test(authz): mock the useAuthZ hook in the CreateEdit payload suites

cmd/authz.go

@@ -94,6 +94,7 @@ func runGenerateAuthz(_ context.Context) error {
 
 	allowedResources := map[string]bool{
 		coretypes.NewResourceRef(coretypes.ResourceServiceAccount).String():                true,
+		coretypes.NewResourceRef(coretypes.ResourceMetaResourceAuthDomain).String():        true,
 		coretypes.NewResourceRef(coretypes.ResourceRole).String():                          true,
 		coretypes.NewResourceRef(coretypes.ResourceMetaResourceFactorAPIKey).String():      true,
 		coretypes.NewResourceRef(coretypes.ResourceTelemetryResourceLogs).String():         true,

docs/api/openapi.yml

@@ -8801,7 +8801,6 @@ components:
       - span
       - trace
       - resource
-      - scope
       - attribute
       - body
       - ""
@@ -15469,8 +15468,10 @@ paths:
                 $ref: '#/components/schemas/RenderErrorResponse'
           description: Internal Server Error
       security:
-      - api_key: []
-      - tokenizer: []
+      - api_key:
+        - VIEWER
+      - tokenizer:
+        - VIEWER
       summary: Get features
       tags:
       - features
@@ -22949,73 +22950,6 @@ paths:
       summary: Rotate session
       tags:
       - sessions
-  /api/v2/system/dashboards/{name}:
-    get:
-      deprecated: false
-      description: Returns a dashboard SigNoz ships and owns, addressed by its stable
-        definition name (e.g. `ai-o11y-overview`) rather than its id. System dashboards
-        are read-only and upgraded through releases. The dashboard's own `name` field
-        carries a reserved prefix that the path segment must not include.
-      operationId: GetSystemDashboard
-      parameters:
-      - in: path
-        name: name
-        required: true
-        schema:
-          type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/DashboardtypesGettableDashboardV2'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - dashboard:read
-      - tokenizer:
-        - dashboard:read
-      summary: Get system dashboard
-      tags:
-      - dashboard
   /api/v2/user_roles:
     post:
       deprecated: false

ee/modules/dashboard/impldashboard/module.go

@@ -276,10 +276,6 @@ func (module *module) GetV2(ctx context.Context, orgID valuer.UUID, id valuer.UU
 	return module.pkgDashboardModule.GetV2(ctx, orgID, id)
 }
 
-func (module *module) GetByNameV2(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error) {
-	return module.pkgDashboardModule.GetByNameV2(ctx, orgID, name)
-}
-
 func (module *module) MigrateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*dashboardtypes.DashboardV2, error) {
 	return module.pkgDashboardModule.MigrateV2(ctx, orgID, id)
 }
@@ -288,10 +284,6 @@ func (module *module) UpdateV2(ctx context.Context, orgID valuer.UUID, id valuer
 	return module.pkgDashboardModule.UpdateV2(ctx, orgID, id, updatedBy, updatable)
 }
 
-func (module *module) UpdateUnsafeV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2) (*dashboardtypes.DashboardV2, error) {
-	return module.pkgDashboardModule.UpdateUnsafeV2(ctx, orgID, id, updatedBy, updatable)
-}
-
 func (module *module) PatchV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, patch dashboardtypes.PatchableDashboardV2) (*dashboardtypes.DashboardV2, error) {
 	return module.pkgDashboardModule.PatchV2(ctx, orgID, id, updatedBy, patch)
 }

ee/query-service/app/api/api.go

@@ -67,7 +67,7 @@ func (ah *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 	// note: add ee override methods first
 
 	// routes available only in ee version
-	router.HandleFunc("/api/v1/features", am.OpenAccess(ah.getFeatureFlags)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v1/features", am.ViewAccess(ah.getFeatureFlags)).Methods(http.MethodGet)
 
 	// base overrides
 	router.HandleFunc("/api/v1/version", am.OpenAccess(ah.getVersion)).Methods(http.MethodGet)

frontend/src/AppRoutes/__tests__/Private.test.tsx

@@ -1541,6 +1541,7 @@ describe('PrivateRoute', () => {
 				path: ROUTES.SERVICE_ACCOUNTS_SETTINGS,
 				deniedRoles: DENIED_ROLES,
 			},
+			ORG_SETTINGS: { path: ROUTES.ORG_SETTINGS, deniedRoles: DENIED_ROLES },
 			TRACES_EXPLORER: { path: ROUTES.TRACES_EXPLORER, deniedRoles: DENIED_ROLES },
 			TRACE: { path: ROUTES.TRACE, deniedRoles: DENIED_ROLES },
 			TRACE_DETAIL: {

frontend/src/api/generated/services/dashboard/index.ts

@@ -46,8 +46,6 @@ import type {
 	GetPublicDashboardPathParameters,
 	GetPublicDashboardWidgetQueryRange200,
 	GetPublicDashboardWidgetQueryRangePathParameters,
-	GetSystemDashboard200,
-	GetSystemDashboardPathParameters,
 	ListDashboardViews200,
 	ListDashboardsForUserV2200,
 	ListDashboardsForUserV2Params,
@@ -2113,108 +2111,6 @@ export const invalidateGetPublicDashboardPanelQueryRangeV2 = async (
 	return queryClient;
 };
 
-/**
- * Returns a dashboard SigNoz ships and owns, addressed by its stable definition name (e.g. `ai-o11y-overview`) rather than its id. System dashboards are read-only and upgraded through releases. The dashboard's own `name` field carries a reserved prefix that the path segment must not include.
- * @summary Get system dashboard
- */
-export const getSystemDashboard = (
-	{ name }: GetSystemDashboardPathParameters,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<GetSystemDashboard200>({
-		url: `/api/v2/system/dashboards/${name}`,
-		method: 'GET',
-		signal,
-	});
-};
-
-export const getGetSystemDashboardQueryKey = ({
-	name,
-}: GetSystemDashboardPathParameters) => {
-	return [`/api/v2/system/dashboards/${name}`] as const;
-};
-
-export const getGetSystemDashboardQueryOptions = <
-	TData = Awaited<ReturnType<typeof getSystemDashboard>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ name }: GetSystemDashboardPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getSystemDashboard>>,
-			TError,
-			TData
-		>;
-	},
-) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey =
-		queryOptions?.queryKey ?? getGetSystemDashboardQueryKey({ name });
-
-	const queryFn: QueryFunction<
-		Awaited<ReturnType<typeof getSystemDashboard>>
-	> = ({ signal }) => getSystemDashboard({ name }, signal);
-
-	return {
-		queryKey,
-		queryFn,
-		enabled: !!name,
-		...queryOptions,
-	} as UseQueryOptions<
-		Awaited<ReturnType<typeof getSystemDashboard>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type GetSystemDashboardQueryResult = NonNullable<
-	Awaited<ReturnType<typeof getSystemDashboard>>
->;
-export type GetSystemDashboardQueryError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Get system dashboard
- */
-
-export function useGetSystemDashboard<
-	TData = Awaited<ReturnType<typeof getSystemDashboard>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ name }: GetSystemDashboardPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getSystemDashboard>>,
-			TError,
-			TData
-		>;
-	},
-): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getGetSystemDashboardQueryOptions({ name }, options);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return { ...query, queryKey: queryOptions.queryKey };
-}
-
-/**
- * @summary Get system dashboard
- */
-export const invalidateGetSystemDashboard = async (
-	queryClient: QueryClient,
-	{ name }: GetSystemDashboardPathParameters,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getGetSystemDashboardQueryKey({ name }) },
-		options,
-	);
-
-	return queryClient;
-};
-
 /**
  * Same as ListDashboardsV2 but personalized for the calling user: each dashboard carries the caller's `pinned` state, and pinned dashboards float to the top of the requested ordering. Supports the same filter DSL, sort, order, and pagination.
  * @summary List dashboards for the current user (v2)

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -3492,7 +3492,6 @@ export enum TelemetrytypesFieldContextDTO {
 	span = 'span',
 	trace = 'trace',
 	resource = 'resource',
-	scope = 'scope',
 	attribute = 'attribute',
 	body = 'body',
 	'' = '',
@@ -12251,17 +12250,6 @@ export type RotateSession200 = {
 	status: string;
 };
 
-export type GetSystemDashboardPathParameters = {
-	name: string;
-};
-export type GetSystemDashboard200 = {
-	data: DashboardtypesGettableDashboardV2DTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
 export type CreateUserRole201 = {
 	data: TypesIdentifiableDTO;
 	/**

frontend/src/container/AlertHistory/Timeline/Table/utils.ts

@@ -10,7 +10,6 @@ const fieldContextToSuggestionMap: Record<
 	[TelemetrytypesFieldContextDTO.attribute]: 'attribute',
 	// no maps for the following values on suggestion context
 	[TelemetrytypesFieldContextDTO.trace]: undefined,
-	[TelemetrytypesFieldContextDTO.scope]: undefined,
 	[TelemetrytypesFieldContextDTO.body]: undefined,
 	[TelemetrytypesFieldContextDTO.metric]: undefined,
 	[TelemetrytypesFieldContextDTO.log]: undefined,

frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.tsx

@@ -14,6 +14,8 @@ import {
 } from 'api/generated/services/sigNoz.schemas';
 import { AxiosError } from 'axios';
 import { FeatureKeys } from 'constants/features';
+import AuthZButton from 'lib/authz/components/AuthZButton/AuthZButton';
+import { buildAuthDomainUpdatePermission } from 'lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions';
 import { defaultTo } from 'lodash-es';
 import { useAppContext } from 'providers/App/App';
 import { useErrorModal } from 'providers/ErrorModalProvider';
@@ -209,7 +211,11 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 									Cancel
 								</Button>
 							)}
-							<Button
+							<AuthZButton
+								checks={
+									isCreate ? [] : [buildAuthDomainUpdatePermission(record?.id ?? '')]
+								}
+								withPortal={false}
 								onClick={onSubmitHandler}
 								variant="solid"
 								color="primary"
@@ -217,7 +223,7 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 								testId="auth-domain-save"
 							>
 								Save Changes
-							</Button>
+							</AuthZButton>
 						</section>
 					</div>
 				)}

frontend/src/container/OrganizationSettings/AuthDomain/SSOEnforcementToggle.tsx

@@ -7,6 +7,8 @@ import {
 	RenderErrorResponseDTO,
 } from 'api/generated/services/sigNoz.schemas';
 import { AxiosError } from 'axios';
+import AuthZTooltip from 'lib/authz/components/AuthZTooltip/AuthZTooltip';
+import { buildAuthDomainUpdatePermission } from 'lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions';
 import { useErrorModal } from 'providers/ErrorModalProvider';
 import { ErrorV2Resp } from 'types/api';
 import APIError from 'types/api/error';
@@ -60,12 +62,14 @@ function SSOEnforcementToggle({
 	};
 
 	return (
-		<Switch
-			disabled={isLoading}
-			value={isChecked}
-			onChange={onChangeHandler}
-			testId="auth-domain-enforce-sso"
-		/>
+		<AuthZTooltip checks={[buildAuthDomainUpdatePermission(record.id ?? '')]}>
+			<Switch
+				disabled={isLoading}
+				value={isChecked}
+				onChange={onChangeHandler}
+				testId="auth-domain-enforce-sso"
+			/>
+		</AuthZTooltip>
 	);
 }
 

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/AuthDomain.authz.test.tsx

@@ -0,0 +1,164 @@
+import {
+	AuthDomainListPermission,
+	buildAuthDomainDeletePermission,
+} from 'lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions';
+import {
+	AUTHZ_CHECK_URL,
+	setupAuthzAdmin,
+	setupAuthzAllow,
+	setupAuthzDenyAll,
+	setupAuthzGrantByPrefix,
+} from 'lib/authz/utils/authz-test-utils';
+import { rest, server } from 'mocks-server/server';
+import { render, screen, userEvent, waitFor } from 'tests/test-utils';
+
+import AuthDomain from '../index';
+import { AUTH_DOMAINS_LIST_ENDPOINT, mockDomainsListResponse } from './mocks';
+
+function setupListHandler(): void {
+	server.use(
+		rest.get(AUTH_DOMAINS_LIST_ENDPOINT, (_, res, ctx) =>
+			res(ctx.status(200), ctx.json(mockDomainsListResponse)),
+		),
+	);
+}
+
+describe('AuthDomain authz', () => {
+	afterEach(() => {
+		server.resetHandlers();
+	});
+
+	describe('when all permissions are denied', () => {
+		it('disables the add button and blocks the table with a callout', async () => {
+			server.use(setupAuthzDenyAll());
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await waitFor(() => {
+				expect(screen.getByTestId('auth-domain-add')).toBeDisabled();
+			});
+
+			await expect(
+				screen.findByText(/is not authorized to perform/i),
+			).resolves.toBeInTheDocument();
+			expect(screen.getByText('list:auth-domain:*')).toBeInTheDocument();
+			expect(screen.queryByText('signoz.io')).not.toBeInTheDocument();
+		});
+	});
+
+	describe('when only list is granted', () => {
+		it('renders rows but disables the row actions and the add button', async () => {
+			server.use(setupAuthzGrantByPrefix('list'));
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await expect(screen.findByText('signoz.io')).resolves.toBeInTheDocument();
+
+			await waitFor(() => {
+				expect(screen.getByTestId('auth-domain-add')).toBeDisabled();
+			});
+
+			screen.getAllByTestId('auth-domain-configure').forEach((button) => {
+				expect(button).toBeDisabled();
+			});
+			screen.getAllByTestId('auth-domain-delete').forEach((button) => {
+				expect(button).toBeDisabled();
+			});
+			screen.getAllByRole('switch').forEach((toggle) => {
+				expect(toggle).toBeDisabled();
+			});
+		});
+	});
+
+	describe('when all permissions are granted', () => {
+		it('keeps every control interactive', async () => {
+			server.use(setupAuthzAdmin());
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await expect(screen.findByText('signoz.io')).resolves.toBeInTheDocument();
+
+			expect(screen.getByTestId('auth-domain-add')).toBeEnabled();
+			await waitFor(() => {
+				screen.getAllByTestId('auth-domain-configure').forEach((button) => {
+					expect(button).toBeEnabled();
+				});
+			});
+			screen.getAllByTestId('auth-domain-delete').forEach((button) => {
+				expect(button).toBeEnabled();
+			});
+			screen.getAllByRole('switch').forEach((toggle) => {
+				expect(toggle).toBeEnabled();
+			});
+		});
+	});
+
+	describe('when read is granted but update is not', () => {
+		it('keeps configure clickable and disables save inside the modal', async () => {
+			const user = userEvent.setup({ pointerEventsCheck: 0 });
+			server.use(setupAuthzGrantByPrefix('list', 'read'));
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await expect(screen.findByText('signoz.io')).resolves.toBeInTheDocument();
+
+			const configureButtons = screen.getAllByTestId('auth-domain-configure');
+			await waitFor(() => {
+				expect(configureButtons[0]).toBeEnabled();
+			});
+			await user.click(configureButtons[0]);
+
+			await screen.findByTestId('auth-domain-save');
+			await waitFor(() => {
+				const saveButton = screen.getByTestId('auth-domain-save');
+				expect(saveButton).toBeDisabled();
+				expect(saveButton).toHaveAttribute('data-denied-permissions');
+			});
+		});
+	});
+
+	describe('when delete is granted on a single domain', () => {
+		it('enables delete only for that row', async () => {
+			server.use(
+				setupAuthzAllow(
+					AuthDomainListPermission,
+					buildAuthDomainDeletePermission('domain-1'),
+				),
+			);
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await expect(screen.findByText('signoz.io')).resolves.toBeInTheDocument();
+
+			const deleteButtons = screen.getAllByTestId('auth-domain-delete');
+			expect(deleteButtons).toHaveLength(3);
+
+			// Row order follows mockDomainsListResponse: domain-1, domain-2, domain-3
+			await waitFor(() => {
+				expect(deleteButtons[0]).toBeEnabled();
+			});
+			expect(deleteButtons[1]).toBeDisabled();
+			expect(deleteButtons[2]).toBeDisabled();
+		});
+	});
+
+	describe('while permission checks are loading', () => {
+		it('keeps the add button disabled', async () => {
+			server.use(
+				rest.post(AUTHZ_CHECK_URL, (_req, res, ctx) => res(ctx.delay('infinite'))),
+			);
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await waitFor(() => {
+				expect(screen.getByTestId('auth-domain-add')).toBeDisabled();
+			});
+		});
+	});
+});

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/AuthDomain.test.tsx

@@ -1,3 +1,4 @@
+import { setupAuthzAdmin } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 import { render, screen, userEvent, waitFor } from 'tests/test-utils';
 
@@ -20,6 +21,7 @@ jest.mock('@signozhq/ui/sonner', () => ({
 describe('AuthDomain', () => {
 	beforeEach(() => {
 		jest.clearAllMocks();
+		server.use(setupAuthzAdmin());
 	});
 
 	afterEach(() => {
@@ -122,6 +124,9 @@ describe('AuthDomain', () => {
 			render(<AuthDomain />);
 
 			const addButton = await screen.findByRole('button', { name: /add domain/i });
+			await waitFor(() => {
+				expect(addButton).toBeEnabled();
+			});
 			await user.click(addButton);
 
 			await waitFor(() => {
@@ -148,8 +153,13 @@ describe('AuthDomain', () => {
 				expect(screen.getByText('signoz.io')).toBeInTheDocument();
 			});
 
-			const configureLinks = await screen.findAllByText(/configure google auth/i);
-			await user.click(configureLinks[0]);
+			const configureButtons = await screen.findAllByTestId(
+				'auth-domain-configure',
+			);
+			await waitFor(() => {
+				expect(configureButtons[0]).toBeEnabled();
+			});
+			await user.click(configureButtons[0]);
 
 			await waitFor(() => {
 				expect(screen.getByText(/edit google authentication/i)).toBeInTheDocument();

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.payload.test.tsx

@@ -1,4 +1,6 @@
 import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
+import { useAuthZ } from 'lib/authz/hooks/useAuthZ/useAuthZ';
+import { mockUseAuthZGrantAll } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 
 import CreateEdit from '../CreateEdit/CreateEdit';
@@ -9,6 +11,9 @@ import {
 	mockUpdateSuccessResponse,
 } from './mocks';
 
+jest.mock('lib/authz/hooks/useAuthZ/useAuthZ');
+const mockedUseAuthZ = useAuthZ as jest.MockedFunction<typeof useAuthZ>;
+
 // TODO: https://github.com/SigNoz/platform-pod/issues/2602
 // The real @signozhq/ui/button has internal effects that prevent form.validateFields()
 // from resolving inside act(). Mirror the pattern from SSOEnforcementToggle.test.tsx
@@ -45,7 +50,15 @@ jest.mock('@signozhq/ui/button', () => ({
 	),
 }));
 
+// Heavy real-timer integration tests (antd Collapse + form.validateFields() + a
+// react-query mutation); the default 5000ms budget flakes under parallel runs.
+jest.setTimeout(20000);
+
 describe('CreateEdit — save payload correctness', () => {
+	beforeEach(() => {
+		mockedUseAuthZ.mockImplementation(mockUseAuthZGrantAll);
+	});
+
 	afterEach(() => {
 		server.resetHandlers();
 	});

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.roleMapping.test.tsx

@@ -1,4 +1,6 @@
 import { render, screen, userEvent, waitFor } from 'tests/test-utils';
+import { useAuthZ } from 'lib/authz/hooks/useAuthZ/useAuthZ';
+import { mockUseAuthZGrantAll } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 import {
 	allRoles,
@@ -15,6 +17,9 @@ import {
 	mockUpdateSuccessResponse,
 } from './mocks';
 
+jest.mock('lib/authz/hooks/useAuthZ/useAuthZ');
+const mockedUseAuthZ = useAuthZ as jest.MockedFunction<typeof useAuthZ>;
+
 // TODO: https://github.com/SigNoz/platform-pod/issues/2602
 // The @signozhq/ui Button uses Radix Slot and has CSS infinite animations that
 // prevent form.validateFields() from resolving inside act(). Replacing with a
@@ -112,6 +117,10 @@ const saveChanges = (user: User): Promise<void> =>
 	user.click(screen.getByRole('button', { name: /save changes/i }));
 
 describe('CreateEdit — role mapping uses API roles', () => {
+	beforeEach(() => {
+		mockedUseAuthZ.mockImplementation(mockUseAuthZGrantAll);
+	});
+
 	afterEach(() => {
 		server.resetHandlers();
 	});

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.sanitization.test.tsx

@@ -1,4 +1,6 @@
 import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
+import { useAuthZ } from 'lib/authz/hooks/useAuthZ/useAuthZ';
+import { mockUseAuthZGrantAll } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 import {
 	AuthtypesAuthDomainConfigGoogleDTO,
@@ -16,6 +18,13 @@ import {
 	mockUpdateSuccessResponse,
 } from './mocks';
 
+jest.mock('lib/authz/hooks/useAuthZ/useAuthZ');
+const mockedUseAuthZ = useAuthZ as jest.MockedFunction<typeof useAuthZ>;
+
+beforeEach(() => {
+	mockedUseAuthZ.mockImplementation(mockUseAuthZGrantAll);
+});
+
 // @signozhq/ui/button internal effects block form.validateFields() in tests
 jest.mock('@signozhq/ui/button', () => ({
 	...jest.requireActual('@signozhq/ui/button'),

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/SSOEnforcementToggle.test.tsx

@@ -1,3 +1,4 @@
+import { setupAuthzAdmin } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 import { render, screen, userEvent, waitFor } from 'tests/test-utils';
 
@@ -34,6 +35,7 @@ import {
 describe('SSOEnforcementToggle', () => {
 	beforeEach(() => {
 		jest.clearAllMocks();
+		server.use(setupAuthzAdmin());
 	});
 
 	afterEach(() => {
@@ -87,6 +89,9 @@ describe('SSOEnforcementToggle', () => {
 		);
 
 		const switchElement = screen.getByRole('switch');
+		await waitFor(() => {
+			expect(switchElement).toBeEnabled();
+		});
 		await user.click(switchElement);
 
 		await waitFor(() => {
@@ -122,7 +127,11 @@ describe('SSOEnforcementToggle', () => {
 			/>,
 		);
 
