test(authz): mock the useAuthZ hook in the CreateEdit payload suites

.github/workflows/integrationci.yaml

@@ -50,7 +50,6 @@ jobs:
           - logspipelines
           - passwordauthn
           - preference
-          - quickfilter
           - querierlogs
           - queriertraces
           - queriermetrics

cmd/authz.go

@@ -94,6 +94,7 @@ func runGenerateAuthz(_ context.Context) error {
 
 	allowedResources := map[string]bool{
 		coretypes.NewResourceRef(coretypes.ResourceServiceAccount).String():                true,
+		coretypes.NewResourceRef(coretypes.ResourceMetaResourceAuthDomain).String():        true,
 		coretypes.NewResourceRef(coretypes.ResourceRole).String():                          true,
 		coretypes.NewResourceRef(coretypes.ResourceMetaResourceFactorAPIKey).String():      true,
 		coretypes.NewResourceRef(coretypes.ResourceTelemetryResourceLogs).String():         true,

docs/api/openapi.yml

@@ -2559,7 +2559,6 @@ components:
       - factor-api-key
       - license
       - subscription
-      - deployment-host
       - logs
       - traces
       - metrics
@@ -7383,26 +7382,6 @@ components:
       - custom
       - text
       type: string
-    QuickfiltertypesSignalFilters:
-      properties:
-        filters:
-          items:
-            $ref: '#/components/schemas/TelemetrytypesTelemetryFieldKey'
-          nullable: true
-          type: array
-        signal:
-          type: string
-      type: object
-    QuickfiltertypesUpdatableQuickFilters:
-      properties:
-        filters:
-          items:
-            $ref: '#/components/schemas/TelemetrytypesTelemetryFieldKey'
-          nullable: true
-          type: array
-        signal:
-          type: string
-      type: object
     RenderErrorResponse:
       properties:
         error:
@@ -8822,7 +8801,6 @@ components:
       - span
       - trace
       - resource
-      - scope
       - attribute
       - body
       - ""
@@ -15490,8 +15468,10 @@ paths:
                 $ref: '#/components/schemas/RenderErrorResponse'
           description: Internal Server Error
       security:
-      - api_key: []
-      - tokenizer: []
+      - api_key:
+        - VIEWER
+      - tokenizer:
+        - VIEWER
       summary: Get features
       tags:
       - features
@@ -18339,165 +18319,6 @@ paths:
       summary: Get query range result (v2)
       tags:
       - dashboard
-  /api/v2/quick_filters:
-    get:
-      deprecated: false
-      description: Returns the org's quick filters for every signal, each filter as
-        a telemetry field key.
-      operationId: ListQuickFilters
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    items:
-                      $ref: '#/components/schemas/QuickfiltertypesSignalFilters'
-                    nullable: true
-                    type: array
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - quick-filter:list
-      - tokenizer:
-        - quick-filter:list
-      summary: List quick filters
-      tags:
-      - quick_filter
-    put:
-      deprecated: false
-      description: Replaces the org's quick filters for the signal named in the body.
-      operationId: UpdateQuickFilters
-      requestBody:
-        content:
-          application/json:
-            schema:
-              $ref: '#/components/schemas/QuickfiltertypesUpdatableQuickFilters'
-      responses:
-        "204":
-          description: No Content
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - quick-filter:update
-      - tokenizer:
-        - quick-filter:update
-      summary: Update quick filters
-      tags:
-      - quick_filter
-  /api/v2/quick_filters/{signal_name}:
-    get:
-      deprecated: false
-      description: Returns the org's quick filters for one signal, each filter as
-        a telemetry field key.
-      operationId: GetQuickFilters
-      parameters:
-      - in: path
-        name: signal_name
-        required: true
-        schema:
-          type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/QuickfiltertypesSignalFilters'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "400":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Bad Request
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - quick-filter:read
-      - tokenizer:
-        - quick-filter:read
-      summary: Get a signal's quick filters
-      tags:
-      - quick_filter
   /api/v2/readyz:
     get:
       operationId: Readyz
@@ -24122,9 +23943,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - deployment-host:list
+        - VIEWER
       - tokenizer:
-        - deployment-host:list
+        - VIEWER
       summary: Get host info from Zeus.
       tags:
       - zeus
@@ -24178,9 +23999,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - deployment-host:update
+        - ADMIN
       - tokenizer:
-        - deployment-host:update
+        - ADMIN
       summary: Put host in Zeus for a deployment.
       tags:
       - zeus

ee/query-service/app/api/api.go

@@ -67,7 +67,7 @@ func (ah *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 	// note: add ee override methods first
 
 	// routes available only in ee version
-	router.HandleFunc("/api/v1/features", am.OpenAccess(ah.getFeatureFlags)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v1/features", am.ViewAccess(ah.getFeatureFlags)).Methods(http.MethodGet)
 
 	// base overrides
 	router.HandleFunc("/api/v1/version", am.OpenAccess(ah.getVersion)).Methods(http.MethodGet)

frontend/src/AppRoutes/__tests__/Private.test.tsx

@@ -1541,6 +1541,7 @@ describe('PrivateRoute', () => {
 				path: ROUTES.SERVICE_ACCOUNTS_SETTINGS,
 				deniedRoles: DENIED_ROLES,
 			},
+			ORG_SETTINGS: { path: ROUTES.ORG_SETTINGS, deniedRoles: DENIED_ROLES },
 			TRACES_EXPLORER: { path: ROUTES.TRACES_EXPLORER, deniedRoles: DENIED_ROLES },
 			TRACE: { path: ROUTES.TRACE, deniedRoles: DENIED_ROLES },
 			TRACE_DETAIL: {

frontend/src/api/generated/services/quick-filter/index.ts

@@ -1,298 +0,0 @@
-/**
- * ! Do not edit manually
- * * The file has been auto-generated using Orval for SigNoz
- * * regenerate with 'pnpm generate:api'
- * SigNoz
- */
-import { useMutation, useQuery } from 'react-query';
-import type {
-	InvalidateOptions,
-	MutationFunction,
-	QueryClient,
-	QueryFunction,
-	QueryKey,
-	UseMutationOptions,
-	UseMutationResult,
-	UseQueryOptions,
-	UseQueryResult,
-} from 'react-query';
-
-import type {
-	GetQuickFilters200,
-	GetQuickFiltersPathParameters,
-	ListQuickFilters200,
-	QuickfiltertypesUpdatableQuickFiltersDTO,
-	RenderErrorResponseDTO,
-} from '../sigNoz.schemas';
-
-import { GeneratedAPIInstance } from '../../../generatedAPIInstance';
-import type { ErrorType, BodyType } from '../../../generatedAPIInstance';
-
-/**
- * Returns the org's quick filters for every signal, each filter as a telemetry field key.
- * @summary List quick filters
- */
-export const listQuickFilters = (signal?: AbortSignal) => {
-	return GeneratedAPIInstance<ListQuickFilters200>({
-		url: `/api/v2/quick_filters`,
-		method: 'GET',
-		signal,
-	});
-};
-
-export const getListQuickFiltersQueryKey = () => {
-	return [`/api/v2/quick_filters`] as const;
-};
-
-export const getListQuickFiltersQueryOptions = <
-	TData = Awaited<ReturnType<typeof listQuickFilters>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(options?: {
-	query?: UseQueryOptions<
-		Awaited<ReturnType<typeof listQuickFilters>>,
-		TError,
-		TData
-	>;
-}) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey = queryOptions?.queryKey ?? getListQuickFiltersQueryKey();
-
-	const queryFn: QueryFunction<Awaited<ReturnType<typeof listQuickFilters>>> = ({
-		signal,
-	}) => listQuickFilters(signal);
-
-	return { queryKey, queryFn, ...queryOptions } as UseQueryOptions<
-		Awaited<ReturnType<typeof listQuickFilters>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type ListQuickFiltersQueryResult = NonNullable<
-	Awaited<ReturnType<typeof listQuickFilters>>
->;
-export type ListQuickFiltersQueryError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary List quick filters
- */
-
-export function useListQuickFilters<
-	TData = Awaited<ReturnType<typeof listQuickFilters>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(options?: {
-	query?: UseQueryOptions<
-		Awaited<ReturnType<typeof listQuickFilters>>,
-		TError,
-		TData
-	>;
-}): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getListQuickFiltersQueryOptions(options);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return { ...query, queryKey: queryOptions.queryKey };
-}
-
-/**
- * @summary List quick filters
- */
-export const invalidateListQuickFilters = async (
-	queryClient: QueryClient,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getListQuickFiltersQueryKey() },
-		options,
-	);
-
-	return queryClient;
-};
-
-/**
- * Replaces the org's quick filters for the signal named in the body.
- * @summary Update quick filters
- */
-export const updateQuickFilters = (
-	quickfiltertypesUpdatableQuickFiltersDTO?: BodyType<QuickfiltertypesUpdatableQuickFiltersDTO>,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<void>({
-		url: `/api/v2/quick_filters`,
-		method: 'PUT',
-		headers: { 'Content-Type': 'application/json' },
-		data: quickfiltertypesUpdatableQuickFiltersDTO,
-		signal,
-	});
-};
-
-export const getUpdateQuickFiltersMutationOptions = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof updateQuickFilters>>,
-		TError,
-		{ data?: BodyType<QuickfiltertypesUpdatableQuickFiltersDTO> },
-		TContext
-	>;
-}): UseMutationOptions<
-	Awaited<ReturnType<typeof updateQuickFilters>>,
-	TError,
-	{ data?: BodyType<QuickfiltertypesUpdatableQuickFiltersDTO> },
-	TContext
-> => {
-	const mutationKey = ['updateQuickFilters'];
-	const { mutation: mutationOptions } = options
-		? options.mutation &&
-			'mutationKey' in options.mutation &&
-			options.mutation.mutationKey
-			? options
-			: { ...options, mutation: { ...options.mutation, mutationKey } }
-		: { mutation: { mutationKey } };
-
-	const mutationFn: MutationFunction<
-		Awaited<ReturnType<typeof updateQuickFilters>>,
-		{ data?: BodyType<QuickfiltertypesUpdatableQuickFiltersDTO> }
-	> = (props) => {
-		const { data } = props ?? {};
-
-		return updateQuickFilters(data);
-	};
-
-	return { mutationFn, ...mutationOptions };
-};
-
-export type UpdateQuickFiltersMutationResult = NonNullable<
-	Awaited<ReturnType<typeof updateQuickFilters>>
->;
-export type UpdateQuickFiltersMutationBody =
-	| BodyType<QuickfiltertypesUpdatableQuickFiltersDTO>
-	| undefined;
-export type UpdateQuickFiltersMutationError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Update quick filters
- */
-export const useUpdateQuickFilters = <
-	TError = ErrorType<RenderErrorResponseDTO>,
-	TContext = unknown,
->(options?: {
-	mutation?: UseMutationOptions<
-		Awaited<ReturnType<typeof updateQuickFilters>>,
-		TError,
-		{ data?: BodyType<QuickfiltertypesUpdatableQuickFiltersDTO> },
-		TContext
-	>;
-}): UseMutationResult<
-	Awaited<ReturnType<typeof updateQuickFilters>>,
-	TError,
-	{ data?: BodyType<QuickfiltertypesUpdatableQuickFiltersDTO> },
-	TContext
-> => {
-	return useMutation(getUpdateQuickFiltersMutationOptions(options));
-};
-/**
- * Returns the org's quick filters for one signal, each filter as a telemetry field key.
- * @summary Get a signal's quick filters
- */
-export const getQuickFilters = (
-	{ signalName }: GetQuickFiltersPathParameters,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<GetQuickFilters200>({
-		url: `/api/v2/quick_filters/${signalName}`,
-		method: 'GET',
-		signal,
-	});
-};
-
-export const getGetQuickFiltersQueryKey = ({
-	signalName,
-}: GetQuickFiltersPathParameters) => {
-	return [`/api/v2/quick_filters/${signalName}`] as const;
-};
-
-export const getGetQuickFiltersQueryOptions = <
-	TData = Awaited<ReturnType<typeof getQuickFilters>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ signalName }: GetQuickFiltersPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getQuickFilters>>,
-			TError,
-			TData
-		>;
-	},
-) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey =
-		queryOptions?.queryKey ?? getGetQuickFiltersQueryKey({ signalName });
-
-	const queryFn: QueryFunction<Awaited<ReturnType<typeof getQuickFilters>>> = ({
-		signal,
-	}) => getQuickFilters({ signalName }, signal);
-
-	return {
-		queryKey,
-		queryFn,
-		enabled: !!signalName,
-		...queryOptions,
-	} as UseQueryOptions<
-		Awaited<ReturnType<typeof getQuickFilters>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type GetQuickFiltersQueryResult = NonNullable<
-	Awaited<ReturnType<typeof getQuickFilters>>
->;
-export type GetQuickFiltersQueryError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Get a signal's quick filters
- */
-
-export function useGetQuickFilters<
-	TData = Awaited<ReturnType<typeof getQuickFilters>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ signalName }: GetQuickFiltersPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getQuickFilters>>,
-			TError,
-			TData
-		>;
-	},
-): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getGetQuickFiltersQueryOptions({ signalName }, options);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return { ...query, queryKey: queryOptions.queryKey };
-}
-
-/**
- * @summary Get a signal's quick filters
- */
-export const invalidateGetQuickFilters = async (
-	queryClient: QueryClient,
-	{ signalName }: GetQuickFiltersPathParameters,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getGetQuickFiltersQueryKey({ signalName }) },
-		options,
-	);
-
-	return queryClient;
-};

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -2175,7 +2175,6 @@ export enum CoretypesKindDTO {
 	'factor-api-key' = 'factor-api-key',
 	license = 'license',
 	subscription = 'subscription',
-	'deployment-host' = 'deployment-host',
 	logs = 'logs',
 	traces = 'traces',
 	metrics = 'metrics',
@@ -3493,7 +3492,6 @@ export enum TelemetrytypesFieldContextDTO {
 	span = 'span',
 	trace = 'trace',
 	resource = 'resource',
-	scope = 'scope',
 	attribute = 'attribute',
 	body = 'body',
 	'' = '',
@@ -8437,28 +8435,6 @@ export enum Querybuildertypesv5QueryTypeDTO {
 	clickhouse_sql = 'clickhouse_sql',
 	promql = 'promql',
 }
-export interface QuickfiltertypesSignalFiltersDTO {
-	/**
-	 * @type array,null
-	 */
-	filters?: TelemetrytypesTelemetryFieldKeyDTO[] | null;
-	/**
-	 * @type string
-	 */
-	signal?: string;
-}
-
-export interface QuickfiltertypesUpdatableQuickFiltersDTO {
-	/**
-	 * @type array,null
-	 */
-	filters?: TelemetrytypesTelemetryFieldKeyDTO[] | null;
-	/**
-	 * @type string
-	 */
-	signal?: string;
-}
-
 export interface RenderErrorResponseDTO {
 	error: ErrorsJSONDTO;
 	/**
@@ -11849,28 +11825,6 @@ export type GetPublicDashboardPanelQueryRangeV2200 = {
 	status: string;
 };
 
-export type ListQuickFilters200 = {
-	/**
-	 * @type array,null
-	 */
-	data: QuickfiltertypesSignalFiltersDTO[] | null;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
-export type GetQuickFiltersPathParameters = {
-	signalName: string;
-};
-export type GetQuickFilters200 = {
-	data: QuickfiltertypesSignalFiltersDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
 export type Readyz200 = {
 	data: FactoryResponseDTO;
 	/**

frontend/src/components/ExplorerCard/ExplorerCard.tsx

@@ -7,8 +7,9 @@ import axios from 'axios';
 import TextToolTip from 'components/TextToolTip';
 import { SOMETHING_WENT_WRONG } from 'constants/api';
 import { LOCALSTORAGE } from 'constants/localStorage';
+import { QueryParams } from 'constants/query';
 import { useOptionsMenu } from 'container/OptionsMenu';
-import { useGetSavedViewParams } from 'hooks/saveViews/useGetSavedViewParams';
+import { useGetSearchQueryParam } from 'hooks/queryBuilder/useGetSearchQueryParam';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { useDeleteView } from 'hooks/saveViews/useDeleteView';
 import { useGetAllViews } from 'hooks/saveViews/useGetAllViews';
@@ -68,7 +69,9 @@ function ExplorerCard({
 		setIsOpen(newOpen);
 	};
 
-	const { viewName, viewKey } = useGetSavedViewParams();
+	const viewName = useGetSearchQueryParam(QueryParams.viewName) || '';
+
+	const viewKey = useGetSearchQueryParam(QueryParams.viewKey) || '';
 
 	const { options } = useOptionsMenu({
 		storageKey:

frontend/src/components/ExplorerCard/constants.ts

@@ -1,3 +1,5 @@
+import { QueryParams } from 'constants/query';
+
 export const ExploreHeaderToolTip = {
 	url: 'https://signoz.io/docs/querying/overview/?utm_source=product&utm_medium=new-query-builder',
 	text: 'More details on how to use query builder',
@@ -7,3 +9,5 @@ export const SaveButtonText = {
 	SAVE_AS_NEW_VIEW: 'Save as new view',
 	SAVE_VIEW: 'Save view',
 };
+
+export type QuerySearchParamNames = QueryParams.viewName | QueryParams.viewKey;

frontend/src/components/QueryBuilderV2/QueryBuilderV2.tsx

@@ -241,29 +241,28 @@ export const QueryBuilderV2 = memo(function QueryBuilderV2({
 						))
 					)}
 
-					{!showOnlyWhereClause &&
-						currentQuery.builder.queryFormulas?.length > 0 && (
-							<div className="qb-formulas-container">
-								{currentQuery.builder.queryFormulas.map((formula, index) => {
-									const query =
-										currentQuery.builder.queryData[index] ||
-										currentQuery.builder.queryData[0];
+					{!showOnlyWhereClause && currentQuery.builder.queryFormulas.length > 0 && (
+						<div className="qb-formulas-container">
+							{currentQuery.builder.queryFormulas.map((formula, index) => {
+								const query =
+									currentQuery.builder.queryData[index] ||
+									currentQuery.builder.queryData[0];
 
-									return (
-										<div key={formula.queryName} className="qb-formula">
-											<Formula
-												filterConfigs={filterConfigs}
-												query={query}
-												formula={formula}
-												index={index}
-												isAdditionalFilterEnable={false}
-												isQBV2
-											/>
-										</div>
-									);
-								})}
-							</div>
-						)}
+								return (
+									<div key={formula.queryName} className="qb-formula">
+										<Formula
+											filterConfigs={filterConfigs}
+											query={query}
+											formula={formula}
+											index={index}
+											isAdditionalFilterEnable={false}
+											isQBV2
+										/>
+									</div>
+								);
+							})}
+						</div>
+					)}
 
 					{shouldShowFooter && (
 						<QueryFooter
@@ -291,7 +290,7 @@ export const QueryBuilderV2 = memo(function QueryBuilderV2({
 							</div>
 						))}
 
-						{currentQuery.builder.queryFormulas?.map((formula) => (
+						{currentQuery.builder.queryFormulas.map((formula) => (
 							<div key={formula.queryName} className="formula-name">
 								{formula.queryName}
 							</div>

frontend/src/components/QueryBuilderV2/QueryV2/__tests__/QueryV2.test.tsx

@@ -212,32 +212,6 @@ describe('QueryBuilderV2 + QueryV2 - base render', () => {
 		expect(handleRunQueryMock).toHaveBeenCalled();
 	});
 
-	it('does not crash when builder.queryFormulas/queryTraceOperator are missing (partial/legacy query)', () => {
-		const currentQueryBase = baseQBContext.currentQuery as Query;
-
-		mockedUseQueryBuilder.mockReturnValue({
-			...baseQBContext,
-			currentQuery: {
-				...currentQueryBase,
-				builder: {
-					queryData: currentQueryBase.builder.queryData,
-					queryFormulas: undefined as unknown as [],
-					queryTraceOperator: undefined as unknown as [],
-				},
-			},
-		});
-
-		expect(() =>
-			render(<QueryBuilderV2 panelType={PANEL_TYPES.TABLE} version="v4" />),
-		).not.toThrow();
-
-		// query list still renders from queryData, formulas block is skipped
-		expect(document.querySelector('.query-names-section')).toBeInTheDocument();
-		expect(
-			document.querySelector('.qb-formulas-container'),
-		).not.toBeInTheDocument();
-	});
-
 	it('fx button is disabled when functions already exist', () => {
 		const currentQueryBase = baseQBContext.currentQuery as Query;
 		const supersetQueryBase = baseQBContext.supersetQuery as Query;

frontend/src/components/ServiceAccountDrawer/__tests__/ServiceAccountDrawer.authz.test.tsx

@@ -4,7 +4,7 @@ import {
 } from 'mocks-server/__mockdata__/roles';
 import { rest, server } from 'mocks-server/server';
 import { NuqsTestingAdapter } from 'nuqs/adapters/testing';
-import { render, screen, waitFor } from 'tests/test-utils';
+import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
 import {
 	setupAuthzAdmin,
 	setupAuthzDeny,
@@ -110,7 +110,10 @@ describe('ServiceAccountDrawer — permissions', () => {
 	it('shows PermissionDeniedCallout in Keys tab when list-keys permission is denied', async () => {
 		server.use(setupAuthzDeny(APIKeyListPermission));
 
-		renderDrawer({ account: 'sa-1', tab: 'keys' });
+		renderDrawer();
+		await screen.findByDisplayValue('CI Bot');
+
+		fireEvent.click(screen.getByRole('radio', { name: /keys/i }));
 
 		await waitFor(() => {
 			expect(screen.getByText(/list:factor-api-key/)).toBeInTheDocument();

frontend/src/container/AlertHistory/Timeline/Table/utils.ts

@@ -10,7 +10,6 @@ const fieldContextToSuggestionMap: Record<
 	[TelemetrytypesFieldContextDTO.attribute]: 'attribute',
 	// no maps for the following values on suggestion context
 	[TelemetrytypesFieldContextDTO.trace]: undefined,
-	[TelemetrytypesFieldContextDTO.scope]: undefined,
 	[TelemetrytypesFieldContextDTO.body]: undefined,
 	[TelemetrytypesFieldContextDTO.metric]: undefined,
 	[TelemetrytypesFieldContextDTO.log]: undefined,

frontend/src/container/ExplorerOptions/ExplorerOptions.tsx

@@ -54,7 +54,7 @@ import {
 } from 'container/OptionsMenu/constants';
 import { OptionsQuery } from 'container/OptionsMenu/types';
 import { ExportDashboard } from 'hooks/dashboard/useExportDashboards';
-import { useGetSavedViewParams } from 'hooks/saveViews/useGetSavedViewParams';
+import { useGetSearchQueryParam } from 'hooks/queryBuilder/useGetSearchQueryParam';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { useGetAllViews } from 'hooks/saveViews/useGetAllViews';
 import { useSaveView } from 'hooks/saveViews/useSaveView';
@@ -287,7 +287,8 @@ function ExplorerOptions({
 
 	const compositeQuery = mapCompositeQueryFromQuery(currentQuery, panelType);
 
-	const { viewName, viewKey } = useGetSavedViewParams();
+	const viewName = useGetSearchQueryParam(QueryParams.viewName) || '';
+	const viewKey = useGetSearchQueryParam(QueryParams.viewKey) || '';
 
 	const extraData = viewsData?.data?.data?.find(
 		(view) => view.id === viewKey,

frontend/src/container/FormAlertRules/utils.ts

@@ -53,24 +53,17 @@ export const getUpdatedStepInterval = (evalWindow?: string): number => {
 };
 
 export const getSelectedQueryOptions = (
-	queries:
-		| Array<
-				| IBuilderQuery
-				| IBuilderTraceOperator
-				| IBuilderFormula
-				| IClickHouseQuery
-				| IPromQLQuery
-		  >
-		| undefined
-		| null,
-): SelectProps['options'] => {
-	if (!queries) {
-		return [];
-	}
-	return queries
+	queries: Array<
+		| IBuilderQuery
+		| IBuilderTraceOperator
+		| IBuilderFormula
+		| IClickHouseQuery
+		| IPromQLQuery
+	>,
+): SelectProps['options'] =>
+	queries
 		.filter((query) => !query.disabled)
 		.map((query) => ({
 			label: 'queryName' in query ? query.queryName : query.name,
 			value: 'queryName' in query ? query.queryName : query.name,
 		}));
-};

frontend/src/container/LogDetailedView/BodyTitleRenderer.tsx

@@ -15,8 +15,9 @@ import {
 	QUERY_BUILDER_FUNCTIONS,
 } from 'constants/antlrQueryConstants';
 import { FeatureKeys } from 'constants/features';
+import { QueryParams } from 'constants/query';
 import { useActiveLog } from 'hooks/logs/useActiveLog';
-import { useGetSavedViewParams } from 'hooks/saveViews/useGetSavedViewParams';
+import { useGetSearchQueryParam } from 'hooks/queryBuilder/useGetSearchQueryParam';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { ICurrentQueryData } from 'hooks/useHandleExplorerTabChange';
 import { useNotifications } from 'hooks/useNotifications';
@@ -49,7 +50,7 @@ function BodyTitleRenderer({
 	const { featureFlags } = useAppContext();
 	const [, setCopy] = useCopyToClipboard();
 	const { notifications } = useNotifications();
-	const { viewName } = useGetSavedViewParams();
+	const viewName = useGetSearchQueryParam(QueryParams.viewName) || '';
 
 	const cleanedNodeKey = removeObjectFromString(nodeKey);
 	const isBodyJsonQueryEnabled =

frontend/src/container/LogDetailedView/TableView/TableViewActions.tsx

@@ -7,12 +7,13 @@ import GroupByIcon from 'assets/CustomIcons/GroupByIcon';
 import cx from 'classnames';
 import CopyClipboardHOC from 'components/Logs/CopyClipboardHOC';
 import { DATE_TIME_FORMATS } from 'constants/dateTimeFormats';
+import { QueryParams } from 'constants/query';
 import { OPERATORS } from 'constants/queryBuilder';
 import ROUTES from 'constants/routes';
 import { ChangeViewFunctionType } from 'container/ExplorerOptions/types';
 import { RESTRICTED_SELECTED_FIELDS } from 'container/LogsFilters/config';
 import { MetricsType } from 'container/MetricsApplication/constant';
-import { useGetSavedViewParams } from 'hooks/saveViews/useGetSavedViewParams';
+import { useGetSearchQueryParam } from 'hooks/queryBuilder/useGetSearchQueryParam';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { ICurrentQueryData } from 'hooks/useHandleExplorerTabChange';
 import {
@@ -140,7 +141,7 @@ export default function TableViewActions(
 
 	const { pathname } = useLocation();
 	const { stagedQuery, updateQueriesData } = useQueryBuilder();
-	const { viewName } = useGetSavedViewParams();
+	const viewName = useGetSearchQueryParam(QueryParams.viewName) || '';
 	const { dataType, logType: fieldType } = getFieldAttributes(record.field);
 
