Merge branch 'issue-2946' of https://github.com/SigNoz/signoz into issue-2946

#### Description

- A logs filter on a bare key that lives in **both** resource and
another context (body or scope) ANDed the two: the resource candidate
built the `__resource_filter` fingerprint CTE while the other candidate
landed as a required main-query term, so the query matched almost
nothing.
- `ResolveLogicalFields` only preferred resource over `attribute`.
Generalized it to prefer resource over **any** other context (attribute,
body, scope, …); other contexts stay reachable via their qualified names
(e.g. `body.service.name`).

#### Issues closed by this PR

Closes SigNoz/engineering-pod#6086
Part of https://github.com/SigNoz/platform-pod/issues/3158

#### Additional Information

Generalized rather than special-casing body/scope, since any future
context would hit the same fingerprint-CTE trap.

.github/workflows/integrationci.yaml

@@ -67,7 +67,6 @@ jobs:
           - semconvfamilies
           - serviceaccount
           - spanmapper
-          - tracedetail
           - querier_json_body
           - querier_skip_resource_fingerprint
           - ttl

docs/api/openapi.yml

@@ -9439,29 +9439,6 @@ components:
       required:
       - aggregations
       type: object
-    SpantypesGettableTraceSummary:
-      properties:
-        ai:
-          $ref: '#/components/schemas/SpantypesTraceAISummary'
-        endTimestampMillis:
-          minimum: 0
-          type: integer
-        hasMissingSpans:
-          type: boolean
-        rootServiceEntryPoint:
-          type: string
-        rootServiceName:
-          type: string
-        startTimestampMillis:
-          minimum: 0
-          type: integer
-        totalErrorSpansCount:
-          minimum: 0
-          type: integer
-        totalSpansCount:
-          minimum: 0
-          type: integer
-      type: object
     SpantypesGettableWaterfallTrace:
       properties:
         endTimestampMillis:
@@ -9745,32 +9722,6 @@ components:
           nullable: true
           type: object
       type: object
-    SpantypesTraceAISummary:
-      properties:
-        tokens:
-          $ref: '#/components/schemas/SpantypesTraceAITokens'
-        totalCost:
-          nullable: true
-          type: number
-      type: object
-    SpantypesTraceAITokens:
-      properties:
-        cacheRead:
-          minimum: 0
-          type: integer
-        cacheWrite:
-          minimum: 0
-          type: integer
-        input:
-          minimum: 0
-          type: integer
-        output:
-          minimum: 0
-          type: integer
-        reasoning:
-          minimum: 0
-          type: integer
-      type: object
     SpantypesUpdatableSpanMapper:
       properties:
         config:
@@ -11009,9 +10960,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - cloud-integration:read
       - tokenizer:
-        - VIEWER
+        - cloud-integration:read
       summary: Agent check-in
       tags:
       - cloudintegration
@@ -11061,9 +11012,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - cloud-integration:list
       - tokenizer:
-        - ADMIN
+        - cloud-integration:list
       summary: List accounts
       tags:
       - cloudintegration
@@ -11118,9 +11069,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - cloud-integration:create
       - tokenizer:
-        - ADMIN
+        - cloud-integration:create
       summary: Create account
       tags:
       - cloudintegration
@@ -11163,9 +11114,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - cloud-integration:delete
       - tokenizer:
-        - ADMIN
+        - cloud-integration:delete
       summary: Disconnect account
       tags:
       - cloudintegration
@@ -11231,9 +11182,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - cloud-integration:read
       - tokenizer:
-        - ADMIN
+        - cloud-integration:read
       summary: Get account
       tags:
       - cloudintegration
@@ -11280,9 +11231,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - cloud-integration:update
       - tokenizer:
-        - ADMIN
+        - cloud-integration:update
       summary: Update account
       tags:
       - cloudintegration
@@ -11338,9 +11289,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - cloud-integration:list
       - tokenizer:
-        - ADMIN
+        - cloud-integration:list
       summary: List account services metadata
       tags:
       - cloudintegration
@@ -11413,9 +11364,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - cloud-integration:read
       - tokenizer:
-        - ADMIN
+        - cloud-integration:read
       summary: Get service for account
       tags:
       - cloudintegration
@@ -11467,9 +11418,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - cloud-integration:update
       - tokenizer:
-        - ADMIN
+        - cloud-integration:update
       summary: Update service
       tags:
       - cloudintegration
@@ -11524,9 +11475,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - cloud-integration:read
       - tokenizer:
-        - VIEWER
+        - cloud-integration:read
       summary: Agent check-in
       tags:
       - cloudintegration
@@ -11577,9 +11528,17 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - ingestion-key:create
+        - serviceaccount:create
+        - factor-api-key:create
+        - serviceaccount:attach
+        - role:attach
       - tokenizer:
-        - ADMIN
+        - ingestion-key:create
+        - serviceaccount:create
+        - factor-api-key:create
+        - serviceaccount:attach
+        - role:attach
       summary: Get connection credentials
       tags:
       - cloudintegration
@@ -11629,10 +11588,8 @@ paths:
                 $ref: '#/components/schemas/RenderErrorResponse'
           description: Internal Server Error
       security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
+      - api_key: []
+      - tokenizer: []
       summary: List services metadata
       tags:
       - cloudintegration
@@ -11687,10 +11644,8 @@ paths:
                 $ref: '#/components/schemas/RenderErrorResponse'
           description: Internal Server Error
       security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
+      - api_key: []
+      - tokenizer: []
       summary: Get service
       tags:
       - cloudintegration
@@ -15509,66 +15464,6 @@ paths:
       summary: Get aggregations for a trace
       tags:
       - tracedetail
-  /api/v1/traces/{traceID}/summary:
-    get:
-      deprecated: false
-      description: Returns the trace-level fields of the waterfall (time range, root,
-        span counts, missing spans) and, when the trace has gen_ai spans, its token
-        and cost totals. Computed in one aggregate query.
-      operationId: GetTraceSummary
-      parameters:
-      - in: path
-        name: traceID
-        required: true
-        schema:
-          type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/SpantypesGettableTraceSummary'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - VIEWER
-      - tokenizer:
-        - VIEWER
-      summary: Get summary for a trace
-      tags:
-      - tracedetail
   /api/v1/user/me:
     get:
       deprecated: true

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -10884,78 +10884,6 @@ export interface SpantypesGettableTraceAggregationsDTO {
 	aggregations: SpantypesSpanAggregationResultDTO[];
 }
 
-export interface SpantypesTraceAITokensDTO {
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	cacheRead?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	cacheWrite?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	input?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	output?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	reasoning?: number;
-}
-
-export interface SpantypesTraceAISummaryDTO {
-	tokens?: SpantypesTraceAITokensDTO;
-	/**
-	 * @type number,null
-	 */
-	totalCost?: number | null;
-}
-
-export interface SpantypesGettableTraceSummaryDTO {
-	ai?: SpantypesTraceAISummaryDTO;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	endTimestampMillis?: number;
-	/**
-	 * @type boolean
-	 */
-	hasMissingSpans?: boolean;
-	/**
-	 * @type string
-	 */
-	rootServiceEntryPoint?: string;
-	/**
-	 * @type string
-	 */
-	rootServiceName?: string;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	startTimestampMillis?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	totalErrorSpansCount?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	totalSpansCount?: number;
-}
-
 export interface SpantypesOtelSpanRefDTO {
 	/**
 	 * @type string
@@ -12667,17 +12595,6 @@ export type GetTraceAggregations200 = {
 	status: string;
 };
 