-		await user.click(screen.getByRole('switch'));
+		const switchElement = screen.getByRole('switch');
+		await waitFor(() => {
+			expect(switchElement).toBeEnabled();
+		});
+		await user.click(switchElement);
 
 		await waitFor(() => expect(mockUpdateAPI).toHaveBeenCalledTimes(1));
 		expect(mockUpdateAPI).toHaveBeenCalledWith({
@@ -149,6 +158,9 @@ describe('SSOEnforcementToggle', () => {
 		);
 
 		const switchElement = screen.getByRole('switch');
+		await waitFor(() => {
+			expect(switchElement).toBeEnabled();
+		});
 		await user.click(switchElement);
 
 		await waitFor(() => {

frontend/src/container/OrganizationSettings/AuthDomain/index.tsx

@@ -14,6 +14,15 @@ import {
 } from 'api/generated/services/sigNoz.schemas';
 import { AxiosError } from 'axios';
 import ErrorContent from 'components/ErrorModal/components/ErrorContent';
+import AuthZButton from 'lib/authz/components/AuthZButton/AuthZButton';
+import { AuthZGuardContent } from 'lib/authz/components/AuthZGuard/AuthZGuardContent';
+import {
+	AuthDomainCreatePermission,
+	AuthDomainListPermission,
+	buildAuthDomainDeletePermission,
+	buildAuthDomainReadPermission,
+} from 'lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions';
+import { useAuthZ } from 'lib/authz/hooks/useAuthZ/useAuthZ';
 import CopyToClipboard from 'periscope/components/CopyToClipboard';
 import { useErrorModal } from 'providers/ErrorModalProvider';
 import APIError from 'types/api/error';
@@ -41,13 +50,17 @@ function AuthDomain(): JSX.Element {
 
 	const { showErrorModal } = useErrorModal();
 
+	const { permissions: authzPermissions } = useAuthZ([AuthDomainListPermission]);
+	const canListAuthDomains =
+		authzPermissions?.[AuthDomainListPermission]?.isGranted ?? false;
+
 	const {
 		data: authDomainListResponse,
 		isLoading: isLoadingAuthDomainListResponse,
 		isFetching: isFetchingAuthDomainListResponse,
 		error: errorFetchingAuthDomainListResponse,
 		refetch: refetchAuthDomainListResponse,
-	} = useListAuthDomains();
+	} = useListAuthDomains({ query: { enabled: canListAuthDomains } });
 
 	const { mutate: deleteAuthDomain, isLoading } =
 		useDeleteAuthDomain<AxiosError<RenderErrorResponseDTO>>();
@@ -153,22 +166,24 @@ function AuthDomain(): JSX.Element {
 				width: 100,
 				render: (_, record: AuthtypesGettableAuthDomainDTO): JSX.Element => (
 					<section className="auth-domain-list-column-action">
-						<Button
+						<AuthZButton
+							checks={[buildAuthDomainReadPermission(record.id ?? '')]}
 							className="auth-domain-list-action-link"
 							onClick={(): void => setRecord(record)}
 							variant="link"
 							testId="auth-domain-configure"
 						>
 							Configure {SSOType.get(record.config?.kind || '')}
-						</Button>
-						<Button
+						</AuthZButton>
+						<AuthZButton
+							checks={[buildAuthDomainDeletePermission(record.id ?? '')]}
 							className="auth-domain-list-action-link delete"
 							onClick={(): void => showDeleteModal(record)}
 							variant="link"
 							testId="auth-domain-delete"
 						>
 							Delete
-						</Button>
+						</AuthZButton>
 					</section>
 				),
 			},
@@ -182,7 +197,8 @@ function AuthDomain(): JSX.Element {
 				<h3 className="auth-domain-title" data-testid="auth-domain-title">
 					Authenticated Domains
 				</h3>
-				<Button
+				<AuthZButton
+					checks={[AuthDomainCreatePermission]}
 					prefix={<Plus size="md" />}
 					onClick={(): void => {
 						setAddDomain(true);
@@ -193,28 +209,32 @@ function AuthDomain(): JSX.Element {
 					testId="auth-domain-add"
 				>
 					Add Domain
-				</Button>
+				</AuthZButton>
 			</section>
-			{formattedError && <ErrorContent error={formattedError} />}
-			{!errorFetchingAuthDomainListResponse && (
-				<Table
-					columns={columns}
-					dataSource={authDomainListResponse?.data}
-					onRow={(
-						record: AuthtypesGettableAuthDomainDTO,
-					): HTMLAttributes<HTMLElement> =>
-						// data-* attributes are valid row props but absent from the antd typing
-						({
-							'data-testid': `auth-domain-row-${record.name}`,
-						}) as unknown as HTMLAttributes<HTMLElement>
-					}
-					loading={
-						isLoadingAuthDomainListResponse || isFetchingAuthDomainListResponse
-					}
-					className="auth-domain-list"
-					rowKey="id"
-				/>
-			)}
+			<AuthZGuardContent checks={[AuthDomainListPermission]}>
+				<>
+					{formattedError && <ErrorContent error={formattedError} />}
+					{!errorFetchingAuthDomainListResponse && (
+						<Table
+							columns={columns}
+							dataSource={authDomainListResponse?.data}
+							onRow={(
+								record: AuthtypesGettableAuthDomainDTO,
+							): HTMLAttributes<HTMLElement> =>
+								// data-* attributes are valid row props but absent from the antd typing
+								({
+									'data-testid': `auth-domain-row-${record.name}`,
+								}) as unknown as HTMLAttributes<HTMLElement>
+							}
+							loading={
+								isLoadingAuthDomainListResponse || isFetchingAuthDomainListResponse
+							}
+							className="auth-domain-list"
+							rowKey="id"
+						/>
+					)}
+				</>
+			</AuthZGuardContent>
 			{(addDomain || record) && (
 				<CreateEdit
 					isCreate={!record}

frontend/src/container/OrganizationSettings/DisplayName/index.tsx

@@ -72,7 +72,8 @@ function DisplayName({ index, id: orgId }: DisplayNameProps): JSX.Element {
 		await updateMyOrganization({ data: { id: orgId, displayName: name } });
 	};
 
-	if (!org) {
+	// The organization resource is not authz-backed yet, keep the legacy admin gate
+	if (!org || !isAdmin) {
 		return <div />;
 	}
 

frontend/src/container/RolesSettings/hooks/__tests__/useRolePermissions.test.ts

@@ -329,21 +329,41 @@ describe('transformTransactionGroupsToResourcePermissions', () => {
 	it('returns all resources from RESOURCE_ORDER even with empty transaction groups', () => {
 		const result = transformTransactionGroupsToResourcePermissions([]);
 
-		expect(result).toHaveLength(7);
+		expect(result).toHaveLength(8);
 		expect(result.map((r) => r.resourceKind)).toStrictEqual([
+			'auth-domain',
 			'factor-api-key',
+			'logs',
+			'meter-metrics',
+			'metrics',
 			'role',
 			'serviceaccount',
-			'logs',
 			'traces',
-			'metrics',
-			'meter-metrics',
 		]);
 	});
 
 	it('sets correct resource metadata from permissions config', () => {
 		const result = transformTransactionGroupsToResourcePermissions([]);
 
+		const authDomainResource = result.find(
+			(r) => r.resourceKind === 'auth-domain',
+		);
+		expect(authDomainResource).toMatchObject({
+			resourceId: 'auth-domain',
+			resourceKind: 'auth-domain',
+			resourceType: CoretypesTypeDTO.metaresource,
+			resourceLabel: 'Auth Domains',
+			availableActions: [
+				'attach',
+				'create',
+				'delete',
+				'detach',
+				'list',
+				'read',
+				'update',
+			],
+		});
+
 		const apiKeyResource = result.find(
 			(r) => r.resourceKind === 'factor-api-key',
 		);
@@ -418,15 +438,16 @@ describe('createEmptyRolePermissions', () => {
 	it('creates permissions for all resources in RESOURCE_ORDER', () => {
 		const result = createEmptyRolePermissions();
 
-		expect(result).toHaveLength(7);
+		expect(result).toHaveLength(8);
 		expect(result.map((r) => r.resourceKind)).toStrictEqual([
+			'auth-domain',
 			'factor-api-key',
+			'logs',
+			'meter-metrics',
+			'metrics',
 			'role',
 			'serviceaccount',
-			'logs',
 			'traces',
-			'metrics',
-			'meter-metrics',
 		]);
 	});
 

frontend/src/container/RolesSettings/permissions.config.ts

@@ -3,6 +3,7 @@ import {
 	ChartLine,
 	DraftingCompass,
 	Gauge,
+	Globe,
 	Key,
 	Logs,
 	Shield,
@@ -38,7 +39,16 @@ export interface ResourcePanelConfig {
  * we want to add resource panel configs for only types we actually are using,
  * not all of them
  */
+// Keys must stay alphabetically sorted — RESOURCE_ORDER derives the display order from them.
 export const RESOURCE_PANELS: Record<AuthZResource, ResourcePanelConfig> = {
+	'auth-domain': {
+		label: 'Auth Domains',
+		description: 'Authenticated domains and their SSO configuration.',
+		icon: Globe,
+		selectorPlaceholder:
+			'Type auth domain ID, separate multiple with comma or space',
+		docsAnchor: 'auth-domain',
+	},
 	'factor-api-key': {
 		label: 'API Keys',
 		description: 'Programmatic access tokens for the workspace.',
@@ -46,6 +56,33 @@ export const RESOURCE_PANELS: Record<AuthZResource, ResourcePanelConfig> = {
 		selectorPlaceholder: 'Type API key ID, separate multiple with comma or space',
 		docsAnchor: 'factor-api-key',
 	},
+	logs: {
+		label: 'Logs',
+		description: 'Log data collected across the workspace.',
+		icon: Logs,
+		selectorPlaceholder:
+			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
+		docsAnchor: 'logs',
+		selectorType: 'telemetryBuilder',
+	},
+	'meter-metrics': {
+		label: 'Meter Metrics',
+		description: 'Usage metering data for the workspace.',
+		icon: Gauge,
+		selectorPlaceholder:
+			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
+		docsAnchor: 'meter-metrics',
+		selectorType: 'telemetryBuilder',
+	},
+	metrics: {
+		label: 'Metrics',
+		description: 'Metric data collected across the workspace.',
+		icon: ChartLine,
+		selectorPlaceholder:
+			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
+		docsAnchor: 'metrics',
+		selectorType: 'telemetryBuilder',
+	},
 	role: {
 		label: 'Roles',
 		description: 'Custom and managed roles and their assignments.',
@@ -61,15 +98,6 @@ export const RESOURCE_PANELS: Record<AuthZResource, ResourcePanelConfig> = {
 			'Type service account ID, separate multiple with comma or space',
 		docsAnchor: 'service-account',
 	},
-	logs: {
-		label: 'Logs',
-		description: 'Log data collected across the workspace.',
-		icon: Logs,
-		selectorPlaceholder:
-			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
-		docsAnchor: 'logs',
-		selectorType: 'telemetryBuilder',
-	},
 	traces: {
 		label: 'Traces',
 		description: 'Distributed tracing data collected across the workspace.',
@@ -79,24 +107,6 @@ export const RESOURCE_PANELS: Record<AuthZResource, ResourcePanelConfig> = {
 		docsAnchor: 'traces',
 		selectorType: 'telemetryBuilder',
 	},
-	metrics: {
-		label: 'Metrics',
-		description: 'Metric data collected across the workspace.',
-		icon: ChartLine,
-		selectorPlaceholder:
-			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
-		docsAnchor: 'metrics',
-		selectorType: 'telemetryBuilder',
-	},
-	'meter-metrics': {
-		label: 'Meter Metrics',
-		description: 'Usage metering data for the workspace.',
-		icon: Gauge,
-		selectorPlaceholder:
-			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
-		docsAnchor: 'meter-metrics',
-		selectorType: 'telemetryBuilder',
-	},
 };
 
 export const RESOURCE_ORDER = Object.keys(RESOURCE_PANELS) as AuthZResource[];

frontend/src/lib/authz/hooks/useAuthZ/permissions.type.ts

@@ -3,6 +3,19 @@ export default {
 	status: 'success',
 	data: {
 		resources: [
+			{
+				kind: 'auth-domain',
+				type: 'metaresource',
+				allowedVerbs: [
+					'attach',
+					'create',
+					'delete',
+					'detach',
+					'list',
+					'read',
+					'update',
+				],
+			},
 			{
 				kind: 'factor-api-key',
 				type: 'metaresource',

frontend/src/lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions.ts

@@ -0,0 +1,22 @@
+import { buildPermission } from '../utils';
+import type { BrandedPermission } from '../types';
+
+// Collection-level — wildcard selector required for correct response key matching
+export const AuthDomainListPermission = buildPermission(
+	'list',
+	'auth-domain:*',
+);
+export const AuthDomainCreatePermission = buildPermission(
+	'create',
+	'auth-domain:*',
+);
+
+// Resource-level — require a specific auth domain id
+export const buildAuthDomainReadPermission = (id: string): BrandedPermission =>
+	buildPermission('read', `auth-domain:${id}`);
+export const buildAuthDomainUpdatePermission = (
+	id: string,
+): BrandedPermission => buildPermission('update', `auth-domain:${id}`);
+export const buildAuthDomainDeletePermission = (
+	id: string,
+): BrandedPermission => buildPermission('delete', `auth-domain:${id}`);

frontend/src/pages/Settings/Settings.tsx

@@ -10,7 +10,6 @@ import { buildNavUrl, getQueryString } from 'container/SideNav/helper';
 import { settingsNavSections } from 'container/SideNav/menuItems';
 import NavItem from 'container/SideNav/NavItem/NavItem';
 import { SidebarItem } from 'container/SideNav/sideNav.types';
-import useComponentPermission from 'hooks/useComponentPermission';
 import { useGetTenantLicense } from 'hooks/useGetTenantLicense';
 import history from 'lib/history';
 import { Cog } from '@signozhq/icons';
@@ -40,10 +39,6 @@ function SettingsPage(): JSX.Element {
 
 	const isWorkspaceBlocked = trialInfo?.workSpaceBlock || false;
 
-	const [isCurrentOrgSettings] = useComponentPermission(
-		['current_org_settings'],
-		user.role,
-	);
 	const { t } = useTranslation(['routes']);
 
 	const isGatewayEnabled =
@@ -80,7 +75,8 @@ function SettingsPage(): JSX.Element {
 						item.key === ROUTES.ROLE_CREATE ||
 						item.key === ROUTES.ROLE_DETAILS ||
 						item.key === ROUTES.ROLE_EDIT ||
-						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS
+						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS ||
+						item.key === ROUTES.ORG_SETTINGS
 							? true
 							: item.isEnabled,
 				}));
@@ -92,7 +88,6 @@ function SettingsPage(): JSX.Element {
 							item.key === ROUTES.BILLING ||
 							item.key === ROUTES.INTEGRATIONS ||
 							item.key === ROUTES.INGESTION_SETTINGS ||
-							item.key === ROUTES.ORG_SETTINGS ||
 							item.key === ROUTES.MEMBERS_SETTINGS ||
 							item.key === ROUTES.SHORTCUTS ||
 							item.key === ROUTES.MCP_SERVER
@@ -131,7 +126,8 @@ function SettingsPage(): JSX.Element {
 						item.key === ROUTES.ROLE_CREATE ||
 						item.key === ROUTES.ROLE_DETAILS ||
 						item.key === ROUTES.ROLE_EDIT ||
-						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS
+						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS ||
+						item.key === ROUTES.ORG_SETTINGS
 							? true
 							: item.isEnabled,
 				}));
@@ -142,7 +138,6 @@ function SettingsPage(): JSX.Element {
 						isEnabled:
 							item.key === ROUTES.BILLING ||
 							item.key === ROUTES.INTEGRATIONS ||
-							item.key === ROUTES.ORG_SETTINGS ||
 							item.key === ROUTES.MEMBERS_SETTINGS ||
 							item.key === ROUTES.INGESTION_SETTINGS ||
 							item.key === ROUTES.MCP_SERVER
@@ -180,7 +175,8 @@ function SettingsPage(): JSX.Element {
 						item.key === ROUTES.ROLE_CREATE ||
 						item.key === ROUTES.ROLE_DETAILS ||
 						item.key === ROUTES.ROLE_EDIT ||
-						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS
+						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS ||
+						item.key === ROUTES.ORG_SETTINGS
 							? true
 							: item.isEnabled,
 				}));
@@ -188,10 +184,7 @@ function SettingsPage(): JSX.Element {
 				if (isAdmin) {
 					updatedItems = updatedItems.map((item) => ({
 						...item,
-						isEnabled:
-							item.key === ROUTES.ORG_SETTINGS || item.key === ROUTES.MEMBERS_SETTINGS
-								? true
-								: item.isEnabled,
+						isEnabled: item.key === ROUTES.MEMBERS_SETTINGS ? true : item.isEnabled,
 					}));
 				}
 
@@ -222,7 +215,6 @@ function SettingsPage(): JSX.Element {
 		() =>
 			getRoutes(
 				user.role,
-				isCurrentOrgSettings,
 				isGatewayEnabled,
 				isWorkspaceBlocked,
 				isCloudUser,
@@ -231,7 +223,6 @@ function SettingsPage(): JSX.Element {
 			),
 		[
 			user.role,
-			isCurrentOrgSettings,
 			isGatewayEnabled,
 			isWorkspaceBlocked,
 			isCloudUser,

frontend/src/pages/Settings/utils.ts

@@ -21,7 +21,6 @@ import {
 
 export const getRoutes = (
 	userRole: ROLES | null,
-	isCurrentOrgSettings: boolean,
 	isGatewayEnabled: boolean,
 	isWorkspaceBlocked: boolean,
 	isCloudUser: boolean,
@@ -47,9 +46,8 @@ export const getRoutes = (
 
 	settings.push(...generalSettings(t));
 
-	if (isCurrentOrgSettings) {
-		settings.push(...organizationSettings(t));
-	}
+	// Visible to all authenticated users — in-page authz gates the content
+	settings.push(...organizationSettings(t));
 
 	if (isGatewayEnabled && (isAdmin || isEditor)) {
 		settings.push(...multiIngestionSettings(t));

frontend/src/utils/permission/index.ts

@@ -59,7 +59,7 @@ export const componentPermission: Record<ComponentTypes, ROLES[]> = {
 export const routePermission: Record<keyof typeof ROUTES, ROLES[]> = {
 	HOME: ['ADMIN', 'EDITOR', 'VIEWER'],
 	ALERTS_NEW: ['ADMIN', 'EDITOR'],
-	ORG_SETTINGS: ['ADMIN'],
+	ORG_SETTINGS: ['ADMIN', 'EDITOR', 'VIEWER'],
 	MY_SETTINGS: ['ADMIN', 'EDITOR', 'VIEWER'],
 	SERVICE_MAP: ['ADMIN', 'EDITOR', 'VIEWER'],
 	ALL_CHANNELS: ['ADMIN', 'EDITOR', 'VIEWER'],
@@ -172,6 +172,7 @@ export const routeWithInitialAuthZSupport = {
 	LOGS: true,
 	LOGS_EXPLORER: true,
 	LIVE_LOGS: true,
+	ORG_SETTINGS: true,
 	ROLES_SETTINGS: true,
 	ROLE_CREATE: true,
 	ROLE_DETAILS: true,

pkg/apiserver/signozapiserver/authdomain.go

@@ -77,7 +77,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
 				SourceSelector: coretypes.WildcardSelector,
 				TargetResource: coretypes.ResourceRole,
-				TargetIDs:      authDomainRoleNamesExtractor(),
+				TargetIDs:      provider.authDomainRoleNamesExtractor(),
 				TargetSelector: coretypes.IDSelector,
 			},
 		),
@@ -146,21 +146,23 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 				Verb:           coretypes.VerbAttach,
 				Category:       coretypes.ActionCategoryAccessControl,
 				SourceResource: coretypes.ResourceMetaResourceAuthDomain,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceIDs:      provider.authDomainIDWhenRolesChangeExtractor(provider.authDomainAttachedRoleNames),
 				SourceSelector: coretypes.IDSelector,
 				TargetResource: coretypes.ResourceRole,
-				TargetIDs:      authDomainRoleNamesExtractor(),
+				TargetIDs:      coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: provider.authDomainAttachedRoleNames},
 				TargetSelector: coretypes.IDSelector,
+				SkipIfNoIDs:    true,
 			},
 			handler.AttachDetachSiblingResourceDef{
 				Verb:           coretypes.VerbDetach,
 				Category:       coretypes.ActionCategoryAccessControl,
 				SourceResource: coretypes.ResourceMetaResourceAuthDomain,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceIDs:      provider.authDomainIDWhenRolesChangeExtractor(provider.authDomainDetachedRoleNames),
 				SourceSelector: coretypes.IDSelector,
 				TargetResource: coretypes.ResourceRole,
-				TargetIDs:      provider.authDomainStoredRoleNamesExtractor(),
+				TargetIDs:      coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: provider.authDomainDetachedRoleNames},
 				TargetSelector: coretypes.IDSelector,
+				SkipIfNoIDs:    true,
 			},
 		),
 	)).Methods(http.MethodPut).GetError(); err != nil {
@@ -197,67 +199,119 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 	return nil
 }
 
-// The extracted names are the roles the request body's mapping grants at SSO
-// login — see authDomainEffectiveRoleNames.
-func authDomainRoleNamesExtractor() coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		roleMappingJSON := gjson.GetBytes(ec.RequestBody, "roleMapping")
-		if !roleMappingJSON.Exists() || roleMappingJSON.Type == gjson.Null {
-			return authDomainEffectiveRoleNames(nil), nil
-		}
-
-		roleMapping := new(authtypes.RoleMapping)
-		if err := json.Unmarshal([]byte(roleMappingJSON.Raw), roleMapping); err != nil {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid role mapping: %v", err)
-		}
-
-		return authDomainEffectiveRoleNames(roleMapping), nil
-	}}
+func (provider *provider) authDomainRoleNamesExtractor() coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: provider.authDomainRequestEffectiveRoleNames}
 }
 