 	// there is no option for where clause in old logs explorer and live logs page or infra monitoring

frontend/src/container/LogDetailedView/TableView/__test__/TableViewActions.test.tsx

@@ -1,6 +1,6 @@
 import { fireEvent, render, screen } from '@testing-library/react';
 import { RESTRICTED_SELECTED_FIELDS } from 'container/LogsFilters/config';
-import { useGetSavedViewParams } from 'hooks/saveViews/useGetSavedViewParams';
+import { useGetSearchQueryParam } from 'hooks/queryBuilder/useGetSearchQueryParam';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { ExplorerViews } from 'pages/LogsExplorer/utils';
 
@@ -88,7 +88,7 @@ jest.mock('react-router-dom', () => ({
 }));
 
 jest.mock('hooks/queryBuilder/useQueryBuilder');
-jest.mock('hooks/saveViews/useGetSavedViewParams');
+jest.mock('hooks/queryBuilder/useGetSearchQueryParam');
 
 describe('TableViewActions', () => {
 	const TEST_VALUE = 'test value';
@@ -140,10 +140,8 @@ describe('TableViewActions', () => {
 			}),
 		} as any);
 
-		// Default mock for useGetSavedViewParams
-		jest
-			.mocked(useGetSavedViewParams)
-			.mockReturnValue({ viewName: '', viewKey: '' });
+		// Default mock for useGetSearchQueryParam
+		jest.mocked(useGetSearchQueryParam).mockReturnValue(null);
 	});
 
 	it('should render without crashing', () => {
@@ -251,9 +249,7 @@ describe('TableViewActions', () => {
 			updateQueriesData: mockUpdateQueriesData,
 		} as any);
 
-		jest
-			.mocked(useGetSavedViewParams)
-			.mockReturnValue({ viewName: '', viewKey: '' });
+		jest.mocked(useGetSearchQueryParam).mockReturnValue(null);
 
 		render(
 			<TableViewActions

frontend/src/container/LogDetailedView/hooks/useLogAttributeActions.tsx

@@ -3,9 +3,10 @@ import { useLocation } from 'react-router-dom';
 import { CircleMinus, CirclePlus, Layers, RefreshCw } from '@signozhq/icons';
 import { convertFiltersToExpression } from 'components/QueryBuilderV2/utils';
 import { FeatureKeys } from 'constants/features';
+import { QueryParams } from 'constants/query';
 import ROUTES from 'constants/routes';
 import { ChangeViewFunctionType } from 'container/ExplorerOptions/types';
-import { useGetSavedViewParams } from 'hooks/saveViews/useGetSavedViewParams';
+import { useGetSearchQueryParam } from 'hooks/queryBuilder/useGetSearchQueryParam';
 import { useQueryBuilder } from 'hooks/queryBuilder/useQueryBuilder';
 import { ICurrentQueryData } from 'hooks/useHandleExplorerTabChange';
 import { ExplorerViews } from 'pages/LogsExplorer/utils';
@@ -57,7 +58,7 @@ export function useLogAttributeActions({
 	const { pathname } = useLocation();
 	const { stagedQuery, updateQueriesData } = useQueryBuilder();
 	const { featureFlags } = useAppContext();
-	const { viewName } = useGetSavedViewParams();
+	const viewName = useGetSearchQueryParam(QueryParams.viewName) || '';
 
 	const isBodyJsonQueryEnabled =
 		featureFlags?.find((flag) => flag.name === FeatureKeys.USE_JSON_BODY)

frontend/src/container/OrganizationSettings/AuthDomain/CreateEdit/CreateEdit.tsx

@@ -14,6 +14,8 @@ import {
 } from 'api/generated/services/sigNoz.schemas';
 import { AxiosError } from 'axios';
 import { FeatureKeys } from 'constants/features';
+import AuthZButton from 'lib/authz/components/AuthZButton/AuthZButton';
+import { buildAuthDomainUpdatePermission } from 'lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions';
 import { defaultTo } from 'lodash-es';
 import { useAppContext } from 'providers/App/App';
 import { useErrorModal } from 'providers/ErrorModalProvider';
@@ -209,7 +211,11 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 									Cancel
 								</Button>
 							)}
-							<Button
+							<AuthZButton
+								checks={
+									isCreate ? [] : [buildAuthDomainUpdatePermission(record?.id ?? '')]
+								}
+								withPortal={false}
 								onClick={onSubmitHandler}
 								variant="solid"
 								color="primary"
@@ -217,7 +223,7 @@ function CreateOrEdit(props: CreateOrEditProps): JSX.Element {
 								testId="auth-domain-save"
 							>
 								Save Changes
-							</Button>
+							</AuthZButton>
 						</section>
 					</div>
 				)}

frontend/src/container/OrganizationSettings/AuthDomain/SSOEnforcementToggle.tsx

@@ -7,6 +7,8 @@ import {
 	RenderErrorResponseDTO,
 } from 'api/generated/services/sigNoz.schemas';
 import { AxiosError } from 'axios';
+import AuthZTooltip from 'lib/authz/components/AuthZTooltip/AuthZTooltip';
+import { buildAuthDomainUpdatePermission } from 'lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions';
 import { useErrorModal } from 'providers/ErrorModalProvider';
 import { ErrorV2Resp } from 'types/api';
 import APIError from 'types/api/error';
@@ -60,12 +62,14 @@ function SSOEnforcementToggle({
 	};
 
 	return (
-		<Switch
-			disabled={isLoading}
-			value={isChecked}
-			onChange={onChangeHandler}
-			testId="auth-domain-enforce-sso"
-		/>
+		<AuthZTooltip checks={[buildAuthDomainUpdatePermission(record.id ?? '')]}>
+			<Switch
+				disabled={isLoading}
+				value={isChecked}
+				onChange={onChangeHandler}
+				testId="auth-domain-enforce-sso"
+			/>
+		</AuthZTooltip>
 	);
 }
 

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/AuthDomain.authz.test.tsx

@@ -0,0 +1,164 @@
+import {
+	AuthDomainListPermission,
+	buildAuthDomainDeletePermission,
+} from 'lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions';
+import {
+	AUTHZ_CHECK_URL,
+	setupAuthzAdmin,
+	setupAuthzAllow,
+	setupAuthzDenyAll,
+	setupAuthzGrantByPrefix,
+} from 'lib/authz/utils/authz-test-utils';
+import { rest, server } from 'mocks-server/server';
+import { render, screen, userEvent, waitFor } from 'tests/test-utils';
+
+import AuthDomain from '../index';
+import { AUTH_DOMAINS_LIST_ENDPOINT, mockDomainsListResponse } from './mocks';
+
+function setupListHandler(): void {
+	server.use(
+		rest.get(AUTH_DOMAINS_LIST_ENDPOINT, (_, res, ctx) =>
+			res(ctx.status(200), ctx.json(mockDomainsListResponse)),
+		),
+	);
+}
+
+describe('AuthDomain authz', () => {
+	afterEach(() => {
+		server.resetHandlers();
+	});
+
+	describe('when all permissions are denied', () => {
+		it('disables the add button and blocks the table with a callout', async () => {
+			server.use(setupAuthzDenyAll());
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await waitFor(() => {
+				expect(screen.getByTestId('auth-domain-add')).toBeDisabled();
+			});
+
+			await expect(
+				screen.findByText(/is not authorized to perform/i),
+			).resolves.toBeInTheDocument();
+			expect(screen.getByText('list:auth-domain:*')).toBeInTheDocument();
+			expect(screen.queryByText('signoz.io')).not.toBeInTheDocument();
+		});
+	});
+
+	describe('when only list is granted', () => {
+		it('renders rows but disables the row actions and the add button', async () => {
+			server.use(setupAuthzGrantByPrefix('list'));
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await expect(screen.findByText('signoz.io')).resolves.toBeInTheDocument();
+
+			await waitFor(() => {
+				expect(screen.getByTestId('auth-domain-add')).toBeDisabled();
+			});
+
+			screen.getAllByTestId('auth-domain-configure').forEach((button) => {
+				expect(button).toBeDisabled();
+			});
+			screen.getAllByTestId('auth-domain-delete').forEach((button) => {
+				expect(button).toBeDisabled();
+			});
+			screen.getAllByRole('switch').forEach((toggle) => {
+				expect(toggle).toBeDisabled();
+			});
+		});
+	});
+
+	describe('when all permissions are granted', () => {
+		it('keeps every control interactive', async () => {
+			server.use(setupAuthzAdmin());
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await expect(screen.findByText('signoz.io')).resolves.toBeInTheDocument();
+
+			expect(screen.getByTestId('auth-domain-add')).toBeEnabled();
+			await waitFor(() => {
+				screen.getAllByTestId('auth-domain-configure').forEach((button) => {
+					expect(button).toBeEnabled();
+				});
+			});
+			screen.getAllByTestId('auth-domain-delete').forEach((button) => {
+				expect(button).toBeEnabled();
+			});
+			screen.getAllByRole('switch').forEach((toggle) => {
+				expect(toggle).toBeEnabled();
+			});
+		});
+	});
+
+	describe('when read is granted but update is not', () => {
+		it('keeps configure clickable and disables save inside the modal', async () => {
+			const user = userEvent.setup({ pointerEventsCheck: 0 });
+			server.use(setupAuthzGrantByPrefix('list', 'read'));
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await expect(screen.findByText('signoz.io')).resolves.toBeInTheDocument();
+
+			const configureButtons = screen.getAllByTestId('auth-domain-configure');
+			await waitFor(() => {
+				expect(configureButtons[0]).toBeEnabled();
+			});
+			await user.click(configureButtons[0]);
+
+			await screen.findByTestId('auth-domain-save');
+			await waitFor(() => {
+				const saveButton = screen.getByTestId('auth-domain-save');
+				expect(saveButton).toBeDisabled();
+				expect(saveButton).toHaveAttribute('data-denied-permissions');
+			});
+		});
+	});
+
+	describe('when delete is granted on a single domain', () => {
+		it('enables delete only for that row', async () => {
+			server.use(
+				setupAuthzAllow(
+					AuthDomainListPermission,
+					buildAuthDomainDeletePermission('domain-1'),
+				),
+			);
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await expect(screen.findByText('signoz.io')).resolves.toBeInTheDocument();
+
+			const deleteButtons = screen.getAllByTestId('auth-domain-delete');
+			expect(deleteButtons).toHaveLength(3);
+
+			// Row order follows mockDomainsListResponse: domain-1, domain-2, domain-3
+			await waitFor(() => {
+				expect(deleteButtons[0]).toBeEnabled();
+			});
+			expect(deleteButtons[1]).toBeDisabled();
+			expect(deleteButtons[2]).toBeDisabled();
+		});
+	});
+
+	describe('while permission checks are loading', () => {
+		it('keeps the add button disabled', async () => {
+			server.use(
+				rest.post(AUTHZ_CHECK_URL, (_req, res, ctx) => res(ctx.delay('infinite'))),
+			);
+			setupListHandler();
+
+			render(<AuthDomain />);
+
+			await waitFor(() => {
+				expect(screen.getByTestId('auth-domain-add')).toBeDisabled();
+			});
+		});
+	});
+});

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/AuthDomain.test.tsx

@@ -1,3 +1,4 @@
+import { setupAuthzAdmin } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 import { render, screen, userEvent, waitFor } from 'tests/test-utils';
 
@@ -20,6 +21,7 @@ jest.mock('@signozhq/ui/sonner', () => ({
 describe('AuthDomain', () => {
 	beforeEach(() => {
 		jest.clearAllMocks();
+		server.use(setupAuthzAdmin());
 	});
 
 	afterEach(() => {
@@ -122,6 +124,9 @@ describe('AuthDomain', () => {
 			render(<AuthDomain />);
 
 			const addButton = await screen.findByRole('button', { name: /add domain/i });
+			await waitFor(() => {
+				expect(addButton).toBeEnabled();
+			});
 			await user.click(addButton);
 
 			await waitFor(() => {
@@ -148,8 +153,13 @@ describe('AuthDomain', () => {
 				expect(screen.getByText('signoz.io')).toBeInTheDocument();
 			});
 
-			const configureLinks = await screen.findAllByText(/configure google auth/i);
-			await user.click(configureLinks[0]);
+			const configureButtons = await screen.findAllByTestId(
+				'auth-domain-configure',
+			);
+			await waitFor(() => {
+				expect(configureButtons[0]).toBeEnabled();
+			});
+			await user.click(configureButtons[0]);
 
 			await waitFor(() => {
 				expect(screen.getByText(/edit google authentication/i)).toBeInTheDocument();

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.payload.test.tsx

@@ -1,4 +1,6 @@
 import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
+import { useAuthZ } from 'lib/authz/hooks/useAuthZ/useAuthZ';
+import { mockUseAuthZGrantAll } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 
 import CreateEdit from '../CreateEdit/CreateEdit';
@@ -9,6 +11,9 @@ import {
 	mockUpdateSuccessResponse,
 } from './mocks';
 
+jest.mock('lib/authz/hooks/useAuthZ/useAuthZ');
+const mockedUseAuthZ = useAuthZ as jest.MockedFunction<typeof useAuthZ>;
+
 // TODO: https://github.com/SigNoz/platform-pod/issues/2602
 // The real @signozhq/ui/button has internal effects that prevent form.validateFields()
 // from resolving inside act(). Mirror the pattern from SSOEnforcementToggle.test.tsx
@@ -45,7 +50,15 @@ jest.mock('@signozhq/ui/button', () => ({
 	),
 }));
 
+// Heavy real-timer integration tests (antd Collapse + form.validateFields() + a
+// react-query mutation); the default 5000ms budget flakes under parallel runs.
+jest.setTimeout(20000);
+
 describe('CreateEdit — save payload correctness', () => {
+	beforeEach(() => {
+		mockedUseAuthZ.mockImplementation(mockUseAuthZGrantAll);
+	});
+
 	afterEach(() => {
 		server.resetHandlers();
 	});

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.roleMapping.test.tsx

@@ -1,4 +1,6 @@
 import { render, screen, userEvent, waitFor } from 'tests/test-utils';
+import { useAuthZ } from 'lib/authz/hooks/useAuthZ/useAuthZ';
+import { mockUseAuthZGrantAll } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 import {
 	allRoles,
@@ -15,6 +17,9 @@ import {
 	mockUpdateSuccessResponse,
 } from './mocks';
 
+jest.mock('lib/authz/hooks/useAuthZ/useAuthZ');
+const mockedUseAuthZ = useAuthZ as jest.MockedFunction<typeof useAuthZ>;
+
 // TODO: https://github.com/SigNoz/platform-pod/issues/2602
 // The @signozhq/ui Button uses Radix Slot and has CSS infinite animations that
 // prevent form.validateFields() from resolving inside act(). Replacing with a
@@ -112,6 +117,10 @@ const saveChanges = (user: User): Promise<void> =>
 	user.click(screen.getByRole('button', { name: /save changes/i }));
 
 describe('CreateEdit — role mapping uses API roles', () => {
+	beforeEach(() => {
+		mockedUseAuthZ.mockImplementation(mockUseAuthZGrantAll);
+	});
+
 	afterEach(() => {
 		server.resetHandlers();
 	});

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/CreateEdit.sanitization.test.tsx

@@ -1,4 +1,6 @@
 import { fireEvent, render, screen, waitFor } from 'tests/test-utils';
+import { useAuthZ } from 'lib/authz/hooks/useAuthZ/useAuthZ';
+import { mockUseAuthZGrantAll } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 import {
 	AuthtypesAuthDomainConfigGoogleDTO,
@@ -16,6 +18,13 @@ import {
 	mockUpdateSuccessResponse,
 } from './mocks';
 
+jest.mock('lib/authz/hooks/useAuthZ/useAuthZ');
+const mockedUseAuthZ = useAuthZ as jest.MockedFunction<typeof useAuthZ>;
+
+beforeEach(() => {
+	mockedUseAuthZ.mockImplementation(mockUseAuthZGrantAll);
+});
+
 // @signozhq/ui/button internal effects block form.validateFields() in tests
 jest.mock('@signozhq/ui/button', () => ({
 	...jest.requireActual('@signozhq/ui/button'),

frontend/src/container/OrganizationSettings/AuthDomain/__tests__/SSOEnforcementToggle.test.tsx

@@ -1,3 +1,4 @@
+import { setupAuthzAdmin } from 'lib/authz/utils/authz-test-utils';
 import { rest, server } from 'mocks-server/server';
 import { render, screen, userEvent, waitFor } from 'tests/test-utils';
 
@@ -34,6 +35,7 @@ import {
 describe('SSOEnforcementToggle', () => {
 	beforeEach(() => {
 		jest.clearAllMocks();
+		server.use(setupAuthzAdmin());
 	});
 
 	afterEach(() => {
@@ -87,6 +89,9 @@ describe('SSOEnforcementToggle', () => {
 		);
 
 		const switchElement = screen.getByRole('switch');
+		await waitFor(() => {
+			expect(switchElement).toBeEnabled();
+		});
 		await user.click(switchElement);
 
 		await waitFor(() => {
@@ -122,7 +127,11 @@ describe('SSOEnforcementToggle', () => {
 			/>,
 		);
 
-		await user.click(screen.getByRole('switch'));
+		const switchElement = screen.getByRole('switch');
+		await waitFor(() => {
+			expect(switchElement).toBeEnabled();
+		});
+		await user.click(switchElement);
 
 		await waitFor(() => expect(mockUpdateAPI).toHaveBeenCalledTimes(1));
 		expect(mockUpdateAPI).toHaveBeenCalledWith({
@@ -149,6 +158,9 @@ describe('SSOEnforcementToggle', () => {
 		);
 
 		const switchElement = screen.getByRole('switch');
+		await waitFor(() => {
+			expect(switchElement).toBeEnabled();
+		});
 		await user.click(switchElement);
 
 		await waitFor(() => {

frontend/src/container/OrganizationSettings/AuthDomain/index.tsx

@@ -14,6 +14,15 @@ import {
 } from 'api/generated/services/sigNoz.schemas';
 import { AxiosError } from 'axios';
 import ErrorContent from 'components/ErrorModal/components/ErrorContent';
+import AuthZButton from 'lib/authz/components/AuthZButton/AuthZButton';
+import { AuthZGuardContent } from 'lib/authz/components/AuthZGuard/AuthZGuardContent';
+import {
+	AuthDomainCreatePermission,
+	AuthDomainListPermission,
+	buildAuthDomainDeletePermission,
+	buildAuthDomainReadPermission,
+} from 'lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions';
+import { useAuthZ } from 'lib/authz/hooks/useAuthZ/useAuthZ';
 import CopyToClipboard from 'periscope/components/CopyToClipboard';
 import { useErrorModal } from 'providers/ErrorModalProvider';
 import APIError from 'types/api/error';
@@ -41,13 +50,17 @@ function AuthDomain(): JSX.Element {
 
 	const { showErrorModal } = useErrorModal();
 
+	const { permissions: authzPermissions } = useAuthZ([AuthDomainListPermission]);
+	const canListAuthDomains =
+		authzPermissions?.[AuthDomainListPermission]?.isGranted ?? false;
+
 	const {
 		data: authDomainListResponse,
 		isLoading: isLoadingAuthDomainListResponse,
 		isFetching: isFetchingAuthDomainListResponse,
 		error: errorFetchingAuthDomainListResponse,
 		refetch: refetchAuthDomainListResponse,
-	} = useListAuthDomains();
+	} = useListAuthDomains({ query: { enabled: canListAuthDomains } });
 
 	const { mutate: deleteAuthDomain, isLoading } =
 		useDeleteAuthDomain<AxiosError<RenderErrorResponseDTO>>();
@@ -153,22 +166,24 @@ function AuthDomain(): JSX.Element {
 				width: 100,
 				render: (_, record: AuthtypesGettableAuthDomainDTO): JSX.Element => (
 					<section className="auth-domain-list-column-action">
-						<Button
+						<AuthZButton
+							checks={[buildAuthDomainReadPermission(record.id ?? '')]}
 							className="auth-domain-list-action-link"
 							onClick={(): void => setRecord(record)}
 							variant="link"
 							testId="auth-domain-configure"
 						>
 							Configure {SSOType.get(record.config?.kind || '')}
-						</Button>
-						<Button
+						</AuthZButton>
+						<AuthZButton
+							checks={[buildAuthDomainDeletePermission(record.id ?? '')]}
 							className="auth-domain-list-action-link delete"
 							onClick={(): void => showDeleteModal(record)}
 							variant="link"
 							testId="auth-domain-delete"
 						>
 							Delete
-						</Button>
+						</AuthZButton>
 					</section>
 				),
 			},
@@ -182,7 +197,8 @@ function AuthDomain(): JSX.Element {
 				<h3 className="auth-domain-title" data-testid="auth-domain-title">
 					Authenticated Domains
 				</h3>
-				<Button
+				<AuthZButton
+					checks={[AuthDomainCreatePermission]}
 					prefix={<Plus size="md" />}
 					onClick={(): void => {
 						setAddDomain(true);
@@ -193,28 +209,32 @@ function AuthDomain(): JSX.Element {
 					testId="auth-domain-add"
 				>
 					Add Domain
-				</Button>
+				</AuthZButton>
 			</section>
-			{formattedError && <ErrorContent error={formattedError} />}
-			{!errorFetchingAuthDomainListResponse && (
-				<Table
-					columns={columns}
-					dataSource={authDomainListResponse?.data}
-					onRow={(
-						record: AuthtypesGettableAuthDomainDTO,
-					): HTMLAttributes<HTMLElement> =>
-						// data-* attributes are valid row props but absent from the antd typing
-						({
-							'data-testid': `auth-domain-row-${record.name}`,
-						}) as unknown as HTMLAttributes<HTMLElement>
-					}
-					loading={
-						isLoadingAuthDomainListResponse || isFetchingAuthDomainListResponse
-					}
-					className="auth-domain-list"
-					rowKey="id"
-				/>
-			)}
+			<AuthZGuardContent checks={[AuthDomainListPermission]}>
+				<>
+					{formattedError && <ErrorContent error={formattedError} />}
+					{!errorFetchingAuthDomainListResponse && (
+						<Table
+							columns={columns}
+							dataSource={authDomainListResponse?.data}
+							onRow={(
+								record: AuthtypesGettableAuthDomainDTO,
+							): HTMLAttributes<HTMLElement> =>
+								// data-* attributes are valid row props but absent from the antd typing
+								({
+									'data-testid': `auth-domain-row-${record.name}`,
+								}) as unknown as HTMLAttributes<HTMLElement>
+							}
+							loading={
+								isLoadingAuthDomainListResponse || isFetchingAuthDomainListResponse
+							}
+							className="auth-domain-list"
+							rowKey="id"
+						/>
+					)}
+				</>
+			</AuthZGuardContent>
 			{(addDomain || record) && (
 				<CreateEdit
 					isCreate={!record}

frontend/src/container/OrganizationSettings/DisplayName/index.tsx

@@ -72,7 +72,8 @@ function DisplayName({ index, id: orgId }: DisplayNameProps): JSX.Element {
 		await updateMyOrganization({ data: { id: orgId, displayName: name } });
 	};
 
-	if (!org) {
+	// The organization resource is not authz-backed yet, keep the legacy admin gate
+	if (!org || !isAdmin) {
 		return <div />;
 	}
 

frontend/src/container/RolesSettings/hooks/__tests__/useRolePermissions.test.ts

@@ -329,21 +329,41 @@ describe('transformTransactionGroupsToResourcePermissions', () => {
 	it('returns all resources from RESOURCE_ORDER even with empty transaction groups', () => {
 		const result = transformTransactionGroupsToResourcePermissions([]);
 
-		expect(result).toHaveLength(7);
+		expect(result).toHaveLength(8);
 		expect(result.map((r) => r.resourceKind)).toStrictEqual([
+			'auth-domain',
 			'factor-api-key',
+			'logs',
+			'meter-metrics',
+			'metrics',
 			'role',
 			'serviceaccount',
-			'logs',
 			'traces',
-			'metrics',
-			'meter-metrics',
 		]);
 	});
 
 	it('sets correct resource metadata from permissions config', () => {
 		const result = transformTransactionGroupsToResourcePermissions([]);
 
+		const authDomainResource = result.find(
+			(r) => r.resourceKind === 'auth-domain',
+		);
+		expect(authDomainResource).toMatchObject({
+			resourceId: 'auth-domain',
+			resourceKind: 'auth-domain',
+			resourceType: CoretypesTypeDTO.metaresource,
+			resourceLabel: 'Auth Domains',
+			availableActions: [
+				'attach',
+				'create',
+				'delete',
+				'detach',
+				'list',
+				'read',
+				'update',
+			],
+		});
+
 		const apiKeyResource = result.find(
 			(r) => r.resourceKind === 'factor-api-key',
 		);
@@ -418,15 +438,16 @@ describe('createEmptyRolePermissions', () => {
 	it('creates permissions for all resources in RESOURCE_ORDER', () => {
 		const result = createEmptyRolePermissions();
 