-export type GetTraceSummaryPathParameters = {
-	traceID: string;
-};
-export type GetTraceSummary200 = {
-	data: SpantypesGettableTraceSummaryDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
 export type ListUserPreferences200 = {
 	/**
 	 * @type array

frontend/src/api/generated/services/tracedetail/index.ts

@@ -4,17 +4,11 @@
  * * regenerate with 'pnpm generate:api'
  * SigNoz
  */
-import { useMutation, useQuery } from 'react-query';
+import { useMutation } from 'react-query';
 import type {
-	InvalidateOptions,
 	MutationFunction,
-	QueryClient,
-	QueryFunction,
-	QueryKey,
 	UseMutationOptions,
 	UseMutationResult,
-	UseQueryOptions,
-	UseQueryResult,
 } from 'react-query';
 
 import type {
@@ -22,8 +16,6 @@ import type {
 	GetFlamegraphPathParameters,
 	GetTraceAggregations200,
 	GetTraceAggregationsPathParameters,
-	GetTraceSummary200,
-	GetTraceSummaryPathParameters,
 	GetWaterfallV4200,
 	GetWaterfallV4PathParameters,
 	RenderErrorResponseDTO,
@@ -35,26 +27,6 @@ import type {
 import { GeneratedAPIInstance } from '../../../generatedAPIInstance';
 import type { ErrorType, BodyType } from '../../../generatedAPIInstance';
 
-const withQueryKey = <T extends object, K>(
-	query: T,
-	queryKey: K,
-): T & { queryKey: K } => {
-	const result = { queryKey } as T & { queryKey: K };
-	for (const key of Object.keys(query)) {
-		// The explicit queryKey always wins, matching the previous
-		// `{ ...query, queryKey }` spread where it was set last.
-		if (key === 'queryKey') {
-			continue;
-		}
-		Object.defineProperty(result, key, {
-			enumerable: true,
-			configurable: true,
-			get: () => (query as Record<string, unknown>)[key],
-		});
-	}
-	return result;
-};
-
 /**
  * Computes span aggregations grouped by requested field.
  * @summary Get aggregations for a trace
@@ -155,108 +127,6 @@ export const useGetTraceAggregations = <
 > => {
 	return useMutation(getGetTraceAggregationsMutationOptions(options));
 };
-/**
- * Returns the trace-level fields of the waterfall (time range, root, span counts, missing spans) and, when the trace has gen_ai spans, its token and cost totals. Computed in one aggregate query.
- * @summary Get summary for a trace
- */
-export const getTraceSummary = (
-	{ traceID }: GetTraceSummaryPathParameters,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<GetTraceSummary200>({
-		url: `/api/v1/traces/${traceID}/summary`,
-		method: 'GET',
-		signal,
-	});
-};
-
-export const getGetTraceSummaryQueryKey = ({
-	traceID,
-}: GetTraceSummaryPathParameters) => {
-	return [`/api/v1/traces/${traceID}/summary`] as const;
-};
-
-export const getGetTraceSummaryQueryOptions = <
-	TData = Awaited<ReturnType<typeof getTraceSummary>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ traceID }: GetTraceSummaryPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getTraceSummary>>,
-			TError,
-			TData
-		>;
-	},
-) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey =
-		queryOptions?.queryKey ?? getGetTraceSummaryQueryKey({ traceID });
-
-	const queryFn: QueryFunction<Awaited<ReturnType<typeof getTraceSummary>>> = ({
-		signal,
-	}) => getTraceSummary({ traceID }, signal);
-
-	return {
-		queryKey,
-		queryFn,
-		enabled: traceID !== null && traceID !== undefined,
-		...queryOptions,
-	} as UseQueryOptions<
-		Awaited<ReturnType<typeof getTraceSummary>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type GetTraceSummaryQueryResult = NonNullable<
-	Awaited<ReturnType<typeof getTraceSummary>>
->;
-export type GetTraceSummaryQueryError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Get summary for a trace
- */
-
-export function useGetTraceSummary<
-	TData = Awaited<ReturnType<typeof getTraceSummary>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ traceID }: GetTraceSummaryPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getTraceSummary>>,
-			TError,
-			TData
-		>;
-	},
-): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getGetTraceSummaryQueryOptions({ traceID }, options);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return withQueryKey(query, queryOptions.queryKey);
-}
-
-/**
- * @summary Get summary for a trace
- */
-export const invalidateGetTraceSummary = async (
-	queryClient: QueryClient,
-	{ traceID }: GetTraceSummaryPathParameters,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getGetTraceSummaryQueryKey({ traceID }) },
-		options,
-	);
-
-	return queryClient;
-};
-
 /**
  * Returns the flamegraph view of spans for a given trace ID.
  * @summary Get flamegraph view for a trace

pkg/apiserver/signozapiserver/cloudintegration.go

@@ -4,14 +4,15 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	citypes "github.com/SigNoz/signoz/pkg/types/cloudintegrationtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/credentials", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.GetConnectionCredentials),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.GetConnectionCredentials, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetConnectionCredentials",
 			Tags:                []string{"cloudintegration"},
@@ -24,14 +25,56 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceIngestionKey.Scope(coretypes.VerbCreate),
+				coretypes.ResourceServiceAccount.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceFactorAPIKey.Scope(coretypes.VerbCreate),
+				coretypes.ResourceServiceAccount.Scope(coretypes.VerbAttach),
+				coretypes.ResourceRole.Scope(coretypes.VerbAttach),
+			}),
 		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceIngestionKey,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceServiceAccount,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceFactorAPIKey,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryAccessControl,
+				SourceResource: coretypes.ResourceServiceAccount,
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceRole,
+				TargetIDs:      signozViewerRoleNamesExtractor(),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachParentChildResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryAccessControl,
+				ParentResource: coretypes.ResourceServiceAccount,
+				ParentSelector: coretypes.WildcardSelector,
+				ChildResource:  coretypes.ResourceMetaResourceFactorAPIKey,
+			},
+		),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/accounts", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.CreateAccount),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.CreateAccount, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "CreateAccount",
 			Tags:                []string{"cloudintegration"},
@@ -44,14 +87,21 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusCreated,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbCreate)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/accounts", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.ListAccounts),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.ListAccounts, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListAccounts",
 			Tags:                []string{"cloudintegration"},
@@ -64,14 +114,20 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/accounts/{id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.GetAccount),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.GetAccount, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetAccount",
 			Tags:                []string{"cloudintegration"},
@@ -84,14 +140,21 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/accounts/{id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.UpdateAccount),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.UpdateAccount, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "UpdateAccount",
 			Tags:                []string{"cloudintegration"},
@@ -104,14 +167,21 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/accounts/{id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.DisconnectAccount),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.DisconnectAccount, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "DisconnectAccount",
 			Tags:                []string{"cloudintegration"},
@@ -124,14 +194,21 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbDelete)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/services", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.ListServicesMetadata),
+		provider.authzMiddleware.OpenAccess(provider.cloudIntegrationHandler.ListServicesMetadata),
 		handler.OpenAPIDef{
 			ID:                  "ListServicesMetadata",
 			Tags:                []string{"cloudintegration"},
@@ -144,14 +221,14 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes(nil),
 		},
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/accounts/{id}/services", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.ListAccountServicesMetadata),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.ListAccountServicesMetadata, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListAccountServicesMetadata",
 			Tags:                []string{"cloudintegration"},
@@ -164,14 +241,21 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/services/{service_id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.GetService),
+		provider.authzMiddleware.OpenAccess(provider.cloudIntegrationHandler.GetService),
 		handler.OpenAPIDef{
 			ID:                  "GetService",
 			Tags:                []string{"cloudintegration"},
@@ -184,14 +268,14 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes(nil),
 		},
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/accounts/{id}/services/{service_id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.UpdateService),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.UpdateService, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "UpdateService",
 			Tags:                []string{"cloudintegration"},
@@ -204,14 +288,21 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/accounts/{id}/services/{service_id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.cloudIntegrationHandler.GetAccountService),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.GetAccountService, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetAccountService",
 			Tags:                []string{"cloudintegration"},
@@ -224,8 +315,15 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
@@ -233,7 +331,7 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 	// Agent check-in endpoint is kept same as older one to maintain backward compatibility with already deployed agents.
 	// In the future, this endpoint will be deprecated and a new endpoint will be introduced for consistency with above endpoints.
 	if err := router.Handle("/api/v1/cloud-integrations/{cloud_provider}/agent-check-in", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.cloudIntegrationHandler.AgentCheckIn),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.AgentCheckIn, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "AgentCheckInDeprecated",
 			Tags:                []string{"cloudintegration"},
@@ -245,15 +343,22 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{},
-			Deprecated:          true,                                 // this endpoint will be deprecated in future
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer), // agent role is viewer
+			Deprecated:          true, // this endpoint will be deprecated in future
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.BodyJSONPath("account_id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/cloud_integrations/{cloud_provider}/accounts/check_in", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.cloudIntegrationHandler.AgentCheckIn),
+		provider.authzMiddleware.CheckResources(provider.cloudIntegrationHandler.AgentCheckIn, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "AgentCheckIn",
 			Tags:                []string{"cloudintegration"},
@@ -266,11 +371,24 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer), // agent role is viewer
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceCloudIntegration.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceCloudIntegration,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.BodyJSONPath("cloudIntegrationId"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
 	return nil
 }
+
+func signozViewerRoleNamesExtractor() coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(coretypes.ExtractorContext) ([]string, error) {
+		return []string{authtypes.SigNozViewerRoleName}, nil
+	}}
+}