-// The extracted names are the roles the stored domain's mapping grants at SSO
-// login — an update replaces that mapping, so the caller must be able to detach
-// them.
-func (provider *provider) authDomainStoredRoleNamesExtractor() coretypes.ResourceIDsExtractor {
+func (provider *provider) authDomainIDWhenRolesChangeExtractor(roleNamesDiff func(coretypes.ExtractorContext) ([]string, error)) coretypes.ResourceIDsExtractor {
 	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
+		diff, err := roleNamesDiff(ec)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(diff) == 0 || ec.Request == nil {
 			return nil, nil
 		}
 
-		claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
-		if err != nil {
-			return nil, err
-		}
-
-		orgID, err := valuer.NewUUID(claims.OrgID)
-		if err != nil {
-			return nil, err
-		}
-
-		id, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
-		if err != nil {
-			return nil, err
-		}
-
-		authDomain, err := provider.authDomainModule.GetByOrgIDAndID(ec.Request.Context(), orgID, id)
-		if err != nil {
-			return nil, err
-		}
-
-		return authDomainEffectiveRoleNames(authDomain.RoleMapping()), nil
+		return []string{mux.Vars(ec.Request)["id"]}, nil
 	}}
 }
 
-// The effective names are the roles a domain grants at SSO login: the mapped
-// roles plus the default (signoz-viewer when unset), or every role when the IDP
-// role attribute is trusted. Never empty — a check with no selectors is forbidden.
-func authDomainEffectiveRoleNames(roleMapping *authtypes.RoleMapping) []string {
+func (provider *provider) authDomainAttachedRoleNames(ec coretypes.ExtractorContext) ([]string, error) {
+	requestRoleNames, err := provider.authDomainRequestEffectiveRoleNames(ec)
+	if err != nil {
+		return nil, err
+	}
+
+	storedRoleNames, err := provider.authDomainStoredEffectiveRoleNames(ec)
+	if err != nil {
+		return nil, err
+	}
+
+	return provider.subtractRoleNames(requestRoleNames, storedRoleNames), nil
+}
+
+func (provider *provider) authDomainDetachedRoleNames(ec coretypes.ExtractorContext) ([]string, error) {
+	requestRoleNames, err := provider.authDomainRequestEffectiveRoleNames(ec)
+	if err != nil {
+		return nil, err
+	}
+
+	storedRoleNames, err := provider.authDomainStoredEffectiveRoleNames(ec)
+	if err != nil {
+		return nil, err
+	}
+
+	return provider.subtractRoleNames(storedRoleNames, requestRoleNames), nil
+}
+
+func (provider *provider) authDomainRequestEffectiveRoleNames(ec coretypes.ExtractorContext) ([]string, error) {
+	roleMappingJSON := gjson.GetBytes(ec.RequestBody, "roleMapping")
+	if !roleMappingJSON.Exists() || roleMappingJSON.Type == gjson.Null {
+		return provider.authDomainEffectiveRoleNames(nil), nil
+	}
+
+	roleMapping := new(authtypes.RoleMapping)
+	if err := json.Unmarshal([]byte(roleMappingJSON.Raw), roleMapping); err != nil {
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid role mapping: %v", err)
+	}
+
+	return provider.authDomainEffectiveRoleNames(roleMapping), nil
+}
+
+func (provider *provider) authDomainStoredEffectiveRoleNames(ec coretypes.ExtractorContext) ([]string, error) {
+	if ec.Request == nil {
+		return nil, nil
+	}
+
+	claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
+	if err != nil {
+		return nil, err
+	}
+
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		return nil, err
+	}
+
+	id, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+	if err != nil {
+		return nil, err
+	}
+
+	authDomain, err := provider.authDomainModule.GetByOrgIDAndID(ec.Request.Context(), orgID, id)
+	if err != nil {
+		return nil, err
+	}
+
+	return provider.authDomainEffectiveRoleNames(authDomain.RoleMapping()), nil
+}
+
+func (provider *provider) subtractRoleNames(roleNames []string, roleNamesToRemove []string) []string {
+	removeSet := make(map[string]struct{}, len(roleNamesToRemove))
+	for _, roleName := range roleNamesToRemove {
+		removeSet[roleName] = struct{}{}
+	}
+
+	remaining := make([]string, 0, len(roleNames))
+	for _, roleName := range roleNames {
+		if _, ok := removeSet[roleName]; !ok {
+			remaining = append(remaining, roleName)
+		}
+	}
+
+	return remaining
+}
+
+// Never empty — a check with no selectors is forbidden.
+func (provider *provider) authDomainEffectiveRoleNames(roleMapping *authtypes.RoleMapping) []string {
 	if roleMapping == nil {
 		return []string{authtypes.SigNozViewerRoleName}
 	}
 
 	if roleMapping.UseRoleAttribute {
-		return []string{coretypes.WildCardSelectorString}
+		return []string{coretypes.WildCardSelectorString, authtypes.SigNozViewerRoleName}
 	}
 
 	roleNames := roleMapping.RoleNames()

pkg/apiserver/signozapiserver/flagger.go

@@ -4,12 +4,13 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/featuretypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addFlaggerRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/features", handler.New(provider.authzMiddleware.OpenAccess(provider.flaggerHandler.GetFeatures), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/features", handler.New(provider.authzMiddleware.ViewAccess(provider.flaggerHandler.GetFeatures), handler.OpenAPIDef{
 		ID:                  "GetFeatures",
 		Tags:                []string{"features"},
 		Summary:             "Get features",
@@ -21,7 +22,7 @@ func (provider *provider) addFlaggerRoutes(router *mux.Router) error {
 		SuccessStatusCode:   http.StatusOK,
 		ErrorStatusCodes:    []int{},
 		Deprecated:          false,
-		SecuritySchemes:     newScopedSecuritySchemes(nil),
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
 	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

pkg/apiserver/signozapiserver/provider.go

@@ -30,7 +30,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/session"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/user"
 	"github.com/SigNoz/signoz/pkg/querier"
@@ -81,8 +80,6 @@ type provider struct {
 	llmPricingRuleHandler      llmpricingrule.Handler
 	statsHandler               statsreporter.Handler
 	savedViewHandler           savedview.Handler
-	systemDashboardModule      systemdashboard.Module
-	systemDashboardHandler     systemdashboard.Handler
 }
 
 func NewFactory(
@@ -121,8 +118,6 @@ func NewFactory(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
-	systemDashboardModule systemdashboard.Module,
-	systemDashboardHandler systemdashboard.Handler,
 ) factory.ProviderFactory[apiserver.APIServer, apiserver.Config] {
 	return factory.NewProviderFactory(factory.MustNewName("signoz"), func(ctx context.Context, providerSettings factory.ProviderSettings, config apiserver.Config) (apiserver.APIServer, error) {
 		return newProvider(
@@ -164,8 +159,6 @@ func NewFactory(
 			rulerHandler,
 			statsHandler,
 			savedViewHandler,
-			systemDashboardModule,
-			systemDashboardHandler,
 		)
 	})
 }
@@ -209,8 +202,6 @@ func newProvider(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
-	systemDashboardModule systemdashboard.Module,
-	systemDashboardHandler systemdashboard.Handler,
 ) (apiserver.APIServer, error) {
 	settings := factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/apiserver/signozapiserver")
 	router := mux.NewRouter().UseEncodedPath()
@@ -253,8 +244,6 @@ func newProvider(
 		llmPricingRuleHandler:      llmPricingRuleHandler,
 		statsHandler:               statsHandler,
 		savedViewHandler:           savedViewHandler,
-		systemDashboardModule:      systemDashboardModule,
-		systemDashboardHandler:     systemDashboardHandler,
 	}
 
 	provider.authzMiddleware = middleware.NewAuthZ(settings.Logger(), orgGetter, authzService)
@@ -307,10 +296,6 @@ func (provider *provider) AddToRouter(router *mux.Router) error {
 		return err
 	}
 
-	if err := provider.addSystemDashboardRoutes(router); err != nil {
-		return err
-	}
-
 	if err := provider.addMetricsExplorerRoutes(router); err != nil {
 		return err
 	}

pkg/apiserver/signozapiserver/systemdashboard.go

@@ -1,63 +0,0 @@
-package signozapiserver
-
-import (
-	"net/http"
-
-	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/gorilla/mux"
-)
-
-func (provider *provider) addSystemDashboardRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/system/dashboards/{name}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.systemDashboardHandler.Get, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetSystemDashboard",
-			Tags:                []string{"dashboard"},
-			Summary:             "Get system dashboard",
-			Description:         "Returns a dashboard SigNoz ships and owns, addressed by its stable definition name (e.g. `ai-o11y-overview`) rather than its id. System dashboards are read-only and upgraded through releases. The dashboard's own `name` field carries a reserved prefix that the path segment must not include.",
-			Request:             nil,
-			RequestContentType:  "",
-			Response:            new(dashboardtypes.GettableDashboardV2),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-			Deprecated:          false,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceDashboard,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       provider.systemDashboardID(),
-			Selector: coretypes.IDSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
-		return err
-	}
-
-	return nil
-}
-
-// systemDashboardID resolves the {name} path param to the dashboard's id. Authz
-// tuples and audit records are written against ids, so the name has to be
-// resolved before either runs.
-func (provider *provider) systemDashboardID() coretypes.ResourceIDExtractor {
-	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
-		ctx := ec.Request.Context()
-		claims, err := authtypes.ClaimsFromContext(ctx)
-		if err != nil {
-			return "", err
-		}
-
-		id, err := provider.systemDashboardModule.ResolveID(ctx, valuer.MustNewUUID(claims.OrgID), mux.Vars(ec.Request)["name"])
-		if err != nil {
-			return "", err
-		}
-
-		return id.StringValue(), nil
-	})
-}

pkg/http/handler/resourcedef.go

@@ -53,6 +53,9 @@ type AttachDetachSiblingResourceDef struct {
 	TargetResource coretypes.Resource
 	TargetIDs      coretypes.ResourceIDsExtractor
 	TargetSelector coretypes.SelectorFunc
+	// SkipIfNoIDs skips the authz checks entirely when neither source nor target
+	// ids resolve — an attach/detach of nothing authorizes nothing.
+	SkipIfNoIDs bool
 }
 
 func (def AttachDetachSiblingResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
@@ -67,6 +70,7 @@ func (def AttachDetachSiblingResourceDef) resolveRequest(ec coretypes.ExtractorC
 			def.TargetIDs,
 			def.TargetSelector,
 			false,
+			def.SkipIfNoIDs,
 			ec,
 		),
 	}
@@ -96,6 +100,7 @@ func (def AttachDetachParentChildResourceDef) resolveRequest(ec coretypes.Extrac
 			def.ChildIDs,
 			nil,
 			true,
+			false,
 			ec,
 		),
 	}

pkg/http/middleware/audit.go

@@ -123,6 +123,10 @@ func (middleware *Audit) emitAuditEvent(req *http.Request, writer responseCaptur
 		}
 
 		resource.ResolveResponse(extractorCtx)
+
+		if resource.Skip() {
+			continue
+		}
 		verb, category := resource.Verb(), resource.Category()
 
 		switch typed := resource.(type) {

pkg/http/middleware/authz.go

@@ -186,6 +186,10 @@ func (middleware *AuthZ) CheckResources(next http.HandlerFunc, roles ...string)
 				return
 			}
 
+			if resource.Skip() {
+				continue
+			}
+
 			if err := middleware.checkResource(ctx, claims, orgID, resource.Verb(), resource.SourceResource(), resource.SourceIDs(), resource.SourceSelector(), roleSelectors); err != nil {
 				render.Error(rw, err)
 				return

pkg/modules/dashboard/dashboard.go

@@ -63,8 +63,6 @@ type Module interface {
 
 	GetV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*dashboardtypes.DashboardV2, error)
 
-	GetByNameV2(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error)
-
 	// MigrateV2 retries the v1→v2 migration on a dashboard still stored in the v1 schema.
 	MigrateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*dashboardtypes.DashboardV2, error)
 
@@ -74,9 +72,6 @@ type Module interface {
 
 	UpdateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2) (*dashboardtypes.DashboardV2, error)
 
-	// UpdateUnsafeV2 updates a dashboard bypassing the guards. Intended for internal system callers.
-	UpdateUnsafeV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2) (*dashboardtypes.DashboardV2, error)
-
 	LockUnlockV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, isAdmin bool, lock bool) error
 
 	PatchV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, patch dashboardtypes.PatchableDashboardV2) (*dashboardtypes.DashboardV2, error)

pkg/modules/dashboard/impldashboard/store.go

@@ -64,23 +64,6 @@ func (store *store) Get(ctx context.Context, orgID valuer.UUID, id valuer.UUID)
 	return storableDashboard, nil
 }
 
-func (store *store) GetByName(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.StorableDashboard, error) {
-	storableDashboard := new(dashboardtypes.StorableDashboard)
-	err := store.
-		sqlstore.
-		BunDB().
-		NewSelect().
-		Model(storableDashboard).
-		Where("name = ?", name).
-		Where("org_id = ?", orgID).
-		Scan(ctx)
-	if err != nil {
-		return nil, store.sqlstore.WrapNotFoundErrf(err, errors.CodeNotFound, "dashboard with name %s doesn't exist", name)
-	}
-
-	return storableDashboard, nil
-}
-
 // ListForUser emits the joined dashboard ⨝ user_dashboard_preference query the
 // spec calls for. Aliases:
 //

pkg/modules/dashboard/impldashboard/v2_module.go

@@ -19,12 +19,9 @@ func (m *module) CreateV2(ctx context.Context, orgID valuer.UUID, createdBy stri
 		return nil, err
 	}
 
-	dashboard, err := postable.NewDashboardV2(orgID, createdBy, source)
-	if err != nil {
-		return nil, err
-	}
+	dashboard := postable.NewDashboardV2(orgID, createdBy, source)
 
-	err = m.store.RunInTx(ctx, func(ctx context.Context) error {
+	err := m.store.RunInTx(ctx, func(ctx context.Context) error {
 		resolvedTags, err := m.tagModule.SyncTags(ctx, orgID, coretypes.KindDashboard, dashboard.ID, postable.Tags)
 		if err != nil {
 			return err
@@ -123,20 +120,6 @@ func (module *module) GetV2(ctx context.Context, orgID valuer.UUID, id valuer.UU
 	return storable.ToDashboardV2(tags)
 }
 
-func (module *module) GetByNameV2(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error) {
-	storable, err := module.store.GetByName(ctx, orgID, name)
-	if err != nil {
-		return nil, err
-	}
-
-	tags, err := module.tagModule.ListForResource(ctx, orgID, coretypes.KindDashboard, storable.ID)
-	if err != nil {
-		return nil, err
-	}
-
-	return storable.ToDashboardV2(tags)
-}
-
 // MigrateV2 retries the v1→v2 migration on a dashboard still stored as v1 (one the
 // bulk 103 migration skipped or failed). Idempotent: an already-v2 one is unchanged.
 func (module *module) MigrateV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*dashboardtypes.DashboardV2, error) {
@@ -196,32 +179,13 @@ func (module *module) UpdateV2(ctx context.Context, orgID valuer.UUID, id valuer
 		return nil, err
 	}
 
-	return module.updateV2(ctx, orgID, existing, updatedBy, updatable, existing.Update)
-}
-
-func (module *module) UpdateUnsafeV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2) (*dashboardtypes.DashboardV2, error) {
-	if err := updatable.Validate(); err != nil {
-		return nil, err
-	}
-
-	existing, err := module.GetV2(ctx, orgID, id)
-	if err != nil {
-		return nil, err
-	}
-
-	return module.updateV2(ctx, orgID, existing, updatedBy, updatable, existing.UpdateUnsafe)
-}
-
-// apply is existing.Update or existing.UpdateUnsafe, so the gated path keeps its
-// in-transaction checks and only UpdateUnsafeV2 skips them.
-func (module *module) updateV2(ctx context.Context, orgID valuer.UUID, existing *dashboardtypes.DashboardV2, updatedBy string, updatable dashboardtypes.UpdatableDashboardV2, apply func(dashboardtypes.UpdatableDashboardV2, string, []*tagtypes.Tag) error) (*dashboardtypes.DashboardV2, error) {
-	err := module.store.RunInTx(ctx, func(ctx context.Context) error {
-		resolvedTags, err := module.tagModule.SyncTags(ctx, orgID, coretypes.KindDashboard, existing.ID, updatable.Tags)
+	err = module.store.RunInTx(ctx, func(ctx context.Context) error {
+		resolvedTags, err := module.tagModule.SyncTags(ctx, orgID, coretypes.KindDashboard, id, updatable.Tags)
 		if err != nil {
 			return err
 		}
 
-		err = apply(updatable, updatedBy, resolvedTags)
+		err = existing.Update(updatable, updatedBy, resolvedTags)
 		if err != nil {
 			return err
 		}

pkg/modules/organization/implorganization/setter.go

@@ -6,20 +6,18 @@ import (
 	"github.com/SigNoz/signoz/pkg/alertmanager"
 	"github.com/SigNoz/signoz/pkg/modules/organization"
 	"github.com/SigNoz/signoz/pkg/modules/quickfilter"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
 type setter struct {
-	store           types.OrganizationStore
-	alertmanager    alertmanager.Alertmanager
-	quickfilter     quickfilter.Module
-	systemDashboard systemdashboard.Module
+	store        types.OrganizationStore
+	alertmanager alertmanager.Alertmanager
+	quickfilter  quickfilter.Module
 }
 
-func NewSetter(store types.OrganizationStore, alertmanager alertmanager.Alertmanager, quickfilter quickfilter.Module, systemDashboard systemdashboard.Module) organization.Setter {
-	return &setter{store: store, alertmanager: alertmanager, quickfilter: quickfilter, systemDashboard: systemDashboard}
+func NewSetter(store types.OrganizationStore, alertmanager alertmanager.Alertmanager, quickfilter quickfilter.Module) organization.Setter {
+	return &setter{store: store, alertmanager: alertmanager, quickfilter: quickfilter}
 }
 
 func (module *setter) Create(ctx context.Context, organization *types.Organization, createManagedRoles func(context.Context, valuer.UUID) error) error {
@@ -39,10 +37,6 @@ func (module *setter) Create(ctx context.Context, organization *types.Organizati
 		return err
 	}
 
-	if err := module.systemDashboard.Reconcile(ctx, organization.ID); err != nil {
-		return err
-	}
-
 	return nil
 }
 

pkg/modules/systemdashboard/implsystemdashboard/definitions.go

@@ -1,45 +0,0 @@
-package implsystemdashboard
-
-import (
-	"embed"
-	"io/fs"
-	"path"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/types/systemdashboardtypes"
-)
-
-const definitionsRoot = "fs/definitions"
-
-//go:embed fs/definitions/*.json
-var definitionFiles embed.FS
-
-// NewRegistry parses every embedded definition. Definitions are build-time assets
-// validated by a test, so a failure here means the binary shipped broken JSON.
-func NewRegistry() (systemdashboardtypes.Registry, error) {
-	entries, err := fs.ReadDir(definitionFiles, definitionsRoot)
-	if err != nil {
-		return systemdashboardtypes.Registry{}, errors.WrapInternalf(err, errors.CodeInternal, "couldn't read system dashboard definitions")
-	}
-
-	definitions := make([]systemdashboardtypes.Definition, 0, len(entries))
-	for _, entry := range entries {
-		if entry.IsDir() {
-			continue
-		}
-
-		file := path.Join(definitionsRoot, entry.Name())
-		raw, err := definitionFiles.ReadFile(file)
-		if err != nil {
-			return systemdashboardtypes.Registry{}, errors.WrapInternalf(err, errors.CodeInternal, "couldn't read %s", file)
-		}
-
-		definition, err := systemdashboardtypes.NewDefinition(raw)
-		if err != nil {
-			return systemdashboardtypes.Registry{}, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "couldn't parse %s", file)
-		}
-		definitions = append(definitions, definition)
-	}
-
-	return systemdashboardtypes.NewRegistry(definitions)
-}

pkg/modules/systemdashboard/implsystemdashboard/definitions_test.go

@@ -1,20 +0,0 @@
-package implsystemdashboard
-
-import (
-	"testing"
-
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// A schema migration cannot ship without updating the definitions: parsing them
-// runs the same validation a create goes through, at the current schemaVersion.
-func TestEmbeddedDefinitionsParseAtCurrentSchemaVersion(t *testing.T) {
-	registry, err := NewRegistry()
-	require.NoError(t, err)
-
-	// The frontend addresses the overview dashboard by this name.
-	_, ok := registry.Get(dashboardtypes.SystemDashboardNamePrefix + "ai-o11y-overview")
-	assert.True(t, ok)
-}

pkg/modules/systemdashboard/implsystemdashboard/fs/definitions/ai-o11y-overview.json

