +1199,15 @@ func (m *module) ListJobs(ctx context.Context, orgID valuer.UUID, req *inframoni
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, jobFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err
@@ -1107,7 +1248,7 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 
 	// Bake the workload base filter into req.Filter so all downstream helpers pick it up.
 	if req.Filter == nil {
-		req.Filter = &qbtypes.Filter{}
+		req.Filter = &inframonitoringtypes.DaemonSetFilter{}
 	}
 	req.Filter.Expression = mergeFilterExpressions(daemonSetsBaseFilterExpr, req.Filter.Expression)
 
@@ -1122,11 +1263,35 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
-	pageGroups, metadataMap, err := m.getTopDaemonSetGroupsAndMetadata(ctx, orgID, req)
+	var (
+		filterExpr        string
+		daemonSetFilter   *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
+		queryResp         *qbtypes.QueryRangeResponse
+	)
+
+	if req.Filter != nil {
+		filterExpr = req.Filter.Expression
+		daemonSetFilter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
+	// getTopDaemonSetGroupsAndMetadata fetches metadata + ranking (+ full-scope pod
+	// status when filtering) concurrently, intersecting metadata/ranked groups
+	// against the status keyset. It returns the keyset + its warning.
+	pageGroups, metadataMap, podStatusCounts, podStatusWarning, err := m.getTopDaemonSetGroupsAndMetadata(ctx, orgID, req)
 	if err != nil {
 		return nil, err
 	}
 
+	// Required metric missing while filtering: surface the warning + empty result.
+	if len(filterByPodStatus) != 0 && podStatusWarning != nil {
+		resp.Warning = podStatusWarning
+		resp.Records = []inframonitoringtypes.DaemonSetRecord{}
+		resp.Total = 0
+		return resp, nil
+	}
+
 	resp.Total = len(metadataMap)
 
 	if len(pageGroups) == 0 {
@@ -1134,21 +1299,8 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 		return resp, nil
 	}
 
-	filterExpr := ""
-	if req.Filter != nil {
-		filterExpr = req.Filter.Expression
-	}
-
 	fullQueryReq := buildFullQueryRequest(req.Start, req.End, filterExpr, req.GroupBy, pageGroups, m.newDaemonSetsTableListQuery())
 
-	// Pods owned by a DaemonSet carry k8s.daemonset.name as a resource attribute,
-	// so default-groupBy gives per-daemonset status counts automatically.
-	var (
-		queryResp        *qbtypes.QueryRangeResponse
-		podStatusCounts  map[string]podStatusCounts
-		podStatusWarning *qbtypes.QueryWarnData
-	)
-
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -1156,11 +1308,15 @@ func (m *module) ListDaemonSets(ctx context.Context, orgID valuer.UUID, req *inf
 		queryResp, err = m.querier.QueryRange(gCtx, orgID, fullQueryReq)
 		return err
 	})
-	g.Go(func() error {
-		var err error
-		podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, req.Filter, req.GroupBy, pageGroups)
-		return err
-	})
+	// When filtering, podStatusCounts already holds the full-scope map (a superset
+	// of the page); otherwise compute it page-scoped here.
+	if len(filterByPodStatus) == 0 {
+		g.Go(func() error {
+			var err error
+			podStatusCounts, podStatusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, daemonSetFilter, req.GroupBy, pageGroups, nil)
+			return err
+		})
+	}
 
 	if err := g.Wait(); err != nil {
 		return nil, err

pkg/modules/inframonitoring/implinframonitoring/namespaces.go

@@ -65,20 +65,34 @@ func buildNamespaceRecords(
 	return records
 }
 
+// getTopNamespaceGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopNamespaceGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableNamespaces,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
 
 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -87,12 +101,26 @@ func (m *module) getTopNamespaceGroupsAndMetadata(
 		return err
 	})
 
+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.NamespaceNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.NamespaceNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}
 
 	queryNamesForOrderBy := orderByToNamespacesQueryNames[orderByKey]
@@ -138,10 +166,19 @@ func (m *module) getTopNamespaceGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 
-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }
 
 func (m *module) getNamespacesTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableNamespaces) (map[string]map[string]string, error) {
@@ -151,5 +188,9 @@ func (m *module) getNamespacesTableMetadata(ctx context.Context, orgID valuer.UU
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, namespacesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, namespacesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }

pkg/modules/inframonitoring/implinframonitoring/nodes.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"slices"
-	"strings"
 
 	"github.com/SigNoz/signoz/pkg/querybuilder"
 	"github.com/SigNoz/signoz/pkg/telemetryschema/metricstelemetryschema"
@@ -92,20 +91,38 @@ func buildNodeRecords(
 	return records
 }
 
+// getTopNodeGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status / node-readiness keysets when filtering,
+// to intersect all).
 func (m *module) getTopNodeGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableNodes,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, map[string]nodeConditionCounts, error) {
 
 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey            string
+		metadataMap           map[string]map[string]string
+		allMetricGroups       []rankedGroup
+		statusCounts          map[string]podStatusCounts
+		statusWarning         *qbtypes.QueryWarnData
+		nodeConditionCounts   map[string]nodeConditionCounts
+		filter                *qbtypes.Filter
+		filterByPodStatus     []inframonitoringtypes.PodStatus
+		filterByNodeReadiness []inframonitoringtypes.NodeCondition
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
+	// When filtering by pod status / node readiness, resolve the full-scope
+	// keyset(s) concurrently (pageGroups=nil spans all groups under the user
+	// filter) to intersect metadata + ranked groups below. Filters compose as AND.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+		filterByNodeReadiness = req.Filter.FilterByNodeReadiness
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -114,12 +131,37 @@ func (m *module) getTopNodeGroupsAndMetadata(
 		return err
 	})
 
+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
+	if len(filterByNodeReadiness) != 0 {
+		g.Go(func() error {
+			var err error
+			nodeConditionCounts, err = m.getPerGroupNodeConditionCounts(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByNodeReadiness)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.NodeNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status/readiness-matching groups. A missing
+		// metric yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning). Filters compose as AND.
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
+		}
+		if len(filterByNodeReadiness) != 0 {
+			metadataMap = intersectMap(metadataMap, nodeConditionCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.NodeNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
 	}
 
 	queryNamesForOrderBy := orderByToNodesQueryNames[orderByKey]
@@ -165,10 +207,23 @@ func (m *module) getTopNodeGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, nil, err
 	}
 
-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status/readiness
+	// keyset. A missing metric yields an empty keyset, correctly emptying the result
+	// (the caller also surfaces the warning). Filters compose as AND.
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+	if len(filterByNodeReadiness) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, nodeConditionCounts)
+		metadataMap = intersectMap(metadataMap, nodeConditionCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nodeConditionCounts, nil
 }
 
 func (m *module) getNodesTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableNodes) (map[string]map[string]string, error) {
@@ -178,7 +233,11 @@ func (m *module) getNodesTableMetadata(ctx context.Context, orgID valuer.UUID, r
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, nodesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, nodesTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }
 
 // getPerGroupNodeConditionCounts computes per-group node counts bucketed by each
@@ -192,6 +251,24 @@ func (m *module) getNodesTableMetadata(ctx context.Context, orgID valuer.UUID, r
 //	countNodesPerCondition:  per-group uniqExactIf into ready/not_ready buckets.
 //
 // Groups absent from the result map have implicit zero counts (caller default).
+// applyNodeReadinessFilter adds the readiness push-down (condition_value IN (...))
+// to the outer count builder. condition_value is numeric (1=Ready, 0=NotReady), so
+// we map each requested enum to its int. No-op when the requested set is empty.
+func applyNodeReadinessFilter(cb *sqlbuilder.SelectBuilder, filterByNodeReadiness []inframonitoringtypes.NodeCondition) {
+	if len(filterByNodeReadiness) == 0 {
+		return
+	}
+	nums := make([]int, len(filterByNodeReadiness))
+	for i, c := range filterByNodeReadiness {
+		v := inframonitoringtypes.NodeConditionNumNotReady
+		if c == inframonitoringtypes.NodeConditionReady {
+			v = inframonitoringtypes.NodeConditionNumReady
+		}
+		nums[i] = v
+	}
+	cb.Where(cb.In("condition_value", sqlbuilder.List(nums)))
+}
+
 func (m *module) getPerGroupNodeConditionCounts(
 	ctx context.Context,
 	orgID valuer.UUID,
@@ -199,8 +276,11 @@ func (m *module) getPerGroupNodeConditionCounts(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByNodeReadiness []inframonitoringtypes.NodeCondition,
 ) (map[string]nodeConditionCounts, error) {
-	if len(pageGroups) == 0 || len(groupBy) == 0 {
+	// Empty pageGroups means "span all under user filter", allowed only in
+	// full-scope mode (filtering by readiness). Otherwise it's an empty page.
+	if len(groupBy) == 0 || (len(pageGroups) == 0 && len(filterByNodeReadiness) == 0) {
 		return map[string]nodeConditionCounts{}, nil
 	}
 
@@ -288,11 +368,14 @@ func (m *module) getPerGroupNodeConditionCounts(
 		fmt.Sprintf("uniqExactIf(node_name, condition_value = %d) AS ready_count", inframonitoringtypes.NodeConditionNumReady),
 		fmt.Sprintf("uniqExactIf(node_name, condition_value = %d) AS not_ready_count", inframonitoringtypes.NodeConditionNumNotReady),
 	)
-	countNodesPerConditionSQL := fmt.Sprintf(
-		"SELECT %s FROM latest_condition_per_node GROUP BY %s",
-		strings.Join(countNodesPerConditionSelectCols, ", "),
-		strings.Join(countNodesPerConditionGroupBy, ", "),
-	)
+	// Outer count query. Built with sqlbuilder so the readiness push-down uses a
+	// proper IN (keep only nodes whose readiness is in the requested set).
+	countBuilder := sqlbuilder.NewSelectBuilder()
+	countBuilder.Select(countNodesPerConditionSelectCols...)
+	countBuilder.From("latest_condition_per_node")
+	applyNodeReadinessFilter(countBuilder, filterByNodeReadiness)
+	countBuilder.GroupBy(countNodesPerConditionGroupBy...)
+	countNodesPerConditionSQL, countArgs := countBuilder.BuildWithFlavor(sqlbuilder.ClickHouse)
 
 	// Combine CTEs + outer.
 	cteFragments := []string{
@@ -300,7 +383,7 @@ func (m *module) getPerGroupNodeConditionCounts(
 		fmt.Sprintf("latest_condition_per_node AS (%s)", latestConditionPerNodeSQL),
 	}
 	finalSQL := querybuilder.CombineCTEs(cteFragments) + countNodesPerConditionSQL
-	finalArgs := querybuilder.PrependArgs([][]any{timeSeriesFPsArgs, latestConditionPerNodeArgs}, nil)
+	finalArgs := querybuilder.PrependArgs([][]any{timeSeriesFPsArgs, latestConditionPerNodeArgs}, countArgs)
 
 	rows, err := m.telemetryStore.ClickhouseDB().Query(ctx, finalSQL, finalArgs...)
 	if err != nil {

pkg/modules/inframonitoring/implinframonitoring/nodes_test.go

@@ -0,0 +1,65 @@
+package implinframonitoring
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/inframonitoringtypes"
+	"github.com/huandu/go-sqlbuilder"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestApplyNodeReadinessFilter(t *testing.T) {
+	tests := []struct {
+		name      string
+		readiness []inframonitoringtypes.NodeCondition
+		wantWhere bool
+		wantArgs  []any
+	}{
+		{
+			name:      "empty set yields no clause",
+			readiness: nil,
+			wantWhere: false,
+			wantArgs:  nil,
+		},
+		{
+			name:      "ready maps to 1 via IN",
+			readiness: []inframonitoringtypes.NodeCondition{inframonitoringtypes.NodeConditionReady},
+			wantWhere: true,
+			wantArgs:  []any{inframonitoringtypes.NodeConditionNumReady},
+		},
+		{
+			name:      "not_ready maps to 0 via IN",
+			readiness: []inframonitoringtypes.NodeCondition{inframonitoringtypes.NodeConditionNotReady},
+			wantWhere: true,
+			wantArgs:  []any{inframonitoringtypes.NodeConditionNumNotReady},
+		},
+		{
+			name: "multiple conditions map to their ints via IN",
+			readiness: []inframonitoringtypes.NodeCondition{
+				inframonitoringtypes.NodeConditionReady,
+				inframonitoringtypes.NodeConditionNotReady,
+			},
+			wantWhere: true,
+			wantArgs:  []any{inframonitoringtypes.NodeConditionNumReady, inframonitoringtypes.NodeConditionNumNotReady},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cb := sqlbuilder.NewSelectBuilder()
+			cb.Select("node_name")
+			cb.From("latest_condition_per_node")
+			applyNodeReadinessFilter(cb, tt.readiness)
+			sql, args := cb.BuildWithFlavor(sqlbuilder.ClickHouse)
+
+			hasWhere := strings.Contains(sql, "condition_value IN (")
+			assert.Equal(t, tt.wantWhere, hasWhere)
+			if len(tt.wantArgs) == 0 {
+				assert.Empty(t, args)
+			} else {
+				assert.Equal(t, tt.wantArgs, args)
+			}
+		})
+	}
+}

pkg/modules/inframonitoring/implinframonitoring/pods.go

@@ -146,24 +146,34 @@ func buildPodRecords(
 	return records
 }
 
-// getTopPodGroupsAndMetadata fetches the group metadata and the ordering-metric
-// ranking concurrently, then pages the ranked groups, backfilling from metadata
-// when the page extends past the metric-ranked groups. Returns the page of
-// groups and the metadata map (needed by the caller for Total and records).
+// getTopPodGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopPodGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostablePods,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
 
 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -172,12 +182,26 @@ func (m *module) getTopPodGroupsAndMetadata(
 		return err
 	})
 
+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.PodNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.PodNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}
 
 	queryNamesForOrderBy := orderByToPodsQueryNames[orderByKey]
@@ -223,10 +247,19 @@ func (m *module) getTopPodGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 
-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }
 
 func (m *module) getPodsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostablePods) (map[string]map[string]string, error) {
@@ -236,7 +269,11 @@ func (m *module) getPodsTableMetadata(ctx context.Context, orgID valuer.UUID, re
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, podsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, podsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }
 
 // getPerGroupPodStatusCountsWithReqMetricChecks gates getPerGroupPodStatusCounts
@@ -251,6 +288,7 @@ func (m *module) getPerGroupPodStatusCountsWithReqMetricChecks(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByPodStatus []inframonitoringtypes.PodStatus,
 ) (map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
 	present, err := m.getMetricsExistence(ctx, podStatusMetricNamesList)
 	if err != nil {
@@ -276,13 +314,28 @@ func (m *module) getPerGroupPodStatusCountsWithReqMetricChecks(
 		return map[string]podStatusCounts{}, warning, nil
 	}
 
-	counts, err := m.getPerGroupPodStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups)
+	counts, err := m.getPerGroupPodStatusCounts(ctx, orgID, start, end, filter, groupBy, pageGroups, filterByPodStatus)
 	if err != nil {
 		return nil, nil, err
 	}
 	return counts, nil, nil
 }
 
+// applyPodStatusFilter adds the display-status push-down (lower(display_status)
+// IN (...)) to the outer count builder. valuer lowercases the wire value while
+// display_status is kubectl-cased, so we compare lower() on both. No-op when the
+// requested set is empty.
+func applyPodStatusFilter(cb *sqlbuilder.SelectBuilder, filterByPodStatus []inframonitoringtypes.PodStatus) {
+	if len(filterByPodStatus) == 0 {
+		return
+	}
+	vals := make([]string, len(filterByPodStatus))
+	for i, s := range filterByPodStatus {
+		vals[i] = s.StringValue()
+	}
+	cb.Where(cb.In("lower(display_status)", sqlbuilder.List(vals)))
+}
+
 // getPerGroupPodStatusCounts computes per-group pod counts bucketed by each
 // pod's latest kubectl-style display status in the requested window. Caller
 // must ensure the required metrics exist (getPerGroupPodStatusCountsWithReqMetricChecks).
@@ -303,13 +356,20 @@ func (m *module) getPerGroupPodStatusCounts(
 	filter *qbtypes.Filter,
 	groupBy []qbtypes.GroupByKey,
 	pageGroups []map[string]string,
+	filterByPodStatus []inframonitoringtypes.PodStatus,
 ) (map[string]podStatusCounts, error) {
-	if len(pageGroups) == 0 || len(groupBy) == 0 {
+	// return early if no group by or (no pagegroups provided plus no filterBystatus given for a full scan)
+	if len(groupBy) == 0 || (len(pageGroups) == 0 && len(filterByPodStatus) == 0) {
 		return map[string]podStatusCounts{}, nil
 	}
 
+	var (
+		filterClause   *sqlbuilder.WhereClause
+		err            error
+		userFilterExpr string
+	)
+
 	// Merge user filter with page-groups IN clauses.
-	userFilterExpr := ""
 	if filter != nil {
 		userFilterExpr = filter.Expression
 	}
@@ -322,10 +382,7 @@ func (m *module) getPerGroupPodStatusCounts(
 	// CTEs, and buildFilterClause hits the metadata store + parses the
 	// expression, so we don't want to repeat it per CTE. AddWhereClause only
 	// reads the clause, so the same instance is safe to attach to each builder.
-	var (
-		filterClause *sqlbuilder.WhereClause
-		err          error
-	)
+
 	if mergedFilterExpr != "" {
 		filterClause, err = m.buildFilterClause(ctx, orgID, &qbtypes.Filter{Expression: mergedFilterExpr}, start, end)
 		if err != nil {
@@ -540,11 +597,15 @@ func (m *module) getPerGroupPodStatusCounts(
 		countGroupBy = append(countGroupBy, col)
 	}
 	countSelectCols = append(countSelectCols, statusCountCols...)
-	countSQL := fmt.Sprintf(
-		"SELECT %s FROM pod_status GROUP BY %s",
-		strings.Join(countSelectCols, ", "),
-		strings.Join(countGroupBy, ", "),
-	)
+
+	// Outer count query. Built with sqlbuilder so the status push-down uses a
+	// proper IN (keep only pods whose display status is in the requested set).
+	countBuilder := sqlbuilder.NewSelectBuilder()
+	countBuilder.Select(countSelectCols...)
+	countBuilder.From("pod_status")
+	applyPodStatusFilter(countBuilder, filterByPodStatus)
+	countBuilder.GroupBy(countGroupBy...)
+	countSQL, countArgs := countBuilder.BuildWithFlavor(sqlbuilder.ClickHouse)
 
 	// Combine CTEs + outer. Arg order mirrors CTE declaration order.
 	cteFragments := []string{
@@ -561,7 +622,7 @@ func (m *module) getPerGroupPodStatusCounts(
 		phaseFpsArgs, phasePerPodArgs,
 		podReasonFpsArgs, podReasonPerPodArgs,
 		containerReasonFpsArgs, containerInnerArgs,
-	}, nil)
+	}, countArgs)
 
 	rows, err := m.telemetryStore.ClickhouseDB().Query(ctx, finalSQL, finalArgs...)
 	if err != nil {

pkg/modules/inframonitoring/implinframonitoring/pods_test.go

@@ -0,0 +1,59 @@
+package implinframonitoring
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/inframonitoringtypes"
+	"github.com/huandu/go-sqlbuilder"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestApplyPodStatusFilter(t *testing.T) {
+	tests := []struct {
+		name      string
+		statuses  []inframonitoringtypes.PodStatus
+		wantWhere bool
+		wantArgs  []any
+	}{
+		{
+			name:      "empty set yields no clause",
+			statuses:  nil,
+			wantWhere: false,
+			wantArgs:  nil,
+		},
+		{
+			name:      "single status pushes lowercased arg via IN",
+			statuses:  []inframonitoringtypes.PodStatus{inframonitoringtypes.PodStatusRunning},
+			wantWhere: true,
+			wantArgs:  []any{"running"},
+		},
+		{
+			name: "multiple statuses push lowercased args via IN",
+			statuses: []inframonitoringtypes.PodStatus{
+				inframonitoringtypes.PodStatusRunning,
+				inframonitoringtypes.PodStatusCrashLoopBackOff,
+			},
+			wantWhere: true,
+			wantArgs:  []any{"running", "crashloopbackoff"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cb := sqlbuilder.NewSelectBuilder()
+			cb.Select("pod_uid")
+			cb.From("pod_status")
+			applyPodStatusFilter(cb, tt.statuses)
+			sql, args := cb.BuildWithFlavor(sqlbuilder.ClickHouse)
+
+			hasWhere := strings.Contains(sql, "lower(display_status) IN (")
+			assert.Equal(t, tt.wantWhere, hasWhere)
+			if len(tt.wantArgs) == 0 {
+				assert.Empty(t, args)
+			} else {
+				assert.Equal(t, tt.wantArgs, args)
+			}
+		})
+	}
+}

pkg/modules/inframonitoring/implinframonitoring/statefulsets.go

@@ -82,20 +82,34 @@ func buildStatefulSetRecords(
 	return records
 }
 
+// getTopStatefulSetGroupsAndMetadata concurrently fetches metadata + the ordering-metric
+// ranking (plus the full-scope pod-status keyset when filtering, to intersect both).
 func (m *module) getTopStatefulSetGroupsAndMetadata(
 	ctx context.Context,
 	orgID valuer.UUID,
 	req *inframonitoringtypes.PostableStatefulSets,
-) ([]map[string]string, map[string]map[string]string, error) {
+) ([]map[string]string, map[string]map[string]string, map[string]podStatusCounts, *qbtypes.QueryWarnData, error) {
 
 	var (
-		orderByKey      string
-		metadataMap     map[string]map[string]string
-		allMetricGroups []rankedGroup
+		orderByKey        string
+		metadataMap       map[string]map[string]string
+		allMetricGroups   []rankedGroup
+		statusCounts      map[string]podStatusCounts
+		statusWarning     *qbtypes.QueryWarnData
+		filter            *qbtypes.Filter
+		filterByPodStatus []inframonitoringtypes.PodStatus
 	)
 
 	orderByKey = req.OrderBy.Key.Name
 
+	// When filtering by pod status, resolve the full-scope status keyset
+	// concurrently (pageGroups=nil spans all groups under the user filter) so it
+	// can intersect metadata + ranked groups below.
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+		filterByPodStatus = req.Filter.FilterByPodStatus
+	}
+
 	g, gCtx := errgroup.WithContext(ctx)
 
 	g.Go(func() error {
@@ -104,12 +118,26 @@ func (m *module) getTopStatefulSetGroupsAndMetadata(
 		return err
 	})
 