-		expect(result).toHaveLength(7);
+		expect(result).toHaveLength(8);
 		expect(result.map((r) => r.resourceKind)).toStrictEqual([
+			'auth-domain',
 			'factor-api-key',
+			'logs',
+			'meter-metrics',
+			'metrics',
 			'role',
 			'serviceaccount',
-			'logs',
 			'traces',
-			'metrics',
-			'meter-metrics',
 		]);
 	});
 

frontend/src/container/RolesSettings/permissions.config.ts

@@ -3,6 +3,7 @@ import {
 	ChartLine,
 	DraftingCompass,
 	Gauge,
+	Globe,
 	Key,
 	Logs,
 	Shield,
@@ -38,7 +39,16 @@ export interface ResourcePanelConfig {
  * we want to add resource panel configs for only types we actually are using,
  * not all of them
  */
+// Keys must stay alphabetically sorted — RESOURCE_ORDER derives the display order from them.
 export const RESOURCE_PANELS: Record<AuthZResource, ResourcePanelConfig> = {
+	'auth-domain': {
+		label: 'Auth Domains',
+		description: 'Authenticated domains and their SSO configuration.',
+		icon: Globe,
+		selectorPlaceholder:
+			'Type auth domain ID, separate multiple with comma or space',
+		docsAnchor: 'auth-domain',
+	},
 	'factor-api-key': {
 		label: 'API Keys',
 		description: 'Programmatic access tokens for the workspace.',
@@ -46,6 +56,33 @@ export const RESOURCE_PANELS: Record<AuthZResource, ResourcePanelConfig> = {
 		selectorPlaceholder: 'Type API key ID, separate multiple with comma or space',
 		docsAnchor: 'factor-api-key',
 	},
+	logs: {
+		label: 'Logs',
+		description: 'Log data collected across the workspace.',
+		icon: Logs,
+		selectorPlaceholder:
+			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
+		docsAnchor: 'logs',
+		selectorType: 'telemetryBuilder',
+	},
+	'meter-metrics': {
+		label: 'Meter Metrics',
+		description: 'Usage metering data for the workspace.',
+		icon: Gauge,
+		selectorPlaceholder:
+			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
+		docsAnchor: 'meter-metrics',
+		selectorType: 'telemetryBuilder',
+	},
+	metrics: {
+		label: 'Metrics',
+		description: 'Metric data collected across the workspace.',
+		icon: ChartLine,
+		selectorPlaceholder:
+			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
+		docsAnchor: 'metrics',
+		selectorType: 'telemetryBuilder',
+	},
 	role: {
 		label: 'Roles',
 		description: 'Custom and managed roles and their assignments.',
@@ -61,15 +98,6 @@ export const RESOURCE_PANELS: Record<AuthZResource, ResourcePanelConfig> = {
 			'Type service account ID, separate multiple with comma or space',
 		docsAnchor: 'service-account',
 	},
-	logs: {
-		label: 'Logs',
-		description: 'Log data collected across the workspace.',
-		icon: Logs,
-		selectorPlaceholder:
-			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
-		docsAnchor: 'logs',
-		selectorType: 'telemetryBuilder',
-	},
 	traces: {
 		label: 'Traces',
 		description: 'Distributed tracing data collected across the workspace.',
@@ -79,24 +107,6 @@ export const RESOURCE_PANELS: Record<AuthZResource, ResourcePanelConfig> = {
 		docsAnchor: 'traces',
 		selectorType: 'telemetryBuilder',
 	},
-	metrics: {
-		label: 'Metrics',
-		description: 'Metric data collected across the workspace.',
-		icon: ChartLine,
-		selectorPlaceholder:
-			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
-		docsAnchor: 'metrics',
-		selectorType: 'telemetryBuilder',
-	},
-	'meter-metrics': {
-		label: 'Meter Metrics',
-		description: 'Usage metering data for the workspace.',
-		icon: Gauge,
-		selectorPlaceholder:
-			'Enter selector as <query-type>/<key>/<value> or <query-type>/* or use wizard...',
-		docsAnchor: 'meter-metrics',
-		selectorType: 'telemetryBuilder',
-	},
 };
 
 export const RESOURCE_ORDER = Object.keys(RESOURCE_PANELS) as AuthZResource[];

frontend/src/hooks/queryBuilder/useGetCompositeQueryParam.ts

@@ -27,14 +27,6 @@ export const useGetCompositeQueryParam = (): Query | null => {
 				decodeURIComponent(compositeQuery.replace(/\+/g, ' ')),
 			);
 
-			// Add default values for optional fields if empty
-			if (parsedCompositeQuery?.builder) {
-				parsedCompositeQuery.builder.queryFormulas =
-					parsedCompositeQuery.builder.queryFormulas ?? [];
-				parsedCompositeQuery.builder.queryTraceOperator =
-					parsedCompositeQuery.builder.queryTraceOperator ?? [];
-			}
-
 			// Convert old format to new format for each query in builder.queryData
 			if (parsedCompositeQuery?.builder?.queryData) {
 				parsedCompositeQuery.builder.queryData =

frontend/src/hooks/queryBuilder/useGetSearchQueryParam.ts

@@ -0,0 +1,15 @@
+import { useMemo } from 'react';
+import { QuerySearchParamNames } from 'components/ExplorerCard/constants';
+import useUrlQuery from 'hooks/useUrlQuery';
+
+export const useGetSearchQueryParam = (
+	searchParams: QuerySearchParamNames,
+): string | null => {
+	const urlQuery = useUrlQuery();
+
+	return useMemo(() => {
+		const searchQuery = urlQuery.get(searchParams);
+
+		return searchQuery ? JSON.parse(searchQuery) : null;
+	}, [urlQuery, searchParams]);
+};

frontend/src/hooks/saveViews/__tests__/useGetSavedViewParams.test.ts

@@ -1,60 +0,0 @@
-import { renderHook } from '@testing-library/react';
-import useUrlQuery from 'hooks/useUrlQuery';
-
-import { useGetSavedViewParams } from '../useGetSavedViewParams';
-
-jest.mock('hooks/useUrlQuery');
-
-const mockedUseUrlQuery = useUrlQuery as jest.Mock;
-
-const setSearch = (search: string): void => {
-	mockedUseUrlQuery.mockReturnValue(new URLSearchParams(search));
-};
-
-describe('useGetSavedViewParams', () => {
-	beforeEach(() => {
-		jest.clearAllMocks();
-	});
-
-	it('returns empty strings when no params are present', () => {
-		setSearch('');
-
-		const { result } = renderHook(() => useGetSavedViewParams());
-
-		expect(result.current).toStrictEqual({ viewName: '', viewKey: '' });
-	});
-
-	it('parses JSON-stringified values', () => {
-		setSearch(
-			`viewName=${encodeURIComponent(
-				JSON.stringify('Hindsight'),
-			)}&viewKey=${encodeURIComponent(JSON.stringify('abc-123'))}`,
-		);
-
-		const { result } = renderHook(() => useGetSavedViewParams());
-
-		expect(result.current).toStrictEqual({
-			viewName: 'Hindsight',
-			viewKey: 'abc-123',
-		});
-	});
-
-	it('falls back to the raw string when a value is not valid JSON', () => {
-		setSearch('viewName=Hindsight&viewKey=some-uuid-value');
-
-		const { result } = renderHook(() => useGetSavedViewParams());
-
-		expect(result.current).toStrictEqual({
-			viewName: 'Hindsight',
-			viewKey: 'some-uuid-value',
-		});
-	});
-
-	it('does not throw and keeps the raw string for non-string JSON', () => {
-		setSearch('viewName=123');
-
-		const { result } = renderHook(() => useGetSavedViewParams());
-
-		expect(result.current).toStrictEqual({ viewName: '123', viewKey: '' });
-	});
-});

frontend/src/hooks/saveViews/useGetSavedViewParams.ts

@@ -1,33 +0,0 @@
-import { useMemo } from 'react';
-import { QueryParams } from 'constants/query';
-import useUrlQuery from 'hooks/useUrlQuery';
-
-interface SavedViewParams {
-	viewName: string;
-	viewKey: string;
-}
-
-const parseViewParam = (value: string | null): string => {
-	if (!value) {
-		return '';
-	}
-
-	try {
-		const parsed = JSON.parse(value);
-		return typeof parsed === 'string' ? parsed : value;
-	} catch {
-		return value;
-	}
-};
-
-export const useGetSavedViewParams = (): SavedViewParams => {
-	const urlQuery = useUrlQuery();
-
-	return useMemo(
-		() => ({
-			viewName: parseViewParam(urlQuery.get(QueryParams.viewName)),
-			viewKey: parseViewParam(urlQuery.get(QueryParams.viewKey)),
-		}),
-		[urlQuery],
-	);
-};

frontend/src/hooks/useHandleExplorerTabChange.ts

@@ -6,7 +6,7 @@ import { SIGNOZ_VALUE } from 'container/QueryBuilder/filters/OrderByFilter/const
 import { Query } from 'types/api/queryBuilder/queryBuilderData';
 import { DataSource } from 'types/common/queryBuilder';
 
-import { useGetSavedViewParams } from './saveViews/useGetSavedViewParams';
+import { useGetSearchQueryParam } from './queryBuilder/useGetSearchQueryParam';
 import { useQueryBuilder } from './queryBuilder/useQueryBuilder';
 
 export interface ICurrentQueryData {
@@ -31,7 +31,9 @@ export const useHandleExplorerTabChange = (): {
 		updateQueriesData,
 	} = useQueryBuilder();
 
-	const { viewName, viewKey } = useGetSavedViewParams();
+	const viewName = useGetSearchQueryParam(QueryParams.viewName) || '';
+
+	const viewKey = useGetSearchQueryParam(QueryParams.viewKey) || '';
 
 	const getUpdateQuery = useCallback(
 		(newPanelType: PANEL_TYPES): Query => {

frontend/src/lib/authz/hooks/useAuthZ/permissions.type.ts

@@ -3,6 +3,19 @@ export default {
 	status: 'success',
 	data: {
 		resources: [
+			{
+				kind: 'auth-domain',
+				type: 'metaresource',
+				allowedVerbs: [
+					'attach',
+					'create',
+					'delete',
+					'detach',
+					'list',
+					'read',
+					'update',
+				],
+			},
 			{
 				kind: 'factor-api-key',
 				type: 'metaresource',

frontend/src/lib/authz/hooks/useAuthZ/permissions/auth-domain.permissions.ts

@@ -0,0 +1,22 @@
+import { buildPermission } from '../utils';
+import type { BrandedPermission } from '../types';
+
+// Collection-level — wildcard selector required for correct response key matching
+export const AuthDomainListPermission = buildPermission(
+	'list',
+	'auth-domain:*',
+);
+export const AuthDomainCreatePermission = buildPermission(
+	'create',
+	'auth-domain:*',
+);
+
+// Resource-level — require a specific auth domain id
+export const buildAuthDomainReadPermission = (id: string): BrandedPermission =>
+	buildPermission('read', `auth-domain:${id}`);
+export const buildAuthDomainUpdatePermission = (
+	id: string,
+): BrandedPermission => buildPermission('update', `auth-domain:${id}`);
+export const buildAuthDomainDeletePermission = (
+	id: string,
+): BrandedPermission => buildPermission('delete', `auth-domain:${id}`);

frontend/src/pages/Settings/Settings.tsx

@@ -10,7 +10,6 @@ import { buildNavUrl, getQueryString } from 'container/SideNav/helper';
 import { settingsNavSections } from 'container/SideNav/menuItems';
 import NavItem from 'container/SideNav/NavItem/NavItem';
 import { SidebarItem } from 'container/SideNav/sideNav.types';
-import useComponentPermission from 'hooks/useComponentPermission';
 import { useGetTenantLicense } from 'hooks/useGetTenantLicense';
 import history from 'lib/history';
 import { Cog } from '@signozhq/icons';
@@ -40,10 +39,6 @@ function SettingsPage(): JSX.Element {
 
 	const isWorkspaceBlocked = trialInfo?.workSpaceBlock || false;
 
-	const [isCurrentOrgSettings] = useComponentPermission(
-		['current_org_settings'],
-		user.role,
-	);
 	const { t } = useTranslation(['routes']);
 
 	const isGatewayEnabled =
@@ -80,7 +75,8 @@ function SettingsPage(): JSX.Element {
 						item.key === ROUTES.ROLE_CREATE ||
 						item.key === ROUTES.ROLE_DETAILS ||
 						item.key === ROUTES.ROLE_EDIT ||
-						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS
+						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS ||
+						item.key === ROUTES.ORG_SETTINGS
 							? true
 							: item.isEnabled,
 				}));
@@ -92,7 +88,6 @@ function SettingsPage(): JSX.Element {
 							item.key === ROUTES.BILLING ||
 							item.key === ROUTES.INTEGRATIONS ||
 							item.key === ROUTES.INGESTION_SETTINGS ||
-							item.key === ROUTES.ORG_SETTINGS ||
 							item.key === ROUTES.MEMBERS_SETTINGS ||
 							item.key === ROUTES.SHORTCUTS ||
 							item.key === ROUTES.MCP_SERVER
@@ -131,7 +126,8 @@ function SettingsPage(): JSX.Element {
 						item.key === ROUTES.ROLE_CREATE ||
 						item.key === ROUTES.ROLE_DETAILS ||
 						item.key === ROUTES.ROLE_EDIT ||
-						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS
+						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS ||
+						item.key === ROUTES.ORG_SETTINGS
 							? true
 							: item.isEnabled,
 				}));
@@ -142,7 +138,6 @@ function SettingsPage(): JSX.Element {
 						isEnabled:
 							item.key === ROUTES.BILLING ||
 							item.key === ROUTES.INTEGRATIONS ||
-							item.key === ROUTES.ORG_SETTINGS ||
 							item.key === ROUTES.MEMBERS_SETTINGS ||
 							item.key === ROUTES.INGESTION_SETTINGS ||
 							item.key === ROUTES.MCP_SERVER
@@ -180,7 +175,8 @@ function SettingsPage(): JSX.Element {
 						item.key === ROUTES.ROLE_CREATE ||
 						item.key === ROUTES.ROLE_DETAILS ||
 						item.key === ROUTES.ROLE_EDIT ||
-						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS
+						item.key === ROUTES.SERVICE_ACCOUNTS_SETTINGS ||
+						item.key === ROUTES.ORG_SETTINGS
 							? true
 							: item.isEnabled,
 				}));
@@ -188,10 +184,7 @@ function SettingsPage(): JSX.Element {
 				if (isAdmin) {
 					updatedItems = updatedItems.map((item) => ({
 						...item,
-						isEnabled:
-							item.key === ROUTES.ORG_SETTINGS || item.key === ROUTES.MEMBERS_SETTINGS
-								? true
-								: item.isEnabled,
+						isEnabled: item.key === ROUTES.MEMBERS_SETTINGS ? true : item.isEnabled,
 					}));
 				}
 
@@ -222,7 +215,6 @@ function SettingsPage(): JSX.Element {
 		() =>
 			getRoutes(
 				user.role,
-				isCurrentOrgSettings,
 				isGatewayEnabled,
 				isWorkspaceBlocked,
 				isCloudUser,
@@ -231,7 +223,6 @@ function SettingsPage(): JSX.Element {
 			),
 		[
 			user.role,
-			isCurrentOrgSettings,
 			isGatewayEnabled,
 			isWorkspaceBlocked,
 			isCloudUser,

frontend/src/pages/Settings/utils.ts

@@ -21,7 +21,6 @@ import {
 
 export const getRoutes = (
 	userRole: ROLES | null,
-	isCurrentOrgSettings: boolean,
 	isGatewayEnabled: boolean,
 	isWorkspaceBlocked: boolean,
 	isCloudUser: boolean,
@@ -47,9 +46,8 @@ export const getRoutes = (
 
 	settings.push(...generalSettings(t));
 
-	if (isCurrentOrgSettings) {
-		settings.push(...organizationSettings(t));
-	}
+	// Visible to all authenticated users — in-page authz gates the content
+	settings.push(...organizationSettings(t));
 
 	if (isGatewayEnabled && (isAdmin || isEditor)) {
 		settings.push(...multiIngestionSettings(t));

frontend/src/providers/QueryBuilder.tsx

@@ -163,23 +163,20 @@ export function QueryBuilderProvider({
 	const prepareQueryBuilderData = useCallback(
 		(query: Query): Query => {
 			const builder: QueryBuilderData = {
-				queryData:
-					query.builder.queryData?.map((item) => ({
-						...initialQueryBuilderFormValuesMap[
-							initialDataSource || DataSource.METRICS
-						],
-						...item,
-					})) ?? [],
-				queryFormulas:
-					query.builder.queryFormulas?.map((item) => ({
-						...initialFormulaBuilderFormValues,
-						...item,
-					})) ?? [],
-				queryTraceOperator:
-					query.builder.queryTraceOperator?.map((item) => ({
-						...initialQueryBuilderFormTraceOperatorValues,
-						...item,
-					})) ?? [],
+				queryData: query.builder.queryData?.map((item) => ({
+					...initialQueryBuilderFormValuesMap[
+						initialDataSource || DataSource.METRICS
+					],
+					...item,
+				})),
+				queryFormulas: query.builder.queryFormulas?.map((item) => ({
+					...initialFormulaBuilderFormValues,
+					...item,
+				})),
+				queryTraceOperator: query.builder.queryTraceOperator?.map((item) => ({
+					...initialQueryBuilderFormTraceOperatorValues,
+					...item,
+				})),
 			};
 
 			const setupedQueryData = builder.queryData.map((item) => {
@@ -212,17 +209,15 @@ export function QueryBuilderProvider({
 				return currentElement;
 			});
 
-			const promql: IPromQLQuery[] =
-				query.promql?.map((item) => ({
-					...initialQueryPromQLData,
-					...item,
-				})) ?? [];
+			const promql: IPromQLQuery[] = query.promql.map((item) => ({
+				...initialQueryPromQLData,
+				...item,
+			}));
 
-			const clickHouse: IClickHouseQuery[] =
-				query.clickhouse_sql?.map((item) => ({
-					...initialClickHouseData,
-					...item,
-				})) ?? [];
+			const clickHouse: IClickHouseQuery[] = query.clickhouse_sql.map((item) => ({
+				...initialClickHouseData,
+				...item,
+			}));
 
 			const newQueryState: QueryState = {
 				clickhouse_sql: clickHouse,

frontend/src/schemas/generated/transactionGroups.schema.json

@@ -66,7 +66,6 @@
         "factor-api-key",
         "license",
         "subscription",
-        "deployment-host",
         "logs",
         "traces",
         "metrics",

frontend/src/utils/permission/index.ts

@@ -59,7 +59,7 @@ export const componentPermission: Record<ComponentTypes, ROLES[]> = {
 export const routePermission: Record<keyof typeof ROUTES, ROLES[]> = {
 	HOME: ['ADMIN', 'EDITOR', 'VIEWER'],
 	ALERTS_NEW: ['ADMIN', 'EDITOR'],
-	ORG_SETTINGS: ['ADMIN'],
+	ORG_SETTINGS: ['ADMIN', 'EDITOR', 'VIEWER'],
 	MY_SETTINGS: ['ADMIN', 'EDITOR', 'VIEWER'],
 	SERVICE_MAP: ['ADMIN', 'EDITOR', 'VIEWER'],
 	ALL_CHANNELS: ['ADMIN', 'EDITOR', 'VIEWER'],
@@ -172,6 +172,7 @@ export const routeWithInitialAuthZSupport = {
 	LOGS: true,
 	LOGS_EXPLORER: true,
 	LIVE_LOGS: true,
+	ORG_SETTINGS: true,
 	ROLES_SETTINGS: true,
 	ROLE_CREATE: true,
 	ROLE_DETAILS: true,

pkg/apiserver/signozapiserver/authdomain.go

@@ -77,7 +77,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
 				SourceSelector: coretypes.WildcardSelector,
 				TargetResource: coretypes.ResourceRole,
-				TargetIDs:      authDomainRoleNamesExtractor(),
+				TargetIDs:      provider.authDomainRoleNamesExtractor(),
 				TargetSelector: coretypes.IDSelector,
 			},
 		),
@@ -146,21 +146,23 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 				Verb:           coretypes.VerbAttach,
 				Category:       coretypes.ActionCategoryAccessControl,
 				SourceResource: coretypes.ResourceMetaResourceAuthDomain,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceIDs:      provider.authDomainIDWhenRolesChangeExtractor(provider.authDomainAttachedRoleNames),
 				SourceSelector: coretypes.IDSelector,
 				TargetResource: coretypes.ResourceRole,
-				TargetIDs:      authDomainRoleNamesExtractor(),
+				TargetIDs:      coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: provider.authDomainAttachedRoleNames},
 				TargetSelector: coretypes.IDSelector,
+				SkipIfNoIDs:    true,
 			},
 			handler.AttachDetachSiblingResourceDef{
 				Verb:           coretypes.VerbDetach,
 				Category:       coretypes.ActionCategoryAccessControl,
 				SourceResource: coretypes.ResourceMetaResourceAuthDomain,
-				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceIDs:      provider.authDomainIDWhenRolesChangeExtractor(provider.authDomainDetachedRoleNames),
 				SourceSelector: coretypes.IDSelector,
 				TargetResource: coretypes.ResourceRole,
-				TargetIDs:      provider.authDomainStoredRoleNamesExtractor(),
+				TargetIDs:      coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: provider.authDomainDetachedRoleNames},
 				TargetSelector: coretypes.IDSelector,
+				SkipIfNoIDs:    true,
 			},
 		),
 	)).Methods(http.MethodPut).GetError(); err != nil {
@@ -197,67 +199,119 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 	return nil
 }
 
-// The extracted names are the roles the request body's mapping grants at SSO
-// login — see authDomainEffectiveRoleNames.
-func authDomainRoleNamesExtractor() coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		roleMappingJSON := gjson.GetBytes(ec.RequestBody, "roleMapping")
-		if !roleMappingJSON.Exists() || roleMappingJSON.Type == gjson.Null {
-			return authDomainEffectiveRoleNames(nil), nil
-		}
-
-		roleMapping := new(authtypes.RoleMapping)
-		if err := json.Unmarshal([]byte(roleMappingJSON.Raw), roleMapping); err != nil {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid role mapping: %v", err)
-		}
-
-		return authDomainEffectiveRoleNames(roleMapping), nil
-	}}
+func (provider *provider) authDomainRoleNamesExtractor() coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: provider.authDomainRequestEffectiveRoleNames}
 }
 
-// The extracted names are the roles the stored domain's mapping grants at SSO
-// login — an update replaces that mapping, so the caller must be able to detach
-// them.
-func (provider *provider) authDomainStoredRoleNamesExtractor() coretypes.ResourceIDsExtractor {
+func (provider *provider) authDomainIDWhenRolesChangeExtractor(roleNamesDiff func(coretypes.ExtractorContext) ([]string, error)) coretypes.ResourceIDsExtractor {
 	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		if ec.Request == nil {
+		diff, err := roleNamesDiff(ec)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(diff) == 0 || ec.Request == nil {
 			return nil, nil
 		}
 
-		claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
-		if err != nil {
-			return nil, err
-		}
-
-		orgID, err := valuer.NewUUID(claims.OrgID)
-		if err != nil {
-			return nil, err
-		}
-
-		id, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
-		if err != nil {
-			return nil, err
-		}
-
-		authDomain, err := provider.authDomainModule.GetByOrgIDAndID(ec.Request.Context(), orgID, id)
-		if err != nil {
-			return nil, err
-		}
-
-		return authDomainEffectiveRoleNames(authDomain.RoleMapping()), nil
+		return []string{mux.Vars(ec.Request)["id"]}, nil
 	}}
 }
 