@@ -1,17 +0,0 @@
-{
-  "version": 1,
-  "definition": {
-    "schemaVersion": "v6",
-    "name": "signoz---ai-o11y-overview",
-    "tags": [],
-    "spec": {
-      "display": {
-        "name": "AI Observability Overview",
-        "description": "Overview of LLM traffic. Panels ship in an upcoming release."
-      },
-      "variables": [],
-      "panels": {},
-      "layouts": []
-    }
-  }
-}

pkg/modules/systemdashboard/implsystemdashboard/handler.go

@@ -1,48 +0,0 @@
-package implsystemdashboard
-
-import (
-	"context"
-	"net/http"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/http/render"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/gorilla/mux"
-)
-
-type handler struct {
-	module systemdashboard.Module
-}
-
-func NewHandler(module systemdashboard.Module) systemdashboard.Handler {
-	return &handler{module: module}
-}
-
-func (handler *handler) Get(rw http.ResponseWriter, r *http.Request) {
-	ctx, cancel := context.WithTimeout(r.Context(), 10*time.Second)
-	defer cancel()
-
-	claims, err := authtypes.ClaimsFromContext(ctx)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	name := mux.Vars(r)["name"]
-	if name == "" {
-		render.Error(rw, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "name is missing in the path"))
-		return
-	}
-
-	systemDashboard, err := handler.module.Get(ctx, valuer.MustNewUUID(claims.OrgID), name)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusOK, systemDashboard.ToGettableDashboardV2())
-}
-

pkg/modules/systemdashboard/implsystemdashboard/module.go

@@ -1,151 +0,0 @@
-package implsystemdashboard
-
-import (
-	"context"
-	"log/slog"
-	"strings"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/modules/dashboard"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
-	"github.com/SigNoz/signoz/pkg/types/systemdashboardtypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
-
-type module struct {
-	settings        factory.ScopedProviderSettings
-	store           systemdashboardtypes.Store
-	registry        systemdashboardtypes.Registry
-	dashboardModule dashboard.Module
-}
-
-func NewModule(
-	providerSettings factory.ProviderSettings,
-	store systemdashboardtypes.Store,
-	registry systemdashboardtypes.Registry,
-	dashboardModule dashboard.Module,
-) systemdashboard.Module {
-	return &module{
-		settings:        factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"),
-		store:           store,
-		registry:        registry,
-		dashboardModule: dashboardModule,
-	}
-}
-
-func (module *module) Reconcile(ctx context.Context, orgID valuer.UUID) error {
-	for _, definition := range module.registry.List() {
-		if err := module.reconcile(ctx, orgID, definition); err != nil {
-			return err
-		}
-	}
-
-	return nil
-}
-
-func (module *module) reconcile(ctx context.Context, orgID valuer.UUID, definition systemdashboardtypes.Definition) error {
-	existing, err := module.dashboardModule.GetByNameV2(ctx, orgID, definition.Name())
-	if err != nil {
-		if !errors.Ast(err, errors.TypeNotFound) {
-			return err
-		}
-		return module.provision(ctx, orgID, definition)
-	}
-
-	// Anything but the provisioner in updated_by means a foreign write. Leave the
-	// row alone — never overwriting is the safe direction.
-	if existing.UpdatedBy != systemdashboardtypes.ProvisionerIdentity {
-		module.settings.Logger().WarnContext(ctx, "skipping system dashboard reconcile: last write was not by the provisioner", slog.String("name", definition.Name()), slog.String("org_id", orgID.StringValue()), slog.String("updated_by", existing.UpdatedBy))
-		return nil
-	}
-
-	state, err := module.store.Get(ctx, orgID, definition.Name())
-	if err != nil {
-		return err
-	}
-	// Only ever move forward: a downgrade must not rewrite the newer content.
-	if state.Version >= definition.Version {
-		return nil
-	}
-
-	return module.upgrade(ctx, orgID, existing.ID, definition)
-}
-
-// provision creates the dashboard and its state row in one transaction, so a
-// system dashboard can never exist without the version it was provisioned at.
-// A concurrent provisioner (another replica, or the org-creation hook racing the
-// startup sweep) loses on the state row's unique (org_id, name) index and rolls back.
-func (module *module) provision(ctx context.Context, orgID valuer.UUID, definition systemdashboardtypes.Definition) error {
-	err := module.store.RunInTx(ctx, func(ctx context.Context) error {
-		created, err := module.dashboardModule.CreateV2(
-			ctx,
-			orgID,
-			systemdashboardtypes.ProvisionerIdentity,
-			valuer.UUID{},
-			dashboardtypes.SourceSystem,
-			definition.Dashboard,
-		)
-		if err != nil {
-			return err
-		}
-
-		return module.store.Create(ctx, systemdashboardtypes.NewStorableSystemDashboard(orgID, created.ID, definition.Name(), definition.Version))
-	})
-	if err != nil {
-		if errors.Ast(err, errors.TypeAlreadyExists) {
-			module.settings.Logger().DebugContext(ctx, "system dashboard already provisioned concurrently", slog.String("name", definition.Name()), slog.String("org_id", orgID.StringValue()))
-			return nil
-		}
-		return err
-	}
-
-	module.settings.Logger().InfoContext(ctx, "provisioned system dashboard", slog.String("name", definition.Name()), slog.Int("version", definition.Version), slog.String("org_id", orgID.StringValue()))
-	return nil
-}
-
-func (module *module) upgrade(ctx context.Context, orgID valuer.UUID, id valuer.UUID, definition systemdashboardtypes.Definition) error {
-	err := module.store.RunInTx(ctx, func(ctx context.Context) error {
-		if _, err := module.dashboardModule.UpdateUnsafeV2(ctx, orgID, id, systemdashboardtypes.ProvisionerIdentity, definition.ToUpdatable()); err != nil {
-			return err
-		}
-
-		return module.store.UpdateVersion(ctx, orgID, definition.Name(), definition.Version)
-	})
-	if err != nil {
-		return err
-	}
-
-	module.settings.Logger().InfoContext(ctx, "upgraded system dashboard", slog.String("name", definition.Name()), slog.Int("version", definition.Version), slog.String("org_id", orgID.StringValue()))
-	return nil
-}
-
-func (module *module) Get(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error) {
-	return module.get(ctx, orgID, name)
-}
-
-func (module *module) ResolveID(ctx context.Context, orgID valuer.UUID, name string) (valuer.UUID, error) {
-	existing, err := module.get(ctx, orgID, name)
-	if err != nil {
-		return valuer.UUID{}, err
-	}
-
-	return existing.ID, nil
-}
-
-func (module *module) get(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error) {
-	if strings.HasPrefix(name, dashboardtypes.SystemDashboardNamePrefix) {
-		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "name must not carry the %q prefix", dashboardtypes.SystemDashboardNamePrefix)
-	}
-
-	existing, err := module.dashboardModule.GetByNameV2(ctx, orgID, dashboardtypes.SystemDashboardNamePrefix+name)
-	if err != nil {
-		return nil, err
-	}
-	if err := existing.ErrIfNotSystem(); err != nil {
-		return nil, err
-	}
-
-	return existing, nil
-}

pkg/modules/systemdashboard/implsystemdashboard/module_test.go

@@ -1,209 +0,0 @@
-package implsystemdashboard
-
-import (
-	"context"
-	"path/filepath"
-	"strconv"
-	"testing"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/analytics/analyticstest"
-	"github.com/SigNoz/signoz/pkg/factory/factorytest"
-	"github.com/SigNoz/signoz/pkg/modules/dashboard"
-	"github.com/SigNoz/signoz/pkg/modules/dashboard/impldashboard"
-	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
-	"github.com/SigNoz/signoz/pkg/queryparser"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/sqlstore/sqlitesqlstore"
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
-	"github.com/SigNoz/signoz/pkg/types/systemdashboardtypes"
-	"github.com/SigNoz/signoz/pkg/types/tagtypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const testDashboardName = "test-overview"
-
-func newTestSQLStore(t *testing.T) sqlstore.SQLStore {
-	t.Helper()
-
-	store, err := sqlitesqlstore.New(context.Background(), factorytest.NewSettings(), sqlstore.Config{
-		Provider:   "sqlite",
-		Connection: sqlstore.ConnectionConfig{MaxOpenConns: 10},
-		Sqlite: sqlstore.SqliteConfig{
-			Path:            filepath.Join(t.TempDir(), "test.db"),
-			Mode:            "wal",
-			BusyTimeout:     5 * time.Second,
-			TransactionMode: "deferred",
-		},
-	})
-	require.NoError(t, err)
-
-	for _, model := range []any{
-		(*dashboardtypes.StorableDashboard)(nil),
-		(*tagtypes.Tag)(nil),
-		(*tagtypes.TagRelation)(nil),
-		(*systemdashboardtypes.StorableSystemDashboard)(nil),
-	} {
-		_, err := store.BunDB().NewCreateTable().Model(model).IfNotExists().Exec(context.Background())
-		require.NoError(t, err)
-	}
-
-	_, err = store.BunDB().Exec(`CREATE UNIQUE INDEX IF NOT EXISTS uq_system_dashboard_org_name ON system_dashboard (org_id, name)`)
-	require.NoError(t, err)
-
-	return store
-}
-
-func newTestModule(t *testing.T, sqlStore sqlstore.SQLStore, definitions ...systemdashboardtypes.Definition) (*module, dashboard.Module) {
-	t.Helper()
-
-	providerSettings := factorytest.NewSettings()
-	dashboardModule := impldashboard.NewModule(
-		impldashboard.NewStore(sqlStore),
-		providerSettings,
-		analyticstest.New(),
-		nil,
-		queryparser.New(providerSettings),
-		impltag.NewModule(impltag.NewStore(sqlStore)),
-	)
-
-	registry, err := systemdashboardtypes.NewRegistry(definitions)
-	require.NoError(t, err)
-
-	return NewModule(providerSettings, NewStore(sqlStore), registry, dashboardModule).(*module), dashboardModule
-}
-
-func newTestDefinition(t *testing.T, version int, displayName string) systemdashboardtypes.Definition {
-	t.Helper()
-
-	raw := `{
-		"version": ` + strconv.Itoa(version) + `,
-		"definition": {
-			"schemaVersion": "` + dashboardtypes.SchemaVersion + `",
-			"name": "` + dashboardtypes.SystemDashboardNamePrefix + testDashboardName + `",
-			"tags": [],
-			"spec": {"display": {"name": "` + displayName + `"}, "variables": [], "panels": {}, "layouts": []}
-		}
-	}`
-
-	definition, err := systemdashboardtypes.NewDefinition([]byte(raw))
-	require.NoError(t, err)
-
-	return definition
-}
-
-func TestReconcileProvisionsThenUpgradesUntilTheRowIsModified(t *testing.T) {
-	ctx := context.Background()
-	sqlStore := newTestSQLStore(t)
-	orgID := valuer.GenerateUUID()
-
-	systemDashboardModule, _ := newTestModule(t, sqlStore, newTestDefinition(t, 1, "v1"))
-	require.NoError(t, systemDashboardModule.Reconcile(ctx, orgID))
-
-	provisioned, err := systemDashboardModule.Get(ctx, orgID, testDashboardName)
-	require.NoError(t, err)
-	assert.Equal(t, dashboardtypes.SourceSystem, provisioned.Source)
-	assert.Equal(t, systemdashboardtypes.ProvisionerIdentity, provisioned.CreatedBy)
-	assert.Equal(t, "v1", provisioned.Spec.Display.Name)
-	assert.Equal(t, 1, stateVersion(t, systemDashboardModule, ctx, orgID))
-
-	// Reconciling the same version again is a no-op.
-	require.NoError(t, systemDashboardModule.Reconcile(ctx, orgID))
-	unchanged, err := systemDashboardModule.Get(ctx, orgID, testDashboardName)
-	require.NoError(t, err)
-	assert.Equal(t, provisioned.UpdatedAt, unchanged.UpdatedAt)
-
-	// An unmodified copy is upgraded in place, keeping its id.
-	upgradingModule, dashboardModule := newTestModule(t, sqlStore, newTestDefinition(t, 2, "v2"))
-	require.NoError(t, upgradingModule.Reconcile(ctx, orgID))
-
-	upgraded, err := upgradingModule.Get(ctx, orgID, testDashboardName)
-	require.NoError(t, err)
-	assert.Equal(t, provisioned.ID, upgraded.ID)
-	assert.Equal(t, "v2", upgraded.Spec.Display.Name)
-	assert.Equal(t, 2, stateVersion(t, upgradingModule, ctx, orgID))
-
-	// Once anything but the provisioner writes the row, later releases leave it alone.
-	updatable := newTestDefinition(t, 2, "edited out of band").ToUpdatable()
-	_, err = dashboardModule.UpdateUnsafeV2(ctx, orgID, upgraded.ID, "user@signoz.io", updatable)
-	require.NoError(t, err)
-
-	shippingModule, _ := newTestModule(t, sqlStore, newTestDefinition(t, 3, "v3"))
-	require.NoError(t, shippingModule.Reconcile(ctx, orgID))
-
-	untouched, err := shippingModule.Get(ctx, orgID, testDashboardName)
-	require.NoError(t, err)
-	assert.Equal(t, "user@signoz.io", untouched.UpdatedBy)
-	assert.Equal(t, "edited out of band", untouched.Spec.Display.Name)
-	assert.Equal(t, 2, stateVersion(t, shippingModule, ctx, orgID))
-}
-
-func stateVersion(t *testing.T, module *module, ctx context.Context, orgID valuer.UUID) int {
-	t.Helper()
-
-	state, err := module.store.Get(ctx, orgID, dashboardtypes.SystemDashboardNamePrefix+testDashboardName)
-	require.NoError(t, err)
-
-	return state.Version
-}
-
-func TestSystemDashboardsAreImmutableToUsers(t *testing.T) {
-	ctx := context.Background()
-	sqlStore := newTestSQLStore(t)
-	orgID := valuer.GenerateUUID()
-
-	systemDashboardModule, dashboardModule := newTestModule(t, sqlStore, newTestDefinition(t, 1, "v1"))
-	require.NoError(t, systemDashboardModule.Reconcile(ctx, orgID))
-
-	provisioned, err := systemDashboardModule.Get(ctx, orgID, testDashboardName)
-	require.NoError(t, err)
-
-	_, err = dashboardModule.UpdateV2(ctx, orgID, provisioned.ID, "user@signoz.io", newTestDefinition(t, 1, "edited").ToUpdatable())
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "cannot be modified")
-}
-
-func TestReconcileDoesNotDowngrade(t *testing.T) {
-	ctx := context.Background()
-	sqlStore := newTestSQLStore(t)
-	orgID := valuer.GenerateUUID()
-
-	newerModule, _ := newTestModule(t, sqlStore, newTestDefinition(t, 3, "v3"))
-	require.NoError(t, newerModule.Reconcile(ctx, orgID))
-
-	olderModule, _ := newTestModule(t, sqlStore, newTestDefinition(t, 2, "v2"))
-	require.NoError(t, olderModule.Reconcile(ctx, orgID))
-
-	got, err := newerModule.Get(ctx, orgID, testDashboardName)
-	require.NoError(t, err)
-	assert.Equal(t, "v3", got.Spec.Display.Name)
-	assert.Equal(t, 3, stateVersion(t, newerModule, ctx, orgID))
-}
-
-func TestGetRejectsANonSystemDashboard(t *testing.T) {
-	ctx := context.Background()
-	sqlStore := newTestSQLStore(t)
-	orgID := valuer.GenerateUUID()
-
-	systemDashboardModule, dashboardModule := newTestModule(t, sqlStore)
-
-	var postable dashboardtypes.PostableDashboardV2
-	require.NoError(t, postable.UnmarshalJSON([]byte(`{
-		"schemaVersion": "`+dashboardtypes.SchemaVersion+`",
-		"name": "a-user-dashboard",
-		"tags": [],
-		"spec": {"display": {"name": "user"}, "variables": [], "panels": {}, "layouts": []}
-	}`)))
-	_, err := dashboardModule.CreateV2(ctx, orgID, "user@signoz.io", valuer.GenerateUUID(), dashboardtypes.SourceUser, postable)
-	require.NoError(t, err)
-
-	// The server-side prefix makes user names structurally unreachable here.
-	_, err = systemDashboardModule.Get(ctx, orgID, "a-user-dashboard")
-	require.Error(t, err)
-
-	_, err = systemDashboardModule.Get(ctx, orgID, dashboardtypes.SystemDashboardNamePrefix+testDashboardName)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "must not carry")
-}

pkg/modules/systemdashboard/implsystemdashboard/service.go

@@ -1,81 +0,0 @@
-package implsystemdashboard
-
-import (
-	"context"
-	"log/slog"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/modules/organization"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
-)
-
-const reconcileRetryInterval = 30 * time.Second
-
-type service struct {
-	settings  factory.ScopedProviderSettings
-	module    systemdashboard.Module
-	orgGetter organization.Getter
-	stopC     chan struct{}
-	healthyC  chan struct{}
-}
-
-// NewService reconciles every org's system dashboards once at startup. Orgs
-// created later are reconciled by the organization setter instead.
-func NewService(providerSettings factory.ProviderSettings, module systemdashboard.Module, orgGetter organization.Getter) factory.Service {
-	return &service{
-		settings:  factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"),
-		module:    module,
-		orgGetter: orgGetter,
-		stopC:     make(chan struct{}),
-		healthyC:  make(chan struct{}),
-	}
-}
-
-func (service *service) Start(ctx context.Context) error {
-	ticker := time.NewTicker(reconcileRetryInterval)
-	defer ticker.Stop()
-
-	for {
-		err := service.reconcile(ctx)
-		if err == nil {
-			close(service.healthyC)
-			<-service.stopC
-			return nil
-		}
-
-		service.settings.Logger().WarnContext(ctx, "system dashboard reconciliation failed, retrying", errors.Attr(err))
-
-		select {
-		case <-service.stopC:
-			return nil
-		case <-ticker.C:
-		}
-	}
-}
-
-func (service *service) Healthy() <-chan struct{} {
-	return service.healthyC
-}
-
-func (service *service) Stop(_ context.Context) error {
-	close(service.stopC)
-	return nil
-}
-
-func (service *service) reconcile(ctx context.Context) error {
-	orgs, err := service.orgGetter.ListByOwnedKeyRange(ctx)
-	if err != nil {
-		return err
-	}
-
-	for _, org := range orgs {
-		if err := service.module.Reconcile(ctx, org.ID); err != nil {
-			return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "couldn't reconcile system dashboards for org %s", org.ID.StringValue())
-		}
-	}
-
-	service.settings.Logger().InfoContext(ctx, "system dashboard reconciliation completed", slog.Int("orgs", len(orgs)))
-	return nil
-}

pkg/modules/systemdashboard/implsystemdashboard/store.go

@@ -1,80 +0,0 @@
-package implsystemdashboard
-
-import (
-	"context"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/systemdashboardtypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
-
-type store struct {
-	sqlstore sqlstore.SQLStore
-}
-
-func NewStore(sqlstore sqlstore.SQLStore) systemdashboardtypes.Store {
-	return &store{sqlstore: sqlstore}
-}
-
-func (store *store) Create(ctx context.Context, storable *systemdashboardtypes.StorableSystemDashboard) error {
-	_, err := store.
-		sqlstore.
-		BunDBCtx(ctx).
-		NewInsert().
-		Model(storable).
-		Exec(ctx)
-	if err != nil {
-		return store.sqlstore.WrapAlreadyExistsErrf(err, systemdashboardtypes.ErrCodeSystemDashboardAlreadyProvisioned, "system dashboard %s is already provisioned", storable.Name)
-	}
-
-	return nil
-}
-
-func (store *store) Get(ctx context.Context, orgID valuer.UUID, name string) (*systemdashboardtypes.StorableSystemDashboard, error) {
-	storable := new(systemdashboardtypes.StorableSystemDashboard)
-	err := store.
-		sqlstore.
-		BunDBCtx(ctx).
-		NewSelect().
-		Model(storable).
-		Where("org_id = ?", orgID).
-		Where("name = ?", name).
-		Scan(ctx)
-	if err != nil {
-		return nil, store.sqlstore.WrapNotFoundErrf(err, systemdashboardtypes.ErrCodeSystemDashboardNotFound, "system dashboard %s is not provisioned", name)
-	}
-
-	return storable, nil
-}
-
-func (store *store) UpdateVersion(ctx context.Context, orgID valuer.UUID, name string, version int) error {
-	result, err := store.
-		sqlstore.
-		BunDBCtx(ctx).
-		NewUpdate().
-		Model(new(systemdashboardtypes.StorableSystemDashboard)).
-		Set("version = ?", version).
-		Set("updated_at = ?", time.Now()).
-		Where("org_id = ?", orgID).
-		Where("name = ?", name).
-		Exec(ctx)
-	if err != nil {
-		return err
-	}
-
-	rows, err := result.RowsAffected()
-	if err != nil {
-		return err
-	}
-	if rows == 0 {
-		return errors.Newf(errors.TypeNotFound, systemdashboardtypes.ErrCodeSystemDashboardNotFound, "system dashboard %s is not provisioned", name)
-	}
-
-	return nil
-}
-
-func (store *store) RunInTx(ctx context.Context, cb func(ctx context.Context) error) error {
-	return store.sqlstore.RunInTxCtx(ctx, nil, cb)
-}

pkg/modules/systemdashboard/systemdashboard.go

@@ -1,28 +0,0 @@
-package systemdashboard
-
-import (
-	"context"
-	"net/http"
-
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
-
-type Module interface {
-	// Reconcile provisions the org's missing system dashboards and upgrades the
-	// unmodified ones to the shipped version. It never touches a dashboard whose
-	// row carries a foreign write and it never deletes.
-	Reconcile(ctx context.Context, orgID valuer.UUID) error
-
-	// Get addresses the dashboard by its bare definition name; the reserved
-	// prefix is a storage concern the API never exposes.
-	Get(ctx context.Context, orgID valuer.UUID, name string) (*dashboardtypes.DashboardV2, error)
-
-	// ResolveID maps a system dashboard's name to its id, so routes addressed by
-	// name can be authz-checked and audited against the id tuples carry.
-	ResolveID(ctx context.Context, orgID valuer.UUID, name string) (valuer.UUID, error)
-}
-
-type Handler interface {
-	Get(http.ResponseWriter, *http.Request)
-}

pkg/query-service/app/http_handler.go

@@ -439,7 +439,7 @@ func (aH *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 	router.HandleFunc("/api/v2/traces/fields", am.EditAccess(aH.updateTraceField)).Methods(http.MethodPost)
 
 	router.HandleFunc("/api/v1/version", am.OpenAccess(aH.getVersion)).Methods(http.MethodGet)
-	router.HandleFunc("/api/v1/features", am.OpenAccess(aH.getFeatureFlags)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v1/features", am.ViewAccess(aH.getFeatureFlags)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/health", am.OpenAccess(aH.getHealth)).Methods(http.MethodGet)
 
 	router.HandleFunc("/api/v1/listErrors", am.ViewAccess(aH.listErrors)).Methods(http.MethodPost)
@@ -1497,7 +1497,7 @@ func (aH *APIHandler) getFeatureFlags(w http.ResponseWriter, r *http.Request) {
 