+	if len(filterByPodStatus) != 0 {
+		g.Go(func() error {
+			var err error
+			statusCounts, statusWarning, err = m.getPerGroupPodStatusCountsWithReqMetricChecks(gCtx, orgID, req.Start, req.End, filter, req.GroupBy, nil, filterByPodStatus)
+			return err
+		})
+	}
+
 	if orderByKey == inframonitoringtypes.StatefulSetNameAttrKey {
 		if err := g.Wait(); err != nil {
-			return nil, nil, err
+			return nil, nil, nil, nil, err
+		}
+		// Secondary filter: keep only status-matching groups. A missing metric
+		// yields an empty statusCounts, so this correctly empties the result
+		// (the caller also surfaces the warning).
+		if len(filterByPodStatus) != 0 {
+			metadataMap = intersectMap(metadataMap, statusCounts)
 		}
 		pageGroups := inframonitoringtypes.PaginateMetadataByName(metadataMap, req.GroupBy, req.OrderBy.Direction, req.Offset, req.Limit, inframonitoringtypes.StatefulSetNameAttrKey)
-		return pageGroups, metadataMap, nil
+		return pageGroups, metadataMap, statusCounts, statusWarning, nil
 	}
 
 	queryNamesForOrderBy := orderByToStatefulSetsQueryNames[orderByKey]
@@ -155,10 +183,19 @@ func (m *module) getTopStatefulSetGroupsAndMetadata(
 	})
 
 	if err := g.Wait(); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, nil, err
 	}
 
-	return paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit), metadataMap, nil
+	// Secondary filter: intersect ranked groups + metadata with the status keyset.
+	// A missing metric yields an empty statusCounts, correctly emptying the result
+	// (the caller also surfaces the warning).
+	if len(filterByPodStatus) != 0 {
+		allMetricGroups = intersectRankedGroups(allMetricGroups, statusCounts)
+		metadataMap = intersectMap(metadataMap, statusCounts)
+	}
+
+	pageGroups := paginateWithBackfill(allMetricGroups, metadataMap, req.GroupBy, req.Offset, req.Limit)
+	return pageGroups, metadataMap, statusCounts, statusWarning, nil
 }
 
 func (m *module) getStatefulSetsTableMetadata(ctx context.Context, orgID valuer.UUID, req *inframonitoringtypes.PostableStatefulSets) (map[string]map[string]string, error) {
@@ -168,5 +205,9 @@ func (m *module) getStatefulSetsTableMetadata(ctx context.Context, orgID valuer.
 			nonGroupByAttrs = append(nonGroupByAttrs, key)
 		}
 	}
-	return m.getMetadata(ctx, orgID, statefulSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, req.Filter, req.Start, req.End)
+	var filter *qbtypes.Filter
+	if req.Filter != nil {
+		filter = &req.Filter.Filter
+	}
+	return m.getMetadata(ctx, orgID, statefulSetsTableMetricNamesList, req.GroupBy, nonGroupByAttrs, filter, req.Start, req.End)
 }

pkg/modules/user/impluser/handler.go

@@ -88,58 +88,6 @@ func (handler *handler) CreateInvite(rw http.ResponseWriter, r *http.Request) {
 	render.Success(rw, http.StatusCreated, invites[0])
 }
 
-func (handler *handler) CreateBulkInvite(rw http.ResponseWriter, r *http.Request) {
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	var req types.PostableBulkInviteRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	// Validate that the request contains users
-	if len(req.Invites) == 0 {
-		render.Error(rw, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "no invites provided for invitation"))
-		return
-	}
-
-	_, err = handler.setter.CreateBulkInvite(ctx, valuer.MustNewUUID(claims.OrgID), valuer.MustNewUUID(claims.IdentityID()), valuer.MustNewEmail(claims.Email), &req)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusCreated, nil)
-}
-
-func (handler *handler) GetUserDeprecated(w http.ResponseWriter, r *http.Request) {
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	id := mux.Vars(r)["id"]
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	user, err := handler.getter.GetDeprecatedUserByOrgIDAndID(ctx, valuer.MustNewUUID(claims.OrgID), valuer.MustNewUUID(id))
-	if err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	render.Success(w, http.StatusOK, user)
-}
-
 func (handler *handler) GetUser(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
@@ -284,33 +232,6 @@ func (handler *handler) ListUsers(w http.ResponseWriter, r *http.Request) {
 	render.Success(w, http.StatusOK, users)
 }
 
-func (handler *handler) UpdateUserDeprecated(w http.ResponseWriter, r *http.Request) {
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	id := mux.Vars(r)["id"]
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	user := types.DeprecatedUser{User: &types.User{}}
-	if err := json.NewDecoder(r.Body).Decode(&user); err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	updatedUser, err := handler.setter.UpdateUserDeprecated(ctx, valuer.MustNewUUID(claims.OrgID), id, &user)
-	if err != nil {
-		render.Error(w, err)
-		return
-	}
-
-	render.Success(w, http.StatusOK, updatedUser)
-}
-
 func (handler *handler) UpdateUser(w http.ResponseWriter, r *http.Request) {
 	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
 	defer cancel()
@@ -470,7 +391,7 @@ func (handler *handler) ResetPassword(w http.ResponseWriter, r *http.Request) {
 	defer cancel()
 
 	req := new(types.PostableResetPassword)
-	if err := json.NewDecoder(r.Body).Decode(req); err != nil {
+	if err := binding.JSON.BindBody(r.Body, req); err != nil {
 		render.Error(w, err)
 		return
 	}

pkg/modules/user/impluser/setter.go

@@ -276,92 +276,6 @@ func (module *setter) CreatePendingInviteUser(ctx context.Context, identityID va
 	return user, nil
 }
 
-func (module *setter) UpdateUserDeprecated(ctx context.Context, orgID valuer.UUID, id string, user *types.DeprecatedUser) (*types.DeprecatedUser, error) {
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		return nil, err
-	}
-
-	existingUser, err := module.getter.GetDeprecatedUserByOrgIDAndID(ctx, orgID, valuer.MustNewUUID(id))
-	if err != nil {
-		return nil, err
-	}
-
-	if err := existingUser.ErrIfRoot(); err != nil {
-		return nil, errors.WithAdditionalf(err, "cannot update root user")
-	}
-
-	if err := existingUser.ErrIfDeleted(); err != nil {
-		return nil, errors.WithAdditionalf(err, "cannot update deleted user")
-	}
-
-	roleChange := user.Role != "" && user.Role != existingUser.Role
-
-	if roleChange {
-		selectors := []coretypes.Selector{
-			coretypes.TypeRole.MustSelector(authtypes.SigNozAdminRoleName),
-		}
-		err = module.authz.CheckWithTupleCreation(
-			ctx,
-			claims,
-			valuer.MustNewUUID(claims.OrgID),
-			authtypes.Relation{Verb: coretypes.VerbAssignee},
-			coretypes.NewResourceRole(),
-			selectors,
-			selectors,
-		)
-
-		if err != nil {
-			return nil, errors.New(errors.TypeForbidden, errors.CodeForbidden, "only admins can change roles")
-		}
-	}
-
-	// make sure the user is not demoting self from admin
-	if roleChange && existingUser.ID == valuer.MustNewUUID(claims.IdentityID()) && existingUser.Role == types.RoleAdmin && user.Role != types.RoleAdmin {
-		return nil, errors.New(errors.TypeForbidden, errors.CodeForbidden, "cannot change self role")
-	}
-
-	if roleChange {
-		err = module.authz.ModifyGrant(ctx,
-			orgID,
-			[]string{authtypes.MustGetSigNozManagedRoleFromExistingRole(existingUser.Role)},
-			[]string{authtypes.MustGetSigNozManagedRoleFromExistingRole(user.Role)},
-			authtypes.MustNewSubject(coretypes.NewResourceUser(), id, orgID, nil),
-		)
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	existingUser.Update(user.DisplayName, user.Role)
-
-	// update the user - idempotent (this does analytics too so keeping it outside txn)
-	if err := module.UpdateAnyUserDeprecated(ctx, orgID, existingUser); err != nil {
-		return nil, err
-	}
-
-	err = module.store.RunInTx(ctx, func(ctx context.Context) error {
-		if roleChange {
-			// delete old role entries and create new ones
-			if err := module.userRoleStore.DeleteUserRoles(ctx, existingUser.ID); err != nil {
-				return err
-			}
-
-			// create new ones
-			if err := module.createUserRoleEntries(ctx, existingUser.OrgID, existingUser.ID, []string{authtypes.MustGetSigNozManagedRoleFromExistingRole(user.Role)}); err != nil {
-				return err
-			}
-		}
-
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-
-	return existingUser, nil
-}
-
 func (module *setter) UpdateUser(ctx context.Context, orgID valuer.UUID, userID valuer.UUID, updatable *types.UpdatableUser) (*types.User, error) {
 	existingUser, err := module.getter.GetUserByOrgIDAndID(ctx, orgID, userID)
 	if err != nil {
@@ -401,23 +315,6 @@ func (module *setter) UpdateAnyUser(ctx context.Context, orgID valuer.UUID, user
 	return nil
 }
 
-func (module *setter) UpdateAnyUserDeprecated(ctx context.Context, orgID valuer.UUID, deprecateUser *types.DeprecatedUser) error {
-	user := types.NewUserFromDeprecatedUser(deprecateUser)
-	if err := module.store.UpdateUser(ctx, orgID, user); err != nil {
-		return err
-	}
-
-	traits := types.NewTraitsFromDeprecatedUser(deprecateUser)
-	module.analytics.IdentifyUser(ctx, user.OrgID.String(), user.ID.String(), traits)
-	module.analytics.TrackUser(ctx, user.OrgID.String(), user.ID.String(), "User Updated", traits)
-
-	if err := module.tokenizer.DeleteIdentity(ctx, user.ID); err != nil {
-		return err
-	}
-
-	return nil
-}
-
 func (module *setter) DeleteUser(ctx context.Context, orgID valuer.UUID, id string, deletedBy string) error {
 	user, err := module.store.GetUser(ctx, valuer.MustNewUUID(id))
 	if err != nil {

pkg/modules/user/user.go

@@ -34,11 +34,9 @@ type Setter interface {
 	// Initiate forgot password flow for a user
 	ForgotPassword(ctx context.Context, orgID valuer.UUID, email valuer.Email, frontendBaseURL string) error
 
-	UpdateUserDeprecated(ctx context.Context, orgID valuer.UUID, id string, user *types.DeprecatedUser) (*types.DeprecatedUser, error)
 	UpdateUser(ctx context.Context, orgID valuer.UUID, userID valuer.UUID, updatable *types.UpdatableUser) (*types.User, error)
 
 	// UpdateAnyUser updates a user and persists the changes to the database along with the analytics and identity deletion.
-	UpdateAnyUserDeprecated(ctx context.Context, orgID valuer.UUID, deprecateUser *types.DeprecatedUser) error
 	UpdateAnyUser(ctx context.Context, orgID valuer.UUID, user *types.User) error
 	DeleteUser(ctx context.Context, orgID valuer.UUID, id string, deletedBy string) error
 
@@ -109,16 +107,13 @@ type Getter interface {
 type Handler interface {
 	// invite
 	CreateInvite(http.ResponseWriter, *http.Request)
-	CreateBulkInvite(http.ResponseWriter, *http.Request)
 
 	// users
 	ListUsersDeprecated(http.ResponseWriter, *http.Request)
 	ListUsers(http.ResponseWriter, *http.Request)
 	CreateUser(http.ResponseWriter, *http.Request)
-	UpdateUserDeprecated(http.ResponseWriter, *http.Request)
 	UpdateUser(http.ResponseWriter, *http.Request)
 	DeleteUser(http.ResponseWriter, *http.Request)
-	GetUserDeprecated(http.ResponseWriter, *http.Request)
 	GetUser(http.ResponseWriter, *http.Request)
 	GetMyUserDeprecated(http.ResponseWriter, *http.Request)
 	GetMyUser(http.ResponseWriter, *http.Request)

pkg/prometheus/handler.go

@@ -1,9 +0,0 @@
-package prometheus
-
-import "net/http"
-
-type Handler interface {
-	Query(http.ResponseWriter, *http.Request)
-
-	QueryRange(http.ResponseWriter, *http.Request)
-}

pkg/prometheus/promapi/handler.go

@@ -1,259 +0,0 @@
-// Package promapi serves the Prometheus HTTP query API over a
-// prometheus.Prometheus provider: /query and /query_range in the shape of
-// Prometheus' /api/v1 endpoints (https://prometheus.io/docs/prometheus/latest/querying/api/),
-// intended to be mounted under a distinguishing prefix (/prometheus/api/v1)
-// so PromQL-only endpoints are separate from the SigNoz query APIs. The
-// request and response contracts follow Prometheus: form-encoded GET/POST
-// params, {"status":"success","data":{resultType,result}} on success and
-// {"status":"error","errorType","error"} with Prometheus' status codes on
-// failure — so Prometheus-compatible clients can point at the prefix.
-package promapi
-
-import (
-	"context"
-	"encoding/json"
-	"log/slog"
-	"math"
-	"net/http"
-	"strconv"
-	"time"
-
-	promModel "github.com/prometheus/common/model"
-	"github.com/prometheus/prometheus/promql"
-	"github.com/prometheus/prometheus/promql/parser"
-	"github.com/prometheus/prometheus/util/stats"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/prometheus"
-)
-
-type handler struct {
-	logger *slog.Logger
-	prom   prometheus.Prometheus
-}
-
-func NewHandler(logger *slog.Logger, prom prometheus.Prometheus) prometheus.Handler {
-	return &handler{logger: logger, prom: prom}
-}
-
-type errorType string
-
-const (
-	errBadData  errorType = "bad_data"
-	errExec     errorType = "execution"
-	errCanceled errorType = "canceled"
-	errTimeout  errorType = "timeout"
-	errInternal errorType = "internal"
-)
-
-type queryData struct {
-	ResultType parser.ValueType `json:"resultType"`
-	Result     parser.Value     `json:"result"`
-	Stats      stats.QueryStats `json:"stats,omitempty"`
-}
-
-type response struct {
-	Status    string     `json:"status"`
-	Data      *queryData `json:"data,omitempty"`
-	ErrorType errorType  `json:"errorType,omitempty"`
-	Error     string     `json:"error,omitempty"`
-	Warnings  []string   `json:"warnings,omitempty"`
-	Infos     []string   `json:"infos,omitempty"`
-}
-
-// QueryRange evaluates an expression over a grid: query, start, end, step,
-// and optional timeout/stats params, all in Prometheus' formats.
-func (h *handler) QueryRange(w http.ResponseWriter, r *http.Request) {
-	start, err := parseTime(r.FormValue("start"))
-	if err != nil {
-		h.respondError(r.Context(), w, errBadData, err)
-		return
-	}
-	end, err := parseTime(r.FormValue("end"))
-	if err != nil {
-		h.respondError(r.Context(), w, errBadData, err)
-		return
-	}
-	if end.Before(start) {
-		h.respondError(r.Context(), w, errBadData, errors.NewInvalidInputf(errors.CodeInvalidInput, "end timestamp must not be before start time"))
-		return
-	}
-	step, err := parseDuration(r.FormValue("step"))
-	if err != nil {
-		h.respondError(r.Context(), w, errBadData, err)
-		return
-	}
-	if step <= 0 {
-		h.respondError(r.Context(), w, errBadData, errors.NewInvalidInputf(errors.CodeInvalidInput, "zero or negative query resolution step widths are not accepted. Try a positive integer"))
-		return
-	}
-	// The engine materializes every point of every series; an unbounded
-	// grid is an unbounded allocation. 11,000 points covers 60s resolution
-	// for a week or 1h resolution for a year.
-	if end.Sub(start)/step > 11000 {
-		h.respondError(r.Context(), w, errBadData, errors.NewInvalidInputf(errors.CodeInvalidInput, "exceeded maximum resolution of 11,000 points per timeseries. Try decreasing the query resolution (?step=XX)"))
-		return
-	}
-
-	ctx, cancel, err := h.contextWithTimeout(r)
-	if err != nil {
-		h.respondError(r.Context(), w, errBadData, err)
-		return
-	}
-	defer cancel()
-
-	if h.tryRangeExecutor(ctx, w, r, start, end, step) {
-		return
-	}
-
-	qry, err := h.prom.Engine().NewRangeQuery(ctx, h.prom.Storage(), nil, r.FormValue("query"), start, end, step)
-	if err != nil {
-		h.respondError(r.Context(), w, errBadData, err)
-		return
-	}
-	h.exec(ctx, w, r, qry)
-}
-
-// tryRangeExecutor serves the query the way a RangeExecutor provider is
-// designed to serve: evaluated inside the datastore when the shape allows.
-// It reports whether the response was written.
-func (h *handler) tryRangeExecutor(ctx context.Context, w http.ResponseWriter, r *http.Request, start, end time.Time, step time.Duration) bool {
-	re, ok := h.prom.(prometheus.RangeExecutor)
-	if !ok {
-		return false
-	}
-	matrix, served, err := re.TryExecuteRange(ctx, r.FormValue("query"), start, end, step)
-	if err != nil {
-		h.respondError(ctx, w, errExec, err)
-		return true
-	}
-	if !served {
-		return false
-	}
-	h.respond(ctx, w, &queryData{ResultType: matrix.Type(), Result: matrix}, nil, nil)
-	return true
-}
-
-// Query evaluates an expression at a single instant: query and optional
-// time/timeout/stats params. A missing time evaluates at the server's now,
-// as in Prometheus.
-func (h *handler) Query(w http.ResponseWriter, r *http.Request) {
-	ts := time.Now()
-	if t := r.FormValue("time"); t != "" {
-		var err error
-		ts, err = parseTime(t)
-		if err != nil {
-			h.respondError(r.Context(), w, errBadData, err)
-			return
-		}
-	}
-
-	ctx, cancel, err := h.contextWithTimeout(r)
-	if err != nil {
-		h.respondError(r.Context(), w, errBadData, err)
-		return
-	}
-	defer cancel()
-
-	qry, err := h.prom.Engine().NewInstantQuery(ctx, h.prom.Storage(), nil, r.FormValue("query"), ts)
-	if err != nil {
-		h.respondError(r.Context(), w, errBadData, err)
-		return
-	}
-	h.exec(ctx, w, r, qry)
-}
-
-func (h *handler) exec(ctx context.Context, w http.ResponseWriter, r *http.Request, qry promql.Query) {
-	defer qry.Close()
-	res := qry.Exec(ctx)
-	if res.Err != nil {
-		h.logger.ErrorContext(ctx, "error evaluating promql query", errors.Attr(res.Err))
-		switch res.Err.(type) {
-		case promql.ErrQueryCanceled:
-			h.respondError(ctx, w, errCanceled, res.Err)
-		case promql.ErrQueryTimeout:
-			h.respondError(ctx, w, errTimeout, res.Err)
-		case promql.ErrStorage:
-			h.respondError(ctx, w, errInternal, res.Err)
-		default:
-			h.respondError(ctx, w, errExec, res.Err)
-		}
-		return
-	}
-
-	data := &queryData{ResultType: res.Value.Type(), Result: res.Value}
-	if r.FormValue("stats") != "" {
-		data.Stats = stats.NewQueryStats(qry.Stats())
-	}
-	warnings, infos := res.Warnings.AsStrings(r.FormValue("query"), 10, 10)
-	h.respond(ctx, w, data, warnings, infos)
-}
-
-func (h *handler) contextWithTimeout(r *http.Request) (context.Context, context.CancelFunc, error) {
-	ctx := r.Context()
-	if to := r.FormValue("timeout"); to != "" {
-		timeout, err := parseDuration(to)
-		if err != nil {
-			return nil, nil, err
-		}
-		ctx, cancel := context.WithTimeout(ctx, timeout)
-		return ctx, cancel, nil
-	}
-	ctx, cancel := context.WithCancel(ctx)
-	return ctx, cancel, nil
-}
-
-func (h *handler) respond(ctx context.Context, w http.ResponseWriter, data *queryData, warnings, infos []string) {
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(http.StatusOK)
-	if err := json.NewEncoder(w).Encode(&response{Status: "success", Data: data, Warnings: warnings, Infos: infos}); err != nil {
-		h.logger.ErrorContext(ctx, "error writing prometheus api response", errors.Attr(err))
-	}
-}
-
-// respondError follows Prometheus' status-code mapping: bad_data 400,
-// execution 422, canceled/timeout 503, internal 500.
-func (h *handler) respondError(ctx context.Context, w http.ResponseWriter, typ errorType, err error) {
-	code := http.StatusInternalServerError
-	switch typ {
-	case errBadData:
-		code = http.StatusBadRequest
-	case errExec:
-		code = http.StatusUnprocessableEntity
-	case errCanceled, errTimeout:
-		code = http.StatusServiceUnavailable
-	}
-	w.Header().Set("Content-Type", "application/json")
-	w.WriteHeader(code)
-	if encErr := json.NewEncoder(w).Encode(&response{Status: "error", ErrorType: typ, Error: err.Error()}); encErr != nil {
-		h.logger.ErrorContext(ctx, "error writing prometheus api error response", errors.Attr(encErr))
-	}
-}
-
-// parseTime accepts Prometheus' time formats: float unix seconds or RFC3339.
-func parseTime(s string) (time.Time, error) {
-	if t, err := strconv.ParseFloat(s, 64); err == nil {
-		sec, ns := math.Modf(t)
-		return time.Unix(int64(sec), int64(ns*float64(time.Second))), nil
-	}
-	if t, err := time.Parse(time.RFC3339Nano, s); err == nil {
-		return t, nil
-	}
-	return time.Time{}, errors.NewInvalidInputf(errors.CodeInvalidInput, "cannot parse %q to a valid timestamp", s)
-}
-
-// parseDuration accepts Prometheus' duration formats: float seconds or a
-// duration string like 5m.
-func parseDuration(s string) (time.Duration, error) {
-	if d, err := strconv.ParseFloat(s, 64); err == nil {
-		ts := d * float64(time.Second)
-		if ts > float64(math.MaxInt64) || ts < float64(math.MinInt64) {
-			return 0, errors.NewInvalidInputf(errors.CodeInvalidInput, "cannot parse %q to a valid duration. It overflows int64", s)
-		}
-		return time.Duration(ts), nil
-	}
-	if d, err := promModel.ParseDuration(s); err == nil {
-		return time.Duration(d), nil
-	}
-	return 0, errors.NewInvalidInputf(errors.CodeInvalidInput, "cannot parse %q to a valid duration", s)
-}