pkg/apiserver/signozapiserver/tracedetail.go

@@ -10,23 +10,6 @@ import (
 )
 
 func (provider *provider) addTraceDetailRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v1/traces/{traceID}/summary", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.traceDetailHandler.GetTraceSummary),
-		handler.OpenAPIDef{
-			ID:                  "GetTraceSummary",
-			Tags:                []string{"tracedetail"},
-			Summary:             "Get summary for a trace",
-			Description:         "Returns the trace-level fields of the waterfall (time range, root, span counts, missing spans) and, when the trace has gen_ai spans, its token and cost totals. Computed in one aggregate query.",
-			Response:            new(spantypes.GettableTraceSummary),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusNotFound},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		},
-	)).Methods(http.MethodGet).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v4/traces/{traceID}/waterfall", handler.New(
 		provider.authzMiddleware.ViewAccess(provider.traceDetailHandler.GetWaterfallV4),
 		handler.OpenAPIDef{

pkg/modules/tracedetail/impltracedetail/handler.go

@@ -6,9 +6,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/http/binding"
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/spantypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
 
@@ -20,27 +18,6 @@ func NewHandler(module tracedetail.Module) tracedetail.Handler {
 	return &handler{module: module}
 }
 
-func (h *handler) GetTraceSummary(rw http.ResponseWriter, r *http.Request) {
-	claims, err := authtypes.ClaimsFromContext(r.Context())
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-	orgID, err := valuer.NewUUID(claims.OrgID)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	stats, err := h.module.GetTraceStats(r.Context(), orgID, mux.Vars(r)["traceID"])
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusOK, spantypes.NewGettableTraceSummary(stats))
-}
-
 func (h *handler) GetWaterfallV4(rw http.ResponseWriter, r *http.Request) {
 	req := new(spantypes.PostableWaterfall)
 	if err := binding.JSON.BindBody(r.Body, req); err != nil {

pkg/modules/tracedetail/impltracedetail/module.go

@@ -8,7 +8,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/types/spantypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
 	"go.opentelemetry.io/otel/metric"
 )
 
@@ -40,21 +39,6 @@ func NewModule(traceStore spantypes.TraceStore, providerSettings factory.Provide
 	return m
 }
 
-func (m *module) GetTraceStats(ctx context.Context, orgID valuer.UUID, traceID string) (*spantypes.TraceStats, error) {
-	summary, err := m.store.GetTraceSummary(ctx, traceID)
-	if err != nil {
-		return nil, err
-	}
-	stats, err := m.store.GetTraceStats(ctx, orgID, traceID, summary)
-	if err != nil {
-		return nil, err
-	}
-	if stats.TotalSpans == 0 {
-		return nil, spantypes.ErrTraceNotFound
-	}
-	return stats, nil
-}
-
 // GetWaterfallV4 is the OOM-safe V4 waterfall.
 // For large traces (NumSpans > effectiveLimit) it uses a two-step fetch:
 // minimal fields for all spans to build the tree, then full fields for the

pkg/modules/tracedetail/impltracedetail/store.go

@@ -10,15 +10,9 @@ import (
 
 	"github.com/SigNoz/signoz/pkg/clickhousesql"
 	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/flagger"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/telemetryschema/tracestelemetryschema"
 	"github.com/SigNoz/signoz/pkg/telemetrystore"
-	"github.com/SigNoz/signoz/pkg/types/aiobservabilitytypes"
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/spantypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
 const colServiceName = `resource_string_service$$$$name` // $ gets escaped so $$$$ converts to $$.
@@ -44,18 +38,10 @@ type spanDurationRow struct {
 
 type traceStore struct {
 	telemetryStore telemetrystore.TelemetryStore
-	metadataStore  telemetrytypes.MetadataStore
-	storage        qbtypes.Storage
-	flagger        flagger.Flagger
 }
 
-func NewTraceStore(ts telemetrystore.TelemetryStore, metadataStore telemetrytypes.MetadataStore, fl flagger.Flagger) *traceStore {
-	return &traceStore{
-		telemetryStore: ts,
-		metadataStore:  metadataStore,
-		storage:        tracestelemetryschema.NewStorage(),
-		flagger:        fl,
-	}
+func NewTraceStore(ts telemetrystore.TelemetryStore) *traceStore {
+	return &traceStore{telemetryStore: ts}
 }
 
 func (s *traceStore) GetTraceSummary(ctx context.Context, traceID string) (*spantypes.TraceSummary, error) {
@@ -79,131 +65,6 @@ func (s *traceStore) GetTraceSummary(ctx context.Context, traceID string) (*span
 	return &summary, nil
 }
 