-// The effective names are the roles a domain grants at SSO login: the mapped
-// roles plus the default (signoz-viewer when unset), or every role when the IDP
-// role attribute is trusted. Never empty — a check with no selectors is forbidden.
-func authDomainEffectiveRoleNames(roleMapping *authtypes.RoleMapping) []string {
+func (provider *provider) authDomainAttachedRoleNames(ec coretypes.ExtractorContext) ([]string, error) {
+	requestRoleNames, err := provider.authDomainRequestEffectiveRoleNames(ec)
+	if err != nil {
+		return nil, err
+	}
+
+	storedRoleNames, err := provider.authDomainStoredEffectiveRoleNames(ec)
+	if err != nil {
+		return nil, err
+	}
+
+	return provider.subtractRoleNames(requestRoleNames, storedRoleNames), nil
+}
+
+func (provider *provider) authDomainDetachedRoleNames(ec coretypes.ExtractorContext) ([]string, error) {
+	requestRoleNames, err := provider.authDomainRequestEffectiveRoleNames(ec)
+	if err != nil {
+		return nil, err
+	}
+
+	storedRoleNames, err := provider.authDomainStoredEffectiveRoleNames(ec)
+	if err != nil {
+		return nil, err
+	}
+
+	return provider.subtractRoleNames(storedRoleNames, requestRoleNames), nil
+}
+
+func (provider *provider) authDomainRequestEffectiveRoleNames(ec coretypes.ExtractorContext) ([]string, error) {
+	roleMappingJSON := gjson.GetBytes(ec.RequestBody, "roleMapping")
+	if !roleMappingJSON.Exists() || roleMappingJSON.Type == gjson.Null {
+		return provider.authDomainEffectiveRoleNames(nil), nil
+	}
+
+	roleMapping := new(authtypes.RoleMapping)
+	if err := json.Unmarshal([]byte(roleMappingJSON.Raw), roleMapping); err != nil {
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid role mapping: %v", err)
+	}
+
+	return provider.authDomainEffectiveRoleNames(roleMapping), nil
+}
+
+func (provider *provider) authDomainStoredEffectiveRoleNames(ec coretypes.ExtractorContext) ([]string, error) {
+	if ec.Request == nil {
+		return nil, nil
+	}
+
+	claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
+	if err != nil {
+		return nil, err
+	}
+
+	orgID, err := valuer.NewUUID(claims.OrgID)
+	if err != nil {
+		return nil, err
+	}
+
+	id, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+	if err != nil {
+		return nil, err
+	}
+
+	authDomain, err := provider.authDomainModule.GetByOrgIDAndID(ec.Request.Context(), orgID, id)
+	if err != nil {
+		return nil, err
+	}
+
+	return provider.authDomainEffectiveRoleNames(authDomain.RoleMapping()), nil
+}
+
+func (provider *provider) subtractRoleNames(roleNames []string, roleNamesToRemove []string) []string {
+	removeSet := make(map[string]struct{}, len(roleNamesToRemove))
+	for _, roleName := range roleNamesToRemove {
+		removeSet[roleName] = struct{}{}
+	}
+
+	remaining := make([]string, 0, len(roleNames))
+	for _, roleName := range roleNames {
+		if _, ok := removeSet[roleName]; !ok {
+			remaining = append(remaining, roleName)
+		}
+	}
+
+	return remaining
+}
+
+// Never empty — a check with no selectors is forbidden.
+func (provider *provider) authDomainEffectiveRoleNames(roleMapping *authtypes.RoleMapping) []string {
 	if roleMapping == nil {
 		return []string{authtypes.SigNozViewerRoleName}
 	}
 
 	if roleMapping.UseRoleAttribute {
-		return []string{coretypes.WildCardSelectorString}
+		return []string{coretypes.WildCardSelectorString, authtypes.SigNozViewerRoleName}
 	}
 
 	roleNames := roleMapping.RoleNames()

pkg/apiserver/signozapiserver/flagger.go

@@ -4,12 +4,13 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/featuretypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addFlaggerRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/features", handler.New(provider.authzMiddleware.OpenAccess(provider.flaggerHandler.GetFeatures), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/features", handler.New(provider.authzMiddleware.ViewAccess(provider.flaggerHandler.GetFeatures), handler.OpenAPIDef{
 		ID:                  "GetFeatures",
 		Tags:                []string{"features"},
 		Summary:             "Get features",
@@ -21,7 +22,7 @@ func (provider *provider) addFlaggerRoutes(router *mux.Router) error {
 		SuccessStatusCode:   http.StatusOK,
 		ErrorStatusCodes:    []int{},
 		Deprecated:          false,
-		SecuritySchemes:     newScopedSecuritySchemes(nil),
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
 	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

pkg/apiserver/signozapiserver/provider.go

@@ -24,7 +24,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/organization"
 	"github.com/SigNoz/signoz/pkg/modules/preference"
 	"github.com/SigNoz/signoz/pkg/modules/promote"
-	"github.com/SigNoz/signoz/pkg/modules/quickfilter"
 	"github.com/SigNoz/signoz/pkg/modules/rawdataexport"
 	"github.com/SigNoz/signoz/pkg/modules/rulestatehistory"
 	"github.com/SigNoz/signoz/pkg/modules/savedview"
@@ -81,7 +80,6 @@ type provider struct {
 	llmPricingRuleHandler      llmpricingrule.Handler
 	statsHandler               statsreporter.Handler
 	savedViewHandler           savedview.Handler
-	quickFilterHandler         quickfilter.Handler
 }
 
 func NewFactory(
@@ -120,7 +118,6 @@ func NewFactory(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
-	quickFilterHandler quickfilter.Handler,
 ) factory.ProviderFactory[apiserver.APIServer, apiserver.Config] {
 	return factory.NewProviderFactory(factory.MustNewName("signoz"), func(ctx context.Context, providerSettings factory.ProviderSettings, config apiserver.Config) (apiserver.APIServer, error) {
 		return newProvider(
@@ -162,7 +159,6 @@ func NewFactory(
 			rulerHandler,
 			statsHandler,
 			savedViewHandler,
-			quickFilterHandler,
 		)
 	})
 }
@@ -206,7 +202,6 @@ func newProvider(
 	rulerHandler ruler.Handler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
-	quickFilterHandler quickfilter.Handler,
 ) (apiserver.APIServer, error) {
 	settings := factory.NewScopedProviderSettings(providerSettings, "github.com/SigNoz/signoz/pkg/apiserver/signozapiserver")
 	router := mux.NewRouter().UseEncodedPath()
@@ -249,7 +244,6 @@ func newProvider(
 		llmPricingRuleHandler:      llmPricingRuleHandler,
 		statsHandler:               statsHandler,
 		savedViewHandler:           savedViewHandler,
-		quickFilterHandler:         quickFilterHandler,
 	}
 
 	provider.authzMiddleware = middleware.NewAuthZ(settings.Logger(), orgGetter, authzService)
@@ -390,10 +384,6 @@ func (provider *provider) AddToRouter(router *mux.Router) error {
 		return err
 	}
 
-	if err := provider.addQuickFilterRoutes(router); err != nil {
-		return err
-	}
-
 	return nil
 }
 

pkg/apiserver/signozapiserver/quickfilter.go

@@ -1,93 +0,0 @@
-package signozapiserver
-
-import (
-	"net/http"
-
-	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/SigNoz/signoz/pkg/types/quickfiltertypes"
-	"github.com/gorilla/mux"
-)
-
-func (provider *provider) addQuickFilterRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/quick_filters", handler.New(
-		provider.authzMiddleware.CheckResources(provider.quickFilterHandler.ListQuickFiltersV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "ListQuickFilters",
-			Tags:                []string{"quick_filter"},
-			Summary:             "List quick filters",
-			Description:         "Returns the org's quick filters for every signal, each filter as a telemetry field key.",
-			Request:             nil,
-			RequestContentType:  "",
-			Response:            new([]*quickfiltertypes.SignalFilters),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			Deprecated:          false,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceQuickFilter.Scope(coretypes.VerbList)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceQuickFilter,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
-		return err
-	}
-
-	if err := router.Handle("/api/v2/quick_filters/{signal_name}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.quickFilterHandler.GetQuickFiltersV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
-		handler.OpenAPIDef{
-			ID:                  "GetQuickFilters",
-			Tags:                []string{"quick_filter"},
-			Summary:             "Get a signal's quick filters",
-			Description:         "Returns the org's quick filters for one signal, each filter as a telemetry field key.",
-			Request:             nil,
-			RequestContentType:  "",
-			Response:            new(quickfiltertypes.SignalFilters),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			Deprecated:          false,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceQuickFilter.Scope(coretypes.VerbRead)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceQuickFilter,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodGet).GetError(); err != nil {
-		return err
-	}
-
-	if err := router.Handle("/api/v2/quick_filters", handler.New(
-		provider.authzMiddleware.CheckResources(provider.quickFilterHandler.UpdateQuickFiltersV2, authtypes.SigNozAdminRoleName),
-		handler.OpenAPIDef{
-			ID:                  "UpdateQuickFilters",
-			Tags:                []string{"quick_filter"},
-			Summary:             "Update quick filters",
-			Description:         "Replaces the org's quick filters for the signal named in the body.",
-			Request:             new(quickfiltertypes.UpdatableQuickFilters),
-			RequestContentType:  "application/json",
-			Response:            nil,
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusNoContent,
-			ErrorStatusCodes:    []int{http.StatusBadRequest},
-			Deprecated:          false,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceQuickFilter.Scope(coretypes.VerbUpdate)}),
-		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceQuickFilter,
-			Verb:     coretypes.VerbUpdate,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			Selector: coretypes.WildcardSelector,
-		}),
-	)).Methods(http.MethodPut).GetError(); err != nil {
-		return err
-	}
-
-	return nil
-}

pkg/apiserver/signozapiserver/zeus.go

@@ -5,8 +5,6 @@ import (
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/zeustypes"
 	"github.com/gorilla/mux"
 )
@@ -29,7 +27,7 @@ func (provider *provider) addZeusRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/zeus/hosts", handler.New(provider.authzMiddleware.CheckResources(provider.zeusHandler.GetHosts, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/zeus/hosts", handler.New(provider.authzMiddleware.ViewAccess(provider.zeusHandler.GetHosts), handler.OpenAPIDef{
 		ID:                  "GetHosts",
 		Tags:                []string{"zeus"},
 		Summary:             "Get host info from Zeus.",
@@ -41,17 +39,12 @@ func (provider *provider) addZeusRoutes(router *mux.Router) error {
 		SuccessStatusCode:   http.StatusOK,
 		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound},
 		Deprecated:          false,
-		SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDeploymentHost.Scope(coretypes.VerbList)}),
-	}, handler.WithResourceDefs(handler.BasicResourceDef{
-		Resource: coretypes.ResourceMetaResourceDeploymentHost,
-		Verb:     coretypes.VerbList,
-		Category: coretypes.ActionCategoryDataAccess,
-		Selector: coretypes.WildcardSelector,
-	}))).Methods(http.MethodGet).GetError(); err != nil {
+		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+	})).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/zeus/hosts", handler.New(provider.authzMiddleware.CheckResources(provider.zeusHandler.PutHost, authtypes.SigNozAdminRoleName), handler.OpenAPIDef{
+	if err := router.Handle("/api/v2/zeus/hosts", handler.New(provider.authzMiddleware.AdminAccess(provider.zeusHandler.PutHost), handler.OpenAPIDef{
 		ID:                  "PutHost",
 		Tags:                []string{"zeus"},
 		Summary:             "Put host in Zeus for a deployment.",
@@ -63,14 +56,8 @@ func (provider *provider) addZeusRoutes(router *mux.Router) error {
 		SuccessStatusCode:   http.StatusNoContent,
 		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusForbidden, http.StatusNotFound, http.StatusConflict},
 		Deprecated:          false,
-		SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDeploymentHost.Scope(coretypes.VerbUpdate)}),
-	}, handler.WithResourceDefs(handler.BasicResourceDef{
-		Resource: coretypes.ResourceMetaResourceDeploymentHost,
-		Verb:     coretypes.VerbUpdate,
-		Category: coretypes.ActionCategoryConfigurationChange,
-		ID:       coretypes.BodyJSONPath("name"),
-		Selector: coretypes.WildcardSelector,
-	}))).Methods(http.MethodPut).GetError(); err != nil {
+		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 

pkg/http/handler/resourcedef.go

@@ -53,6 +53,9 @@ type AttachDetachSiblingResourceDef struct {
 	TargetResource coretypes.Resource
 	TargetIDs      coretypes.ResourceIDsExtractor
 	TargetSelector coretypes.SelectorFunc
+	// SkipIfNoIDs skips the authz checks entirely when neither source nor target
+	// ids resolve — an attach/detach of nothing authorizes nothing.
+	SkipIfNoIDs bool
 }
 
 func (def AttachDetachSiblingResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
@@ -67,6 +70,7 @@ func (def AttachDetachSiblingResourceDef) resolveRequest(ec coretypes.ExtractorC
 			def.TargetIDs,
 			def.TargetSelector,
 			false,
+			def.SkipIfNoIDs,
 			ec,
 		),
 	}
@@ -96,6 +100,7 @@ func (def AttachDetachParentChildResourceDef) resolveRequest(ec coretypes.Extrac
 			def.ChildIDs,
 			nil,
 			true,
+			false,
 			ec,
 		),
 	}

pkg/http/middleware/audit.go

@@ -123,6 +123,10 @@ func (middleware *Audit) emitAuditEvent(req *http.Request, writer responseCaptur
 		}
 
 		resource.ResolveResponse(extractorCtx)
+
+		if resource.Skip() {
+			continue
+		}
 		verb, category := resource.Verb(), resource.Category()
 
 		switch typed := resource.(type) {

pkg/http/middleware/authz.go

@@ -186,6 +186,10 @@ func (middleware *AuthZ) CheckResources(next http.HandlerFunc, roles ...string)
 				return
 			}
 
+			if resource.Skip() {
+				continue
+			}
+
 			if err := middleware.checkResource(ctx, claims, orgID, resource.Verb(), resource.SourceResource(), resource.SourceIDs(), resource.SourceSelector(), roleSelectors); err != nil {
 				render.Error(rw, err)
 				return

pkg/modules/quickfilter/implquickfilter/handler.go

@@ -4,13 +4,10 @@ import (
 	"encoding/json"
 	"net/http"
 
-	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/modules/quickfilter"
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/quickfiltertypes"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
@@ -23,89 +20,6 @@ func NewHandler(module quickfilter.Module) quickfilter.Handler {
 	return &handler{module: module}
 }
 
-// legacySignalFilters is the v1 API shape: filters as v3 attribute keys.
-type legacySignalFilters struct {
-	Signal  quickfiltertypes.Signal `json:"signal"`
-	Filters []v3.AttributeKey       `json:"filters"`
-}
-
-// newTelemetryFieldKeysFromLegacy converts a v1 write payload with the same
-// normalizations as the storage migration: alias contexts, numerics to number.
-// The v1 shape carries no per filter signal, so meter keys get it restored.
-func newTelemetryFieldKeysFromLegacy(signal quickfiltertypes.Signal, filters []v3.AttributeKey) ([]telemetrytypes.TelemetryFieldKey, error) {
-	var fieldSignal telemetrytypes.Signal
-	if signal == quickfiltertypes.SignalMeter {
-		fieldSignal = telemetrytypes.SignalMetrics
-	}
-
-	fieldKeys := make([]telemetrytypes.TelemetryFieldKey, 0, len(filters))
-	for _, filter := range filters {
-		if err := filter.Validate(); err != nil {
-			return nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "invalid filter: %v", err)
-		}
-
-		fieldContext, ok := telemetrytypes.FieldContextFromText(string(filter.Type))
-		if !ok {
-			fieldContext = telemetrytypes.FieldContextUnspecified
-		}
-
-		var fieldDataType telemetrytypes.FieldDataType
-		if err := fieldDataType.Scan(string(filter.DataType)); err != nil {
-			fieldDataType = telemetrytypes.FieldDataTypeUnspecified
-		}
-		if fieldDataType == telemetrytypes.FieldDataTypeInt64 {
-			fieldDataType = telemetrytypes.FieldDataTypeNumber
-		}
-
-		fieldKeys = append(fieldKeys, telemetrytypes.TelemetryFieldKey{
-			Name:          filter.Key,
-			Signal:        fieldSignal,
-			FieldContext:  fieldContext,
-			FieldDataType: fieldDataType,
-		})
-	}
-
-	return fieldKeys, nil
-}
-
-// newLegacySignalFiltersFromSignalFilters renders stored telemetry field keys
-// back into the v1 shape, restoring the legacy spellings v1 clients expect.
-func newLegacySignalFiltersFromSignalFilters(signalFilters *quickfiltertypes.SignalFilters) *legacySignalFilters {
-	filters := make([]v3.AttributeKey, 0, len(signalFilters.Filters))
-	for _, fieldKey := range signalFilters.Filters {
-		// Only tag and resource exist in the v3 enum; other contexts render as
-		// unspecified so v1 clients never see spellings their queries can't use.
-		var attributeType v3.AttributeKeyType
-		switch fieldKey.FieldContext {
-		case telemetrytypes.FieldContextAttribute:
-			attributeType = v3.AttributeKeyTypeTag
-		case telemetrytypes.FieldContextResource:
-			attributeType = v3.AttributeKeyTypeResource
-		default:
-			attributeType = v3.AttributeKeyTypeUnspecified
-		}
-
-		var dataType v3.AttributeKeyDataType
-		switch fieldKey.FieldDataType {
-		case telemetrytypes.FieldDataTypeNumber:
-			dataType = v3.AttributeKeyDataTypeFloat64
-		default:
-			dataType = v3.AttributeKeyDataType(fieldKey.FieldDataType.StringValue())
-		}
-
-		filters = append(filters, v3.AttributeKey{
-			Key:      fieldKey.Name,
-			Type:     attributeType,
-			DataType: dataType,
-		})
-	}
-
-	return &legacySignalFilters{
-		Signal:  signalFilters.Signal,
-		Filters: filters,
-	}
-}
-
 func (handler *handler) GetQuickFilters(rw http.ResponseWriter, r *http.Request) {
 	claims, err := authtypes.ClaimsFromContext(r.Context())
 	if err != nil {
@@ -113,18 +27,36 @@ func (handler *handler) GetQuickFilters(rw http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	filters, err := handler.module.GetQuickFilters(r.Context(), valuer.MustNewUUID(claims.OrgID), quickfiltertypes.Signal{})
+	filters, err := handler.module.GetQuickFilters(r.Context(), valuer.MustNewUUID(claims.OrgID))
 	if err != nil {
 		render.Error(rw, err)
 		return
 	}
 
-	legacyFilters := make([]*legacySignalFilters, 0, len(filters))
-	for _, signalFilters := range filters {
-		legacyFilters = append(legacyFilters, newLegacySignalFiltersFromSignalFilters(signalFilters))
+	render.Success(rw, http.StatusOK, filters)
+}
+
+func (handler *handler) UpdateQuickFilters(rw http.ResponseWriter, r *http.Request) {
+	claims, err := authtypes.ClaimsFromContext(r.Context())
+	if err != nil {
+		render.Error(rw, err)
+		return
 	}
 
-	render.Success(rw, http.StatusOK, legacyFilters)
+	var req quickfiltertypes.UpdatableQuickFilters
+	decodeErr := json.NewDecoder(r.Body).Decode(&req)
+	if decodeErr != nil {
+		render.Error(rw, decodeErr)
+		return
+	}
+
+	err = handler.module.UpdateQuickFilters(r.Context(), valuer.MustNewUUID(claims.OrgID), req.Signal, req.Filters)
+	if err != nil {
+		render.Error(rw, err)
+		return
+	}
+
+	render.Success(rw, http.StatusNoContent, nil)
 }
 
 func (handler *handler) GetSignalFilters(rw http.ResponseWriter, r *http.Request) {
@@ -141,51 +73,7 @@ func (handler *handler) GetSignalFilters(rw http.ResponseWriter, r *http.Request
 		return
 	}
 
-	filters, err := handler.module.GetQuickFilters(r.Context(), valuer.MustNewUUID(claims.OrgID), validatedSignal)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusOK, newLegacySignalFiltersFromSignalFilters(filters[0]))
-}
-
-func (handler *handler) UpdateQuickFilters(rw http.ResponseWriter, r *http.Request) {
-	claims, err := authtypes.ClaimsFromContext(r.Context())
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	var req legacySignalFilters
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	fieldKeys, err := newTelemetryFieldKeysFromLegacy(req.Signal, req.Filters)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	err = handler.module.UpsertQuickFilters(r.Context(), valuer.MustNewUUID(claims.OrgID), req.Signal, fieldKeys)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusNoContent, nil)
-}
-
-func (handler *handler) ListQuickFiltersV2(rw http.ResponseWriter, r *http.Request) {
-	claims, err := authtypes.ClaimsFromContext(r.Context())
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	filters, err := handler.module.GetQuickFilters(r.Context(), valuer.MustNewUUID(claims.OrgID), quickfiltertypes.Signal{})
+	filters, err := handler.module.GetSignalFilters(r.Context(), valuer.MustNewUUID(claims.OrgID), validatedSignal)
 	if err != nil {
 		render.Error(rw, err)
 		return
@@ -193,48 +81,3 @@ func (handler *handler) ListQuickFiltersV2(rw http.ResponseWriter, r *http.Reque
 
 	render.Success(rw, http.StatusOK, filters)
 }
-
-func (handler *handler) UpdateQuickFiltersV2(rw http.ResponseWriter, r *http.Request) {
-	claims, err := authtypes.ClaimsFromContext(r.Context())
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	var req quickfiltertypes.UpdatableQuickFilters
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	err = handler.module.UpsertQuickFilters(r.Context(), valuer.MustNewUUID(claims.OrgID), req.Signal, req.Filters)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusNoContent, nil)
-}
-
-func (handler *handler) GetQuickFiltersV2(rw http.ResponseWriter, r *http.Request) {
-	claims, err := authtypes.ClaimsFromContext(r.Context())
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	signal := mux.Vars(r)["signal_name"]
-	validatedSignal, err := quickfiltertypes.NewSignal(signal)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	filters, err := handler.module.GetQuickFilters(r.Context(), valuer.MustNewUUID(claims.OrgID), validatedSignal)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusOK, filters[0])
-}

pkg/modules/quickfilter/implquickfilter/handler_test.go

@@ -1,62 +0,0 @@
-package implquickfilter
-
-import (
-	"testing"
-
-	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
-	"github.com/SigNoz/signoz/pkg/types/quickfiltertypes"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestNewTelemetryFieldKeysFromLegacy(t *testing.T) {
-	fieldKeys, err := newTelemetryFieldKeysFromLegacy(quickfiltertypes.SignalTraces, []v3.AttributeKey{
-		{Key: "service.name", Type: v3.AttributeKeyTypeResource, DataType: v3.AttributeKeyDataTypeString},
-		{Key: "http.method", Type: v3.AttributeKeyTypeTag, DataType: v3.AttributeKeyDataTypeString},
-		{Key: "duration_nano", Type: v3.AttributeKeyTypeTag, DataType: v3.AttributeKeyDataTypeFloat64},
-		{Key: "code_line", Type: v3.AttributeKeyTypeTag, DataType: v3.AttributeKeyDataTypeInt64},
-	})
-	require.NoError(t, err)
-	require.Len(t, fieldKeys, 4)
-
-	assert.Equal(t, telemetrytypes.TelemetryFieldKey{Name: "service.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString}, fieldKeys[0])
-	assert.Equal(t, telemetrytypes.FieldContextAttribute, fieldKeys[1].FieldContext)
-	assert.Equal(t, telemetrytypes.FieldDataTypeNumber, fieldKeys[2].FieldDataType)
-	assert.Equal(t, telemetrytypes.FieldDataTypeNumber, fieldKeys[3].FieldDataType)
-
-	t.Run("meter writes restore the per-filter signal", func(t *testing.T) {
-		fieldKeys, err := newTelemetryFieldKeysFromLegacy(quickfiltertypes.SignalMeter, []v3.AttributeKey{
-			{Key: "host.name", DataType: v3.AttributeKeyDataTypeString},
-		})
-		require.NoError(t, err)
-		require.Len(t, fieldKeys, 1)
-		assert.Equal(t, telemetrytypes.SignalMetrics, fieldKeys[0].Signal)
-	})
-
-	t.Run("rejects a filter without a key", func(t *testing.T) {
-		_, err := newTelemetryFieldKeysFromLegacy(quickfiltertypes.SignalTraces, []v3.AttributeKey{{DataType: v3.AttributeKeyDataTypeString}})
-		require.Error(t, err)
-	})
-}
-
-func TestNewLegacySignalFiltersFromSignalFilters(t *testing.T) {
-	legacy := newLegacySignalFiltersFromSignalFilters(&quickfiltertypes.SignalFilters{
-		Signal: quickfiltertypes.SignalLogs,
-		Filters: []telemetrytypes.TelemetryFieldKey{
-			{Name: "service.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-			{Name: "http.method", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-			{Name: "duration_nano", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeNumber},
-			{Name: "severity_text", FieldContext: telemetrytypes.FieldContextLog, FieldDataType: telemetrytypes.FieldDataTypeString},
-			{Name: "host.name", Signal: telemetrytypes.SignalMetrics},
-		},
-	})
-
-	assert.Equal(t, quickfiltertypes.SignalLogs, legacy.Signal)
-	require.Len(t, legacy.Filters, 5)
-	assert.Equal(t, v3.AttributeKey{Key: "service.name", Type: v3.AttributeKeyTypeResource, DataType: v3.AttributeKeyDataTypeString}, legacy.Filters[0])
-	assert.Equal(t, v3.AttributeKeyTypeTag, legacy.Filters[1].Type)
-	assert.Equal(t, v3.AttributeKeyDataTypeFloat64, legacy.Filters[2].DataType)
-	assert.Equal(t, v3.AttributeKeyTypeUnspecified, legacy.Filters[3].Type, "contexts outside the v3 enum must render as unspecified")
-	assert.Equal(t, v3.AttributeKey{Key: "host.name"}, legacy.Filters[4])
-}

pkg/modules/quickfilter/implquickfilter/module.go

@@ -2,11 +2,12 @@ package implquickfilter
 
 import (
 	"context"
+	"encoding/json"
 
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/modules/quickfilter"
+	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/types/quickfiltertypes"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
@@ -18,50 +19,91 @@ func NewModule(store quickfiltertypes.QuickFilterStore) quickfilter.Module {
 	return &module{store: store}
 }
 
-// GetQuickFilters returns quick filters for a signal, or for every signal when signal is zero.
-func (module *module) GetQuickFilters(ctx context.Context, orgID valuer.UUID, signal quickfiltertypes.Signal) ([]*quickfiltertypes.SignalFilters, error) {
-	if signal.IsZero() {
-		storedFilters, err := module.store.Get(ctx, orgID)
-		if err != nil {
-			return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "error fetching organization filters")
-		}
-
-		result := make([]*quickfiltertypes.SignalFilters, 0, len(storedFilters))
-		for _, storedFilter := range storedFilters {
-			signalFilter, err := quickfiltertypes.NewSignalFilterFromStorableQuickFilter(storedFilter)
-			if err != nil {
-				return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "error processing filter for signal: %s", storedFilter.Signal)
-			}
-			result = append(result, signalFilter)
-		}
-
-		return result, nil
+// GetQuickFilters returns all quick filters for an organization.
+func (module *module) GetQuickFilters(ctx context.Context, orgID valuer.UUID) ([]*quickfiltertypes.SignalFilters, error) {
+	storedFilters, err := module.store.Get(ctx, orgID)
+	if err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "error fetching organization filters")
 	}
 