pkg/querier/collect.go

@@ -23,7 +23,11 @@ func (q *querier) Collect(ctx context.Context, _ valuer.UUID) (map[string]any, e
 		traces           uint64
 		tracesLastSeenAt time.Time
 	)
-	if err := q.telemetryStore.ClickhouseDB().QueryRow(ctx, fmt.Sprintf("SELECT COUNT(*), max(timestamp) FROM %s", tracesTable)).Scan(&traces, &tracesLastSeenAt); err == nil {
+	tracesLastSeenExpr := "max(timestamp)"
+	if q.hasColumn(ctx, tracestelemetryschema.DBName, tracestelemetryschema.SpanIndexV3TableName, "inserted_at") {
+		tracesLastSeenExpr = "max(inserted_at)"
+	}
+	if err := q.telemetryStore.ClickhouseDB().QueryRow(ctx, fmt.Sprintf("SELECT COUNT(*), %s FROM %s", tracesLastSeenExpr, tracesTable)).Scan(&traces, &tracesLastSeenAt); err == nil {
 		stats["telemetry.traces.count"] = traces
 		if tracesLastSeenAt.Unix() != 0 {
 			stats["telemetry.traces.last_observed.time"] = tracesLastSeenAt.UTC()
@@ -37,7 +41,11 @@ func (q *querier) Collect(ctx context.Context, _ valuer.UUID) (map[string]any, e
 		logs           uint64
 		logsLastSeenAt time.Time
 	)
-	if err := q.telemetryStore.ClickhouseDB().QueryRow(ctx, fmt.Sprintf("SELECT COUNT(*), fromUnixTimestamp64Nano(max(timestamp)) FROM %s", logsTable)).Scan(&logs, &logsLastSeenAt); err == nil {
+	logsLastSeenExpr := "fromUnixTimestamp64Nano(max(timestamp))"
+	if q.hasColumn(ctx, logstelemetryschema.DBName, logstelemetryschema.LogsV2TableName, "inserted_at") {
+		logsLastSeenExpr = "max(inserted_at)"
+	}
+	if err := q.telemetryStore.ClickhouseDB().QueryRow(ctx, fmt.Sprintf("SELECT COUNT(*), %s FROM %s", logsLastSeenExpr, logsTable)).Scan(&logs, &logsLastSeenAt); err == nil {
 		stats["telemetry.logs.count"] = logs
 		if logsLastSeenAt.Unix() != 0 {
 			stats["telemetry.logs.last_observed.time"] = logsLastSeenAt.UTC()
@@ -51,7 +59,11 @@ func (q *querier) Collect(ctx context.Context, _ valuer.UUID) (map[string]any, e
 		metrics           uint64
 		metricsLastSeenAt time.Time
 	)
-	if err := q.telemetryStore.ClickhouseDB().QueryRow(ctx, fmt.Sprintf("SELECT COUNT(*), toDateTime(max(unix_milli) / 1000) FROM %s", metricsTable)).Scan(&metrics, &metricsLastSeenAt); err == nil {
+	metricsLastSeenExpr := "toDateTime(max(unix_milli) / 1000)"
+	if q.hasColumn(ctx, metricstelemetryschema.DBName, metricstelemetryschema.SamplesV4TableName, "inserted_at_unix_milli") {
+		metricsLastSeenExpr = "fromUnixTimestamp64Milli(max(inserted_at_unix_milli))"
+	}
+	if err := q.telemetryStore.ClickhouseDB().QueryRow(ctx, fmt.Sprintf("SELECT COUNT(*), %s FROM %s", metricsLastSeenExpr, metricsTable)).Scan(&metrics, &metricsLastSeenAt); err == nil {
 		stats["telemetry.metrics.count"] = metrics
 		if metricsLastSeenAt.Unix() != 0 {
 			stats["telemetry.metrics.last_observed.time"] = metricsLastSeenAt.UTC()
@@ -63,3 +75,12 @@ func (q *querier) Collect(ctx context.Context, _ valuer.UUID) (map[string]any, e
 
 	return stats, nil
 }
+
+func (q *querier) hasColumn(ctx context.Context, database, table, column string) bool {
+	var exists bool
+	if err := q.telemetryStore.ClickhouseDB().QueryRow(ctx, "SELECT hasColumnInTable(?, ?, ?)", database, table, column).Scan(&exists); err != nil {
+		q.logger.DebugContext(ctx, "failed to check column existence", errors.Attr(err))
+		return false
+	}
+	return exists
+}

pkg/query-service/app/http_handler.go

@@ -485,9 +485,6 @@ func (aH *APIHandler) Respond(w http.ResponseWriter, data interface{}) {
 func (aH *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 	router.HandleFunc("/api/v1/query_range", am.ViewAccess(aH.queryRangeMetrics)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/query", am.ViewAccess(aH.queryMetrics)).Methods(http.MethodGet)
-
-	router.HandleFunc("/prometheus/api/v1/query_range", am.ViewAccess(aH.Signoz.Handlers.PrometheusHandler.QueryRange)).Methods(http.MethodGet, http.MethodPost)
-	router.HandleFunc("/prometheus/api/v1/query", am.ViewAccess(aH.Signoz.Handlers.PrometheusHandler.Query)).Methods(http.MethodGet, http.MethodPost)
 	router.HandleFunc("/api/v1/rules", am.ViewAccess(aH.listRules)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/rules/{id}", am.ViewAccess(aH.getRule)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/rules", am.EditAccess(aH.createRule)).Methods(http.MethodPost)

pkg/query-service/constants/constants.go

@@ -11,10 +11,10 @@ import (
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
-const (
-	HTTPHostPort    = "0.0.0.0:8080" // Address to serve http (query service)
-	PrivateHostPort = "0.0.0.0:8085" // Address to server internal services like alert manager
-	OpAmpWsEndpoint = "0.0.0.0:4320" // address for opamp websocket
+var (
+	HTTPHostPort    = GetOrDefaultEnv("SIGNOZ_HTTP_HOST_PORT", "0.0.0.0:8080")    // Address to serve http (query service)
+	PrivateHostPort = GetOrDefaultEnv("SIGNOZ_PRIVATE_HOST_PORT", "0.0.0.0:8085") // Address to server internal services like alert manager
+	OpAmpWsEndpoint = GetOrDefaultEnv("SIGNOZ_OPAMP_WS_ENDPOINT", "0.0.0.0:4320") // address for opamp websocket
 )
 
 const MaxAllowedPointsInTimeSeries = 300

pkg/semconv/families_gen.go

@@ -0,0 +1,22 @@
+// Code generated by scripts/semconv. DO NOT EDIT.
+
+package semconv
+
+var families = []Family{
+	{
+		Current:        "db.system.name",
+		Old:            []string{"db.system"},
+		Kind:           KindAttribute,
+		Contexts:       nil,
+		Signals:        nil,
+		ApplyToMetrics: nil,
+	},
+	{
+		Current:        "deployment.environment.name",
+		Old:            []string{"deployment.environment"},
+		Kind:           KindAttribute,
+		Contexts:       nil,
+		Signals:        nil,
+		ApplyToMetrics: nil,
+	},
+}

pkg/semconv/semconv.go

@@ -0,0 +1,127 @@
+package semconv
+
+import (
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+//go:generate go run ../../scripts/semconv
+
+// Kind identifies whether a family describes an attribute or a metric name.
+type Kind struct {
+	valuer.String
+}
+
+// Family is one logical telemetry field. Old is ordered from the most recent
+// predecessor to the oldest one and therefore also defines fallback order.
+type Family struct {
+	Current        string
+	Old            []string
+	Kind           Kind
+	Contexts       []telemetrytypes.FieldContext
+	Signals        []telemetrytypes.Signal
+	ApplyToMetrics []string
+	ValueMap       map[string]string
+}
+
+var (
+	KindAttribute = Kind{String: valuer.NewString("attribute")}
+	KindMetric    = Kind{String: valuer.NewString("metric")}
+)
+
+var memberToFamilies, familyMembers = buildIndexes()
+
+// Enum returns the acceptable values for Kind.
+func (Kind) Enum() []any {
+	return []any{KindAttribute, KindMetric}
+}
+
+// Lookup returns the enabled family containing selector.Name for kind. The
+// returned family must not be modified.
+func Lookup(kind Kind, selector telemetrytypes.FieldKeySelector) (Family, bool) {
+	idx, ok := lookupIndex(kind, selector)
+	if !ok {
+		return Family{}, false
+	}
+	return families[idx], true
+}
+
+// Members returns the current name first, followed by historical names in
+// fallback order. A name outside an enabled family is returned unchanged. The
+// returned slice must not be modified.
+func Members(kind Kind, selector telemetrytypes.FieldKeySelector) []string {
+	idx, ok := lookupIndex(kind, selector)
+	if !ok {
+		return []string{selector.Name}
+	}
+	return familyMembers[idx]
+}
+
+// Current returns the current name for selector.Name, or the input name when
+// it does not belong to an enabled family.
+func Current(kind Kind, selector telemetrytypes.FieldKeySelector) string {
+	idx, ok := lookupIndex(kind, selector)
+	if !ok {
+		return selector.Name
+	}
+	return families[idx].Current
+}
+
+// All returns every enabled family. The returned slice and families must not be
+// modified.
+func All() []Family {
+	return families
+}
+
+func buildIndexes() (map[string][]int, [][]string) {
+	index := make(map[string][]int)
+	members := make([][]string, len(families))
+	for i, family := range families {
+		members[i] = make([]string, 0, len(family.Old)+1)
+		members[i] = append(members[i], family.Current)
+		members[i] = append(members[i], family.Old...)
+		index[family.Current] = append(index[family.Current], i)
+		for _, old := range family.Old {
+			index[old] = append(index[old], i)
+		}
+	}
+	return index, members
+}
+
+func lookupIndex(kind Kind, selector telemetrytypes.FieldKeySelector) (int, bool) {
+	for _, idx := range memberToFamilies[selector.Name] {
+		if matchesSelector(families[idx], kind, selector) {
+			return idx, true
+		}
+	}
+	return 0, false
+}
+
+func matchesSelector(family Family, kind Kind, selector telemetrytypes.FieldKeySelector) bool {
+	if family.Kind != kind {
+		return false
+	}
+
+	if selector.Signal != telemetrytypes.SignalUnspecified && len(family.Signals) > 0 {
+		if !slices.Contains(family.Signals, selector.Signal) {
+			return false
+		}
+	}
+
+	if selector.FieldContext != telemetrytypes.FieldContextUnspecified && len(family.Contexts) > 0 {
+		if !slices.Contains(family.Contexts, selector.FieldContext) {
+			return false
+		}
+	}
+
+	if selector.Signal == telemetrytypes.SignalMetrics && len(family.ApplyToMetrics) > 0 {
+		if selector.MetricContext == nil {
+			return false
+		}
+		return slices.Contains(family.ApplyToMetrics, selector.MetricContext.MetricName)
+	}
+
+	return true
+}

pkg/semconv/semconv_test.go

@@ -0,0 +1,80 @@
+package semconv
+
+import (
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMembersReturnsCurrentBeforeHistoricalName(t *testing.T) {
+	selector := telemetrytypes.FieldKeySelector{
+		Name:         "deployment.environment",
+		Signal:       telemetrytypes.SignalTraces,
+		FieldContext: telemetrytypes.FieldContextResource,
+	}
+
+	assert.Equal(t,
+		[]string{"deployment.environment.name", "deployment.environment"},
+		Members(KindAttribute, selector),
+		"members should use current-first fallback order",
+	)
+}
+
+func TestCurrentReturnsCanonicalName(t *testing.T) {
+	selector := telemetrytypes.FieldKeySelector{
+		Name:         "deployment.environment",
+		Signal:       telemetrytypes.SignalTraces,
+		FieldContext: telemetrytypes.FieldContextResource,
+	}
+
+	assert.Equal(t,
+		"deployment.environment.name",
+		Current(KindAttribute, selector),
+		"historical name should resolve to the current family name",
+	)
+}
+
+func TestAllScopedFamilyMatchesSupportedScopes(t *testing.T) {
+	tests := []struct {
+		name         string
+		signal       telemetrytypes.Signal
+		fieldContext telemetrytypes.FieldContext
+	}{
+		{name: "trace resource", signal: telemetrytypes.SignalTraces, fieldContext: telemetrytypes.FieldContextResource},
+		{name: "trace attribute", signal: telemetrytypes.SignalTraces, fieldContext: telemetrytypes.FieldContextAttribute},
+		{name: "log resource", signal: telemetrytypes.SignalLogs, fieldContext: telemetrytypes.FieldContextResource},
+		{name: "log attribute", signal: telemetrytypes.SignalLogs, fieldContext: telemetrytypes.FieldContextAttribute},
+		{name: "metric resource", signal: telemetrytypes.SignalMetrics, fieldContext: telemetrytypes.FieldContextResource},
+		{name: "metric attribute", signal: telemetrytypes.SignalMetrics, fieldContext: telemetrytypes.FieldContextAttribute},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			selector := telemetrytypes.FieldKeySelector{
+				Name:         "deployment.environment",
+				Signal:       test.signal,
+				FieldContext: test.fieldContext,
+			}
+
+			assert.Equal(t,
+				"deployment.environment.name",
+				Current(KindAttribute, selector),
+				"an all-scoped family should match every supported signal and attribute context",
+			)
+		})
+	}
+}
+
+func TestMembersReturnsInputWhenKindDoesNotMatch(t *testing.T) {
+	selector := telemetrytypes.FieldKeySelector{
+		Name:   "deployment.environment",
+		Signal: telemetrytypes.SignalTraces,
+	}
+
+	assert.Equal(t,
+		[]string{"deployment.environment"},
+		Members(KindMetric, selector),
+		"an attribute family must not match a metric-name lookup",
+	)
+}

pkg/signoz/handler.go

@@ -48,8 +48,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail/impltracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/tracefunnel"
 	"github.com/SigNoz/signoz/pkg/modules/tracefunnel/impltracefunnel"
-	"github.com/SigNoz/signoz/pkg/prometheus"
-	"github.com/SigNoz/signoz/pkg/prometheus/promapi"
 	"github.com/SigNoz/signoz/pkg/querier"
 	"github.com/SigNoz/signoz/pkg/ruler"
 	"github.com/SigNoz/signoz/pkg/ruler/signozruler"
@@ -83,7 +81,6 @@ type Handlers struct {
 	RuleStateHistory        rulestatehistory.Handler
 	SpanMapperHandler       spanmapper.Handler
 	AlertmanagerHandler     alertmanager.Handler
-	PrometheusHandler       prometheus.Handler
 	TraceDetail             tracedetail.Handler
 	RulerHandler            ruler.Handler
 	LLMPricingRuleHandler   llmpricingrule.Handler
@@ -104,7 +101,6 @@ func NewHandlers(
 	zeusService zeus.Zeus,
 	registryHandler factory.Handler,
 	alertmanagerService alertmanager.Alertmanager,
-	prometheusService prometheus.Prometheus,
 	rulerService ruler.Ruler,
 	statsAggregator statsreporter.Aggregator,
 ) Handlers {
@@ -133,7 +129,6 @@ func NewHandlers(
 		CloudIntegrationHandler: implcloudintegration.NewHandler(modules.CloudIntegration),
 		SpanMapperHandler:       implspanmapper.NewHandler(modules.SpanMapper),
 		AlertmanagerHandler:     signozalertmanager.NewHandler(alertmanagerService),
-		PrometheusHandler:       promapi.NewHandler(providerSettings.Logger, prometheusService),
 		TraceDetail:             impltracedetail.NewHandler(modules.TraceDetail),
 		RulerHandler:            signozruler.NewHandler(rulerService),
 		LLMPricingRuleHandler:   impllmpricingrule.NewHandler(modules.LLMPricingRule),

pkg/signoz/handler_test.go

@@ -63,7 +63,7 @@ func TestNewHandlers(t *testing.T) {
 
 	querierHandler := querier.NewHandler(providerSettings, nil, nil)
 	registryHandler := factory.NewHandler(nil)
-	handlers := NewHandlers(modules, providerSettings, nil, querierHandler, nil, nil, nil, nil, nil, nil, nil, registryHandler, alertmanager, nil, nil, nil)
+	handlers := NewHandlers(modules, providerSettings, nil, querierHandler, nil, nil, nil, nil, nil, nil, nil, registryHandler, alertmanager, nil, nil)
 	reflectVal := reflect.ValueOf(handlers)
 	for i := 0; i < reflectVal.NumField(); i++ {
 		f := reflectVal.Field(i)

pkg/signoz/signoz.go

@@ -617,7 +617,7 @@ func New(
 
 	// Initialize all handlers for the modules
 	registryHandler := factory.NewHandler(registry)
-	handlers := NewHandlers(modules, providerSettings, analytics, querierHandler, licensing, global, flagger, gateway, telemetryMetadataStore, authz, zeus, registryHandler, alertmanager, prometheus, rulerInstance, statsAggregator)
+	handlers := NewHandlers(modules, providerSettings, analytics, querierHandler, licensing, global, flagger, gateway, telemetryMetadataStore, authz, zeus, registryHandler, alertmanager, rulerInstance, statsAggregator)
 
 	// Initialize the API server (after registry so it can access service health)
 	apiserverInstance, err := factory.NewProviderFromNamedMap(

pkg/sqlmigration/109_restructure_saved_view_spec.go

@@ -15,6 +15,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/sqlschema"
 	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types"
 )
 
 type restructureSavedViewSpec struct {
@@ -164,6 +165,15 @@ func (migration *restructureSavedViewSpec) Up(ctx context.Context, db *bun.DB) e
 		return err
 	}
 
+	var orgIDs []string
+	if err := tx.NewSelect().Model((*types.Organization)(nil)).Column("id").Scan(ctx, &orgIDs); err != nil {
+		return err
+	}
+	validOrgIDs := make(map[string]struct{}, len(orgIDs))
+	for _, id := range orgIDs {
+		validOrgIDs[id] = struct{}{}
+	}
+
 	// drop table `saved_views`
 	for _, sql := range migration.sqlschema.Operator().DropTable(savedViewsTable) {
 		if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
@@ -210,6 +220,13 @@ func (migration *restructureSavedViewSpec) Up(ctx context.Context, db *bun.DB) e
 			continue // orphaned row from a pre-existing org_id backfill gap; nothing sane to attach it to
 		}
 