-func (s *traceStore) GetTraceStats(ctx context.Context, orgID valuer.UUID, traceID string, summary *spantypes.TraceSummary) (*spantypes.TraceStats, error) {
-	table := fmt.Sprintf("%s.%s", spantypes.TraceDB, spantypes.TraceTable)
-	spans := sqlbuilder.NewSelectBuilder()
-
-	genAIColumns, err := s.genAISpanColumns(ctx, orgID, summary, spans)
-	if err != nil {
-		return nil, err
-	}
-
-	// A span whose parent was never recorded hangs off a synthetic "Missing Span" root in the waterfall.
-	ids := sqlbuilder.NewSelectBuilder()
-	ids.Select("span_id")
-	ids.From(table)
-	ids.Where(
-		ids.E("trace_id", traceID),
-		ids.GE("ts_bucket_start", summary.Start.Unix()-1800),
-		ids.LE("ts_bucket_start", summary.End.Unix()),
-	)
-	missingParent := fmt.Sprintf("parent_span_id <> '' AND parent_span_id GLOBAL NOT IN (%s)", spans.Var(ids))
-
-	spans.Select(
-		"toUnixTimestamp64Nano(timestamp) AS span_start_ns",
-		"span_start_ns + duration_nano AS span_end_ns",
-		"span_id",
-		"has_error",
-		"("+missingParent+") AS has_missing_parent",
-		"(parent_span_id = '' OR has_missing_parent) AS is_root",
-		"if(parent_span_id = '', name, 'Missing Span') AS root_name",
-		"if(parent_span_id = '', "+colServiceName+", '') AS root_service",
-	)
-	spans.SelectMore(genAIColumns...)
-	spans.From(table)
-	spans.Where(
-		spans.E("trace_id", traceID),
-		spans.GE("ts_bucket_start", summary.Start.Unix()-1800),
-		spans.LE("ts_bucket_start", summary.End.Unix()),
-	)
-	spans.SQL("LIMIT 1 BY span_id")
-
-	sb := sqlbuilder.NewSelectBuilder()
-	sb.Select(
-		"toUInt64(min(span_start_ns)) AS start_ns",
-		"toUInt64(max(span_end_ns)) AS end_ns",
-		"count() AS total_spans",
-		"countIf(has_error) AS total_error_spans",
-		"countIf(has_missing_parent) > 0 AS has_missing_spans",
-		"argMinIf(root_service, (span_start_ns, root_name), is_root) AS root_service_name",
-		"argMinIf(root_name, (span_start_ns, root_name), is_root) AS root_entry_point",
-		"countIf(is_gen_ai) AS gen_ai_span_count",
-		"toUInt64(coalesce(sum(input_tokens_value), 0)) AS input_tokens",
-		"toUInt64(coalesce(sum(output_tokens_value), 0)) AS output_tokens",
-		"toUInt64(coalesce(sum(cache_read_tokens_value), 0)) AS cache_read_tokens",
-		"toUInt64(coalesce(sum(cache_write_tokens_value), 0)) AS cache_write_tokens",
-		"toUInt64(coalesce(sum(reasoning_tokens_value), 0)) AS reasoning_tokens",
-		"sum(total_cost_value) AS total_cost",
-	)
-	sb.From(sb.BuilderAs(spans, "spans"))
-	query, args := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-
-	var stats spantypes.TraceStats
-	err = s.telemetryStore.ClickhouseDB().QueryRow(ctx, query, args...).Scan(
-		&stats.StartNs, &stats.EndNs, &stats.TotalSpans, &stats.TotalErrorSpans, &stats.HasMissingSpans,
-		&stats.RootServiceName, &stats.RootEntryPoint, &stats.GenAISpanCount,
-		&stats.Tokens.Input, &stats.Tokens.Output, &stats.Tokens.CacheRead, &stats.Tokens.CacheWrite, &stats.Tokens.Reasoning,
-		&stats.TotalCost,
-	)
-	if err != nil {
-		return nil, errors.WrapInternalf(err, errors.CodeInternal, "error querying trace stats")
-	}
-	return &stats, nil
-}
-
-// genAISpanColumns renders the per-span gen_ai gate and value reads through the shared
-// traces storage, so each attribute is read from the column its evolutions place it in
-// over the trace's own time window. Exists predicates bind their args into sb.
-func (s *traceStore) genAISpanColumns(ctx context.Context, orgID valuer.UUID, summary *spantypes.TraceSummary, sb *sqlbuilder.SelectBuilder) ([]string, error) {
-	// no data type: metadata reports token counts as number, so a float64 request would
-	// miss them and fall back to a map read without evolutions
-	attributeKey := func(name string) *telemetrytypes.TelemetryFieldKey {
-		return &telemetrytypes.TelemetryFieldKey{Name: name, Signal: telemetrytypes.SignalTraces, FieldContext: telemetrytypes.FieldContextAttribute}
-	}
-
-	selectors := make([]*telemetrytypes.FieldKeySelector, 0, len(aiobservabilitytypes.GenAISpanGateKeys)+len(spantypes.TraceStatsGenAIColumns))
-	addSelector := func(name string) {
-		selectors = append(selectors, &telemetrytypes.FieldKeySelector{
-			Name:              name,
-			Signal:            telemetrytypes.SignalTraces,
-			FieldContext:      telemetrytypes.FieldContextAttribute,
-			SelectorMatchType: telemetrytypes.FieldSelectorMatchTypeExact,
-		})
-	}
-	for _, name := range aiobservabilitytypes.GenAISpanGateKeys {
-		addSelector(name)
-	}
-	for _, col := range spantypes.TraceStatsGenAIColumns {
-		addSelector(col.Key)
-	}
-	keys, _, err := s.metadataStore.GetKeysMulti(ctx, orgID, querybuilder.ExpandKeySelectorsForFamilies(ctx, orgID, s.flagger, selectors))
-	if err != nil {
-		return nil, err
-	}
-
-	q := querybuilder.NewQueryInfo(ctx, orgID, s.flagger, telemetrytypes.SignalTraces, nil, uint64(summary.Start.UnixNano()), uint64(summary.End.UnixNano()))
-
-	gate := make([]string, 0, len(aiobservabilitytypes.GenAISpanGateKeys))
-	for _, name := range aiobservabilitytypes.GenAISpanGateKeys {
-		conds, _, err := querybuilder.Conditions(ctx, q, s.storage, attributeKey(name), qbtypes.FilterOperatorExists, nil, keys, false, sb)
-		if err != nil {
-			return nil, err
-		}
-		gate = append(gate, conds...)
-	}
-	columns := []string{sb.Or(gate...) + " AS is_gen_ai"}
-
-	for _, col := range spantypes.TraceStatsGenAIColumns {
-		expr, err := querybuilder.ResolveColumn(ctx, q, s.storage, attributeKey(col.Key), telemetrytypes.FieldDataTypeFloat64, keys)
-		if err != nil {
-			return nil, err
-		}
-		// a materialized column name carries `$$`, which Build would otherwise unescape
-		columns = append(columns, sqlbuilder.Escape(expr)+" AS "+col.Column+"_value")
-	}
-	return columns, nil
-}
-
 func (s *traceStore) GetTraceSpans(ctx context.Context, traceID string, summary *spantypes.TraceSummary) ([]spantypes.StorableSpan, error) {
 	// DISTINCT ON (span_id) is ClickHouse-specific syntax not supported by sqlbuilder
 	query := fmt.Sprintf(`

pkg/modules/tracedetail/tracedetail.go

@@ -6,12 +6,10 @@ import (
 
 	"github.com/SigNoz/signoz/pkg/types/spantypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
 // Handler exposes HTTP handlers for trace detail APIs.
 type Handler interface {
-	GetTraceSummary(http.ResponseWriter, *http.Request)
 	GetWaterfallV4(http.ResponseWriter, *http.Request)
 	GetTraceAggregations(http.ResponseWriter, *http.Request)
 	GetFlamegraph(http.ResponseWriter, *http.Request)
@@ -19,7 +17,6 @@ type Handler interface {
 
 // Module defines the business logic for trace detail operations.
 type Module interface {
-	GetTraceStats(ctx context.Context, orgID valuer.UUID, traceID string) (*spantypes.TraceStats, error)
 	GetWaterfallV4(ctx context.Context, traceID string, selectedSpanID string, uncollapsedSpans []string) (*spantypes.GettableWaterfallTrace, error)
 	GetTraceAggregations(ctx context.Context, traceID string, req *spantypes.PostableTraceAggregations) (*spantypes.GettableTraceAggregations, error)
 	GetFlamegraph(ctx context.Context, traceID string, selectedSpanID string, selectFields []telemetrytypes.TelemetryFieldKey) (*spantypes.GettableFlamegraphTrace, error)

pkg/querybuilder/key_resolution.go

@@ -25,8 +25,9 @@ const (
 // ResolveLogicalFields picks which logical fields a filter term builds conditions
 // for. With 0 or 1 field it returns the input unchanged and no warning. When a
 // name is ambiguous (several logical fields — a family is one field and never
-// ambiguous with itself) it returns a warning; a resource+attribute mix defaults
-// to the resource fields (the common intent), noted in the warning.
+// ambiguous with itself) it returns a warning; a resource + other-context mix
+// (attribute, body, scope, …) defaults to the resource fields (the common
+// intent), noted in the warning.
 func ResolveLogicalFields(field *telemetrytypes.TelemetryFieldKey, logicalFields []*telemetrytypes.LogicalField) ([]*telemetrytypes.LogicalField, string) {
 	if len(logicalFields) <= 1 {
 		return logicalFields, ""
@@ -39,18 +40,17 @@ func ResolveLogicalFields(field *telemetrytypes.TelemetryFieldKey, logicalFields
 		logicalFields,
 	)
 
-	hasResource, hasAttribute := false, false
+	hasResource, hasOther := false, false
 	for _, item := range logicalFields {
-		switch item.FieldContext {
-		case telemetrytypes.FieldContextResource:
+		if item.FieldContext == telemetrytypes.FieldContextResource {
 			hasResource = true
-		case telemetrytypes.FieldContextAttribute:
-			hasAttribute = true
+		} else {
+			hasOther = true
 		}
 	}
 
-	// when there is both resource and attribute context, default to resource only
-	if hasResource && hasAttribute {
+	// with resource and any other context, default to resource only
+	if hasResource && hasOther {
 		filtered := make([]*telemetrytypes.LogicalField, 0, len(logicalFields))
 		for _, item := range logicalFields {
 			if item.FieldContext == telemetrytypes.FieldContextResource {
@@ -58,8 +58,8 @@ func ResolveLogicalFields(field *telemetrytypes.TelemetryFieldKey, logicalFields
 			}
 		}
 		logicalFields = filtered
-		warning += " " + "Using `resource` context by default. To query attributes explicitly, " +
-			fmt.Sprintf("use the fully qualified name (e.g., 'attribute.%s')", field.Name)
+		warning += " " + "Using `resource` context by default. To query another context explicitly, " +
+			fmt.Sprintf("use the fully qualified name (e.g., 'attribute.%s' or 'body.%s')", field.Name, field.Name)
 	}
 
 	return logicalFields, warning

pkg/querybuilder/logical_fields_test.go

@@ -175,6 +175,42 @@ func TestResolveLogicalFieldsKeepsFamilyThroughAmbiguity(t *testing.T) {
 	assert.Equal(t, []string{"deployment.environment.name", "deployment.environment"}, memberNames(resolved[0]))
 }
 