 	claims, err := authtypes.ClaimsFromContext(r.Context())
 	if err != nil {
-		aH.HandleError(w, err, http.StatusUnauthorized)
+		aH.HandleError(w, err, http.StatusInternalServerError)
 		return
 	}
 

pkg/querybuilder/key_resolution.go

@@ -107,8 +107,8 @@ func SynthesizeKeys(field *telemetrytypes.TelemetryFieldKey, value any) []*telem
 		fieldContext = telemetrytypes.FieldContextAttribute
 	}
 	fieldDataType := field.FieldDataType
-	// Resource and scope values are strings; pin the type so operand coercion applies.
-	if (fieldContext == telemetrytypes.FieldContextResource || fieldContext == telemetrytypes.FieldContextScope) &&
+	// Resource values are strings; pin the type so operand coercion applies.
+	if fieldContext == telemetrytypes.FieldContextResource &&
 		fieldDataType == telemetrytypes.FieldDataTypeUnspecified {
 		fieldDataType = telemetrytypes.FieldDataTypeString
 	}

pkg/querybuilder/query_to_keys.go

@@ -56,17 +56,6 @@ func QueryStringToKeysSelectors(query string) []*telemetrytypes.FieldKeySelector
 					FieldDataType: key.FieldDataType,
 				})
 			}
-
-			// todo(tushar): consider reverting changes done to this method in below PR to avoid scope specific checks
-			// https://github.com/SigNoz/signoz/issues/11374
-			if key.FieldContext == telemetrytypes.FieldContextScope {
-				keys = append(keys, &telemetrytypes.FieldKeySelector{
-					Name:          key.FieldContext.StringValue() + "." + key.Name,
-					Signal:        key.Signal,
-					FieldContext:  telemetrytypes.FieldContextUnspecified, // this allows 'scope.' prefix for keys with other context as well
-					FieldDataType: key.FieldDataType,
-				})
-			}
 		}
 	}
 

pkg/querybuilder/query_to_keys_test.go

@@ -72,44 +72,6 @@ func TestQueryToKeys(t *testing.T) {
 				},
 			},
 		},
-		{
-			query: `scope.version = '1.0.0'`,
-			expectedKeys: []telemetrytypes.FieldKeySelector{
-				{
-					Name:          "version",
-					Signal:        telemetrytypes.SignalUnspecified,
-					FieldContext:  telemetrytypes.FieldContextScope,
-					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
-				},
-				{
-					Name:          "scope.version",
-					Signal:        telemetrytypes.SignalUnspecified,
-					FieldContext:  telemetrytypes.FieldContextUnspecified,
-					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
-				},
-			},
-		},
-		{
-			// A scope attribute whose own name carries a `scope.` prefix. `scope.prefixed`
-			// normalizes to {prefixed, scope}; the second selector re-adds the prefix so the
-			// metadata fetch can target the attribute's exact key `scope.prefixed` rather than
-			// relying on the broad `%prefixed%` match.
-			query: `scope.prefixed = 'x'`,
-			expectedKeys: []telemetrytypes.FieldKeySelector{
-				{
-					Name:          "prefixed",
-					Signal:        telemetrytypes.SignalUnspecified,
-					FieldContext:  telemetrytypes.FieldContextScope,
-					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
-				},
-				{
-					Name:          "scope.prefixed",
-					Signal:        telemetrytypes.SignalUnspecified,
-					FieldContext:  telemetrytypes.FieldContextUnspecified,
-					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
-				},
-			},
-		},
 	}
 
 	for _, testCase := range testCases {

pkg/signoz/handler.go

@@ -46,8 +46,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile/implspanpercentile"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail/impltracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/tracefunnel"
@@ -90,7 +88,6 @@ type Handlers struct {
 	RulerHandler            ruler.Handler
 	LLMPricingRuleHandler   llmpricingrule.Handler
 	StatsHandler            statsreporter.Handler
-	SystemDashboard         systemdashboard.Handler
 }
 
 func NewHandlers(
@@ -140,6 +137,5 @@ func NewHandlers(
 		RulerHandler:            signozruler.NewHandler(rulerService),
 		LLMPricingRuleHandler:   impllmpricingrule.NewHandler(modules.LLMPricingRule),
 		StatsHandler:            statsreporter.NewHandler(statsAggregator),
-		SystemDashboard:         implsystemdashboard.NewHandler(modules.SystemDashboard),
 	}
 }

pkg/signoz/handler_test.go

@@ -59,7 +59,7 @@ func TestNewHandlers(t *testing.T) {
 	userGetter := impluser.NewGetter(impluser.NewStore(sqlstore, providerSettings), userRoleStore, flagger)
 
 	retentionGetter := implretention.NewGetter(implretention.NewStore(sqlstore))
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil, nil)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil)
 
 	querierHandler := querier.NewHandler(providerSettings, nil, nil)
 	registryHandler := factory.NewHandler(nil)

pkg/signoz/module.go

@@ -48,7 +48,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile/implspanpercentile"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tag"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail/impltracedetail"
@@ -68,36 +67,35 @@ import (
 )
 
 type Modules struct {
-	OrgGetter            organization.Getter
-	OrgSetter            organization.Setter
-	Preference           preference.Module
-	UserSetter           user.Setter
-	UserGetter           user.Getter
-	RetentionGetter      retention.Getter
-	SavedView            savedview.Module
-	Apdex                apdex.Module
-	Dashboard            dashboard.Module
-	QuickFilter          quickfilter.Module
-	TraceFunnel          tracefunnel.Module
-	RawDataExport        rawdataexport.Module
-	AuthDomain           authdomain.Module
-	Session              session.Module
-	Services             services.Module
-	SpanPercentile       spanpercentile.Module
-	MetricsExplorer      metricsexplorer.Module
-	MetricReductionRule  metricreductionrule.Module
-	InfraMonitoring      inframonitoring.Module
+	OrgGetter           organization.Getter
+	OrgSetter           organization.Setter
+	Preference          preference.Module
+	UserSetter          user.Setter
+	UserGetter          user.Getter
+	RetentionGetter     retention.Getter
+	SavedView           savedview.Module
+	Apdex               apdex.Module
+	Dashboard           dashboard.Module
+	QuickFilter         quickfilter.Module
+	TraceFunnel         tracefunnel.Module
+	RawDataExport       rawdataexport.Module
+	AuthDomain          authdomain.Module
+	Session             session.Module
+	Services            services.Module
+	SpanPercentile      spanpercentile.Module
+	MetricsExplorer     metricsexplorer.Module
+	MetricReductionRule metricreductionrule.Module
+	InfraMonitoring     inframonitoring.Module
 	Promote              promote.Module
 	ServiceAccount       serviceaccount.Module
 	ServiceAccountGetter serviceaccount.Getter
 	CloudIntegration     cloudintegration.Module
-	LogsPipeline         logspipeline.Module
-	RuleStateHistory     rulestatehistory.Module
-	TraceDetail          tracedetail.Module
-	SpanMapper           spanmapper.Module
-	LLMPricingRule       llmpricingrule.Module
-	Tag                  tag.Module
-	SystemDashboard      systemdashboard.Module
+	LogsPipeline        logspipeline.Module
+	RuleStateHistory    rulestatehistory.Module
+	TraceDetail         tracedetail.Module
+	SpanMapper          spanmapper.Module
+	LLMPricingRule      llmpricingrule.Module
+	Tag                 tag.Module
 }
 
 func NewModules(
@@ -126,10 +124,9 @@ func NewModules(
 	fl flagger.Flagger,
 	tagModule tag.Module,
 	metricReductionRule metricreductionrule.Module,
-	systemDashboard systemdashboard.Module,
 ) Modules {
 	quickfilter := implquickfilter.NewModule(implquickfilter.NewStore(sqlstore))
-	orgSetter := implorganization.NewSetter(implorganization.NewStore(sqlstore), alertmanager, quickfilter, systemDashboard)
+	orgSetter := implorganization.NewSetter(implorganization.NewStore(sqlstore), alertmanager, quickfilter)
 	// Cleanup callbacks from other modules, invoked when a user is deleted.
 	onDeleteUser := []user.OnDeleteUser{
 		dashboard.DeletePreferencesForUser,
@@ -139,35 +136,34 @@ func NewModules(
 	authDomainModule := implauthdomain.NewModule(implauthdomain.NewStore(sqlstore), authNs, authz)
 
 	return Modules{
-		OrgGetter:            orgGetter,
-		OrgSetter:            orgSetter,
-		Preference:           implpreference.NewModule(implpreference.NewStore(sqlstore), preferencetypes.NewAvailablePreference()),
-		SavedView:            implsavedview.NewModule(implsavedview.NewStore(sqlstore)),
-		Apdex:                implapdex.NewModule(sqlstore),
-		Dashboard:            dashboard,
-		UserSetter:           userSetter,
-		UserGetter:           userGetter,
-		RetentionGetter:      retentionGetter,
-		QuickFilter:          quickfilter,
-		TraceFunnel:          impltracefunnel.NewModule(impltracefunnel.NewStore(sqlstore)),
-		RawDataExport:        implrawdataexport.NewModule(querier),
-		AuthDomain:           authDomainModule,
-		Session:              implsession.NewModule(providerSettings, authNs, userSetter, userGetter, authDomainModule, tokenizer, orgGetter, authz, config.Global),
-		SpanPercentile:       implspanpercentile.NewModule(querier, providerSettings),
-		Services:             implservices.NewModule(querier, telemetryStore),
-		MetricsExplorer:      implmetricsexplorer.NewModule(telemetryStore, telemetryMetadataStore, cache, ruleStore, dashboard, fl, providerSettings, config.MetricsExplorer),
-		MetricReductionRule:  metricReductionRule,
-		InfraMonitoring:      implinframonitoring.NewModule(telemetryStore, telemetryMetadataStore, querier, fl, providerSettings, config.InfraMonitoring),
-		Promote:              implpromote.NewModule(telemetryMetadataStore, telemetryStore),
+		OrgGetter:           orgGetter,
+		OrgSetter:           orgSetter,
+		Preference:          implpreference.NewModule(implpreference.NewStore(sqlstore), preferencetypes.NewAvailablePreference()),
+		SavedView:           implsavedview.NewModule(implsavedview.NewStore(sqlstore)),
+		Apdex:               implapdex.NewModule(sqlstore),
+		Dashboard:           dashboard,
+		UserSetter:          userSetter,
+		UserGetter:          userGetter,
+		RetentionGetter:     retentionGetter,
+		QuickFilter:         quickfilter,
+		TraceFunnel:         impltracefunnel.NewModule(impltracefunnel.NewStore(sqlstore)),
+		RawDataExport:       implrawdataexport.NewModule(querier),
+		AuthDomain:          authDomainModule,
+		Session:             implsession.NewModule(providerSettings, authNs, userSetter, userGetter, authDomainModule, tokenizer, orgGetter, authz, config.Global),
+		SpanPercentile:      implspanpercentile.NewModule(querier, providerSettings),
+		Services:            implservices.NewModule(querier, telemetryStore),
+		MetricsExplorer:     implmetricsexplorer.NewModule(telemetryStore, telemetryMetadataStore, cache, ruleStore, dashboard, fl, providerSettings, config.MetricsExplorer),
+		MetricReductionRule: metricReductionRule,
+		InfraMonitoring:     implinframonitoring.NewModule(telemetryStore, telemetryMetadataStore, querier, fl, providerSettings, config.InfraMonitoring),
+		Promote:             implpromote.NewModule(telemetryMetadataStore, telemetryStore),
 		ServiceAccount:       serviceAccount,
 		ServiceAccountGetter: serviceAccountGetter,
-		LogsPipeline:         impllogspipeline.NewModule(sqlstore),
-		RuleStateHistory:     implrulestatehistory.NewModule(implrulestatehistory.NewStore(telemetryStore, telemetryMetadataStore, providerSettings.Logger), ruleStore),
-		CloudIntegration:     cloudIntegrationModule,
-		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore), providerSettings, config.TraceDetail),
-		SpanMapper:           implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), fl),
-		LLMPricingRule:       impllmpricingrule.NewModule(impllmpricingrule.NewStore(sqlstore), fl, querier),
-		Tag:                  tagModule,
-		SystemDashboard:      systemDashboard,
+		LogsPipeline:        impllogspipeline.NewModule(sqlstore),
+		RuleStateHistory:    implrulestatehistory.NewModule(implrulestatehistory.NewStore(telemetryStore, telemetryMetadataStore, providerSettings.Logger), ruleStore),
+		CloudIntegration:    cloudIntegrationModule,
+		TraceDetail:         impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore), providerSettings, config.TraceDetail),
+		SpanMapper:          implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), fl),
+		LLMPricingRule:      impllmpricingrule.NewModule(impllmpricingrule.NewStore(sqlstore), fl, querier),
+		Tag:                 tagModule,
 	}
 }

pkg/signoz/module_test.go

@@ -21,7 +21,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/retention/implretention"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount/implserviceaccount"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
 	"github.com/SigNoz/signoz/pkg/queryparser"
@@ -67,12 +66,7 @@ func TestNewModules(t *testing.T) {
 
 	retentionGetter := implretention.NewGetter(implretention.NewStore(sqlstore))
 
-	systemDashboardRegistry, err := implsystemdashboard.NewRegistry()
-	require.NoError(t, err)
-
-	systemDashboard := implsystemdashboard.NewModule(providerSettings, implsystemdashboard.NewStore(sqlstore), systemDashboardRegistry, dashboardModule)
-
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule(), systemDashboard)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule())
 
 	reflectVal := reflect.ValueOf(modules)
 	for i := 0; i < reflectVal.NumField(); i++ {

pkg/signoz/openapi.go

@@ -35,7 +35,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/session"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/modules/user"
 	"github.com/SigNoz/signoz/pkg/querier"
@@ -94,8 +93,6 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ ruler.Handler }{},
 		struct{ statsreporter.Handler }{},
 		struct{ savedview.Handler }{},
-		struct{ systemdashboard.Module }{},
-		struct{ systemdashboard.Handler }{},
 	).New(ctx, instrumentation.ToProviderSettings(), apiserver.Config{})
 	if err != nil {
 		return nil, err

pkg/signoz/provider.go

@@ -244,7 +244,6 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewDeleteOrphanUserRolesFactory(),
 		sqlmigration.NewMigrateLambdaDashboardsFactory(),
 		sqlmigration.NewAddAuthDomainTuplesFactory(sqlstore),
-		sqlmigration.NewAddSystemDashboardFactory(sqlstore, sqlschema),
 	)
 }
 
@@ -348,8 +347,6 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.RulerHandler,
 			handlers.StatsHandler,
 			handlers.SavedView,
-			modules.SystemDashboard,
-			handlers.SystemDashboard,
 		),
 	)
 }

pkg/signoz/signoz.go

@@ -36,7 +36,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/rulestatehistory"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount/implserviceaccount"
-	"github.com/SigNoz/signoz/pkg/modules/systemdashboard/implsystemdashboard"
 	"github.com/SigNoz/signoz/pkg/modules/tag"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
@@ -541,16 +540,8 @@ func New(
 
 	metricReductionRuleModule := metricReductionRuleModuleCallback(sqlstore, telemetrystore, dashboard, queryParser, licensing, flagger, telemetryMetadataStore, providerSettings, config.MetricsExplorer.TelemetryStore.Threads)
 
-	// Initialize the system dashboard module. The registry is parsed here so a
-	// malformed embedded definition fails startup instead of a request.
-	systemDashboardRegistry, err := implsystemdashboard.NewRegistry()
-	if err != nil {
-		return nil, err
-	}
-	systemDashboardModule := implsystemdashboard.NewModule(providerSettings, implsystemdashboard.NewStore(sqlstore), systemDashboardRegistry, dashboard)
-
 	// Initialize all modules
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule, systemDashboardModule)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule)
 
 	// Initialize ruler from the variant-specific provider factories
 	rulerInstance, err := factory.NewProviderFromNamedMap(ctx, providerSettings, config.Ruler, rulerProviderFactories(cache, alertmanager, sqlstore, telemetrystore, telemetryMetadataStore, prometheus, orgGetter, modules.RuleStateHistory, querier, queryParser), "signoz")
@@ -619,7 +610,6 @@ func New(
 		factory.NewNamedService(factory.MustNewName("auditor"), auditor),
 		factory.NewNamedService(factory.MustNewName("meterreporter"), meterReporter, factory.MustNewName("licensing")),
 		factory.NewNamedService(factory.MustNewName("ruler"), rulerInstance),
-		factory.NewNamedService(factory.MustNewName("systemdashboard"), implsystemdashboard.NewService(providerSettings, systemDashboardModule, orgGetter)),
 	)
 	if err != nil {
 		return nil, err

pkg/sqlmigration/118_add_system_dashboard.go

@@ -1,93 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlschema"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addSystemDashboard struct {
-	sqlstore  sqlstore.SQLStore
-	sqlschema sqlschema.SQLSchema
-}
-
-func NewAddSystemDashboardFactory(sqlstore sqlstore.SQLStore, sqlschema sqlschema.SQLSchema) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(
-		factory.MustNewName("add_system_dashboard"),
-		func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-			return &addSystemDashboard{sqlstore: sqlstore, sqlschema: sqlschema}, nil
-		},
-	)
-}
-
-func (migration *addSystemDashboard) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addSystemDashboard) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	sqls := migration.sqlschema.Operator().CreateTable(&sqlschema.Table{
-		Name: "system_dashboard",
-		Columns: []*sqlschema.Column{
-			{Name: "id", DataType: sqlschema.DataTypeText, Nullable: false},
-			{Name: "org_id", DataType: sqlschema.DataTypeText, Nullable: false},
-			{Name: "dashboard_id", DataType: sqlschema.DataTypeText, Nullable: false},
-			{Name: "name", DataType: sqlschema.DataTypeText, Nullable: false},
-			{Name: "version", DataType: sqlschema.DataTypeBigInt, Nullable: false},
-			{Name: "created_at", DataType: sqlschema.DataTypeTimestamp, Nullable: false},
-			{Name: "updated_at", DataType: sqlschema.DataTypeTimestamp, Nullable: false},
-		},
-		PrimaryKeyConstraint: &sqlschema.PrimaryKeyConstraint{
-			ColumnNames: []sqlschema.ColumnName{"id"},
-		},
-		ForeignKeyConstraints: []*sqlschema.ForeignKeyConstraint{
-			{
-				ReferencingColumnName: sqlschema.ColumnName("org_id"),
-				ReferencedTableName:   sqlschema.TableName("organizations"),
-				ReferencedColumnName:  sqlschema.ColumnName("id"),
-			},
-			{
-				ReferencingColumnName: sqlschema.ColumnName("dashboard_id"),
-				ReferencedTableName:   sqlschema.TableName("dashboard"),
-				ReferencedColumnName:  sqlschema.ColumnName("id"),
-			},
-		},
-	})
-
-	// (org_id, name) is what makes provisioning safe across replicas: the state
-	// row is written in the same transaction as the dashboard, so a losing racer
-	// rolls back its dashboard too.
-	sqls = append(sqls, migration.sqlschema.Operator().CreateIndex(
-		&sqlschema.UniqueIndex{
-			TableName:   "system_dashboard",
-			ColumnNames: []sqlschema.ColumnName{"org_id", "name"},
-		},
-	)...)
-	sqls = append(sqls, migration.sqlschema.Operator().CreateIndex(
-		&sqlschema.UniqueIndex{
-			TableName:   "system_dashboard",
-			ColumnNames: []sqlschema.ColumnName{"dashboard_id"},
-		},
-	)...)
-
-	for _, sql := range sqls {
-		if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
-			return err
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addSystemDashboard) Down(context.Context, *bun.DB) error {
-	return nil
-}

pkg/statementbuilder/tracesstatementbuilder/statement_builder.go

@@ -204,15 +204,31 @@ func getKeySelectors(query qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation])
 	}
 
 	for idx := range query.GroupBy {
-		keySelectors = append(keySelectors, keySelectorsForField(query.GroupBy[idx].TelemetryFieldKey)...)
+		groupBy := query.GroupBy[idx]
+		keySelectors = append(keySelectors, &telemetrytypes.FieldKeySelector{
+			Name:          groupBy.Name,
+			Signal:        telemetrytypes.SignalTraces,
+			FieldContext:  groupBy.FieldContext,
+			FieldDataType: groupBy.FieldDataType,
+		})
 	}
 
 	for idx := range query.SelectFields {
-		keySelectors = append(keySelectors, keySelectorsForField(query.SelectFields[idx])...)
+		keySelectors = append(keySelectors, &telemetrytypes.FieldKeySelector{
+			Name:          query.SelectFields[idx].Name,
+			Signal:        telemetrytypes.SignalTraces,
+			FieldContext:  query.SelectFields[idx].FieldContext,
+			FieldDataType: query.SelectFields[idx].FieldDataType,
+		})
 	}
 
 	for idx := range query.Order {
-		keySelectors = append(keySelectors, keySelectorsForField(query.Order[idx].Key.TelemetryFieldKey)...)
+		keySelectors = append(keySelectors, &telemetrytypes.FieldKeySelector{
+			Name:          query.Order[idx].Key.Name,
+			Signal:        telemetrytypes.SignalTraces,
+			FieldContext:  query.Order[idx].Key.FieldContext,
+			FieldDataType: query.Order[idx].Key.FieldDataType,
+		})
 	}
 
 	for idx := range keySelectors {
@@ -223,26 +239,6 @@ func getKeySelectors(query qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation])
 	return keySelectors
 }
 
