fix: check user attach on reset token issue, list tokens collection-wide

PUT /api/v2/users/{id}/reset_password_tokens issues a credential for the
target user, so it now declares a parent-child def requiring attach on the
user alongside factor-password:create on the instance (mirroring the
/api/v1/service_accounts/{id}/keys pattern).

GET on the same path enumerates the user's tokens, so it checks
factor-password:list on the wildcard (list is a collection-level verb; the
path id is only a filter) instead of factor-password:read on the instance.

docs/api/openapi.yml

@@ -9427,8 +9427,6 @@ components:
           type: string
         name:
           type: string
-        origin:
-          $ref: '#/components/schemas/SpantypesSpanMapperOrigin'
         updatedAt:
           format: date-time
           type: string
@@ -9441,7 +9439,6 @@ components:
       - fieldContext
       - config
       - enabled
-      - origin
       type: object
     SpantypesSpanMapperConfig:
       properties:
@@ -9470,75 +9467,48 @@ components:
           type: string
         orgId:
           type: string
-        origin:
-          $ref: '#/components/schemas/SpantypesSpanMapperOrigin'
         updatedAt:
           format: date-time
           type: string
         updatedBy:
           type: string
-        version:
-          type: integer
       required:
       - id
       - orgId
       - name
       - condition
       - enabled
-      - origin
-      - version
       type: object
     SpantypesSpanMapperGroupCondition:
       nullable: true
       properties:
         attributes:
           items:
-            $ref: '#/components/schemas/SpantypesSpanMapperGroupConditionKey'
+            type: string
           nullable: true
           type: array
         resource:
           items:
-            $ref: '#/components/schemas/SpantypesSpanMapperGroupConditionKey'
+            type: string
           nullable: true
           type: array
       required:
       - attributes
       - resource
       type: object
-    SpantypesSpanMapperGroupConditionKey:
-      properties:
-        enabled:
-          type: boolean
-        origin:
-          $ref: '#/components/schemas/SpantypesSpanMapperOrigin'
-        value:
-          type: string
-      required:
-      - value
-      - enabled
-      type: object
     SpantypesSpanMapperOperation:
       enum:
       - move
       - copy
       type: string
-    SpantypesSpanMapperOrigin:
-      enum:
-      - user
-      - system
-      type: string
     SpantypesSpanMapperSource:
       properties:
         context:
           $ref: '#/components/schemas/SpantypesFieldContext'
-        enabled:
-          type: boolean
         key:
           type: string
         operation:
           $ref: '#/components/schemas/SpantypesSpanMapperOperation'
-        origin:
-          $ref: '#/components/schemas/SpantypesSpanMapperOrigin'
         priority:
           type: integer
       required:
@@ -9546,7 +9516,6 @@ components:
       - context
       - operation
       - priority
-      - enabled
       type: object
     SpantypesSpanMapperTestSpan:
       properties:
@@ -20339,9 +20308,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - role:read
       - tokenizer:
-        - ADMIN
+        - role:read
       summary: Get users by role id
       tags:
       - users
@@ -24903,9 +24872,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:attach
+        - role:attach
       - tokenizer:
-        - ADMIN
+        - user:attach
+        - role:attach
       summary: Create user role
       tags:
       - users
@@ -24955,9 +24926,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:detach
+        - role:detach
       - tokenizer:
-        - ADMIN
+        - user:detach
+        - role:detach
       summary: Delete user role
       tags:
       - users
@@ -25018,9 +24991,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user role
       tags:
       - users
@@ -25066,9 +25039,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:list
       - tokenizer:
-        - ADMIN
+        - user:list
       summary: List users v2
       tags:
       - users
@@ -25128,9 +25101,13 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:create
+        - user:attach
+        - role:attach
       - tokenizer:
-        - ADMIN
+        - user:create
+        - user:attach
+        - role:attach
       summary: Create user
       tags:
       - users
@@ -25174,9 +25151,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:delete
       - tokenizer:
-        - ADMIN
+        - user:delete
       summary: Delete user
       tags:
       - users
@@ -25231,9 +25208,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user by user id
       tags:
       - users
@@ -25287,9 +25264,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:update
       - tokenizer:
-        - ADMIN
+        - user:update
       summary: Update user v2
       tags:
       - users
@@ -25345,9 +25322,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - factor-password:list
       - tokenizer:
-        - ADMIN
+        - factor-password:list
       summary: Get reset password token for a user
       tags:
       - users
@@ -25410,9 +25387,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - factor-password:create
+        - user:attach
       - tokenizer:
-        - ADMIN
+        - factor-password:create
+        - user:attach
       summary: Create or regenerate reset password token for a user
       tags:
       - users
@@ -25470,9 +25449,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user roles
       tags:
       - users

docs/contributing/go/authz.md

@@ -121,7 +121,7 @@ The pieces:
 - **`ResourceDef`** — declares the resource, verb, audit category, how to extract the instance ID, and how to turn that ID into selectors. ID extractors live in [pkg/types/coretypes/extractor.go](/pkg/types/coretypes/extractor.go): `PathParam("id")`, `BodyJSONPath("data.id")`, `BodyJSONArray("ids")`, and `ResponseJSONPath("data.id")` for IDs only known after the handler runs (e.g. `create`).
 - **`SecuritySchemes`** — advertises the required scope (`resource.Scope(verb)`, e.g. `serviceaccount:create`) in the OpenAPI spec.
 
-For routes that link two resources, use `AttachDetachSiblingResourceDef` (both sides are authz-checked, e.g. attaching a role to a service account requires `attach` on **both** the service account and the role). For parent-child routes (e.g. creating an API key under a service account), both sides are checked too, but with different verbs: declare a `BasicResourceDef` checking the child with `create`/`delete`, alongside an `AttachDetachParentChildResourceDef` checking the parent with `attach`/`detach` (within that def the child is only recorded for audit) — see the `/api/v1/service_accounts/{id}/keys` route in [pkg/apiserver/signozapiserver/serviceaccount.go](/pkg/apiserver/signozapiserver/serviceaccount.go).
+For routes that link two resources, use `AttachDetachSiblingResourceDef` (both sides are authz-checked, e.g. attaching a role to a service account requires `attach` on **both** the service account and the role). If the target list is optional in the payload (e.g. `userRoles` at user creation), set `OptionalTargets`: when no target ids resolve, the attach is vacuous and the def is skipped entirely — without it, the empty-id contract would check collection-level access on the target. For parent-child routes (e.g. creating an API key under a service account), both sides are checked too, but with different verbs: declare a `BasicResourceDef` checking the child with `create`/`delete`, alongside an `AttachDetachParentChildResourceDef` checking the parent with `attach`/`detach` (within that def the child is only recorded for audit) — see the `/api/v1/service_accounts/{id}/keys` route in [pkg/apiserver/signozapiserver/serviceaccount.go](/pkg/apiserver/signozapiserver/serviceaccount.go).
 
 Prefer `CheckResources` with a `ResourceDef` for anything resource-shaped. The older coarse gates `ViewAccess`/`EditAccess`/`AdminAccess` only check "does the caller hold one of these roles" and give up per-resource granularity; `OpenAccess` performs no authorization (authentication still applies); `CheckWithoutClaims` serves anonymous routes such as public dashboards.
 

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -10518,31 +10518,15 @@ export interface SpantypesGettableFlamegraphTraceDTO {
 	startTimestampMillis: number;
 }
 
-export enum SpantypesSpanMapperOriginDTO {
-	user = 'user',
-	system = 'system',
-}
-export interface SpantypesSpanMapperGroupConditionKeyDTO {
-	/**
-	 * @type boolean
-	 */
-	enabled: boolean;
-	origin?: SpantypesSpanMapperOriginDTO;
-	/**
-	 * @type string
-	 */
-	value: string;
-}
-
 export type SpantypesSpanMapperGroupConditionDTOAnyOf = {
 	/**
 	 * @type array,null
 	 */
-	attributes: SpantypesSpanMapperGroupConditionKeyDTO[] | null;
+	attributes: string[] | null;
 	/**
 	 * @type array,null
 	 */
-	resource: SpantypesSpanMapperGroupConditionKeyDTO[] | null;
+	resource: string[] | null;
 };
 
 /**
@@ -10578,7 +10562,6 @@ export interface SpantypesSpanMapperGroupDTO {
 	 * @type string
 	 */
 	orgId: string;
-	origin: SpantypesSpanMapperOriginDTO;
 	/**
 	 * @type string
 	 * @format date-time
@@ -10588,10 +10571,6 @@ export interface SpantypesSpanMapperGroupDTO {
 	 * @type string
 	 */
 	updatedBy?: string;
-	/**
-	 * @type integer
-	 */
-	version: number;
 }
 
 export interface SpantypesGettableSpanMapperGroupsDTO {
@@ -10649,16 +10628,11 @@ export enum SpantypesSpanMapperOperationDTO {
 }
 export interface SpantypesSpanMapperSourceDTO {
 	context: SpantypesFieldContextDTO;
-	/**
-	 * @type boolean
-	 */
-	enabled: boolean;
 	/**
 	 * @type string
 	 */
 	key: string;
 	operation: SpantypesSpanMapperOperationDTO;
-	origin?: SpantypesSpanMapperOriginDTO;
 	/**
 	 * @type integer
 	 */
@@ -10700,7 +10674,6 @@ export interface SpantypesSpanMapperDTO {
 	 * @type string
 	 */
 	name: string;
-	origin: SpantypesSpanMapperOriginDTO;
 	/**
 	 * @type string
 	 * @format date-time

frontend/src/container/LLMObservability/AttributeMapping/AttributeMappingsTab/__tests__/AttributeMappingsTab.test.tsx

@@ -333,7 +333,6 @@ describe('AttributeMappingsTab (integration)', () => {
 						context: FieldContext.attribute,
 						operation: MapperOperation.copy,
 						priority,
-						enabled: true,
 					})),
 				},
 			}),

frontend/src/container/LLMObservability/AttributeMapping/AttributeMappingsTab/components/MappingsTable/GroupHeader/ConditionsTooltip.tsx

@@ -1,12 +1,10 @@
 import { Typography } from '@signozhq/ui/typography';
 
-import { ConditionKey } from 'container/LLMObservability/AttributeMapping/types';
-
 import styles from './ConditionsTooltip.module.scss';
 
 interface ConditionsTooltipProps {
-	attributes: ConditionKey[];
-	resource: ConditionKey[];
+	attributes: string[];
+	resource: string[];
 }
 
 function ConditionsTooltip({
@@ -35,8 +33,8 @@ function ConditionsTooltip({
 					</Typography.Text>
 					<div className={styles.keyList}>
 						{attributes.map((key) => (
-							<code key={`${key.origin}-${key.value}`} className={styles.key}>
-								{key.value}
+							<code key={key} className={styles.key}>
+								{key}
 							</code>
 						))}
 					</div>
@@ -49,8 +47,8 @@ function ConditionsTooltip({
 					</Typography.Text>
 					<div className={styles.keyList}>
 						{resource.map((key) => (
-							<code key={`${key.origin}-${key.value}`} className={styles.key}>
-								{key.value}
+							<code key={key} className={styles.key}>
+								{key}
 							</code>
 						))}
 					</div>

frontend/src/container/LLMObservability/AttributeMapping/__tests__/fixtures.ts

@@ -3,7 +3,6 @@ import {
 	SpantypesSpanMapperDTO as Mapper,
 	SpantypesSpanMapperGroupDTO as MapperGroup,
 	SpantypesSpanMapperOperationDTO as MapperOperation,
-	SpantypesSpanMapperOriginDTO as MapperOrigin,
 	SpantypesSpanMapperTestSpanDTO as TestSpan,
 } from 'api/generated/services/sigNoz.schemas';
 
@@ -22,15 +21,9 @@ export function makeGroup(overrides: Partial<MapperGroup> = {}): MapperGroup {
 		orgId: 'org-1',
 		name: 'demo',
 		enabled: true,
-		origin: MapperOrigin.user,
-		version: 0,
 		condition: {
-			attributes: [
-				{ value: 'ai.embeddings', enabled: true, origin: MapperOrigin.user },
-			],
-			resource: [
-				{ value: 'cloud.account.id', enabled: true, origin: MapperOrigin.user },
-			],
+			attributes: ['ai.embeddings'],
+			resource: ['cloud.account.id'],
 		},
 		...overrides,
 	};
@@ -42,7 +35,6 @@ export function makeMapper(overrides: Partial<Mapper> = {}): Mapper {
 		groupId: 'group-1',
 		name: 'gen_ai.request.model',
 		enabled: true,
-		origin: MapperOrigin.user,
 		fieldContext: FieldContext.attribute,
 		config: {
 			sources: [
@@ -51,16 +43,12 @@ export function makeMapper(overrides: Partial<Mapper> = {}): Mapper {
 					context: FieldContext.attribute,
 					operation: MapperOperation.copy,
 					priority: 2,
-					enabled: true,
-					origin: MapperOrigin.user,
 				},
 				{
 					key: 'llm.model',
 					context: FieldContext.attribute,
 					operation: MapperOperation.move,
 					priority: 1,
-					enabled: true,
-					origin: MapperOrigin.user,
 				},
 			],
 		},
@@ -97,12 +85,8 @@ export const mockGroups: MapperGroup[] = [
 		id: 'group-1',
 		name: 'demo',
 		condition: {
-			attributes: [
-				{ value: 'ai.embeddings', enabled: true, origin: MapperOrigin.user },
-			],
-			resource: [
-				{ value: 'cloud.account.id', enabled: true, origin: MapperOrigin.user },
-			],
+			attributes: ['ai.embeddings'],
+			resource: ['cloud.account.id'],
 		},
 	}),
 	makeGroup({

frontend/src/container/LLMObservability/AttributeMapping/components/GroupFormDrawer/components/ConditionKeyList/ConditionKeyList.tsx

@@ -1,23 +1,19 @@
 import { Button } from '@signozhq/ui/button';
 import { Plus, X } from '@signozhq/icons';
 
-import {
-	ConditionKey,
-	FieldContextValue,
-} from 'container/LLMObservability/AttributeMapping/types';
-import { createConditionKey } from 'container/LLMObservability/AttributeMapping/utils';
+import { FieldContextValue } from 'container/LLMObservability/AttributeMapping/types';
 import KeySearchInput from '../../../KeySearchInput/KeySearchInput';
 import styles from './ConditionKeyList.module.scss';
 
 interface ConditionKeyListProps {
 	label: string;
 	labelHint?: string;
-	keys: ConditionKey[];
+	keys: string[];
 	placeholder: string;
 	addLabel: string;
 	testIdPrefix: string;
 	fieldContext: FieldContextValue;
-	onChange: (keys: ConditionKey[]) => void;
+	onChange: (keys: string[]) => void;
 }
 
 function ConditionKeyList({
@@ -31,11 +27,11 @@ function ConditionKeyList({
 	onChange,
 }: ConditionKeyListProps): JSX.Element {
 	const updateKey = (index: number, value: string): void => {
-		onChange(keys.map((key, i) => (i === index ? { ...key, value } : key)));
+		onChange(keys.map((key, i) => (i === index ? value : key)));
 	};
 
 	const addKey = (): void => {
-		onChange([...keys, createConditionKey()]);
+		onChange([...keys, '']);
 	};
 
 	const removeKey = (index: number): void => {
@@ -57,7 +53,7 @@ function ConditionKeyList({
 							<KeySearchInput
 								className={styles.keyInput}
 								placeholder={placeholder}
-								value={key.value}
+								value={key}
 								fieldContext={fieldContext}
 								onChange={(next): void => updateKey(index, next)}
 								testId={`${testIdPrefix}-${index}`}

frontend/src/container/LLMObservability/AttributeMapping/saveDraft.ts

@@ -42,9 +42,7 @@ function sourcesEqual(a: SourceConfig[], b: SourceConfig[]): boolean {
 			(source, index) =>
 				source.key === b[index].key &&
 				source.context === b[index].context &&
-				source.operation === b[index].operation &&
-				source.enabled === b[index].enabled &&
-				source.origin === b[index].origin,
+				source.operation === b[index].operation,
 		)
 	);
 }

frontend/src/container/LLMObservability/AttributeMapping/types.ts

@@ -3,7 +3,6 @@ import {
 	SpantypesSpanMapperDTO,
 	SpantypesSpanMapperGroupDTO,
 	SpantypesSpanMapperOperationDTO,
-	SpantypesSpanMapperOriginDTO,
 } from 'api/generated/services/sigNoz.schemas';
 
 export type MapperGroup = SpantypesSpanMapperGroupDTO;
@@ -12,16 +11,6 @@ export const FieldContext = SpantypesFieldContextDTO;
 export type FieldContextValue = SpantypesFieldContextDTO;
 export const MapperOperation = SpantypesSpanMapperOperationDTO;
 export type MapperOperationValue = SpantypesSpanMapperOperationDTO;
-export const MapperOrigin = SpantypesSpanMapperOriginDTO;
-export type MapperOriginValue = SpantypesSpanMapperOriginDTO;
-
-// One condition substring. Shipped (system) keys are read-only apart from
-// `enabled`; user keys are fully editable.
-export interface ConditionKey {
-	value: string;
-	enabled: boolean;
-	origin: MapperOriginValue;
-}
 
 export type MapperDraftMode = 'add' | 'edit';
 
@@ -29,8 +18,6 @@ export interface SourceConfig {
 	key: string;
 	context: SpantypesFieldContextDTO;
 	operation: SpantypesSpanMapperOperationDTO;
-	enabled: boolean;
-	origin: MapperOriginValue;
 }
 
 // Editable form state for a mapper. `sources` is ordered highest priority
@@ -46,8 +33,8 @@ export interface MapperDraft {
 export interface GroupDraft {
 	id: string | null;
 	name: string;
-	attributes: ConditionKey[];
-	resource: ConditionKey[];
+	attributes: string[];
+	resource: string[];
 	enabled: boolean;
 }
 
@@ -64,8 +51,8 @@ export interface DraftGroup {
 	localId: string;
 	serverId: string | null;
 	name: string;
-	attributes: ConditionKey[];
-	resource: ConditionKey[];
+	attributes: string[];
+	resource: string[];
 	enabled: boolean;
 	mappers: DraftMapper[];
 }

frontend/src/container/LLMObservability/AttributeMapping/utils.ts

@@ -1,14 +1,12 @@
 import {
 	SpantypesPostableSpanMapperDTO,
 	SpantypesPostableSpanMapperGroupDTO,
-	SpantypesSpanMapperGroupConditionKeyDTO,
 	SpantypesUpdatableSpanMapperDTO,
 	SpantypesUpdatableSpanMapperGroupDTO,
 } from 'api/generated/services/sigNoz.schemas';
 import { v4 as uuid } from 'uuid';
 
 import {
-	ConditionKey,
 	DraftGroup,
 	DraftMapper,
 	FieldContext,
@@ -17,7 +15,6 @@ import {
 	MapperDraft,
 	MapperGroup,
 	MapperOperation,
-	MapperOrigin,
 	SourceConfig,
 } from './types';
 
@@ -27,36 +24,20 @@ function genLocalId(prefix: 'group' | 'mapper'): string {
 	return `local-${prefix}-${uuid()}`;
 }
 
-export function createConditionKey(value = ''): ConditionKey {
-	return { value, enabled: true, origin: MapperOrigin.user };
-}
-
-// Trimmed, de-duplicated, non-empty keys preserving input order. A shipped and
-// a user key may share a value, so the origin is part of the identity.
-function cleanKeys(keys: ConditionKey[]): ConditionKey[] {
+// Trimmed, de-duplicated, non-empty keys preserving input order.
+function cleanKeys(keys: string[]): string[] {
 	const seen = new Set<string>();
-	const result: ConditionKey[] = [];
+	const result: string[] = [];
 	keys.forEach((raw) => {
-		const value = raw.value.trim();
-		const dedupeKey = `${raw.origin}:${value}`;
-		if (value && !seen.has(dedupeKey)) {
-			seen.add(dedupeKey);
-			result.push({ ...raw, value });
+		const key = raw.trim();
+		if (key && !seen.has(key)) {
+			seen.add(key);
+			result.push(key);
 		}
 	});
 	return result;
 }
 
-function fromConditionKeys(
-	keys: SpantypesSpanMapperGroupConditionKeyDTO[] | null | undefined,
-): ConditionKey[] {
-	return (keys ?? []).map((key) => ({
-		value: key.value,
-		enabled: key.enabled,
-		origin: key.origin ?? MapperOrigin.user,
-	}));
-}
-
 // Source configs for a mapper, highest priority first (first match wins at
 // evaluation time).
 function getMapperSources(mapper: Mapper): SourceConfig[] {
@@ -67,8 +48,6 @@ function getMapperSources(mapper: Mapper): SourceConfig[] {
 			key: source.key,
 			context: source.context,
 			operation: source.operation,
-			enabled: source.enabled,
-			origin: source.origin ?? MapperOrigin.user,
 		}));
 }
 
@@ -77,8 +56,6 @@ export function createEmptySource(): SourceConfig {
 		key: '',
 		context: FieldContext.attribute,
 		operation: MapperOperation.copy,
-		enabled: true,
-		origin: MapperOrigin.user,
 	};
 }
 