-	storedFilter, err := module.store.GetBySignal(ctx, orgID, signal.StringValue())
-	if err != nil {
-		if errors.Ast(err, errors.TypeNotFound) {
-			return []*quickfiltertypes.SignalFilters{quickfiltertypes.NewSignalFiltersFromSignal(signal)}, nil
+	result := make([]*quickfiltertypes.SignalFilters, 0, len(storedFilters))
+	for _, storedFilter := range storedFilters {
+		signalFilter, err := quickfiltertypes.NewSignalFilterFromStorableQuickFilter(storedFilter)
+		if err != nil {
+			return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "error processing filter for signal: %s", storedFilter.Signal)
 		}
+		result = append(result, signalFilter)
+	}
+
+	return result, nil
+}
+
+// GetSignalFilters returns quick filters for a specific signal in an organization.
+func (m *module) GetSignalFilters(ctx context.Context, orgID valuer.UUID, signal quickfiltertypes.Signal) (*quickfiltertypes.SignalFilters, error) {
+	storedFilter, err := m.store.GetBySignal(ctx, orgID, signal.StringValue())
+	if err != nil {
 		return nil, err
 	}
 
+	// If no filter exists for this signal, return empty filters with the requested signal
+	if storedFilter == nil {
+		return &quickfiltertypes.SignalFilters{
+			Signal:  signal,
+			Filters: []v3.AttributeKey{},
+		}, nil
+	}
+
+	// Convert stored filter to signal filter
 	signalFilter, err := quickfiltertypes.NewSignalFilterFromStorableQuickFilter(storedFilter)
 	if err != nil {
 		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "error processing filter for signal: %s", storedFilter.Signal)
 	}
 
-	return []*quickfiltertypes.SignalFilters{signalFilter}, nil
+	return signalFilter, nil
 }
 
-// UpsertQuickFilters replaces quick filters for a specific signal in an organization, creating them if absent.
-func (module *module) UpsertQuickFilters(ctx context.Context, orgID valuer.UUID, signal quickfiltertypes.Signal, filters []telemetrytypes.TelemetryFieldKey) error {
-	filter, err := quickfiltertypes.NewStorableQuickFilter(orgID, signal, filters)
+// UpdateQuickFilters updates quick filters for a specific signal in an organization.
+func (module *module) UpdateQuickFilters(ctx context.Context, orgID valuer.UUID, signal quickfiltertypes.Signal, filters []v3.AttributeKey) error {
+	// Validate each filter
+	for _, filter := range filters {
+		if err := filter.Validate(); err != nil {
+			return errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "invalid filter: %v", err)
+		}
+	}
+
+	// Marshal filters to JSON
+	filterJSON, err := json.Marshal(filters)
 	if err != nil {
+		return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "error marshalling filters")
+	}
+
+	// Check if filter exists
+	existingFilter, err := module.store.GetBySignal(ctx, orgID, signal.StringValue())
+	if err != nil {
+		return errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "error checking existing filters")
+	}
+
+	var filter *quickfiltertypes.StorableQuickFilter
+	if existingFilter != nil {
+		// Update in place
+		if err := existingFilter.Update(filterJSON); err != nil {
+			return errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "error updating existing filter")
+		}
+		filter = existingFilter
+	} else {
+		// Create new
+		filter, err = quickfiltertypes.NewStorableQuickFilter(orgID, signal, filterJSON)
+		if err != nil {
+			return errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "error creating new filter")
+		}
+	}
+
+	// Persist filter
+	if err := module.store.Upsert(ctx, filter); err != nil {
 		return err
 	}
 
-	return module.store.Upsert(ctx, filter)
+	return nil
 }
 
 func (module *module) SetDefaultConfig(ctx context.Context, orgID valuer.UUID) error {

pkg/modules/quickfilter/implquickfilter/store.go

@@ -62,7 +62,7 @@ func (s *store) Upsert(ctx context.Context, filter *quickfiltertypes.StorableQui
 		BunDB().
 		NewInsert().
 		Model(filter).
-		On("CONFLICT (org_id, signal) DO UPDATE").
+		On("CONFLICT (id) DO UPDATE").
 		Set("filter = EXCLUDED.filter").
 		Set("updated_at = EXCLUDED.updated_at").
 		Exec(ctx)

pkg/modules/quickfilter/quickfilter.go

@@ -4,25 +4,20 @@ import (
 	"context"
 	"net/http"
 
+	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/types/quickfiltertypes"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
 type Module interface {
-	// GetQuickFilters returns quick filters for a signal, or for every signal when signal is zero.
-	GetQuickFilters(ctx context.Context, orgID valuer.UUID, signal quickfiltertypes.Signal) ([]*quickfiltertypes.SignalFilters, error)
-	UpsertQuickFilters(ctx context.Context, orgID valuer.UUID, signal quickfiltertypes.Signal, filters []telemetrytypes.TelemetryFieldKey) error
+	GetQuickFilters(ctx context.Context, orgID valuer.UUID) ([]*quickfiltertypes.SignalFilters, error)
+	UpdateQuickFilters(ctx context.Context, orgID valuer.UUID, signal quickfiltertypes.Signal, filters []v3.AttributeKey) error
+	GetSignalFilters(ctx context.Context, orgID valuer.UUID, signal quickfiltertypes.Signal) (*quickfiltertypes.SignalFilters, error)
 	SetDefaultConfig(ctx context.Context, orgID valuer.UUID) error
 }
 
 type Handler interface {
-	// Legacy v1 endpoints, served by converting to and from the v3 attribute key shape.
 	GetQuickFilters(http.ResponseWriter, *http.Request)
 	UpdateQuickFilters(http.ResponseWriter, *http.Request)
 	GetSignalFilters(http.ResponseWriter, *http.Request)
-
-	ListQuickFiltersV2(http.ResponseWriter, *http.Request)
-	GetQuickFiltersV2(http.ResponseWriter, *http.Request)
-	UpdateQuickFiltersV2(http.ResponseWriter, *http.Request)
 }

pkg/query-service/app/http_handler.go

@@ -439,7 +439,7 @@ func (aH *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 	router.HandleFunc("/api/v2/traces/fields", am.EditAccess(aH.updateTraceField)).Methods(http.MethodPost)
 
 	router.HandleFunc("/api/v1/version", am.OpenAccess(aH.getVersion)).Methods(http.MethodGet)
-	router.HandleFunc("/api/v1/features", am.OpenAccess(aH.getFeatureFlags)).Methods(http.MethodGet)
+	router.HandleFunc("/api/v1/features", am.ViewAccess(aH.getFeatureFlags)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/health", am.OpenAccess(aH.getHealth)).Methods(http.MethodGet)
 
 	router.HandleFunc("/api/v1/listErrors", am.ViewAccess(aH.listErrors)).Methods(http.MethodPost)
@@ -450,7 +450,7 @@ func (aH *APIHandler) RegisterRoutes(router *mux.Router, am *middleware.AuthZ) {
 
 	router.HandleFunc("/api/v1/disks", am.ViewAccess(aH.getDisks)).Methods(http.MethodGet)
 
-	// Quick Filters (v1 routes serve the legacy v3 shape; v2 lives in signozapiserver)
+	// Quick Filters
 	router.HandleFunc("/api/v1/orgs/me/filters", am.ViewAccess(aH.Signoz.Handlers.QuickFilter.GetQuickFilters)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/orgs/me/filters/{signal}", am.ViewAccess(aH.Signoz.Handlers.QuickFilter.GetSignalFilters)).Methods(http.MethodGet)
 	router.HandleFunc("/api/v1/orgs/me/filters", am.AdminAccess(aH.Signoz.Handlers.QuickFilter.UpdateQuickFilters)).Methods(http.MethodPut)
@@ -1497,7 +1497,7 @@ func (aH *APIHandler) getFeatureFlags(w http.ResponseWriter, r *http.Request) {
 
 	claims, err := authtypes.ClaimsFromContext(r.Context())
 	if err != nil {
-		aH.HandleError(w, err, http.StatusUnauthorized)
+		aH.HandleError(w, err, http.StatusInternalServerError)
 		return
 	}
 

pkg/querybuilder/key_resolution.go

@@ -107,8 +107,8 @@ func SynthesizeKeys(field *telemetrytypes.TelemetryFieldKey, value any) []*telem
 		fieldContext = telemetrytypes.FieldContextAttribute
 	}
 	fieldDataType := field.FieldDataType
-	// Resource and scope values are strings; pin the type so operand coercion applies.
-	if (fieldContext == telemetrytypes.FieldContextResource || fieldContext == telemetrytypes.FieldContextScope) &&
+	// Resource values are strings; pin the type so operand coercion applies.
+	if fieldContext == telemetrytypes.FieldContextResource &&
 		fieldDataType == telemetrytypes.FieldDataTypeUnspecified {
 		fieldDataType = telemetrytypes.FieldDataTypeString
 	}

pkg/querybuilder/query_to_keys.go

@@ -56,17 +56,6 @@ func QueryStringToKeysSelectors(query string) []*telemetrytypes.FieldKeySelector
 					FieldDataType: key.FieldDataType,
 				})
 			}
-
-			// todo(tushar): consider reverting changes done to this method in below PR to avoid scope specific checks
-			// https://github.com/SigNoz/signoz/issues/11374
-			if key.FieldContext == telemetrytypes.FieldContextScope {
-				keys = append(keys, &telemetrytypes.FieldKeySelector{
-					Name:          key.FieldContext.StringValue() + "." + key.Name,
-					Signal:        key.Signal,
-					FieldContext:  telemetrytypes.FieldContextUnspecified, // this allows 'scope.' prefix for keys with other context as well
-					FieldDataType: key.FieldDataType,
-				})
-			}
 		}
 	}
 

pkg/querybuilder/query_to_keys_test.go

@@ -72,44 +72,6 @@ func TestQueryToKeys(t *testing.T) {
 				},
 			},
 		},
-		{
-			query: `scope.version = '1.0.0'`,
-			expectedKeys: []telemetrytypes.FieldKeySelector{
-				{
-					Name:          "version",
-					Signal:        telemetrytypes.SignalUnspecified,
-					FieldContext:  telemetrytypes.FieldContextScope,
-					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
-				},
-				{
-					Name:          "scope.version",
-					Signal:        telemetrytypes.SignalUnspecified,
-					FieldContext:  telemetrytypes.FieldContextUnspecified,
-					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
-				},
-			},
-		},
-		{
-			// A scope attribute whose own name carries a `scope.` prefix. `scope.prefixed`
-			// normalizes to {prefixed, scope}; the second selector re-adds the prefix so the
-			// metadata fetch can target the attribute's exact key `scope.prefixed` rather than
-			// relying on the broad `%prefixed%` match.
-			query: `scope.prefixed = 'x'`,
-			expectedKeys: []telemetrytypes.FieldKeySelector{
-				{
-					Name:          "prefixed",
-					Signal:        telemetrytypes.SignalUnspecified,
-					FieldContext:  telemetrytypes.FieldContextScope,
-					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
-				},
-				{
-					Name:          "scope.prefixed",
-					Signal:        telemetrytypes.SignalUnspecified,
-					FieldContext:  telemetrytypes.FieldContextUnspecified,
-					FieldDataType: telemetrytypes.FieldDataTypeUnspecified,
-				},
-			},
-		},
 	}
 
 	for _, testCase := range testCases {

pkg/signoz/openapi.go

@@ -29,7 +29,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/organization"
 	"github.com/SigNoz/signoz/pkg/modules/preference"
 	"github.com/SigNoz/signoz/pkg/modules/promote"
-	"github.com/SigNoz/signoz/pkg/modules/quickfilter"
 	"github.com/SigNoz/signoz/pkg/modules/rawdataexport"
 	"github.com/SigNoz/signoz/pkg/modules/rulestatehistory"
 	"github.com/SigNoz/signoz/pkg/modules/savedview"
@@ -94,7 +93,6 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ ruler.Handler }{},
 		struct{ statsreporter.Handler }{},
 		struct{ savedview.Handler }{},
-		struct{ quickfilter.Handler }{},
 	).New(ctx, instrumentation.ToProviderSettings(), apiserver.Config{})
 	if err != nil {
 		return nil, err

pkg/signoz/provider.go

@@ -244,9 +244,6 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewDeleteOrphanUserRolesFactory(),
 		sqlmigration.NewMigrateLambdaDashboardsFactory(),
 		sqlmigration.NewAddAuthDomainTuplesFactory(sqlstore),
-		sqlmigration.NewAddDeploymentHostTuplesFactory(sqlstore),
-		sqlmigration.NewMigrateQuickFiltersFactory(sqlstore),
-		sqlmigration.NewAddQuickFilterTuplesFactory(sqlstore),
 	)
 }
 
@@ -350,7 +347,6 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.RulerHandler,
 			handlers.StatsHandler,
 			handlers.SavedView,
-			handlers.QuickFilter,
 		),
 	)
 }

pkg/sqlmigration/118_add_deployment_host_tuples.go

@@ -1,161 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/oklog/ulid/v2"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/dialect"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addDeploymentHostTuples struct {
-	sqlstore sqlstore.SQLStore
-}
-
-func NewAddDeploymentHostTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_deployment_host_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addDeploymentHostTuples{sqlstore: sqlstore}, nil
-	})
-}
-
-func (migration *addDeploymentHostTuples) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addDeploymentHostTuples) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var storeID string
-	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
-	if err != nil {
-		return err
-	}
-
-	var orgIDs []string
-	err = tx.NewSelect().
-		Table("organizations").
-		Column("id").
-		Scan(ctx, &orgIDs)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
-
-	// zeus hosts moved from the legacy ViewAccess/AdminAccess role gates to
-	// CheckResources, which on enterprise requires real tuples -- existing orgs
-	// never had these written, only new orgs get them from the registry at bootstrap.
-	tuples := []migrationTuple{
-		{authtypes.SigNozAdminRoleName, "metaresource", "deployment-host", "list"},
-		{authtypes.SigNozAdminRoleName, "metaresource", "deployment-host", "update"},
-		{authtypes.SigNozEditorRoleName, "metaresource", "deployment-host", "list"},
-		{authtypes.SigNozViewerRoleName, "metaresource", "deployment-host", "list"},
-	}
-
-	for _, orgID := range orgIDs {
-		for _, tuple := range tuples {
-			entropy := ulid.DefaultEntropy()
-			now := time.Now().UTC()
-			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
-
-			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
-			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
-
-			if isPG {
-				user := "role:" + roleSubject + "#assignee"
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			} else {
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			}
-		}
-	}
-
-	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
-	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
-		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
-		if err != nil {
-			return err
-		}
-		managedRoleGroups[roleName] = string(data)
-	}
-
-	for _, orgID := range orgIDs {
-		for roleName, data := range managedRoleGroups {
-			if _, err := tx.NewUpdate().
-				Model(new(roles)).
-				Set("transaction_groups = ?", data).
-				Where("org_id = ?", orgID).
-				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
-				Where("name = ?", roleName).
-				Exec(ctx); err != nil {
-				return err
-			}
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addDeploymentHostTuples) Down(context.Context, *bun.DB) error {
-	return nil
-}

pkg/sqlmigration/120_migrate_quick_filters.go

@@ -1,170 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"encoding/json"
-	"log/slog"
-	"strings"
-
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/migrate"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-)
-
-type storableQuickFilterRow struct {
-	bun.BaseModel `bun:"table:quick_filter"`
-
-	ID     string `bun:"id,pk"`
-	Filter string `bun:"filter"`
-}
-
-// legacyQuickFilterEntry carries both shapes a stored entry can be in: the
-// legacy key/type/dataType shape and the current name-carrying shape.
-type legacyQuickFilterEntry struct {
-	Name     string `json:"name"`
-	Key      string `json:"key"`
-	Type     string `json:"type"`
-	DataType string `json:"dataType"`
-	Signal   string `json:"signal"`
-}
-
-// quickFilterLegacyTypeToFieldContext maps the v3 attribute key types the v1
-// write path could store. Materialized top-level fields carried no type, and
-// anything unknown (e.g. "Sum" in the old meter defaults) normalizes to
-// unspecified, matching what the v1 write path does at runtime.
-var quickFilterLegacyTypeToFieldContext = map[string]string{
-	"tag":      "attribute",
-	"resource": "resource",
-	"scope":    "scope",
-}
-
-// quickFilterLegacyDataTypeToFieldDataType maps the v3 attribute key data
-// types the v1 write path could store, with numerics collapsed to number,
-// matching the fields API and the v1 write path.
-var quickFilterLegacyDataTypeToFieldDataType = map[string]string{
-	"string":  "string",
-	"bool":    "bool",
-	"int64":   "number",
-	"float64": "number",
-}
-
-// quickFilterFieldDataType resolves legacy datatype spellings, with unknowns
-// normalized to unspecified.
-func quickFilterFieldDataType(legacyDataType string) string {
-	return quickFilterLegacyDataTypeToFieldDataType[strings.ToLower(strings.TrimSpace(legacyDataType))]
-}
-
-// quickFilterFieldContext resolves legacy type spellings, with unknowns
-// normalized to unspecified.
-func quickFilterFieldContext(legacyType string) string {
-	return quickFilterLegacyTypeToFieldContext[strings.ToLower(strings.TrimSpace(legacyType))]
-}
-
-type migrateQuickFilters struct {
-	sqlstore sqlstore.SQLStore
-	settings factory.ProviderSettings
-}
-
-func NewMigrateQuickFiltersFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("migrate_quick_filters"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &migrateQuickFilters{sqlstore: sqlstore, settings: ps}, nil
-	})
-}
-
-func (migration *migrateQuickFilters) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *migrateQuickFilters) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var rows []*storableQuickFilterRow
-	if err := tx.NewSelect().Model(&rows).Scan(ctx); err != nil {
-		return err
-	}
-
-	var migrated, skipped int
-	for _, row := range rows {
-		migratedFilter, changed, ok := migrateQuickFilterEntries(row.Filter)
-		if !ok {
-			migration.settings.Logger.WarnContext(ctx, "quick filter could not be parsed, leaving it untouched", slog.String("quick_filter_id", row.ID), slog.String("raw_filter", row.Filter))
-			skipped++
-			continue
-		}
-		if !changed {
-			continue
-		}
-
-		migrated++
-		if _, err := tx.NewUpdate().Model((*storableQuickFilterRow)(nil)).Set("filter = ?", migratedFilter).Where("id = ?", row.ID).Exec(ctx); err != nil {
-			return err
-		}
-	}
-
-	migration.settings.Logger.InfoContext(ctx, "migrated quick filters to telemetry field keys", slog.Int("total", len(rows)), slog.Int("migrated", migrated), slog.Int("skipped", skipped))
-
-	return tx.Commit()
-}
-
-func (migration *migrateQuickFilters) Down(context.Context, *bun.DB) error {
-	return nil
-}
-
-// migrateQuickFilterEntries rewrites a stored filter list from the legacy
-// key/dataType/type shape to telemetry field keys; ok=false means unparseable.
-func migrateQuickFilterEntries(filter string) (migrated string, changed bool, ok bool) {
-	var entriesRaw []json.RawMessage
-	if err := json.Unmarshal([]byte(filter), &entriesRaw); err != nil {
-		return "", false, false
-	}
-
-	migratedEntries := make([]json.RawMessage, 0, len(entriesRaw))
-	for _, rawEntry := range entriesRaw {
-		var entry legacyQuickFilterEntry
-		if err := json.Unmarshal(rawEntry, &entry); err != nil {
-			// Some stored entries are plain strings rather than objects; treat
-			// the string as the filter key name, dropping empty ones.
-			var name string
-			if err := json.Unmarshal(rawEntry, &name); err != nil {
-				return "", false, false
-			}
-			entry = legacyQuickFilterEntry{Key: name}
-		}
-
-		switch {
-		case entry.Name != "":
-			migratedEntries = append(migratedEntries, rawEntry)
-		case entry.Key != "":
-			migratedJSON, err := marshalUnescaped(telemetryFieldKeyOutput{
-				Name:          entry.Key,
-				Signal:        entry.Signal,
-				FieldContext:  quickFilterFieldContext(entry.Type),
-				FieldDataType: quickFilterFieldDataType(entry.DataType),
-			})
-			if err != nil {
-				return "", false, false
-			}
-			migratedEntries = append(migratedEntries, migratedJSON)
-			changed = true
-		default:
-			changed = true
-		}
-	}
-
-	if !changed {
-		return "", false, true
-	}
-
-	migratedJSON, err := marshalUnescaped(migratedEntries)
-	if err != nil {
-		return "", false, false
-	}
-
-	return string(migratedJSON), true, true
-}

pkg/sqlmigration/121_add_quick_filter_tuples.go

@@ -1,139 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"database/sql"
-	"time"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/oklog/ulid/v2"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/dialect"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addQuickFilterTuples struct {
-	sqlstore sqlstore.SQLStore
-}
-
-func NewAddQuickFilterTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_quick_filter_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addQuickFilterTuples{sqlstore: sqlstore}, nil
-	})
-}
-
-func (migration *addQuickFilterTuples) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addQuickFilterTuples) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-	defer func() { _ = tx.Rollback() }()
-
-	var storeID string
-	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
-	if err != nil {
-		return err
-	}
-
-	var orgIDs []string
-	err = tx.NewSelect().
-		Table("organizations").
-		Column("id").
-		Scan(ctx, &orgIDs)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
-
-	// quick-filter moved from the legacy ViewAccess/AdminAccess role gate to
-	// CheckResources, which on enterprise requires real tuples -- existing orgs
-	// never had these written, only new orgs get them from the registry at bootstrap.
-	tuples := []migrationTuple{
-		{authtypes.SigNozAdminRoleName, "metaresource", "quick-filter", "read"},
-		{authtypes.SigNozAdminRoleName, "metaresource", "quick-filter", "update"},
-		{authtypes.SigNozAdminRoleName, "metaresource", "quick-filter", "list"},
-		{authtypes.SigNozEditorRoleName, "metaresource", "quick-filter", "read"},
-		{authtypes.SigNozEditorRoleName, "metaresource", "quick-filter", "list"},
-		{authtypes.SigNozViewerRoleName, "metaresource", "quick-filter", "read"},
-		{authtypes.SigNozViewerRoleName, "metaresource", "quick-filter", "list"},
-	}
-
-	for _, orgID := range orgIDs {
-		for _, tuple := range tuples {
-			entropy := ulid.DefaultEntropy()
-			now := time.Now().UTC()
-			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
-
-			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
-			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
-
-			if isPG {
-				user := "role:" + roleSubject + "#assignee"
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			} else {
-				result, err := tx.ExecContext(ctx, `
-					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-				rowsAffected, err := result.RowsAffected()
-				if err != nil {
-					return err
-				}
-				if rowsAffected == 0 {
-					continue
-				}
-				_, err = tx.ExecContext(ctx, `
-					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
-					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
-					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
-				)
-				if err != nil {
-					return err
-				}
-			}
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addQuickFilterTuples) Down(context.Context, *bun.DB) error {
-	return nil
-}

pkg/statementbuilder/tracesstatementbuilder/statement_builder.go

@@ -204,15 +204,31 @@ func getKeySelectors(query qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation])
 	}
 
 	for idx := range query.GroupBy {
-		keySelectors = append(keySelectors, keySelectorsForField(query.GroupBy[idx].TelemetryFieldKey)...)
+		groupBy := query.GroupBy[idx]
+		keySelectors = append(keySelectors, &telemetrytypes.FieldKeySelector{
+			Name:          groupBy.Name,
+			Signal:        telemetrytypes.SignalTraces,
+			FieldContext:  groupBy.FieldContext,
+			FieldDataType: groupBy.FieldDataType,
+		})
 	}
 
 	for idx := range query.SelectFields {
-		keySelectors = append(keySelectors, keySelectorsForField(query.SelectFields[idx])...)
+		keySelectors = append(keySelectors, &telemetrytypes.FieldKeySelector{
+			Name:          query.SelectFields[idx].Name,
+			Signal:        telemetrytypes.SignalTraces,
+			FieldContext:  query.SelectFields[idx].FieldContext,
+			FieldDataType: query.SelectFields[idx].FieldDataType,
+		})
 	}
 
 	for idx := range query.Order {
-		keySelectors = append(keySelectors, keySelectorsForField(query.Order[idx].Key.TelemetryFieldKey)...)
+		keySelectors = append(keySelectors, &telemetrytypes.FieldKeySelector{
+			Name:          query.Order[idx].Key.Name,
+			Signal:        telemetrytypes.SignalTraces,
+			FieldContext:  query.Order[idx].Key.FieldContext,
+			FieldDataType: query.Order[idx].Key.FieldDataType,
+		})
 	}
 
 	for idx := range keySelectors {
@@ -223,26 +239,6 @@ func getKeySelectors(query qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation])
 	return keySelectors
 }
 
-func keySelectorsForField(key telemetrytypes.TelemetryFieldKey) []*telemetrytypes.FieldKeySelector {
-	selectors := []*telemetrytypes.FieldKeySelector{
-		{
-			Name:          key.Name,
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  key.FieldContext,
-			FieldDataType: key.FieldDataType,
-		},
-	}
-	if key.FieldContext != telemetrytypes.FieldContextUnspecified {
-		selectors = append(selectors, &telemetrytypes.FieldKeySelector{
-			Name:          key.FieldContext.StringValue() + "." + key.Name,
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  telemetrytypes.FieldContextUnspecified,
-			FieldDataType: key.FieldDataType,
-		})
-	}
-	return selectors
-}
-
 // mergeDeprecatedTraceKeys prepends deprecated intrinsic/calculated trace field
 // definitions to the keys map. We do this during statement building, not at
 // metadata fetch time, because:
@@ -314,14 +310,20 @@ func adjustTraceKey(key *telemetrytypes.TelemetryFieldKey, keys map[string][]*te
 
