test(passwordauthn): restructure the suite by concern

# Conflicts:
#	pkg/http/handler/resourcedef.go

.github/workflows/integrationci.yaml

@@ -68,7 +68,6 @@ jobs:
           - semconvfamilies
           - serviceaccount
           - spanmapper
-          - tracedetail
           - querier_json_body
           - querier_skip_resource_fingerprint
           - ttl

docs/api/openapi.yml

@@ -9693,29 +9693,6 @@ components:
       required:
       - aggregations
       type: object
-    SpantypesGettableTraceSummary:
-      properties:
-        ai:
-          $ref: '#/components/schemas/SpantypesTraceAISummary'
-        endTimestampMillis:
-          minimum: 0
-          type: integer
-        hasMissingSpans:
-          type: boolean
-        rootServiceEntryPoint:
-          type: string
-        rootServiceName:
-          type: string
-        startTimestampMillis:
-          minimum: 0
-          type: integer
-        totalErrorSpansCount:
-          minimum: 0
-          type: integer
-        totalSpansCount:
-          minimum: 0
-          type: integer
-      type: object
     SpantypesGettableWaterfallTrace:
       properties:
         endTimestampMillis:
@@ -10030,32 +10007,6 @@ components:
           nullable: true
           type: object
       type: object
-    SpantypesTraceAISummary:
-      properties:
-        tokens:
-          $ref: '#/components/schemas/SpantypesTraceAITokens'
-        totalCost:
-          nullable: true
-          type: number
-      type: object
-    SpantypesTraceAITokens:
-      properties:
-        cacheRead:
-          minimum: 0
-          type: integer
-        cacheWrite:
-          minimum: 0
-          type: integer
-        input:
-          minimum: 0
-          type: integer
-        output:
-          minimum: 0
-          type: integer
-        reasoning:
-          minimum: 0
-          type: integer
-      type: object
     SpantypesUpdatableSpanMapper:
       properties:
         config:
@@ -15780,67 +15731,6 @@ paths:
       tags:
       - tracedetail
       x-signoz-stability: alpha
-  /api/v1/traces/{traceID}/summary:
-    get:
-      deprecated: false
-      description: Returns the trace-level fields of the waterfall (time range, root,
-        span counts, missing spans) and, when the trace has gen_ai spans, its token
-        and cost totals. Computed in one aggregate query.
-      operationId: GetTraceSummary
-      parameters:
-      - in: path
-        name: traceID
-        required: true
-        schema:
-          type: string
-      responses:
-        "200":
-          content:
-            application/json:
-              schema:
-                properties:
-                  data:
-                    $ref: '#/components/schemas/SpantypesGettableTraceSummary'
-                  status:
-                    type: string
-                required:
-                - status
-                - data
-                type: object
-          description: OK
-        "401":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Unauthorized
-        "403":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Forbidden
-        "404":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Not Found
-        "500":
-          content:
-            application/json:
-              schema:
-                $ref: '#/components/schemas/RenderErrorResponse'
-          description: Internal Server Error
-      security:
-      - api_key:
-        - VIEWER
-      - tokenizer:
-        - VIEWER
-      summary: Get summary for a trace
-      tags:
-      - tracedetail
-      x-signoz-stability: alpha
   /api/v1/user/me:
     get:
       deprecated: true
@@ -21296,9 +21186,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - role:read
       - tokenizer:
-        - ADMIN
+        - role:read
       summary: Get users by role id
       tags:
       - users
@@ -25884,9 +25774,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:attach
+        - role:attach
       - tokenizer:
-        - ADMIN
+        - user:attach
+        - role:attach
       summary: Create user role
       tags:
       - users
@@ -25937,9 +25829,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:detach
+        - role:detach
       - tokenizer:
-        - ADMIN
+        - user:detach
+        - role:detach
       summary: Delete user role
       tags:
       - users
@@ -26001,9 +25895,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user role
       tags:
       - users
@@ -26050,9 +25944,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:list
       - tokenizer:
-        - ADMIN
+        - user:list
       summary: List users v2
       tags:
       - users
@@ -26113,9 +26007,13 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:create
+        - user:attach
+        - role:attach
       - tokenizer:
-        - ADMIN
+        - user:create
+        - user:attach
+        - role:attach
       summary: Create user
       tags:
       - users
@@ -26160,9 +26058,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:delete
       - tokenizer:
-        - ADMIN
+        - user:delete
       summary: Delete user
       tags:
       - users
@@ -26218,9 +26116,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user by user id
       tags:
       - users
@@ -26275,9 +26173,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:update
       - tokenizer:
-        - ADMIN
+        - user:update
       summary: Update user v2
       tags:
       - users
@@ -26334,9 +26232,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - factor-password:list
       - tokenizer:
-        - ADMIN
+        - factor-password:list
       summary: Get reset password token for a user
       tags:
       - users
@@ -26400,9 +26298,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - factor-password:create
+        - user:attach
       - tokenizer:
-        - ADMIN
+        - factor-password:create
+        - user:attach
       summary: Create or regenerate reset password token for a user
       tags:
       - users
@@ -26461,9 +26361,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user roles
       tags:
       - users
@@ -26777,10 +26677,7 @@ paths:
                 $ref: '#/components/schemas/RenderErrorResponse'
           description: Internal Server Error
       security:
-      - api_key:
-        - ADMIN
-      - tokenizer:
-        - ADMIN
+      - tokenizer: []
       summary: Updates my password
       tags:
       - users