-func keySelectorsForField(key telemetrytypes.TelemetryFieldKey) []*telemetrytypes.FieldKeySelector {
-	selectors := []*telemetrytypes.FieldKeySelector{
-		{
-			Name:          key.Name,
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  key.FieldContext,
-			FieldDataType: key.FieldDataType,
-		},
-	}
-	if key.FieldContext != telemetrytypes.FieldContextUnspecified {
-		selectors = append(selectors, &telemetrytypes.FieldKeySelector{
-			Name:          key.FieldContext.StringValue() + "." + key.Name,
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  telemetrytypes.FieldContextUnspecified,
-			FieldDataType: key.FieldDataType,
-		})
-	}
-	return selectors
-}
-
 // mergeDeprecatedTraceKeys prepends deprecated intrinsic/calculated trace field
 // definitions to the keys map. We do this during statement building, not at
 // metadata fetch time, because:
@@ -314,14 +310,20 @@ func adjustTraceKey(key *telemetrytypes.TelemetryFieldKey, keys map[string][]*te
 
 		For example: trace_id (intrinsic), response_status_code (calculated).
 	*/
-	// Resolve against the context-qualified name first, then the bare name since that can be instrinsic field e.g. scope.name.
 	var isIntrinsicOrCalculatedField bool
 	var intrinsicOrCalculatedField telemetrytypes.TelemetryFieldKey
-	if key.FieldContext != telemetrytypes.FieldContextUnspecified {
-		intrinsicOrCalculatedField, isIntrinsicOrCalculatedField = lookupIntrinsicOrCalculatedField(key.FieldContext.StringValue() + "." + key.Name)
-	}
-	if !isIntrinsicOrCalculatedField {
-		intrinsicOrCalculatedField, isIntrinsicOrCalculatedField = lookupIntrinsicOrCalculatedField(key.Name)
+	if _, ok := tracestelemetryschema.IntrinsicFields[key.Name]; ok {
+		isIntrinsicOrCalculatedField = true
+		intrinsicOrCalculatedField = tracestelemetryschema.IntrinsicFields[key.Name]
+	} else if _, ok := tracestelemetryschema.CalculatedFields[key.Name]; ok {
+		isIntrinsicOrCalculatedField = true
+		intrinsicOrCalculatedField = tracestelemetryschema.CalculatedFields[key.Name]
+	} else if _, ok := tracestelemetryschema.IntrinsicFieldsDeprecated[key.Name]; ok {
+		isIntrinsicOrCalculatedField = true
+		intrinsicOrCalculatedField = tracestelemetryschema.IntrinsicFieldsDeprecated[key.Name]
+	} else if _, ok := tracestelemetryschema.CalculatedFieldsDeprecated[key.Name]; ok {
+		isIntrinsicOrCalculatedField = true
+		intrinsicOrCalculatedField = tracestelemetryschema.CalculatedFieldsDeprecated[key.Name]
 	}
 
 	if isIntrinsicOrCalculatedField {
@@ -333,24 +335,6 @@ func adjustTraceKey(key *telemetrytypes.TelemetryFieldKey, keys map[string][]*te
 	return actions
 }
 
-// lookupIntrinsicOrCalculatedField returns the intrinsic or calculated field registered under
-// name, across the current and deprecated tables.
-func lookupIntrinsicOrCalculatedField(name string) (telemetrytypes.TelemetryFieldKey, bool) {
-	if f, ok := tracestelemetryschema.IntrinsicFields[name]; ok {
-		return f, true
-	}
-	if f, ok := tracestelemetryschema.CalculatedFields[name]; ok {
-		return f, true
-	}
-	if f, ok := tracestelemetryschema.IntrinsicFieldsDeprecated[name]; ok {
-		return f, true
-	}
-	if f, ok := tracestelemetryschema.CalculatedFieldsDeprecated[name]; ok {
-		return f, true
-	}
-	return telemetrytypes.TelemetryFieldKey{}, false
-}
-
 // buildListQuery builds a query for list panel type.
 func (b *traceQueryStatementBuilder) buildListQuery(
 	ctx context.Context,

pkg/statementbuilder/tracesstatementbuilder/stmt_builder_test.go

@@ -374,94 +374,6 @@ func TestStatementBuilder(t *testing.T) {
 			},
 			expectedErr: nil,
 		},
-		{
-			name:        "scope.name filter and group by",
-			requestType: qbtypes.RequestTypeTimeSeries,
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Aggregations: []qbtypes.TraceAggregation{
-					{
-						Expression: "count()",
-					},
-				},
-				Filter: &qbtypes.Filter{
-					Expression: "scope.name = 'opentelemetry-io'",
-				},
-				Limit: 10,
-				GroupBy: []qbtypes.GroupByKey{
-					{
-						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
-							Name:         "scope.name",
-							FieldContext: telemetrytypes.FieldContextScope,
-						},
-					},
-				},
-			},
-			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.name::String = ? AND scope.name::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_scope.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.name::String = ? AND scope.name::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_scope.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_scope.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_scope.name`",
-				Args:  []any{"opentelemetry-io", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "opentelemetry-io", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
-			},
-			expectedErr: nil,
-		},
-		{
-			name:        "scope.version filter with scope.name group by",
-			requestType: qbtypes.RequestTypeTimeSeries,
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Aggregations: []qbtypes.TraceAggregation{
-					{
-						Expression: "count()",
-					},
-				},
-				Filter: &qbtypes.Filter{
-					Expression: "scope.version = '1.0.0'",
-				},
-				Limit: 10,
-				GroupBy: []qbtypes.GroupByKey{
-					{
-						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
-							Name:         "scope.name",
-							FieldContext: telemetrytypes.FieldContextScope,
-						},
-					},
-				},
-			},
-			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_scope.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_scope.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_scope.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_scope.name`",
-				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
-			},
-			expectedErr: nil,
-		},
-		{
-			name:        "scope.version filter only (no scope field in group by)",
-			requestType: qbtypes.RequestTypeTimeSeries,
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Aggregations: []qbtypes.TraceAggregation{
-					{
-						Expression: "count()",
-					},
-				},
-				Filter: &qbtypes.Filter{
-					Expression: "scope.version = '1.0.0'",
-				},
-				Limit: 10,
-				GroupBy: []qbtypes.GroupByKey{
-					{
-						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
-							Name: "service.name",
-						},
-					},
-				},
-			},
-			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name`",
-				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
-			},
-		},
 	}
 
 	fl := flaggertest.New(t)
@@ -888,143 +800,6 @@ func TestStatementBuilderListQueryWithCorruptData(t *testing.T) {
 			},
 			expectedErr: nil,
 		},
-		{
-			name:        "List query with scope filter only (no scope in select or group by)",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap: map[string][]*telemetrytypes.TelemetryFieldKey{
-				"scope.version": {
-					{
-						Name:          "scope.version",
-						Signal:        telemetrytypes.SignalTraces,
-						FieldContext:  telemetrytypes.FieldContextScope,
-						FieldDataType: telemetrytypes.FieldDataTypeString,
-					},
-				},
-			},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter: &qbtypes.Filter{
-					Expression: "scope.version = '1.0.0'",
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
-		{
-			// Regression test: scope.version in selectFields with no metadata (isColumn=true filters it out)
-			// must still produce scope.version::String, not scope.attributes.version::String
-			name:        "scope.version in selectFields only, no metadata (intrinsic field fallback)",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap:     map[string][]*telemetrytypes.TelemetryFieldKey{},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter:       &qbtypes.Filter{},
-				SelectFields: []telemetrytypes.TelemetryFieldKey{
-					{Name: "scope.version", FieldContext: telemetrytypes.FieldContextUnspecified},
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.version::String <> '', scope.version::String, NULL) AS `__SELECT_KEY_3_scope.version` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
-		{
-			// A scope attribute whose own name literally carries a `scope.` prefix (`scope.prefixed`,
-			// normalized to {prefixed, scope}) resolves to that attribute in a SELECT even without a
-			// filter: getKeySelectors emits the reconstructed `scope.prefixed` selector so the metadata
-			// fetch surfaces it and AdjustKey recovers the full name. Without it the `scope.` prefix is
-			// lost and it wrongly reads `scope.attributes.prefixed`.
-			name:        "scope-prefixed attribute in selectFields resolves without a filter",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap: map[string][]*telemetrytypes.TelemetryFieldKey{
-				"scope.prefixed": {
-					{
-						Name:          "scope.prefixed",
-						Signal:        telemetrytypes.SignalTraces,
-						FieldContext:  telemetrytypes.FieldContextScope,
-						FieldDataType: telemetrytypes.FieldDataTypeString,
-					},
-				},
-			},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter:       &qbtypes.Filter{},
-				SelectFields: []telemetrytypes.TelemetryFieldKey{
-					{Name: "prefixed", FieldContext: telemetrytypes.FieldContextScope},
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.attributes.`scope.prefixed` IS NOT NULL, scope.attributes.`scope.prefixed`::String, NULL) AS `__SELECT_KEY_3_scope.prefixed` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
-		{
-			// A scope-context key whose name matches a declared scope path resolves to that
-			// declared path (scope.name), not the span `name` column and not an undeclared
-			// scope attribute. getTracesKeys surfaces the declared path as an intrinsic key
-			// (metadata.go), which shadows the same-named span intrinsic.
-			name:        "scope-context name resolves to the declared scope path",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap: map[string][]*telemetrytypes.TelemetryFieldKey{
-				"scope.name": {
-					{
-						Name:          "scope.name",
-						Signal:        telemetrytypes.SignalTraces,
-						FieldContext:  telemetrytypes.FieldContextScope,
-						FieldDataType: telemetrytypes.FieldDataTypeString,
-					},
-				},
-				"name": {
-					{
-						Name:          "name",
-						Signal:        telemetrytypes.SignalTraces,
-						FieldContext:  telemetrytypes.FieldContextSpan,
-						FieldDataType: telemetrytypes.FieldDataTypeString,
-					},
-				},
-			},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter:       &qbtypes.Filter{},
-				SelectFields: []telemetrytypes.TelemetryFieldKey{
-					{Name: "name", FieldContext: telemetrytypes.FieldContextScope},
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.name::String <> '', scope.name::String, NULL) AS `__SELECT_KEY_3_name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
-		{
-			// span.scope.name (span context, name "scope.name") resolves to the declared
-			// scope path scope.name, not a span attribute literally named scope.name.
-			name:        "span-context scope.name in selectFields resolves to the declared scope path",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap:     map[string][]*telemetrytypes.TelemetryFieldKey{},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter:       &qbtypes.Filter{},
-				SelectFields: []telemetrytypes.TelemetryFieldKey{
-					{Name: "scope.name", FieldContext: telemetrytypes.FieldContextSpan},
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.name::String <> '', scope.name::String, NULL) AS `__SELECT_KEY_3_scope.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
 	}
 
 	for _, c := range cases {

pkg/telemetrymetadata/metadata.go

@@ -180,7 +180,7 @@ func (t *telemetryMetaStore) getTracesKeys(ctx context.Context, fieldKeySelector
 		`CASE
 			// WHEN tagType = 'spanfield' THEN 1
 			WHEN tagType = 'resource' THEN 2
-			WHEN tagType = 'scope' THEN 3
+			// WHEN tagType = 'scope' THEN 3
 			WHEN tagType = 'tag' THEN 4
 			ELSE 5
 		END as priority`,

pkg/telemetryschema/tracestelemetryschema/condition_builder_test.go

@@ -391,96 +391,6 @@ func TestConditionForResourceWithEvolution(t *testing.T) {
 	}
 }
 
-// TestConditionForScopeIntrinsicFields covers the scope.name/scope.version intrinsic
-// fields against the "scope" JSON column. These are *declared* String paths on that
-// column, so a row without a scope reads as ” and never NULL: presence must be an
-// empty-string check, since "IS NOT NULL" would hold for every row. That also rules
-// out treating them as nested attribute keys under scope.attributes, which are
-// undeclared (Dynamic) paths and genuinely NULL when absent.
-func TestConditionForScopeIntrinsicFields(t *testing.T) {
-	ctx := context.Background()
-	fm := NewFieldMapper(flaggertest.New(t))
-	conditionBuilder := NewConditionBuilder(fm, flaggertest.New(t))
-
-	testCases := []struct {
-		name        string
-		key         telemetrytypes.TelemetryFieldKey
-		operator    qbtypes.FilterOperator
-		value       any
-		expectedSQL string
-	}{
-		{
-			name: "Equal - scope.name",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "scope.name",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorEqual,
-			value:       "io.signoz.payment",
-			expectedSQL: "(scope.name::String = ? AND scope.name::String <> '')",
-		},
-		{
-			name: "Equal - scope.version",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "scope.version",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorEqual,
-			value:       "2.3.1",
-			expectedSQL: "(scope.version::String = ? AND scope.version::String <> '')",
-		},
-		{
-			name: "Exists - scope.name",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "scope.name",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorExists,
-			value:       nil,
-			expectedSQL: "scope.name::String <> ''",
-		},
-		{
-			name: "NotExists - scope.version",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "scope.version",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorNotExists,
-			value:       nil,
-			expectedSQL: "scope.version::String = ''",
-		},
-		{
-			// `scope.attribute.name` (normalized to {attribute.name, scope}) addresses the scope
-			// attribute named `name` — the declared `scope.name` path is never reached this way.
-			name: "Equal - scope.attribute.name reaches the named scope attribute",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "attribute.name",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorEqual,
-			value:       "io.signoz.checkout",
-			expectedSQL: "(scope.attributes.`name`::String = ? AND scope.attributes.`name` IS NOT NULL)",
-		},
-	}
-
-	for _, tc := range testCases {
-		sb := sqlbuilder.NewSelectBuilder()
-		t.Run(tc.name, func(t *testing.T) {
-			conds, _, err := conditionBuilder.ConditionFor(ctx, valuer.UUID{}, 0, 0, &tc.key, map[string][]*telemetrytypes.TelemetryFieldKey{tc.key.Name: {&tc.key}}, qbtypes.ConditionBuilderOptions{}, tc.operator, tc.value, sb)
-			require.NoError(t, err)
-			sb.Where(conds...)
-			sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-			assert.Contains(t, sql, tc.expectedSQL)
-			assert.NotContains(t, sql, "scope.`scope.", "must not double-prefix the scope JSON path")
-		})
-	}
-}
-
 // TestConditionForSynthesizedKeys covers the KeyNotFound fallback: when a
 // referenced attribute key has no metadata match, the builder synthesizes key(s) from
 // user input and queries anyway, emitting a warning instead of failing.
@@ -504,20 +414,6 @@ func TestConditionForSynthesizedKeys(t *testing.T) {
 		assert.Contains(t, args, "timeout")
 	})
 
-	t.Run("scope context with no metadata -> scope attribute", func(t *testing.T) {
-		sb := sqlbuilder.NewSelectBuilder()
-		key := telemetrytypes.TelemetryFieldKey{Name: "custom.attr", FieldContext: telemetrytypes.FieldContextScope}
-		conds, warnings, err := cb.ConditionFor(ctx, valuer.UUID{}, 0, 0, &key, noMatches, qbtypes.ConditionBuilderOptions{}, qbtypes.FilterOperatorEqual, "v", sb)
-		assert.NoError(t, err, "an undeclared scope attribute must still be filterable")
-		assert.NotEmpty(t, warnings)
-		sb.Where(conds...)
-		sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-		assert.Contains(t, sql, "scope.attributes.`custom.attr`")
-		// `scope.` can be part of the attribute's own name, so the literal spelling is a
-		// candidate too — the caller ORs the two.
-		assert.Contains(t, sql, "scope.attributes.`scope.custom.attr`")
-	})
-
 	t.Run("bare key with number operand -> attribute number", func(t *testing.T) {
 		sb := sqlbuilder.NewSelectBuilder()
 		key := telemetrytypes.TelemetryFieldKey{Name: "http.status"}

pkg/telemetryschema/tracestelemetryschema/const.go

@@ -121,20 +121,6 @@ var (
 			FieldContext:  telemetrytypes.FieldContextSpan,
 			FieldDataType: telemetrytypes.FieldDataTypeString,
 		},
-		"scope.name": {
-			Name:          "scope.name",
-			Description:   "Instrumentation scope name",
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  telemetrytypes.FieldContextScope,
-			FieldDataType: telemetrytypes.FieldDataTypeString,
-		},
-		"scope.version": {
-			Name:          "scope.version",
-			Description:   "Instrumentation scope version",
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  telemetrytypes.FieldContextScope,
-			FieldDataType: telemetrytypes.FieldDataTypeString,
-		},
 	}
 	IntrinsicFieldsDeprecated = map[string]telemetrytypes.TelemetryFieldKey{
 		"traceID": {

pkg/telemetryschema/tracestelemetryschema/field_mapper.go

@@ -53,7 +53,6 @@ var (
 			ValueType: schema.ColumnTypeString,
 		}},
 		"resource": {Name: "resource", Type: schema.JSONColumnType{}},
-		"scope":    {Name: "scope", Type: schema.JSONColumnType{}},
 
 		"events": {Name: "events", Type: schema.ArrayColumnType{
 			ElementType: schema.ColumnTypeString,
@@ -182,7 +181,7 @@ func (m *fieldMapper) getColumn(
 	case telemetrytypes.FieldContextResource:
 		return []*schema.Column{indexV3Columns["resource"], indexV3Columns["resources_string"]}, nil
 	case telemetrytypes.FieldContextScope:
-		return []*schema.Column{indexV3Columns["scope"]}, nil
+		return []*schema.Column{}, qbtypes.ErrColumnNotFound
 	case telemetrytypes.FieldContextAttribute:
 		switch key.FieldDataType {
 		case telemetrytypes.FieldDataTypeString:
@@ -293,25 +292,14 @@ func (m *fieldMapper) resolveColumnExprs(
 
 		switch column.Type.GetType() {
 		case schema.ColumnTypeEnumJSON:
+			// json is only supported for resource context as of now
+			if key.FieldContext != telemetrytypes.FieldContextResource {
+				return nil, nil, nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "only resource context fields are supported for json columns, got %s", key.FieldContext.String)
+			}
 			// have to add ::string as clickHouse throws an error :- data types Variant/Dynamic are not allowed in GROUP BY
 			// once clickHouse dependency is updated, we need to check if we can remove it.
-			switch key.FieldContext {
-			case telemetrytypes.FieldContextResource:
-				exprs = append(exprs, fmt.Sprintf("%s.`%s`::String", columnName, key.Name))
-				existExprs = append(existExprs, fmt.Sprintf("%s.`%s` IS NOT NULL", columnName, key.Name))
-			case telemetrytypes.FieldContextScope:
-				if f, ok := IntrinsicFields[key.Name]; ok && f.FieldContext == telemetrytypes.FieldContextScope {
-					// declared String paths on the scope column read '' for the missing case
-					exprs = append(exprs, fmt.Sprintf("%s::String", key.Name))
-					existExprs = append(existExprs, fmt.Sprintf("%s <> ''", key.Name))
-				} else {
-					attributeName := strings.TrimPrefix(key.Name, "attribute.") // literal "attribute" prefix in attribute keys needs double prefix
-					exprs = append(exprs, fmt.Sprintf("%s.attributes.%s::String", columnName, querybuilder.ClickHouseIdentifier(attributeName)))
-					existExprs = append(existExprs, fmt.Sprintf("%s.attributes.%s IS NOT NULL", columnName, querybuilder.ClickHouseIdentifier(attributeName)))
-				}
-			default:
-				return nil, nil, nil, errors.NewInternalf(errors.CodeInternal, "only resource and scope context fields are supported for json columns, got %s", key.FieldContext.String)
-			}
+			exprs = append(exprs, fmt.Sprintf("%s.`%s`::String", columnName, key.Name))
+			existExprs = append(existExprs, fmt.Sprintf("%s.`%s` IS NOT NULL", columnName, key.Name))
 		case schema.ColumnTypeEnumString,
 			schema.ColumnTypeEnumUInt64,
 			schema.ColumnTypeEnumUInt32,
@@ -353,6 +341,20 @@ func (m *fieldMapper) resolveColumnExprs(
 	return exprs, existExprs, columns, nil
 }
 
+// logicalForResolvedColumn upgrades a directly-resolvable key (the FieldFor
+// probe succeeded) to its family when the metadata map proves membership;
+// otherwise the key stays a single-member logical field.
+func (m *fieldMapper) logicalForResolvedColumn(ctx context.Context, orgID valuer.UUID, field *telemetrytypes.TelemetryFieldKey, keys map[string][]*telemetrytypes.TelemetryFieldKey) *telemetrytypes.LogicalField {
+	for _, logical := range querybuilder.MatchingLogicalFields(ctx, orgID, m.fl, field, keys) {
+		if logical.IsFamily() &&
+			logical.FieldContext == field.FieldContext &&
+			(field.FieldDataType == telemetrytypes.FieldDataTypeUnspecified || logical.FieldDataType == field.FieldDataType) {
+			return logical
+		}
+	}
+	return telemetrytypes.SingleLogicalField(field.Name, field)
+}
+
 // upgradeToFamilies swaps single-member candidates for their family when the
 // metadata map proves membership. Candidate order and every non-family
 // candidate stay exactly as the legacy flow produced them; sibling candidates
@@ -417,11 +419,9 @@ func (m *fieldMapper) ColumnExpressionFor(
 	var candidates []*telemetrytypes.LogicalField
 	switch _, err := m.FieldFor(ctx, orgID, startNs, endNs, field); {
 	case err == nil:
-		// Every match from metadata is kept, similar to the filter path.
-		candidates = querybuilder.MatchingLogicalFields(ctx, orgID, m.fl, field, keys)
-		if len(candidates) == 0 {
-			candidates = []*telemetrytypes.LogicalField{telemetrytypes.SingleLogicalField(field.Name, field)}
-		}
+		// A directly-resolvable key upgrades to its family when the metadata
+		// map proves membership; otherwise it stays single-member.
+		candidates = []*telemetrytypes.LogicalField{m.logicalForResolvedColumn(ctx, orgID, field, keys)}
 	case errors.Is(err, qbtypes.ErrColumnNotFound):
 		// The legacy candidate flow, unchanged: column (when the bare name is
 		// one) plus metadata matches, else synthesized type-variant keys. The
@@ -595,37 +595,15 @@ func (m *fieldMapper) CandidateKeys(ctx context.Context, _ valuer.UUID, field *t
 		// honored as-is: the stripped name lives in the attribute maps
 		stripped := telemetrytypes.NewTelemetryFieldKey(field.Name, telemetrytypes.FieldContextUnspecified, field.FieldDataType)
 		return querybuilder.SynthesizeKeys(stripped, value)
-	case telemetrytypes.FieldContextAttribute, telemetrytypes.FieldContextResource, telemetrytypes.FieldContextScope:
+	case telemetrytypes.FieldContextAttribute, telemetrytypes.FieldContextResource:
 		// strict context honored as-is: stripped interpretation first, literal spelling second
 		literal := telemetrytypes.NewTelemetryFieldKey(field.FieldContext.StringValue()+"."+field.Name, field.FieldContext, field.FieldDataType)
 		return append(querybuilder.SynthesizeKeys(field, value), querybuilder.SynthesizeKeys(literal, value)...)
 	}
-	// contexts that don't exist on spans (log, body, …) have nothing to synthesize
+	// contexts that don't exist on spans (log, body, scope, …) have nothing to synthesize
 	return nil
 }
 