@@ -95,7 +72,7 @@ function getCleanSources(draft: MapperDraft): SourceConfig[] {
 	const result: SourceConfig[] = [];
 	draft.sources.forEach((source) => {
 		const key = source.key.trim();
-		const dedupeKey = `${source.origin}:${source.context}:${key}`;
+		const dedupeKey = `${source.context}:${key}`;
 		if (key && !seen.has(dedupeKey)) {
 			seen.add(dedupeKey);
 			result.push({ ...source, key });
@@ -118,8 +95,6 @@ function buildSources(
 		context: source.context,
 		operation: source.operation,
 		priority: sources.length - index,
-		enabled: source.enabled,
-		origin: source.origin,
 	}));
 }
 
@@ -148,7 +123,7 @@ export function buildUpdatableMapper(
 export const EMPTY_GROUP_DRAFT: GroupDraft = {
 	id: null,
 	name: '',
-	attributes: [createConditionKey()],
+	attributes: [''],
 	resource: [],
 	enabled: true,
 };
@@ -195,8 +170,8 @@ export function buildDraftGroup(
 		localId: group.id,
 		serverId: group.id,
 		name: group.name,
-		attributes: fromConditionKeys(group.condition?.attributes),
-		resource: fromConditionKeys(group.condition?.resource),
+		attributes: group.condition?.attributes ?? [],
+		resource: group.condition?.resource ?? [],
 		enabled: group.enabled,
 		mappers: mappers.map(buildDraftMapper),
 	};
@@ -207,8 +182,7 @@ export function groupDraftFromNode(group: DraftGroup): GroupDraft {
 	return {
 		id: group.localId,
 		name: group.name,
-		attributes:
-			group.attributes.length > 0 ? group.attributes : [createConditionKey()],
+		attributes: group.attributes.length > 0 ? group.attributes : [''],
 		resource: group.resource,
 		enabled: group.enabled,
 	};

frontend/src/container/LLMObservability/Explorer/Controls/Controls.module.scss

@@ -0,0 +1,14 @@
+.container {
+	display: flex;
+	align-items: center;
+	justify-content: flex-end;
+	gap: 0.3rem;
+	margin: 8px 0;
+}
+
+.optionsTrigger {
+	display: flex;
+	align-items: center;
+	gap: 4px;
+	cursor: pointer;
+}

frontend/src/container/LLMObservability/Explorer/Controls/index.tsx

@@ -0,0 +1,82 @@
+import { memo, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Settings } from '@signozhq/icons';
+import FieldsSelector from 'components/FieldsSelector';
+import Controls, { ControlsProps } from 'container/Controls';
+import { OptionsMenuConfig } from 'container/OptionsMenu/types';
+import useQueryPagination from 'hooks/queryPagination/useQueryPagination';
+import { DataSource } from 'types/common/queryBuilder';
+
+import styles from './Controls.module.scss';
+
+function TraceExplorerControls({
+	isLoading,
+	totalCount,
+	perPageOptions,
+	config,
+	showSizeChanger = true,
+}: TraceExplorerControlsProps): JSX.Element | null {
+	const { t } = useTranslation(['trace']);
+	const [isFieldsSelectorOpen, setIsFieldsSelectorOpen] = useState(false);
+
+	const {
+		pagination,
+		handleCountItemsPerPageChange,
+		handleNavigateNext,
+		handleNavigatePrevious,
+	} = useQueryPagination(totalCount, perPageOptions);
+
+	return (
+		<div className={styles.container}>
+			{config?.fieldsSelector && (
+				<>
+					<div
+						className={styles.optionsTrigger}
+						onClick={(): void => setIsFieldsSelectorOpen(true)}
+					>
+						{t('options_menu.options')}
+						<Settings size="md" />
+					</div>
+					<FieldsSelector
+						isOpen={isFieldsSelectorOpen}
+						title="Edit columns"
+						fields={config.fieldsSelector.value}
+						onFieldsChange={config.fieldsSelector.onFieldsChange}
+						onClose={(): void => setIsFieldsSelectorOpen(false)}
+						signal={DataSource.TRACES}
+					/>
+				</>
+			)}
+
+			<Controls
+				isLoading={isLoading}
+				totalCount={totalCount}
+				offset={pagination.offset}
+				countPerPage={pagination.limit}
+				perPageOptions={perPageOptions}
+				handleCountItemsPerPageChange={handleCountItemsPerPageChange}
+				handleNavigateNext={handleNavigateNext}
+				handleNavigatePrevious={handleNavigatePrevious}
+				showSizeChanger={showSizeChanger}
+			/>
+		</div>
+	);
+}
+
+TraceExplorerControls.defaultProps = {
+	config: null,
+};
+
+type TraceExplorerControlsProps = Pick<
+	ControlsProps,
+	'isLoading' | 'totalCount' | 'perPageOptions'
+> & {
+	config?: OptionsMenuConfig | null;
+	showSizeChanger?: boolean;
+};
+
+TraceExplorerControls.defaultProps = {
+	showSizeChanger: true,
+};
+
+export default memo(TraceExplorerControls);

frontend/src/container/LLMObservability/Explorer/ListView/utils.tsx

@@ -0,0 +1,168 @@
+import { Link } from 'react-router-dom';
+import type { TableColumnsType as ColumnsType } from 'antd';
+import { Badge } from '@signozhq/ui/badge';
+import { Typography } from '@signozhq/ui/typography';
+import { TelemetryFieldKey } from 'api/v5/v5';
+import type { TracesTableRow } from '../TracesTable/getFieldColumn';
+import { DATE_TIME_FORMATS } from 'constants/dateTimeFormats';
+import ROUTES from 'constants/routes';
+import { buildCompositeKey } from 'container/OptionsMenu/utils';
+import { getMs } from 'container/Trace/Filters/Panel/PanelBody/Duration/util';
+import { formUrlParams } from 'container/TraceDetail/utils';
+import { TimestampInput } from 'hooks/useTimezoneFormatter/useTimezoneFormatter';
+import { RowData } from 'lib/query/createTableColumnsFromQuery';
+import LineClampedText from 'periscope/components/LineClampedText/LineClampedText';
+import { ILog } from 'types/api/logs/log';
+import { QueryDataV3 } from 'types/api/widgets/getQuery';
+
+export function BlockLink({
+	children,
+	to,
+	openInNewTab,
+}: {
+	children: React.ReactNode;
+	to: string;
+	openInNewTab: boolean;
+}): any {
+	// Display block to make the whole cell clickable
+	return (
+		<Link
+			to={to}
+			style={{ display: 'block' }}
+			target={openInNewTab ? '_blank' : '_self'}
+		>
+			{children}
+		</Link>
+	);
+}
+
+export const transformDataWithDate = (
+	data: QueryDataV3[],
+): Omit<ILog, 'timestamp'>[] =>
+	data[0]?.list?.map(({ data, timestamp }) => ({ ...data, date: timestamp })) ||
+	[];
+
+export const getTraceLink = (record: Record<string, unknown>): string => {
+	function readId(value: unknown): string {
+		if (typeof value === 'string' || typeof value === 'number') {
+			return String(value);
+		}
+		return '';
+	}
+
+	const traceId = readId(record.traceID) || readId(record.trace_id);
+	const spanId = readId(record.spanID) || readId(record.span_id);
+
+	return `${ROUTES.TRACE}/${traceId}${formUrlParams({
+		spanId,
+		levelUp: 0,
+		levelDown: 0,
+	})}`;
+};
+
+export const getListColumns = (
+	selectedColumns: TelemetryFieldKey[],
+	formatTimezoneAdjustedTimestamp: (
+		input: TimestampInput,
+		format?: string,
+	) => string | number,
+): ColumnsType<RowData> => {
+	const initialColumns: ColumnsType<RowData> = [
+		{
+			dataIndex: 'date',
+			key: 'date',
+			title: 'Timestamp',
+			width: 145,
+			render: (value, item): JSX.Element => {
+				const date =
+					typeof value === 'string'
+						? formatTimezoneAdjustedTimestamp(
+								value,
+								DATE_TIME_FORMATS.ISO_DATETIME_MS,
+							)
+						: formatTimezoneAdjustedTimestamp(
+								value / 1e6,
+								DATE_TIME_FORMATS.ISO_DATETIME_MS,
+							);
+				return (
+					<BlockLink to={getTraceLink(item)} openInNewTab={false}>
+						<Typography.Text>{date}</Typography.Text>
+					</BlockLink>
+				);
+			},
+		},
+	];
+
+	const columns: ColumnsType<RowData> =
+		selectedColumns.map((props) => {
+			const name = props?.name || (props as any)?.key;
+			const fieldContext = props?.fieldContext || (props as any)?.type;
+			return {
+				title: name,
+				dataIndex: name,
+				key: buildCompositeKey(name, fieldContext),
+				width: 145,
+				render: (value, item): JSX.Element => {
+					if (value === '') {
+						return (
+							<BlockLink to={getTraceLink(item)} openInNewTab={false}>
+								<Typography data-testid={name}>N/A</Typography>
+							</BlockLink>
+						);
+					}
+
+					if (
+						name === 'httpMethod' ||
+						name === 'responseStatusCode' ||
+						name === 'response_status_code' ||
+						name === 'http_method'
+					) {
+						return (
+							<BlockLink to={getTraceLink(item)} openInNewTab={false}>
+								<Badge data-testid={name} color="sakura" variant="outline">
+									{value}
+								</Badge>
+							</BlockLink>
+						);
+					}
+
+					if (name === 'durationNano' || name === 'duration_nano') {
+						return (
+							<BlockLink to={getTraceLink(item)} openInNewTab={false}>
+								<Typography data-testid={name}>{getMs(value)}ms</Typography>
+							</BlockLink>
+						);
+					}
+
+					return (
+						<BlockLink to={getTraceLink(item)} openInNewTab={false}>
+							<Typography data-testid={name}>
+								<LineClampedText text={value} lines={3} />
+							</Typography>
+						</BlockLink>
+					);
+				},
+				responsive: ['md'],
+			};
+		}) || [];
+
+	return [...initialColumns, ...columns];
+};
+
+// Reshapes the query-range list payload into table rows. `id` mirrors span_id so
+// TanStack sees genuine row changes on orderBy toggles instead of falling back to
+// positional ids; `timestamp` is lifted from the wrapping ListItem.
+export const transformSpanRows = (data: QueryDataV3[]): TracesTableRow[] => {
+	const list = data[0]?.list;
+	if (!list) {
+		return [];
+	}
+	return list.map((item) => {
+		const row = item.data as Record<string, unknown>;
+		return {
+			...row,
+			timestamp: item.timestamp,
+			id: row.span_id,
+		};
+	}) as TracesTableRow[];
+};

frontend/src/container/LLMObservability/Explorer/TraceLoading/TraceLoading.styles.scss

@@ -0,0 +1,19 @@
+.loading-traces {
+	padding: 24px 0;
+	height: 240px;
+
+	display: flex;
+	justify-content: center;
+	align-items: flex-start;
+
+	.loading-traces-content {
+		display: flex;
+		align-items: flex-start;
+		flex-direction: column;
+
+		.loading-gif {
+			height: 72px;
+			margin-left: -24px;
+		}
+	}
+}

frontend/src/container/LLMObservability/Explorer/TraceLoading/TraceLoading.tsx

@@ -0,0 +1,22 @@
+import { useTranslation } from 'react-i18next';
+import { Typography } from '@signozhq/ui/typography';
+import { DataSource } from 'types/common/queryBuilder';
+
+import loadingPlaneUrl from '@/assets/Icons/loading-plane.gif';
+
+import './TraceLoading.styles.scss';
+
+export function TracesLoading(): JSX.Element {
+	const { t } = useTranslation('common');
+	return (
+		<div className="loading-traces">
+			<div className="loading-traces-content">
+				<img className="loading-gif" src={loadingPlaneUrl} alt="wait-icon" />
+
+				<Typography>
+					{t('pending_data_placeholder', { dataSource: DataSource.TRACES })}
+				</Typography>
+			</div>
+		</div>
+	);
+}

frontend/src/container/LLMObservability/Explorer/TracesTable/FieldCell.tsx

@@ -0,0 +1,77 @@
+import { generatePath, Link } from 'react-router-dom';
+import { Badge } from '@signozhq/ui/badge';
+import TanStackTable from 'components/TanStackTableView';
+import { DATE_TIME_FORMATS } from 'constants/dateTimeFormats';
+import ROUTES from 'constants/routes';
+import { getMs } from 'container/Trace/Filters/Panel/PanelBody/Duration/util';
+import { useTimezone } from 'providers/Timezone';
+
+import {
+	DURATION_FIELD_NAMES,
+	STATUS_FIELD_NAMES,
+	TIMESTAMP_FIELD_NAMES,
+	TRACE_ID_FIELD_NAMES,
+} from './constants';
+import { stringifyCellValue } from './utils';
+
+type FieldCellProps = {
+	name: string;
+	value: unknown;
+};
+
+function FieldCell({ name, value }: FieldCellProps): JSX.Element {
+	const { formatTimezoneAdjustedTimestamp } = useTimezone();
+
+	if (TIMESTAMP_FIELD_NAMES.has(name)) {
+		const ts = value as string | number;
+		const formatted =
+			typeof ts === 'string'
+				? formatTimezoneAdjustedTimestamp(ts, DATE_TIME_FORMATS.ISO_DATETIME_MS)
+				: formatTimezoneAdjustedTimestamp(
+						ts / 1e6,
+						DATE_TIME_FORMATS.ISO_DATETIME_MS,
+					);
+		const text = String(formatted);
+		return <TanStackTable.Text title={text}>{text}</TanStackTable.Text>;
+	}
+
+	if (value === '' || value == null) {
+		return <TanStackTable.Text data-testid={name}>-</TanStackTable.Text>;
+	}
+
+	const text = stringifyCellValue(value);
+
+	if (TRACE_ID_FIELD_NAMES.has(name)) {
+		return (
+			<Link
+				to={generatePath(ROUTES.TRACE_DETAIL, { id: text })}
+				data-testid="trace-id"
+				onClick={(e): void => e.stopPropagation()}
+			>
+				{text}
+			</Link>
+		);
+	}
+
+	if (STATUS_FIELD_NAMES.has(name)) {
+		return (
+			<Badge data-testid={name} color="sakura" variant="outline">
+				{text}
+			</Badge>
+		);
+	}
+
+	if (DURATION_FIELD_NAMES.has(name)) {
+		return (
+			<TanStackTable.Text data-testid={name}>{getMs(text)}ms</TanStackTable.Text>
+		);
+	}
+
+	return (
+		<TanStackTable.Text data-testid={name} title={text}>
+			{text}
+		</TanStackTable.Text>
+	);
+}
+
+export default FieldCell;

frontend/src/container/LLMObservability/Explorer/TracesTable/TracesTable.module.scss

@@ -0,0 +1,26 @@
+.tableWrapper {
+	flex: 1;
+	min-height: 0;
+	display: flex;
+	flex-direction: column;
+}
+
+.tracesTable {
+	--tanstack-table-row-height: 54px;
+	--tanstack-table-header-height: 54px;
+
+	--tanstack-cell-padding-top-override: 5px;
+	--tanstack-cell-padding-bottom-override: 5px;
+	--tanstack-cell-padding-right-override: 15px;
+
+	--tanstack-cell-padding-left-override: 15px;
+	--tanstack-cell-header-padding-left-override: 5px;
+
+	--tanstack-cell-header-padding-left-first-column: 15px;
+
+	--tanstack-plain-body-line-clamp: 1;
+
+	--tanstack-table-cell-bg: var(--l2-background);
+	--tanstack-table-header-cell-bg: var(--l1-background-hover);
+	--tanstack-table-row-hover-bg: var(--l1-background-hover);
+}

frontend/src/container/LLMObservability/Explorer/TracesTable/TracesTable.tsx

@@ -0,0 +1,116 @@
+import { useCallback } from 'react';
+import { useHistory } from 'react-router-dom';
+import ErrorInPlace from 'components/ErrorInPlace/ErrorInPlace';
+import TanStackTable from 'components/TanStackTableView';
+import type {
+	CellTypographySize,
+	TableColumnDef,
+} from 'components/TanStackTableView/types';
+import EmptyLogsSearch from 'container/EmptyLogsSearch/EmptyLogsSearch';
+import NoLogs from 'container/NoLogs/NoLogs';
+import { TracesLoading } from '../TraceLoading/TraceLoading';
+import APIError from 'types/api/error';
+import { DataSource, PanelTypeKeys } from 'types/common/queryBuilder';
+import { getAbsoluteUrl } from 'utils/basePath';
+
+import type { TracesTableRow } from './getFieldColumn';
+import styles from './TracesTable.module.scss';
+
+export type TracesTableProps = {
+	data: TracesTableRow[];
+	columns: TableColumnDef<TracesTableRow>[];
+	columnStorageKey?: string;
+	respectColumnOrder?: boolean;
+	panelType: PanelTypeKeys;
+	/** Builds the trace-detail href for a row; drives row click + cmd/ctrl-click. */
+	getRowHref: (row: TracesTableRow) => string;
+	isLoading: boolean;
+	isFetching: boolean;
+	isError: boolean;
+	error: APIError | Error | null;
+	isFilterApplied: boolean;
+	onColumnOrderChange?: (cols: TableColumnDef<TracesTableRow>[]) => void;
+	onColumnRemove?: (columnId: string) => void;
+	cellTypographySize?: CellTypographySize;
+};
+
+function TracesTable({
+	data,
+	columns,
+	columnStorageKey,
+	respectColumnOrder = false,
+	panelType,
+	getRowHref,
+	isLoading,
+	isFetching,
+	isError,
+	error,
+	isFilterApplied,
+	onColumnOrderChange,
+	onColumnRemove,
+	cellTypographySize = 'medium',
+}: TracesTableProps): JSX.Element {
+	const history = useHistory();
+
+	const isDataAbsent =
+		!isLoading && !isFetching && !isError && data.length === 0;
+
+	const handleRowClick = useCallback(
+		(row: TracesTableRow): void => {
+			history.push(getRowHref(row));
+		},
+		[history, getRowHref],
+	);
+
+	const handleRowClickNewTab = useCallback(
+		(row: TracesTableRow): void => {
+			window.open(getAbsoluteUrl(getRowHref(row)), '_blank', 'noopener');
+		},
+		[getRowHref],
+	);
+
+	return (
+		<>
+			{isError && error && <ErrorInPlace error={error as APIError} />}
+
+			{(isLoading || (isFetching && data.length === 0)) && <TracesLoading />}
+
+			{isDataAbsent && !isFilterApplied && (
+				<NoLogs dataSource={DataSource.TRACES} />
+			)}
+
+			{isDataAbsent && isFilterApplied && (
+				<EmptyLogsSearch dataSource={DataSource.TRACES} panelType={panelType} />
+			)}
+
+			{!isError && data.length !== 0 && (
+				<div className={styles.tableWrapper}>
+					<TanStackTable<TracesTableRow>
+						data={data}
+						columns={columns}
+						className={styles.tracesTable}
+						columnStorageKey={columnStorageKey}
+						respectColumnOrder={respectColumnOrder}
+						isLoading={isFetching}
+						cellTypographySize={cellTypographySize}
+						onColumnOrderChange={onColumnOrderChange}
+						onColumnRemove={onColumnRemove}
+						onRowClick={handleRowClick}
+						onRowClickNewTab={handleRowClickNewTab}
+						getRowTestId={(row): string => `traces-table-row-${row.id}`}
+					/>
+				</div>
+			)}
+		</>
+	);
+}
+
+TracesTable.defaultProps = {
+	columnStorageKey: undefined,
+	respectColumnOrder: false,
+	onColumnOrderChange: undefined,
+	onColumnRemove: undefined,
+	cellTypographySize: 'medium',
+};
+
+export default TracesTable;

frontend/src/container/LLMObservability/Explorer/TracesTable/constants.ts

@@ -0,0 +1,18 @@
+// Field-name allowlists that drive signal-specific cell rendering. Both legacy
+// camelCase and snake_case variants are listed because the API has shipped both.
+export const TIMESTAMP_FIELD_NAMES = new Set(['timestamp']);
+
+export const STATUS_FIELD_NAMES = new Set([
+	'httpMethod',
+	'http_method',
+	'http.method',
+	'http.request.method',
+	'responseStatusCode',
+	'response_status_code',
+	'http.status_code',
+	'http.response.status_code',
+]);
+
+export const DURATION_FIELD_NAMES = new Set(['durationNano', 'duration_nano']);
+
+export const TRACE_ID_FIELD_NAMES = new Set(['traceID', 'trace_id']);

frontend/src/container/LLMObservability/Explorer/TracesTable/getFieldColumn.tsx

@@ -0,0 +1,26 @@
+import { TelemetryFieldKey } from 'api/v5/v5';
+import type { TableColumnDef } from 'components/TanStackTableView/types';
+import { buildCompositeKey } from 'container/OptionsMenu/utils';
+
+import { TIMESTAMP_FIELD_NAMES } from './constants';
+import FieldCell from './FieldCell';
+
+export type TracesTableRow = { id: string } & Record<string, unknown>;
+
+export function getFieldColumn(
+	field: TelemetryFieldKey,
+): TableColumnDef<TracesTableRow> {
+	const { name, fieldContext, fieldDataType } = field;
+	const isTimestamp = TIMESTAMP_FIELD_NAMES.has(name);
+
+	return {
+		id: buildCompositeKey(name, fieldContext, fieldDataType),
+		header: name,
+		accessorFn: (row): unknown => row[name],
+		enableMove: !isTimestamp,
+		enableRemove: !isTimestamp,
+		canBeHidden: !isTimestamp,
+		width: { min: 192 },
+		cell: ({ value }): JSX.Element => <FieldCell name={name} value={value} />,
+	};
+}