+// Resource wins over every other context, not just attribute: a bare key that
+// also lives in body or scope must collapse to resource alone, so the surviving
+// candidate does not AND against the resource fingerprint CTE.
+func TestResolveLogicalFieldsResourceWinsOverOtherContexts(t *testing.T) {
+	testCases := []struct {
+		name  string
+		other telemetrytypes.FieldContext
+	}{
+		{name: "ResourceOverBody", other: telemetrytypes.FieldContextBody},
+		{name: "ResourceOverScope", other: telemetrytypes.FieldContextScope},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			requested := &telemetrytypes.TelemetryFieldKey{Name: "service.name"}
+			fields := []*telemetrytypes.LogicalField{
+				telemetrytypes.SingleLogicalField("service.name", &telemetrytypes.TelemetryFieldKey{
+					Name:          "service.name",
+					FieldContext:  telemetrytypes.FieldContextResource,
+					FieldDataType: telemetrytypes.FieldDataTypeString,
+				}),
+				telemetrytypes.SingleLogicalField("service.name", &telemetrytypes.TelemetryFieldKey{
+					Name:          "service.name",
+					FieldContext:  testCase.other,
+					FieldDataType: telemetrytypes.FieldDataTypeString,
+				}),
+			}
+
+			resolved, warning := ResolveLogicalFields(requested, fields)
+			assert.NotEmpty(t, warning)
+			require.Len(t, resolved, 1)
+			assert.Equal(t, telemetrytypes.FieldContextResource, resolved[0].FieldContext)
+		})
+	}
+}
+
 // Members of a family with different data types never merge: the identity
 // (signal, context, data type) separates them into distinct logical fields.
 func TestMatchingLogicalFieldsNeverMergesAcrossDataTypes(t *testing.T) {

pkg/signoz/module.go

@@ -161,7 +161,7 @@ func NewModules(
 		LogsPipeline:         impllogspipeline.NewModule(sqlstore),
 		RuleStateHistory:     implrulestatehistory.NewModule(implrulestatehistory.NewStore(telemetryStore, telemetryMetadataStore, providerSettings.Logger), ruleStore),
 		CloudIntegration:     cloudIntegrationModule,
-		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore, telemetryMetadataStore, fl), providerSettings, config.TraceDetail),
+		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore), providerSettings, config.TraceDetail),
 		SpanMapper:           implspanmapper.NewModule(implspanmapper.NewStore(sqlstore), fl),
 		LLMPricingRule:       impllmpricingrule.NewModule(impllmpricingrule.NewStore(sqlstore), fl, querier),
 		Tag:                  tagModule,

pkg/signoz/provider.go

@@ -254,6 +254,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddIngestionTuplesFactory(sqlstore),
 		sqlmigration.NewAddSubscriptionTuplesFactory(sqlstore),
 		sqlmigration.NewNormalizeQuickFilterFieldsFactory(sqlstore),
+		sqlmigration.NewAddCloudIntegrationTuplesFactory(sqlstore),
 	)
 }
 

pkg/sqlmigration/127_add_cloud_integration_tuples.go

@@ -0,0 +1,166 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addCloudIntegrationTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddCloudIntegrationTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_cloud_integration_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addCloudIntegrationTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addCloudIntegrationTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addCloudIntegrationTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	// cloud-integration moved from legacy role gates to CheckResources. Existing
+	// organizations need the same tuples that new organizations receive from the
+	// managed-role registry at bootstrap.
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "metaresource", "cloud-integration", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "cloud-integration", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "cloud-integration", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "cloud-integration", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "cloud-integration", "list"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "cloud-integration", "read"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "cloud-integration", "list"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "cloud-integration", "read"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "cloud-integration", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
+	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
+		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
+		if err != nil {
+			return err
+		}
+		managedRoleGroups[roleName] = string(data)
+	}
+
+	for _, orgID := range orgIDs {
+		for roleName, data := range managedRoleGroups {
+			if _, err := tx.NewUpdate().
+				Model(new(roles)).
+				Set("transaction_groups = ?", data).
+				Where("org_id = ?", orgID).
+				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
+				Where("name = ?", roleName).
+				Exec(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addCloudIntegrationTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/statementbuilder/logsstatementbuilder/resource_conflict_test.go

@@ -0,0 +1,90 @@
+package logsstatementbuilder
+
+import (
+	"context"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/flagger/flaggertest"
+	"github.com/SigNoz/signoz/pkg/instrumentation/instrumentationtest"
+	"github.com/SigNoz/signoz/pkg/querybuilder"
+	"github.com/SigNoz/signoz/pkg/statementbuilder"
+	"github.com/SigNoz/signoz/pkg/telemetryschema/logstelemetryschema"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes/telemetrytypestest"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/require"
+)
+
+// A key present in both resource and body contexts must filter on resource only.
+// The resource condition builds the fingerprint CTE, so a surviving body condition
+// would AND against it and match almost nothing (engineering-pod#6086).
+func TestStatementBuilderResourceBodyConflict(t *testing.T) {
+	store := telemetrytypestest.NewMockMetadataStore()
+	store.SetStaticFields(logstelemetryschema.IntrinsicFields)
+	store.SetKey(&telemetrytypes.TelemetryFieldKey{
+		Name:          "service.name",
+		Signal:        telemetrytypes.SignalLogs,
+		FieldContext:  telemetrytypes.FieldContextResource,
+		FieldDataType: telemetrytypes.FieldDataTypeString,
+	})
+	bodyKey := &telemetrytypes.TelemetryFieldKey{
+		Name:          "service.name",
+		Signal:        telemetrytypes.SignalLogs,
+		FieldContext:  telemetrytypes.FieldContextBody,
+		FieldDataType: telemetrytypes.FieldDataTypeString,
+	}
+	require.NoError(t, bodyKey.SetJSONAccessPlan(telemetrytypes.JSONColumnMetadata{
+		BaseColumn:     logstelemetryschema.LogsV2BodyV2Column,
+		PromotedColumn: logstelemetryschema.LogsV2BodyPromotedColumn,
+	}, map[string][]telemetrytypes.FieldDataType{"service.name": {telemetrytypes.FieldDataTypeString}}))
+	store.SetKey(bodyKey)
+
+	fl := flaggertest.WithUseJSONBody(t, true)
+	storage := logstelemetryschema.NewStorage()
+	aggExprRewriter := querybuilder.NewAggExprRewriter(instrumentationtest.New().ToProviderSettings(), nil, storage, fl, telemetrytypes.SignalLogs)
+	statementBuilder := NewLogQueryStatementBuilder(
+		instrumentationtest.New().ToProviderSettings(),
+		store,
+		storage,
+		aggExprRewriter,
+		logstelemetryschema.DefaultFullTextColumn,
+		fl,
+		nil,
+		statementbuilder.Config{SkipResourceFingerprint: statementbuilder.SkipResourceFingerprint{Enabled: false, Threshold: 100000}},
+	)
+
+	testCases := []struct {
+		name        string
+		requestType qbtypes.RequestType
+		query       qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]
+		expected    qbtypes.Statement
+	}{
+		{
+			name:        "AmbiguousKeyFiltersResourceOnly",
+			requestType: qbtypes.RequestTypeRaw,
+			query: qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]{
+				Signal: telemetrytypes.SignalLogs,
+				Filter: &qbtypes.Filter{Expression: "service.name = 'webapp'"},
+				Limit:  10,
+			},
+			expected: qbtypes.Statement{
+				Query: "WITH __resource_filter AS (SELECT fingerprint FROM signoz_logs.distributed_logs_v2_resource WHERE (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint) SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body_v2 as body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE resource_fingerprint GLOBAL IN (SELECT fingerprint FROM __resource_filter) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"webapp", "%service.name%", "%service.name\":\"webapp%", uint64(1747945619), uint64(1747983448), "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				Warnings: []string{
+					"Key `service.name` is ambiguous, found 2 different combinations of field context / data type: [name=service.name,context=resource,datatype=string name=service.name,context=body,datatype=string]. Using `resource` context by default. To query another context explicitly, use the fully qualified name (e.g., 'attribute.service.name' or 'body.service.name')",
+				},
+			},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			q, err := statementBuilder.Build(context.Background(), valuer.UUID{}, 1747947419000, 1747983448000, testCase.requestType, testCase.query, nil)
+			require.NoError(t, err)
+			require.Equal(t, testCase.expected.Query, q.Query)
+			require.Equal(t, testCase.expected.Args, q.Args)
+			require.Equal(t, testCase.expected.Warnings, q.Warnings)
+		})
+	}
+}