 		For example: trace_id (intrinsic), response_status_code (calculated).
 	*/
-	// Resolve against the context-qualified name first, then the bare name since that can be instrinsic field e.g. scope.name.
 	var isIntrinsicOrCalculatedField bool
 	var intrinsicOrCalculatedField telemetrytypes.TelemetryFieldKey
-	if key.FieldContext != telemetrytypes.FieldContextUnspecified {
-		intrinsicOrCalculatedField, isIntrinsicOrCalculatedField = lookupIntrinsicOrCalculatedField(key.FieldContext.StringValue() + "." + key.Name)
-	}
-	if !isIntrinsicOrCalculatedField {
-		intrinsicOrCalculatedField, isIntrinsicOrCalculatedField = lookupIntrinsicOrCalculatedField(key.Name)
+	if _, ok := tracestelemetryschema.IntrinsicFields[key.Name]; ok {
+		isIntrinsicOrCalculatedField = true
+		intrinsicOrCalculatedField = tracestelemetryschema.IntrinsicFields[key.Name]
+	} else if _, ok := tracestelemetryschema.CalculatedFields[key.Name]; ok {
+		isIntrinsicOrCalculatedField = true
+		intrinsicOrCalculatedField = tracestelemetryschema.CalculatedFields[key.Name]
+	} else if _, ok := tracestelemetryschema.IntrinsicFieldsDeprecated[key.Name]; ok {
+		isIntrinsicOrCalculatedField = true
+		intrinsicOrCalculatedField = tracestelemetryschema.IntrinsicFieldsDeprecated[key.Name]
+	} else if _, ok := tracestelemetryschema.CalculatedFieldsDeprecated[key.Name]; ok {
+		isIntrinsicOrCalculatedField = true
+		intrinsicOrCalculatedField = tracestelemetryschema.CalculatedFieldsDeprecated[key.Name]
 	}
 
 	if isIntrinsicOrCalculatedField {
@@ -333,24 +335,6 @@ func adjustTraceKey(key *telemetrytypes.TelemetryFieldKey, keys map[string][]*te
 	return actions
 }
 
-// lookupIntrinsicOrCalculatedField returns the intrinsic or calculated field registered under
-// name, across the current and deprecated tables.
-func lookupIntrinsicOrCalculatedField(name string) (telemetrytypes.TelemetryFieldKey, bool) {
-	if f, ok := tracestelemetryschema.IntrinsicFields[name]; ok {
-		return f, true
-	}
-	if f, ok := tracestelemetryschema.CalculatedFields[name]; ok {
-		return f, true
-	}
-	if f, ok := tracestelemetryschema.IntrinsicFieldsDeprecated[name]; ok {
-		return f, true
-	}
-	if f, ok := tracestelemetryschema.CalculatedFieldsDeprecated[name]; ok {
-		return f, true
-	}
-	return telemetrytypes.TelemetryFieldKey{}, false
-}
-
 // buildListQuery builds a query for list panel type.
 func (b *traceQueryStatementBuilder) buildListQuery(
 	ctx context.Context,

pkg/statementbuilder/tracesstatementbuilder/stmt_builder_test.go

@@ -374,94 +374,6 @@ func TestStatementBuilder(t *testing.T) {
 			},
 			expectedErr: nil,
 		},
-		{
-			name:        "scope.name filter and group by",
-			requestType: qbtypes.RequestTypeTimeSeries,
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Aggregations: []qbtypes.TraceAggregation{
-					{
-						Expression: "count()",
-					},
-				},
-				Filter: &qbtypes.Filter{
-					Expression: "scope.name = 'opentelemetry-io'",
-				},
-				Limit: 10,
-				GroupBy: []qbtypes.GroupByKey{
-					{
-						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
-							Name:         "scope.name",
-							FieldContext: telemetrytypes.FieldContextScope,
-						},
-					},
-				},
-			},
-			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.name::String = ? AND scope.name::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_scope.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.name::String = ? AND scope.name::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_scope.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_scope.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_scope.name`",
-				Args:  []any{"opentelemetry-io", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "opentelemetry-io", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
-			},
-			expectedErr: nil,
-		},
-		{
-			name:        "scope.version filter with scope.name group by",
-			requestType: qbtypes.RequestTypeTimeSeries,
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Aggregations: []qbtypes.TraceAggregation{
-					{
-						Expression: "count()",
-					},
-				},
-				Filter: &qbtypes.Filter{
-					Expression: "scope.version = '1.0.0'",
-				},
-				Limit: 10,
-				GroupBy: []qbtypes.GroupByKey{
-					{
-						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
-							Name:         "scope.name",
-							FieldContext: telemetrytypes.FieldContextScope,
-						},
-					},
-				},
-			},
-			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_scope.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(scope.name::String <> '', scope.name::String, NULL)) AS `__GROUP_BY_KEY_0_scope.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_scope.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_scope.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_scope.name`",
-				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
-			},
-			expectedErr: nil,
-		},
-		{
-			name:        "scope.version filter only (no scope field in group by)",
-			requestType: qbtypes.RequestTypeTimeSeries,
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Aggregations: []qbtypes.TraceAggregation{
-					{
-						Expression: "count()",
-					},
-				},
-				Filter: &qbtypes.Filter{
-					Expression: "scope.version = '1.0.0'",
-				},
-				Limit: 10,
-				GroupBy: []qbtypes.GroupByKey{
-					{
-						TelemetryFieldKey: telemetrytypes.TelemetryFieldKey{
-							Name: "service.name",
-						},
-					},
-				},
-			},
-			expected: qbtypes.Statement{
-				Query: "WITH __limit_cte AS (SELECT toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? GROUP BY `__GROUP_BY_KEY_0_service.name` ORDER BY __result_0 DESC LIMIT ?) SELECT toStartOfInterval(timestamp, INTERVAL 30 SECOND) AS ts, toString(multiIf(multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL) IS NOT NULL, multiIf(resource.`service.name` IS NOT NULL, resource.`service.name`::String, mapContains(resources_string, 'service.name'), resources_string['service.name'], NULL), NULL)) AS `__GROUP_BY_KEY_0_service.name`, count() AS __result_0 FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? AND (`__GROUP_BY_KEY_0_service.name`) GLOBAL IN (SELECT `__GROUP_BY_KEY_0_service.name` FROM __limit_cte) GROUP BY ts, `__GROUP_BY_KEY_0_service.name`",
-				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10, "1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448)},
-			},
-		},
 	}
 
 	fl := flaggertest.New(t)
@@ -888,143 +800,6 @@ func TestStatementBuilderListQueryWithCorruptData(t *testing.T) {
 			},
 			expectedErr: nil,
 		},
-		{
-			name:        "List query with scope filter only (no scope in select or group by)",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap: map[string][]*telemetrytypes.TelemetryFieldKey{
-				"scope.version": {
-					{
-						Name:          "scope.version",
-						Signal:        telemetrytypes.SignalTraces,
-						FieldContext:  telemetrytypes.FieldContextScope,
-						FieldDataType: telemetrytypes.FieldDataTypeString,
-					},
-				},
-			},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter: &qbtypes.Filter{
-					Expression: "scope.version = '1.0.0'",
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, trace_state AS `__SELECT_KEY_3_trace_state`, parent_span_id AS `__SELECT_KEY_4_parent_span_id`, flags AS `__SELECT_KEY_5_flags`, name AS `__SELECT_KEY_6_name`, kind AS `__SELECT_KEY_7_kind`, kind_string AS `__SELECT_KEY_8_kind_string`, duration_nano AS `__SELECT_KEY_9_duration_nano`, status_code AS `__SELECT_KEY_10_status_code`, status_message AS `__SELECT_KEY_11_status_message`, status_code_string AS `__SELECT_KEY_12_status_code_string`, events AS `__SELECT_KEY_13_events`, links AS `__SELECT_KEY_14_links`, response_status_code AS `__SELECT_KEY_15_response_status_code`, external_http_url AS `__SELECT_KEY_16_external_http_url`, http_url AS `__SELECT_KEY_17_http_url`, external_http_method AS `__SELECT_KEY_18_external_http_method`, http_method AS `__SELECT_KEY_19_http_method`, http_host AS `__SELECT_KEY_20_http_host`, db_name AS `__SELECT_KEY_21_db_name`, db_operation AS `__SELECT_KEY_22_db_operation`, has_error AS `__SELECT_KEY_23_has_error`, is_remote AS `__SELECT_KEY_24_is_remote`, attributes_string, attributes_number, attributes_bool, resources_string FROM signoz_traces.distributed_signoz_index_v3 WHERE (scope.version::String = ? AND scope.version::String <> '') AND timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1.0.0", "1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
-		{
-			// Regression test: scope.version in selectFields with no metadata (isColumn=true filters it out)
-			// must still produce scope.version::String, not scope.attributes.version::String
-			name:        "scope.version in selectFields only, no metadata (intrinsic field fallback)",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap:     map[string][]*telemetrytypes.TelemetryFieldKey{},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter:       &qbtypes.Filter{},
-				SelectFields: []telemetrytypes.TelemetryFieldKey{
-					{Name: "scope.version", FieldContext: telemetrytypes.FieldContextUnspecified},
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.version::String <> '', scope.version::String, NULL) AS `__SELECT_KEY_3_scope.version` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
-		{
-			// A scope attribute whose own name literally carries a `scope.` prefix (`scope.prefixed`,
-			// normalized to {prefixed, scope}) resolves to that attribute in a SELECT even without a
-			// filter: getKeySelectors emits the reconstructed `scope.prefixed` selector so the metadata
-			// fetch surfaces it and AdjustKey recovers the full name. Without it the `scope.` prefix is
-			// lost and it wrongly reads `scope.attributes.prefixed`.
-			name:        "scope-prefixed attribute in selectFields resolves without a filter",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap: map[string][]*telemetrytypes.TelemetryFieldKey{
-				"scope.prefixed": {
-					{
-						Name:          "scope.prefixed",
-						Signal:        telemetrytypes.SignalTraces,
-						FieldContext:  telemetrytypes.FieldContextScope,
-						FieldDataType: telemetrytypes.FieldDataTypeString,
-					},
-				},
-			},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter:       &qbtypes.Filter{},
-				SelectFields: []telemetrytypes.TelemetryFieldKey{
-					{Name: "prefixed", FieldContext: telemetrytypes.FieldContextScope},
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.attributes.`scope.prefixed` IS NOT NULL, scope.attributes.`scope.prefixed`::String, NULL) AS `__SELECT_KEY_3_scope.prefixed` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
-		{
-			// A scope-context key whose name matches a declared scope path resolves to that
-			// declared path (scope.name), not the span `name` column and not an undeclared
-			// scope attribute. getTracesKeys surfaces the declared path as an intrinsic key
-			// (metadata.go), which shadows the same-named span intrinsic.
-			name:        "scope-context name resolves to the declared scope path",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap: map[string][]*telemetrytypes.TelemetryFieldKey{
-				"scope.name": {
-					{
-						Name:          "scope.name",
-						Signal:        telemetrytypes.SignalTraces,
-						FieldContext:  telemetrytypes.FieldContextScope,
-						FieldDataType: telemetrytypes.FieldDataTypeString,
-					},
-				},
-				"name": {
-					{
-						Name:          "name",
-						Signal:        telemetrytypes.SignalTraces,
-						FieldContext:  telemetrytypes.FieldContextSpan,
-						FieldDataType: telemetrytypes.FieldDataTypeString,
-					},
-				},
-			},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter:       &qbtypes.Filter{},
-				SelectFields: []telemetrytypes.TelemetryFieldKey{
-					{Name: "name", FieldContext: telemetrytypes.FieldContextScope},
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.name::String <> '', scope.name::String, NULL) AS `__SELECT_KEY_3_name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
-		{
-			// span.scope.name (span context, name "scope.name") resolves to the declared
-			// scope path scope.name, not a span attribute literally named scope.name.
-			name:        "span-context scope.name in selectFields resolves to the declared scope path",
-			requestType: qbtypes.RequestTypeRaw,
-			keysMap:     map[string][]*telemetrytypes.TelemetryFieldKey{},
-			query: qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]{
-				Signal:       telemetrytypes.SignalTraces,
-				StepInterval: qbtypes.Step{Duration: 30 * time.Second},
-				Filter:       &qbtypes.Filter{},
-				SelectFields: []telemetrytypes.TelemetryFieldKey{
-					{Name: "scope.name", FieldContext: telemetrytypes.FieldContextSpan},
-				},
-				Limit: 10,
-			},
-			expected: qbtypes.Statement{
-				Query: "SELECT timestamp AS `__SELECT_KEY_0_timestamp`, trace_id AS `__SELECT_KEY_1_trace_id`, span_id AS `__SELECT_KEY_2_span_id`, multiIf(scope.name::String <> '', scope.name::String, NULL) AS `__SELECT_KEY_3_scope.name` FROM signoz_traces.distributed_signoz_index_v3 WHERE timestamp >= ? AND timestamp < ? AND ts_bucket_start >= ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"1747947419000000000", "1747983448000000000", uint64(1747945619), uint64(1747983448), 10},
-			},
-		},
 	}
 
 	for _, c := range cases {

pkg/telemetrymetadata/metadata.go

@@ -180,7 +180,7 @@ func (t *telemetryMetaStore) getTracesKeys(ctx context.Context, fieldKeySelector
 		`CASE
 			// WHEN tagType = 'spanfield' THEN 1
 			WHEN tagType = 'resource' THEN 2
-			WHEN tagType = 'scope' THEN 3
+			// WHEN tagType = 'scope' THEN 3
 			WHEN tagType = 'tag' THEN 4
 			ELSE 5
 		END as priority`,

pkg/telemetryschema/tracestelemetryschema/condition_builder_test.go

@@ -391,96 +391,6 @@ func TestConditionForResourceWithEvolution(t *testing.T) {
 	}
 }
 
-// TestConditionForScopeIntrinsicFields covers the scope.name/scope.version intrinsic
-// fields against the "scope" JSON column. These are *declared* String paths on that
-// column, so a row without a scope reads as ” and never NULL: presence must be an
-// empty-string check, since "IS NOT NULL" would hold for every row. That also rules
-// out treating them as nested attribute keys under scope.attributes, which are
-// undeclared (Dynamic) paths and genuinely NULL when absent.
-func TestConditionForScopeIntrinsicFields(t *testing.T) {
-	ctx := context.Background()
-	fm := NewFieldMapper(flaggertest.New(t))
-	conditionBuilder := NewConditionBuilder(fm, flaggertest.New(t))
-
-	testCases := []struct {
-		name        string
-		key         telemetrytypes.TelemetryFieldKey
-		operator    qbtypes.FilterOperator
-		value       any
-		expectedSQL string
-	}{
-		{
-			name: "Equal - scope.name",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "scope.name",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorEqual,
-			value:       "io.signoz.payment",
-			expectedSQL: "(scope.name::String = ? AND scope.name::String <> '')",
-		},
-		{
-			name: "Equal - scope.version",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "scope.version",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorEqual,
-			value:       "2.3.1",
-			expectedSQL: "(scope.version::String = ? AND scope.version::String <> '')",
-		},
-		{
-			name: "Exists - scope.name",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "scope.name",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorExists,
-			value:       nil,
-			expectedSQL: "scope.name::String <> ''",
-		},
-		{
-			name: "NotExists - scope.version",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "scope.version",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorNotExists,
-			value:       nil,
-			expectedSQL: "scope.version::String = ''",
-		},
-		{
-			// `scope.attribute.name` (normalized to {attribute.name, scope}) addresses the scope
-			// attribute named `name` — the declared `scope.name` path is never reached this way.
-			name: "Equal - scope.attribute.name reaches the named scope attribute",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:          "attribute.name",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-			operator:    qbtypes.FilterOperatorEqual,
-			value:       "io.signoz.checkout",
-			expectedSQL: "(scope.attributes.`name`::String = ? AND scope.attributes.`name` IS NOT NULL)",
-		},
-	}
-
-	for _, tc := range testCases {
-		sb := sqlbuilder.NewSelectBuilder()
-		t.Run(tc.name, func(t *testing.T) {
-			conds, _, err := conditionBuilder.ConditionFor(ctx, valuer.UUID{}, 0, 0, &tc.key, map[string][]*telemetrytypes.TelemetryFieldKey{tc.key.Name: {&tc.key}}, qbtypes.ConditionBuilderOptions{}, tc.operator, tc.value, sb)
-			require.NoError(t, err)
-			sb.Where(conds...)
-			sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-			assert.Contains(t, sql, tc.expectedSQL)
-			assert.NotContains(t, sql, "scope.`scope.", "must not double-prefix the scope JSON path")
-		})
-	}
-}
-
 // TestConditionForSynthesizedKeys covers the KeyNotFound fallback: when a
 // referenced attribute key has no metadata match, the builder synthesizes key(s) from
 // user input and queries anyway, emitting a warning instead of failing.
@@ -504,20 +414,6 @@ func TestConditionForSynthesizedKeys(t *testing.T) {
 		assert.Contains(t, args, "timeout")
 	})
 
-	t.Run("scope context with no metadata -> scope attribute", func(t *testing.T) {
-		sb := sqlbuilder.NewSelectBuilder()
-		key := telemetrytypes.TelemetryFieldKey{Name: "custom.attr", FieldContext: telemetrytypes.FieldContextScope}
-		conds, warnings, err := cb.ConditionFor(ctx, valuer.UUID{}, 0, 0, &key, noMatches, qbtypes.ConditionBuilderOptions{}, qbtypes.FilterOperatorEqual, "v", sb)
-		assert.NoError(t, err, "an undeclared scope attribute must still be filterable")
-		assert.NotEmpty(t, warnings)
-		sb.Where(conds...)
-		sql, _ := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-		assert.Contains(t, sql, "scope.attributes.`custom.attr`")
-		// `scope.` can be part of the attribute's own name, so the literal spelling is a
-		// candidate too — the caller ORs the two.
-		assert.Contains(t, sql, "scope.attributes.`scope.custom.attr`")
-	})
-
 	t.Run("bare key with number operand -> attribute number", func(t *testing.T) {
 		sb := sqlbuilder.NewSelectBuilder()
 		key := telemetrytypes.TelemetryFieldKey{Name: "http.status"}

pkg/telemetryschema/tracestelemetryschema/const.go

@@ -121,20 +121,6 @@ var (
 			FieldContext:  telemetrytypes.FieldContextSpan,
 			FieldDataType: telemetrytypes.FieldDataTypeString,
 		},
-		"scope.name": {
-			Name:          "scope.name",
-			Description:   "Instrumentation scope name",
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  telemetrytypes.FieldContextScope,
-			FieldDataType: telemetrytypes.FieldDataTypeString,
-		},
-		"scope.version": {
-			Name:          "scope.version",
-			Description:   "Instrumentation scope version",
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  telemetrytypes.FieldContextScope,
-			FieldDataType: telemetrytypes.FieldDataTypeString,
-		},
 	}
 	IntrinsicFieldsDeprecated = map[string]telemetrytypes.TelemetryFieldKey{
 		"traceID": {

pkg/telemetryschema/tracestelemetryschema/field_mapper.go

@@ -53,7 +53,6 @@ var (
 			ValueType: schema.ColumnTypeString,
 		}},
 		"resource": {Name: "resource", Type: schema.JSONColumnType{}},
-		"scope":    {Name: "scope", Type: schema.JSONColumnType{}},
 
 		"events": {Name: "events", Type: schema.ArrayColumnType{
 			ElementType: schema.ColumnTypeString,
@@ -182,7 +181,7 @@ func (m *fieldMapper) getColumn(
 	case telemetrytypes.FieldContextResource:
 		return []*schema.Column{indexV3Columns["resource"], indexV3Columns["resources_string"]}, nil
 	case telemetrytypes.FieldContextScope:
-		return []*schema.Column{indexV3Columns["scope"]}, nil
+		return []*schema.Column{}, qbtypes.ErrColumnNotFound
 	case telemetrytypes.FieldContextAttribute:
 		switch key.FieldDataType {
 		case telemetrytypes.FieldDataTypeString:
@@ -293,25 +292,14 @@ func (m *fieldMapper) resolveColumnExprs(
 
 		switch column.Type.GetType() {
 		case schema.ColumnTypeEnumJSON:
+			// json is only supported for resource context as of now
+			if key.FieldContext != telemetrytypes.FieldContextResource {
+				return nil, nil, nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "only resource context fields are supported for json columns, got %s", key.FieldContext.String)
+			}
 			// have to add ::string as clickHouse throws an error :- data types Variant/Dynamic are not allowed in GROUP BY
 			// once clickHouse dependency is updated, we need to check if we can remove it.
-			switch key.FieldContext {
-			case telemetrytypes.FieldContextResource:
-				exprs = append(exprs, fmt.Sprintf("%s.`%s`::String", columnName, key.Name))
-				existExprs = append(existExprs, fmt.Sprintf("%s.`%s` IS NOT NULL", columnName, key.Name))
-			case telemetrytypes.FieldContextScope:
-				if f, ok := IntrinsicFields[key.Name]; ok && f.FieldContext == telemetrytypes.FieldContextScope {
-					// declared String paths on the scope column read '' for the missing case
-					exprs = append(exprs, fmt.Sprintf("%s::String", key.Name))
-					existExprs = append(existExprs, fmt.Sprintf("%s <> ''", key.Name))
-				} else {
-					attributeName := strings.TrimPrefix(key.Name, "attribute.") // literal "attribute" prefix in attribute keys needs double prefix
-					exprs = append(exprs, fmt.Sprintf("%s.attributes.%s::String", columnName, querybuilder.ClickHouseIdentifier(attributeName)))
-					existExprs = append(existExprs, fmt.Sprintf("%s.attributes.%s IS NOT NULL", columnName, querybuilder.ClickHouseIdentifier(attributeName)))
-				}
-			default:
-				return nil, nil, nil, errors.NewInternalf(errors.CodeInternal, "only resource and scope context fields are supported for json columns, got %s", key.FieldContext.String)
-			}
+			exprs = append(exprs, fmt.Sprintf("%s.`%s`::String", columnName, key.Name))
+			existExprs = append(existExprs, fmt.Sprintf("%s.`%s` IS NOT NULL", columnName, key.Name))
 		case schema.ColumnTypeEnumString,
 			schema.ColumnTypeEnumUInt64,
 			schema.ColumnTypeEnumUInt32,
@@ -353,6 +341,20 @@ func (m *fieldMapper) resolveColumnExprs(
 	return exprs, existExprs, columns, nil
 }
 
+// logicalForResolvedColumn upgrades a directly-resolvable key (the FieldFor
+// probe succeeded) to its family when the metadata map proves membership;
+// otherwise the key stays a single-member logical field.
+func (m *fieldMapper) logicalForResolvedColumn(ctx context.Context, orgID valuer.UUID, field *telemetrytypes.TelemetryFieldKey, keys map[string][]*telemetrytypes.TelemetryFieldKey) *telemetrytypes.LogicalField {
+	for _, logical := range querybuilder.MatchingLogicalFields(ctx, orgID, m.fl, field, keys) {
+		if logical.IsFamily() &&
+			logical.FieldContext == field.FieldContext &&
+			(field.FieldDataType == telemetrytypes.FieldDataTypeUnspecified || logical.FieldDataType == field.FieldDataType) {
+			return logical
+		}
+	}
+	return telemetrytypes.SingleLogicalField(field.Name, field)
+}
+
 // upgradeToFamilies swaps single-member candidates for their family when the
 // metadata map proves membership. Candidate order and every non-family
 // candidate stay exactly as the legacy flow produced them; sibling candidates
@@ -417,11 +419,9 @@ func (m *fieldMapper) ColumnExpressionFor(
 	var candidates []*telemetrytypes.LogicalField
 	switch _, err := m.FieldFor(ctx, orgID, startNs, endNs, field); {
 	case err == nil:
-		// Every match from metadata is kept, similar to the filter path.
-		candidates = querybuilder.MatchingLogicalFields(ctx, orgID, m.fl, field, keys)
-		if len(candidates) == 0 {
-			candidates = []*telemetrytypes.LogicalField{telemetrytypes.SingleLogicalField(field.Name, field)}
-		}
+		// A directly-resolvable key upgrades to its family when the metadata
+		// map proves membership; otherwise it stays single-member.
+		candidates = []*telemetrytypes.LogicalField{m.logicalForResolvedColumn(ctx, orgID, field, keys)}
 	case errors.Is(err, qbtypes.ErrColumnNotFound):
 		// The legacy candidate flow, unchanged: column (when the bare name is
 		// one) plus metadata matches, else synthesized type-variant keys. The
@@ -595,37 +595,15 @@ func (m *fieldMapper) CandidateKeys(ctx context.Context, _ valuer.UUID, field *t
 		// honored as-is: the stripped name lives in the attribute maps
 		stripped := telemetrytypes.NewTelemetryFieldKey(field.Name, telemetrytypes.FieldContextUnspecified, field.FieldDataType)
 		return querybuilder.SynthesizeKeys(stripped, value)
-	case telemetrytypes.FieldContextAttribute, telemetrytypes.FieldContextResource, telemetrytypes.FieldContextScope:
+	case telemetrytypes.FieldContextAttribute, telemetrytypes.FieldContextResource:
 		// strict context honored as-is: stripped interpretation first, literal spelling second
 		literal := telemetrytypes.NewTelemetryFieldKey(field.FieldContext.StringValue()+"."+field.Name, field.FieldContext, field.FieldDataType)
 		return append(querybuilder.SynthesizeKeys(field, value), querybuilder.SynthesizeKeys(literal, value)...)
 	}
-	// contexts that don't exist on spans (log, body, …) have nothing to synthesize
+	// contexts that don't exist on spans (log, body, scope, …) have nothing to synthesize
 	return nil
 }
 