+		// to avoid foreign key constraint issues
+		if _, ok := validOrgIDs[old.OrgID]; !ok {
+			skipped++
+			migration.settings.Logger.WarnContext(ctx, "saved view references an org that no longer exists, skipping", slog.String("org_id", old.OrgID), slog.String("saved_view_id", old.ID))
+			continue
+		}
+
 		var compositeQuery legacySavedViewCompositeQuery
 		if err := json.Unmarshal([]byte(old.Data), &compositeQuery); err != nil {
 			failed++

pkg/types/authtypes/claims.go

@@ -72,14 +72,6 @@ func (c *Claims) LogValue() slog.Value {
 	)
 }
 
-func (c *Claims) IsSelfAccess(id string) error {
-	if c.UserID == id {
-		return nil
-	}
-
-	return errors.NewForbiddenf(errors.CodeForbidden, "only the user/admin can access their own resource")
-}
-
 func (c *Claims) IdentityID() string {
 	if c.Principal == PrincipalUser {
 		return c.UserID

pkg/types/inframonitoringtypes/clusters.go

@@ -42,13 +42,22 @@ type ClusterRecord struct {
 type PostableClusters struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *ClusterFilter       `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
+// ClusterFilter is the attribute filter plus optional secondary filters on the
+// derived pod display status(es) (see PodStatus; matches any listed, OR) and node
+// readiness (see NodeCondition; matches any listed, OR). Empty FilterByPodStatus / FilterByNodeReadiness = off.
+type ClusterFilter struct {
+	qbtypes.Filter        `json:",inline"`
+	FilterByPodStatus     []PodStatus     `json:"filterByPodStatus"`
+	FilterByNodeReadiness []NodeCondition `json:"filterByNodeReadiness"`
+}
+
 // Validate ensures PostableClusters contains acceptable values.
 func (req *PostableClusters) Validate() error {
 	if req == nil {
@@ -88,6 +97,19 @@ func (req *PostableClusters) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+		for _, c := range req.Filter.FilterByNodeReadiness {
+			if !c.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by node readiness: %s", c)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(ClustersValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/containers.go

@@ -75,13 +75,21 @@ type ContainerRecord struct {
 type PostableContainers struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *ContainerFilter     `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
+// ContainerFilter is the attribute filter plus an optional secondary filter on
+// the derived container display status(es) (see ContainerStatus; matches any
+// listed, OR). Empty FilterByContainerStatus = off.
+type ContainerFilter struct {
+	qbtypes.Filter          `json:",inline"`
+	FilterByContainerStatus []ContainerStatus `json:"filterByContainerStatus"`
+}
+
 // Validate ensures PostableContainers contains acceptable values.
 func (req *PostableContainers) Validate() error {
 	if req == nil {
@@ -121,6 +129,14 @@ func (req *PostableContainers) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
+	if req.Filter != nil {
+		for _, c := range req.Filter.FilterByContainerStatus {
+			if !c.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by container status: %s", c)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(ContainersValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/containers_constants.go

@@ -1,6 +1,10 @@
 package inframonitoringtypes
 
-import "github.com/SigNoz/signoz/pkg/valuer"
+import (
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
 
 // ContainerStatus is the kubectl-style display status of a container, derived
 // from k8s.container.status.state (base) + k8s.container.status.reason (overlay).
@@ -31,6 +35,12 @@ var (
 	ContainerStatusNoData = ContainerStatus{valuer.NewString("no_data")}
 )
 
+// IsFilterable reports whether c is a concrete, user-filterable
+// container status: any Enum() member except the no_data sentinel.
+func (c ContainerStatus) IsFilterable() bool {
+	return c != ContainerStatusNoData && slices.Contains((ContainerStatus{}).Enum(), any(c))
+}
+
 func (ContainerStatus) Enum() []any {
 	return []any{
 		ContainerStatusRunning,

pkg/types/inframonitoringtypes/daemonsets.go

@@ -36,13 +36,20 @@ type DaemonSetRecord struct {
 type PostableDaemonSets struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *DaemonSetFilter     `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
+// DaemonSetFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type DaemonSetFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableDaemonSets contains acceptable values.
 func (req *PostableDaemonSets) Validate() error {
 	if req == nil {
@@ -82,6 +89,14 @@ func (req *PostableDaemonSets) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(DaemonSetsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/deployments.go

@@ -34,13 +34,20 @@ type DeploymentRecord struct {
 type PostableDeployments struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *DeploymentFilter    `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
+// DeploymentFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type DeploymentFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableDeployments contains acceptable values.
 func (req *PostableDeployments) Validate() error {
 	if req == nil {
@@ -80,6 +87,14 @@ func (req *PostableDeployments) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(DeploymentsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/jobs.go

@@ -36,13 +36,20 @@ type JobRecord struct {
 type PostableJobs struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *JobFilter           `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
+// JobFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type JobFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableJobs contains acceptable values.
 func (req *PostableJobs) Validate() error {
 	if req == nil {
@@ -82,6 +89,14 @@ func (req *PostableJobs) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(JobsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/namespaces.go

@@ -34,13 +34,20 @@ type NamespaceRecord struct {
 type PostableNamespaces struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *NamespaceFilter     `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
+// NamespaceFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type NamespaceFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableNamespaces contains acceptable values.
 func (req *PostableNamespaces) Validate() error {
 	if req == nil {
@@ -80,6 +87,14 @@ func (req *PostableNamespaces) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(NamespacesValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/nodes.go

@@ -39,13 +39,22 @@ type NodeRecord struct {
 type PostableNodes struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *NodeFilter          `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
+// NodeFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus; matches any listed, OR) and node
+// readiness (see NodeCondition; matches any listed, OR). Empty FilterByPodStatus / FilterByNodeReadiness = off.
+type NodeFilter struct {
+	qbtypes.Filter        `json:",inline"`
+	FilterByPodStatus     []PodStatus     `json:"filterByPodStatus"`
+	FilterByNodeReadiness []NodeCondition `json:"filterByNodeReadiness"`
+}
+
 // Validate ensures PostableNodes contains acceptable values.
 func (req *PostableNodes) Validate() error {
 	if req == nil {
@@ -85,6 +94,19 @@ func (req *PostableNodes) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+		for _, c := range req.Filter.FilterByNodeReadiness {
+			if !c.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by node readiness: %s", c)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(NodesValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/nodes_constants.go

@@ -1,6 +1,10 @@
 package inframonitoringtypes
 
-import "github.com/SigNoz/signoz/pkg/valuer"
+import (
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
 
 type NodeCondition struct {
 	valuer.String
@@ -20,6 +24,12 @@ func (NodeCondition) Enum() []any {
 	}
 }
 
+// IsFilterable reports whether c is a concrete, user-filterable
+// node readiness: any Enum() member except the no_data sentinel.
+func (c NodeCondition) IsFilterable() bool {
+	return c != NodeConditionNoData && slices.Contains((NodeCondition{}).Enum(), any(c))
+}
+
 // Numeric values emitted by the k8s.node.condition_ready metric
 // (source: OTel kubeletstats receiver).
 const (

pkg/types/inframonitoringtypes/pods.go

@@ -63,13 +63,20 @@ type PodRecord struct {
 type PostablePods struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *PodFilter           `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
+// PodFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type PodFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostablePods contains acceptable values.
 func (req *PostablePods) Validate() error {
 	if req == nil {
@@ -109,6 +116,14 @@ func (req *PostablePods) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(PodsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/inframonitoringtypes/pods_constants.go

@@ -1,6 +1,10 @@
 package inframonitoringtypes
 
-import "github.com/SigNoz/signoz/pkg/valuer"
+import (
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
 
 // PodStatus is the kubectl-style pod display status, derived from
 // k8s.pod.phase + k8s.pod.status_reason + k8s.container.status.reason
@@ -66,6 +70,12 @@ func (PodStatus) Enum() []any {
 	}
 }
 
+// IsFilterable reports whether s is a concrete, user-filterable pod
+// status: any Enum() member except the no_data sentinel.
+func (s PodStatus) IsFilterable() bool {
+	return s != PodStatusNoData && slices.Contains((PodStatus{}).Enum(), any(s))
+}
+
 const PodNameAttrKey = "k8s.pod.name"
 
 const (

pkg/types/inframonitoringtypes/statefulsets.go

@@ -34,13 +34,20 @@ type StatefulSetRecord struct {
 type PostableStatefulSets struct {
 	Start   int64                `json:"start" required:"true"`
 	End     int64                `json:"end" required:"true"`
-	Filter  *qbtypes.Filter      `json:"filter"`
+	Filter  *StatefulSetFilter   `json:"filter"`
 	GroupBy []qbtypes.GroupByKey `json:"groupBy"`
 	OrderBy *qbtypes.OrderBy     `json:"orderBy"`
 	Offset  int                  `json:"offset"`
 	Limit   int                  `json:"limit" required:"true"`
 }
 
+// StatefulSetFilter is the attribute filter plus an optional secondary filter on the
+// derived pod display status(es) (see PodStatus); matches any listed (OR). Empty = off.
+type StatefulSetFilter struct {
+	qbtypes.Filter    `json:",inline"`
+	FilterByPodStatus []PodStatus `json:"filterByPodStatus"`
+}
+
 // Validate ensures PostableStatefulSets contains acceptable values.
 func (req *PostableStatefulSets) Validate() error {
 	if req == nil {
@@ -80,6 +87,14 @@ func (req *PostableStatefulSets) Validate() error {
 		return errors.NewInvalidInputf(errors.CodeInvalidInput, "offset cannot be negative")
 	}
 
+	if req.Filter != nil {
+		for _, s := range req.Filter.FilterByPodStatus {
+			if !s.IsFilterable() {
+				return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid filter by pod status: %s", s)
+			}
+		}
+	}
+
 	if req.OrderBy != nil {
 		if !slices.Contains(StatefulSetsValidOrderByKeys, req.OrderBy.Key.Name) {
 			return errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid order by key: %s", req.OrderBy.Key.Name)

pkg/types/user.go

@@ -128,18 +128,6 @@ func NewDeprecatedUserFromUserAndRole(user *User, role Role) *DeprecatedUser {
 	}
 }
 
-func NewUserFromDeprecatedUser(deprecatedUser *DeprecatedUser) *User {
-	return &User{
-		Identifiable:  deprecatedUser.Identifiable,
-		DisplayName:   deprecatedUser.DisplayName,
-		Email:         deprecatedUser.Email,
-		OrgID:         deprecatedUser.OrgID,
-		IsRoot:        deprecatedUser.IsRoot,
-		Status:        deprecatedUser.Status,
-		TimeAuditable: deprecatedUser.TimeAuditable,
-	}
-}
-
 // Update applies mutable fields from the input to the user. Immutable fields
 // (email, is_root, org_id, id) are preserved. Only non-zero input fields are applied.
 func (u *User) Update(displayName string) {
@@ -149,16 +137,6 @@ func (u *User) Update(displayName string) {
 	u.UpdatedAt = time.Now()
 }
 
-func (u *DeprecatedUser) Update(displayName string, role Role) {
-	if displayName != "" {
-		u.DisplayName = displayName
-	}
-	if role != "" {
-		u.Role = role
-	}
-	u.UpdatedAt = time.Now()
-}
-
 func (u *User) UpdateStatus(status valuer.String) error {
 	// no updates allowed if user is in delete state
 	if err := u.ErrIfDeleted(); err != nil {
@@ -234,17 +212,6 @@ func NewTraitsFromUser(user *User) map[string]any {
 	}
 }
 
-func NewTraitsFromDeprecatedUser(user *DeprecatedUser) map[string]any {
-	return map[string]any{
-		"name":         user.DisplayName,
-		"role":         user.Role,
-		"email":        user.Email.String(),
-		"display_name": user.DisplayName,
-		"status":       user.Status,
-		"created_at":   user.CreatedAt,
-	}
-}
-
 func (request *PostableRegisterOrgAndAdmin) UnmarshalJSON(data []byte) error {
 	type Alias PostableRegisterOrgAndAdmin
 