frontend/src/container/LLMObservability/Explorer/TracesTable/utils.ts

@@ -0,0 +1,12 @@
+export function stringifyCellValue(value: unknown): string {
+	if (value == null) {
+		return '';
+	}
+	if (typeof value === 'string') {
+		return value;
+	}
+	if (typeof value === 'number' || typeof value === 'boolean') {
+		return String(value);
+	}
+	return JSON.stringify(value);
+}

frontend/src/container/LLMObservability/Explorer/TracesView/configs.tsx

@@ -1,9 +1,6 @@
 import { TelemetryFieldKey } from 'api/v5/v5';
 import type { TableColumnDef } from 'components/TanStackTableView/types';
-import {
-	getFieldColumn,
-	TracesTableRow,
-} from 'container/TracesExplorer/TracesTable/getFieldColumn';
+import { getFieldColumn, TracesTableRow } from '../TracesTable/getFieldColumn';
 import { DEFAULT_PER_PAGE_OPTIONS } from 'hooks/queryPagination';
 
 export const PER_PAGE_OPTIONS: number[] = [10, ...DEFAULT_PER_PAGE_OPTIONS];

frontend/src/container/LLMObservability/Explorer/aiActions.ts

@@ -0,0 +1,235 @@
+/**
+ * AI Assistant page-action factories for the Traces Explorer.
+ *
+ * Mirrors the logs equivalents — each factory closes over live page
+ * state/callbacks so `execute()` always operates on the current query, and
+ * the page component instantiates them via `useMemo` + `usePageActions`.
+ *
+ * See `pages/LogsExplorer/aiActions.ts` for the rationale behind writing
+ * BOTH `filters.items` and `filter.expression` and then re-using the same
+ * URL parser shape via `redirectWithQueryBuilderData`.
+ */
+
+import { convertFiltersToExpression } from 'components/QueryBuilderV2/utils';
+import {
+	aiFilterToTagFilterItem,
+	FILTER_OP_ENUM,
+	FILTER_VALUE_DESCRIPTION,
+	FilterDeps,
+	replaceFirstQueryData,
+} from 'container/AIAssistant/pageActions/builderQueryHelpers';
+import {
+	ActionResult,
+	PageAction,
+} from 'container/AIAssistant/pageActions/types';
+import {
+	IBuilderQuery,
+	TagFilterItem,
+} from 'types/api/queryBuilder/queryBuilderData';
+
+interface AIFilter {
+	key: string;
+	op: string;
+	value: string;
+}
+
+interface RunQueryParams {
+	filters: AIFilter[];
+}
+
+interface AddFilterParams {
+	key: string;
+	op: string;
+	value: string;
+}
+
+type TracesView = 'list' | 'timeseries' | 'table' | 'trace';
+
+interface ChangeViewParams {
+	view: TracesView;
+}
+
+interface SaveViewParams {
+	name: string;
+}
+
+/**
+ * Replace all active span filters and navigate to the updated query URL
+ * (which makes the WHERE clause reflect the new filters and triggers a re-run).
+ */
+export function tracesRunQueryAction(
+	deps: FilterDeps,
+): PageAction<RunQueryParams> {
+	return {
+		id: 'traces.runQuery',
+		description: 'Replace the active trace filters and re-run the query',
+		parameters: {
+			type: 'object',
+			properties: {
+				filters: {
+					type: 'array',
+					description: 'Replacement filter list',
+					items: {
+						type: 'object',
+						properties: {
+							key: {
+								type: 'string',
+								description: 'Attribute key, e.g. service.name, http.status_code',
+							},
+							op: {
+								type: 'string',
+								enum: [...FILTER_OP_ENUM],
+							},
+							value: {
+								type: 'string',
+								description: FILTER_VALUE_DESCRIPTION,
+							},
+						},
+						required: ['key', 'op', 'value'],
+					},
+				},
+			},
+			required: ['filters'],
+		},
+		autoApply: true,
+		execute: async ({ filters }): Promise<ActionResult> => {
+			const baseQuery = deps.currentQuery.builder.queryData[0];
+			if (!baseQuery) {
+				throw new Error('No active query found in Traces Explorer.');
+			}
+
+			const tagItems = filters.map(aiFilterToTagFilterItem);
+			const newFilters = { items: tagItems, op: 'AND' };
+			const updatedBuilderQuery: IBuilderQuery = {
+				...baseQuery,
+				filters: newFilters,
+				filter: convertFiltersToExpression(newFilters),
+			};
+
+			deps.handleSetQueryData(0, updatedBuilderQuery);
+			deps.redirectWithQueryBuilderData(
+				replaceFirstQueryData(deps.currentQuery, updatedBuilderQuery),
+			);
+
+			return {
+				summary: `Query updated with ${filters.length} filter(s) and re-run.`,
+			};
+		},
+		getContext: (): Record<string, unknown> => ({
+			filters:
+				deps.currentQuery.builder.queryData[0]?.filters?.items?.map(
+					(f: TagFilterItem) => ({
+						key: f.key?.key,
+						op: f.op,
+						value: f.value,
+					}),
+				) ?? [],
+		}),
+	};
+}
+
+/**
+ * Append a single filter to the existing trace query and navigate to the
+ * updated URL.
+ */
+export function tracesAddFilterAction(
+	deps: FilterDeps,
+): PageAction<AddFilterParams> {
+	return {
+		id: 'traces.addFilter',
+		description: 'Add a single filter to the current trace query and re-run',
+		parameters: {
+			type: 'object',
+			properties: {
+				key: {
+					type: 'string',
+					description: 'Attribute key, e.g. service.name, http.status_code',
+				},
+				op: {
+					type: 'string',
+					enum: [...FILTER_OP_ENUM],
+				},
+				value: {
+					type: 'string',
+					description: FILTER_VALUE_DESCRIPTION,
+				},
+			},
+			required: ['key', 'op', 'value'],
+		},
+		autoApply: true,
+		execute: async ({ key, op, value }): Promise<ActionResult> => {
+			const baseQuery = deps.currentQuery.builder.queryData[0];
+			if (!baseQuery) {
+				throw new Error('No active query found in Traces Explorer.');
+			}
+
+			const existing = baseQuery.filters?.items ?? [];
+			const newItem = aiFilterToTagFilterItem({ key, op, value });
+			const newFilters = { items: [...existing, newItem], op: 'AND' };
+			const updatedBuilderQuery: IBuilderQuery = {
+				...baseQuery,
+				filters: newFilters,
+				filter: convertFiltersToExpression(newFilters),
+			};
+
+			deps.handleSetQueryData(0, updatedBuilderQuery);
+			deps.redirectWithQueryBuilderData(
+				replaceFirstQueryData(deps.currentQuery, updatedBuilderQuery),
+			);
+
+			return { summary: `Filter added: ${key} ${op} "${value}". Query re-run.` };
+		},
+	};
+}
+
+/**
+ * Switch the traces explorer between list / timeseries / table / trace views.
+ */
+export function tracesChangeViewAction(deps: {
+	onChangeView: (view: TracesView) => void;
+}): PageAction<ChangeViewParams> {
+	return {
+		id: 'traces.changeView',
+		description:
+			'Switch the Traces Explorer between list, timeseries, table, and trace views',
+		parameters: {
+			type: 'object',
+			properties: {
+				view: {
+					type: 'string',
+					enum: ['list', 'timeseries', 'table', 'trace'],
+					description: 'The panel view to switch to',
+				},
+			},
+			required: ['view'],
+		},
+		execute: async ({ view }): Promise<ActionResult> => {
+			deps.onChangeView(view);
+			return { summary: `Switched to the "${view}" view.` };
+		},
+	};
+}
+
+/**
+ * Save the current trace query as a named view (stub — wires to real API
+ * when available).
+ */
+export function tracesSaveViewAction(deps: {
+	onSaveView: (name: string) => Promise<void>;
+}): PageAction<SaveViewParams> {
+	return {
+		id: 'traces.saveView',
+		description: 'Save the current trace query as a named view',
+		parameters: {
+			type: 'object',
+			properties: {
+				name: { type: 'string', description: 'Name for the saved view' },
+			},
+			required: ['name'],
+		},
+		execute: async ({ name }): Promise<ActionResult> => {
+			await deps.onSaveView(name);
+			return { summary: `View "${name}" saved.` };
+		},
+	};
+}

frontend/src/container/LLMObservability/ToolbarActions/LeftToolbarActions.tsx

@@ -0,0 +1,132 @@
+import {
+	ArrowUpToLine,
+	Atom,
+	Filter,
+	SquareMousePointer,
+	Terminal,
+	Binoculars,
+} from '@signozhq/icons';
+import { Button, Tooltip } from 'antd';
+import cx from 'classnames';
+import { ExplorerViews } from 'pages/LogsExplorer/utils';
+
+import './ToolbarActions.styles.scss';
+
+interface LeftToolbarActionsProps {
+	items: any;
+	selectedView: string;
+	onChangeSelectedView: (view: ExplorerViews) => void;
+	showFilter: boolean;
+	handleFilterVisibilityChange: () => void;
+}
+
+const activeTab = 'active-tab';
+
+export default function LeftToolbarActions({
+	items,
+	selectedView,
+	onChangeSelectedView,
+	showFilter,
+	handleFilterVisibilityChange,
+}: LeftToolbarActionsProps): JSX.Element {
+	const { clickhouse, list, timeseries, table, trace } = items;
+
+	return (
+		<div className="left-toolbar">
+			{!showFilter && (
+				<Tooltip title="Show Filters">
+					<Button onClick={handleFilterVisibilityChange} className="filter-btn">
+						<Filter size={12} />
+						<ArrowUpToLine size={12} style={{ transform: 'rotate(90deg)' }} />
+					</Button>
+				</Tooltip>
+			)}
+			<div className="left-toolbar-query-actions">
+				{list?.show && (
+					<Tooltip title="List View">
+						<Button
+							disabled={list.disabled}
+							className={cx(
+								'list-view-tab',
+								'explorer-view-option',
+								selectedView === list.key ? activeTab : '',
+							)}
+							onClick={(): void => onChangeSelectedView(list.key)}
+						>
+							<SquareMousePointer size={14} data-testid="search-view" />
+							List View
+						</Button>
+					</Tooltip>
+				)}
+
+				{trace?.show && (
+					<Tooltip title="Trace View">
+						<Button
+							disabled={trace.disabled}
+							className={cx(
+								'trace-view-tab',
+								'explorer-view-option',
+								selectedView === trace.key ? activeTab : '',
+							)}
+							onClick={(): void => onChangeSelectedView(trace.key)}
+						>
+							<SquareMousePointer size={14} data-testid="trace-view" />
+							Trace View
+						</Button>
+					</Tooltip>
+				)}
+
+				{timeseries?.show && (
+					<Tooltip title="Time Series">
+						<Button
+							disabled={timeseries.disabled}
+							className={cx(
+								'timeseries-view-tab',
+								'explorer-view-option',
+								selectedView === timeseries.key ? activeTab : '',
+							)}
+							onClick={(): void => onChangeSelectedView(timeseries.key)}
+						>
+							<Atom size={14} data-testid="query-builder-view" />
+							Time Series
+						</Button>
+					</Tooltip>
+				)}
+
+				{clickhouse?.show && (
+					<Tooltip title="Clickhouse">
+						<Button
+							disabled={clickhouse.disabled}
+							className={cx(
+								'clickhouse-view-tab',
+								'explorer-view-option',
+								selectedView === clickhouse.key ? activeTab : '',
+							)}
+							onClick={(): void => onChangeSelectedView(clickhouse.key)}
+						>
+							<Terminal size={14} data-testid="clickhouse-view" />
+							Clickhouse
+						</Button>
+					</Tooltip>
+				)}
+
+				{table?.show && (
+					<Tooltip title="Table">
+						<Button
+							disabled={table.disabled}
+							className={cx(
+								'table-view-tab',
+								'explorer-view-option',
+								selectedView === table.key ? activeTab : '',
+							)}
+							onClick={(): void => onChangeSelectedView(table.key)}
+						>
+							<Binoculars size={14} data-testid="query-builder-view-v2" />
+							Table
+						</Button>
+					</Tooltip>
+				)}
+			</div>
+		</div>
+	);
+}

frontend/src/container/LLMObservability/ToolbarActions/ToolbarActions.styles.scss

@@ -0,0 +1,125 @@
+.left-toolbar {
+	display: flex;
+	align-items: center;
+
+	.filter-btn {
+		display: flex;
+		align-items: center;
+		justify-content: center;
+		box-shadow: none;
+		height: 32px;
+		margin-right: 12px;
+		border: 1px solid var(--l1-border);
+	}
+
+	.left-toolbar-query-actions {
+		display: flex;
+		border-radius: 2px;
+		border: 1px solid var(--l1-border);
+		background: var(--l1-background);
+		flex-direction: row;
+		border-bottom: none;
+		margin-bottom: -1px;
+
+		.prom-ql-icon {
+			height: 14px;
+			width: 14px;
+		}
+
+		.explorer-view-option {
+			display: flex;
+			align-items: center;
+			justify-content: center;
+			flex-direction: row;
+			border: none;
+			padding: 9px;
+			box-shadow: none;
+			border-radius: 0px;
+			border-left: 1px solid var(--l1-border);
+			border-bottom: 1px solid var(--l1-border);
+
+			gap: 8px;
+
+			&.active-tab {
+				background-color: var(--primary-background);
+				border-bottom: 1px solid var(--primary-background);
+				color: var(--primary-foreground);
+
+				&:hover {
+					background-color: var(--primary-background) !important;
+				}
+			}
+
+			&:disabled {
+				background-color: var(--l3-background);
+				opacity: 0.6;
+			}
+
+			&:first-child {
+				border-left: 1px solid transparent;
+			}
+
+			&:hover {
+				background-color: transparent !important;
+				border-left: 1px solid transparent !important;
+				color: var(--l1-foreground);
+			}
+		}
+	}
+
+	.frequency-chart-view-controller {
+		display: flex;
+		align-items: center;
+		padding-left: 8px;
+		gap: 8px;
+	}
+}
+
+.right-toolbar {
+	display: flex;
+	align-items: center;
+	background-color: var(--bg-robin-600);
+}
+
+.right-actions {
+	display: flex;
+	align-items: center;
+}
+
+.loading-container {
+	display: flex;
+	gap: 8px;
+	align-items: center;
+
+	.loading-btn {
+		display: flex;
+		width: 32px;
+		height: 33px;
+		padding: 4px 10px;
+		justify-content: center;
+		align-items: center;
+		gap: 6px;
+		flex-shrink: 0;
+		border-radius: 2px;
+		background: var(--l3-background);
+		box-shadow: none;
+		border: none;
+	}
+
+	.cancel-run {
+		display: flex;
+		height: 33px;
+		padding: 4px 10px;
+		justify-content: center;
+		align-items: center;
+		gap: 6px;
+		flex: 1 0 0;
+		border-radius: 2px;
+		background: var(--danger-background);
+		border: none;
+	}
+	.cancel-run:hover {
+		background-color: var(--bg-cherry-400) !important;
+		color: var(--l1-foreground) !important;
+	}
+}

pkg/apiserver/signozapiserver/provider.go

@@ -53,6 +53,7 @@ type provider struct {
 	authzService               authz.AuthZ
 	orgHandler                 organization.Handler
 	userHandler                user.Handler
+	userGetter                 user.Getter
 	sessionHandler             session.Handler
 	authDomainHandler          authdomain.Handler
 	authDomainModule           authdomain.Module
@@ -97,6 +98,7 @@ func NewFactory(
 	authzService authz.AuthZ,
 	orgHandler organization.Handler,
 	userHandler user.Handler,
+	userGetter user.Getter,
 	sessionHandler session.Handler,
 	authDomainHandler authdomain.Handler,
 	authDomainModule authdomain.Module,
@@ -144,6 +146,7 @@ func NewFactory(
 			authzService,
 			orgHandler,
 			userHandler,
+			userGetter,
 			sessionHandler,
 			authDomainHandler,
 			authDomainModule,
@@ -193,6 +196,7 @@ func newProvider(
 	authzService authz.AuthZ,
 	orgHandler organization.Handler,
 	userHandler user.Handler,
+	userGetter user.Getter,
 	sessionHandler session.Handler,
 	authDomainHandler authdomain.Handler,
 	authDomainModule authdomain.Module,
@@ -240,6 +244,7 @@ func newProvider(
 		router:                     router,
 		orgHandler:                 orgHandler,
 		userHandler:                userHandler,
+		userGetter:                 userGetter,
 		authzService:               authzService,
 		sessionHandler:             sessionHandler,
 		authDomainHandler:          authDomainHandler,

pkg/apiserver/signozapiserver/user.go

@@ -6,24 +6,35 @@ import (
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addUserRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.ListUsers), handler.OpenAPIDef{
-		ID:                  "ListUsers",
-		Tags:                []string{"users"},
-		Summary:             "List users v2",
-		Description:         "This endpoint lists all users for the organization",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*types.User, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.ListUsers, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListUsers",
+			Tags:                []string{"users"},
+			Summary:             "List users v2",
+			Description:         "This endpoint lists all users for the organization",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*types.User, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryAccessControl,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
@@ -61,20 +72,43 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateUser), handler.OpenAPIDef{
-		ID:                  "CreateUser",
-		Tags:                []string{"users"},
-		Summary:             "Create user",
-		Description:         "This endpoint creates a user for the organization",
-		Request:             new(authtypes.PostableUser),
-		RequestContentType:  "application/json",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateUser",
+			Tags:                []string{"users"},
+			Summary:             "Create user",
+			Description:         "This endpoint creates a user for the organization",
+			Request:             new(authtypes.PostableUser),
+			RequestContentType:  "application/json",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbCreate), coretypes.ResourceUser.Scope(coretypes.VerbAttach), coretypes.ResourceRole.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceUser,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:            coretypes.VerbAttach,
+				Category:        coretypes.ActionCategoryAccessControl,
+				SourceResource:  coretypes.ResourceUser,
+				SourceIDs:       coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector:  coretypes.WildcardSelector,
+				TargetResource:  coretypes.ResourceRole,
+				TargetIDs:       coretypes.BodyJSONArray("userRoles.#.id"),
+				TargetSelector:  provider.roleSelector,
+				OptionalTargets: true,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
@@ -95,88 +129,148 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUser), handler.OpenAPIDef{
-		ID:                  "GetUser",
-		Tags:                []string{"users"},
-		Summary:             "Get user by user id",
-		Description:         "This endpoint returns the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(authtypes.UserWithRoles),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUser",
+			Tags:                []string{"users"},
+			Summary:             "Get user by user id",
+			Description:         "This endpoint returns the user by id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(authtypes.UserWithRoles),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.UpdateUser), handler.OpenAPIDef{
-		ID:                  "UpdateUser",
-		Tags:                []string{"users"},
-		Summary:             "Update user v2",
-		Description:         "This endpoint updates the user by id",
-		Request:             new(types.UpdatableUser),
-		RequestContentType:  "application/json",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.UpdateUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateUser",
+			Tags:                []string{"users"},
+			Summary:             "Update user v2",
+			Description:         "This endpoint updates the user by id",
+			Request:             new(types.UpdatableUser),
+			RequestContentType:  "application/json",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUser), handler.OpenAPIDef{
-		ID:                  "DeleteUser",
-		Tags:                []string{"users"},
-		Summary:             "Delete user",
-		Description:         "This endpoint deletes the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.DeleteUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteUser",
+			Tags:                []string{"users"},
+			Summary:             "Delete user",
+			Description:         "This endpoint deletes the user by id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetResetPasswordToken), handler.OpenAPIDef{
-		ID:                  "GetResetPasswordToken",
-		Tags:                []string{"users"},
-		Summary:             "Get reset password token for a user",
-		Description:         "This endpoint returns the existing reset password token for a user.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.ResetPasswordToken),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetResetPasswordToken, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetResetPasswordToken",
+			Tags:                []string{"users"},
+			Summary:             "Get reset password token for a user",
+			Description:         "This endpoint returns the existing reset password token for a user.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(types.ResetPasswordToken),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceFactorPassword.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceFactorPassword,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryAccessControl,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateResetPasswordToken), handler.OpenAPIDef{
-		ID:                  "CreateResetPasswordToken",
-		Tags:                []string{"users"},
-		Summary:             "Create or regenerate reset password token for a user",
-		Description:         "This endpoint creates or regenerates a reset password token for a user. If a valid token exists, it is returned. If expired, a new one is created.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.ResetPasswordToken),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateResetPasswordToken, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateResetPasswordToken",
+			Tags:                []string{"users"},
+			Summary:             "Create or regenerate reset password token for a user",
+			Description:         "This endpoint creates or regenerates a reset password token for a user. If a valid token exists, it is returned. If expired, a new one is created.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(types.ResetPasswordToken),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceFactorPassword.Scope(coretypes.VerbCreate), coretypes.ResourceUser.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceFactorPassword,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachParentChildResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryAccessControl,
+				ParentResource: coretypes.ResourceUser,
+				ParentID:       coretypes.PathParam("id"),
+				ParentSelector: coretypes.IDSelector,
+				ChildResource:  coretypes.ResourceMetaResourceFactorPassword,
+				ChildIDs:       coretypes.OneID(coretypes.PathParam("id")),
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
@@ -248,90 +342,196 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetRolesByUserID), handler.OpenAPIDef{
-		ID:                  "GetRolesByUserID",
-		Tags:                []string{"users"},
-		Summary:             "Get user roles",
-		Description:         "This endpoint returns the user roles by user id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*authtypes.Role, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetRolesByUserID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRolesByUserID",
+			Tags:                []string{"users"},
+			Summary:             "Get user roles",
+			Description:         "This endpoint returns the user roles by user id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*authtypes.Role, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/roles/{id}/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUsersByRoleID), handler.OpenAPIDef{
-		ID:                  "GetUsersByRoleID",
-		Tags:                []string{"users"},
-		Summary:             "Get users by role id",
-		Description:         "This endpoint returns the users having the role by role id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*types.User, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/roles/{id}/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUsersByRoleID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUsersByRoleID",
+			Tags:                []string{"users"},
+			Summary:             "Get users by role id",
+			Description:         "This endpoint returns the users having the role by role id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*types.User, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceRole.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceRole,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateUserRole), handler.OpenAPIDef{
-		ID:                  "CreateUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Create user role",
-		Description:         "This endpoint assigns a role to a user",
-		Request:             new(authtypes.PostableUserRole),
-		RequestContentType:  "",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Create user role",
+			Description:         "This endpoint assigns a role to a user",
+			Request:             new(authtypes.PostableUserRole),
+			RequestContentType:  "",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbAttach), coretypes.ResourceRole.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(handler.AttachDetachSiblingResourceDef{
+			Verb:           coretypes.VerbAttach,
+			Category:       coretypes.ActionCategoryAccessControl,
+			SourceResource: coretypes.ResourceUser,
+			SourceIDs:      coretypes.OneID(coretypes.BodyJSONPath("userId")),
+			SourceSelector: coretypes.IDSelector,
+			TargetResource: coretypes.ResourceRole,
+			TargetIDs:      coretypes.OneID(coretypes.BodyJSONPath("roleId")),
+			TargetSelector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUserRole), handler.OpenAPIDef{
-		ID:                  "GetUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Get user role",
-		Description:         "This endpoint gets an existing user role",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(authtypes.UserRole),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Get user role",
+			Description:         "This endpoint gets an existing user role",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(authtypes.UserRole),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       provider.userRoleUserIDExtractor(),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUserRole), handler.OpenAPIDef{
-		ID:                  "DeleteUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Delete user role",
-		Description:         "This endpoint revokes a role from a user",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.DeleteUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Delete user role",
+			Description:         "This endpoint revokes a role from a user",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbDetach), coretypes.ResourceRole.Scope(coretypes.VerbDetach)}),
+		},
+		handler.WithResourceDefs(handler.AttachDetachSiblingResourceDef{
+			Verb:           coretypes.VerbDetach,
+			Category:       coretypes.ActionCategoryAccessControl,
+			SourceResource: coretypes.ResourceUser,
+			SourceIDs:      coretypes.OneID(provider.userRoleUserIDExtractor()),
+			SourceSelector: coretypes.IDSelector,
+			TargetResource: coretypes.ResourceRole,
+			TargetIDs:      coretypes.OneID(provider.userRoleRoleIDExtractor()),
+			TargetSelector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
 	return nil
 }
+
+func (provider *provider) userRoleUserIDExtractor() coretypes.ResourceIDExtractor {
+	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
+		if ec.Request == nil {
+			return "", nil
+		}
+
+		claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
+		if err != nil {
+			return "", err
+		}
+
+		userRoleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return "", err
+		}
+
+		userRole, err := provider.userGetter.GetUserRoleByOrgIDAndID(ec.Request.Context(), valuer.MustNewUUID(claims.OrgID), userRoleID)
+		if err != nil {
+			return "", err
+		}
+
+		return userRole.UserID.String(), nil
+	})
+}
+
+func (provider *provider) userRoleRoleIDExtractor() coretypes.ResourceIDExtractor {
+	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
+		if ec.Request == nil {
+			return "", nil
+		}
+
+		claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
+		if err != nil {
+			return "", err
+		}
+
+		userRoleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return "", err
+		}
+
+		userRole, err := provider.userGetter.GetUserRoleByOrgIDAndID(ec.Request.Context(), valuer.MustNewUUID(claims.OrgID), userRoleID)
+		if err != nil {
+			return "", err
+		}
+
+		return userRole.RoleID.String(), nil
+	})
+}