pkg/telemetryschema/aitelemetryschema/const.go

@@ -19,7 +19,6 @@ var (
 		aiobservabilitytypes.GenAIUsageOutputTokens:             genAIAttribute(aiobservabilitytypes.GenAIUsageOutputTokens, telemetrytypes.FieldDataTypeFloat64),
 		aiobservabilitytypes.GenAIUsageCacheReadInputTokens:     genAIAttribute(aiobservabilitytypes.GenAIUsageCacheReadInputTokens, telemetrytypes.FieldDataTypeFloat64),
 		aiobservabilitytypes.GenAIUsageCacheCreationInputTokens: genAIAttribute(aiobservabilitytypes.GenAIUsageCacheCreationInputTokens, telemetrytypes.FieldDataTypeFloat64),
-		aiobservabilitytypes.GenAIUsageReasoningOutputTokens:    genAIAttribute(aiobservabilitytypes.GenAIUsageReasoningOutputTokens, telemetrytypes.FieldDataTypeFloat64),
 		aiobservabilitytypes.SignozGenAITotalCost:               genAIAttribute(aiobservabilitytypes.SignozGenAITotalCost, telemetrytypes.FieldDataTypeFloat64),
 
 		aiobservabilitytypes.GenAIInputMessages:  genAIAttribute(aiobservabilitytypes.GenAIInputMessages, telemetrytypes.FieldDataTypeString),

pkg/types/aiobservabilitytypes/keys.go

@@ -15,7 +15,6 @@ const (
 	GenAIUsageOutputTokens             = "gen_ai.usage.output_tokens"
 	GenAIUsageCacheReadInputTokens     = "gen_ai.usage.cache_read.input_tokens"
 	GenAIUsageCacheCreationInputTokens = "gen_ai.usage.cache_creation.input_tokens"
-	GenAIUsageReasoningOutputTokens    = "gen_ai.usage.reasoning.output_tokens"
 
 	GenAIInputMessages  = "gen_ai.input.messages"
 	GenAIOutputMessages = "gen_ai.output.messages"

pkg/types/coretypes/extractor.go

@@ -46,6 +46,10 @@ func (extractor ResourceIDsExtractor) IsPhase(phase ExtractPhase) bool {
 
 // OneID lifts a single-id extractor into a one-element ids extractor.
 func OneID(extractor ResourceIDExtractor) ResourceIDsExtractor {
+	if extractor.Fn == nil {
+		return ResourceIDsExtractor{}
+	}
+
 	return ResourceIDsExtractor{Phase: extractor.Phase, Fn: func(ec ExtractorContext) ([]string, error) {
 		id, err := extractor.Fn(ec)
 		if err != nil || id == "" {

pkg/types/coretypes/registry_managed_role.go

@@ -35,7 +35,7 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindAuthDomain}, WildCardSelectorString)},
 		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindAuthDomain}, WildCardSelectorString)},
 		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindAuthDomain}, WildCardSelectorString)},
-		// cloud-integration — admin only
+		// cloud-integration — admin can fully manage accounts
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindCloudIntegration}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindCloudIntegration}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindCloudIntegration}, WildCardSelectorString)},
@@ -216,6 +216,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTracesField}, WildCardSelectorString)},
 	},
 	SigNozEditorRoleName: {
+		// cloud-integration — editor can read accounts
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindCloudIntegration}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindCloudIntegration}, WildCardSelectorString)},
 		// dashboard — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDashboard}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDashboard}, WildCardSelectorString)},
@@ -308,6 +311,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindTracesField}, WildCardSelectorString)},
 	},
 	SigNozViewerRoleName: {
+		// cloud-integration — viewer can read accounts
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindCloudIntegration}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindCloudIntegration}, WildCardSelectorString)},
 		// dashboard — read only
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDashboard}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindDashboard}, WildCardSelectorString)},

pkg/types/coretypes/registry_resource.go

@@ -52,7 +52,7 @@ var (
 	ResourceMetaResourceApdexSetting                     = NewResourceMetaResource(KindApdexSetting)
 	ResourceMetaResourceAuthDomain                       = NewResourceMetaResource(KindAuthDomain)
 	ResourceMetaResourceSession                          = NewResourceMetaResource(KindSession)
-	ResourceMetaResourceCloudIntegration                 = NewResourceMetaResource(KindCloudIntegration)
+	ResourceMetaResourceCloudIntegration                 = NewResourceMetaResource(KindCloudIntegration, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourceCloudIntegrationService          = NewResourceMetaResource(KindCloudIntegrationService)
 	ResourceMetaResourceIntegration                      = NewResourceMetaResource(KindIntegration)
 	ResourceMetaResourceDashboard                        = NewResourceMetaResource(KindDashboard, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)

pkg/types/spantypes/store.go

@@ -27,7 +27,6 @@ type SpanMapperStore interface {
 // TraceStore defines the data access interface for trace detail queries.
 type TraceStore interface {
 	GetTraceSummary(ctx context.Context, traceID string) (*TraceSummary, error)
-	GetTraceStats(ctx context.Context, orgID valuer.UUID, traceID string, summary *TraceSummary) (*TraceStats, error)
 	GetTraceSpans(ctx context.Context, traceID string, summary *TraceSummary) ([]StorableSpan, error)
 	GetMinimalSpans(ctx context.Context, traceID string, start, end time.Time) ([]MinimalSpan, error)
 	GetTraceSpansByIDs(ctx context.Context, traceID string, start, end time.Time, spanIDs []string) ([]StorableSpan, error)