-// scopeJSONExistsExpression renders the existence predicate for the scope JSON column, the one
-// signal-specific case the generic querybuilder.ExistsExpression must not carry.
-func scopeJSONExistsExpression(key *telemetrytypes.TelemetryFieldKey, fieldExpression string, exists bool) (string, bool) {
-	if key.FieldContext != telemetrytypes.FieldContextScope {
-		return "", false
-	}
-	// Declared String paths are non-Nullable (absent reads '' not NULL).
-	if f, ok := IntrinsicFields[key.Name]; ok && f.FieldContext == telemetrytypes.FieldContextScope {
-		if exists {
-			return fieldExpression + " <> ''", true
-		}
-		return fieldExpression + " = ''", true
-	}
-	// Scope attribute: the value expression casts the JSON path to String, which folds a missing
-	// key's NULL to '', so presence must test the raw path — drop the ::String cast.
-	path := strings.TrimSuffix(fieldExpression, "::String")
-	if exists {
-		return path + " IS NOT NULL", true
-	}
-	return path + " IS NULL", true
-}
-
 // ExistsFor implements the per-key existence primitive of qbtypes.FieldMapper.
 func (m *fieldMapper) ExistsFor(
 	ctx context.Context,
@@ -642,8 +620,5 @@ func (m *fieldMapper) ExistsFor(
 	if err != nil {
 		return "", err
 	}
-	if expr, ok := scopeJSONExistsExpression(key, fieldExpression, exists); ok {
-		return expr, nil
-	}
 	return querybuilder.ExistsExpression(columns, key, tsStart, tsEnd, fieldExpression, exists)
 }

pkg/telemetryschema/tracestelemetryschema/field_mapper_test.go

@@ -84,45 +84,6 @@ func TestGetFieldKeyName(t *testing.T) {
 			expectedResult: "multiIf(resource.`deployment.environment` IS NOT NULL, resource.`deployment.environment`::String, `resource_string_deployment$$environment_exists`, `resource_string_deployment$$environment`, NULL)",
 			expectedError:  nil,
 		},
-		{
-			name: "Scope field - scope.name",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "scope.name",
-				FieldContext: telemetrytypes.FieldContextScope,
-			},
-			expectedResult: "scope.name::String",
-			expectedError:  nil,
-		},
-		{
-			name: "Scope field - scope.version",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "scope.version",
-				FieldContext: telemetrytypes.FieldContextScope,
-			},
-			expectedResult: "scope.version::String",
-			expectedError:  nil,
-		},
-		{
-			name: "Scope field - custom attribute",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "custom.attr",
-				FieldContext: telemetrytypes.FieldContextScope,
-			},
-			expectedResult: "scope.attributes.`custom.attr`::String",
-			expectedError:  nil,
-		},
-		{
-			// `scope.attribute.name` normalizes to {attribute.name, scope}; the literal
-			// `attribute.` prefix is dropped so it addresses the scope attribute named `name`
-			// (which the declared `scope.name` path deliberately does not).
-			name: "Scope field - attribute prefix addresses the named scope attribute",
-			key: telemetrytypes.TelemetryFieldKey{
-				Name:         "attribute.name",
-				FieldContext: telemetrytypes.FieldContextScope,
-			},
-			expectedResult: "scope.attributes.`name`::String",
-			expectedError:  nil,
-		},
 		{
 			// Query like `attribute.attribute_string:string` should resolve to `attributes_string['attribute_string']`.
 			name: "Attribute key whose name collides with contextual map column resolves as a map lookup",
@@ -343,99 +304,3 @@ func TestColumnExpressionForTimestampAttributeCollision(t *testing.T) {
 		assert.Contains(t, result, "attributes_number['timestamp']")
 	})
 }
-
-// TestColumnExpressionForScopeDeclaredPath covers select-side resolution of scope names that
-// collide with a declared scope path. A short name under scope context (or the bare
-// `scope.<x>` spelling that normalizes to it) names both homes and coalesces them when
-// metadata knows a same-named scope attribute, and binds to the declared path alone when it
-// does not. The full `scope.<x>` name under explicit scope context addresses the declared
-// path alone; the explicit `scope.attribute.` prefix addresses the attribute alone.
-func TestColumnExpressionForScopeDeclaredPath(t *testing.T) {
-	ctx := context.Background()
-
-	scopeKey := func(name string) *telemetrytypes.TelemetryFieldKey {
-		return &telemetrytypes.TelemetryFieldKey{
-			Name:          name,
-			Signal:        telemetrytypes.SignalTraces,
-			FieldContext:  telemetrytypes.FieldContextScope,
-			FieldDataType: telemetrytypes.FieldDataTypeString,
-		}
-	}
-	declaredOnly := map[string][]*telemetrytypes.TelemetryFieldKey{
-		"scope.name":    {scopeKey("scope.name")},
-		"scope.version": {scopeKey("scope.version")},
-	}
-	withAttr := map[string][]*telemetrytypes.TelemetryFieldKey{
-		"scope.name":    {scopeKey("scope.name")},
-		"scope.version": {scopeKey("scope.version")},
-		"name":          {scopeKey("name")},
-		"version":       {scopeKey("version")},
-	}
-
-	testCases := []struct {
-		name           string
-		key            telemetrytypes.TelemetryFieldKey
-		keys           map[string][]*telemetrytypes.TelemetryFieldKey
-		expectedResult string
-	}{
-		{
-			name:           "short name under scope context binds to the declared path",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "version", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           declaredOnly,
-			expectedResult: "multiIf(scope.version::String <> '', scope.version::String, NULL)",
-		},
-		{
-			name:           "full scope.version name under scope context addresses the declared path alone",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "scope.version", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.version::String <> '', scope.version::String, NULL)",
-		},
-		{
-			name:           "full scope.name name under scope context addresses the declared path alone",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "scope.name", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.name::String <> '', scope.name::String, NULL)",
-		},
-		{
-			// `scope.attribute.name` normalizes to {attribute.name, scope}; the `attribute.`
-			// prefix is dropped so it addresses the scope attribute named `name` — the only
-			// way to reach it, since `scope.name` is reserved for the declared path.
-			name:           "attribute prefix reaches the named scope attribute",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "attribute.name", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.attributes.`name` IS NOT NULL, scope.attributes.`name`::String, NULL)",
-		},
-		{
-			// the caller supplied the context, so `scope.` is part of the name rather than a
-			// prefix to strip: this addresses a scope attribute literally named
-			// `scope.testing.env`, not the attribute `testing.env`
-			name:           "explicit context keeps a scope-prefixed name intact",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "scope.testing.env", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           declaredOnly,
-			expectedResult: "multiIf(scope.attributes.`scope.testing.env` IS NOT NULL, scope.attributes.`scope.testing.env`::String, NULL)",
-		},
-		{
-			// metadata knows both homes under this name, so the short spelling coalesces
-			// them instead of being rejected as ambiguous
-			name:           "short name coalesces a known scope attribute with the declared path",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "name", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.attributes.`name` IS NOT NULL, toString(scope.attributes.`name`::String), scope.name::String <> '', toString(scope.name::String), NULL)",
-		},
-		{
-			name:           "short version coalesces a known scope attribute with the declared path",
-			key:            telemetrytypes.TelemetryFieldKey{Name: "version", FieldContext: telemetrytypes.FieldContextScope},
-			keys:           withAttr,
-			expectedResult: "multiIf(scope.attributes.`version` IS NOT NULL, toString(scope.attributes.`version`::String), scope.version::String <> '', toString(scope.version::String), NULL)",
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.name, func(t *testing.T) {
-			fm := NewFieldMapper(flaggertest.New(t))
-			result, err := fm.ColumnExpressionFor(ctx, valuer.UUID{}, 0, 0, &tc.key, telemetrytypes.FieldDataTypeUnspecified, tc.keys)
-			require.NoError(t, err)
-			assert.Equal(t, tc.expectedResult, result)
-		})
-	}
-}

pkg/telemetryschema/tracestelemetryschema/test_data.go

@@ -113,20 +113,6 @@ func BuildCompleteFieldKeyMap(releaseTime time.Time) map[string][]*telemetrytype
 				FieldDataType: telemetrytypes.FieldDataTypeBool,
 			},
 		},
-		"scope.name": {
-			{
-				Name:          "scope.name",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-		},
-		"scope.version": {
-			{
-				Name:          "scope.version",
-				FieldContext:  telemetrytypes.FieldContextScope,
-				FieldDataType: telemetrytypes.FieldDataTypeString,
-			},
-		},
 		// both spellings of an enabled semantic-convention family
 		"deployment.environment.name": {
 			{

pkg/types/coretypes/kind.go

@@ -71,7 +71,6 @@ func (name Kind) Enum() []any {
 		KindFactorAPIKey,
 		KindLicense,
 		KindSubscription,
-		KindDeploymentHost,
 		KindLogs,
 		KindTraces,
 		KindMetrics,

pkg/types/coretypes/registry_kind.go

@@ -31,7 +31,6 @@ var Kinds = []Kind{
 	KindFactorAPIKey,
 	KindLicense,
 	KindSubscription,
-	KindDeploymentHost,
 	KindLogs,
 	KindTraces,
 	KindMetrics,
@@ -72,7 +71,6 @@ var (
 	KindFactorAPIKey                 = MustNewKind("factor-api-key")
 	KindLicense                      = MustNewKind("license")
 	KindSubscription                 = MustNewKind("subscription")
-	KindDeploymentHost               = MustNewKind("deployment-host")
 	KindLogs                         = MustNewKind("logs")
 	KindTraces                       = MustNewKind("traces")
 	KindMetrics                      = MustNewKind("metrics")

pkg/types/coretypes/registry_managed_role.go

@@ -191,9 +191,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
-		// deployment-host — admin updates, viewer lists
-		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDeploymentHost}, WildCardSelectorString)},
-		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDeploymentHost}, WildCardSelectorString)},
 		// user-preference — every authenticated user can read+update their own
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
@@ -286,8 +283,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// ttl-setting — read only (admin updates)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
-		// deployment-host — list only (admin updates)
-		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDeploymentHost}, WildCardSelectorString)},
 		// user-preference — every authenticated user can read+update their own
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
@@ -346,8 +341,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// ttl-setting — read only
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTTLSetting}, WildCardSelectorString)},
-		// deployment-host — list only
-		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDeploymentHost}, WildCardSelectorString)},
 		// user-preference — every authenticated user can read+update their own
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindUserPreference}, WildCardSelectorString)},

pkg/types/coretypes/registry_resource.go

@@ -31,7 +31,6 @@ var Resources = []Resource{
 	ResourceMetaResourceFactorAPIKey,
 	ResourceMetaResourceLicense,
 	ResourceMetaResourceSubscription,
-	ResourceMetaResourceDeploymentHost,
 	ResourceTelemetryResourceLogs,
 	ResourceTelemetryResourceTraces,
 	ResourceTelemetryResourceMetrics,
@@ -72,7 +71,6 @@ var (
 	ResourceMetaResourceFactorAPIKey                     = NewResourceMetaResource(KindFactorAPIKey, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceLicense                          = NewResourceMetaResource(KindLicense)
 	ResourceMetaResourceSubscription                     = NewResourceMetaResource(KindSubscription)
-	ResourceMetaResourceDeploymentHost                   = NewResourceMetaResource(KindDeploymentHost, VerbList, VerbUpdate)
 	ResourceTelemetryResourceLogs                        = NewResourceTelemetryResource(KindLogs)
 	ResourceTelemetryResourceTraces                      = NewResourceTelemetryResource(KindTraces)
 	ResourceTelemetryResourceMetrics                     = NewResourceTelemetryResource(KindMetrics)

pkg/types/coretypes/resolved.go

@@ -19,6 +19,7 @@ type ResolvedResource interface {
 	SourceIDs() []string
 	SourceSelector() SelectorFunc
 	Err() error
+	Skip() bool
 	ResolveResponse(ec ExtractorContext)
 	hasResponsePhase() bool
 }

pkg/types/coretypes/resolved_resource.go

@@ -59,6 +59,10 @@ func (resolved *resolvedResource) fill(phase ExtractPhase, ec ExtractorContext)
 	}
 }
 
+func (resolved *resolvedResource) Skip() bool {
+	return false
+}
+
 func (resolved *resolvedResource) Err() error {
 	return resolved.err
 }

pkg/types/coretypes/resolved_resource_with_target.go

@@ -12,6 +12,7 @@ type resolvedResourceWithTarget struct {
 	targetExtractor ResourceIDsExtractor
 	targetIDs       []string
 	parentChild     bool
+	skipIfNoIDs     bool
 	err             error
 }
 
@@ -25,6 +26,7 @@ func NewResolvedResourceWithTarget(
 	targetExtractor ResourceIDsExtractor,
 	targetSelector SelectorFunc,
 	parentChild bool,
+	skipIfNoIDs bool,
 	ec ExtractorContext,
 ) ResolvedResourceWithTargetResource {
 	resolved := &resolvedResourceWithTarget{
@@ -37,6 +39,7 @@ func NewResolvedResourceWithTarget(
 		targetSelector:  targetSelector,
 		targetExtractor: targetExtractor,
 		parentChild:     parentChild,
+		skipIfNoIDs:     skipIfNoIDs,
 	}
 	resolved.fill(PhaseRequest, ec)
 
@@ -69,6 +72,10 @@ func (resolved *resolvedResourceWithTarget) fill(phase ExtractPhase, ec Extracto
 	}
 }
 
+func (resolved *resolvedResourceWithTarget) Skip() bool {
+	return resolved.skipIfNoIDs && len(resolved.sourceIDs) == 0 && len(resolved.targetIDs) == 0
+}
+
 func (resolved *resolvedResourceWithTarget) Err() error {
 	return resolved.err
 }

pkg/types/quickfiltertypes/filter.go

@@ -5,9 +5,9 @@ import (
 	"time"
 
 	"github.com/SigNoz/signoz/pkg/errors"
+	v3 "github.com/SigNoz/signoz/pkg/query-service/model/v3"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/aiobservabilitytypes"
-	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/uptrace/bun"
 )
@@ -70,27 +70,18 @@ type StorableQuickFilter struct {
 }
 
 type SignalFilters struct {
-	Signal  Signal                             `json:"signal"`
-	Filters []telemetrytypes.TelemetryFieldKey `json:"filters"`
+	Signal  Signal            `json:"signal"`
+	Filters []v3.AttributeKey `json:"filters"`
 }
 
 type UpdatableQuickFilters struct {
-	Signal  Signal                             `json:"signal"`
-	Filters []telemetrytypes.TelemetryFieldKey `json:"filters"`
-}
-
-func validateFilters(filters []telemetrytypes.TelemetryFieldKey) error {
-	for _, filter := range filters {
-		if filter.Name == "" {
-			return errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "filter name is required")
-		}
-	}
-	return nil
+	Signal  Signal            `json:"signal"`
+	Filters []v3.AttributeKey `json:"filters"`
 }
 
 // NewStorableQuickFilter creates a new StorableQuickFilter after validation.
-func NewStorableQuickFilter(orgID valuer.UUID, signal Signal, filters []telemetrytypes.TelemetryFieldKey) (*StorableQuickFilter, error) {
-	if orgID.IsZero() {
+func NewStorableQuickFilter(orgID valuer.UUID, signal Signal, filterJSON []byte) (*StorableQuickFilter, error) {
+	if orgID.StringValue() == "" {
 		return nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "orgID is required")
 	}
 
@@ -98,13 +89,9 @@ func NewStorableQuickFilter(orgID valuer.UUID, signal Signal, filters []telemetr
 		return nil, err
 	}
 
-	if err := validateFilters(filters); err != nil {
-		return nil, err
-	}
-
-	filterJSON, err := json.Marshal(filters)
-	if err != nil {
-		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "error marshalling filters")
+	var filters []v3.AttributeKey
+	if err := json.Unmarshal(filterJSON, &filters); err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "invalid filter JSON")
 	}
 
 	now := time.Now()
@@ -122,12 +109,16 @@ func NewStorableQuickFilter(orgID valuer.UUID, signal Signal, filters []telemetr
 	}, nil
 }
 
-// NewSignalFiltersFromSignal creates a SignalFilters with no filters for a signal.
-func NewSignalFiltersFromSignal(signal Signal) *SignalFilters {
-	return &SignalFilters{
-		Signal:  signal,
-		Filters: []telemetrytypes.TelemetryFieldKey{},
+// Update updates an existing StorableQuickFilter with new filter data after validation.
+func (quickfilter *StorableQuickFilter) Update(filterJSON []byte) error {
+	var filters []v3.AttributeKey
+	if err := json.Unmarshal(filterJSON, &filters); err != nil {
+		return errors.Wrapf(err, errors.TypeInvalidInput, errors.CodeInvalidInput, "invalid filter JSON")
 	}
+
+	quickfilter.Filter = string(filterJSON)
+	quickfilter.UpdatedAt = time.Now()
+	return nil
 }
 
 // NewSignalFilterFromStorableQuickFilter converts a StorableQuickFilter to a SignalFilters object.
@@ -136,7 +127,7 @@ func NewSignalFilterFromStorableQuickFilter(storableQuickFilter *StorableQuickFi
 		return nil, errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "storableQuickFilter cannot be nil")
 	}
 
-	var filters []telemetrytypes.TelemetryFieldKey
+	var filters []v3.AttributeKey
 	if storableQuickFilter.Filter != "" {
 		err := json.Unmarshal([]byte(storableQuickFilter.Filter), &filters)
 		if err != nil {
@@ -152,88 +143,170 @@ func NewSignalFilterFromStorableQuickFilter(storableQuickFilter *StorableQuickFi
 
 // NewDefaultQuickFilter generates default filters for all supported signals.
 func NewDefaultQuickFilter(orgID valuer.UUID) ([]*StorableQuickFilter, error) {
-	tracesFilters := []telemetrytypes.TelemetryFieldKey{
-		{Name: "duration_nano", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeNumber},
-		{Name: "deployment.environment", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "hasError", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeBool},
-		{Name: "service.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "name", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "rpc.method", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "response_status_code", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "http_host", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "http.method", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "http.route", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "http_url", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "trace_id", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
+	tracesFilters := []map[string]interface{}{
+		{"key": "duration_nano", "dataType": "float64", "type": "tag"},
+		{"key": "deployment.environment", "dataType": "string", "type": "resource"},
+		{"key": "hasError", "dataType": "bool", "type": "tag"},
+		{"key": "service.name", "dataType": "string", "type": "resource"},
+		{"key": "name", "dataType": "string", "type": "tag"},
+		{"key": "rpc.method", "dataType": "string", "type": "tag"},
+		{"key": "response_status_code", "dataType": "string", "type": "tag"},
+		{"key": "http_host", "dataType": "string", "type": "tag"},
+		{"key": "http.method", "dataType": "string", "type": "tag"},
+		{"key": "http.route", "dataType": "string", "type": "tag"},
+		{"key": "http_url", "dataType": "string", "type": "tag"},
+		{"key": "trace_id", "dataType": "string", "type": "tag"},
 	}
 
-	logsFilters := []telemetrytypes.TelemetryFieldKey{
-		{Name: "severity_text", FieldContext: telemetrytypes.FieldContextLog, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "deployment.environment", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "service.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "host.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "k8s.cluster.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "k8s.deployment.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "k8s.namespace.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "k8s.pod.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
+	logsFilters := []map[string]interface{}{
+		{"key": "severity_text", "dataType": "string", "type": "resource"},
+		{"key": "deployment.environment", "dataType": "string", "type": "resource"},
+		{"key": "service.name", "dataType": "string", "type": "resource"},
+		{"key": "host.name", "dataType": "string", "type": "resource"},
+		{"key": "k8s.cluster.name", "dataType": "string", "type": "resource"},
+		{"key": "k8s.deployment.name", "dataType": "string", "type": "resource"},
+		{"key": "k8s.namespace.name", "dataType": "string", "type": "resource"},
+		{"key": "k8s.pod.name", "dataType": "string", "type": "resource"},
 	}
 
-	apiMonitoringFilters := []telemetrytypes.TelemetryFieldKey{
-		{Name: "deployment.environment", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "service.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "rpc.method", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
+	apiMonitoringFilters := []map[string]interface{}{
+		{"key": "deployment.environment", "dataType": "string", "type": "resource"},
+		{"key": "service.name", "dataType": "string", "type": "resource"},
+		{"key": "rpc.method", "dataType": "string", "type": "tag"},
 	}
 
-	exceptionsFilters := []telemetrytypes.TelemetryFieldKey{
-		{Name: "deployment.environment", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "service.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "host.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "k8s.cluster.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "k8s.deployment.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "k8s.namespace.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "k8s.pod.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
+	exceptionsFilters := []map[string]interface{}{
+		{"key": "deployment.environment", "dataType": "string", "type": "resource"},
+		{"key": "service.name", "dataType": "string", "type": "resource"},
+		{"key": "host.name", "dataType": "string", "type": "resource"},
+		{"key": "k8s.cluster.name", "dataType": "string", "type": "resource"},
+		{"key": "k8s.deployment.name", "dataType": "string", "type": "resource"},
+		{"key": "k8s.namespace.name", "dataType": "string", "type": "resource"},
+		{"key": "k8s.pod.name", "dataType": "string", "type": "resource"},
 	}
 
-	// Meter keys are label names with no context or datatype: the meter fields
-	// API returns them as name+signal only, so the defaults mirror that shape.
-	meterFilters := []telemetrytypes.TelemetryFieldKey{
-		{Name: "deployment.environment", Signal: telemetrytypes.SignalMetrics},
-		{Name: "service.name", Signal: telemetrytypes.SignalMetrics},
-		{Name: "host.name", Signal: telemetrytypes.SignalMetrics},
+	meterFilters := []map[string]interface{}{
+		{"key": "deployment.environment", "dataType": "float64", "type": "Sum"},
+		{"key": "service.name", "dataType": "float64", "type": "Sum"},
+		{"key": "host.name", "dataType": "float64", "type": "Sum"},
 	}
 
 	// AI observability (builder_ai_query trace explorer), ordered by expected
 	// usage: env scoping, the LLM identity keys, then service and the rest.
-	aiObservabilityFilters := []telemetrytypes.TelemetryFieldKey{
-		{Name: "deployment.environment", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: aiobservabilitytypes.GenAIOperationName, FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: aiobservabilitytypes.GenAIProviderName, FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: aiobservabilitytypes.GenAIRequestModel, FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "service.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: aiobservabilitytypes.GenAIToolName, FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: aiobservabilitytypes.GenAIAgentName, FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
+	aiObservabilityFilters := []map[string]interface{}{
+		{"key": "deployment.environment", "dataType": "string", "type": "resource"},
+		{"key": aiobservabilitytypes.GenAIOperationName, "dataType": "string", "type": "tag"},
+		{"key": aiobservabilitytypes.GenAIProviderName, "dataType": "string", "type": "tag"},
+		{"key": aiobservabilitytypes.GenAIRequestModel, "dataType": "string", "type": "tag"},
+		{"key": "service.name", "dataType": "string", "type": "resource"},
+		{"key": aiobservabilitytypes.GenAIToolName, "dataType": "string", "type": "tag"},
+		{"key": aiobservabilitytypes.GenAIAgentName, "dataType": "string", "type": "tag"},
 	}
 
-	defaults := []struct {
-		signal  Signal
-		filters []telemetrytypes.TelemetryFieldKey
-	}{
-		{SignalTraces, tracesFilters},
-		{SignalLogs, logsFilters},
-		{SignalApiMonitoring, apiMonitoringFilters},
-		{SignalExceptions, exceptionsFilters},
-		{SignalMeter, meterFilters},
-		{SignalAiObservability, aiObservabilityFilters},
+	tracesJSON, err := json.Marshal(tracesFilters)
+	if err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "failed to marshal traces filters")
 	}
 
-	storableQuickFilters := make([]*StorableQuickFilter, 0, len(defaults))
-	for _, def := range defaults {
-		storableQuickFilter, err := NewStorableQuickFilter(orgID, def.signal, def.filters)
-		if err != nil {
-			return nil, err
-		}
-		storableQuickFilters = append(storableQuickFilters, storableQuickFilter)
+	logsJSON, err := json.Marshal(logsFilters)
+	if err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "failed to marshal logs filters")
 	}
 