pkg/http/handler/resourcedef.go

@@ -53,9 +53,20 @@ type AttachDetachSiblingResourceDef struct {
 	TargetResource coretypes.Resource
 	TargetIDs      coretypes.ResourceIDsExtractor
 	TargetSelector coretypes.SelectorFunc
+	// OptionalTargets drops the def when no target ids resolve, for routes where
+	// the target list is legitimately optional in the payload.
+	OptionalTargets bool
 }
 
 func (def AttachDetachSiblingResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
+	if def.OptionalTargets && def.TargetIDs.IsPhase(coretypes.PhaseRequest) {
+		// extractors are pure; on error fall through and let fill record it
+		ids, err := def.TargetIDs.Fn(ec)
+		if err == nil && len(ids) == 0 {
+			return nil
+		}
+	}
+
 	return []coretypes.ResolvedResource{
 		coretypes.NewResolvedResourceWithTarget(
 			def.Verb,

pkg/http/handler/resourcedef_test.go

@@ -0,0 +1,68 @@
+package handler
+
+import (
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func userRoleAttachDef(optionalTargets bool) AttachDetachSiblingResourceDef {
+	return AttachDetachSiblingResourceDef{
+		Verb:            coretypes.VerbAttach,
+		Category:        coretypes.ActionCategoryAccessControl,
+		SourceResource:  coretypes.ResourceUser,
+		SourceIDs:       coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+		SourceSelector:  coretypes.WildcardSelector,
+		TargetResource:  coretypes.NewResourceRole(),
+		TargetIDs:       coretypes.BodyJSONArray("userRoles.#.id"),
+		TargetSelector:  coretypes.WildcardSelector,
+		OptionalTargets: optionalTargets,
+	}
+}
+
+func TestAttachDetachSiblingResourceDefOptionalTargets(t *testing.T) {
+	t.Run("absent target list resolves to no checks", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"name":"jane"}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		assert.Empty(t, resolved)
+	})
+
+	t.Run("empty target list resolves to no checks", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"userRoles":[]}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		assert.Empty(t, resolved)
+	})
+
+	t.Run("present targets resolve the attach as usual", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"userRoles":[{"id":"role-a"},{"id":"role-b"}]}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		require.Len(t, resolved, 1)
+
+		withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+		require.True(t, ok)
+		assert.NoError(t, resolved[0].Err())
+		assert.Equal(t, []string{"role-a", "role-b"}, withTarget.TargetIDs())
+	})
+
+	t.Run("malformed target entry still fails closed", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"userRoles":[{"id":""}]}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		require.Len(t, resolved, 1)
+
+		withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+		require.True(t, ok)
+		assert.Equal(t, []string{""}, withTarget.TargetIDs())
+	})
+
+	t.Run("without the flag the empty-id contract is preserved", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: []byte(`{"name":"jane"}`)}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(false)}, ec)
+		require.Len(t, resolved, 1)
+
+		withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+		require.True(t, ok)
+		assert.Equal(t, []string{""}, withTarget.TargetIDs())
+	})
+}

pkg/modules/organization/implorganization/setter.go

@@ -7,7 +7,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/dashboard"
 	"github.com/SigNoz/signoz/pkg/modules/organization"
 	"github.com/SigNoz/signoz/pkg/modules/quickfilter"
-	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
@@ -17,11 +16,10 @@ type setter struct {
 	alertmanager alertmanager.Alertmanager
 	quickfilter  quickfilter.Module
 	dashboard    dashboard.Module
-	spanMapper   spanmapper.Module
 }
 
-func NewSetter(store types.OrganizationStore, alertmanager alertmanager.Alertmanager, quickfilter quickfilter.Module, dashboard dashboard.Module, spanMapper spanmapper.Module) organization.Setter {
-	return &setter{store: store, alertmanager: alertmanager, quickfilter: quickfilter, dashboard: dashboard, spanMapper: spanMapper}
+func NewSetter(store types.OrganizationStore, alertmanager alertmanager.Alertmanager, quickfilter quickfilter.Module, dashboard dashboard.Module) organization.Setter {
+	return &setter{store: store, alertmanager: alertmanager, quickfilter: quickfilter, dashboard: dashboard}
 }
 
 func (module *setter) Create(ctx context.Context, organization *types.Organization, createManagedRoles func(context.Context, valuer.UUID) error) error {
@@ -45,10 +43,6 @@ func (module *setter) Create(ctx context.Context, organization *types.Organizati
 		return err
 	}
 
-	if err := module.spanMapper.ReconcileSystemGroups(ctx, organization.ID); err != nil {
-		return err
-	}
-
 	return nil
 }
 

pkg/modules/spanmapper/implspanmapper/definitions.go

@@ -1,46 +0,0 @@
-package implspanmapper
-
-import (
-	"embed"
-	"io/fs"
-	"path"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/types/spantypes"
-)
-
-const definitionsRoot = "fs/definitions"
-
-//go:embed fs/definitions/*.json
-var definitionFiles embed.FS
-
-// NewSystemGroupRegistry parses every embedded definition. Definitions are
-// build-time assets validated by a test, so a failure here means the binary
-// shipped broken JSON.
-func NewSystemGroupRegistry() (spantypes.SpanMapperGroupRegistry, error) {
-	entries, err := fs.ReadDir(definitionFiles, definitionsRoot)
-	if err != nil {
-		return spantypes.SpanMapperGroupRegistry{}, errors.WrapInternalf(err, errors.CodeInternal, "couldn't read span mapper group definitions")
-	}
-
-	definitions := make([]spantypes.SpanMapperGroupDefinition, 0, len(entries))
-	for _, entry := range entries {
-		if entry.IsDir() {
-			continue
-		}
-
-		file := path.Join(definitionsRoot, entry.Name())
-		raw, err := definitionFiles.ReadFile(file)
-		if err != nil {
-			return spantypes.SpanMapperGroupRegistry{}, errors.WrapInternalf(err, errors.CodeInternal, "couldn't read %s", file)
-		}
-
-		definition, err := spantypes.NewSpanMapperGroupDefinition(raw)
-		if err != nil {
-			return spantypes.SpanMapperGroupRegistry{}, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "couldn't parse %s", file)
-		}
-		definitions = append(definitions, definition)
-	}
-
-	return spantypes.NewSpanMapperGroupRegistry(definitions)
-}

pkg/modules/spanmapper/implspanmapper/fs/definitions/agent.json

@@ -1,79 +0,0 @@
-{
-  "version": 1,
-  "definition": {
-    "name": "agent",
-    "condition": {
-      "attributes": [
-        {
-          "value": "agent"
-        }
-      ],
-      "resource": []
-    },
-    "enabled": true,
-    "mappers": [
-      {
-        "name": "gen_ai.agent.name",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "agent.name",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "agent_name",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.agent.id",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "agent.id",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.agent.description",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "agent.description",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.output.messages",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "final_result",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      }
-    ]
-  }
-}

pkg/modules/spanmapper/implspanmapper/fs/definitions/llm.json

@@ -1,347 +0,0 @@
-{
-  "version": 1,
-  "definition": {
-    "name": "llm",
-    "condition": {
-      "attributes": [
-        {
-          "value": "model"
-        }
-      ],
-      "resource": []
-    },
-    "enabled": true,
-    "mappers": [
-      {
-        "name": "gen_ai.request.model",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "llm.model_name",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 60
-            },
-            {
-              "key": "llm.request.model",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 50
-            },
-            {
-              "key": "ai.model.id",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 40
-            },
-            {
-              "key": "langfuse.observation.model.name",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "embedding.model_name",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "model",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.response.model",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "llm.response.model",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "ai.response.model",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.provider.name",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "gen_ai.system",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 50
-            },
-            {
-              "key": "llm.vendor",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 40
-            },
-            {
-              "key": "llm.provider",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "llm.system",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "ai.model.provider",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.operation.name",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "llm.request.type",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.usage.input_tokens",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "gen_ai.usage.prompt_tokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 50
-            },
-            {
-              "key": "llm.usage.prompt_tokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 40
-            },
-            {
-              "key": "llm.token_count.prompt",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "ai.usage.inputTokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "ai.usage.promptTokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.usage.output_tokens",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "gen_ai.usage.completion_tokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 50
-            },
-            {
-              "key": "llm.usage.completion_tokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 40
-            },
-            {
-              "key": "llm.token_count.completion",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "ai.usage.outputTokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "ai.usage.completionTokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.usage.cache_read.input_tokens",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "gen_ai.usage.cache_read_input_tokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "llm.token_count.prompt_details.cache_read",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "ai.usage.cachedInputTokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.usage.cache_creation.input_tokens",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "gen_ai.usage.cache_write.input_tokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "gen_ai.usage.cache_creation_input_tokens",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "llm.token_count.prompt_details.cache_write",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.input.messages",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "gen_ai.prompt",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "ai.prompt.messages",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "input.value",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.output.messages",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "gen_ai.completion",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "ai.response.text",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "output.value",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.conversation.id",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "session.id",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "langfuse.session.id",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.response.finish_reason",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "ai.response.finishReason",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      }
-    ]
-  }
-}

pkg/modules/spanmapper/implspanmapper/fs/definitions/tool.json

@@ -1,135 +0,0 @@
-{
-  "version": 1,
-  "definition": {
-    "name": "tool",
-    "condition": {
-      "attributes": [
-        {
-          "value": "tool"
-        }
-      ],
-      "resource": []
-    },
-    "enabled": true,
-    "mappers": [
-      {
-        "name": "gen_ai.tool.name",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "tool.name",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "ai.toolCall.name",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.tool.call.id",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "tool.id",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "ai.toolCall.id",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.tool.description",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "tool.description",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.tool.call.arguments",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "ai.toolCall.args",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 40
-            },
-            {
-              "key": "traceloop.entity.input",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "gcp.vertex.agent.tool_call_args",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "input.value",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      },
-      {
-        "name": "gen_ai.tool.call.result",
-        "fieldContext": "attribute",
-        "config": {
-          "sources": [
-            {
-              "key": "ai.toolCall.result",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 40
-            },
-            {
-              "key": "traceloop.entity.output",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 30
-            },
-            {
-              "key": "gcp.vertex.agent.tool_response",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 20
-            },
-            {
-              "key": "output.value",
-              "context": "attribute",
-              "operation": "copy",
-              "priority": 10
-            }
-          ]
-        }
-      }
-    ]
-  }
-}

pkg/modules/spanmapper/implspanmapper/handler.go

@@ -69,10 +69,6 @@ func (h *handler) CreateGroup(rw http.ResponseWriter, r *http.Request) {
 		render.Error(rw, err)
 		return
 	}
-	if err := req.Validate(); err != nil {
-		render.Error(rw, err)
-		return
-	}
 
 	group := spantypes.NewSpanMapperGroup(orgID, claims.Email, req)
 
@@ -195,10 +191,6 @@ func (h *handler) CreateMapper(rw http.ResponseWriter, r *http.Request) {
 		render.Error(rw, err)
 		return
 	}
-	if err := req.Validate(); err != nil {
-		render.Error(rw, err)
-		return
-	}
 	mapper := spantypes.NewSpanMapper(groupID, claims.Email, req)
 
 	if err := h.module.CreateMapper(ctx, orgID, groupID, mapper); err != nil {

pkg/modules/spanmapper/implspanmapper/module.go

@@ -5,7 +5,6 @@ import (
 	"encoding/json"
 
 	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/flagger"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
 	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
@@ -15,24 +14,13 @@ import (
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
-// maxTestSpans bounds the input size: every test request boots a full
-// in-memory collector pipeline and is reachable with viewer access.
-const maxTestSpans = 100
-
 type module struct {
-	store    spantypes.SpanMapperStore
-	flagger  flagger.Flagger
-	registry spantypes.SpanMapperGroupRegistry
-	settings factory.ScopedProviderSettings
+	store   spantypes.SpanMapperStore
+	flagger flagger.Flagger
 }
 
-func NewModule(store spantypes.SpanMapperStore, flagger flagger.Flagger, registry spantypes.SpanMapperGroupRegistry, providerSettings factory.ProviderSettings) spanmapper.Module {
-	return &module{
-		store:    store,
-		flagger:  flagger,
-		registry: registry,
-		settings: factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"),
-	}
+func NewModule(store spantypes.SpanMapperStore, flagger flagger.Flagger) spanmapper.Module {
+	return &module{store: store, flagger: flagger}
 }
 
 func (module *module) ListGroups(ctx context.Context, orgID valuer.UUID, q *spantypes.ListSpanMapperGroupsQuery) ([]*spantypes.SpanMapperGroup, error) {
@@ -44,9 +32,6 @@ func (module *module) GetGroup(ctx context.Context, orgID, id valuer.UUID) (*spa
 }
 
 func (module *module) CreateGroup(ctx context.Context, orgID valuer.UUID, group *spantypes.SpanMapperGroup) error {
-	if module.registry.IsReserved(group.Name) {
-		return errors.Newf(errors.TypeInvalidInput, spantypes.ErrCodeMappingGroupNameReserved, "group name %q is reserved for a default group", group.Name)
-	}
 	return module.store.CreateGroup(ctx, group)
 }
 
@@ -55,14 +40,10 @@ func (module *module) UpdateGroup(ctx context.Context, orgID, id valuer.UUID, na
 	if err != nil {
 		return err
 	}
-	if name != nil && *name != group.Name && module.registry.IsReserved(*name) {
-		return errors.Newf(errors.TypeInvalidInput, spantypes.ErrCodeMappingGroupNameReserved, "group name %q is reserved for a default group", *name)
-	}
-	if err := group.Update(name, condition, enabled, updatedBy); err != nil {
-		return err
-	}
+	group.Update(name, condition, enabled, updatedBy)
 
-	if err := module.store.UpdateGroup(ctx, group); err != nil {
+	err = module.store.UpdateGroup(ctx, group)
+	if err != nil {
 		return err
 	}
 	agentConf.NotifyConfigUpdate(ctx)
@@ -70,16 +51,10 @@ func (module *module) UpdateGroup(ctx context.Context, orgID, id valuer.UUID, na
 }
 
 func (module *module) DeleteGroup(ctx context.Context, orgID, id valuer.UUID) error {
-	group, err := module.store.GetGroup(ctx, orgID, id)
+	err := module.store.DeleteGroup(ctx, orgID, id)
 	if err != nil {
 		return err
 	}
-	if err := group.ErrIfNotDeletable(); err != nil {
-		return err
-	}
-	if err := module.store.DeleteGroup(ctx, orgID, id); err != nil {
-		return err
-	}
 	agentConf.NotifyConfigUpdate(ctx)
 	return nil
 }
@@ -106,13 +81,14 @@ func (module *module) CreateMapper(ctx context.Context, orgID, groupID valuer.UU
 }
 
 func (module *module) UpdateMapper(ctx context.Context, orgID, groupID, id valuer.UUID, fieldContext spantypes.FieldContext, config *spantypes.SpanMapperConfig, enabled *bool, updatedBy string) error {
+	if _, err := module.store.GetGroup(ctx, orgID, groupID); err != nil {
+		return err
+	}
 	mapper, err := module.store.GetMapper(ctx, orgID, groupID, id)
 	if err != nil {
 		return err
 	}
-	if err := mapper.Update(fieldContext, config, enabled, updatedBy); err != nil {
-		return err
-	}
+	mapper.Update(fieldContext, config, enabled, updatedBy)
 	err = module.store.UpdateMapper(ctx, mapper)
 	if err != nil {
 		return err
@@ -122,14 +98,7 @@ func (module *module) UpdateMapper(ctx context.Context, orgID, groupID, id value
 }
 
 func (module *module) DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID) error {
-	mapper, err := module.store.GetMapper(ctx, orgID, groupID, id)
-	if err != nil {
-		return err
-	}
-	if err := mapper.ErrIfNotDeletable(); err != nil {
-		return err
-	}
-	err = module.store.DeleteMapper(ctx, orgID, groupID, id)
+	err := module.store.DeleteMapper(ctx, orgID, groupID, id)
 	if err != nil {
 		return err
 	}
@@ -137,6 +106,10 @@ func (module *module) DeleteMapper(ctx context.Context, orgID, groupID, id value
 	return nil
 }
 
+// maxTestSpans bounds the input size: every test request boots a full
+// in-memory collector pipeline and is reachable with viewer access.
+const maxTestSpans = 100
+
 func (module *module) TestMappers(ctx context.Context, orgID valuer.UUID, spans []spantypes.SpanMapperTestSpan, groups []*spantypes.SpanMapperGroupWithMappers) ([]spantypes.SpanMapperTestSpan, []string, error) {
 	if len(spans) == 0 {
 		return nil, nil, errors.New(errors.TypeInvalidInput, spantypes.ErrCodeMappingInvalidInput, "'spans' must contain at least one span")
@@ -157,6 +130,37 @@ func (module *module) TestMappers(ctx context.Context, orgID valuer.UUID, spans
 	return out, collectorLogs, nil
 }
 