docs/contributing/go/authz.md

@@ -121,7 +121,7 @@ The pieces:
 - **`ResourceDef`** — declares the resource, verb, audit category, how to extract the instance ID, and how to turn that ID into selectors. ID extractors live in [pkg/types/coretypes/extractor.go](/pkg/types/coretypes/extractor.go): `PathParam("id")`, `BodyJSONPath("data.id")`, `BodyJSONArray("ids")`, and `ResponseJSONPath("data.id")` for IDs only known after the handler runs (e.g. `create`).
 - **`SecuritySchemes`** — advertises the required scope (`resource.Scope(verb)`, e.g. `serviceaccount:create`) in the OpenAPI spec.
 
-For routes that link two resources, use `AttachDetachSiblingResourceDef` (both sides are authz-checked, e.g. attaching a role to a service account requires `attach` on **both** the service account and the role). For parent-child routes (e.g. creating an API key under a service account), both sides are checked too, but with different verbs: declare a `BasicResourceDef` checking the child with `create`/`delete`, alongside an `AttachDetachParentChildResourceDef` checking the parent with `attach`/`detach` (within that def the child is only recorded for audit) — see the `/api/v1/service_accounts/{id}/keys` route in [pkg/apiserver/signozapiserver/serviceaccount.go](/pkg/apiserver/signozapiserver/serviceaccount.go).
+For routes that link two resources, use `AttachDetachSiblingResourceDef` (both sides are authz-checked, e.g. attaching a role to a service account requires `attach` on **both** the service account and the role). When a side's ids come from a list extractor (`BodyJSONArray` or a custom `ResourceIDsExtractor`) and that list resolves to nothing at request time, there is nothing to link: the def resolves to no resources, so no check runs and no audit event is emitted (e.g. inviting a user with an empty `userRoles`). A single-id side (`OneID`) always resolves to exactly one id and fails closed when it is empty. For parent-child routes (e.g. creating an API key under a service account), both sides are checked too, but with different verbs: declare a `BasicResourceDef` checking the child with `create`/`delete`, alongside an `AttachDetachParentChildResourceDef` checking the parent with `attach`/`detach` (within that def the child is only recorded for audit) — see the `/api/v1/service_accounts/{id}/keys` route in [pkg/apiserver/signozapiserver/serviceaccount.go](/pkg/apiserver/signozapiserver/serviceaccount.go).
 
 Prefer `CheckResources` with a `ResourceDef` for anything resource-shaped. The older coarse gates `ViewAccess`/`EditAccess`/`AdminAccess` only check "does the caller hold one of these roles" and give up per-resource granularity; `OpenAccess` performs no authorization (authentication still applies); `CheckWithoutClaims` serves anonymous routes such as public dashboards.
 