-	return storableQuickFilters, nil
+	apiMonitoringJSON, err := json.Marshal(apiMonitoringFilters)
+	if err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "failed to marshal api monitoring filters")
+	}
+
+	exceptionsJSON, err := json.Marshal(exceptionsFilters)
+	if err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "failed to marshal exceptions filters")
+	}
+
+	meterJSON, err := json.Marshal(meterFilters)
+	if err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "failed to marshal meter filters")
+	}
+
+	aiObservabilityJSON, err := json.Marshal(aiObservabilityFilters)
+	if err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInternal, errors.CodeInternal, "failed to marshal ai observability filters")
+	}
+
+	timeRightNow := time.Now()
+
+	return []*StorableQuickFilter{
+		{
+			Identifiable: types.Identifiable{
+				ID: valuer.GenerateUUID(),
+			},
+			OrgID:  orgID,
+			Filter: string(tracesJSON),
+			Signal: SignalTraces,
+			TimeAuditable: types.TimeAuditable{
+				CreatedAt: timeRightNow,
+				UpdatedAt: timeRightNow,
+			},
+		},
+		{
+			Identifiable: types.Identifiable{
+				ID: valuer.GenerateUUID(),
+			},
+			OrgID:  orgID,
+			Filter: string(logsJSON),
+			Signal: SignalLogs,
+			TimeAuditable: types.TimeAuditable{
+				CreatedAt: timeRightNow,
+				UpdatedAt: timeRightNow,
+			},
+		},
+		{
+			Identifiable: types.Identifiable{
+				ID: valuer.GenerateUUID(),
+			},
+			OrgID:  orgID,
+			Filter: string(apiMonitoringJSON),
+			Signal: SignalApiMonitoring,
+			TimeAuditable: types.TimeAuditable{
+				CreatedAt: timeRightNow,
+				UpdatedAt: timeRightNow,
+			},
+		},
+		{
+			Identifiable: types.Identifiable{
+				ID: valuer.GenerateUUID(),
+			},
+			OrgID:  orgID,
+			Filter: string(exceptionsJSON),
+			Signal: SignalExceptions,
+			TimeAuditable: types.TimeAuditable{
+				CreatedAt: timeRightNow,
+				UpdatedAt: timeRightNow,
+			},
+		},
+		{
+			Identifiable: types.Identifiable{
+				ID: valuer.GenerateUUID(),
+			},
+			OrgID:  orgID,
+			Filter: string(meterJSON),
+			Signal: SignalMeter,
+			TimeAuditable: types.TimeAuditable{
+				CreatedAt: timeRightNow,
+				UpdatedAt: timeRightNow,
+			},
+		},
+		{
+			Identifiable: types.Identifiable{
+				ID: valuer.GenerateUUID(),
+			},
+			OrgID:  orgID,
+			Filter: string(aiObservabilityJSON),
+			Signal: SignalAiObservability,
+			TimeAuditable: types.TimeAuditable{
+				CreatedAt: timeRightNow,
+				UpdatedAt: timeRightNow,
+			},
+		},
+	}, nil
 }

pkg/types/telemetrytypes/field_context.go

@@ -18,7 +18,7 @@ import (
 // - Use `scope.` prefix to explicitly indicate and enforce scope context. Example
 //   - `scope.name`
 //   - `scope.version`
-//   - `scope.my.custom.attribute` resolves to the `my.custom.attribute` scope attribute
+//   - `scope.my.custom.attribute` and `scope.attribute.my.custom.attribute` resolve to same attribute
 //
 // - Use `attribute.` to explicitly indicate and enforce attribute context. Example
 //   - `attribute.http.method`
@@ -190,7 +190,7 @@ func (FieldContext) Enum() []any {
 		FieldContextSpan,
 		FieldContextTrace,
 		FieldContextResource,
-		FieldContextScope,
+		// FieldContextScope,
 		FieldContextAttribute,
 		// FieldContextEvent,
 		FieldContextBody,

pkg/types/telemetrytypes/field_test.go

@@ -294,17 +294,6 @@ func TestNormalize(t *testing.T) {
 				FieldDataType: FieldDataTypeString,
 			},
 		},
-		{
-			name: "Normalize keeps a prefix that does not match the set context",
-			input: TelemetryFieldKey{
-				Name:         "scope.name",
-				FieldContext: FieldContextAttribute,
-			},
-			expected: TelemetryFieldKey{
-				Name:         "scope.name",
-				FieldContext: FieldContextAttribute,
-			},
-		},
 		{
 			name: "Normalize body field",
 			input: TelemetryFieldKey{

tests/fixtures/querier.py

@@ -999,8 +999,6 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "cloud.provider": "integration",
                 "cloud.account.id": "000",
                 "trace_id": "corrupt_data",
-                "scope_name": "corrupt_data",
-                "scope.scope.name": "corrupt_data",
             },
             attributes={
                 "net.transport": "IP.TCP",
@@ -1009,10 +1007,7 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "http.request.method": "POST",
                 "http.response.status_code": "200",
                 "timestamp": "corrupt_data",
-                "version": "1.0.0",
-                "scope.scope.version": "1.0.0",
             },
-            scope={"name": "io.signoz.http.server", "version": "2.0.0"},
         ),
         Traces(
             timestamp=now - timedelta(seconds=3.5),
@@ -1032,24 +1027,12 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "cloud.provider": "integration",
                 "cloud.account.id": "000",
                 "timestamp": "corrupt_data",
-                "scope.attributes.name": "corrupt_data",
             },
             attributes={
                 "db.name": "integration",
                 "db.operation": "SELECT",
                 "db.statement": "SELECT * FROM integration",
                 "trace_d": "corrupt_data",
-                "scope.attributes.version": "corrupt_data",
-            },
-            scope={
-                "name": "io.opentelemetry.contrib.http",
-                "version": "1.0.0",
-                "attributes": {
-                    "telemetry.sdk.language": "cpp",
-                    "name": "not-the-real-name",
-                    "version": "not-the-real-version",
-                    "attributes": "literally-a-key-named-attributes",
-                },
             },
         ),
         Traces(
@@ -1070,15 +1053,12 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "cloud.provider": "integration",
                 "cloud.account.id": "000",
                 "duration_nano": "corrupt_data",
-                "scope.scope.attributes.version": "corrupt_data",
             },
             attributes={
                 "http.request.method": "PATCH",
                 "http.status_code": "404",
                 "id": "1",
-                "scope.scope.version": "corrupt_data",
             },
-            scope={"name": "io.signoz.http.client", "version": "2.0.0"},
         ),
         Traces(
             timestamp=now - timedelta(seconds=1),
@@ -1097,7 +1077,6 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "host.name": "linux-001",
                 "cloud.provider": "integration",
                 "cloud.account.id": "001",
-                "scope.scope.version": "corrupt_data",
             },
             attributes={
                 "message.type": "SENT",
@@ -1105,10 +1084,7 @@ def generate_traces_with_corrupt_metadata() -> list[Traces]:
                 "messaging.message.id": "001",
                 "duration_nano": "corrupt_data",
                 "id": 1,
-                "scope": "corrupt_data",
-                "scope.attributes.name": "corrupt_data",
             },
-            scope={"name": "io.signoz.messaging", "version": "3.0.0"},
         ),
     ]
 

tests/fixtures/traces.py

@@ -302,7 +302,6 @@ class Traces(ABC):
     db_operation: str
     has_error: bool
     is_remote: str
-    scope_json: dict[str, Any]
 
     resource: list[TracesResource]
     tag_attributes: list[TracesTagAttributes]
@@ -328,7 +327,6 @@ class Traces(ABC):
         links: list[TracesLink] = [],
         trace_state: str = "",
         flags: np.uint32 = 0,
-        scope: dict[str, Any] = {},
         resource_write_mode: Literal["legacy_only", "dual_write"] = "dual_write",
     ) -> None:
         if timestamp is None:
@@ -410,33 +408,6 @@ class Traces(ABC):
         # Calculate resource fingerprint
         self.resource_fingerprint = LogsOrTracesFingerprint(self.resources_string).calculate()
 
-        # Process scope mirroring the InstrumentationScope on the OTLP span.
-        scope_name = scope.get("name", "")
-        scope_version = scope.get("version", "")
-        scope_string = {k: str(v) for k, v in scope.get("attributes", {}).items()}
-        self.scope_json = {
-            "name": scope_name,
-            "version": scope_version,
-            "attributes": scope_string,
-        }
-
-        scope_keys = {"scope.name": scope_name, "scope.version": scope_version}
-        scope_keys.update(scope_string)
-        for k, v in scope_keys.items():
-            if v == "":
-                continue
-            self.tag_attributes.append(
-                TracesTagAttributes(
-                    timestamp=timestamp,
-                    tag_key=k,
-                    tag_type="scope",
-                    tag_data_type="string",
-                    string_value=v,
-                    number_value=None,
-                )
-            )
-            self.attribute_keys.append(TracesResourceOrAttributeKeys(name=k, datatype="string", tag_type="scope"))
-
         # Process attributes by type and populate custom fields
         self.attribute_string = {}
         self.attributes_number = {}
@@ -688,7 +659,6 @@ class Traces(ABC):
                 self.has_error,
                 self.is_remote,
                 self.resource_json,
-                self.scope_json,
             ],
             dtype=object,
         )
@@ -719,7 +689,6 @@ class Traces(ABC):
             attributes=data.get("attributes", {}),
             trace_state=data.get("trace_state", ""),
             flags=data.get("flags", 0),
-            scope=data.get("scope", {}),
         )
 
     @classmethod
@@ -859,7 +828,6 @@ def insert_traces_to_clickhouse(conn, traces: list[Traces]) -> None:
             "has_error",
             "is_remote",
             "resource",
-            "scope",
         ],
         data=[trace.np_arr() for trace in traces],
     )

tests/integration/testdata/role/managed_role_transactions.json

@@ -295,14 +295,6 @@
         "list"
       ]
     },
-    {
-      "type": "metaresource",
-      "kind": "deployment-host",
-      "verbs": [
-        "list",
-        "update"
-      ]
-    },
     {
       "type": "metaresource",
       "kind": "user-preference",
@@ -506,13 +498,6 @@
         "list"
       ]
     },
-    {
-      "type": "metaresource",
-      "kind": "deployment-host",
-      "verbs": [
-        "list"
-      ]
-    },
     {
       "type": "metaresource",
       "kind": "user-preference",
@@ -669,13 +654,6 @@
         "list"
       ]
     },
-    {
-      "type": "metaresource",
-      "kind": "deployment-host",
-      "verbs": [
-        "list"
-      ]
-    },
     {
       "type": "metaresource",
       "kind": "user-preference",

tests/integration/tests/callbackauthn/05_authz.py

@@ -28,6 +28,7 @@ _TARGET_A = "target-a-authdomain.integration.test"
 _TARGET_B = "target-b-authdomain.integration.test"
 _ADMIN_DOMAIN = "admin-crud-authdomain.integration.test"
 _ACTOR_DOMAIN = "actor-crud-authdomain.integration.test"
+_DIFF_DOMAIN = "diff-crud-authdomain.integration.test"
 
 _SAML_CONFIG = {
     "kind": "saml",
@@ -428,6 +429,75 @@ def test_update_requires_detach_on_stored_roles(
     assert response.status_code == HTTPStatus.NO_CONTENT, response.text
 
 
+def test_update_with_unchanged_mapping_needs_only_update(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    actor_id = find_role_by_name(signoz, admin_token, _ACTOR_ROLE_NAME)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/auth_domains"),
+        json={
+            "name": _DIFF_DOMAIN,
+            "enabled": True,
+            "config": _SAML_CONFIG,
+            "roleMapping": {"defaultRole": "EDITOR"},
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    domain_id = response.json()["data"]["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("update", "metaresource", "auth-domain", [domain_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    # The mapping is echoed back unchanged, so the attach/detach checks are
+    # skipped and update alone suffices.
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        json={
+            "enabled": False,
+            "config": _SAML_CONFIG,
+            "roleMapping": {"defaultRole": "EDITOR"},
+        },
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"unchanged mapping with update only: {response.text}"
+
+    # Dropping the mapping attaches signoz-viewer and detaches signoz-editor,
+    # neither of which the actor can do.
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        json={"enabled": False, "config": _SAML_CONFIG},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"changed mapping without attach/detach: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/auth_domains/{domain_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
 def test_instance_verbs_scoped_to_granted_domain(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument

tests/integration/tests/queriertraces/01_list.py

@@ -1240,13 +1240,6 @@ def test_traces_list_span_scope(
             lambda x: {"duration_nano": int(x[1].duration_nano), "span_id": x[1].span_id, "timestamp": format_timestamp(x[1].timestamp), "trace_id": x[1].trace_id},
             id="select_attribute_duration_order_intrinsic",
         ),
-        # Case 9: filter on the intrinsic scope.version. Only x[1] should match.
-        pytest.param(
-            BuilderQuery(signal="traces", name="A", select_fields=[TelemetryFieldKey("timestamp")], filter_expression="scope.version = '1.0.0'", limit=1),
-            HTTPStatus.OK,
-            lambda x: {"span_id": x[1].span_id, "timestamp": format_timestamp(x[1].timestamp), "trace_id": x[1].trace_id},
-            id="filter_scope_version",
-        ),
     ],
 )
 def test_traces_list_with_corrupt_data(
@@ -1290,168 +1283,6 @@ def test_traces_list_with_corrupt_data(
         assert get_rows(response)[0]["data"] == expected(traces)
 
 
-@pytest.mark.parametrize(
-    "filter_expression,expected_indices",
-    [
-        # Intrinsic scope.name / scope.version resolve to the JSON sub-columns.
-        pytest.param("scope.name = 'io.signoz.payment'", [1], id="intrinsic_scope_name"),
-        pytest.param("scope.version = '2.3.1'", [0], id="intrinsic_scope_version"),
-        # A scope attribute resolves against the scope JSON column's attributes.
-        pytest.param("scope.telemetry.sdk.language = 'python'", [1], id="scope_attribute"),
-        # A scope attribute whose own name carries a `scope.` prefix. `scope.prefixed`
-        # normalizes to {prefixed, scope} and must still resolve to the attribute.
-        pytest.param("scope.prefixed = 'prefixed-val'", [0], id="scope_prefixed_attribute"),
-        # `env.tier` is a span attribute on span 0 and a scope attribute on
-        # span 1. Unprefixed -> no explicit context, so it is checked in every
-        # applicable context (attribute OR scope) and both spans match.
-        pytest.param("env.tier = 'gold'", [0, 1], id="bare_cross_context"),
-        # The explicit `scope.` prefix forces scope context only, so span 0's
-        # span attribute is ignored — only span 1 matches.
-        pytest.param("scope.env.tier = 'gold'", [1], id="scope_prefixed_cross_context"),
-        # `scope.name` names both homes it can resolve to: the declared scope.name field
-        # (span 0) and a same-named `name` scope attribute (span 1), the same way any
-        # other name colliding across contexts unions. `scope.attribute.name` addresses
-        # the attribute alone.
-        pytest.param("scope.name = 'io.signoz.checkout'", [0, 1], id="scope_name_unions_attribute"),
-        # The `scope.name` spelling is also a real stored key: span 2 carries a span
-        # attribute literally named `scope.name`, so it matches too.
-        pytest.param("scope.name = 'attr-scope-name'", [2], id="scope_name_matches_stored_spelling"),
-        # The explicit `scope.attribute.` prefix addresses the scope attribute alone, without
-        # the declared path. Span 1 has a `name` scope attribute = 'io.signoz.checkout'.
-        pytest.param("scope.attribute.name = 'io.signoz.checkout'", [1], id="scope_attribute_name"),
-        # `version` as a scope attribute: no span carries one (span 1's 4.5.6 is the declared
-        # scope.version, not a scope attribute), so this matches nothing.
-        pytest.param("scope.attribute.version = '4.5.6'", [], id="scope_attribute_version_none"),
-        # An unprefixed `name` is checked in every applicable context: the span `name`
-        # column (span 2) and a `name` scope attribute (span 1). It does not reach the
-        # declared scope.name field (span 0), which only the `scope.` prefix addresses.
-        pytest.param("name = 'io.signoz.checkout'", [1, 2], id="bare_name_unions_scope_attribute"),
-        # A value that no resolvable key holds (scope.name/scope.version field,
-        # a `name`/`version` scope attribute, or a same-named attribute/resource)
-        # returns nothing.
-        pytest.param("scope.version = 'corrupt_data'", [], id="scope_version_no_match"),
-        pytest.param("scope.name = 'corrupt_data'", [], id="scope_name_no_match"),
-    ],
-)
-def test_traces_list_with_scope_filter(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-    filter_expression: str,
-    expected_indices: list[int],
-) -> None:
-    """
-    Setup three spans with different scope key resolution:
-    - x[0]: scope.name/version 'io.signoz.checkout'/'2.3.1'; span attribute
-      env.tier='gold'.
-    - x[1]: scope.name/version 'io.signoz.payment'/'4.5.6'; scope attributes
-      telemetry.sdk.language='python', env.tier='gold', and a `name` scope
-      attribute colliding with x[0]'s scope.name value.
-    - x[2]: span name 'io.signoz.checkout' (colliding with x[0]'s scope.name
-      value) and a span attribute literally named `scope.name`.
-
-    Tests:
-    - Filtering on scope.name / scope.version / a scope attribute.
-    - An unprefixed key is resolved across contexts (scope checked alongside
-      attribute / intrinsic), while a `scope.`-prefixed key is scope-only.
-    - `scope.name`/`scope.version` name every home they resolve to: the declared JSON
-      sub-column and a same-named `name`/`version` scope attribute. The explicit
-      `scope.attribute.` prefix addresses the attribute alone.
-    - a bare `name` reaches the span `name` column and a `name` scope attribute, but
-      never the declared scope.name field.
-    """
-    now = datetime.now(tz=UTC).replace(microsecond=0)
-    trace_id = TraceIdGenerator.trace_id()
-    span_ids = [TraceIdGenerator.span_id() for _ in range(3)]
-
-    traces = [
-        Traces(
-            timestamp=now - timedelta(seconds=4),
-            duration=timedelta(seconds=2),
-            trace_id=trace_id,
-            span_id=span_ids[0],
-            parent_span_id="",
-            name="GET /checkout",
-            kind=TracesKind.SPAN_KIND_SERVER,
-            status_code=TracesStatusCode.STATUS_CODE_OK,
-            resources={"service.name": "checkout"},
-            attributes={"http.request.method": "GET", "env.tier": "gold"},
-            scope={
-                "name": "io.signoz.checkout",
-                "version": "2.3.1",
-                # a scope attribute whose own name carries a `scope.` prefix
-                "attributes": {"telemetry.sdk.language": "go", "scope.prefixed": "prefixed-val"},
-            },
-        ),
-        Traces(
-            timestamp=now - timedelta(seconds=2),
-            duration=timedelta(seconds=1),
-            trace_id=trace_id,
-            span_id=span_ids[1],
-            parent_span_id="",
-            name="POST /pay",
-            kind=TracesKind.SPAN_KIND_SERVER,
-            status_code=TracesStatusCode.STATUS_CODE_OK,
-            resources={"service.name": "payment"},
-            attributes={"http.request.method": "POST"},
-            # env.tier is a scope attribute here (cross-context with span 0);
-            # `name` is a scope attribute colliding with span 0's scope.name.
-            scope={
-                "name": "io.signoz.payment",
-                "version": "4.5.6",
-                "attributes": {
-                    "telemetry.sdk.language": "python",
-                    "env.tier": "gold",
-                    "name": "io.signoz.checkout",
-                },
-            },
-        ),
-        Traces(
-            timestamp=now - timedelta(seconds=1),
-            duration=timedelta(seconds=1),
-            trace_id=trace_id,
-            span_id=span_ids[2],
-            parent_span_id="",
-            # span name collides with span 0's scope.name value
-            name="io.signoz.checkout",
-            kind=TracesKind.SPAN_KIND_SERVER,
-            status_code=TracesStatusCode.STATUS_CODE_OK,
-            resources={"service.name": "probe"},
-            # a span attribute named `scope.name`
-            attributes={"scope.name": "attr-scope-name"},
-            scope={"name": "span-gamma", "version": "9.9.9"},
-        ),
-    ]
-    insert_traces(traces)
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    start_ms = int((now - timedelta(minutes=1)).timestamp() * 1000)
-    end_ms = int((now + timedelta(seconds=1)).timestamp() * 1000)
-
-    response = make_query_request(
-        signoz,
-        token,
-        start_ms=start_ms,
-        end_ms=end_ms,
-        request_type=RequestType.RAW,
-        queries=[
-            BuilderQuery(
-                signal="traces",
-                name="A",
-                select_fields=[TelemetryFieldKey("timestamp")],
-                filter_expression=filter_expression,
-                limit=10,
-            ).to_dict()
-        ],
-    )
-
-    assert response.status_code == HTTPStatus.OK, response.text
-    got_span_ids = {row["data"]["span_id"] for row in get_rows(response)}
-    expected_span_ids = {traces[i].span_id for i in expected_indices}
-    assert got_span_ids == expected_span_ids
-
-
 @pytest.mark.parametrize("surface", ["filter", "select", "order"])
 def test_traces_list_unknown_span_context_synthesizes(
     signoz: types.SigNoz,

tests/integration/tests/quickfilter/01_quick_filter.py

@@ -1,269 +0,0 @@
-from collections.abc import Callable
-from http import HTTPStatus
-
-import requests
-from sqlalchemy import sql
-
-from fixtures import types
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-
-ALL_SIGNALS = {
-    "traces",
-    "logs",
-    "api_monitoring",
-    "exceptions",
-    "meter",
-    "ai_observability",
-}
-
-
-def test_get_quick_filters_returns_defaults(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-
-    assert response.status_code == HTTPStatus.OK, response.text
-    data = response.json()["data"]
-    assert {signal_filters["signal"] for signal_filters in data} == ALL_SIGNALS
-
-    for signal_filters in data:
-        assert len(signal_filters["filters"]) > 0
-        for field_key in signal_filters["filters"]:
-            assert field_key["name"] != ""
-            assert "fieldContext" in field_key
-            assert "fieldDataType" in field_key
-            assert "key" not in field_key
-
-
-def test_v1_get_serves_legacy_shape(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/orgs/me/filters"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    data = response.json()["data"]
-    assert {signal_filters["signal"] for signal_filters in data} == ALL_SIGNALS
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/orgs/me/filters/traces"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    filters = response.json()["data"]["filters"]
-    assert filters[0]["key"] == "duration_nano"
-    assert filters[0]["type"] == "tag"
-    assert filters[0]["dataType"] == "float64"
-    assert all("name" not in legacy_filter for legacy_filter in filters)
-
-
-def test_v1_update_round_trips_to_v2(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get("/api/v1/orgs/me/filters"),
-        json={
-            "signal": "exceptions",
-            "filters": [
-                {"key": "service.name", "dataType": "string", "type": "resource"},
-                {"key": "http.method", "dataType": "string", "type": "tag"},
-                {"key": "code_line", "dataType": "int64", "type": "tag"},
-            ],
-        },
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters/exceptions"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    filters = response.json()["data"]["filters"]
-    assert [(field_key["name"], field_key["fieldContext"]) for field_key in filters] == [
-        ("service.name", "resource"),
-        ("http.method", "attribute"),
-        ("code_line", "attribute"),
-    ]
-    assert filters[2]["fieldDataType"] == "number"
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/orgs/me/filters/exceptions"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    filters = response.json()["data"]["filters"]
-    assert [(legacy_filter["key"], legacy_filter["type"]) for legacy_filter in filters] == [
-        ("service.name", "resource"),
-        ("http.method", "tag"),
-        ("code_line", "tag"),
-    ]
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get("/api/v1/orgs/me/filters"),
-        json={
-            "signal": "meter",
-            "filters": [{"key": "host.name", "dataType": "string", "type": ""}],
-        },
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters/meter"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    assert [(field_key["name"], field_key["signal"]) for field_key in response.json()["data"]["filters"]] == [("host.name", "metrics")]
-
-
-def test_update_quick_filters_round_trip(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters"),
-        json={
-            "signal": "logs",
-            "filters": [
-                {
-                    "name": "k8s.pod.name",
-                    "fieldContext": "resource",
-                    "fieldDataType": "string",
-                },
-                {
-                    "name": "body.status",
-                    "fieldContext": "body",
-                    "fieldDataType": "string",
-                },
-            ],
-        },
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-
-    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters/logs"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-
-    assert response.status_code == HTTPStatus.OK, response.text
-    filters = response.json()["data"]["filters"]
-    assert [field_key["name"] for field_key in filters] == [
-        "k8s.pod.name",
-        "body.status",
-    ]
-    assert filters[0]["fieldContext"] == "resource"
-    assert filters[1]["fieldContext"] == "body"
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/orgs/me/filters/logs"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    assert [(legacy_filter["key"], legacy_filter["type"]) for legacy_filter in response.json()["data"]["filters"]] == [
-        ("k8s.pod.name", "resource"),
-        ("body.status", ""),
-    ]
-
-
-def test_update_quick_filters_creates_row_for_signal_without_one(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    with signoz.sqlstore.conn.connect() as conn:
-        conn.execute(
-            sql.text("DELETE FROM quick_filter WHERE signal = :signal"),
-            {"signal": "api_monitoring"},
-        )
-        conn.commit()
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters/api_monitoring"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    assert response.json()["data"] == {"signal": "api_monitoring", "filters": []}
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters"),
-        json={
-            "signal": "api_monitoring",
-            "filters": [
-                {
-                    "name": "service.name",
-                    "fieldContext": "resource",
-                    "fieldDataType": "string",
-                },
-            ],
-        },
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters/api_monitoring"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    assert [field_key["name"] for field_key in response.json()["data"]["filters"]] == ["service.name"]
-
-
-def test_update_quick_filters_rejects_invalid_input(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    for invalid_body in [
-        {
-            "signal": "traces",
-            "filters": [{"key": "service.name", "dataType": "string", "type": "resource"}],
-        },
-        {"signal": "invalid", "filters": []},
-    ]:
-        response = requests.put(
-            signoz.self.host_configs["8080"].get("/api/v2/quick_filters"),
-            json=invalid_body,
-            headers={"Authorization": f"Bearer {admin_token}"},
-            timeout=2,
-        )
-        assert response.status_code == HTTPStatus.BAD_REQUEST, response.text

tests/integration/tests/quickfilter/02_authz.py

@@ -1,92 +0,0 @@
-from collections.abc import Callable
-from http import HTTPStatus
-
-import pytest
-import requests
-
-from fixtures import types
-from fixtures.auth import (
-    USER_ADMIN_EMAIL,
-    USER_ADMIN_PASSWORD,
-    USERS_BASE,
-    create_active_user,
-)
-
-EDITOR_EMAIL = "editor+quickfilter@integration.test"
-VIEWER_EMAIL = "viewer+quickfilter@integration.test"
-NON_ADMIN_PASSWORD = "password123Z$"
-
-
-def test_create_non_admin_users(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-):
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(USERS_BASE),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    existing_emails = {user["email"] for user in response.json()["data"]}
-
-    for email, role, name in [
-        (EDITOR_EMAIL, "signoz-editor", "quickfilter-editor"),
-        (VIEWER_EMAIL, "signoz-viewer", "quickfilter-viewer"),
-    ]:
-        if email not in existing_emails:
-            create_active_user(
-                signoz,
-                admin_token,
-                email=email,
-                role=role,
-                password=NON_ADMIN_PASSWORD,
-                name=name,
-            )
-
-
-@pytest.mark.parametrize("email", [EDITOR_EMAIL, VIEWER_EMAIL], ids=["editor", "viewer"])
-def test_non_admin_can_read_quick_filters(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    email: str,
-):
-    token = get_token(email, NON_ADMIN_PASSWORD)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters"),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters/traces"),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-
-
-@pytest.mark.parametrize("email", [EDITOR_EMAIL, VIEWER_EMAIL], ids=["editor", "viewer"])
-def test_non_admin_cannot_update_quick_filters(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    email: str,
-):
-    token = get_token(email, NON_ADMIN_PASSWORD)
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get("/api/v2/quick_filters"),
-        json={
-            "signal": "traces",
-            "filters": [{"name": "service.name", "fieldContext": "resource", "fieldDataType": "string"}],
-        },
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.FORBIDDEN, response.text