+// backfillMappers loads saved mappers for any enabled group whose Mappers is
+// nil. Disabled groups are skipped: the simulation filters them out anyway,
+// so there is no point loading their mappers or failing on their names.
+func (module *module) backfillMappers(ctx context.Context, orgID valuer.UUID, groups []*spantypes.SpanMapperGroupWithMappers) ([]*spantypes.SpanMapperGroupWithMappers, error) {
+	savedGroups, err := module.store.ListGroups(ctx, orgID, nil)
+	if err != nil {
+		return nil, err
+	}
+	savedByName := make(map[string]*spantypes.SpanMapperGroup, len(savedGroups))
+	for _, g := range savedGroups {
+		savedByName[g.Name] = g
+	}
+
+	// For each group in the request, if Mappers is nil, load the saved mappers for that group name.
+	for _, g := range groups {
+		if g.Mappers != nil || !g.Group.Enabled {
+			continue
+		}
+		saved, ok := savedByName[g.Group.Name]
+		if !ok {
+			return nil, errors.Newf(errors.TypeNotFound, spantypes.ErrCodeMappingGroupNotFound, "no saved group named %q to load mappers from; send 'mappers' for new or edited groups", g.Group.Name)
+		}
+		loaded, err := module.store.ListMappers(ctx, orgID, saved.ID)
+		if err != nil {
+			return nil, err
+		}
+		g.Mappers = loaded
+	}
+	return groups, nil
+}
+
 func (module *module) AgentFeatureType() agentConf.AgentFeatureType {
 	return spantypes.SpanAttrMappingFeatureType
 }
@@ -192,37 +196,6 @@ func (module *module) RecommendAgentConfig(orgID valuer.UUID, currentConfYaml []
 	return updatedConf, string(serialized), nil
 }
 
-// backfillMappers loads saved mappers for any enabled group whose Mappers is
-// nil. Disabled groups are skipped: the simulation filters them out anyway,
-// so there is no point loading their mappers or failing on their names.
-func (module *module) backfillMappers(ctx context.Context, orgID valuer.UUID, groups []*spantypes.SpanMapperGroupWithMappers) ([]*spantypes.SpanMapperGroupWithMappers, error) {
-	savedGroups, err := module.store.ListGroups(ctx, orgID, nil)
-	if err != nil {
-		return nil, err
-	}
-	savedByName := make(map[string]*spantypes.SpanMapperGroup, len(savedGroups))
-	for _, g := range savedGroups {
-		savedByName[g.Name] = g
-	}
-
-	// For each group in the request, if Mappers is nil, load the saved mappers for that group name.
-	for _, g := range groups {
-		if g.Mappers != nil || !g.Group.Enabled {
-			continue
-		}
-		saved, ok := savedByName[g.Group.Name]
-		if !ok {
-			return nil, errors.Newf(errors.TypeNotFound, spantypes.ErrCodeMappingGroupNotFound, "no saved group named %q to load mappers from; send 'mappers' for new or edited groups", g.Group.Name)
-		}
-		loaded, err := module.store.ListMappers(ctx, orgID, saved.ID)
-		if err != nil {
-			return nil, err
-		}
-		g.Mappers = loaded
-	}
-	return groups, nil
-}
-
 // listEnabledGroupsWithMappers returns groups with their mappers.
 func (module *module) listEnabledGroupsWithMappers(ctx context.Context, orgID valuer.UUID) ([]*spantypes.SpanMapperGroupWithMappers, error) {
 	enabled := true

pkg/modules/spanmapper/implspanmapper/module_test.go

@@ -1,228 +0,0 @@
-package implspanmapper
-
-import (
-	"context"
-	"path/filepath"
-	"strconv"
-	"testing"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory/factorytest"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/sqlstore/sqlitesqlstore"
-	"github.com/SigNoz/signoz/pkg/types/spantypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const testUser = "user@signoz.io"
-
-func newTestSQLStore(t *testing.T) sqlstore.SQLStore {
-	t.Helper()
-
-	store, err := sqlitesqlstore.New(context.Background(), factorytest.NewSettings(), sqlstore.Config{
-		Provider:   "sqlite",
-		Connection: sqlstore.ConnectionConfig{MaxOpenConns: 10},
-		Sqlite: sqlstore.SqliteConfig{
-			Path:            filepath.Join(t.TempDir(), "test.db"),
-			Mode:            "wal",
-			BusyTimeout:     5 * time.Second,
-			TransactionMode: "deferred",
-		},
-	})
-	require.NoError(t, err)
-
-	for _, model := range []any{
-		(*spantypes.StorableSpanMapperGroup)(nil),
-		(*spantypes.StorableSpanMapper)(nil),
-	} {
-		_, err := store.BunDB().NewCreateTable().Model(model).IfNotExists().Exec(context.Background())
-		require.NoError(t, err)
-	}
-
-	_, err = store.BunDB().Exec(`CREATE UNIQUE INDEX IF NOT EXISTS uq_span_mapper_group_org_name ON span_mapper_group (org_id, name)`)
-	require.NoError(t, err)
-	_, err = store.BunDB().Exec(`CREATE UNIQUE INDEX IF NOT EXISTS uq_span_mapper_group_name ON span_mapper (group_id, name)`)
-	require.NoError(t, err)
-
-	return store
-}
-
-func newTestModule(t *testing.T, sqlStore sqlstore.SQLStore, definitions ...spantypes.SpanMapperGroupDefinition) *module {
-	t.Helper()
-
-	registry, err := spantypes.NewSpanMapperGroupRegistry(definitions)
-	require.NoError(t, err)
-
-	return NewModule(NewStore(sqlStore), nil, registry, factorytest.NewSettings()).(*module)
-}
-
-func newTestDefinition(t *testing.T, version int, body string) spantypes.SpanMapperGroupDefinition {
-	t.Helper()
-
-	definition, err := spantypes.NewSpanMapperGroupDefinition([]byte(`{"version": ` + strconv.Itoa(version) + `, "definition": ` + body + `}`))
-	require.NoError(t, err)
-
-	return definition
-}
-
-// llmV1 ships two mappers; llmV2 renames a source, adds a mapper and drops one.
-const llmV1 = `{
-	"name": "llm",
-	"condition": {"attributes": [{"value": "model"}], "resource": []},
-	"enabled": true,
-	"mappers": [
-		{"name": "gen_ai.request.model", "fieldContext": "attribute", "config": {"sources": [
-			{"key": "llm.model_name", "context": "attribute", "operation": "copy", "priority": 20},
-			{"key": "ai.model.id", "context": "attribute", "operation": "copy", "priority": 10}
-		]}},
-		{"name": "gen_ai.input.messages", "fieldContext": "attribute", "config": {"sources": [
-			{"key": "gen_ai.prompt", "context": "attribute", "operation": "copy", "priority": 10}
-		]}}
-	]
-}`
-
-const llmV2 = `{
-	"name": "llm",
-	"condition": {"attributes": [{"value": "model"}, {"value": "llm."}], "resource": []},
-	"enabled": true,
-	"mappers": [
-		{"name": "gen_ai.request.model", "fieldContext": "attribute", "config": {"sources": [
-			{"key": "llm.model_name", "context": "attribute", "operation": "copy", "priority": 20},
-			{"key": "langfuse.observation.model.name", "context": "attribute", "operation": "copy", "priority": 10}
-		]}},
-		{"name": "gen_ai.provider.name", "fieldContext": "attribute", "config": {"sources": [
-			{"key": "llm.vendor", "context": "attribute", "operation": "copy", "priority": 10}
-		]}}
-	]
-}`
-
-func findMapper(t *testing.T, mappers []*spantypes.SpanMapper, name string) *spantypes.SpanMapper {
-	t.Helper()
-	for _, m := range mappers {
-		if m.Name == name {
-			return m
-		}
-	}
-	require.Failf(t, "mapper not found", "no mapper named %q", name)
-	return nil
-}
-
-func findSource(t *testing.T, sources []spantypes.SpanMapperSource, key string, origin spantypes.SpanMapperOrigin) spantypes.SpanMapperSource {
-	t.Helper()
-	for _, s := range sources {
-		if s.Key == key && s.Origin == origin {
-			return s
-		}
-	}
-	require.Failf(t, "source not found", "no %s source with key %q", origin.StringValue(), key)
-	return spantypes.SpanMapperSource{}
-}
-
-func TestReconcileUpgradeKeepsTogglesAndUserItems(t *testing.T) {
-	ctx := context.Background()
-	orgID := valuer.GenerateUUID()
-	sqlStore := newTestSQLStore(t)
-	v1 := newTestModule(t, sqlStore, newTestDefinition(t, 1, llmV1))
-	require.NoError(t, v1.ReconcileSystemGroups(ctx, orgID))
-
-	group, err := v1.store.GetGroupByName(ctx, orgID, "llm")
-	require.NoError(t, err)
-	mappers, err := v1.ListMappers(ctx, orgID, group.ID)
-	require.NoError(t, err)
-
-	// Switch the shipped substring off and add a user one.
-	off := false
-	require.NoError(t, v1.UpdateGroup(ctx, orgID, group.ID, nil, &spantypes.SpanMapperGroupCondition{
-		Attributes: []spantypes.SpanMapperGroupConditionKey{
-			{Value: "model", Enabled: false, Origin: spantypes.SpanMapperOriginSystem},
-			{Value: "gen_ai.request.model", Enabled: true, Origin: spantypes.SpanMapperOriginUser},
-		},
-		Resource: []spantypes.SpanMapperGroupConditionKey{},
-	}, &off, testUser))
-
-	// Switch a shipped source off, add a user override, and switch the mapper off.
-	model := findMapper(t, mappers, "gen_ai.request.model")
-	require.NoError(t, v1.UpdateMapper(ctx, orgID, group.ID, model.ID, spantypes.FieldContext{}, &spantypes.SpanMapperConfig{Sources: []spantypes.SpanMapperSource{
-		{Key: "llm.model_name", Context: spantypes.FieldContextSpanAttribute, Operation: spantypes.SpanMapperOperationCopy, Priority: 20, Enabled: false, Origin: spantypes.SpanMapperOriginSystem},
-		{Key: "llm.model_name", Context: spantypes.FieldContextSpanAttribute, Operation: spantypes.SpanMapperOperationMove, Priority: 1, Enabled: true, Origin: spantypes.SpanMapperOriginUser},
-	}}, &off, testUser))
-
-	// Add a user source to the mapper v2 stops shipping, so it must survive.
-	messages := findMapper(t, mappers, "gen_ai.input.messages")
-	require.NoError(t, v1.UpdateMapper(ctx, orgID, group.ID, messages.ID, spantypes.FieldContext{}, &spantypes.SpanMapperConfig{Sources: []spantypes.SpanMapperSource{
-		{Key: "input.value", Context: spantypes.FieldContextSpanAttribute, Operation: spantypes.SpanMapperOperationCopy, Priority: 1, Enabled: true},
-	}}, nil, testUser))
-
-	// A user mapper in the shipped group.
-	require.NoError(t, v1.CreateMapper(ctx, orgID, group.ID, spantypes.NewSpanMapper(group.ID, testUser, &spantypes.PostableSpanMapper{
-		Name: "gen_ai.custom", FieldContext: spantypes.FieldContextSpanAttribute, Enabled: true,
-		Config: spantypes.SpanMapperConfig{Sources: []spantypes.SpanMapperSource{{Key: "custom", Context: spantypes.FieldContextSpanAttribute, Operation: spantypes.SpanMapperOperationCopy, Priority: 1, Enabled: true}}},
-	})))
-
-	v2 := newTestModule(t, sqlStore, newTestDefinition(t, 2, llmV2))
-	require.NoError(t, v2.ReconcileSystemGroups(ctx, orgID))
-
-	upgraded, err := v2.GetGroup(ctx, orgID, group.ID)
-	require.NoError(t, err)
-	assert.Equal(t, 2, upgraded.Version)
-	assert.False(t, upgraded.Enabled)
-	assert.Equal(t, spantypes.ProvisionerIdentity, upgraded.UpdatedBy)
-	assert.Equal(t, []spantypes.SpanMapperGroupConditionKey{
-		{Value: "model", Enabled: false, Origin: spantypes.SpanMapperOriginSystem},
-		{Value: "llm.", Enabled: true, Origin: spantypes.SpanMapperOriginSystem},
-		{Value: "gen_ai.request.model", Enabled: true, Origin: spantypes.SpanMapperOriginUser},
-	}, upgraded.Condition.Attributes)
-
-	mappers, err = v2.ListMappers(ctx, orgID, group.ID)
-	require.NoError(t, err)
-	require.Len(t, mappers, 4)
-
-	model = findMapper(t, mappers, "gen_ai.request.model")
-	assert.False(t, model.Enabled)
-	assert.Equal(t, spantypes.SpanMapperOriginSystem, model.Origin)
-	assert.False(t, findSource(t, model.Config.Sources, "llm.model_name", spantypes.SpanMapperOriginSystem).Enabled)
-	assert.True(t, findSource(t, model.Config.Sources, "langfuse.observation.model.name", spantypes.SpanMapperOriginSystem).Enabled)
-	assert.Equal(t, spantypes.SpanMapperOperationMove, findSource(t, model.Config.Sources, "llm.model_name", spantypes.SpanMapperOriginUser).Operation)
-	assert.Len(t, model.Config.Sources, 3)
-
-	messages = findMapper(t, mappers, "gen_ai.input.messages")
-	assert.Equal(t, spantypes.SpanMapperOriginUser, messages.Origin)
-	require.Len(t, messages.Config.Sources, 1)
-	assert.Equal(t, "input.value", messages.Config.Sources[0].Key)
-
-	assert.Equal(t, spantypes.SpanMapperOriginSystem, findMapper(t, mappers, "gen_ai.provider.name").Origin)
-	assert.Equal(t, spantypes.SpanMapperOriginUser, findMapper(t, mappers, "gen_ai.custom").Origin)
-
-	// Shipping v1 again drops provider.name outright (no user sources) and
-	// re-adopts the surviving user mapper input.messages as a shipped one.
-	v3 := newTestModule(t, sqlStore, newTestDefinition(t, 3, llmV1))
-	require.NoError(t, v3.ReconcileSystemGroups(ctx, orgID))
-	mappers, err = v3.ListMappers(ctx, orgID, group.ID)
-	require.NoError(t, err)
-	require.Len(t, mappers, 3)
-	for _, m := range mappers {
-		assert.NotEqual(t, "gen_ai.provider.name", m.Name)
-	}
-	messages = findMapper(t, mappers, "gen_ai.input.messages")
-	assert.Equal(t, spantypes.SpanMapperOriginSystem, messages.Origin)
-	assert.Len(t, messages.Config.Sources, 2)
-}
-
-func TestReconcileDoesNotDowngrade(t *testing.T) {
-	ctx := context.Background()
-	orgID := valuer.GenerateUUID()
-	sqlStore := newTestSQLStore(t)
-
-	require.NoError(t, newTestModule(t, sqlStore, newTestDefinition(t, 2, llmV2)).ReconcileSystemGroups(ctx, orgID))
-	older := newTestModule(t, sqlStore, newTestDefinition(t, 1, llmV1))
-	require.NoError(t, older.ReconcileSystemGroups(ctx, orgID))
-
-	group, err := older.store.GetGroupByName(ctx, orgID, "llm")
-	require.NoError(t, err)
-	assert.Equal(t, 2, group.Version)
-	mappers, err := older.ListMappers(ctx, orgID, group.ID)
-	require.NoError(t, err)
-	findMapper(t, mappers, "gen_ai.provider.name")
-}

pkg/modules/spanmapper/implspanmapper/reconcile.go

@@ -1,187 +0,0 @@
-package implspanmapper
-
-import (
-	"context"
-	"log/slog"
-	"slices"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/query-service/agentConf"
-	"github.com/SigNoz/signoz/pkg/types/spantypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
-
-func (module *module) ReconcileSystemGroups(ctx context.Context, orgID valuer.UUID) error {
-	for _, definition := range module.registry.List() {
-		if err := module.reconcileSystemGroup(ctx, orgID, definition); err != nil {
-			return err
-		}
-	}
-	agentConf.NotifyConfigUpdate(ctx)
-	return nil
-}
-
-// reconcileSystemGroup brings one org's copy of a definition to the shipped
-// version in a single transaction. A concurrent provisioner (another replica,
-// or the org-creation hook racing the startup sweep) loses on the group's
-// unique (org_id, name) index and is treated as a no-op.
-func (module *module) reconcileSystemGroup(ctx context.Context, orgID valuer.UUID, definition spantypes.SpanMapperGroupDefinition) error {
-	err := module.store.RunInTx(ctx, func(ctx context.Context) error {
-		group, err := module.store.GetGroupByName(ctx, orgID, definition.Name())
-		if err != nil && errors.Ast(err, errors.TypeNotFound) {
-			group = newSystemGroup(orgID, definition)
-			err = module.store.CreateGroup(ctx, group)
-		}
-		if err != nil {
-			return err
-		}
-
-		if group.Origin != spantypes.SpanMapperOriginSystem {
-			module.settings.Logger().WarnContext(ctx, "skipping default span mapper group: a user group holds its name", slog.String("name", definition.Name()), slog.String("org_id", orgID.StringValue()))
-			return nil
-		}
-		if group.Version >= definition.Version {
-			return nil
-		}
-		return module.applyDefinition(ctx, orgID, group, definition)
-	})
-	if err != nil && errors.Ast(err, errors.TypeAlreadyExists) {
-		module.settings.Logger().DebugContext(ctx, "default span mapper group provisioned concurrently", slog.String("name", definition.Name()), slog.String("org_id", orgID.StringValue()))
-		return nil
-	}
-	return err
-}
-
-// applyDefinition replaces every shipped item with the definition, carrying each
-// enabled flag over by identity, and leaves user items untouched. A mapper that
-// is no longer shipped is deleted unless the user added sources to it, in which
-// case it survives as a user mapper.
-func (module *module) applyDefinition(ctx context.Context, orgID valuer.UUID, group *spantypes.SpanMapperGroup, definition spantypes.SpanMapperGroupDefinition) error {
-	mappers, err := module.store.ListMappers(ctx, orgID, group.ID)
-	if err != nil {
-		return err
-	}
-	byName := make(map[string]*spantypes.SpanMapper, len(mappers))
-	for _, m := range mappers {
-		byName[m.Name] = m
-	}
-
-	now := time.Now()
-	for i := range definition.Definition.Mappers {
-		pm := &definition.Definition.Mappers[i]
-		mapper, exists := byName[pm.Name]
-		delete(byName, pm.Name)
-		if !exists {
-			if err := module.store.CreateMapper(ctx, newSystemMapper(group.ID, pm)); err != nil {
-				return err
-			}
-			continue
-		}
-		mapper.Config.Sources = mergeShippedSources(mapper.Config.Sources, pm.Config.Sources)
-		mapper.FieldContext = pm.FieldContext
-		mapper.Origin = spantypes.SpanMapperOriginSystem
-		mapper.UpdatedAt = now
-		mapper.UpdatedBy = spantypes.ProvisionerIdentity
-		if err := module.store.UpdateMapper(ctx, mapper); err != nil {
-			return err
-		}
-	}
-
-	// Whatever is left in byName is not shipped any more.
-	for _, mapper := range byName {
-		if mapper.Origin != spantypes.SpanMapperOriginSystem {
-			continue
-		}
-		mapper.Config.Sources = mergeShippedSources(mapper.Config.Sources, nil)
-		if len(mapper.Config.Sources) == 0 {
-			if err := module.store.DeleteMapper(ctx, orgID, group.ID, mapper.ID); err != nil {
-				return err
-			}
-			continue
-		}
-		mapper.Origin = spantypes.SpanMapperOriginUser
-		mapper.UpdatedAt = now
-		mapper.UpdatedBy = spantypes.ProvisionerIdentity
-		if err := module.store.UpdateMapper(ctx, mapper); err != nil {
-			return err
-		}
-	}
-
-	shipped := definition.Definition.Condition
-	group.Condition = spantypes.SpanMapperGroupCondition{
-		Attributes: mergeShippedConditionKeys(group.Condition.Attributes, shipped.Attributes),
-		Resource:   mergeShippedConditionKeys(group.Condition.Resource, shipped.Resource),
-	}
-	group.Version = definition.Version
-	group.UpdatedAt = now
-	group.UpdatedBy = spantypes.ProvisionerIdentity
-	if err := module.store.UpdateGroup(ctx, group); err != nil {
-		return err
-	}
-
-	module.settings.Logger().InfoContext(ctx, "applied default span mapper group", slog.String("name", definition.Name()), slog.Int("version", definition.Version), slog.String("org_id", orgID.StringValue()))
-	return nil
-}
-
-// newSystemGroup is the empty shell applyDefinition fills: version 0 so the
-// definition is applied right after the row exists.
-func newSystemGroup(orgID valuer.UUID, definition spantypes.SpanMapperGroupDefinition) *spantypes.SpanMapperGroup {
-	group := spantypes.NewSpanMapperGroup(orgID, spantypes.ProvisionerIdentity, &definition.Definition.PostableSpanMapperGroup)
-	group.Condition = definition.Definition.Condition
-	group.Enabled = true
-	group.Origin = spantypes.SpanMapperOriginSystem
-	return group
-}
-
-func newSystemMapper(groupID valuer.UUID, pm *spantypes.PostableSpanMapper) *spantypes.SpanMapper {
-	mapper := spantypes.NewSpanMapper(groupID, spantypes.ProvisionerIdentity, pm)
-	mapper.Config = pm.Config
-	mapper.Enabled = true
-	mapper.Origin = spantypes.SpanMapperOriginSystem
-	return mapper
-}
-
-// mergeShippedConditionKeys returns the shipped keys, each keeping the enabled
-// flag of the stored system key with the same value, followed by the stored
-// user keys.
-func mergeShippedConditionKeys(stored, shipped []spantypes.SpanMapperGroupConditionKey) []spantypes.SpanMapperGroupConditionKey {
-	out := make([]spantypes.SpanMapperGroupConditionKey, 0, len(stored)+len(shipped))
-	for _, k := range shipped {
-		idx := slices.IndexFunc(stored, func(s spantypes.SpanMapperGroupConditionKey) bool {
-			return s.Origin == spantypes.SpanMapperOriginSystem && s.Value == k.Value
-		})
-		if idx != -1 {
-			k.Enabled = stored[idx].Enabled
-		}
-		out = append(out, k)
-	}
-	for _, k := range stored {
-		if k.Origin != spantypes.SpanMapperOriginSystem {
-			out = append(out, k)
-		}
-	}
-	return out
-}
-
-// mergeShippedSources returns the shipped sources, each keeping the enabled
-// flag of the stored system source with the same key and context, followed by
-// the stored user sources.
-func mergeShippedSources(stored, shipped []spantypes.SpanMapperSource) []spantypes.SpanMapperSource {
-	out := make([]spantypes.SpanMapperSource, 0, len(stored)+len(shipped))
-	for _, s := range shipped {
-		idx := slices.IndexFunc(stored, func(o spantypes.SpanMapperSource) bool {
-			return o.Origin == spantypes.SpanMapperOriginSystem && o.Key == s.Key && o.Context == s.Context
-		})
-		if idx != -1 {
-			s.Enabled = stored[idx].Enabled
-		}
-		out = append(out, s)
-	}
-	for _, s := range stored {
-		if s.Origin != spantypes.SpanMapperOriginSystem {
-			out = append(out, s)
-		}
-	}
-	return out
-}