pkg/types/spantypes/trace_summary.go

@@ -1,76 +0,0 @@
-package spantypes
-
-import "github.com/SigNoz/signoz/pkg/types/aiobservabilitytypes"
-
-// TraceStatsGenAIColumns pairs each summed TraceStats column with the gen_ai attribute it sums.
-var TraceStatsGenAIColumns = []TraceStatsGenAIColumn{
-	{Column: "input_tokens", Key: aiobservabilitytypes.GenAIUsageInputTokens},
-	{Column: "output_tokens", Key: aiobservabilitytypes.GenAIUsageOutputTokens},
-	{Column: "cache_read_tokens", Key: aiobservabilitytypes.GenAIUsageCacheReadInputTokens},
-	{Column: "cache_write_tokens", Key: aiobservabilitytypes.GenAIUsageCacheCreationInputTokens},
-	{Column: "reasoning_tokens", Key: aiobservabilitytypes.GenAIUsageReasoningOutputTokens},
-	{Column: "total_cost", Key: aiobservabilitytypes.SignozGenAITotalCost},
-}
-
-type TraceStatsGenAIColumn struct {
-	Column string
-	Key    string
-}
-
-// TraceStats is the single-row result of the trace summary aggregate query.
-type TraceStats struct {
-	StartNs         uint64
-	EndNs           uint64
-	RootServiceName string
-	RootEntryPoint  string
-	TotalSpans      uint64
-	TotalErrorSpans uint64
-	HasMissingSpans bool
-	GenAISpanCount  uint64
-	Tokens          TraceAITokens
-	TotalCost       *float64
-}
-
-// GettableTraceSummary is the response for the trace summary API; the trace-level
-// fields match the waterfall response.
-type GettableTraceSummary struct {
-	StartTimestampMillis  uint64          `json:"startTimestampMillis"`
-	EndTimestampMillis    uint64          `json:"endTimestampMillis"`
-	RootServiceName       string          `json:"rootServiceName"`
-	RootServiceEntryPoint string          `json:"rootServiceEntryPoint"`
-	TotalSpansCount       uint64          `json:"totalSpansCount"`
-	TotalErrorSpansCount  uint64          `json:"totalErrorSpansCount"`
-	HasMissingSpans       bool            `json:"hasMissingSpans"`
-	AI                    *TraceAISummary `json:"ai,omitempty"`
-}
-
-// TraceAISummary is present when any span carries a gen_ai gate key.
-type TraceAISummary struct {
-	Tokens TraceAITokens `json:"tokens"`
-	// TotalCost is null when no span carries a cost attribute.
-	TotalCost *float64 `json:"totalCost" nullable:"true"`
-}
-
-type TraceAITokens struct {
-	Input      uint64 `json:"input"`
-	Output     uint64 `json:"output"`
-	CacheRead  uint64 `json:"cacheRead"`
-	CacheWrite uint64 `json:"cacheWrite"`
-	Reasoning  uint64 `json:"reasoning"`
-}
-
-func NewGettableTraceSummary(stats *TraceStats) *GettableTraceSummary {
-	summary := &GettableTraceSummary{
-		StartTimestampMillis:  stats.StartNs / 1_000_000,
-		EndTimestampMillis:    stats.EndNs / 1_000_000,
-		RootServiceName:       stats.RootServiceName,
-		RootServiceEntryPoint: stats.RootEntryPoint,
-		TotalSpansCount:       stats.TotalSpans,
-		TotalErrorSpansCount:  stats.TotalErrorSpans,
-		HasMissingSpans:       stats.HasMissingSpans,
-	}
-	if stats.GenAISpanCount > 0 {
-		summary.AI = &TraceAISummary{Tokens: stats.Tokens, TotalCost: stats.TotalCost}
-	}
-	return summary
-}

tests/fixtures/traces.py

@@ -895,7 +895,6 @@ _TRACES_TABLES_TO_TRUNCATE = [
     "span_attributes_keys",
     "signoz_error_index_v2",
     "top_level_operations",
-    "trace_summary",
 ]
 
 

tests/integration/tests/querier_json_body/08_resource_body_conflict.py

@@ -0,0 +1,88 @@
+import json
+from collections.abc import Callable
+from datetime import UTC, datetime, timedelta
+from http import HTTPStatus
+
+from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
+from fixtures.logs import Logs
+from fixtures.querier import (
+    build_raw_query,
+    get_rows,
+    make_query_request,
+)
+
+
+def test_resource_body_conflict(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    export_json_types: Callable[[list[Logs]], None],
+) -> None:
+    now = datetime.now(tz=UTC)
+    start_ms = int((now - timedelta(seconds=10)).timestamp() * 1000)
+    end_ms = int(now.timestamp() * 1000)
+
+    # python's body carries service.name, making the bare key ambiguous across
+    # resource and body; java's body omits it, so ANDing body in would drop it.
+    logs_list = [
+        Logs(
+            timestamp=now - timedelta(seconds=2),
+            resources={"service.name": "java"},
+            body_v2=json.dumps({"msg": "hello"}),
+            body_promoted="",
+        ),
+        Logs(
+            timestamp=now - timedelta(seconds=1),
+            resources={"service.name": "python"},
+            body_v2=json.dumps({"service.name": "python"}),
+            body_promoted="",
+        ),
+    ]
+    export_json_types(logs_list)
+    insert_logs(logs_list)
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    cases = [
+        {
+            "name": "bare_key_resolves_to_resource",
+            "filter": "service.name = 'java'",
+            "expected_service_names": ["java"],
+            "expect_resource_warning": True,
+        },
+        {
+            "name": "qualified_body_key_targets_body",
+            "filter": "body.service.name = 'python'",
+            "expected_service_names": ["python"],
+            "expect_resource_warning": False,
+        },
+    ]
+
+    for case in cases:
+        response = make_query_request(
+            signoz,
+            token,
+            start_ms,
+            end_ms,
+            request_type="raw",
+            queries=[
+                build_raw_query(
+                    name="A",
+                    signal="logs",
+                    filter_expression=case["filter"],
+                    limit=100,
+                    step_interval=60,
+                )
+            ],
+        )
+
+        assert response.status_code == HTTPStatus.OK, f"{case['name']}: {response.text}"
+        rows = get_rows(response)
+        assert [row["data"]["resources_string"].get("service.name") for row in rows] == case["expected_service_names"], f"{case['name']}: {response.json()}"
+
+        warning = response.json()["data"].get("warning")
+        if case["expect_resource_warning"]:
+            assert warning is not None and "Using `resource` context by default" in warning["warnings"][0]["message"], f"{case['name']}: {warning}"
+        else:
+            assert warning is None, f"{case['name']}: {warning}"

tests/integration/tests/queriercommon/02_qb_warnings.py

@@ -64,8 +64,8 @@ def test_resource_default_warning(
         "Key `service.name` is ambiguous, found 2 different combinations of "
         "field context / data type: [name=service.name,context=resource,datatype=string "
         "name=service.name,context=attribute,datatype=string]. Using `resource` context "
-        "by default. To query attributes explicitly, use the fully qualified name "
-        "(e.g., 'attribute.service.name')"
+        "by default. To query another context explicitly, use the fully qualified name "
+        "(e.g., 'attribute.service.name' or 'body.service.name')"
     )
     assert warning["warnings"] == [
         {"message": expected_service_name_warning},
@@ -237,8 +237,8 @@ def test_deduped_warnings_for_single_query(
         "Key `service.name` is ambiguous, found 2 different combinations of "
         "field context / data type: [name=service.name,context=resource,datatype=string "
         "name=service.name,context=attribute,datatype=string]. Using `resource` context "
-        "by default. To query attributes explicitly, use the fully qualified name "
-        "(e.g., 'attribute.service.name')"
+        "by default. To query another context explicitly, use the fully qualified name "
+        "(e.g., 'attribute.service.name' or 'body.service.name')"
     )
     expected_status_code_warning = "Key `http.status_code` is ambiguous, found 2 different combinations of field context / data type: [name=http.status_code,context=attribute,datatype=number name=http.status_code,context=attribute,datatype=string]."
     assert warning["warnings"] == [
@@ -328,8 +328,8 @@ def test_deduped_warnings_for_multiple_queries(
         "Key `service.name` is ambiguous, found 2 different combinations of "
         "field context / data type: [name=service.name,context=resource,datatype=string "
         "name=service.name,context=attribute,datatype=string]. Using `resource` context "
-        "by default. To query attributes explicitly, use the fully qualified name "
-        "(e.g., 'attribute.service.name')"
+        "by default. To query another context explicitly, use the fully qualified name "
+        "(e.g., 'attribute.service.name' or 'body.service.name')"
     )
     expected_status_code_warning = "Key `http.status_code` is ambiguous, found 2 different combinations of field context / data type: [name=http.status_code,context=attribute,datatype=number name=http.status_code,context=attribute,datatype=string]."
     assert warning["warnings"] == [