-// scopeJSONExistsExpression renders the existence predicate for the scope JSON column, the one
-// signal-specific case the generic querybuilder.ExistsExpression must not carry.
-func scopeJSONExistsExpression(key *telemetrytypes.TelemetryFieldKey, fieldExpression string, exists bool) (string, bool) {
-	if key.FieldContext != telemetrytypes.FieldContextScope {
-		return "", false
-	}
-	// Declared String paths are non-Nullable (absent reads '' not NULL).
-	if f, ok := IntrinsicFields[key.Name]; ok && f.FieldContext == telemetrytypes.FieldContextScope {
-		if exists {
-			return fieldExpression + " <> ''", true
-		}
-		return fieldExpression + " = ''", true
-	}
-	// Scope attribute: the value expression casts the JSON path to String, which folds a missing
-	// key's NULL to '', so presence must test the raw path — drop the ::String cast.
-	path := strings.TrimSuffix(fieldExpression, "::String")
-	if exists {
-		return path + " IS NOT NULL", true
-	}
-	return path + " IS NULL", true
-}
-
 // ExistsFor implements the per-key existence primitive of qbtypes.FieldMapper.
 func (m *fieldMapper) ExistsFor(
 	ctx context.Context,
@@ -642,8 +620,5 @@ func (m *fieldMapper) ExistsFor(
 	if err != nil {
 		return "", err
 	}
-	if expr, ok := scopeJSONExistsExpression(key, fieldExpression, exists); ok {
-		return expr, nil
-	}
 	return querybuilder.ExistsExpression(columns, key, tsStart, tsEnd, fieldExpression, exists)
 }

pkg/telemetryschema/tracestelemetryschema/field_mapper_test.go

@@ -84,45 +84,6 @@ func TestGetFieldKeyName(t *testing.T) {
 			expectedResult: "multiIf(resource.`deployment.environment` IS NOT NULL, resource.`deployment.environment`::String, `resource_string_deployment$$environment_exists`, `resource_string_deployment$$environment`, NULL)",
 			expectedError:  nil,
 		},
-		{
-			name: "Scope field - scope.name",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "scope.name",
-				FieldContext: telemetrytypes.FieldContextScope,
-			},
-			expectedResult: "scope.name::String",
-			expectedError:  nil,
-		},
-		{
-			name: "Scope field - scope.version",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "scope.version",
-				FieldContext: telemetrytypes.FieldContextScope,
-			},
-			expectedResult: "scope.version::String",
-			expectedError:  nil,
-		},
-		{
-			name: "Scope field - custom attribute",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "custom.attr",
-				FieldContext: telemetrytypes.FieldContextScope,
-			},
-			expectedResult: "scope.attributes.`custom.attr`::String",
-			expectedError:  nil,
-		},
-		{
-			// `scope.attribute.name` normalizes to {attribute.name, scope}; the literal
-			// `attribute.` prefix is dropped so it addresses the scope attribute named `name`
-			// (which the declared `scope.name` path deliberately does not).
-			name: "Scope field - attribute prefix addresses the named scope attribute",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "attribute.name",
-				FieldContext: telemetrytypes.FieldContextScope,
-			},
-			expectedResult: "scope.attributes.`name`::String",
-			expectedError:  nil,
-		},
 		{
 			// Query like `attribute.attribute_string:string` should resolve to `attributes_string['attribute_string']`.
 			name: "Attribute key whose name collides with contextual map column resolves as a map lookup",
@@ -343,99 +304,3 @@ func TestColumnExpressionForTimestampAttributeCollision(t *testing.T) {
 		assert.Contains(t, result, "attributes_number['timestamp']")
 	})
 }
-
-// TestColumnExpressionForScopeDeclaredPath covers select-side resolution of scope names that
-// collide with a declared scope path. A short name under scope context (or the bare
-// `scope.<x>` spelling that normalizes to it) names both homes and coalesces them when
-// metadata knows a same-named scope attribute, and binds to the declared path alone when it
-// does not. The full `scope.<x>` name under explicit scope context addresses the declared
-// path alone; the explicit `scope.attribute.` prefix addresses the attribute alone.
-func TestColumnExpressionForScopeDeclaredPath(t *testing.T) {
-	ctx := context.Background()
-
-	scopeKey := func(name string) *telemetrytypes.TelemetryFieldKey {
-		return &telemetrytypes.TelemetryFieldKey{
-			Name:          name,
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  telemetrytypes.FieldContextScope,
-			FieldDataType: telemetrytypes.FieldDataTypeString,
-		}
-	}
-	declaredOnly := map[string][]*telemetrytypes.TelemetryFieldKey{
-		"scope.name":    {scopeKey("scope.name")},
-		"scope.version": {scopeKey("scope.version")},
-	}
-	withAttr := map[string][]*telemetrytypes.TelemetryFieldKey{
-		"scope.name":    {scopeKey("scope.name")},
-		"scope.version": {scopeKey("scope.version")},
-		"name":          {scopeKey("name")},
-		"version":       {scopeKey("version")},
-	}
-
-	testCases := []struct {
-		name           string
-		key            telemetrytypes.TelemetryFieldKey
-		keys           map[string][]*telemetrytypes.TelemetryFieldKey
-		expectedResult string
-	}{
-		{
-			name:           "short name under scope context binds to the declared path",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "version", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           declaredOnly,
-			expectedResult: "multiIf(scope.version::String <> '', scope.version::String, NULL)",
-		},
-		{
-			name:           "full scope.version name under scope context addresses the declared path alone",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "scope.version", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.version::String <> '', scope.version::String, NULL)",
-		},
-		{
-			name:           "full scope.name name under scope context addresses the declared path alone",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "scope.name", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.name::String <> '', scope.name::String, NULL)",
-		},
-		{
-			// `scope.attribute.name` normalizes to {attribute.name, scope}; the `attribute.`
-			// prefix is dropped so it addresses the scope attribute named `name` — the only
-			// way to reach it, since `scope.name` is reserved for the declared path.
-			name:           "attribute prefix reaches the named scope attribute",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "attribute.name", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.attributes.`name` IS NOT NULL, scope.attributes.`name`::String, NULL)",
-		},
-		{
-			// the caller supplied the context, so `scope.` is part of the name rather than a
-			// prefix to strip: this addresses a scope attribute literally named
-			// `scope.testing.env`, not the attribute `testing.env`
-			name:           "explicit context keeps a scope-prefixed name intact",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "scope.testing.env", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           declaredOnly,
-			expectedResult: "multiIf(scope.attributes.`scope.testing.env` IS NOT NULL, scope.attributes.`scope.testing.env`::String, NULL)",
-		},
-		{
-			// metadata knows both homes under this name, so the short spelling coalesces
-			// them instead of being rejected as ambiguous
-			name:           "short name coalesces a known scope attribute with the declared path",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "name", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.attributes.`name` IS NOT NULL, toString(scope.attributes.`name`::String), scope.name::String <> '', toString(scope.name::String), NULL)",
-		},
-		{
-			name:           "short version coalesces a known scope attribute with the declared path",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "version", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.attributes.`version` IS NOT NULL, toString(scope.attributes.`version`::String), scope.version::String <> '', toString(scope.version::String), NULL)",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			fm := NewFieldMapper(flaggertest.New(t))
-			result, err := fm.ColumnExpressionFor(ctx, valuer.UUID{}, 0, 0, &tc.key, telemetrytypes.FieldDataTypeUnspecified, tc.keys)
-			require.NoError(t, err)
-			assert.Equal(t, tc.expectedResult, result)
-		})
-	}
-}

pkg/telemetryschema/tracestelemetryschema/test_data.go

@@ -113,20 +113,6 @@ func BuildCompleteFieldKeyMap(releaseTime time.Time) map[string][]*telemetrytype
 				FieldDataType: telemetrytypes.FieldDataTypeBool,
 			},
 		},
-		"scope.name": {
-			{
-				Name:          "scope.name",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-		},
-		"scope.version": {
-			{
-				Name:          "scope.version",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-		},
 		// both spellings of an enabled semantic-convention family
 		"deployment.environment.name": {
 			{

pkg/types/coretypes/resolved.go

@@ -19,6 +19,7 @@ type ResolvedResource interface {
 	SourceIDs() []string
 	SourceSelector() SelectorFunc
 	Err() error
+	Skip() bool
 	ResolveResponse(ec ExtractorContext)
 	hasResponsePhase() bool
 }

pkg/types/coretypes/resolved_resource.go

@@ -59,6 +59,10 @@ func (resolved *resolvedResource) fill(phase ExtractPhase, ec ExtractorContext)
 	}
 }
 
+func (resolved *resolvedResource) Skip() bool {
+	return false
+}
+
 func (resolved *resolvedResource) Err() error {
 	return resolved.err
 }

pkg/types/coretypes/resolved_resource_with_target.go

@@ -12,6 +12,7 @@ type resolvedResourceWithTarget struct {
 	targetExtractor ResourceIDsExtractor
 	targetIDs       []string
 	parentChild     bool
+	skipIfNoIDs     bool
 	err             error
 }
 
@@ -25,6 +26,7 @@ func NewResolvedResourceWithTarget(
 	targetExtractor ResourceIDsExtractor,
 	targetSelector SelectorFunc,
 	parentChild bool,
+	skipIfNoIDs bool,
 	ec ExtractorContext,
 ) ResolvedResourceWithTargetResource {
 	resolved := &resolvedResourceWithTarget{
@@ -37,6 +39,7 @@ func NewResolvedResourceWithTarget(
 		targetSelector:  targetSelector,
 		targetExtractor: targetExtractor,
 		parentChild:     parentChild,
+		skipIfNoIDs:     skipIfNoIDs,
 	}
 	resolved.fill(PhaseRequest, ec)
 
@@ -69,6 +72,10 @@ func (resolved *resolvedResourceWithTarget) fill(phase ExtractPhase, ec Extracto
 	}
 }
 
+func (resolved *resolvedResourceWithTarget) Skip() bool {
+	return resolved.skipIfNoIDs && len(resolved.sourceIDs) == 0 && len(resolved.targetIDs) == 0
+}
+
 func (resolved *resolvedResourceWithTarget) Err() error {
 	return resolved.err
 }

pkg/types/dashboardtypes/perses_dashboard.go

@@ -25,10 +25,6 @@ const (
 	dashboardNameSuffixLen = 8
 )
 
-// SystemDashboardNamePrefix is reserved for dashboards SigNoz ships and owns. Generated
-// names never contain consecutive hyphens, so only a typed name can carry it — create rejects that.
-const SystemDashboardNamePrefix = "signoz---"
-
 const (
 	dashboardIconPathPrefix = "/assets/Icons/"
 	dashboardLogoPathPrefix = "/assets/Logos/"
@@ -79,8 +75,8 @@ type DashboardV2 struct {
 }
 
 func (d *DashboardV2) ErrIfNotMutable() error {
-	if d.Source != SourceUser {
-		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be modified", d.Source)
+	if d.Source == SourceIntegration {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "integration dashboards cannot be modified")
 	}
 	return nil
 }
@@ -99,11 +95,6 @@ func (d *DashboardV2) Update(updatable UpdatableDashboardV2, updatedBy string, r
 	if err := d.ErrIfNotUpdatable(); err != nil {
 		return err
 	}
-	return d.UpdateUnsafe(updatable, updatedBy, resolvedTags)
-}
-
-// UpdateUnsafe applies the update without the source/lock gate. Intended for internal system callers.
-func (d *DashboardV2) UpdateUnsafe(updatable UpdatableDashboardV2, updatedBy string, resolvedTags []*tagtypes.Tag) error {
 	if updatable.Name != d.Name {
 		return errors.NewInvalidInputf(ErrCodeDashboardImmutable, "name is immutable; cannot change from %q to %q", d.Name, updatable.Name)
 	}
@@ -138,13 +129,6 @@ func (d *DashboardV2) LockUnlock(lock bool, isAdmin bool, updatedBy string) erro
 	return nil
 }
 
-func (d *DashboardV2) ErrIfNotSystem() error {
-	if d.Source != SourceSystem {
-		return errors.Newf(errors.TypeNotFound, ErrCodeDashboardNotFound, "dashboard %q is not a system dashboard", d.Name)
-	}
-	return nil
-}
-
 func (d *DashboardV2) ErrIfNotClonable() error {
 	if !d.Source.isClonable() {
 		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be cloned", d.Source)
@@ -221,21 +205,13 @@ type PostableDashboardV2 struct {
 	Spec         DashboardSpec          `json:"spec" required:"true"`
 }
 
-func (postable PostableDashboardV2) NewDashboardV2(orgID valuer.UUID, createdBy string, source Source) (*DashboardV2, error) {
+func (postable PostableDashboardV2) NewDashboardV2(orgID valuer.UUID, createdBy string, source Source) *DashboardV2 {
 	now := time.Now()
 
 	name := postable.Name
 	if postable.GenerateName {
 		name = generateDashboardName(postable.Spec.Display.Name)
 	}
-	// Checked on the final name, here rather than in validateName, because only
-	// the constructor knows the source.
-	if source != SourceSystem && strings.HasPrefix(name, SystemDashboardNamePrefix) {
-		return nil, errors.NewInvalidInputf(ErrCodeDashboardInvalidInput, "name %q is invalid: the %q prefix is reserved for system dashboards", name, SystemDashboardNamePrefix)
-	}
-	if source == SourceSystem && !strings.HasPrefix(name, SystemDashboardNamePrefix) {
-		return nil, errors.NewInvalidInputf(ErrCodeDashboardInvalidInput, "name %q is invalid: system dashboard names must start with the %q prefix", name, SystemDashboardNamePrefix)
-	}
 
 	return &DashboardV2{
 		Identifiable:            types.Identifiable{ID: valuer.GenerateUUID()},
@@ -248,7 +224,7 @@ func (postable PostableDashboardV2) NewDashboardV2(orgID valuer.UUID, createdBy
 		Name:                    name,
 		Tags:                    tagtypes.NewTagsFromPostableTags(orgID, coretypes.KindDashboard, postable.Tags),
 		Spec:                    postable.Spec,
-	}, nil
+	}
 }
 
 func (p *PostableDashboardV2) UnmarshalJSON(data []byte) error {

pkg/types/dashboardtypes/perses_dashboard_convertors_test.go

@@ -89,25 +89,21 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 	cases := []struct {
 		scenario       string
 		source         Source
-		name           string
 		expectedLocked bool
 	}{
 		{
 			scenario:       "user source is not locked",
 			source:         SourceUser,
-			name:           "my-dashboard",
 			expectedLocked: false,
 		},
 		{
 			scenario:       "system source is not locked",
 			source:         SourceSystem,
-			name:           SystemDashboardNamePrefix + "my-dashboard",
 			expectedLocked: false,
 		},
 		{
 			scenario:       "integration source is locked",
 			source:         SourceIntegration,
-			name:           "my-dashboard",
 			expectedLocked: true,
 		},
 	}
@@ -119,7 +115,7 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 					SchemaVersion: SchemaVersion,
 					Image:         "img",
 				},
-				Name: tc.name,
+				Name: "my-dashboard",
 				Tags: []tagtypes.PostableTag{
 					{Key: "team", Value: "platform"},
 					{Key: "env", Value: "prod"},
@@ -128,8 +124,7 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 			}
 
 			before := time.Now()
-			dashboard, err := postable.NewDashboardV2(orgID, "alice", tc.source)
-			require.NoError(t, err)
+			dashboard := postable.NewDashboardV2(orgID, "alice", tc.source)
 			after := time.Now()
 
 			require.NotNil(t, dashboard)
@@ -165,10 +160,8 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 			Spec:                    DashboardSpec{},
 		}
 
-		first, err := postable.NewDashboardV2(orgID, "alice", SourceUser)
-		require.NoError(t, err)
-		second, err := postable.NewDashboardV2(orgID, "alice", SourceUser)
-		require.NoError(t, err)
+		first := postable.NewDashboardV2(orgID, "alice", SourceUser)
+		second := postable.NewDashboardV2(orgID, "alice", SourceUser)
 		assert.NotEqual(t, first.ID, second.ID, "expected distinct UUIDs across invocations")
 	})
 
@@ -181,8 +174,7 @@ func TestPostableDashboardV2NewDashboardV2(t *testing.T) {
 			},
 		}
 
-		dashboard, err := postable.NewDashboardV2(orgID, "alice", SourceUser)
-		require.NoError(t, err)
+		dashboard := postable.NewDashboardV2(orgID, "alice", SourceUser)
 		assert.True(t, strings.HasPrefix(dashboard.Name, "my-dashboard-"), "expected slug prefix, got %q", dashboard.Name)
 		assert.Len(t, dashboard.Name, len("my-dashboard-")+dashboardNameSuffixLen)
 	})

pkg/types/dashboardtypes/perses_dashboard_patch_test.go

@@ -109,8 +109,7 @@ func TestPatchableDashboardV2_Apply(t *testing.T) {
 	var p PostableDashboardV2
 	require.NoError(t, json.Unmarshal([]byte(basePostableJSON), &p), "base postable JSON must validate")
 	testOrgID := valuer.GenerateUUID()
-	base, err := p.NewDashboardV2(testOrgID, "somecreatedthisiguess@signoz.io", SourceUser)
-	require.NoError(t, err)
+	base := p.NewDashboardV2(testOrgID, "somecreatedthisiguess@signoz.io", SourceUser)
 	base.Tags = []*tagtypes.Tag{
 		{Key: "team", Value: "alpha"},
 		{Key: "env", Value: "prod"},

pkg/types/dashboardtypes/perses_dashboard_test.go

@@ -8,7 +8,6 @@ import (
 	"testing"
 
 	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/perses/spec/go/dashboard"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -1929,37 +1928,3 @@ func TestEnsureSingleExpressionAggregation(t *testing.T) {
 		})
 	}
 }
-
-// Guards the constant: a prefixed name must stay a valid DNS-1123 label.
-func TestSystemDashboardNamePrefix(t *testing.T) {
-	require.NoError(t, validateDashboardName(SystemDashboardNamePrefix+"ai-o11y-overview"))
-}
-
-func TestNewDashboardV2RejectsReservedName(t *testing.T) {
-	testCases := []struct {
-		description string
-		name        string
-		source      Source
-		errContains string
-	}{
-		{description: "reserved name for a system dashboard", name: SystemDashboardNamePrefix + "overview", source: SourceSystem},
-		{description: "reserved name for a user dashboard", name: SystemDashboardNamePrefix + "overview", source: SourceUser, errContains: "reserved for system dashboards"},
-		{description: "reserved name for an integration dashboard", name: SystemDashboardNamePrefix + "overview", source: SourceIntegration, errContains: "reserved for system dashboards"},
-		{description: "unprefixed name for a system dashboard", name: "overview", source: SourceSystem, errContains: "must start with"},
-		{description: "ordinary name for a user dashboard", name: "overview", source: SourceUser},
-		{description: "fewer hyphens than the prefix for a user dashboard", name: "signoz--overview", source: SourceUser},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.description, func(t *testing.T) {
-			postable := PostableDashboardV2{Name: testCase.name}
-			_, err := postable.NewDashboardV2(valuer.GenerateUUID(), "user@signoz.io", testCase.source)
-			if testCase.errContains != "" {
-				require.Error(t, err)
-				assert.Contains(t, err.Error(), testCase.errContains)
-				return
-			}
-			require.NoError(t, err)
-		})
-	}
-}

pkg/types/dashboardtypes/store.go

@@ -13,9 +13,6 @@ type Store interface {
 
 	Get(context.Context, valuer.UUID, valuer.UUID) (*StorableDashboard, error)
 
-	// GetByName resolves a dashboard by its per-org unique name.
-	GetByName(ctx context.Context, orgID valuer.UUID, name string) (*StorableDashboard, error)
-
 	GetPublic(context.Context, string) (*StorablePublicDashboard, error)
 