scripts/semconv/generate.go

@@ -0,0 +1,721 @@
+package main
+
+import (
+	"bytes"
+	"errors"
+	"flag"
+	"fmt"
+	"go/format"
+	"os"
+	"path/filepath"
+	"sort"
+	"strconv"
+	"strings"
+
+	"gopkg.in/yaml.v3"
+)
+
+const (
+	kindAttribute = "attribute"
+	kindMetric    = "metric"
+)
+
+type stringListFlag []string
+
+func (f *stringListFlag) String() string { return strings.Join(*f, ",") }
+func (f *stringListFlag) Set(value string) error {
+	*f = append(*f, value)
+	return nil
+}
+
+type schemaFile struct {
+	FileFormat string                   `yaml:"file_format"`
+	SchemaURL  string                   `yaml:"schema_url"`
+	Versions   map[string]schemaVersion `yaml:"versions"`
+}
+
+type schemaVersion struct {
+	All       changeSection `yaml:"all"`
+	Resources changeSection `yaml:"resources"`
+	Spans     changeSection `yaml:"spans"`
+	Logs      changeSection `yaml:"logs"`
+	Metrics   changeSection `yaml:"metrics"`
+}
+
+type changeSection struct {
+	Changes []schemaChange `yaml:"changes"`
+}
+
+type schemaChange struct {
+	RenameAttributes *attributeRename  `yaml:"rename_attributes"`
+	RenameMetrics    map[string]string `yaml:"rename_metrics"`
+}
+
+type attributeRename struct {
+	AttributeMap   map[string]string `yaml:"attribute_map"`
+	ApplyToMetrics []string          `yaml:"apply_to_metrics"`
+}
+
+type overlayFile struct {
+	DefaultEnabled bool `yaml:"default_enabled"`
+	// Families is keyed only by current name. One name cannot carry separate
+	// policies for attribute and metric families; set kind explicitly whenever
+	// a metric-name family is configured.
+	Families map[string]overlayFamily `yaml:"families"`
+}
+
+type overlayFamily struct {
+	Enabled           *bool             `yaml:"enabled"`
+	Kind              string            `yaml:"kind"`
+	Old               []string          `yaml:"old"`
+	AddOld            []string          `yaml:"add_old"`
+	ExcludeOld        []string          `yaml:"exclude_old"`
+	Contexts          []string          `yaml:"contexts"`
+	Signals           []string          `yaml:"signals"`
+	AddContexts       []string          `yaml:"add_contexts"`
+	AddSignals        []string          `yaml:"add_signals"`
+	ApplyToMetrics    []string          `yaml:"apply_to_metrics"`
+	AddApplyToMetrics []string          `yaml:"add_apply_to_metrics"`
+	ValueMap          map[string]string `yaml:"value_map"`
+}
+
+type edge struct {
+	old            string
+	current        string
+	kind           string
+	contexts       []string
+	signals        []string
+	allContexts    bool
+	allSignals     bool
+	applyToMetrics []string
+}
+
+type graphKey struct{ kind, name string }
+
+type generatedFamily struct {
+	Current        string
+	Old            []string
+	Kind           string
+	Contexts       []string
+	Signals        []string
+	ApplyToMetrics []string
+	ValueMap       map[string]string
+}
+
+func main() {
+	root, err := findRepoRoot()
+	if err != nil {
+		fatal(err)
+	}
+
+	var schemaPaths stringListFlag
+	flag.Var(&schemaPaths, "schema", "schema source (repeatable)")
+	overlayPath := flag.String("overlay", filepath.Join(root, "scripts/semconv/overlay.yaml"), "SigNoz overlay")
+	goOutput := flag.String("go-out", filepath.Join(root, "pkg/semconv/families_gen.go"), "generated Go output")
+	tsOutput := flag.String("ts-out", filepath.Join(root, "frontend/src/constants/generated/semconvFamilies.gen.ts"), "generated TypeScript output")
+	check := flag.Bool("check", false, "fail if generated files are stale")
+	flag.Parse()
+
+	if len(schemaPaths) == 0 {
+		schemaPaths = append(schemaPaths, filepath.Join(root, "scripts/semconv/schema-1.42.0.yaml"))
+	}
+
+	families, err := generate(schemaPaths, *overlayPath)
+	if err != nil {
+		fatal(err)
+	}
+	goBytes, err := renderGo(families)
+	if err != nil {
+		fatal(err)
+	}
+	tsBytes := renderTypeScript(families)
+
+	if *check {
+		if err := checkFile(*goOutput, goBytes); err != nil {
+			fatal(err)
+		}
+		if err := checkFile(*tsOutput, tsBytes); err != nil {
+			fatal(err)
+		}
+		return
+	}
+
+	if err := os.WriteFile(*goOutput, goBytes, 0o644); err != nil {
+		fatal(err)
+	}
+	if err := os.WriteFile(*tsOutput, tsBytes, 0o644); err != nil {
+		fatal(err)
+	}
+}
+
+func fatal(err error) {
+	fmt.Fprintln(os.Stderr, err)
+	os.Exit(1)
+}
+
+func findRepoRoot() (string, error) {
+	dir, err := os.Getwd()
+	if err != nil {
+		return "", err
+	}
+	for {
+		if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil {
+			return dir, nil
+		}
+		parent := filepath.Dir(dir)
+		if parent == dir {
+			return "", errors.New("could not find repository root")
+		}
+		dir = parent
+	}
+}
+
+func generate(schemaPaths []string, overlayPath string) ([]generatedFamily, error) {
+	var schemas []schemaFile
+	for _, path := range schemaPaths {
+		data, err := os.ReadFile(path)
+		if err != nil {
+			return nil, fmt.Errorf("read schema %s: %w", path, err)
+		}
+		var schema schemaFile
+		if err := decodeKnownFields(data, &schema); err != nil {
+			return nil, fmt.Errorf("parse schema %s: %w", path, err)
+		}
+		schemas = append(schemas, schema)
+	}
+
+	overlayData, err := os.ReadFile(overlayPath)
+	if err != nil {
+		return nil, fmt.Errorf("read overlay: %w", err)
+	}
+	var overlay overlayFile
+	if err := decodeKnownFields(overlayData, &overlay); err != nil {
+		return nil, fmt.Errorf("parse overlay: %w", err)
+	}
+
+	return buildFamilies(schemas, overlay)
+}
+
+func decodeKnownFields(data []byte, target any) error {
+	decoder := yaml.NewDecoder(bytes.NewReader(data))
+	decoder.KnownFields(true)
+	return decoder.Decode(target)
+}
+
+func collectEdges(schemas []schemaFile) ([]edge, error) {
+	var edges []edge
+	for _, schema := range schemas {
+		versions := make([]string, 0, len(schema.Versions))
+		versionParts := make(map[string][3]int, len(schema.Versions))
+		for version := range schema.Versions {
+			parts, err := parseSchemaVersion(version)
+			if err != nil {
+				return nil, err
+			}
+			versions = append(versions, version)
+			versionParts[version] = parts
+		}
+		sort.Slice(versions, func(i, j int) bool {
+			return compareVersionParts(versionParts[versions[i]], versionParts[versions[j]]) < 0
+		})
+		for _, versionName := range versions {
+			version := schema.Versions[versionName]
+			var versionEdges []edge
+			sections := []struct {
+				name    string
+				section changeSection
+			}{
+				{name: "all", section: version.All},
+				{name: "resources", section: version.Resources},
+				{name: "spans", section: version.Spans},
+				{name: "logs", section: version.Logs},
+				{name: "metrics", section: version.Metrics},
+			}
+			for _, scoped := range sections {
+				contexts, signals, allContexts, allSignals, err := scopeForSection(scoped.name)
+				if err != nil {
+					return nil, err
+				}
+				for _, change := range scoped.section.Changes {
+					if change.RenameAttributes != nil {
+						for _, old := range sortedMapKeys(change.RenameAttributes.AttributeMap) {
+							versionEdges = append(versionEdges, edge{
+								old: old, current: change.RenameAttributes.AttributeMap[old], kind: kindAttribute,
+								contexts: contexts, signals: signals,
+								allContexts: allContexts, allSignals: allSignals,
+								applyToMetrics: change.RenameAttributes.ApplyToMetrics,
+							})
+						}
+					}
+					for _, old := range sortedMapKeys(change.RenameMetrics) {
+						versionEdges = append(versionEdges, edge{
+							old: old, current: change.RenameMetrics[old], kind: kindMetric,
+							contexts: []string{"metric"}, signals: []string{"metrics"},
+						})
+					}
+				}
+			}
+			if err := rejectSameVersionChains(versionName, versionEdges); err != nil {
+				return nil, err
+			}
+			edges = append(edges, versionEdges...)
+		}
+	}
+	return edges, nil
+}
+
+func rejectSameVersionChains(version string, edges []edge) error {
+	oldNames := make(map[graphKey]struct{}, len(edges))
+	for _, item := range edges {
+		oldNames[graphKey{kind: item.kind, name: item.old}] = struct{}{}
+	}
+	for _, item := range edges {
+		if _, ok := oldNames[graphKey{kind: item.kind, name: item.current}]; ok {
+			return fmt.Errorf(
+				"schema version %q contains a same-version %s rename chain through %q",
+				version,
+				item.kind,
+				item.current,
+			)
+		}
+	}
+	return nil
+}
+
+func parseSchemaVersion(version string) ([3]int, error) {
+	parts := strings.Split(version, ".")
+	if len(parts) != 3 {
+		return [3]int{}, fmt.Errorf("schema version %q must contain major, minor, and patch numbers", version)
+	}
+
+	var parsed [3]int
+	for i, part := range parts {
+		value, err := strconv.Atoi(part)
+		if err != nil || value < 0 {
+			return [3]int{}, fmt.Errorf("schema version %q contains invalid numeric component %q", version, part)
+		}
+		parsed[i] = value
+	}
+	return parsed, nil
+}
+
+func compareVersionParts(left, right [3]int) int {
+	for i := range left {
+		if left[i] < right[i] {
+			return -1
+		}
+		if left[i] > right[i] {
+			return 1
+		}
+	}
+	return 0
+}
+
+func scopeForSection(section string) (contexts, signals []string, allContexts, allSignals bool, err error) {
+	switch section {
+	case "all":
+		return nil, nil, true, true, nil
+	case "resources":
+		return []string{"resource"}, nil, false, true, nil
+	case "spans":
+		return []string{"attribute"}, []string{"traces"}, false, false, nil
+	case "logs":
+		return []string{"attribute"}, []string{"logs"}, false, false, nil
+	case "metrics":
+		return []string{"attribute"}, []string{"metrics"}, false, false, nil
+	default:
+		return nil, nil, false, false, fmt.Errorf("unsupported schema section %q", section)
+	}
+}
+
+func buildFamilies(schemas []schemaFile, overlay overlayFile) ([]generatedFamily, error) {
+	edges, err := collectEdges(schemas)
+	if err != nil {
+		return nil, err
+	}
+	next := make(map[graphKey]string)
+	for _, item := range edges {
+		key := graphKey{kind: item.kind, name: item.old}
+		if existing, ok := next[key]; ok && existing == item.current {
+			// Repeated entries are common in chained schema histories. Treat an
+			// identical edge as a no-op so it cannot sever a later edge in the
+			// same chain (A -> B, B -> C, then a repeated A -> B).
+			continue
+		}
+		// Schema history occasionally repeats an old name with a newer direct
+		// destination or rolls a rename back. Edges are collected
+		// oldest-to-newest, so the latest published current name must be a root.
+		delete(next, graphKey{kind: item.kind, name: item.current})
+		next[key] = item.current
+	}
+
+	type familyState struct {
+		family      generatedFamily
+		distance    map[string]int
+		allContexts bool
+		allSignals  bool
+	}
+	states := map[graphKey]*familyState{}
+	for _, item := range edges {
+		root, distance, err := rootFor(next, item.kind, item.old)
+		if err != nil {
+			return nil, err
+		}
+		key := graphKey{kind: item.kind, name: root}
+		state := states[key]
+		if state == nil {
+			state = &familyState{
+				family:   generatedFamily{Current: root, Kind: item.kind},
+				distance: map[string]int{},
+			}
+			states[key] = state
+		}
+		if prior, ok := state.distance[item.old]; !ok || distance < prior {
+			state.distance[item.old] = distance
+		}
+		state.allContexts = state.allContexts || item.allContexts
+		state.allSignals = state.allSignals || item.allSignals
+		state.family.Contexts = appendUnique(state.family.Contexts, item.contexts...)
+		state.family.Signals = appendUnique(state.family.Signals, item.signals...)
+		state.family.ApplyToMetrics = appendUnique(state.family.ApplyToMetrics, item.applyToMetrics...)
+	}
+
+	for _, state := range states {
+		for old := range state.distance {
+			if old != state.family.Current {
+				state.family.Old = append(state.family.Old, old)
+			}
+		}
+		sort.Slice(state.family.Old, func(i, j int) bool {
+			left, right := state.family.Old[i], state.family.Old[j]
+			if state.distance[left] != state.distance[right] {
+				return state.distance[left] < state.distance[right]
+			}
+			return left < right
+		})
+		if state.allContexts {
+			state.family.Contexts = nil
+		} else {
+			sort.Strings(state.family.Contexts)
+		}
+		if state.allSignals {
+			state.family.Signals = nil
+		} else {
+			sort.Strings(state.family.Signals)
+		}
+		sort.Strings(state.family.ApplyToMetrics)
+	}
+
+	for _, current := range sortedMapKeys(overlay.Families) {
+		policy := overlay.Families[current]
+		kind, err := normalizedOverlayKind(current, policy)
+		if err != nil {
+			return nil, err
+		}
+		policy.Kind = kind
+		overlay.Families[current] = policy
+		key := graphKey{kind: kind, name: current}
+		state := states[key]
+		if state == nil {
+			if len(policy.Old) == 0 {
+				return nil, fmt.Errorf(
+					"overlay family %q with kind %q is absent from schemas and has no old members",
+					current,
+					kind,
+				)
+			}
+			state = &familyState{
+				family:   generatedFamily{Current: current, Kind: kind, Old: append([]string(nil), policy.Old...)},
+				distance: map[string]int{},
+			}
+			states[key] = state
+		}
+		applyOverlay(&state.family, policy)
+	}
+
+	var result []generatedFamily
+	for key, state := range states {
+		policy, hasPolicy := overlay.Families[key.name]
+		enabled := overlay.DefaultEnabled
+		if hasPolicy && policy.Kind != key.kind {
+			hasPolicy = false
+		}
+		if hasPolicy && policy.Enabled != nil {
+			enabled = *policy.Enabled
+		}
+		if !enabled {
+			continue
+		}
+		if len(state.family.Old) == 0 {
+			return nil, fmt.Errorf(
+				"enabled family %q with kind %q has no old members",
+				state.family.Current,
+				state.family.Kind,
+			)
+		}
+		sort.Strings(state.family.Contexts)
+		sort.Strings(state.family.Signals)
+		sort.Strings(state.family.ApplyToMetrics)
+		result = append(result, state.family)
+	}
+
+	sort.Slice(result, func(i, j int) bool {
+		if result[i].Current != result[j].Current {
+			return result[i].Current < result[j].Current
+		}
+		return result[i].Kind < result[j].Kind
+	})
+	return result, nil
+}
+
+func rootFor(next map[graphKey]string, kind, name string) (string, int, error) {
+	seen := map[string]bool{}
+	distance := 0
+	for {
+		if seen[name] {
+			return "", 0, fmt.Errorf("rename cycle for %s %q", kind, name)
+		}
+		seen[name] = true
+		current, ok := next[graphKey{kind: kind, name: name}]
+		if !ok {
+			return name, distance, nil
+		}
+		name = current
+		distance++
+	}
+}
+
+func normalizedOverlayKind(current string, policy overlayFamily) (string, error) {
+	kind := policy.Kind
+	if kind == "" {
+		kind = kindAttribute
+	}
+	if kind != kindAttribute && kind != kindMetric {
+		return "", fmt.Errorf("overlay family %q has unsupported kind %q", current, kind)
+	}
+	return kind, nil
+}
+
+func applyOverlay(family *generatedFamily, policy overlayFamily) {
+	if policy.Kind != "" {
+		family.Kind = policy.Kind
+	}
+	if policy.Old != nil {
+		family.Old = append([]string(nil), policy.Old...)
+	}
+	family.Old = appendUnique(family.Old, policy.AddOld...)
+	if len(policy.ExcludeOld) > 0 {
+		excluded := make(map[string]bool, len(policy.ExcludeOld))
+		for _, old := range policy.ExcludeOld {
+			excluded[old] = true
+		}
+		family.Old = deleteMatching(family.Old, excluded)
+	}
+	if policy.Contexts != nil {
+		family.Contexts = append([]string(nil), policy.Contexts...)
+	}
+	if policy.Signals != nil {
+		family.Signals = append([]string(nil), policy.Signals...)
+	}
+	family.Contexts = appendUnique(family.Contexts, policy.AddContexts...)
+	family.Signals = appendUnique(family.Signals, policy.AddSignals...)
+	if policy.ApplyToMetrics != nil {
+		family.ApplyToMetrics = append([]string(nil), policy.ApplyToMetrics...)
+	}
+	family.ApplyToMetrics = appendUnique(family.ApplyToMetrics, policy.AddApplyToMetrics...)
+	if policy.ValueMap != nil {
+		family.ValueMap = make(map[string]string, len(policy.ValueMap))
+		for old, current := range policy.ValueMap {
+			family.ValueMap[old] = current
+		}
+	}
+}
+
+func appendUnique(values []string, additions ...string) []string {
+	seen := make(map[string]bool, len(values)+len(additions))
+	for _, value := range values {
+		seen[value] = true
+	}
+	for _, value := range additions {
+		if value == "" || seen[value] {
+			continue
+		}
+		seen[value] = true
+		values = append(values, value)
+	}
+	return values
+}
+
+func deleteMatching(values []string, excluded map[string]bool) []string {
+	result := values[:0]
+	for _, value := range values {
+		if !excluded[value] {
+			result = append(result, value)
+		}
+	}
+	return result
+}
+
+func renderGo(families []generatedFamily) ([]byte, error) {
+	var out bytes.Buffer
+	out.WriteString("// Code generated by scripts/semconv. DO NOT EDIT.\n\n")
+	out.WriteString("package semconv\n\n")
+	needsTelemetryTypes := false
+	for _, family := range families {
+		if len(family.Contexts) > 0 || len(family.Signals) > 0 {
+			needsTelemetryTypes = true
+			break
+		}
+	}
+	if needsTelemetryTypes {
+		out.WriteString("import \"github.com/SigNoz/signoz/pkg/types/telemetrytypes\"\n\n")
+	}
+	out.WriteString("var families = []Family{\n")
+	for _, family := range families {
+		contexts, err := goFieldContextSlice(family.Contexts)
+		if err != nil {
+			return nil, fmt.Errorf("render family %q: %w", family.Current, err)
+		}
+		signals, err := goSignalSlice(family.Signals)
+		if err != nil {
+			return nil, fmt.Errorf("render family %q: %w", family.Current, err)
+		}
+		out.WriteString("\t{\n")
+		fmt.Fprintf(&out, "\t\tCurrent: %s,\n", strconv.Quote(family.Current))
+		fmt.Fprintf(&out, "\t\tOld: %s,\n", goStringSlice(family.Old))
+		if family.Kind == kindMetric {
+			out.WriteString("\t\tKind: KindMetric,\n")
+		} else {
+			out.WriteString("\t\tKind: KindAttribute,\n")
+		}
+		fmt.Fprintf(&out, "\t\tContexts: %s,\n", contexts)
+		fmt.Fprintf(&out, "\t\tSignals: %s,\n", signals)
+		fmt.Fprintf(&out, "\t\tApplyToMetrics: %s,\n", goStringSlice(family.ApplyToMetrics))
+		if len(family.ValueMap) > 0 {
+			out.WriteString("\t\tValueMap: map[string]string{\n")
+			keys := sortedMapKeys(family.ValueMap)
+			for _, key := range keys {
+				fmt.Fprintf(&out, "\t\t\t%s: %s,\n", strconv.Quote(key), strconv.Quote(family.ValueMap[key]))
+			}
+			out.WriteString("\t\t},\n")
+		}
+		out.WriteString("\t},\n")
+	}
+	out.WriteString("}\n")
+	return format.Source(out.Bytes())
+}
+
+func goStringSlice(values []string) string {
+	if len(values) == 0 {
+		return "nil"
+	}
+	quoted := make([]string, len(values))
+	for i, value := range values {
+		quoted[i] = strconv.Quote(value)
+	}
+	return "[]string{" + strings.Join(quoted, ", ") + "}"
+}
+
+func goFieldContextSlice(values []string) (string, error) {
+	if len(values) == 0 {
+		return "nil", nil
+	}
+	constants := make([]string, len(values))
+	for i, value := range values {
+		switch value {
+		case "metric":
+			constants[i] = "telemetrytypes.FieldContextMetric"
+		case "resource":
+			constants[i] = "telemetrytypes.FieldContextResource"
+		case "attribute":
+			constants[i] = "telemetrytypes.FieldContextAttribute"
+		default:
+			return "", fmt.Errorf("unsupported field context %q", value)
+		}
+	}
+	return "[]telemetrytypes.FieldContext{" + strings.Join(constants, ", ") + "}", nil
+}
+
+func goSignalSlice(values []string) (string, error) {
+	if len(values) == 0 {
+		return "nil", nil
+	}
+	constants := make([]string, len(values))
+	for i, value := range values {
+		switch value {
+		case "traces":
+			constants[i] = "telemetrytypes.SignalTraces"
+		case "logs":
+			constants[i] = "telemetrytypes.SignalLogs"
+		case "metrics":
+			constants[i] = "telemetrytypes.SignalMetrics"
+		default:
+			return "", fmt.Errorf("unsupported signal %q", value)
+		}
+	}
+	return "[]telemetrytypes.Signal{" + strings.Join(constants, ", ") + "}", nil
+}
+
+func renderTypeScript(families []generatedFamily) []byte {
+	var out bytes.Buffer
+	out.WriteString("// Code generated by scripts/semconv. DO NOT EDIT.\n\n")
+	out.WriteString("export type SemconvFamily = {\n")
+	out.WriteString("\treadonly current: string;\n\treadonly old: readonly string[];\n")
+	out.WriteString("\treadonly kind: 'attribute' | 'metric';\n")
+	out.WriteString("\treadonly contexts: readonly string[];\n\treadonly signals: readonly string[];\n")
+	out.WriteString("\treadonly applyToMetrics: readonly string[];\n")
+	out.WriteString("\treadonly valueMap: Readonly<Record<string, string>>;\n};\n\n")
+	out.WriteString("export const SEMCONV_FAMILIES: readonly SemconvFamily[] = [\n")
+	for _, family := range families {
+		out.WriteString("\t{\n")
+		fmt.Fprintf(&out, "\t\tcurrent: %s,\n", tsString(family.Current))
+		fmt.Fprintf(&out, "\t\told: %s,\n", tsStringSlice(family.Old))
+		fmt.Fprintf(&out, "\t\tkind: %s,\n", tsString(family.Kind))
+		fmt.Fprintf(&out, "\t\tcontexts: %s,\n", tsStringSlice(family.Contexts))
+		fmt.Fprintf(&out, "\t\tsignals: %s,\n", tsStringSlice(family.Signals))
+		fmt.Fprintf(&out, "\t\tapplyToMetrics: %s,\n", tsStringSlice(family.ApplyToMetrics))
+		out.WriteString("\t\tvalueMap: {")
+		keys := sortedMapKeys(family.ValueMap)
+		for i, key := range keys {
+			if i > 0 {
+				out.WriteString(", ")
+			}
+			fmt.Fprintf(&out, "%s: %s", tsString(key), tsString(family.ValueMap[key]))
+		}
+		out.WriteString("},\n\t},\n")
+	}
+	out.WriteString("] as const;\n")
+	return out.Bytes()
+}
+
+func tsString(value string) string {
+	quoted := strconv.Quote(value)
+	return "'" + strings.ReplaceAll(quoted[1:len(quoted)-1], "'", `\'`) + "'"
+}
+func tsStringSlice(values []string) string {
+	quoted := make([]string, len(values))
+	for i, value := range values {
+		quoted[i] = tsString(value)
+	}
+	return "[" + strings.Join(quoted, ", ") + "]"
+}
+
+func sortedMapKeys[T any](values map[string]T) []string {
+	keys := make([]string, 0, len(values))
+	for key := range values {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	return keys
+}
+
+func checkFile(path string, expected []byte) error {
+	actual, err := os.ReadFile(path)
+	if err != nil {
+		return fmt.Errorf("generated file %s is missing: run go run ./scripts/semconv", path)
+	}
+	if !bytes.Equal(actual, expected) {
+		return fmt.Errorf("generated file %s is stale: run go run ./scripts/semconv", path)
+	}
+	return nil
+}