tests/integration/tests/tracedetail/01_summary.py

@@ -1,280 +0,0 @@
-from collections.abc import Callable
-from datetime import UTC, datetime, timedelta
-from http import HTTPStatus
-
-import pytest
-import requests
-
-from fixtures import types
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.querierai import root_span
-from fixtures.traces import TraceIdGenerator, Traces, TracesKind, TracesStatusCode
-
-WATERFALL_FIELDS = (
-    "startTimestampMillis",
-    "endTimestampMillis",
-    "rootServiceName",
-    "rootServiceEntryPoint",
-    "totalSpansCount",
-    "totalErrorSpansCount",
-    "hasMissingSpans",
-)
-
-
-@pytest.mark.parametrize("attribute_backend", ["map", "json"])
-def test_summary_ai_trace(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-    use_attribute_backend: Callable[[str], None],
-    attribute_backend: str,
-) -> None:
-    """The summary carries the waterfall's trace-level fields and, for a trace with gen_ai
-    spans, token totals over every LLM span and the cost summed over the spans that carry it.
-    Spans are written to one layout only, so a read from the wrong column sums to zero."""
-    use_attribute_backend(attribute_backend)
-    write_mode = "json_only" if attribute_backend == "json" else "legacy_only"
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    service = f"td-summary-{attribute_backend}"
-    resources = {"service.name": service}
-    trace_id = TraceIdGenerator.trace_id()
-    root_id = TraceIdGenerator.span_id()
-
-    insert_traces(
-        [
-            root_span(now=now, trace_id=trace_id, span_id=root_id, resources=resources, duration_s=4),
-            Traces(
-                timestamp=now - timedelta(seconds=4),
-                duration=timedelta(seconds=1),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="chat gpt-4o-mini",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attributes={
-                    "gen_ai.request.model": "gpt-4o-mini",
-                    "gen_ai.usage.input_tokens": 100,
-                    "gen_ai.usage.output_tokens": 20,
-                    "gen_ai.usage.cache_read.input_tokens": 7,
-                    "_signoz.gen_ai.total_cost": 0.01,
-                },
-                attribute_write_mode=write_mode,
-            ),
-            # a failed LLM call: counted in tokens and errors, but priced by nobody
-            Traces(
-                timestamp=now - timedelta(seconds=3),
-                duration=timedelta(seconds=0.5),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="chat gpt-4o-mini",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_ERROR,
-                resources=resources,
-                attributes={
-                    "gen_ai.request.model": "gpt-4o-mini",
-                    "gen_ai.usage.input_tokens": 50,
-                    "gen_ai.usage.output_tokens": 5,
-                },
-                attribute_write_mode=write_mode,
-            ),
-            Traces(
-                timestamp=now - timedelta(seconds=2),
-                duration=timedelta(seconds=0.5),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="execute_tool",
-                kind=TracesKind.SPAN_KIND_INTERNAL,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attributes={"gen_ai.tool.name": "get_weather"},
-                attribute_write_mode=write_mode,
-            ),
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    headers = {"authorization": f"Bearer {token}", "content-type": "application/json"}
-
-    summary = requests.get(signoz.self.host_configs["8080"].get(f"/api/v1/traces/{trace_id}/summary"), timeout=10, headers=headers)
-    assert summary.status_code == HTTPStatus.OK, summary.text
-    summary = summary.json()["data"]
-
-    waterfall = requests.post(
-        signoz.self.host_configs["8080"].get(f"/api/v4/traces/{trace_id}/waterfall"),
-        timeout=10,
-        headers=headers,
-        json={"selectedSpanId": "", "uncollapsedSpans": []},
-    )
-    assert waterfall.status_code == HTTPStatus.OK, waterfall.text
-    waterfall = waterfall.json()["data"]
-
-    assert {k: summary[k] for k in WATERFALL_FIELDS} == {k: waterfall[k] for k in WATERFALL_FIELDS}
-    assert summary["rootServiceName"] == service
-    assert summary["rootServiceEntryPoint"] == "POST /api/chat"
-    assert summary["totalSpansCount"] == 4
-    assert summary["totalErrorSpansCount"] == 1
-    assert summary["hasMissingSpans"] is False
-
-    assert summary["ai"]["tokens"] == {"input": 150, "output": 25, "cacheRead": 7, "cacheWrite": 0, "reasoning": 0}
-    assert summary["ai"]["totalCost"] == pytest.approx(0.01)
-
-
-def test_summary_ai_trace_across_json_rollout(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-    seed_attribute_evolution: Callable[[str, datetime], None],
-) -> None:
-    """A trace that straddles the attribute JSON rollout has LLM spans written only to the legacy
-    maps before it and to the JSON column after it. The summary window covers both, so the gen_ai
-    reads must fall back across columns and sum every span."""
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    rollout = now - timedelta(minutes=30)
-    seed_attribute_evolution("traces", rollout)
-
-    service = "td-summary-rollout"
-    resources = {"service.name": service}
-    trace_id = TraceIdGenerator.trace_id()
-    root_id = TraceIdGenerator.span_id()
-
-    insert_traces(
-        [
-            Traces(
-                timestamp=rollout - timedelta(minutes=10),
-                duration=timedelta(minutes=15),
-                trace_id=trace_id,
-                span_id=root_id,
-                parent_span_id="",
-                name="long agent run",
-                kind=TracesKind.SPAN_KIND_SERVER,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attribute_write_mode="legacy_only",
-            ),
-            Traces(
-                timestamp=rollout - timedelta(minutes=5),
-                duration=timedelta(seconds=1),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="chat gpt-4o-mini",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attributes={"gen_ai.request.model": "gpt-4o-mini", "gen_ai.usage.input_tokens": 100, "gen_ai.usage.output_tokens": 20, "_signoz.gen_ai.total_cost": 0.01},
-                attribute_write_mode="legacy_only",
-            ),
-            Traces(
-                timestamp=rollout + timedelta(minutes=4),
-                duration=timedelta(seconds=1),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="chat gpt-4o-mini",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attributes={"gen_ai.request.model": "gpt-4o-mini", "gen_ai.usage.input_tokens": 50, "gen_ai.usage.output_tokens": 5, "_signoz.gen_ai.total_cost": 0.02},
-                attribute_write_mode="json_only",
-            ),
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    summary = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/traces/{trace_id}/summary"),
-        timeout=10,
-        headers={"authorization": f"Bearer {token}"},
-    )
-    assert summary.status_code == HTTPStatus.OK, summary.text
-    summary = summary.json()["data"]
-
-    assert summary["totalSpansCount"] == 3
-    assert summary["rootServiceEntryPoint"] == "long agent run"
-    assert summary["ai"]["tokens"] == {"input": 150, "output": 25, "cacheRead": 0, "cacheWrite": 0, "reasoning": 0}
-    assert summary["ai"]["totalCost"] == pytest.approx(0.03)
-
-
-def test_summary_non_ai_trace_with_missing_root(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    """A trace whose recorded spans all hang off an unrecorded parent reports the synthetic
-    "Missing Span" root exactly as the waterfall does, and a trace without gen_ai spans has
-    no `ai` block."""
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    resources = {"service.name": "td-summary-orphan"}
-    trace_id = TraceIdGenerator.trace_id()
-    missing_parent_id = TraceIdGenerator.span_id()
-
-    insert_traces(
-        [
-            Traces(
-                timestamp=now - timedelta(seconds=5),
-                duration=timedelta(seconds=2),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=missing_parent_id,
-                name="SELECT users",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-            ),
-            Traces(
-                timestamp=now - timedelta(seconds=4),
-                duration=timedelta(seconds=1),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=missing_parent_id,
-                name="publish event",
-                kind=TracesKind.SPAN_KIND_PRODUCER,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-            ),
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    headers = {"authorization": f"Bearer {token}", "content-type": "application/json"}
-
-    summary = requests.get(signoz.self.host_configs["8080"].get(f"/api/v1/traces/{trace_id}/summary"), timeout=10, headers=headers)
-    assert summary.status_code == HTTPStatus.OK, summary.text
-    summary = summary.json()["data"]
-
-    waterfall = requests.post(
-        signoz.self.host_configs["8080"].get(f"/api/v4/traces/{trace_id}/waterfall"),
-        timeout=10,
-        headers=headers,
-        json={"selectedSpanId": "", "uncollapsedSpans": []},
-    )
-    assert waterfall.status_code == HTTPStatus.OK, waterfall.text
-    waterfall = waterfall.json()["data"]
-
-    assert {k: summary[k] for k in WATERFALL_FIELDS} == {k: waterfall[k] for k in WATERFALL_FIELDS}
-    assert summary["hasMissingSpans"] is True
-    assert summary["rootServiceName"] == ""
-    assert summary["rootServiceEntryPoint"] == "Missing Span"
-    assert summary["totalSpansCount"] == 2
-    assert "ai" not in summary
-
-
-def test_summary_unknown_trace(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-) -> None:
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/traces/{TraceIdGenerator.trace_id()}/summary"),
-        timeout=10,
-        headers={"authorization": f"Bearer {token}"},
-    )
-    assert response.status_code == HTTPStatus.NOT_FOUND, response.text