 	GetDashboardByOrgsAndPublicID(context.Context, []string, string) (*StorableDashboard, error)

pkg/types/systemdashboardtypes/definition.go

@@ -1,95 +0,0 @@
-package systemdashboardtypes
-
-import (
-	"bytes"
-	"encoding/json"
-	"slices"
-	"strings"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/types/dashboardtypes"
-)
-
-// Definition is one shipped system dashboard. Version is bumped on every content
-// change and drives upgrade detection; the name is the stable key and never changes.
-type Definition struct {
-	Version   int                                `json:"version"`
-	Dashboard dashboardtypes.PostableDashboardV2 `json:"definition"`
-}
-
-func (definition Definition) Name() string {
-	return definition.Dashboard.Name
-}
-
-func NewDefinition(raw []byte) (Definition, error) {
-	decoder := json.NewDecoder(bytes.NewReader(raw))
-	decoder.DisallowUnknownFields()
-
-	var definition Definition
-	if err := decoder.Decode(&definition); err != nil {
-		return Definition{}, errors.WrapInvalidInputf(err, ErrCodeSystemDashboardDefinitionInvalid, "%s", err.Error())
-	}
-	if err := definition.validate(); err != nil {
-		return Definition{}, err
-	}
-
-	return definition, nil
-}
-
-func (definition Definition) validate() error {
-	if definition.Version < 1 {
-		return errors.NewInvalidInputf(ErrCodeSystemDashboardDefinitionInvalid, "version must be at least 1, got %d", definition.Version)
-	}
-	if !strings.HasPrefix(definition.Name(), dashboardtypes.SystemDashboardNamePrefix) {
-		return errors.NewInvalidInputf(ErrCodeSystemDashboardDefinitionInvalid, "name %q must start with %q", definition.Name(), dashboardtypes.SystemDashboardNamePrefix)
-	}
-	if definition.Dashboard.GenerateName {
-		return errors.NewInvalidInputf(ErrCodeSystemDashboardDefinitionInvalid, "%s: generateName is not allowed, the name is the stable key", definition.Name())
-	}
-
-	return nil
-}
-
-// ToUpdatable is how an upgrade re-applies a definition onto an existing row:
-// everything but the dashboard's identity comes from the shipped definition.
-func (definition Definition) ToUpdatable() dashboardtypes.UpdatableDashboardV2 {
-	return dashboardtypes.UpdatableDashboardV2{
-		DashboardV2MetadataBase: definition.Dashboard.DashboardV2MetadataBase,
-		Name:                    definition.Dashboard.Name,
-		Tags:                    definition.Dashboard.Tags,
-		Spec:                    definition.Dashboard.Spec,
-	}
-}
-
-// Registry holds every definition embedded in the binary, keyed by name.
-type Registry struct {
-	definitions map[string]Definition
-}
-
-func NewRegistry(definitions []Definition) (Registry, error) {
-	byName := make(map[string]Definition, len(definitions))
-	for _, definition := range definitions {
-		if _, duplicate := byName[definition.Name()]; duplicate {
-			return Registry{}, errors.NewInvalidInputf(ErrCodeSystemDashboardDefinitionInvalid, "duplicate system dashboard name %q", definition.Name())
-		}
-		byName[definition.Name()] = definition
-	}
-
-	return Registry{definitions: byName}, nil
-}
-
-func (registry Registry) Get(name string) (Definition, bool) {
-	definition, ok := registry.definitions[name]
-	return definition, ok
-}
-
-// List returns the definitions sorted by name so provisioning order is stable.
-func (registry Registry) List() []Definition {
-	definitions := make([]Definition, 0, len(registry.definitions))
-	for _, definition := range registry.definitions {
-		definitions = append(definitions, definition)
-	}
-	slices.SortFunc(definitions, func(a, b Definition) int { return strings.Compare(a.Name(), b.Name()) })
-
-	return definitions
-}

pkg/types/systemdashboardtypes/system_dashboard.go

@@ -1,58 +0,0 @@
-package systemdashboardtypes
-
-import (
-	"context"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/uptrace/bun"
-)
-
-var (
-	ErrCodeSystemDashboardNotFound           = errors.MustNewCode("system_dashboard_not_found")
-	ErrCodeSystemDashboardDefinitionInvalid  = errors.MustNewCode("system_dashboard_definition_invalid")
-	ErrCodeSystemDashboardAlreadyProvisioned = errors.MustNewCode("system_dashboard_already_provisioned")
-)
-
-// ProvisionerIdentity is stamped into created_by/updated_by by the reconciler. It
-// is deliberately not a valid email, so it can never collide with a real account:
-// any other value in updated_by means a foreign write.
-const ProvisionerIdentity = "signoz"
-
-type Store interface {
-	Create(ctx context.Context, storable *StorableSystemDashboard) error
-
-	Get(ctx context.Context, orgID valuer.UUID, name string) (*StorableSystemDashboard, error)
-
-	UpdateVersion(ctx context.Context, orgID valuer.UUID, name string, version int) error
-
-	RunInTx(ctx context.Context, cb func(ctx context.Context) error) error
-}
-
-// StorableSystemDashboard records the shipped version each org's copy of a system
-// dashboard was last provisioned at. That version is the only thing the dashboard
-// row cannot answer, since the binary only embeds the latest definition.
-type StorableSystemDashboard struct {
-	bun.BaseModel `bun:"table:system_dashboard"`
-
-	types.Identifiable
-	types.TimeAuditable
-	OrgID       valuer.UUID `bun:"org_id,type:text,notnull"`
-	DashboardID valuer.UUID `bun:"dashboard_id,type:text,notnull"`
-	Name        string      `bun:"name,type:text,notnull"`
-	Version     int         `bun:"version,notnull"`
-}
-
-func NewStorableSystemDashboard(orgID valuer.UUID, dashboardID valuer.UUID, name string, version int) *StorableSystemDashboard {
-	now := time.Now()
-	return &StorableSystemDashboard{
-		Identifiable:  types.Identifiable{ID: valuer.GenerateUUID()},
-		TimeAuditable: types.TimeAuditable{CreatedAt: now, UpdatedAt: now},
-		OrgID:         orgID,
-		DashboardID:   dashboardID,
-		Name:          name,
-		Version:       version,
-	}
-}

pkg/types/telemetrytypes/field_context.go

@@ -18,7 +18,7 @@ import (
 // - Use `scope.` prefix to explicitly indicate and enforce scope context. Example
 //   - `scope.name`
 //   - `scope.version`
-//   - `scope.my.custom.attribute` resolves to the `my.custom.attribute` scope attribute
+//   - `scope.my.custom.attribute` and `scope.attribute.my.custom.attribute` resolve to same attribute
 //
 // - Use `attribute.` to explicitly indicate and enforce attribute context. Example
 //   - `attribute.http.method`
@@ -190,7 +190,7 @@ func (FieldContext) Enum() []any {
 		FieldContextSpan,
 		FieldContextTrace,
 		FieldContextResource,
-		FieldContextScope,
+		// FieldContextScope,
 		FieldContextAttribute,
 		// FieldContextEvent,
 		FieldContextBody,

pkg/types/telemetrytypes/field_test.go

@@ -294,17 +294,6 @@ func TestNormalize(t *testing.T) {
 				FieldDataType: FieldDataTypeString,
 			},
 		},
-		{
-			name: "Normalize keeps a prefix that does not match the set context",
-			input: TelemetryFieldKey{
-				Name:         "scope.name",
-				FieldContext: FieldContextAttribute,
-			},
-			expected: TelemetryFieldKey{
-				Name:         "scope.name",
-				FieldContext: FieldContextAttribute,
-			},
-		},
 		{
 			name: "Normalize body field",
 			input: TelemetryFieldKey{

tests/fixtures/querier.py

@@ -999,8 +999,6 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "cloud.provider": "integration",
                 "cloud.account.id": "000",
                 "trace_id": "corrupt_data",
-                "scope_name": "corrupt_data",
-                "scope.scope.name": "corrupt_data",
             },
             attributes={
                 "net.transport": "IP.TCP",
@@ -1009,10 +1007,7 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "http.request.method": "POST",
                 "http.response.status_code": "200",
                 "timestamp": "corrupt_data",
-                "version": "1.0.0",
-                "scope.scope.version": "1.0.0",
             },
-            scope={"name": "io.signoz.http.server", "version": "2.0.0"},
         ),
         Traces(
             timestamp=now - timedelta(seconds=3.5),
@@ -1032,24 +1027,12 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "cloud.provider": "integration",
                 "cloud.account.id": "000",
                 "timestamp": "corrupt_data",
-                "scope.attributes.name": "corrupt_data",
             },
             attributes={
                 "db.name": "integration",
                 "db.operation": "SELECT",
                 "db.statement": "SELECT * FROM integration",
                 "trace_d": "corrupt_data",
-                "scope.attributes.version": "corrupt_data",
-            },
-            scope={
-                "name": "io.opentelemetry.contrib.http",
-                "version": "1.0.0",
-                "attributes": {
-                    "telemetry.sdk.language": "cpp",
-                    "name": "not-the-real-name",
-                    "version": "not-the-real-version",
-                    "attributes": "literally-a-key-named-attributes",
-                },
             },
         ),
         Traces(
@@ -1070,15 +1053,12 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "cloud.provider": "integration",
                 "cloud.account.id": "000",
                 "duration_nano": "corrupt_data",
-                "scope.scope.attributes.version": "corrupt_data",
             },
             attributes={
                 "http.request.method": "PATCH",
                 "http.status_code": "404",
                 "id": "1",
-                "scope.scope.version": "corrupt_data",
             },
-            scope={"name": "io.signoz.http.client", "version": "2.0.0"},
         ),
         Traces(
             timestamp=now - timedelta(seconds=1),
@@ -1097,7 +1077,6 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "host.name": "linux-001",
                 "cloud.provider": "integration",
                 "cloud.account.id": "001",
-                "scope.scope.version": "corrupt_data",
             },
             attributes={
                 "message.type": "SENT",
@@ -1105,10 +1084,7 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "messaging.message.id": "001",
                 "duration_nano": "corrupt_data",
                 "id": 1,
-                "scope": "corrupt_data",
-                "scope.attributes.name": "corrupt_data",
             },
-            scope={"name": "io.signoz.messaging", "version": "3.0.0"},
         ),
     ]
 

tests/fixtures/traces.py

@@ -302,7 +302,6 @@ class Traces(ABC):
     db_operation: str
     has_error: bool
     is_remote: str
-    scope_json: dict[str, Any]
 
     resource: list[TracesResource]
     tag_attributes: list[TracesTagAttributes]
@@ -328,7 +327,6 @@ class Traces(ABC):
         links: list[TracesLink] = [],
         trace_state: str = "",
         flags: np.uint32 = 0,
-        scope: dict[str, Any] = {},
         resource_write_mode: Literal["legacy_only", "dual_write"] = "dual_write",
     ) -> None:
         if timestamp is None:
@@ -410,33 +408,6 @@ class Traces(ABC):
         # Calculate resource fingerprint
         self.resource_fingerprint = LogsOrTracesFingerprint(self.resources_string).calculate()
 
-        # Process scope mirroring the InstrumentationScope on the OTLP span.
-        scope_name = scope.get("name", "")
-        scope_version = scope.get("version", "")
-        scope_string = {k: str(v) for k, v in scope.get("attributes", {}).items()}
-        self.scope_json = {
-            "name": scope_name,
-            "version": scope_version,
-            "attributes": scope_string,
-        }
-
-        scope_keys = {"scope.name": scope_name, "scope.version": scope_version}
-        scope_keys.update(scope_string)
-        for k, v in scope_keys.items():
-            if v == "":
-                continue
-            self.tag_attributes.append(
-                TracesTagAttributes(
-                    timestamp=timestamp,
-                    tag_key=k,
-                    tag_type="scope",
-                    tag_data_type="string",
-                    string_value=v,
-                    number_value=None,
-                )
-            )
-            self.attribute_keys.append(TracesResourceOrAttributeKeys(name=k, datatype="string", tag_type="scope"))
-
         # Process attributes by type and populate custom fields
         self.attribute_string = {}
         self.attributes_number = {}
@@ -688,7 +659,6 @@ class Traces(ABC):
                 self.has_error,
                 self.is_remote,
                 self.resource_json,
-                self.scope_json,
             ],
             dtype=object,
         )
@@ -719,7 +689,6 @@ class Traces(ABC):
             attributes=data.get("attributes", {}),
             trace_state=data.get("trace_state", ""),
             flags=data.get("flags", 0),
-            scope=data.get("scope", {}),
         )
 
     @classmethod
@@ -859,7 +828,6 @@ def insert_traces_to_clickhouse(conn, traces: list[Traces]) -> None:
             "has_error",
             "is_remote",
             "resource",
-            "scope",
         ],
         data=[trace.np_arr() for trace in traces],
     )

tests/integration/tests/callbackauthn/05_authz.py

@@ -28,6 +28,7 @@ _TARGET_A = "target-a-authdomain.integration.test"
 _TARGET_B = "target-b-authdomain.integration.test"
 _ADMIN_DOMAIN = "admin-crud-authdomain.integration.test"
 _ACTOR_DOMAIN = "actor-crud-authdomain.integration.test"
+_DIFF_DOMAIN = "diff-crud-authdomain.integration.test"
 
 _SAML_CONFIG = {
     "kind": "saml",
@@ -428,6 +429,75 @@ def test_update_requires_detach_on_stored_roles(
     assert response.status_code == HTTPStatus.NO_CONTENT, response.text
 
 
+def test_update_with_unchanged_mapping_needs_only_update(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    actor_id = find_role_by_name(signoz, admin_token, _ACTOR_ROLE_NAME)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        json={
+            "name": _DIFF_DOMAIN,
+            "enabled": True,
+            "config": _SAML_CONFIG,
+            "roleMapping": {"defaultRole": "EDITOR"},
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    domain_id = response.json()["data"]["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("update", "metaresource", "auth-domain", [domain_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    # The mapping is echoed back unchanged, so the attach/detach checks are
+    # skipped and update alone suffices.
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        json={
+            "enabled": False,
+            "config": _SAML_CONFIG,
+            "roleMapping": {"defaultRole": "EDITOR"},
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"unchanged mapping with update only: {response.text}"
+
+    # Dropping the mapping attaches signoz-viewer and detaches signoz-editor,
+    # neither of which the actor can do.
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        json={"enabled": False, "config": _SAML_CONFIG},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"changed mapping without attach/detach: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
 def test_instance_verbs_scoped_to_granted_domain(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument

tests/integration/tests/queriertraces/01_list.py

@@ -1240,13 +1240,6 @@ def test_traces_list_span_scope(
             lambda x: {"duration_nano": int(x[1].duration_nano), "span_id": x[1].span_id, "timestamp": format_timestamp(x[1].timestamp), "trace_id": x[1].trace_id},
             id="select_attribute_duration_order_intrinsic",
         ),
-        # Case 9: filter on the intrinsic scope.version. Only x[1] should match.
-        pytest.param(
-            BuilderQuery(signal="traces", name="A", select_fields=[TelemetryFieldKey("timestamp")], filter_expression="scope.version = '1.0.0'", limit=1),
-            HTTPStatus.OK,
-            lambda x: {"span_id": x[1].span_id, "timestamp": format_timestamp(x[1].timestamp), "trace_id": x[1].trace_id},
-            id="filter_scope_version",
-        ),
     ],
 )
 def test_traces_list_with_corrupt_data(
@@ -1290,168 +1283,6 @@ def test_traces_list_with_corrupt_data(
         assert get_rows(response)[0]["data"] == expected(traces)
 
 
-@pytest.mark.parametrize(
-    "filter_expression,expected_indices",
-    [
-        # Intrinsic scope.name / scope.version resolve to the JSON sub-columns.
-        pytest.param("scope.name = 'io.signoz.payment'", [1], id="intrinsic_scope_name"),
-        pytest.param("scope.version = '2.3.1'", [0], id="intrinsic_scope_version"),
-        # A scope attribute resolves against the scope JSON column's attributes.
-        pytest.param("scope.telemetry.sdk.language = 'python'", [1], id="scope_attribute"),
-        # A scope attribute whose own name carries a `scope.` prefix. `scope.prefixed`
-        # normalizes to {prefixed, scope} and must still resolve to the attribute.
-        pytest.param("scope.prefixed = 'prefixed-val'", [0], id="scope_prefixed_attribute"),
-        # `env.tier` is a span attribute on span 0 and a scope attribute on
-        # span 1. Unprefixed -> no explicit context, so it is checked in every
-        # applicable context (attribute OR scope) and both spans match.
-        pytest.param("env.tier = 'gold'", [0, 1], id="bare_cross_context"),
-        # The explicit `scope.` prefix forces scope context only, so span 0's
-        # span attribute is ignored — only span 1 matches.
-        pytest.param("scope.env.tier = 'gold'", [1], id="scope_prefixed_cross_context"),
-        # `scope.name` names both homes it can resolve to: the declared scope.name field
-        # (span 0) and a same-named `name` scope attribute (span 1), the same way any
-        # other name colliding across contexts unions. `scope.attribute.name` addresses
-        # the attribute alone.
-        pytest.param("scope.name = 'io.signoz.checkout'", [0, 1], id="scope_name_unions_attribute"),
-        # The `scope.name` spelling is also a real stored key: span 2 carries a span
-        # attribute literally named `scope.name`, so it matches too.
-        pytest.param("scope.name = 'attr-scope-name'", [2], id="scope_name_matches_stored_spelling"),
-        # The explicit `scope.attribute.` prefix addresses the scope attribute alone, without
-        # the declared path. Span 1 has a `name` scope attribute = 'io.signoz.checkout'.
-        pytest.param("scope.attribute.name = 'io.signoz.checkout'", [1], id="scope_attribute_name"),
-        # `version` as a scope attribute: no span carries one (span 1's 4.5.6 is the declared
-        # scope.version, not a scope attribute), so this matches nothing.
-        pytest.param("scope.attribute.version = '4.5.6'", [], id="scope_attribute_version_none"),
-        # An unprefixed `name` is checked in every applicable context: the span `name`
-        # column (span 2) and a `name` scope attribute (span 1). It does not reach the
-        # declared scope.name field (span 0), which only the `scope.` prefix addresses.
-        pytest.param("name = 'io.signoz.checkout'", [1, 2], id="bare_name_unions_scope_attribute"),
-        # A value that no resolvable key holds (scope.name/scope.version field,
-        # a `name`/`version` scope attribute, or a same-named attribute/resource)
-        # returns nothing.
-        pytest.param("scope.version = 'corrupt_data'", [], id="scope_version_no_match"),
-        pytest.param("scope.name = 'corrupt_data'", [], id="scope_name_no_match"),
-    ],
-)
-def test_traces_list_with_scope_filter(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-    filter_expression: str,
-    expected_indices: list[int],
-) -> None:
-    """
-    Setup three spans with different scope key resolution:
-    - x[0]: scope.name/version 'io.signoz.checkout'/'2.3.1'; span attribute
-      env.tier='gold'.
-    - x[1]: scope.name/version 'io.signoz.payment'/'4.5.6'; scope attributes
-      telemetry.sdk.language='python', env.tier='gold', and a `name` scope
-      attribute colliding with x[0]'s scope.name value.
-    - x[2]: span name 'io.signoz.checkout' (colliding with x[0]'s scope.name
-      value) and a span attribute literally named `scope.name`.
-
-    Tests:
-    - Filtering on scope.name / scope.version / a scope attribute.
-    - An unprefixed key is resolved across contexts (scope checked alongside
-      attribute / intrinsic), while a `scope.`-prefixed key is scope-only.
-    - `scope.name`/`scope.version` name every home they resolve to: the declared JSON
-      sub-column and a same-named `name`/`version` scope attribute. The explicit
-      `scope.attribute.` prefix addresses the attribute alone.
-    - a bare `name` reaches the span `name` column and a `name` scope attribute, but
-      never the declared scope.name field.
-    """
-    now = datetime.now(tz=UTC).replace(microsecond=0)
-    trace_id = TraceIdGenerator.trace_id()
-    span_ids = [TraceIdGenerator.span_id() for _ in range(3)]
-
-    traces = [
-        Traces(
-            timestamp=now - timedelta(seconds=4),
-            duration=timedelta(seconds=2),
-            trace_id=trace_id,
-            span_id=span_ids[0],
-            parent_span_id="",
-            name="GET /checkout",
-            kind=TracesKind.SPAN_KIND_SERVER,
-            status_code=TracesStatusCode.STATUS_CODE_OK,
-            resources={"service.name": "checkout"},
-            attributes={"http.request.method": "GET", "env.tier": "gold"},
-            scope={
-                "name": "io.signoz.checkout",
-                "version": "2.3.1",
-                # a scope attribute whose own name carries a `scope.` prefix
-                "attributes": {"telemetry.sdk.language": "go", "scope.prefixed": "prefixed-val"},
-            },
-        ),
-        Traces(
-            timestamp=now - timedelta(seconds=2),
-            duration=timedelta(seconds=1),
-            trace_id=trace_id,
-            span_id=span_ids[1],
-            parent_span_id="",
-            name="POST /pay",
-            kind=TracesKind.SPAN_KIND_SERVER,
-            status_code=TracesStatusCode.STATUS_CODE_OK,
-            resources={"service.name": "payment"},
-            attributes={"http.request.method": "POST"},
-            # env.tier is a scope attribute here (cross-context with span 0);
-            # `name` is a scope attribute colliding with span 0's scope.name.
-            scope={
-                "name": "io.signoz.payment",
-                "version": "4.5.6",
-                "attributes": {
-                    "telemetry.sdk.language": "python",
-                    "env.tier": "gold",
-                    "name": "io.signoz.checkout",
-                },
-            },
-        ),
-        Traces(
-            timestamp=now - timedelta(seconds=1),
-            duration=timedelta(seconds=1),
-            trace_id=trace_id,
-            span_id=span_ids[2],
-            parent_span_id="",
-            # span name collides with span 0's scope.name value
-            name="io.signoz.checkout",
-            kind=TracesKind.SPAN_KIND_SERVER,
-            status_code=TracesStatusCode.STATUS_CODE_OK,
-            resources={"service.name": "probe"},
-            # a span attribute named `scope.name`
-            attributes={"scope.name": "attr-scope-name"},
-            scope={"name": "span-gamma", "version": "9.9.9"},
-        ),
-    ]
-    insert_traces(traces)
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    start_ms = int((now - timedelta(minutes=1)).timestamp() * 1000)
-    end_ms = int((now + timedelta(seconds=1)).timestamp() * 1000)
-
-    response = make_query_request(
-        signoz,
-        token,
-        start_ms=start_ms,
-        end_ms=end_ms,
-        request_type=RequestType.RAW,
-        queries=[
-            BuilderQuery(
-                signal="traces",
-                name="A",
-                select_fields=[TelemetryFieldKey("timestamp")],
-                filter_expression=filter_expression,
-                limit=10,
-            ).to_dict()
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK, response.text
-    got_span_ids = {row["data"]["span_id"] for row in get_rows(response)}
-    expected_span_ids = {traces[i].span_id for i in expected_indices}
-    assert got_span_ids == expected_span_ids
-
-
 @pytest.mark.parametrize("surface", ["filter", "select", "order"])
 def test_traces_list_unknown_span_context_synthesizes(
     signoz: types.SigNoz,