pkg/modules/spanmapper/implspanmapper/service.go

@@ -1,81 +0,0 @@
-package implspanmapper
-
-import (
-	"context"
-	"log/slog"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/modules/organization"
-	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
-)
-
-const reconcileRetryInterval = 30 * time.Second
-
-type service struct {
-	settings  factory.ScopedProviderSettings
-	module    spanmapper.Module
-	orgGetter organization.Getter
-	stopC     chan struct{}
-	healthyC  chan struct{}
-}
-
-// NewService reconciles every org's default mapping groups once at startup.
-// Orgs created later are reconciled by the organization setter instead.
-func NewService(providerSettings factory.ProviderSettings, module spanmapper.Module, orgGetter organization.Getter) factory.Service {
-	return &service{
-		settings:  factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"),
-		module:    module,
-		orgGetter: orgGetter,
-		stopC:     make(chan struct{}),
-		healthyC:  make(chan struct{}),
-	}
-}
-
-func (service *service) Start(ctx context.Context) error {
-	ticker := time.NewTicker(reconcileRetryInterval)
-	defer ticker.Stop()
-
-	for {
-		err := service.reconcile(ctx)
-		if err == nil {
-			close(service.healthyC)
-			<-service.stopC
-			return nil
-		}
-
-		service.settings.Logger().WarnContext(ctx, "default span mapper group reconciliation failed, retrying", errors.Attr(err))
-
-		select {
-		case <-service.stopC:
-			return nil
-		case <-ticker.C:
-		}
-	}
-}
-
-func (service *service) Healthy() <-chan struct{} {
-	return service.healthyC
-}
-
-func (service *service) Stop(_ context.Context) error {
-	close(service.stopC)
-	return nil
-}
-
-func (service *service) reconcile(ctx context.Context) error {
-	orgs, err := service.orgGetter.ListByOwnedKeyRange(ctx)
-	if err != nil {
-		return err
-	}
-
-	for _, org := range orgs {
-		if err := service.module.ReconcileSystemGroups(ctx, org.ID); err != nil {
-			return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "couldn't reconcile default span mapper groups for org %s", org.ID.StringValue())
-		}
-	}
-
-	service.settings.Logger().InfoContext(ctx, "default span mapper group reconciliation completed", slog.Int("orgs", len(orgs)))
-	return nil
-}

pkg/modules/spanmapper/implspanmapper/store.go

@@ -17,10 +17,6 @@ func NewStore(sqlstore sqlstore.SQLStore) spantypes.SpanMapperStore {
 	return &store{sqlstore: sqlstore}
 }
 
-func (s *store) RunInTx(ctx context.Context, cb func(ctx context.Context) error) error {
-	return s.sqlstore.RunInTxCtx(ctx, nil, cb)
-}
-
 func (s *store) CreateGroup(ctx context.Context, group *spantypes.SpanMapperGroup) error {
 	storable := group.ToStorable()
 	_, err := s.sqlstore.
@@ -38,7 +34,7 @@ func (s *store) GetGroup(ctx context.Context, orgID, id valuer.UUID) (*spantypes
 	storable := new(spantypes.StorableSpanMapperGroup)
 
 	err := s.sqlstore.
-		BunDBCtx(ctx).
+		BunDB().
 		NewSelect().
 		Model(storable).
 		Where("org_id = ?", orgID).
@@ -50,27 +46,11 @@ func (s *store) GetGroup(ctx context.Context, orgID, id valuer.UUID) (*spantypes
 	return storable.ToSpanMapperGroup(), nil
 }
 
-func (s *store) GetGroupByName(ctx context.Context, orgID valuer.UUID, name string) (*spantypes.SpanMapperGroup, error) {
-	storable := new(spantypes.StorableSpanMapperGroup)
-
-	err := s.sqlstore.
-		BunDBCtx(ctx).
-		NewSelect().
-		Model(storable).
-		Where("org_id = ?", orgID).
-		Where("name = ?", name).
-		Scan(ctx)
-	if err != nil {
-		return nil, s.sqlstore.WrapNotFoundErrf(err, spantypes.ErrCodeMappingGroupNotFound, "span mapper group %q not found", name)
-	}
-	return storable.ToSpanMapperGroup(), nil
-}
-
 func (s *store) ListGroups(ctx context.Context, orgID valuer.UUID, q *spantypes.ListSpanMapperGroupsQuery) ([]*spantypes.SpanMapperGroup, error) {
 	storables := make([]*spantypes.StorableSpanMapperGroup, 0)
 
 	sel := s.sqlstore.
-		BunDBCtx(ctx).
+		BunDB().
 		NewSelect().
 		Model(&storables).
 		Where("org_id = ?", orgID)
@@ -111,35 +91,38 @@ func (s *store) UpdateGroup(ctx context.Context, group *spantypes.SpanMapperGrou
 }
 
 func (s *store) DeleteGroup(ctx context.Context, orgID, id valuer.UUID) error {
-	return s.RunInTx(ctx, func(ctx context.Context) error {
-		db := s.sqlstore.BunDBCtx(ctx)
+	tx, err := s.sqlstore.BunDBCtx(ctx).BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
 
-		// Cascade: remove mappers belonging to this group first.
-		if _, err := db.NewDelete().
-			Model((*spantypes.StorableSpanMapper)(nil)).
-			Where("group_id = ?", id).
-			Exec(ctx); err != nil {
-			return err
-		}
+	// Cascade: remove mappers belonging to this group first.
+	if _, err := tx.NewDelete().
+		Model((*spantypes.StorableSpanMapper)(nil)).
+		Where("group_id = ?", id).
+		Exec(ctx); err != nil {
+		return err
+	}
 
-		res, err := db.NewDelete().
-			Model((*spantypes.StorableSpanMapperGroup)(nil)).
-			Where("org_id = ?", orgID).
-			Where("id = ?", id).
-			Exec(ctx)
-		if err != nil {
-			return err
-		}
+	res, err := tx.NewDelete().
+		Model((*spantypes.StorableSpanMapperGroup)(nil)).
+		Where("org_id = ?", orgID).
+		Where("id = ?", id).
+		Exec(ctx)
+	if err != nil {
+		return err
+	}
 
-		rowsAffected, err := res.RowsAffected()
-		if err != nil {
-			return err
-		}
-		if rowsAffected == 0 {
-			return errors.Newf(errors.TypeNotFound, spantypes.ErrCodeMappingGroupNotFound, "span mapper group %s not found", id)
-		}
-		return nil
-	})
+	rowsAffected, err := res.RowsAffected()
+	if err != nil {
+		return err
+	}
+	if rowsAffected == 0 {
+		return errors.Newf(errors.TypeNotFound, spantypes.ErrCodeMappingGroupNotFound, "span mapper group %s not found", id)
+	}
+
+	return tx.Commit()
 }
 
 func (s *store) CreateMapper(ctx context.Context, mapper *spantypes.SpanMapper) error {
@@ -163,7 +146,7 @@ func (s *store) GetMapper(ctx context.Context, orgID, groupID, id valuer.UUID) (
 
 	storable := new(spantypes.StorableSpanMapper)
 	err := s.sqlstore.
-		BunDBCtx(ctx).
+		BunDB().
 		NewSelect().
 		Model(storable).
 		Where("group_id = ?", groupID).
@@ -183,7 +166,7 @@ func (s *store) ListMappers(ctx context.Context, orgID, groupID valuer.UUID) ([]
 
 	storables := make([]*spantypes.StorableSpanMapper, 0)
 	if err := s.sqlstore.
-		BunDBCtx(ctx).
+		BunDB().
 		NewSelect().
 		Model(&storables).
 		Where("group_id = ?", groupID).

pkg/modules/spanmapper/spanmapper.go

@@ -28,10 +28,6 @@ type Module interface {
 	UpdateMapper(ctx context.Context, orgID, groupID, id valuer.UUID, fieldContext spantypes.FieldContext, config *spantypes.SpanMapperConfig, enabled *bool, updatedBy string) error
 	DeleteMapper(ctx context.Context, orgID, groupID, id valuer.UUID) error
 	TestMappers(ctx context.Context, orgID valuer.UUID, spans []spantypes.SpanMapperTestSpan, groups []*spantypes.SpanMapperGroupWithMappers) ([]spantypes.SpanMapperTestSpan, []string, error)
-
-	// ReconcileSystemGroups provisions or upgrades the shipped mapping groups
-	// for one org. It runs at startup for every org and again on org creation.
-	ReconcileSystemGroups(ctx context.Context, orgID valuer.UUID) error
 }
 
 // Handler defines the HTTP handler interface for mapping group and mapper endpoints.

pkg/signoz/handler_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/dashboard/impldashboard"
 	"github.com/SigNoz/signoz/pkg/modules/organization/implorganization"
 	"github.com/SigNoz/signoz/pkg/modules/retention/implretention"
-	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
 	"github.com/SigNoz/signoz/pkg/querier"
@@ -62,10 +61,7 @@ func TestNewHandlers(t *testing.T) {
 	userGetter := impluser.NewGetter(impluser.NewStore(sqlstore, providerSettings), userRoleStore, flagger)
 
 	retentionGetter := implretention.NewGetter(implretention.NewStore(sqlstore))
-	spanMapperRegistry, err := implspanmapper.NewSystemGroupRegistry()
-	require.NoError(t, err)
-	spanMapperModule := implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), flagger, spanMapperRegistry, providerSettings)
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil, spanMapperModule)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, nil, nil, nil, retentionGetter, flagger, tagModule, nil)
 
 	querierHandler := querier.NewHandler(providerSettings, nil, nil)
 	registryHandler := factory.NewHandler(nil)

pkg/signoz/module.go

@@ -45,6 +45,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/session"
 	"github.com/SigNoz/signoz/pkg/modules/session/implsession"
 	"github.com/SigNoz/signoz/pkg/modules/spanmapper"
+	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile"
 	"github.com/SigNoz/signoz/pkg/modules/spanpercentile/implspanpercentile"
 	"github.com/SigNoz/signoz/pkg/modules/tag"
@@ -123,10 +124,9 @@ func NewModules(
 	fl flagger.Flagger,
 	tagModule tag.Module,
 	metricReductionRule metricreductionrule.Module,
-	spanMapper spanmapper.Module,
 ) Modules {
 	quickfilter := implquickfilter.NewModule(implquickfilter.NewStore(sqlstore))
-	orgSetter := implorganization.NewSetter(implorganization.NewStore(sqlstore), alertmanager, quickfilter, dashboard, spanMapper)
+	orgSetter := implorganization.NewSetter(implorganization.NewStore(sqlstore), alertmanager, quickfilter, dashboard)
 	// Cleanup callbacks from other modules, invoked when a user is deleted.
 	onDeleteUser := []user.OnDeleteUser{
 		dashboard.DeletePreferencesForUser,
@@ -162,7 +162,7 @@ func NewModules(
 		RuleStateHistory:     implrulestatehistory.NewModule(implrulestatehistory.NewStore(telemetryStore, telemetryMetadataStore, providerSettings.Logger), ruleStore),
 		CloudIntegration:     cloudIntegrationModule,
 		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore), providerSettings, config.TraceDetail),
-		SpanMapper:           spanMapper,
+		SpanMapper:           implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), fl),
 		LLMPricingRule:       impllmpricingrule.NewModule(impllmpricingrule.NewStore(sqlstore), fl, querier),
 		Tag:                  tagModule,
 	}

pkg/signoz/module_test.go

@@ -21,7 +21,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/retention/implretention"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount/implserviceaccount"
-	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
 	"github.com/SigNoz/signoz/pkg/queryparser"
@@ -69,11 +68,7 @@ func TestNewModules(t *testing.T) {
 
 	retentionGetter := implretention.NewGetter(implretention.NewStore(sqlstore))
 
-	spanMapperRegistry, err := implspanmapper.NewSystemGroupRegistry()
-	require.NoError(t, err)
-	spanMapperModule := implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), flagger, spanMapperRegistry, providerSettings)
-
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule(), spanMapperModule)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, nil, nil, nil, nil, nil, nil, nil, queryParser, Config{}, dashboardModule, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, implcloudintegration.NewModule(), retentionGetter, flagger, tagModule, implmetricreductionrule.NewModule())
 
 	reflectVal := reflect.ValueOf(modules)
 	for i := 0; i < reflectVal.NumField(); i++ {

pkg/signoz/openapi.go

@@ -66,6 +66,7 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ authz.AuthZ }{},
 		struct{ organization.Handler }{},
 		struct{ user.Handler }{},
+		struct{ user.Getter }{},
 		struct{ session.Handler }{},
 		struct{ authdomain.Handler }{},
 		struct{ authdomain.Module }{},

pkg/signoz/provider.go

@@ -254,7 +254,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddIngestionTuplesFactory(sqlstore),
 		sqlmigration.NewAddSubscriptionTuplesFactory(sqlstore),
 		sqlmigration.NewNormalizeQuickFilterFieldsFactory(sqlstore),
-		sqlmigration.NewAddSpanMapperOriginFactory(sqlstore, sqlschema),
+		sqlmigration.NewAddUserTuplesFactory(sqlstore),
 	)
 }
 
@@ -327,6 +327,7 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			authz,
 			implorganization.NewHandler(modules.OrgGetter, modules.OrgSetter),
 			impluser.NewHandler(modules.UserSetter, modules.UserGetter),
+			modules.UserGetter,
 			implsession.NewHandler(modules.Session, globalConfig),
 			implauthdomain.NewHandler(modules.AuthDomain),
 			modules.AuthDomain,

pkg/signoz/signoz.go

@@ -36,7 +36,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/rulestatehistory"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount"
 	"github.com/SigNoz/signoz/pkg/modules/serviceaccount/implserviceaccount"
-	"github.com/SigNoz/signoz/pkg/modules/spanmapper/implspanmapper"
 	"github.com/SigNoz/signoz/pkg/modules/tag"
 	"github.com/SigNoz/signoz/pkg/modules/tag/impltag"
 	"github.com/SigNoz/signoz/pkg/modules/user/impluser"
@@ -550,15 +549,7 @@ func New(
 	metricReductionRuleModule := metricReductionRuleModuleCallback(sqlstore, telemetrystore, dashboard, queryParser, licensing, flagger, telemetryMetadataStore, providerSettings, config.MetricsExplorer.TelemetryStore.Threads)
 
 	// Initialize all modules
-	// The default mapping group registry is parsed here so a malformed embedded
-	// definition fails startup instead of a request.
-	spanMapperRegistry, err := implspanmapper.NewSystemGroupRegistry()
-	if err != nil {
-		return nil, err
-	}
-	spanMapperModule := implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), flagger, spanMapperRegistry, providerSettings)
-
-	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule, spanMapperModule)
+	modules := NewModules(sqlstore, tokenizer, emailing, providerSettings, orgGetter, alertmanager, analytics, querier, telemetrystore, telemetryMetadataStore, authNs, authz, cache, queryParser, config, dashboard, userGetter, userRoleStore, serviceAccount, serviceAccountGetter, cloudIntegrationModule, retentionGetter, flagger, tagModule, metricReductionRuleModule)
 
 	// Initialize ruler from the variant-specific provider factories
 	rulerInstance, err := factory.NewProviderFromNamedMap(ctx, providerSettings, config.Ruler, rulerProviderFactories(cache, alertmanager, sqlstore, telemetrystore, telemetryMetadataStore, prometheus, orgGetter, modules.RuleStateHistory, querier, queryParser), "signoz")
@@ -628,7 +619,6 @@ func New(
 		factory.NewNamedService(factory.MustNewName("meterreporter"), meterReporter, factory.MustNewName("licensing")),
 		factory.NewNamedService(factory.MustNewName("ruler"), rulerInstance),
 		factory.NewNamedService(factory.MustNewName("systemdashboard"), impldashboard.NewService(providerSettings, dashboard, orgGetter)),
-		factory.NewNamedService(factory.MustNewName("spanmappergroup"), implspanmapper.NewService(providerSettings, spanMapperModule, orgGetter)),
 	)
 	if err != nil {
 		return nil, err

pkg/sqlmigration/127_add_span_mapper_origin.go

@@ -1,93 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlschema"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addSpanMapperOrigin struct {
-	sqlstore  sqlstore.SQLStore
-	sqlschema sqlschema.SQLSchema
-}
-
-func NewAddSpanMapperOriginFactory(sqlstore sqlstore.SQLStore, sqlschema sqlschema.SQLSchema) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(
-		factory.MustNewName("add_span_mapper_origin"),
-		func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-			return &addSpanMapperOrigin{sqlstore: sqlstore, sqlschema: sqlschema}, nil
-		},
-	)
-}
-
-func (migration *addSpanMapperOrigin) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-// Up adds the ownership columns that let SigNoz ship default mapping groups
-// alongside user ones.
-func (migration *addSpanMapperOrigin) Up(ctx context.Context, db *bun.DB) error {
-	// span_mapper references span_mapper_group and both have foreign keys, so
-	// enforcement must be off for the SQLite recreate-table fallback.
-	if err := migration.sqlschema.ToggleFKEnforcement(ctx, db, false); err != nil {
-		return err
-	}
-
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		_ = tx.Rollback()
-	}()
-
-	groupTable, groupUniqueConstraints, err := migration.sqlschema.GetTable(ctx, sqlschema.TableName("span_mapper_group"))
-	if err != nil {
-		return err
-	}
-
-	sqls := migration.sqlschema.Operator().AddColumn(groupTable, groupUniqueConstraints, &sqlschema.Column{
-		Name:     sqlschema.ColumnName("origin"),
-		DataType: sqlschema.DataTypeText,
-		Nullable: false,
-		Default:  "'user'",
-	}, "user")
-	sqls = append(sqls, migration.sqlschema.Operator().AddColumn(groupTable, groupUniqueConstraints, &sqlschema.Column{
-		Name:     sqlschema.ColumnName("version"),
-		DataType: sqlschema.DataTypeBigInt,
-		Nullable: false,
-		Default:  "0",
-	}, 0)...)
-
-	mapperTable, mapperUniqueConstraints, err := migration.sqlschema.GetTable(ctx, sqlschema.TableName("span_mapper"))
-	if err != nil {
-		return err
-	}
-
-	sqls = append(sqls, migration.sqlschema.Operator().AddColumn(mapperTable, mapperUniqueConstraints, &sqlschema.Column{
-		Name:     sqlschema.ColumnName("origin"),
-		DataType: sqlschema.DataTypeText,
-		Nullable: false,
-		Default:  "'user'",
-	}, "user")...)
-
-	for _, sql := range sqls {
-		if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
-			return err
-		}
-	}
-
-	if err := tx.Commit(); err != nil {
-		return err
-	}
-
-	return migration.sqlschema.ToggleFKEnforcement(ctx, db, true)
-}
-
-func (migration *addSpanMapperOrigin) Down(context.Context, *bun.DB) error {
-	return nil
-}

pkg/sqlmigration/127_add_user_tuples.go

@@ -0,0 +1,144 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addUserTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddUserTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_user_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addUserTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addUserTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addUserTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	// user and factor-password moved from the legacy AdminAccess role gate to
+	// CheckResources, which on enterprise requires real tuples -- existing orgs
+	// never had these written, only new orgs get them from the registry at
+	// bootstrap. The managed-role transaction groups stored per org already
+	// carry these transactions, so no re-sync is needed here.
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "user", "user", "create"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "read"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "update"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "delete"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "list"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "attach"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "detach"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addUserTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/types/spantypes/mapper.go

@@ -1,8 +1,6 @@
 package spantypes
 
 import (
-	"slices"
-	"strings"
 	"time"
 
 	"github.com/SigNoz/signoz/pkg/errors"
@@ -13,7 +11,6 @@ import (
 var (
 	ErrCodeMapperNotFound      = errors.MustNewCode("span_attribute_mapper_not_found")
 	ErrCodeMapperAlreadyExists = errors.MustNewCode("span_attribute_mapper_already_exists")
-	ErrCodeMapperNotDeletable  = errors.MustNewCode("span_attribute_mapper_not_deletable")
 	ErrCodeMappingInvalidInput = errors.MustNewCode("span_attribute_mapping_invalid_input")
 )
 