scripts/semconv/generate_test.go

@@ -0,0 +1,376 @@
+package main
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSchemaDecoderRejectsUnsupportedSection(t *testing.T) {
+	var schema schemaFile
+	err := decodeKnownFields([]byte(`
+versions:
+  1.0.0:
+    span_events:
+      changes:
+        - rename_events:
+            event_map:
+              old: current
+`), &schema)
+
+	assert.ErrorContains(t, err, "field span_events not found", "unsupported schema sections must fail generation")
+}
+
+func TestBuildFamiliesRejectsMalformedSchemaVersion(t *testing.T) {
+	var schema schemaFile
+	require.NoError(t, decodeKnownFields([]byte(`
+versions:
+  latest:
+    spans:
+      changes: []
+`), &schema), "test schema must decode")
+
+	_, err := buildFamilies([]schemaFile{schema}, overlayFile{})
+	assert.ErrorContains(t, err, `schema version "latest"`, "malformed versions must not be silently reordered")
+}
+
+func TestBuildFamiliesResolvesRenameChain(t *testing.T) {
+	var schema schemaFile
+	require.NoError(t, decodeKnownFields([]byte(`
+versions:
+  4.0.0:
+    spans:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              a: b
+  3.0.0:
+    spans:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              b: c
+              x: c
+  2.0.0:
+    spans:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              a: b
+        - rename_attributes:
+            attribute_map:
+              a: b
+`), &schema), "test schema must decode")
+
+	enabled := true
+	families, err := buildFamilies([]schemaFile{schema}, overlayFile{Families: map[string]overlayFamily{
+		"c": {Enabled: &enabled},
+	}})
+	require.NoError(t, err)
+	assert.Equal(t, []generatedFamily{{
+		Current:  "c",
+		Old:      []string{"b", "x", "a"},
+		Kind:     kindAttribute,
+		Contexts: []string{"attribute"},
+		Signals:  []string{"traces"},
+	}}, families, "predecessors should be ordered by distance and then name")
+}
+
+func TestBuildFamiliesMapsSchemaSectionsToScopes(t *testing.T) {
+	var schema schemaFile
+	require.NoError(t, decodeKnownFields([]byte(`
+versions:
+  1.0.0:
+    all:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              all.old: all.current
+    resources:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              resource.old: resource.current
+    logs:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              log.old: log.current
+    metrics:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              state: cpu.mode
+            apply_to_metrics: [system.cpu.time]
+        - rename_metrics:
+            old.metric: current.metric
+`), &schema), "test schema must decode")
+
+	enabled := true
+	families, err := buildFamilies([]schemaFile{schema}, overlayFile{Families: map[string]overlayFamily{
+		"all.current":      {Enabled: &enabled},
+		"resource.current": {Enabled: &enabled},
+		"log.current":      {Enabled: &enabled},
+		"cpu.mode":         {Enabled: &enabled},
+		"current.metric":   {Enabled: &enabled, Kind: kindMetric},
+	}})
+	require.NoError(t, err)
+	assert.Equal(t, []generatedFamily{
+		{
+			Current: "all.current", Old: []string{"all.old"}, Kind: kindAttribute,
+			Contexts: nil, Signals: nil,
+		},
+		{
+			Current: "cpu.mode", Old: []string{"state"}, Kind: kindAttribute,
+			Contexts: []string{"attribute"}, Signals: []string{"metrics"},
+			ApplyToMetrics: []string{"system.cpu.time"},
+		},
+		{
+			Current: "current.metric", Old: []string{"old.metric"}, Kind: kindMetric,
+			Contexts: []string{"metric"}, Signals: []string{"metrics"},
+		},
+		{
+			Current: "log.current", Old: []string{"log.old"}, Kind: kindAttribute,
+			Contexts: []string{"attribute"}, Signals: []string{"logs"},
+		},
+		{
+			Current: "resource.current", Old: []string{"resource.old"}, Kind: kindAttribute,
+			Contexts: []string{"resource"},
+		},
+	}, families, "schema sections should produce their documented signal and context scopes")
+}
+
+func TestOverlayAddsFamilyWithoutSchemaHistory(t *testing.T) {
+	enabled := true
+	families, err := buildFamilies(nil, overlayFile{Families: map[string]overlayFamily{
+		"added.current": {
+			Enabled:  &enabled,
+			Old:      []string{"added.old"},
+			Contexts: []string{"resource"},
+			Signals:  []string{"traces"},
+		},
+	}})
+
+	require.NoError(t, err)
+	assert.Equal(t, []generatedFamily{{
+		Current:  "added.current",
+		Old:      []string{"added.old"},
+		Kind:     kindAttribute,
+		Contexts: []string{"resource"},
+		Signals:  []string{"traces"},
+	}}, families, "an explicit overlay family should not require schema history")
+}
+
+func TestOverlayOverridesGeneratedFamily(t *testing.T) {
+	var schema schemaFile
+	require.NoError(t, decodeKnownFields([]byte(`
+versions:
+  1.0.0:
+    spans:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              old: current
+`), &schema), "test schema must decode")
+
+	enabled := true
+	families, err := buildFamilies([]schemaFile{schema}, overlayFile{Families: map[string]overlayFamily{
+		"current": {
+			Enabled:     &enabled,
+			AddOld:      []string{"older"},
+			ExcludeOld:  []string{"old"},
+			AddContexts: []string{"resource"},
+			AddSignals:  []string{"logs"},
+			ValueMap:    map[string]string{"legacy": "current"},
+		},
+	}})
+
+	require.NoError(t, err)
+	assert.Equal(t, []generatedFamily{{
+		Current:  "current",
+		Old:      []string{"older"},
+		Kind:     kindAttribute,
+		Contexts: []string{"attribute", "resource"},
+		Signals:  []string{"logs", "traces"},
+		ValueMap: map[string]string{"legacy": "current"},
+	}}, families, "overlay additions and exclusions should be applied to the generated family")
+}
+
+func TestOverlayDisablesFamilyWhenDefaultIsEnabled(t *testing.T) {
+	var schema schemaFile
+	require.NoError(t, decodeKnownFields([]byte(`
+versions:
+  1.0.0:
+    spans:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              old: current
+`), &schema), "test schema must decode")
+
+	disabled := false
+	families, err := buildFamilies([]schemaFile{schema}, overlayFile{
+		DefaultEnabled: true,
+		Families: map[string]overlayFamily{
+			"current": {Enabled: &disabled},
+		},
+	})
+
+	require.NoError(t, err)
+	assert.Empty(t, families, "an explicitly disabled family must override default_enabled")
+}
+
+func TestRenderGoIsDeterministic(t *testing.T) {
+	families := []generatedFamily{{
+		Current: "current", Old: []string{"old"}, Kind: kindAttribute,
+		ValueMap: map[string]string{"b": "2", "a": "1"},
+	}}
+
+	first, err := renderGo(families)
+	require.NoError(t, err)
+	second, err := renderGo(families)
+	require.NoError(t, err)
+	assert.Equal(t, first, second, "Go generation must not depend on map iteration order")
+}
+
+func TestRenderGoUsesCanonicalTelemetryTypes(t *testing.T) {
+	families := []generatedFamily{{
+		Current: "current", Old: []string{"old"}, Kind: kindAttribute,
+		Contexts: []string{"resource"}, Signals: []string{"traces"},
+	}}
+
+	output, err := renderGo(families)
+	require.NoError(t, err)
+	assert.Contains(t, string(output), "telemetrytypes.FieldContextResource", "generated contexts should use telemetrytypes")
+	assert.Contains(t, string(output), "telemetrytypes.SignalTraces", "generated signals should use telemetrytypes")
+}
+
+func TestRenderTypeScriptIsDeterministic(t *testing.T) {
+	families := []generatedFamily{{
+		Current: "current", Old: []string{"old"}, Kind: kindAttribute,
+		ValueMap: map[string]string{"b": "2", "a": "1"},
+	}}
+
+	assert.Equal(t, renderTypeScript(families), renderTypeScript(families), "TypeScript generation must not depend on map iteration order")
+}
+
+func TestBuildFamiliesHandlesRenameRollback(t *testing.T) {
+	var schema schemaFile
+	require.NoError(t, decodeKnownFields([]byte(`
+versions:
+  2.0.0:
+    metrics:
+      changes:
+        - rename_metrics:
+            temporary: original
+  1.0.0:
+    metrics:
+      changes:
+        - rename_metrics:
+            original: temporary
+`), &schema), "test schema must decode")
+
+	enabled := true
+	families, err := buildFamilies([]schemaFile{schema}, overlayFile{Families: map[string]overlayFamily{
+		"original": {Enabled: &enabled, Kind: kindMetric},
+	}})
+
+	require.NoError(t, err)
+	assert.Equal(t, []generatedFamily{{
+		Current:  "original",
+		Old:      []string{"temporary"},
+		Kind:     kindMetric,
+		Contexts: []string{"metric"},
+		Signals:  []string{"metrics"},
+	}}, families, "the latest rollback destination should remain the family root")
+}
+
+func TestBuildFamiliesRejectsSameVersionRenameChain(t *testing.T) {
+	var schema schemaFile
+	require.NoError(t, decodeKnownFields([]byte(`
+versions:
+  1.0.0:
+    spans:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              x: y
+              y: z
+`), &schema), "test schema must decode")
+
+	_, err := buildFamilies([]schemaFile{schema}, overlayFile{})
+	assert.ErrorContains(t, err, `same-version attribute rename chain through "y"`, "order-sensitive same-version chains must be rejected")
+}
+
+func TestBuildFamiliesRejectsOverlayFamilyWithoutHistory(t *testing.T) {
+	enabled := true
+	_, err := buildFamilies(nil, overlayFile{Families: map[string]overlayFamily{
+		"missing": {Enabled: &enabled},
+	}})
+
+	assert.ErrorContains(t, err, `overlay family "missing" with kind "attribute" is absent`, "an overlay cannot invent a family without old members")
+}
+
+func TestBuildFamiliesRejectsEnabledFamilyWithoutOldMembers(t *testing.T) {
+	var schema schemaFile
+	require.NoError(t, decodeKnownFields([]byte(`
+versions:
+  1.0.0:
+    spans:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              old: current
+`), &schema), "test schema must decode")
+
+	enabled := true
+	_, err := buildFamilies([]schemaFile{schema}, overlayFile{Families: map[string]overlayFamily{
+		"current": {Enabled: &enabled, ExcludeOld: []string{"old"}},
+	}})
+	assert.ErrorContains(t, err, `enabled family "current" with kind "attribute" has no old members`, "exclude_old cannot empty an enabled family")
+}
+
+func TestOverlayKindDefaultsToAttribute(t *testing.T) {
+	var schema schemaFile
+	require.NoError(t, decodeKnownFields([]byte(`
+versions:
+  1.0.0:
+    spans:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              attribute.old: shared.current
+    metrics:
+      changes:
+        - rename_metrics:
+            metric.old: shared.current
+`), &schema), "test schema must decode")
+
+	enabled := true
+	families, err := buildFamilies([]schemaFile{schema}, overlayFile{Families: map[string]overlayFamily{
+		"shared.current": {Enabled: &enabled},
+	}})
+
+	require.NoError(t, err)
+	assert.Equal(t, []generatedFamily{{
+		Current:  "shared.current",
+		Old:      []string{"attribute.old"},
+		Kind:     kindAttribute,
+		Contexts: []string{"attribute"},
+		Signals:  []string{"traces"},
+	}}, families, "a kind-less overlay policy should affect only the attribute family")
+}
+
+func TestCheckFileReportsStaleOutput(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "generated.go")
+	require.NoError(t, os.WriteFile(path, []byte("old"), 0o600), "test output must be writable")
+
+	assert.ErrorContains(t, checkFile(path, []byte("new")), "is stale", "check mode must reject stale generated output")
+}
+
+func TestTypeScriptStringEscapesControlCharacters(t *testing.T) {
+	assert.Equal(t, `'line\n\t\x01\'\\end'`, tsString("line\n\t\x01'\\end"), "generated TypeScript strings must remain valid literals")
+}

scripts/semconv/overlay.yaml

@@ -0,0 +1,11 @@
+# SigNoz semantic-convention rollout policy.
+#
+# Families are keyed by their current OpenTelemetry name. Schema-derived
+# families are disabled by default so rollout remains explicit and reversible.
+default_enabled: false
+
+families:
+  deployment.environment.name:
+    enabled: true
+  db.system.name:
+    enabled: true

scripts/semconv/schema-1.42.0.yaml

@@ -0,0 +1,760 @@
+
+
+file_format: 1.1.0
+schema_url: https://opentelemetry.io/schemas/1.42.0
+versions:
+  1.42.0:
+    metrics:
+      changes:
+        - rename_metrics:
+            v8js.memory.heap.limit: v8js.memory.heap.space.size
+  1.41.1:
+  1.41.0:
+    metrics:
+      changes:
+        - rename_metrics:
+            k8s.container.cpu.limit: k8s.container.cpu.limit.desired
+            k8s.container.cpu.limit_utilization: k8s.container.cpu.limit.utilization
+            k8s.container.cpu.request: k8s.container.cpu.request.desired
+            k8s.container.cpu.request_utilization: k8s.container.cpu.request.utilization
+            k8s.container.memory.limit: k8s.container.memory.limit.desired
+            k8s.container.memory.request: k8s.container.memory.request.desired
+  1.40.0:
+    all:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              feature_flag.evaluation.error.message: feature_flag.error.message
+    metrics:
+      changes:
+        - rename_metrics:
+            system.memory.shared: system.memory.linux.shared
+  1.39.0:
+    all:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              linux.memory.slab.state: system.memory.linux.slab.state
+              peer.service: service.peer.name
+              rpc.connect_rpc.error_code: rpc.response.status_code
+              rpc.connect_rpc.request.metadata: rpc.request.metadata
+              rpc.connect_rpc.response.metadata: rpc.response.metadata
+              rpc.grpc.request.metadata: rpc.request.metadata
+              rpc.grpc.response.metadata: rpc.response.metadata
+              rpc.jsonrpc.request_id: jsonrpc.request.id
+              rpc.jsonrpc.version: jsonrpc.protocol.version
+              rpc.system: rpc.system.name
+    metrics:
+      changes:
+        - rename_metrics:
+            process.open_file_descriptor.count: process.unix.file_descriptor.count
+            system.linux.memory.available: system.memory.linux.available
+            system.linux.memory.slab.usage: system.memory.linux.slab.usage
+  1.38.0:
+    all:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              process.context_switch_type: process.context_switch.type
+              process.paging.fault_type: system.paging.fault.type
+              system.cpu.logical_number: cpu.logical_number
+              system.paging.type: system.paging.fault.type
+              system.process.status: process.state
+              system.processes.status: process.state
+    metrics:
+      changes:
+        - rename_metrics:
+            k8s.cronjob.active_jobs: k8s.cronjob.job.active
+            k8s.daemonset.current_scheduled_nodes: k8s.daemonset.node.current_scheduled
+            k8s.daemonset.desired_scheduled_nodes: k8s.daemonset.node.desired_scheduled
+            k8s.daemonset.misscheduled_nodes: k8s.daemonset.node.misscheduled
+            k8s.daemonset.ready_nodes: k8s.daemonset.node.ready
+            k8s.deployment.available_pods: k8s.deployment.pod.available
+            k8s.deployment.desired_pods: k8s.deployment.pod.desired
+            k8s.hpa.current_pods: k8s.hpa.pod.current
+            k8s.hpa.desired_pods: k8s.hpa.pod.desired
+            k8s.hpa.max_pods: k8s.hpa.pod.max
+            k8s.hpa.min_pods: k8s.hpa.pod.min
+            k8s.job.active_pods: k8s.job.pod.active
+            k8s.job.desired_successful_pods: k8s.job.pod.desired_successful
+            k8s.job.failed_pods: k8s.job.pod.failed
+            k8s.job.max_parallel_pods: k8s.job.pod.max_parallel
+            k8s.job.successful_pods: k8s.job.pod.successful
+            k8s.node.allocatable.cpu: k8s.node.cpu.allocatable
+            k8s.node.allocatable.ephemeral_storage: k8s.node.ephemeral_storage.allocatable
+            k8s.node.allocatable.memory: k8s.node.memory.allocatable
+            k8s.node.allocatable.pods: k8s.node.pod.allocatable
+            k8s.replicaset.available_pods: k8s.replicaset.pod.available
+            k8s.replicaset.desired_pods: k8s.replicaset.pod.desired
+            k8s.replication_controller.available_pods: k8s.replicationcontroller.pod.available
+            k8s.replication_controller.desired_pods: k8s.replicationcontroller.pod.desired
+            k8s.replicationcontroller.available_pods: k8s.replicationcontroller.pod.available
+            k8s.replicationcontroller.desired_pods: k8s.replicationcontroller.pod.desired
+            k8s.statefulset.current_pods: k8s.statefulset.pod.current
+            k8s.statefulset.desired_pods: k8s.statefulset.pod.desired
+            k8s.statefulset.ready_pods: k8s.statefulset.pod.ready
+            k8s.statefulset.updated_pods: k8s.statefulset.pod.updated
+            v8js.heap.space.available_size: v8js.memory.heap.space.available_size
+            v8js.heap.space.physical_size: v8js.memory.heap.space.physical_size
+  1.37.0:
+    all:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              android.state: android.app.state
+              container.runtime: container.runtime.name
+              enduser.role: user.roles
+              gen_ai.openai.request.service_tier: openai.request.service_tier
+              gen_ai.openai.response.service_tier: openai.response.service_tier
+              gen_ai.openai.response.system_fingerprint: openai.response.system_fingerprint
+              gen_ai.system: gen_ai.provider.name
+              ios.state: ios.app.state
+  1.36.0:
+  1.35.0:
+    all:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1698
+        - rename_attributes:
+            attribute_map:
+              az.namespace: azure.resource_provider.namespace
+              az.service_request_id: azure.service.request.id
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/issues/1800
+        - rename_metrics:
+            system.network.connections: system.network.connection.count
+  1.34.0:
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/2295
+        - rename_metrics:
+            cpu.time: system.cpu.time
+            cpu.utilization: system.cpu.utilization
+            cpu.frequency: system.cpu.frequency
+  1.33.0:
+    all:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1982
+        - rename_attributes:
+            attribute_map:
+              feature_flag.provider_name: feature_flag.provider.name
+        # https://github.com/open-telemetry/semantic-conventions/pull/1994
+        - rename_attributes:
+            attribute_map:
+              feature_flag.evaluation.error.message: error.message
+  1.32.0:
+    all:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1989
+        - rename_attributes:
+            attribute_map:
+              feature_flag.evaluation.reason: feature_flag.result.reason
+              feature_flag.variant: feature_flag.result.variant
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/2042
+        - rename_metrics:
+            otel.sdk.span.live.count: otel.sdk.span.live
+            otel.sdk.span.ended.count: otel.sdk.span.ended
+            otel.sdk.processor.span.processed.count: otel.sdk.processor.span.processed
+            otel.sdk.exporter.span.inflight.count: otel.sdk.exporter.span.inflight
+            otel.sdk.exporter.span.exported.count: otel.sdk.exporter.span.exported
+  1.31.0:
+    all:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1880
+        - rename_attributes:
+            attribute_map:
+              android.state: android.app.state
+              io.state: ios.app.state
+    metrics:
+      changes:
+        - rename_metrics:
+            k8s.replication_controller.desired_pods: k8s.replicationcontroller.desired_pods
+            k8s.replication_controller.available_pods: k8s.replicationcontroller.available_pods
+        # https://github.com/open-telemetry/semantic-conventions/pull/1896
+        - rename_metrics:
+            system.cpu.time: cpu.time
+            system.cpu.utilization: cpu.utilization
+            system.cpu.frequency: cpu.frequency
+        # https://github.com/open-telemetry/semantic-conventions/pull/1896
+        - rename_attributes:
+            attribute_map:
+              system.cpu.logical_number: cpu.logical_number
+  1.30.0:
+    all:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1632
+        - rename_attributes:
+            attribute_map:
+              gen_ai.openai.request.seed: gen_ai.request.seed
+              system.network.state: network.connection.state
+        # https://github.com/open-telemetry/semantic-conventions/pull/1624
+        - rename_attributes:
+            attribute_map:
+              code.function: code.function.name
+              code.filepath: code.file.path
+              code.lineno: code.line.number
+              code.column: code.column.number
+        # https://github.com/open-telemetry/semantic-conventions/pull/1734
+        - rename_attributes:
+            attribute_map:
+              db.system: db.system.name
+              db.cassandra.coordinator.dc: cassandra.coordinator.dc
+              db.cassandra.coordinator.id: cassandra.coordinator.id
+              db.cassandra.consistency_level: cassandra.consistency.level
+              db.cassandra.idempotence: cassandra.query.idempotent
+              db.cassandra.page_size: cassandra.page.size
+              db.cassandra.speculative_execution_count: cassandra.speculative_execution.count
+              db.cosmosdb.client_id: azure.client.id
+              db.cosmosdb.connection_mode: azure.cosmosdb.connection.mode
+              db.cosmosdb.consistency_level: azure.cosmosdb.consistency.level
+              db.cosmosdb.request_charge: azure.cosmosdb.operation.request_charge
+              db.cosmosdb.request_content_length: azure.cosmosdb.request.body.size
+              db.cosmosdb.regions_contacted: azure.cosmosdb.operation.contacted_regions
+              db.cosmosdb.sub_status_code: azure.cosmosdb.response.sub_status_code
+              db.elasticsearch.node.name: elasticsearch.node.name
+              # db.elasticsearch.path_parts is a template attribute, schema transformation
+              # does not support it, adding as a comment for consistency
+              # db.elasticsearch.path_parts.<key> -> db.operation.parameter.<key>
+    metrics:
+      changes:
+        - rename_metrics:
+            db.client.cosmosdb.operation.request_charge: azure.cosmosdb.client.operation.request_charge
+            db.client.cosmosdb.active_instance.count: azure.cosmosdb.client.active_instance.count
+
+  1.29.0:
+    all:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1520
+        - rename_attributes:
+            attribute_map:
+              process.executable.build_id.profiling: process.executable.build_id.htlhash
+        # https://github.com/open-telemetry/semantic-conventions/pull/1383
+        - rename_attributes:
+            attribute_map:
+              vcs.repository.change.id: vcs.change.id
+              vcs.repository.change.title: vcs.change.title
+              vcs.repository.ref.name: vcs.ref.head.name
+              vcs.repository.ref.revision: vcs.ref.head.revision
+              vcs.repository.ref.type: vcs.ref.head.type
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1492
+        - rename_attributes:
+            attribute_map:
+              system.device: network.interface.name
+            apply_to_metrics:
+              - container.network.io
+              - system.network.dropped
+              - system.network.errors
+              - system.network.io
+              - system.network.connections
+  1.28.0:
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1422
+        - rename_metrics:
+            messaging.client.published.messages: messaging.client.sent.messages
+  1.27.0:
+    all:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1216
+        - rename_attributes:
+            attribute_map:
+              tls.client.server_name: server.address
+        # https://github.com/open-telemetry/semantic-conventions/pull/1075
+        - rename_attributes:
+            attribute_map:
+              deployment.environment: deployment.environment.name
+        # https://github.com/open-telemetry/semantic-conventions/pull/1245
+        - rename_attributes:
+            attribute_map:
+              messaging.kafka.message.offset: messaging.kafka.offset
+        # https://github.com/open-telemetry/semantic-conventions/pull/815
+        - rename_attributes:
+            attribute_map:
+              messaging.kafka.consumer.group: messaging.consumer.group.name
+              messaging.rocketmq.client_group: messaging.consumer.group.name
+              messaging.eventhubs.consumer.group: messaging.consumer.group.name
+              messaging.servicebus.destination.subscription_name: messaging.destination.subscription.name
+        # https://github.com/open-telemetry/semantic-conventions/pull/1200
+        - rename_attributes:
+            attribute_map:
+              gen_ai.usage.completion_tokens: gen_ai.usage.output_tokens
+              gen_ai.usage.prompt_tokens: gen_ai.usage.input_tokens
+    spans:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1002
+        - rename_attributes:
+            attribute_map:
+              db.elasticsearch.cluster.name: db.namespace
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/1125
+        - rename_attributes:
+            attribute_map:
+              db.client.connections.state: db.client.connection.state
+            apply_to_metrics:
+              - db.client.connection.count
+        - rename_attributes:
+            attribute_map:
+              db.client.connections.pool.name: db.client.connection.pool.name
+            apply_to_metrics:
+              - db.client.connection.count
+              - db.client.connection.idle.max
+              - db.client.connection.idle.min
+              - db.client.connection.max
+              - db.client.connection.pending_requests
+              - db.client.connection.timeouts
+              - db.client.connection.create_time
+              - db.client.connection.wait_time
+              - db.client.connection.use_time
+        # https://github.com/open-telemetry/semantic-conventions/pull/1006
+        - rename_metrics:
+            messaging.publish.messages: messaging.client.published.messages
+        # https://github.com/open-telemetry/semantic-conventions/pull/1026
+        - rename_attributes:
+            attribute_map:
+              system.cpu.state: cpu.mode
+              process.cpu.state: cpu.mode
+              container.cpu.state: cpu.mode
+            apply_to_metrics:
+              - system.cpu.time
+              - system.cpu.utilization
+              - process.cpu.time
+              - process.cpu.utilization
+              - container.cpu.time
+        # https://github.com/open-telemetry/semantic-conventions/pull/1265
+        - rename_metrics:
+            jvm.buffer.memory.usage: jvm.buffer.memory.used
+  1.26.0:
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/966
+        - rename_metrics:
+            db.client.connections.usage: db.client.connection.count
+            db.client.connections.idle.max: db.client.connection.idle.max
+            db.client.connections.idle.min: db.client.connection.idle.min
+            db.client.connections.max: db.client.connection.max
+            db.client.connections.pending_requests: db.client.connection.pending_requests
+            db.client.connections.timeouts: db.client.connection.timeouts
+        # https://github.com/open-telemetry/semantic-conventions/pull/948
+        - rename_attributes:
+            attribute_map:
+              messaging.client_id: messaging.client.id
+        # https://github.com/open-telemetry/semantic-conventions/pull/909
+        - rename_attributes:
+            attribute_map:
+              state: db.client.connections.state
+            apply_to_metrics:
+              - db.client.connections.usage
+        - rename_attributes:
+            attribute_map:
+              pool.name: db.client.connections.pool.name
+            apply_to_metrics:
+              - db.client.connections.usage
+              - db.client.connections.idle.max
+              - db.client.connections.idle.min
+              - db.client.connections.max
+              - db.client.connections.pending_requests
+              - db.client.connections.timeouts
+              - db.client.connections.create_time
+              - db.client.connections.wait_time
+              - db.client.connections.use_time
+    all:
+      changes:
+        # https://github:com/open-telemetry/semantic-conventions/pull/731/
+        - rename_attributes:
+            attribute_map:
+              enduser.id: user.id
+
+  1.25.0:
+    spans:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/911
+        - rename_attributes:
+            attribute_map:
+              db.name: db.namespace
+        # https://github.com/open-telemetry/semantic-conventions/pull/870
+        - rename_attributes:
+            attribute_map:
+              db.sql.table: db.collection.name
+              db.mongodb.collection: db.collection.name
+              db.cosmosdb.container: db.collection.name
+              db.cassandra.table: db.collection.name
+        # https://github.com/open-telemetry/semantic-conventions/pull/798
+        - rename_attributes:
+            attribute_map:
+              messaging.kafka.destination.partition: messaging.destination.partition.id
+        # https://github.com/open-telemetry/semantic-conventions/pull/875
+        - rename_attributes:
+            attribute_map:
+              db.operation: db.operation.name
+        # https://github.com/open-telemetry/semantic-conventions/pull/913
+        - rename_attributes:
+            attribute_map:
+              messaging.operation: messaging.operation.type
+        # https://github.com/open-telemetry/semantic-conventions/pull/866
+        - rename_attributes:
+            attribute_map:
+              db.statement: db.query.text
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/484
+        - rename_attributes:
+            attribute_map:
+              system.processes.status: system.process.status
+            apply_to_metrics:
+              - system.processes.count
+        - rename_metrics:
+            system.processes.count: system.process.count
+            system.processes.created: system.process.created
+        # https://github.com/open-telemetry/semantic-conventions/pull/625
+        - rename_attributes:
+            attribute_map:
+              container.labels: container.label
+              k8s.pod.labels: k8s.pod.label
+        # https://github.com/open-telemetry/semantic-conventions/pull/330
+        - rename_metrics:
+            process.threads: process.thread.count
+            process.open_file_descriptors: process.open_file_descriptor.count
+        - rename_attributes:
+            attribute_map:
+              state: process.cpu.state
+            apply_to_metrics:
+              - process.cpu.time
+              - process.cpu.utilization
+        - rename_attributes:
+            attribute_map:
+              direction: disk.io.direction
+            apply_to_metrics:
+              - process.disk.io
+        - rename_attributes:
+            attribute_map:
+              type: process.context_switch_type
+            apply_to_metrics:
+              - process.context_switches
+        - rename_attributes:
+            attribute_map:
+              direction: network.io.direction
+            apply_to_metrics:
+              - process.network.io
+        - rename_attributes:
+            attribute_map:
+              type: process.paging.fault_type
+            apply_to_metrics:
+              - process.paging.faults
+    all:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/854
+        - rename_attributes:
+            attribute_map:
+              message.type: rpc.message.type
+              message.id: rpc.message.id
+              message.compressed_size: rpc.message.compressed_size
+              message.uncompressed_size: rpc.message.uncompressed_size
+
+  1.24.0:
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/536
+        - rename_metrics:
+            jvm.memory.usage: jvm.memory.used
+            jvm.memory.usage_after_last_gc: jvm.memory.used_after_last_gc
+        # https://github.com/open-telemetry/semantic-conventions/pull/530
+        - rename_attributes:
+            attribute_map:
+              system.network.io.direction: network.io.direction
+              system.disk.io.direction: disk.io.direction
+  1.23.1:
+  1.23.0:
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/20
+        - rename_attributes:
+            attribute_map:
+              thread.daemon: jvm.thread.daemon
+            apply_to_metrics:
+              - jvm.thread.count
+  1.22.0:
+    spans:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/229
+        - rename_attributes:
+            attribute_map:
+              messaging.message.payload_size_bytes: messaging.message.body.size
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/374
+        - rename_attributes:
+            attribute_map:
+              http.resend_count: http.request.resend_count
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/224
+        - rename_metrics:
+            http.client.duration: http.client.request.duration
+            http.server.duration: http.server.request.duration
+        # https://github.com/open-telemetry/semantic-conventions/pull/241
+        - rename_metrics:
+            process.runtime.jvm.memory.usage: jvm.memory.usage
+            process.runtime.jvm.memory.committed: jvm.memory.committed
+            process.runtime.jvm.memory.limit: jvm.memory.limit
+            process.runtime.jvm.memory.usage_after_last_gc: jvm.memory.usage_after_last_gc
+            process.runtime.jvm.gc.duration: jvm.gc.duration
+            # also https://github.com/open-telemetry/semantic-conventions/pull/252
+            process.runtime.jvm.threads.count: jvm.thread.count
+            # also https://github.com/open-telemetry/semantic-conventions/pull/252
+            process.runtime.jvm.classes.loaded: jvm.class.loaded
+            # also https://github.com/open-telemetry/semantic-conventions/pull/252
+            process.runtime.jvm.classes.unloaded: jvm.class.unloaded
+            # also https://github.com/open-telemetry/semantic-conventions/pull/252
+            # and https://github.com/open-telemetry/semantic-conventions/pull/60
+            process.runtime.jvm.classes.current_loaded: jvm.class.count
+            process.runtime.jvm.cpu.time: jvm.cpu.time
+            process.runtime.jvm.cpu.recent_utilization: jvm.cpu.recent_utilization
+            process.runtime.jvm.memory.init: jvm.memory.init
+            process.runtime.jvm.system.cpu.utilization: jvm.system.cpu.utilization
+            process.runtime.jvm.system.cpu.load_1m: jvm.system.cpu.load_1m
+            # https://github.com/open-telemetry/semantic-conventions/pull/253
+            process.runtime.jvm.buffer.usage: jvm.buffer.memory.usage
+            # https://github.com/open-telemetry/semantic-conventions/pull/253
+            process.runtime.jvm.buffer.limit: jvm.buffer.memory.limit
+            process.runtime.jvm.buffer.count: jvm.buffer.count
+        # https://github.com/open-telemetry/semantic-conventions/pull/20
+        - rename_attributes:
+            attribute_map:
+              type: jvm.memory.type
+              pool: jvm.memory.pool.name
+            apply_to_metrics:
+              - jvm.memory.usage
+              - jvm.memory.committed
+              - jvm.memory.limit
+              - jvm.memory.usage_after_last_gc
+              - jvm.memory.init
+        - rename_attributes:
+            attribute_map:
+              name: jvm.gc.name
+              action: jvm.gc.action
+            apply_to_metrics:
+              - jvm.gc.duration
+        - rename_attributes:
+            attribute_map:
+              daemon: thread.daemon
+            apply_to_metrics:
+              - jvm.threads.count
+        - rename_attributes:
+            attribute_map:
+              pool: jvm.buffer.pool.name
+            apply_to_metrics:
+              - jvm.buffer.memory.usage
+              - jvm.buffer.memory.limit
+              - jvm.buffer.count
+        # https://github.com/open-telemetry/semantic-conventions/pull/89
+        - rename_attributes:
+            attribute_map:
+              state: system.cpu.state
+              cpu: system.cpu.logical_number
+            apply_to_metrics:
+              - system.cpu.time
+              - system.cpu.utilization
+        - rename_attributes:
+            attribute_map:
+              state: system.memory.state
+            apply_to_metrics:
+              - system.memory.usage
+              - system.memory.utilization
+        - rename_attributes:
+            attribute_map:
+              state: system.paging.state
+            apply_to_metrics:
+              - system.paging.usage
+              - system.paging.utilization
+        - rename_attributes:
+            attribute_map:
+              type: system.paging.type
+              direction: system.paging.direction
+            apply_to_metrics:
+              - system.paging.faults
+              - system.paging.operations
+        - rename_attributes:
+            attribute_map:
+              device: system.device
+              direction: system.disk.direction
+            apply_to_metrics:
+              - system.disk.io
+              - system.disk.operations
+              - system.disk.io_time
+              - system.disk.operation_time
+              - system.disk.merged
+        - rename_attributes:
+            attribute_map:
+              device: system.device
+              state: system.filesystem.state
+              type: system.filesystem.type
+              mode: system.filesystem.mode
+              mountpoint: system.filesystem.mountpoint
+            apply_to_metrics:
+              - system.filesystem.usage
+              - system.filesystem.utilization
+        - rename_attributes:
+            attribute_map:
+              device: system.device
+              direction: system.network.direction
+              protocol: network.protocol
+              state: system.network.state
+            apply_to_metrics:
+              - system.network.dropped
+              - system.network.packets
+              - system.network.errors
+              - system.network.io
+              - system.network.connections
+        - rename_attributes:
+            attribute_map:
+              status: system.processes.status
+            apply_to_metrics:
+              - system.processes.count
+        # https://github.com/open-telemetry/semantic-conventions/pull/247
+        - rename_metrics:
+            http.server.request.size: http.server.request.body.size
+            http.server.response.size: http.server.response.body.size
+    resources:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/178
+        - rename_attributes:
+            attribute_map:
+              telemetry.auto.version: telemetry.distro.version
+  1.21.0:
+    spans:
+      changes:
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/3336
+        - rename_attributes:
+            attribute_map:
+              messaging.kafka.client_id: messaging.client_id
+              messaging.rocketmq.client_id: messaging.client_id
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/3402
+        - rename_attributes:
+            attribute_map:
+              # net.peer.(name|port) attributes were usually populated on client side
+              # so they should be usually translated to server.(address|port)
+              # net.host.* attributes were only populated on server side
+              net.host.name: server.address
+              net.host.port: server.port
+              # was only populated on client side
+              net.sock.peer.name: server.socket.domain
+              # net.sock.peer.(addr|port) mapping is not possible
+              # since they applied to both client and server side
+              # were only populated on server side
+              net.sock.host.addr: server.socket.address
+              net.sock.host.port: server.socket.port
+              http.client_ip: client.address
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/3426
+        - rename_attributes:
+            attribute_map:
+              net.protocol.name: network.protocol.name
+              net.protocol.version: network.protocol.version
+              net.host.connection.type: network.connection.type
+              net.host.connection.subtype: network.connection.subtype
+              net.host.carrier.name: network.carrier.name
+              net.host.carrier.mcc: network.carrier.mcc
+              net.host.carrier.mnc: network.carrier.mnc
+              net.host.carrier.icc: network.carrier.icc
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/3355
+        - rename_attributes:
+            attribute_map:
+              http.method: http.request.method
+              http.status_code: http.response.status_code
+              http.scheme: url.scheme
+              http.url: url.full
+              http.request_content_length: http.request.body.size
+              http.response_content_length: http.response.body.size
+    metrics:
+      changes:
+        # https://github.com/open-telemetry/semantic-conventions/pull/53
+        - rename_metrics:
+            process.runtime.jvm.cpu.utilization: process.runtime.jvm.cpu.recent_utilization
+  1.20.0:
+    spans:
+      changes:
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/3272
+        - rename_attributes:
+            attribute_map:
+              net.app.protocol.name: net.protocol.name
+              net.app.protocol.version: net.protocol.version
+  1.19.0:
+    spans:
+      changes:
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/3209
+        - rename_attributes:
+            attribute_map:
+              faas.execution: faas.invocation_id
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/3188
+        - rename_attributes:
+            attribute_map:
+              faas.id: cloud.resource_id
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/3190
+        - rename_attributes:
+            attribute_map:
+              http.user_agent: user_agent.original
+    resources:
+      changes:
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/3190
+        - rename_attributes:
+            attribute_map:
+              browser.user_agent: user_agent.original
+  1.18.0:
+  1.17.0:
+    spans:
+      changes:
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/2957
+        - rename_attributes:
+            attribute_map:
+              messaging.consumer_id: messaging.consumer.id
+              messaging.protocol: net.app.protocol.name
+              messaging.protocol_version: net.app.protocol.version
+              messaging.destination: messaging.destination.name
+              messaging.temp_destination: messaging.destination.temporary
+              messaging.destination_kind: messaging.destination.kind
+              messaging.message_id: messaging.message.id
+              messaging.conversation_id: messaging.message.conversation_id
+              messaging.message_payload_size_bytes: messaging.message.payload_size_bytes
+              messaging.message_payload_compressed_size_bytes: messaging.message.payload_compressed_size_bytes
+              messaging.rabbitmq.routing_key: messaging.rabbitmq.destination.routing_key
+              messaging.kafka.message_key: messaging.kafka.message.key
+              messaging.kafka.partition: messaging.kafka.destination.partition
+              messaging.kafka.tombstone: messaging.kafka.message.tombstone
+              messaging.rocketmq.message_type: messaging.rocketmq.message.type
+              messaging.rocketmq.message_tag: messaging.rocketmq.message.tag
+              messaging.rocketmq.message_keys: messaging.rocketmq.message.keys
+              messaging.kafka.consumer_group: messaging.kafka.consumer.group
+  1.16.0:
+  1.15.0:
+    spans:
+      changes:
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/2743
+        - rename_attributes:
+            attribute_map:
+              http.retry_count: http.resend_count
+  1.14.0:
+  1.13.0:
+    spans:
+      changes:
+        # https://github.com/open-telemetry/opentelemetry-specification/pull/2614
+        - rename_attributes:
+            attribute_map:
+              net.peer.ip: net.sock.peer.addr
+              net.host.ip: net.sock.host.addr
+  1.12.0:
+  1.11.0:
+  1.10.0:
+  1.9.0:
+  1.8.0:
+    spans:
+      changes:
+        - rename_attributes:
+            attribute_map:
+              db.cassandra.keyspace: db.name
+              db.hbase.namespace: db.name
+  1.7.0:
+  1.6.1:
+  1.5.0:
+  1.4.0:

tests/conftest.py

@@ -18,11 +18,14 @@ pytest_plugins = [
     "fixtures.logs",
     "fixtures.traces",
     "fixtures.metrics",
+    "fixtures.queriercommon",
     "fixtures.metadata",
     "fixtures.meter",
     "fixtures.browser",
     "fixtures.keycloak",
     "fixtures.idp",
+    "fixtures.googleidp",
+    "fixtures.tls",
     "fixtures.notification_channel",
     "fixtures.maildev",
     "fixtures.alerts",

tests/fixtures/clickhouse.py

@@ -329,9 +329,6 @@ def clickhouse(
     request: pytest.FixtureRequest,
     pytestconfig: pytest.Config,
 ) -> types.TestContainerClickhouse:
-    """
-    Package-scoped fixture for Clickhouse TestContainer.
-    """
     return create_clickhouse(
         tmpfs=tmpfs,
         network=network,

tests/fixtures/cloudintegrations.py

@@ -1,5 +1,3 @@
-"""Fixtures for cloud integration tests."""
-
 from collections.abc import Callable
 from dataclasses import dataclass, field
 from http import HTTPStatus

tests/fixtures/dashboards.py

@@ -0,0 +1,30 @@
+from http import HTTPStatus
+
+import requests
+
+from fixtures import types
+
+DASHBOARDS_BASE_URL = "/api/v2/dashboards"
+# MaxListLimit caps a single list page, so wiping a shared DB has to drain pages
+# until the list comes back empty.
+MAX_LIST_LIMIT = 200
+
+
+def delete_all_dashboards(signoz: types.SigNoz, token: str) -> None:
+    while True:
+        response = requests.get(
+            signoz.self.host_configs["8080"].get(f"{DASHBOARDS_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+            headers={"Authorization": f"Bearer {token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.OK, response.text
+        dashboards = response.json()["data"]["dashboards"]
+        if not dashboards:
+            return
+        for dashboard in dashboards:
+            del_res = requests.delete(
+                signoz.self.host_configs["8080"].get(f"{DASHBOARDS_BASE_URL}/{dashboard['id']}"),
+                headers={"Authorization": f"Bearer {token}"},
+                timeout=5,
+            )
+            assert del_res.status_code == HTTPStatus.NO_CONTENT, del_res.text

tests/fixtures/googleidp.py

@@ -0,0 +1,231 @@
+import functools
+import time
+from collections.abc import Callable
+from http import HTTPStatus
+from pathlib import Path
+from urllib.parse import urlparse
+
+import docker
+import docker.errors
+import pytest
+import requests
+from jwcrypto import jwk, jwt
+from testcontainers.core.container import Network
+from wiremock.resources.mappings import HttpMethods, Mapping, MappingRequest, MappingResponse
+from wiremock.testing.testcontainer import WireMockContainer
+
+from fixtures import reuse, types
+from fixtures.logger import setup_logger
+from fixtures.tls import CA_ID_LABEL, KEYSTORE_PASSWORD, ca_id, issue_server_keystore
+
+logger = setup_logger(__name__)
+
+# The google callback authn hardcodes Google's issuer, so the mock must be
+# reachable as accounts.google.com over TLS from the signoz container: the
+# wiremock container joins the network under that alias and serves HTTPS on 443
+# with a certificate issued by the integration CA that signoz trusts.
+ISSUER = "https://accounts.google.com"
+ISSUER_HOST = "accounts.google.com"
+
+GOOGLE_DOMAIN = "google.integration.test"
+
+
+# One signing key for the whole session: the token and JWKS stubs are always
+# installed together, so per-call keys would only add RSA keygen latency.
+@functools.cache
+def signing_key() -> jwk.JWK:
+    return jwk.JWK.generate(kty="RSA", size=2048, kid="googleidp-integration", use="sig", alg="RS256")
+
+
+def perform_google_login(
+    signoz: types.SigNoz,
+    googleidp: types.TestContainerDocker,
+    get_session_context: Callable[[str], dict],
+    email: str,
+) -> str:
+    """Drive the google login flow for email and return the final redirect URL.
+
+    The authorize URL points at https://accounts.google.com (resolvable only
+    inside the docker network), so it is rewritten to the mock's host-mapped
+    port, mirroring how the oidc suite rewrites keycloak URLs.
+    """
+    session_context = get_session_context(email)
+
+    assert len(session_context["orgs"]) == 1
+    assert len(session_context["orgs"][0]["authNSupport"]["callback"]) == 1
+
+    url = session_context["orgs"][0]["authNSupport"]["callback"][0]["url"]
+    assert url.startswith(f"{ISSUER}/")
+
+    parsed_url = urlparse(url)
+    authorize_url = googleidp.host_configs["8080"].get(f"{parsed_url.path}?{parsed_url.query}")
+
+    response = requests.get(authorize_url, allow_redirects=False, timeout=5)
+    assert response.status_code == HTTPStatus.FOUND
+
+    callback_url = response.headers["Location"]
+    assert "/api/v1/complete/google" in callback_url
+
+    response = requests.get(callback_url, allow_redirects=False, timeout=30)
+    assert response.status_code == HTTPStatus.SEE_OTHER
+
+    return response.headers["Location"]
+
+
+def get_google_domain(signoz: types.SigNoz, admin_token: str) -> dict:
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v1/domains"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=2,
+    )
+    return next(
+        (domain for domain in response.json()["data"] if domain["name"] == GOOGLE_DOMAIN),
+        None,
+    )
+
+
+def google_oidc_mappings(email: str, name: str, hd: str, audience: str, email_verified: bool = True) -> list[Mapping]:
+    """Wiremock mappings for one Google OIDC login: discovery, an auto-approving
+    authorize redirect, a token response with an RS256 id_token for the given
+    identity, and the JWKS the signoz container verifies it against."""
+    now = int(time.time())
+    token = jwt.JWT(
+        header={"alg": "RS256", "kid": signing_key()["kid"], "typ": "JWT"},
+        claims={
+            "iss": ISSUER,
+            "aud": audience,
+            "sub": f"google-oauth2|{email}",
+            "email": email,
+            "email_verified": email_verified,
+            "name": name,
+            "hd": hd,
+            "iat": now,
+            "exp": now + 3600,
+        },
+    )
+    token.make_signed_token(signing_key())
+    id_token = token.serialize()
+
+    return [
+        Mapping(
+            request=MappingRequest(method=HttpMethods.GET, url_path="/.well-known/openid-configuration"),
+            response=MappingResponse(
+                status=200,
+                json_body={
+                    "issuer": ISSUER,
+                    "authorization_endpoint": f"{ISSUER}/o/oauth2/v2/auth",
+                    "token_endpoint": f"{ISSUER}/token",
+                    "jwks_uri": f"{ISSUER}/jwks",
+                    "response_types_supported": ["code"],
+                    "subject_types_supported": ["public"],
+                    "id_token_signing_alg_values_supported": ["RS256"],
+                    "scopes_supported": ["openid", "email", "profile"],
+                    "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
+                },
+            ),
+        ),
+        Mapping(
+            request=MappingRequest(method=HttpMethods.GET, url_path="/o/oauth2/v2/auth"),
+            response=MappingResponse(
+                status=302,
+                headers={
+                    # Triple-stache: redirect_uri and state are URLs; handlebars
+                    # would otherwise HTML-escape their special characters.
+                    # request.query values arrive URL-decoded, so the state is
+                    # re-encoded into the redirect exactly as google does.
+                    "Location": "{{{request.query.redirect_uri}}}?code=integration-test-code&state={{{urlEncode request.query.state}}}",
+                },
+                transformers=["response-template"],
+            ),
+        ),
+        Mapping(
+            request=MappingRequest(method=HttpMethods.POST, url_path="/token"),
+            response=MappingResponse(
+                status=200,
+                json_body={
+                    "access_token": "integration-test-access-token",
+                    "token_type": "Bearer",
+                    "expires_in": 3600,
+                    "id_token": id_token,
+                },
+            ),
+        ),
+        Mapping(
+            request=MappingRequest(method=HttpMethods.GET, url_path="/jwks"),
+            response=MappingResponse(
+                status=200,
+                json_body={"keys": [signing_key().export_public(as_dict=True)]},
+            ),
+        ),
+    ]
+
+
+@pytest.fixture(name="googleidp", scope="package")
+def googleidp(  # pylint: disable=too-many-arguments,too-many-positional-arguments
+    network: Network,
+    tls: types.TLS,
+    tmpfs: Callable[[str], Path],
+    request: pytest.FixtureRequest,
+    pytestconfig: pytest.Config,
+) -> types.TestContainerDocker:
+    """Wiremock impersonating Google's OIDC provider. Stubs are installed per
+    test via make_http_mocks with google_oidc_mappings; port 8080 serves the
+    admin API and the authorize redirect to the test process."""
+
+    def create() -> types.TestContainerDocker:
+        keystore_path = issue_server_keystore(tls, tmpfs("googleidp-certs"), ISSUER_HOST)
+
+        container = WireMockContainer(image="wiremock/wiremock:2.35.1-1", secure=False)
+        container.with_volume_mapping(str(keystore_path.parent), "/certs", "ro")
+        container.with_network(network)
+        container.with_network_aliases(ISSUER_HOST)
+        container.with_kwargs(labels={CA_ID_LABEL: ca_id(tls)})
+
+        try:
+            container.start(f"--port 8080 --https-port 443 --https-keystore /certs/keystore.p12 --keystore-type PKCS12 --keystore-password {KEYSTORE_PASSWORD} --local-response-templating")
+        except Exception:
+            # Ryuk is disabled: a started-but-unready container would survive
+            # and keep squatting on the accounts.google.com alias, poisoning
+            # DNS for any replacement on the shared network.
+            container.stop()
+            raise
+
+        return types.TestContainerDocker(
+            id=container.get_wrapped_container().id,
+            host_configs={
+                "8080": types.TestContainerUrlConfig("http", container.get_container_host_ip(), container.get_exposed_port(8080)),
+            },
+            container_configs={
+                "443": types.TestContainerUrlConfig("https", ISSUER_HOST, 443),
+            },
+        )
+
+    def delete(container: types.TestContainerDocker) -> None:
+        client = docker.from_env()
+        try:
+            client.containers.get(container_id=container.id).stop()
+            client.containers.get(container_id=container.id).remove(v=True)
+        except docker.errors.NotFound:
+            logger.info("googleidp container %s already gone", container.id)
+
+    def restore(cache: dict) -> types.TestContainerDocker:
+        return types.TestContainerDocker.from_cache(cache)
+
+    def stale(container: types.TestContainerDocker) -> bool:
+        client = docker.from_env()
+        try:
+            labels = client.containers.get(container_id=container.id).attrs["Config"]["Labels"]
+        except docker.errors.NotFound:
+            return True
+        return labels.get(CA_ID_LABEL) != ca_id(tls)
+
+    return reuse.wrap(
+        request,
+        pytestconfig,
+        "googleidp",
+        lambda: types.TestContainerDocker(id="", host_configs={}, container_configs={}),
+        create,
+        delete,
+        restore,
+        stale=stale,
+    )

tests/fixtures/http.py

@@ -24,9 +24,6 @@ def zeus(
     request: pytest.FixtureRequest,
     pytestconfig: pytest.Config,
 ) -> types.TestContainerDocker:
-    """
-    Package-scoped fixture for running zeus
-    """
 
     def create() -> types.TestContainerDocker:
         container = WireMockContainer(image="wiremock/wiremock:2.35.1-1", secure=False)
@@ -76,9 +73,6 @@ def gateway(
     request: pytest.FixtureRequest,
     pytestconfig: pytest.Config,
 ) -> types.TestContainerDocker:
-    """
-    Package-scoped fixture for running gateway
-    """
 
     def create() -> types.TestContainerDocker:
         container = WireMockContainer(image="wiremock/wiremock:2.35.1-1", secure=False)

tests/fixtures/idp.py

@@ -7,6 +7,7 @@ import pytest
 import requests
 from keycloak import KeycloakAdmin
 from selenium import webdriver
+from selenium.common.exceptions import WebDriverException
 from selenium.webdriver.common.by import By
 from selenium.webdriver.support import expected_conditions as EC
 from selenium.webdriver.support.wait import WebDriverWait
@@ -370,18 +371,26 @@ def idp_login(driver: webdriver.Chrome) -> Callable[[str, str], None]:
         password_field.send_keys(password)
 
         # Click the login button
+        idp_host = urlparse(driver.current_url).netloc
         login_button = wait.until(EC.element_to_be_clickable((By.ID, "kc-login")))
         login_button.click()
 
-        # Wait till kc-login element has vanished from the page, which means that a redirection is taking place.
-        wait.until(EC.invisibility_of_element((By.ID, "kc-login")))
+        # Wait till the browser has left the idp host — not just the login page: keycloak's SAML flow inserts an
+        # auto-submitting interstitial on the idp whose POST is what creates the user in signoz. The button is
+        # re-queried per poll; a mid-navigation WebDriverException (detached node) just retries the poll.
+        def _left_idp(drv: webdriver.Chrome) -> bool:
+            try:
+                return urlparse(drv.current_url).netloc != idp_host and not drv.find_elements(By.ID, "kc-login")
+            except WebDriverException:
+                return False
+
+        wait.until(_left_idp)
 
     return _idp_login
 
 
 @pytest.fixture(name="create_group_idp", scope="function")
 def create_group_idp(idp: types.TestContainerIDP) -> Callable[[str], str]:
-    """Creates a group in Keycloak IDP."""
     client = KeycloakAdmin(
         server_url=idp.container.host_configs["6060"].base(),
         username=IDP_ROOT_USERNAME,
@@ -410,7 +419,6 @@ def create_user_idp_with_groups(
     idp: types.TestContainerIDP,
     create_group_idp: Callable[[str], str],  # pylint: disable=redefined-outer-name
 ) -> Callable[[str, str, bool, list[str]], None]:
-    """Creates a user in Keycloak IDP with specified groups."""
     client = KeycloakAdmin(
         server_url=idp.container.host_configs["6060"].base(),
         username=IDP_ROOT_USERNAME,
@@ -458,7 +466,6 @@ def add_user_to_group(
     idp: types.TestContainerIDP,
     create_group_idp: Callable[[str], str],  # pylint: disable=redefined-outer-name
 ) -> Callable[[str, str], None]:
-    """Adds an existing user to a group."""
     client = KeycloakAdmin(
         server_url=idp.container.host_configs["6060"].base(),
         username=IDP_ROOT_USERNAME,
@@ -479,7 +486,6 @@ def create_user_idp_with_role(
     idp: types.TestContainerIDP,
     create_group_idp: Callable[[str], str],  # pylint: disable=redefined-outer-name
 ) -> Callable[[str, str, bool, str, list[str]], None]:
-    """Creates a user in Keycloak IDP with a custom role attribute and optional groups."""
     client = KeycloakAdmin(
         server_url=idp.container.host_configs["6060"].base(),
         username=IDP_ROOT_USERNAME,
@@ -527,7 +533,6 @@ def create_user_idp_with_role(
 
 @pytest.fixture(name="setup_user_profile", scope="package")
 def setup_user_profile(idp: types.TestContainerIDP) -> Callable[[], None]:
-    """Setup Keycloak User Profile with signoz_role attribute."""
 
     def _setup_user_profile() -> None:
         client = KeycloakAdmin(
@@ -568,7 +573,6 @@ def setup_user_profile(idp: types.TestContainerIDP) -> Callable[[], None]:
 
 
 def _ensure_groups_client_scope(client: KeycloakAdmin) -> None:
-    """Create 'groups' client scope if it doesn't exist."""
     # Check if groups scope exists
     scopes = client.get_client_scopes()
     groups_scope_exists = any(s.get("name") == "groups" for s in scopes)
@@ -619,7 +623,6 @@ def _ensure_groups_client_scope(client: KeycloakAdmin) -> None:
 
 
 def get_oidc_domain(signoz: types.SigNoz, admin_token: str) -> dict:
-    """Helper to get the OIDC domain."""
     response = requests.get(
         signoz.self.host_configs["8080"].get("/api/v1/domains"),
         headers={"Authorization": f"Bearer {admin_token}"},
@@ -632,7 +635,6 @@ def get_oidc_domain(signoz: types.SigNoz, admin_token: str) -> dict:
 
 
 def get_user_by_email(signoz: types.SigNoz, admin_token: str, email: str) -> dict:
-    """Helper to get a user by email."""
     response = requests.get(
         signoz.self.host_configs["8080"].get("/api/v1/user"),
         timeout=2,
@@ -653,7 +655,6 @@ def perform_oidc_login(
     email: str,
     password: str,
 ) -> None:
-    """Helper to perform OIDC login flow."""
     session_context = get_session_context(email)
     url = session_context["orgs"][0]["authNSupport"]["callback"][0]["url"]
     parsed_url = urlparse(url)

tests/fixtures/inframonitoring.py

@@ -1,5 +1,3 @@
-"""Shared constants/helpers for v2 infra-monitoring pod-status tests."""
-
 # All 18 PodCountsByStatus buckets (camelCase, matches inframonitoringtypes.PodCountsByStatus / the API response).
 STATUS_BUCKETS = (
     "pending",
@@ -50,3 +48,22 @@ def expected_status_counts(**nonzero: int) -> dict:
     counts = {bucket: 0 for bucket in STATUS_BUCKETS}
     counts.update(nonzero)
     return counts
+
+
+# All buckets of the clusters-API per-group resource counts (camelCase, matches
+# inframonitoringtypes ClusterRecord.Counts / the API response).
+RESOURCE_COUNT_BUCKETS = (
+    "nodes",
+    "namespaces",
+    "deployments",
+    "daemonSets",
+    "jobs",
+    "statefulSets",
+)
+
+
+def expected_resource_counts(**nonzero: int) -> dict:
+    """Full resource-counts dict with the given buckets set, rest 0."""
+    counts = {bucket: 0 for bucket in RESOURCE_COUNT_BUCKETS}
+    counts.update(nonzero)
+    return counts

tests/fixtures/jsontypes.py

@@ -1,9 +1,3 @@
-"""
-Simpler version of metadataexporter for exporting jsontypes for test fixtures.
-This exports JSON type metadata to the path_types table by parsing JSON bodies
-and extracting all paths with their types, similar to how the real metadataexporter works.
-"""
-
 import datetime
 import json
 from abc import ABC
@@ -21,8 +15,6 @@ from fixtures import types
 
 
 class JSONPathType(ABC):
-    """Represents a JSON path with its type information"""
-
     field_name: str
     field_data_type: str
     last_seen: np.uint64
@@ -44,7 +36,6 @@ class JSONPathType(ABC):
         self.last_seen = np.uint64(int(last_seen.timestamp() * 1e9))
 
     def np_arr(self) -> np.array:
-        """Return path type data as numpy array for database insertion"""
         return np.array([self.signal, self.field_context, self.field_name, self.field_data_type, self.last_seen])
 
 
@@ -145,7 +136,7 @@ def _python_type_to_clickhouse_type(value: Any) -> str:
     elif isinstance(value, dict):
         return "json"
     else:
-        return "string"  # Default fallback
+        return "string"
 
 
 def _extract_json_paths(
@@ -154,19 +145,7 @@ def _extract_json_paths(
     path_types: dict[str, set[str]] | None = None,
     level: int = 0,
 ) -> dict[str, set[str]]:
-    """
-    Recursively extract all paths and their types from a JSON object.
-    Matches metadataexporter's analyzePValue logic.
-
-    Args:
-        obj: The JSON object to traverse
-        current_path: Current path being built (e.g., "user.name")
-        path_types: Dictionary mapping paths to sets of types found
-        level: Current nesting level (for depth limiting)
-
-    Returns:
-        Dictionary mapping paths to sets of type strings
-    """
+    """Matches metadataexporter's analyzePValue logic."""
     if path_types is None:
         path_types = {}
 
@@ -179,17 +158,14 @@ def _extract_json_paths(
         # Matches Go walkMap which recurses without calling ta.record on the map node.
 
         for key, value in obj.items():
-            # Build the path for this key
             if current_path:
                 new_path = f"{current_path}.{key}"
             else:
                 new_path = key
 
-            # Recurse into the value
             _extract_json_paths(value, new_path, path_types, level + 1)
 
     elif isinstance(obj, list):
-        # Skip empty arrays
         if len(obj) == 0:
             return path_types
 
@@ -246,17 +222,6 @@ def _parse_json_bodies_and_extract_paths(
     json_bodies: list[str],
     timestamp: datetime.datetime | None = None,
 ) -> list[JSONPathType]:
-    """
-    Parse JSON bodies and extract all paths with their types.
-    This mimics the behavior of metadataexporter.
-
-    Args:
-        json_bodies: List of JSON body strings to parse
-        timestamp: Timestamp to use for last_seen (defaults to now)
-
-    Returns:
-        List of JSONPathType objects with all discovered paths and types
-    """
     if timestamp is None:
         timestamp = datetime.datetime.now()
 
@@ -268,11 +233,9 @@ def _parse_json_bodies_and_extract_paths(
             parsed = json.loads(json_body)
             _extract_json_paths(parsed, "", all_path_types, level=0)
         except (json.JSONDecodeError, TypeError):
-            # Skip invalid JSON
             continue
 
-    # Convert to list of JSONPathType objects
-    # Each path can have multiple types, so we create one JSONPathType per type
+    # Each path can have multiple types -> one JSONPathType per type
     path_type_objects: list[JSONPathType] = []
     for path, types_set in all_path_types.items():
         for type_str in types_set:
@@ -285,64 +248,34 @@ def _parse_json_bodies_and_extract_paths(
 def export_json_types(
     clickhouse: types.TestContainerClickhouse,
 ) -> Generator[Callable[[list[JSONPathType] | list[str] | list[Any]], None], Any]:
-    """
-    Fixture for exporting JSON type metadata to the path_types table.
-    This is a simpler version of metadataexporter for test fixtures.
+    """Write JSON path/type metadata the way the real metadataexporter would.
 
-    The function can accept:
-    1. List of JSONPathType objects (manual specification)
-    2. List of JSON body strings (auto-extract paths)
-    3. List of Logs objects (extract from body_json field)
-
-    Usage examples:
-        # Manual specification
-        export_json_types([
-            JSONPathType(field_name="user.name", field_data_type="string"),
-            JSONPathType(field_name="user.age", field_data_type="int64"),
-        ])
-
-        # Auto-extract from JSON strings
-        export_json_types([
-            '{"user": {"name": "alice", "age": 25}}',
-            '{"user": {"name": "bob", "age": 30}}',
-        ])
-
-        # Auto-extract from Logs objects
-        export_json_types(logs_list)
+    Accepts JSONPathType objects (manual specification), raw JSON body strings,
+    or Logs objects (paths auto-extracted from the JSON body).
     """
 
     def _export_json_types(
         data: list[JSONPathType] | list[str] | list[Any],  # List[Logs] but avoiding circular import
     ) -> None:
-        """
-        Export JSON type metadata to signoz_metadata.distributed_field_keys table.
-        This table stores signal, context, path, and type information for body JSON fields.
-        """
         path_types: list[JSONPathType] = []
 
         if len(data) == 0:
             return
 
-        # Determine input type and convert to JSONPathType list
         first_item = data[0]
 
         if isinstance(first_item, JSONPathType):
-            # Already JSONPathType objects
             path_types = data  # type: ignore
         elif isinstance(first_item, str):
-            # List of JSON strings - parse and extract paths
             path_types = _parse_json_bodies_and_extract_paths(data)  # type: ignore
         else:
             # Assume it's a list of Logs objects - extract body_v2
             json_bodies: list[str] = []
             for log in data:  # type: ignore
-                # Try to get body_v2 attribute
                 if hasattr(log, "body_v2") and log.body_v2:
                     json_bodies.append(log.body_v2)
                 elif hasattr(log, "body") and log.body:
-                    # Fallback to body if body_v2 not available
                     try:
-                        # Try to parse as JSON
                         json.loads(log.body)
                         json_bodies.append(log.body)
                     except (json.JSONDecodeError, TypeError):
@@ -369,7 +302,6 @@ def export_json_types(
 
     yield _export_json_types
 
-    # Cleanup - truncate the local table after tests (following pattern from logs fixture)
     clickhouse.conn.query(f"TRUNCATE TABLE signoz_metadata.field_keys ON CLUSTER '{clickhouse.env['SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_CLUSTER']}' SYNC")
 
 

tests/fixtures/keeper.py

@@ -109,9 +109,6 @@ def keeper(
     request: pytest.FixtureRequest,
     pytestconfig: pytest.Config,
 ) -> types.TestContainerDocker:
-    """
-    Package-scoped fixture for ClickHouse Keeper TestContainer.
-    """
     return create_clickhouse_keeper(
         tmpfs=tmpfs,
         network=network,

tests/fixtures/keycloak.py

@@ -19,9 +19,6 @@ def idp(
     request: pytest.FixtureRequest,
     pytestconfig: pytest.Config,
 ) -> types.TestContainerIDP:
-    """
-    Package-scoped fixture for running an idp for SSO/SAML
-    """
 
     def create() -> types.TestContainerIDP:
         container = KeycloakContainer(

tests/fixtures/logs.py

@@ -311,7 +311,6 @@ class Logs(ABC):
         self.attribute_keys.append(LogsResourceOrAttributeKeys(name="severity_number", datatype="float64"))
 
     def _get_severity_number(self, severity_text: str) -> np.uint8:
-        """Convert severity text to numeric value"""
         severity_map = {
             "TRACE": 1,
             "DEBUG": 5,
@@ -324,7 +323,6 @@ class Logs(ABC):
         return np.uint8(severity_map.get(severity_text.upper(), 9))  # Default to INFO
 
     def np_arr(self) -> np.array:
-        """Return log data as numpy array for database insertion"""
         return np.array(
             [
                 self.ts_bucket_start,
@@ -356,7 +354,6 @@ class Logs(ABC):
         cls,
         data: dict,
     ) -> "Logs":
-        """Create a Logs instance from a dict."""
         # parse timestamp from iso format
         timestamp = parse_timestamp(data["timestamp"])
         return cls(

tests/fixtures/metrics.py

@@ -374,6 +374,7 @@ class Metrics(ABC):
         file_path: str,
         base_time: datetime.datetime | None = None,
         metric_name_override: str | None = None,
+        label_substitutions: dict[str, str] | None = None,
     ) -> list["Metrics"]:
         """
         Load metrics from a JSONL file.
@@ -385,6 +386,9 @@ class Metrics(ABC):
             base_time: If provided, all timestamps are shifted so the earliest
                        timestamp in the file maps to base_time
             metric_name_override: If provided, overrides metric_name for all metrics
+            label_substitutions: If provided, any label whose value equals a key is
+                                 rewritten to that key's value (placeholder substitution,
+                                 e.g. {"__START_TIME__": start_time.isoformat()})
         """
         data_list = []
         with open(file_path, encoding="utf-8") as f:
@@ -392,7 +396,13 @@ class Metrics(ABC):
                 line = line.strip()
                 if not line:
                     continue
-                data_list.append(json.loads(line))
+                data = json.loads(line)
+                if label_substitutions:
+                    labels = data.get("labels", {})
+                    for key, value in labels.items():
+                        if value in label_substitutions:
+                            labels[key] = label_substitutions[value]
+                data_list.append(data)
 
         if not data_list:
             return []

tests/fixtures/migrator.py

@@ -92,9 +92,6 @@ def migrator(
     request: pytest.FixtureRequest,
     pytestconfig: pytest.Config,
 ) -> types.Operation:
-    """
-    Package-scoped fixture for running schema migrations.
-    """
     return create_migrator(
         network=network,
         clickhouse=clickhouse,

tests/fixtures/network.py

@@ -13,9 +13,6 @@ logger = setup_logger(__name__)
 
 @pytest.fixture(name="network", scope="package")
 def network(request: pytest.FixtureRequest, pytestconfig: pytest.Config) -> types.Network:
-    """
-    Package-Scoped fixture for creating a network
-    """
 
     def create() -> types.Network:
         nw = Network()

tests/fixtures/postgres.py

@@ -13,9 +13,6 @@ logger = setup_logger(__name__)
 
 @pytest.fixture(name="postgres", scope="package")
 def postgres(network: Network, request: pytest.FixtureRequest, pytestconfig: pytest.Config) -> types.TestContainerSQL:
-    """
-    Package-scoped fixture for PostgreSQL TestContainer.
-    """
 
     def create() -> types.TestContainerSQL:
         version = request.config.getoption("--postgres-version")