@@ -37,25 +34,12 @@ var (
 	SpanMapperOperationCopy = SpanMapperOperation{valuer.NewString("copy")}
 )
 
-// SpanMapperOrigin tells shipped (system) items apart from user-created ones.
-// System items are read-only apart from their enabled toggle.
-type SpanMapperOrigin struct {
-	valuer.String
-}
-
-var (
-	SpanMapperOriginUser   = SpanMapperOrigin{valuer.NewString("user")}
-	SpanMapperOriginSystem = SpanMapperOrigin{valuer.NewString("system")}
-)
-
 // MapperSource describes one candidate source for a target attribute.
 type SpanMapperSource struct {
 	Key       string              `json:"key" required:"true"`
 	Context   FieldContext        `json:"context" required:"true"`
 	Operation SpanMapperOperation `json:"operation" required:"true"`
 	Priority  int                 `json:"priority" required:"true"`
-	Enabled   bool                `json:"enabled" required:"true"`
-	Origin    SpanMapperOrigin    `json:"origin"`
 }
 
 // MapperConfig holds the mapping logic for a single target attribute.
@@ -75,7 +59,6 @@ type SpanMapper struct {
 	FieldContext FieldContext     `json:"fieldContext"  required:"true"`
 	Config       SpanMapperConfig `json:"config"        required:"true"`
 	Enabled      bool             `json:"enabled"       required:"true"`
-	Origin       SpanMapperOrigin `json:"origin"        required:"true"`
 }
 
 type PostableSpanMapper struct {
@@ -107,63 +90,6 @@ func (SpanMapperOperation) Enum() []any {
 	return []any{SpanMapperOperationMove, SpanMapperOperationCopy}
 }
 
-func (SpanMapperOrigin) Enum() []any {
-	return []any{SpanMapperOriginUser, SpanMapperOriginSystem}
-}
-
-func (p *PostableSpanMapper) Validate() error {
-	if strings.TrimSpace(p.Name) == "" {
-		return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "mapper name must not be blank")
-	}
-	if err := p.FieldContext.Validate(); err != nil {
-		return err
-	}
-	return p.Config.Validate()
-}
-
-func (f FieldContext) Validate() error {
-	if f != FieldContextSpanAttribute && f != FieldContextResource {
-		return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "field context must be one of %q or %q, got %q", FieldContextSpanAttribute, FieldContextResource, f.StringValue())
-	}
-	return nil
-}
-
-// Validate checks every source and rejects duplicate priorities within an
-// origin. Shipped and user sources are never compared with each other: a user
-// re-adding a shipped key with another operation is the supported override.
-func (c *SpanMapperConfig) Validate() error {
-	if len(c.Sources) == 0 {
-		return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "config.sources must contain at least one source")
-	}
-	seen := map[SpanMapperOrigin]map[int]struct{}{}
-	for _, s := range c.Sources {
-		if strings.TrimSpace(s.Key) == "" {
-			return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "source key must not be blank")
-		}
-		if err := s.Context.Validate(); err != nil {
-			return err
-		}
-		if s.Operation != SpanMapperOperationCopy && s.Operation != SpanMapperOperationMove {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "source operation must be one of %q or %q, got %q", SpanMapperOperationCopy, SpanMapperOperationMove, s.Operation.StringValue())
-		}
-		if !s.Origin.IsZero() && s.Origin != SpanMapperOriginUser && s.Origin != SpanMapperOriginSystem {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "source origin must be one of %q or %q, got %q", SpanMapperOriginUser, SpanMapperOriginSystem, s.Origin.StringValue())
-		}
-		origin := s.Origin
-		if origin.IsZero() {
-			origin = SpanMapperOriginUser
-		}
-		if seen[origin] == nil {
-			seen[origin] = map[int]struct{}{}
-		}
-		if _, dup := seen[origin][s.Priority]; dup {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "source priority %d is used more than once", s.Priority)
-		}
-		seen[origin][s.Priority] = struct{}{}
-	}
-	return nil
-}
-
 func NewSpanMapper(groupID valuer.UUID, createdBy string, p *PostableSpanMapper) *SpanMapper {
 	now := time.Now()
 	return &SpanMapper{
@@ -171,9 +97,8 @@ func NewSpanMapper(groupID valuer.UUID, createdBy string, p *PostableSpanMapper)
 		GroupID:      groupID,
 		Name:         p.Name,
 		FieldContext: p.FieldContext,
-		Config:       SpanMapperConfig{Sources: withOrigin(p.Config.Sources, SpanMapperOriginUser)},
+		Config:       p.Config,
 		Enabled:      p.Enabled,
-		Origin:       SpanMapperOriginUser,
 		TimeAuditable: types.TimeAuditable{
 			CreatedAt: now,
 			UpdatedAt: now,
@@ -185,42 +110,16 @@ func NewSpanMapper(groupID valuer.UUID, createdBy string, p *PostableSpanMapper)
 	}
 }
 
-// Update applies a user edit; a zero fieldContext means it was omitted. On a
-// system mapper the field context is fixed and the stored system sources are
-// kept; see nextSources.
-func (m *SpanMapper) Update(fieldContext FieldContext, config *SpanMapperConfig, enabled *bool, updatedBy string) error {
-	if !fieldContext.IsZero() {
-		if m.Origin == SpanMapperOriginSystem && fieldContext != m.FieldContext {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "field context of system mapper %q cannot be changed", m.Name)
-		}
-		if err := fieldContext.Validate(); err != nil {
-			return err
-		}
-		m.FieldContext = fieldContext
-	}
+func (m *SpanMapper) Update(fieldContext FieldContext, config *SpanMapperConfig, enabled *bool, updatedBy string) {
+	m.FieldContext = fieldContext
 	if config != nil {
-		sources, err := m.nextSources(config.Sources)
-		if err != nil {
-			return err
-		}
-		m.Config = SpanMapperConfig{Sources: sources}
-		if err := m.Config.Validate(); err != nil {
-			return err
-		}
+		m.Config = *config
 	}
 	if enabled != nil {
 		m.Enabled = *enabled
 	}
 	m.UpdatedAt = time.Now()
 	m.UpdatedBy = updatedBy
-	return nil
-}
-
-func (m *SpanMapper) ErrIfNotDeletable() error {
-	if m.Origin == SpanMapperOriginSystem {
-		return errors.Newf(errors.TypeInvalidInput, ErrCodeMapperNotDeletable, "system mapper %q cannot be deleted, disable it instead", m.Name)
-	}
-	return nil
 }
 
 func (m *SpanMapper) ToStorable() *StorableSpanMapper {
@@ -233,7 +132,6 @@ func (m *SpanMapper) ToStorable() *StorableSpanMapper {
 		FieldContext:  m.FieldContext,
 		Config:        m.Config,
 		Enabled:       m.Enabled,
-		Origin:        m.Origin,
 	}
 }
 
@@ -247,7 +145,6 @@ func (s *StorableSpanMapper) ToSpanMapper() *SpanMapper {
 		FieldContext:  s.FieldContext,
 		Config:        s.Config,
 		Enabled:       s.Enabled,
-		Origin:        s.Origin,
 	}
 }
 
@@ -262,39 +159,3 @@ func NewSpanMappersFromStorable(ss []*StorableSpanMapper) []*SpanMapper {
 func NewGettableSpanMappers(m []*SpanMapper) *GettableSpanMappers {
 	return &GettableSpanMappers{Items: m}
 }
-
-// nextSources builds the source list from an edit: user sources are taken from
-// the edit as sent, system sources stay as stored and the edit can only flip
-// their enabled flag.
-func (m *SpanMapper) nextSources(edit []SpanMapperSource) ([]SpanMapperSource, error) {
-	var systemSources, userSources []SpanMapperSource
-	for _, s := range m.Config.Sources {
-		if s.Origin == SpanMapperOriginSystem {
-			systemSources = append(systemSources, s)
-		}
-	}
-
-	for _, s := range edit {
-		if s.Origin != SpanMapperOriginSystem {
-			s.Origin = SpanMapperOriginUser
-			userSources = append(userSources, s)
-			continue
-		}
-		idx := slices.IndexFunc(systemSources, func(o SpanMapperSource) bool { return o.Key == s.Key && o.Context == s.Context })
-		if idx == -1 {
-			return nil, errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "system source %q does not exist on this mapper; only its enabled flag can change", s.Key)
-		}
-		systemSources[idx].Enabled = s.Enabled
-	}
-
-	return append(systemSources, userSources...), nil
-}
-
-func withOrigin(sources []SpanMapperSource, origin SpanMapperOrigin) []SpanMapperSource {
-	out := make([]SpanMapperSource, len(sources))
-	for i, s := range sources {
-		s.Origin = origin
-		out[i] = s
-	}
-	return out
-}

pkg/types/spantypes/mappergroup.go

@@ -1,8 +1,6 @@
 package spantypes
 
 import (
-	"slices"
-	"strings"
 	"time"
 
 	"github.com/SigNoz/signoz/pkg/errors"
@@ -13,28 +11,17 @@ import (
 var (
 	ErrCodeMappingGroupNotFound      = errors.MustNewCode("span_attribute_mapping_group_not_found")
 	ErrCodeMappingGroupAlreadyExists = errors.MustNewCode("span_attribute_mapping_group_already_exists")
-	ErrCodeMappingGroupNameReserved  = errors.MustNewCode("span_attribute_mapping_group_name_reserved")
-	ErrCodeMappingGroupNotDeletable  = errors.MustNewCode("span_attribute_mapping_group_not_deletable")
 )
 
-// SpanMapperGroupConditionKey is one substring a span's attribute or resource
-// keys are matched against.
-type SpanMapperGroupConditionKey struct {
-	Value   string           `json:"value" required:"true"`
-	Enabled bool             `json:"enabled" required:"true"`
-	Origin  SpanMapperOrigin `json:"origin"`
-}
-
 // SpanMapperGroupCondition gates whether a group's rules run for a given span.
 // A group runs when any attribute or resource key on the span CONTAINS one of
 // the listed substrings (plain substring match — no glob syntax).
 type SpanMapperGroupCondition struct {
-	Attributes []SpanMapperGroupConditionKey `json:"attributes" required:"true" nullable:"true"`
-	Resource   []SpanMapperGroupConditionKey `json:"resource" required:"true" nullable:"true"`
+	Attributes []string `json:"attributes" required:"true" nullable:"true"`
+	Resource   []string `json:"resource" required:"true" nullable:"true"`
 }
 
 // SpanMapperGroup is the domain model for a span attribute mapping group.
-// Version is the shipped definition version for system groups and 0 otherwise.
 type SpanMapperGroup struct {
 	types.TimeAuditable
 	types.UserAuditable
@@ -44,8 +31,6 @@ type SpanMapperGroup struct {
 	Name      string                   `json:"name" required:"true"`
 	Condition SpanMapperGroupCondition `json:"condition" required:"true"`
 	Enabled   bool                     `json:"enabled" required:"true"`
-	Origin    SpanMapperOrigin         `json:"origin" required:"true"`
-	Version   int                      `json:"version" required:"true"`
 }
 
 // GettableSpanMapperGroup is the HTTP response representation of a mapping group.
@@ -73,42 +58,14 @@ type GettableSpanMapperGroups struct {
 	Items []*GettableSpanMapperGroup `json:"items" required:"true" nullable:"false"`
 }
 
-// Validate requires at least one substring overall and rejects blank ones.
-// All-off is allowed: a group with every substring disabled simply never runs.
-func (c *SpanMapperGroupCondition) Validate() error {
-	if len(c.Attributes)+len(c.Resource) == 0 {
-		return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "condition must list at least one attribute or resource substring")
-	}
-	for _, k := range slices.Concat(c.Attributes, c.Resource) {
-		if strings.TrimSpace(k.Value) == "" {
-			return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "condition substrings must not be blank")
-		}
-		if !k.Origin.IsZero() && k.Origin != SpanMapperOriginUser && k.Origin != SpanMapperOriginSystem {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "condition origin must be one of %q or %q, got %q", SpanMapperOriginUser, SpanMapperOriginSystem, k.Origin.StringValue())
-		}
-	}
-	return nil
-}
-
-func (p *PostableSpanMapperGroup) Validate() error {
-	if strings.TrimSpace(p.Name) == "" {
-		return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "group name must not be blank")
-	}
-	return p.Condition.Validate()
-}
-
 func NewSpanMapperGroup(orgID valuer.UUID, createdBy string, p *PostableSpanMapperGroup) *SpanMapperGroup {
 	now := time.Now()
 	return &SpanMapperGroup{
-		ID:    valuer.GenerateUUID(),
-		OrgID: orgID,
-		Name:  p.Name,
-		Condition: SpanMapperGroupCondition{
-			Attributes: conditionKeysWithOrigin(p.Condition.Attributes, SpanMapperOriginUser),
-			Resource:   conditionKeysWithOrigin(p.Condition.Resource, SpanMapperOriginUser),
-		},
-		Enabled: p.Enabled,
-		Origin:  SpanMapperOriginUser,
+		ID:        valuer.GenerateUUID(),
+		OrgID:     orgID,
+		Name:      p.Name,
+		Condition: p.Condition,
+		Enabled:   p.Enabled,
 		TimeAuditable: types.TimeAuditable{
 			CreatedAt: now,
 			UpdatedAt: now,
@@ -120,45 +77,18 @@ func NewSpanMapperGroup(orgID valuer.UUID, createdBy string, p *PostableSpanMapp
 	}
 }
 
-// Update applies a user edit. A system group keeps its name and its system
-// substrings; see nextConditionKeys.
-func (g *SpanMapperGroup) Update(name *string, condition *SpanMapperGroupCondition, enabled *bool, updatedBy string) error {
+func (g *SpanMapperGroup) Update(name *string, condition *SpanMapperGroupCondition, enabled *bool, updatedBy string) {
 	if name != nil {
-		if g.Origin == SpanMapperOriginSystem && *name != g.Name {
-			return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "system group %q cannot be renamed", g.Name)
-		}
-		if strings.TrimSpace(*name) == "" {
-			return errors.New(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "group name must not be blank")
-		}
 		g.Name = *name
 	}
 	if condition != nil {
-		attrs, err := nextConditionKeys(g.Condition.Attributes, condition.Attributes)
-		if err != nil {
-			return err
-		}
-		res, err := nextConditionKeys(g.Condition.Resource, condition.Resource)
-		if err != nil {
-			return err
-		}
-		g.Condition = SpanMapperGroupCondition{Attributes: attrs, Resource: res}
-		if err := g.Condition.Validate(); err != nil {
-			return err
-		}
+		g.Condition = *condition
 	}
 	if enabled != nil {
 		g.Enabled = *enabled
 	}
 	g.UpdatedAt = time.Now()
 	g.UpdatedBy = updatedBy
-	return nil
-}
-
-func (g *SpanMapperGroup) ErrIfNotDeletable() error {
-	if g.Origin == SpanMapperOriginSystem {
-		return errors.Newf(errors.TypeInvalidInput, ErrCodeMappingGroupNotDeletable, "system group %q cannot be deleted, disable it instead", g.Name)
-	}
-	return nil
 }
 
 func (g *SpanMapperGroup) ToStorable() *StorableSpanMapperGroup {
@@ -170,8 +100,6 @@ func (g *SpanMapperGroup) ToStorable() *StorableSpanMapperGroup {
 		Name:          g.Name,
 		Condition:     g.Condition,
 		Enabled:       g.Enabled,
-		Origin:        g.Origin,
-		Version:       g.Version,
 	}
 }
 
@@ -184,8 +112,6 @@ func (s *StorableSpanMapperGroup) ToSpanMapperGroup() *SpanMapperGroup {
 		Name:          s.Name,
 		Condition:     s.Condition,
 		Enabled:       s.Enabled,
-		Origin:        s.Origin,
-		Version:       s.Version,
 	}
 }
 
@@ -200,39 +126,3 @@ func NewSpanMapperGroupsFromStorable(ss []*StorableSpanMapperGroup) []*SpanMappe
 func NewGettableSpanMapperGroups(g []*SpanMapperGroup) *GettableSpanMapperGroups {
 	return &GettableSpanMapperGroups{Items: g}
 }
-
-// nextConditionKeys builds a substring list from an edit: user substrings are
-// taken from the edit as sent, system substrings stay as stored and the edit
-// can only flip their enabled flag.
-func nextConditionKeys(stored, edit []SpanMapperGroupConditionKey) ([]SpanMapperGroupConditionKey, error) {
-	var systemKeys, userKeys []SpanMapperGroupConditionKey
-	for _, k := range stored {
-		if k.Origin == SpanMapperOriginSystem {
-			systemKeys = append(systemKeys, k)
-		}
-	}
-
-	for _, k := range edit {
-		if k.Origin != SpanMapperOriginSystem {
-			k.Origin = SpanMapperOriginUser
-			userKeys = append(userKeys, k)
-			continue
-		}
-		idx := slices.IndexFunc(systemKeys, func(s SpanMapperGroupConditionKey) bool { return s.Value == k.Value })
-		if idx == -1 {
-			return nil, errors.Newf(errors.TypeInvalidInput, ErrCodeMappingInvalidInput, "system substring %q does not exist on this group; only its enabled flag can change", k.Value)
-		}
-		systemKeys[idx].Enabled = k.Enabled
-	}
-
-	return append(systemKeys, userKeys...), nil
-}
-
-func conditionKeysWithOrigin(keys []SpanMapperGroupConditionKey, origin SpanMapperOrigin) []SpanMapperGroupConditionKey {
-	out := make([]SpanMapperGroupConditionKey, len(keys))
-	for i, k := range keys {
-		k.Origin = origin
-		out[i] = k
-	}
-	return out
-}

pkg/types/spantypes/spanmapperdefinition.go

@@ -1,121 +0,0 @@
-package spantypes
-
-import (
-	"bytes"
-	"encoding/json"
-	"slices"
-	"strings"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-)
-
-var ErrCodeMappingDefinitionInvalid = errors.MustNewCode("span_attribute_mapping_definition_invalid")
-
-// ProvisionerIdentity is stamped into created_by/updated_by by the reconciler.
-const ProvisionerIdentity = "signoz"
-
-// SpanMapperGroupDefinition is one shipped mapping group. Version is bumped on
-// every content change and drives upgrades; the group name is the stable key
-// and never changes. Once parsed, every substring and source carries the
-// system origin and is enabled.
-type SpanMapperGroupDefinition struct {
-	Version    int                         `json:"version"`
-	Definition PostableSpanMapperTestGroup `json:"definition"`
-}
-
-func (d SpanMapperGroupDefinition) Name() string {
-	return d.Definition.Name
-}
-
-func NewSpanMapperGroupDefinition(raw []byte) (SpanMapperGroupDefinition, error) {
-	decoder := json.NewDecoder(bytes.NewReader(raw))
-	decoder.DisallowUnknownFields()
-
-	var d SpanMapperGroupDefinition
-	if err := decoder.Decode(&d); err != nil {
-		return SpanMapperGroupDefinition{}, errors.WrapInvalidInputf(err, ErrCodeMappingDefinitionInvalid, "%s", err.Error())
-	}
-	if err := d.validate(); err != nil {
-		return SpanMapperGroupDefinition{}, err
-	}
-
-	for _, keys := range [][]SpanMapperGroupConditionKey{d.Definition.Condition.Attributes, d.Definition.Condition.Resource} {
-		for i := range keys {
-			keys[i].Enabled = true
-			keys[i].Origin = SpanMapperOriginSystem
-		}
-	}
-	for i := range d.Definition.Mappers {
-		sources := d.Definition.Mappers[i].Config.Sources
-		for j := range sources {
-			sources[j].Enabled = true
-			sources[j].Origin = SpanMapperOriginSystem
-		}
-	}
-	return d, nil
-}
-
-// SpanMapperGroupRegistry holds every definition embedded in the binary, keyed by name.
-type SpanMapperGroupRegistry struct {
-	definitions map[string]SpanMapperGroupDefinition
-}
-
-func NewSpanMapperGroupRegistry(definitions []SpanMapperGroupDefinition) (SpanMapperGroupRegistry, error) {
-	byName := make(map[string]SpanMapperGroupDefinition, len(definitions))
-	for _, d := range definitions {
-		if _, dup := byName[d.Name()]; dup {
-			return SpanMapperGroupRegistry{}, errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "duplicate span mapper group name %q", d.Name())
-		}
-		byName[d.Name()] = d
-	}
-	return SpanMapperGroupRegistry{definitions: byName}, nil
-}
-
-func (r SpanMapperGroupRegistry) IsReserved(name string) bool {
-	_, ok := r.definitions[name]
-	return ok
-}
-
-// List returns the definitions sorted by name so provisioning order is stable.
-func (r SpanMapperGroupRegistry) List() []SpanMapperGroupDefinition {
-	out := make([]SpanMapperGroupDefinition, 0, len(r.definitions))
-	for _, d := range r.definitions {
-		out = append(out, d)
-	}
-	slices.SortFunc(out, func(a, b SpanMapperGroupDefinition) int { return strings.Compare(a.Name(), b.Name()) })
-	return out
-}
-
-func (d SpanMapperGroupDefinition) validate() error {
-	if d.Version < 1 {
-		return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "version must be at least 1, got %d", d.Version)
-	}
-	if err := d.Definition.Validate(); err != nil {
-		return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeMappingDefinitionInvalid, "%s", d.Name())
-	}
-	if len(d.Definition.Mappers) == 0 {
-		return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "%s: at least one mapper is required", d.Name())
-	}
-	names := make(map[string]struct{}, len(d.Definition.Mappers))
-	for i := range d.Definition.Mappers {
-		m := &d.Definition.Mappers[i]
-		if err := m.Validate(); err != nil {
-			return errors.Wrapf(err, errors.TypeInvalidInput, ErrCodeMappingDefinitionInvalid, "%s: mapper %q", d.Name(), m.Name)
-		}
-		if _, dup := names[m.Name]; dup {
-			return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "%s: duplicate mapper %q", d.Name(), m.Name)
-		}
-		names[m.Name] = struct{}{}
-		for _, s := range m.Config.Sources {
-			if !s.Origin.IsZero() || s.Enabled {
-				return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "%s: mapper %q: sources must not set origin or enabled", d.Name(), m.Name)
-			}
-		}
-	}
-	for _, k := range slices.Concat(d.Definition.Condition.Attributes, d.Definition.Condition.Resource) {
-		if !k.Origin.IsZero() || k.Enabled {
-			return errors.NewInvalidInputf(ErrCodeMappingDefinitionInvalid, "%s: condition substrings must not set origin or enabled", d.Name())
-		}
-	}
-	return nil
-}

pkg/types/spantypes/spanmapperprocessor.go

@@ -86,31 +86,17 @@ func buildProcessorConfig(groups []*SpanMapperGroupWithMappers) *spanMapperProce
 	out := make([]spanMapperProcessorGroup, 0, len(groups))
 
 	for _, gm := range groups {
-		existsAny := spanMapperProcessorExistsAny{
-			Attributes: enabledConditionValues(gm.Group.Condition.Attributes),
-			Resource:   enabledConditionValues(gm.Group.Condition.Resource),
-		}
-		// The collector rejects an empty exists_any and empty sources; with
-		// per-item toggles, all-off is valid stored state and means "never runs".
-		if len(existsAny.Attributes)+len(existsAny.Resource) == 0 {
-			continue
-		}
-
 		rules := make([]spanMapperProcessorAttribute, 0, len(gm.Mappers))
 		for _, m := range gm.Mappers {
-			rule := buildAttributeRule(m)
-			if len(rule.Sources) == 0 {
-				continue
-			}
-			rules = append(rules, rule)
-		}
-		if len(rules) == 0 {
-			continue
+			rules = append(rules, buildAttributeRule(m))
 		}
 
 		out = append(out, spanMapperProcessorGroup{
-			ID:         gm.Group.Name,
-			ExistsAny:  existsAny,
+			ID: gm.Group.Name,
+			ExistsAny: spanMapperProcessorExistsAny{
+				Attributes: gm.Group.Condition.Attributes,
+				Resource:   gm.Group.Condition.Resource,
+			},
 			Attributes: rules,
 		})
 	}
@@ -118,31 +104,14 @@ func buildProcessorConfig(groups []*SpanMapperGroupWithMappers) *spanMapperProce
 	return &spanMapperProcessorConfig{Groups: out}
 }
 
-func enabledConditionValues(keys []SpanMapperGroupConditionKey) []string {
-	out := make([]string, 0, len(keys))
-	for _, k := range keys {
-		if k.Enabled {
-			out = append(out, k.Value)
-		}
-	}
-	if len(out) == 0 {
-		return nil
-	}
-	return out
-}
-
 // buildAttributeRule maps a single SpanMapper to a collector attribute rule.
-// Disabled sources are skipped and the rest are sorted by Priority DESC
-// (highest-priority first); read-from-resource sources are encoded via the
-// "resource." prefix on the key. Each source carries its own action — "copy"
-// is omitted to keep the emitted YAML compact, and only "move" is set explicitly.
+// Sources are sorted by Priority DESC (highest-priority first); read-from-
+// resource sources are encoded via the "resource." prefix on the key. Each
+// source carries its own action — "copy" is omitted to keep the emitted YAML
+// compact, and only "move" is set explicitly.
 func buildAttributeRule(m *SpanMapper) spanMapperProcessorAttribute {
-	sources := make([]SpanMapperSource, 0, len(m.Config.Sources))
-	for _, s := range m.Config.Sources {
-		if s.Enabled {
-			sources = append(sources, s)
-		}
-	}
+	sources := make([]SpanMapperSource, len(m.Config.Sources))
+	copy(sources, m.Config.Sources)
 	sort.SliceStable(sources, func(i, j int) bool { return sources[i].Priority > sources[j].Priority })
 
 	out := make([]spanMapperProcessorSource, 0, len(sources))

pkg/types/spantypes/spanmapperprocessor_test.go

@@ -145,22 +145,6 @@ func TestBuildAttributeRule(t *testing.T) {
 				},
 			},
 		},
-		{
-			name: "disabled_sources_skipped",
-			mapper: newMapper("gen_ai.input.messages", FieldContextSpanAttribute,
-				systemSrc("gen_ai.prompt", SpanMapperOperationCopy, 30, false),
-				systemSrc("input.value", SpanMapperOperationCopy, 20, true),
-				attrSrc("gen_ai.prompt", SpanMapperOperationMove, 40),
-			),
-			want: spanMapperProcessorAttribute{
-				Target:  "gen_ai.input.messages",
-				Context: FieldContextSpanAttribute.StringValue(),
-				Sources: []spanMapperProcessorSource{
-					{Key: "gen_ai.prompt", Action: SpanMapperOperationMove.StringValue()},
-					{Key: "input.value"},
-				},
-			},
-		},
 	}
 
 	for _, tc := range tests {
@@ -171,33 +155,6 @@ func TestBuildAttributeRule(t *testing.T) {
 	}
 }
 
-func TestBuildProcessorConfigDropsAllOffItems(t *testing.T) {
-	t.Parallel()
-
-	offGroup := newGroup("all-off", nil, nil)
-	offGroup.Condition.Attributes = []SpanMapperGroupConditionKey{{Value: "model", Enabled: false, Origin: SpanMapperOriginSystem}}
-
-	mixed := newGroup("llm", nil, nil)
-	mixed.Condition.Attributes = []SpanMapperGroupConditionKey{
-		{Value: "model", Enabled: false, Origin: SpanMapperOriginSystem},
-		{Value: "gen_ai.request.model", Enabled: true, Origin: SpanMapperOriginUser},
-	}
-
-	got := buildProcessorConfig([]*SpanMapperGroupWithMappers{
-		{Group: offGroup, Mappers: []*SpanMapper{newMapper("gen_ai.request.model", FieldContextSpanAttribute, attrSrc("llm.model", SpanMapperOperationCopy, 1))}},
-		{Group: mixed, Mappers: []*SpanMapper{
-			newMapper("gen_ai.request.model", FieldContextSpanAttribute, systemSrc("llm.model", SpanMapperOperationCopy, 10, false)),
-			newMapper("gen_ai.provider.name", FieldContextSpanAttribute, systemSrc("llm.vendor", SpanMapperOperationCopy, 10, true)),
-		}},
-	})
-
-	require.Len(t, got.Groups, 1)
-	assert.Equal(t, "llm", got.Groups[0].ID)
-	assert.Equal(t, []string{"gen_ai.request.model"}, got.Groups[0].ExistsAny.Attributes)
-	require.Len(t, got.Groups[0].Attributes, 1)
-	assert.Equal(t, "gen_ai.provider.name", got.Groups[0].Attributes[0].Target)
-}
-
 func loadFixture(t *testing.T, name string) []byte {
 	t.Helper()
 	b, err := os.ReadFile(filepath.Join("testdata", name))
@@ -217,23 +174,12 @@ func assertYAMLEqual(t *testing.T, want, got []byte) {
 
 func newGroup(name string, attrs, res []string) *SpanMapperGroup {
 	return &SpanMapperGroup{
-		Name: name,
-		Condition: SpanMapperGroupCondition{
-			Attributes: userConditionKeys(attrs),
-			Resource:   userConditionKeys(res),
-		},
-		Enabled: true,
+		Name:      name,
+		Condition: SpanMapperGroupCondition{Attributes: attrs, Resource: res},
+		Enabled:   true,
 	}
 }
 
-func userConditionKeys(values []string) []SpanMapperGroupConditionKey {
-	out := make([]SpanMapperGroupConditionKey, len(values))
-	for i, v := range values {
-		out[i] = SpanMapperGroupConditionKey{Value: v, Enabled: true, Origin: SpanMapperOriginUser}
-	}
-	return out
-}
-
 func newMapper(name string, target FieldContext, sources ...SpanMapperSource) *SpanMapper {
 	return &SpanMapper{
 		Name:         name,
@@ -244,13 +190,9 @@ func newMapper(name string, target FieldContext, sources ...SpanMapperSource) *S
 }
 
 func attrSrc(key string, op SpanMapperOperation, priority int) SpanMapperSource {
-	return SpanMapperSource{Key: key, Context: FieldContextSpanAttribute, Operation: op, Priority: priority, Enabled: true, Origin: SpanMapperOriginUser}
+	return SpanMapperSource{Key: key, Context: FieldContextSpanAttribute, Operation: op, Priority: priority}
 }
 
 func resSrc(key string, op SpanMapperOperation, priority int) SpanMapperSource {
-	return SpanMapperSource{Key: key, Context: FieldContextResource, Operation: op, Priority: priority, Enabled: true, Origin: SpanMapperOriginUser}
-}
-
-func systemSrc(key string, op SpanMapperOperation, priority int, enabled bool) SpanMapperSource {
-	return SpanMapperSource{Key: key, Context: FieldContextSpanAttribute, Operation: op, Priority: priority, Enabled: enabled, Origin: SpanMapperOriginSystem}
+	return SpanMapperSource{Key: key, Context: FieldContextResource, Operation: op, Priority: priority}
 }

pkg/types/spantypes/spanmappersimulator_test.go

@@ -15,14 +15,14 @@ func TestSimulateSpanMappersProcessing_EndToEnd(t *testing.T) {
 	groups := []*SpanMapperGroupWithMappers{{
 		Group: &SpanMapperGroup{
 			Name:      "llm",
-			Condition: SpanMapperGroupCondition{Attributes: userConditionKeys([]string{"model"})},
+			Condition: SpanMapperGroupCondition{Attributes: []string{"model"}},
 			Enabled:   true,
 		},
 		Mappers: []*SpanMapper{{
 			Name:         "gen_ai.request.model",
 			FieldContext: FieldContextSpanAttribute,
 			Config: SpanMapperConfig{Sources: []SpanMapperSource{
-				{Key: "llm.model", Context: FieldContextSpanAttribute, Operation: SpanMapperOperationCopy, Priority: 1, Enabled: true, Origin: SpanMapperOriginUser},
+				{Key: "llm.model", Context: FieldContextSpanAttribute, Operation: SpanMapperOperationCopy, Priority: 1},
 			}},
 			Enabled: true,
 		}},

pkg/types/spantypes/storable.go

@@ -20,9 +20,7 @@ type StorableSpanMapperGroup struct {
 	OrgID     valuer.UUID              `bun:"org_id,type:text,notnull"`
 	Name      string                   `bun:"name,type:text,notnull"`
 	Condition SpanMapperGroupCondition `bun:"condition,type:jsonb,notnull"`
-	Enabled   bool                     `bun:"enabled,notnull"`
-	Origin    SpanMapperOrigin         `bun:"origin,type:text,notnull"`
-	Version   int                      `bun:"version,notnull"`
+	Enabled   bool                     `bun:"enabled,notnull,default:true"`
 }
 
 type StorableSpanMapper struct {
@@ -36,8 +34,7 @@ type StorableSpanMapper struct {
 	Name         string           `bun:"name,type:text,notnull"`
 	FieldContext FieldContext     `bun:"field_context,type:text,notnull"`
 	Config       SpanMapperConfig `bun:"config,type:jsonb,notnull"`
-	Enabled      bool             `bun:"enabled,notnull"`
-	Origin       SpanMapperOrigin `bun:"origin,type:text,notnull"`
+	Enabled      bool             `bun:"enabled,notnull,default:true"`
 }
 
 func (c SpanMapperGroupCondition) Value() (driver.Value, error) {

pkg/types/spantypes/store.go

@@ -9,14 +9,9 @@ import (
 )
 
 type SpanMapperStore interface {
-	// RunInTx runs cb in one transaction; every store call made with the
-	// callback's ctx joins it.
-	RunInTx(ctx context.Context, cb func(ctx context.Context) error) error
-
 	// Group operations
 	ListGroups(ctx context.Context, orgID valuer.UUID, q *ListSpanMapperGroupsQuery) ([]*SpanMapperGroup, error)
 	GetGroup(ctx context.Context, orgID, id valuer.UUID) (*SpanMapperGroup, error)
-	GetGroupByName(ctx context.Context, orgID valuer.UUID, name string) (*SpanMapperGroup, error)
 	CreateGroup(ctx context.Context, group *SpanMapperGroup) error
 	UpdateGroup(ctx context.Context, group *SpanMapperGroup) error
 	DeleteGroup(ctx context.Context, orgID, id valuer.UUID) error

tests/integration/tests/alertmanager/04_notification_channels_v2.py

@@ -10,6 +10,7 @@ from fixtures import types
 from fixtures.auth import (
     USER_ADMIN_EMAIL,
     USER_ADMIN_PASSWORD,
+    create_active_user,
 )
 
 TIMEOUT = 10

tests/integration/tests/spanmapper/01_span_mapper.py

@@ -41,7 +41,7 @@ def test_create_groups_and_simulate_with_backfill(
         },
         json={
             "name": "llm-backfill",
-            "condition": {"attributes": [{"value": "model", "enabled": True}], "resource": []},
+            "condition": {"attributes": ["model"], "resource": []},
             "enabled": True,
         },
     )
@@ -69,7 +69,6 @@ def test_create_groups_and_simulate_with_backfill(
                         "context": "attribute",
                         "operation": "copy",
                         "priority": 1,
-                        "enabled": True,
                     }
                 ]
             },
@@ -127,13 +126,13 @@ def test_create_groups_and_simulate_with_backfill(
                 # No "mappers" key: the server backfills them from the saved group.
                 {
                     "name": "llm-backfill",
-                    "condition": {"attributes": [{"value": "model", "enabled": True}], "resource": []},
+                    "condition": {"attributes": ["model"], "resource": []},
                     "enabled": True,
                 },
                 # Unsaved group; mappers provided inline.
                 {
                     "name": "db-inline",
-                    "condition": {"attributes": [{"value": "db", "enabled": True}], "resource": []},
+                    "condition": {"attributes": ["db"], "resource": []},
                     "enabled": True,
                     "mappers": [
                         {
@@ -146,7 +145,6 @@ def test_create_groups_and_simulate_with_backfill(
                                         "context": "attribute",
                                         "operation": "move",
                                         "priority": 1,
-                                        "enabled": True,
                                     }
                                 ]
                             },

tests/integration/tests/spanmapper/02_default_groups.py

@@ -1,152 +0,0 @@
-from collections.abc import Callable
-from http import HTTPStatus
-
-import requests
-
-from fixtures import types
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-
-GROUPS_PATH = "/api/v1/span_mapper_groups"
-
-
-def test_default_groups_are_seeded_and_shipped_items_are_toggle_only(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-) -> None:
-    """
-    Setup:
-    A fresh org. The reconciler seeds the shipped mapping groups at startup
-    and on org creation, so nothing has to be created here.
-
-    Tests:
-    1. The list contains llm, agent and tool as system groups with shipped
-       substrings
-    2. Shipped mappers and their sources are system-owned and enabled
-    3. A shipped name cannot be taken by a user group, and system groups and
-       mappers cannot be deleted
-    4. A shipped source can be switched off and a user override added; both
-       round-trip through PATCH and the simulator honours them
-    5. A shipped substring can be switched off and a user one added
-    """
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    headers = {"authorization": f"Bearer {token}", "content-type": "application/json"}
-
-    list_groups = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), timeout=10, headers=headers)
-    assert list_groups.status_code == HTTPStatus.OK
-    groups = {g["name"]: g for g in list_groups.json()["data"]["items"]}
-    assert {"llm", "agent", "tool"} <= set(groups)
-    for name in ("llm", "agent", "tool"):
-        assert groups[name]["origin"] == "system"
-        assert groups[name]["version"] >= 1
-        assert groups[name]["createdBy"] == "signoz"
-    llm = groups["llm"]
-    assert llm["condition"]["attributes"] == [{"value": "model", "enabled": True, "origin": "system"}]
-
-    list_mappers = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers"), timeout=10, headers=headers)
-    assert list_mappers.status_code == HTTPStatus.OK
-    mappers = {m["name"]: m for m in list_mappers.json()["data"]["items"]}
-    model = mappers["gen_ai.request.model"]
-    assert model["origin"] == "system"
-    assert model["enabled"] is True
-    assert all(s["origin"] == "system" and s["enabled"] is True for s in model["config"]["sources"])
-    assert "llm.model_name" in [s["key"] for s in model["config"]["sources"]]
-
-    reserved = requests.post(
-        signoz.self.host_configs["8080"].get(GROUPS_PATH),
-        timeout=10,
-        headers=headers,
-        json={"name": "tool", "condition": {"attributes": [{"value": "tool", "enabled": True}], "resource": []}, "enabled": True},
-    )
-    assert reserved.status_code == HTTPStatus.BAD_REQUEST
-    assert reserved.json()["error"]["code"] == "span_attribute_mapping_group_name_reserved"
-
-    delete_group = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}"), timeout=10, headers=headers)
-    assert delete_group.status_code == HTTPStatus.BAD_REQUEST
-    assert delete_group.json()["error"]["code"] == "span_attribute_mapping_group_not_deletable"
-
-    delete_mapper = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers/{model['id']}"), timeout=10, headers=headers)
-    assert delete_mapper.status_code == HTTPStatus.BAD_REQUEST
-    assert delete_mapper.json()["error"]["code"] == "span_attribute_mapper_not_deletable"
-
-    # Switch the shipped llm.model_name source off and re-add it as a user move.
-    sources = [{**s, "enabled": s["key"] != "llm.model_name"} for s in model["config"]["sources"]] + [{"key": "llm.model_name", "context": "attribute", "operation": "move", "priority": 1, "enabled": True}]
-    patch_mapper = requests.patch(
-        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers/{model['id']}"),
-        timeout=10,
-        headers=headers,
-        json={"config": {"sources": sources}},
-    )
-    assert patch_mapper.status_code == HTTPStatus.NO_CONTENT
-
-    list_mappers = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers"), timeout=10, headers=headers)
-    updated = {m["name"]: m for m in list_mappers.json()["data"]["items"]}["gen_ai.request.model"]
-    by_origin = {(s["key"], s["origin"]): s for s in updated["config"]["sources"]}
-    assert by_origin[("llm.model_name", "system")]["enabled"] is False
-    assert by_origin[("llm.model_name", "user")]["operation"] == "move"
-    assert len(updated["config"]["sources"]) == len(model["config"]["sources"]) + 1
-
-    # The user override wins: the source is moved, not copied.
-    simulate = requests.post(
-        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/test"),
-        timeout=10,
-        headers=headers,
-        json={
-            "spans": [{"attributes": {"llm.model_name": "gpt-4o"}, "resource": {}}],
-            "groups": [{"name": "llm", "condition": llm["condition"], "enabled": True}],
-        },
-    )
-    assert simulate.status_code == HTTPStatus.OK
-    attrs = simulate.json()["data"]["spans"][0]["attributes"]
-    assert attrs["gen_ai.request.model"] == "gpt-4o"
-    assert "llm.model_name" not in attrs
-
-    # A shipped substring that does not exist is rejected; toggling one is not.
-    bad_condition = requests.patch(
-        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}"),
-        timeout=10,
-        headers=headers,
-        json={"condition": {"attributes": [{"value": "nope", "enabled": True, "origin": "system"}], "resource": []}},
-    )
-    assert bad_condition.status_code == HTTPStatus.BAD_REQUEST
-
-    patch_group = requests.patch(
-        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}"),
-        timeout=10,
-        headers=headers,
-        json={
-            "condition": {
-                "attributes": [
-                    {"value": "model", "enabled": False, "origin": "system"},
-                    {"value": "gen_ai.request.model", "enabled": True},
-                ],
-                "resource": [],
-            }
-        },
-    )
-    assert patch_group.status_code == HTTPStatus.NO_CONTENT
-
-    list_groups = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), timeout=10, headers=headers)
-    llm_after = {g["name"]: g for g in list_groups.json()["data"]["items"]}["llm"]
-    assert llm_after["condition"]["attributes"] == [
-        {"value": "model", "enabled": False, "origin": "system"},
-        {"value": "gen_ai.request.model", "enabled": True, "origin": "user"},
-    ]
-    assert llm_after["origin"] == "system"
-    assert llm_after["name"] == "llm"
-
-    # Leave the shipped group as seeded for the other suites.
-    restore_group = requests.patch(
-        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}"),
-        timeout=10,
-        headers=headers,
-        json={"condition": {"attributes": [{"value": "model", "enabled": True, "origin": "system"}], "resource": []}},
-    )
-    assert restore_group.status_code == HTTPStatus.NO_CONTENT
-    restore_mapper = requests.patch(
-        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{llm['id']}/span_mappers/{model['id']}"),
-        timeout=10,
-        headers=headers,
-        json={"config": {"sources": model["config"]["sources"]}},
-    )
-    assert restore_mapper.status_code == HTTPStatus.NO_CONTENT