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -11194,78 +11194,6 @@ export interface SpantypesGettableTraceAggregationsDTO {
 	aggregations: SpantypesSpanAggregationResultDTO[];
 }
 
-export interface SpantypesTraceAITokensDTO {
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	cacheRead?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	cacheWrite?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	input?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	output?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	reasoning?: number;
-}
-
-export interface SpantypesTraceAISummaryDTO {
-	tokens?: SpantypesTraceAITokensDTO;
-	/**
-	 * @type number,null
-	 */
-	totalCost?: number | null;
-}
-
-export interface SpantypesGettableTraceSummaryDTO {
-	ai?: SpantypesTraceAISummaryDTO;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	endTimestampMillis?: number;
-	/**
-	 * @type boolean
-	 */
-	hasMissingSpans?: boolean;
-	/**
-	 * @type string
-	 */
-	rootServiceEntryPoint?: string;
-	/**
-	 * @type string
-	 */
-	rootServiceName?: string;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	startTimestampMillis?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	totalErrorSpansCount?: number;
-	/**
-	 * @type integer
-	 * @minimum 0
-	 */
-	totalSpansCount?: number;
-}
-
 export interface SpantypesOtelSpanRefDTO {
 	/**
 	 * @type string
@@ -12954,17 +12882,6 @@ export type GetTraceAggregations200 = {
 	status: string;
 };
 
-export type GetTraceSummaryPathParameters = {
-	traceID: string;
-};
-export type GetTraceSummary200 = {
-	data: SpantypesGettableTraceSummaryDTO;
-	/**
-	 * @type string
-	 */
-	status: string;
-};
-
 export type ListUserPreferences200 = {
 	/**
 	 * @type array

frontend/src/api/generated/services/tracedetail/index.ts

@@ -4,17 +4,11 @@
  * * regenerate with 'pnpm generate:api'
  * SigNoz
  */
-import { useMutation, useQuery } from 'react-query';
+import { useMutation } from 'react-query';
 import type {
-	InvalidateOptions,
 	MutationFunction,
-	QueryClient,
-	QueryFunction,
-	QueryKey,
 	UseMutationOptions,
 	UseMutationResult,
-	UseQueryOptions,
-	UseQueryResult,
 } from 'react-query';
 
 import type {
@@ -22,8 +16,6 @@ import type {
 	GetFlamegraphPathParameters,
 	GetTraceAggregations200,
 	GetTraceAggregationsPathParameters,
-	GetTraceSummary200,
-	GetTraceSummaryPathParameters,
 	GetWaterfallV4200,
 	GetWaterfallV4PathParameters,
 	RenderErrorResponseDTO,
@@ -35,26 +27,6 @@ import type {
 import { GeneratedAPIInstance } from '../../../generatedAPIInstance';
 import type { ErrorType, BodyType } from '../../../generatedAPIInstance';
 
-const withQueryKey = <T extends object, K>(
-	query: T,
-	queryKey: K,
-): T & { queryKey: K } => {
-	const result = { queryKey } as T & { queryKey: K };
-	for (const key of Object.keys(query)) {
-		// The explicit queryKey always wins, matching the previous
-		// `{ ...query, queryKey }` spread where it was set last.
-		if (key === 'queryKey') {
-			continue;
-		}
-		Object.defineProperty(result, key, {
-			enumerable: true,
-			configurable: true,
-			get: () => (query as Record<string, unknown>)[key],
-		});
-	}
-	return result;
-};
-
 /**
  * Computes span aggregations grouped by requested field.
  * @summary Get aggregations for a trace
@@ -155,108 +127,6 @@ export const useGetTraceAggregations = <
 > => {
 	return useMutation(getGetTraceAggregationsMutationOptions(options));
 };
-/**
- * Returns the trace-level fields of the waterfall (time range, root, span counts, missing spans) and, when the trace has gen_ai spans, its token and cost totals. Computed in one aggregate query.
- * @summary Get summary for a trace
- */
-export const getTraceSummary = (
-	{ traceID }: GetTraceSummaryPathParameters,
-	signal?: AbortSignal,
-) => {
-	return GeneratedAPIInstance<GetTraceSummary200>({
-		url: `/api/v1/traces/${traceID}/summary`,
-		method: 'GET',
-		signal,
-	});
-};
-
-export const getGetTraceSummaryQueryKey = ({
-	traceID,
-}: GetTraceSummaryPathParameters) => {
-	return [`/api/v1/traces/${traceID}/summary`] as const;
-};
-
-export const getGetTraceSummaryQueryOptions = <
-	TData = Awaited<ReturnType<typeof getTraceSummary>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ traceID }: GetTraceSummaryPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getTraceSummary>>,
-			TError,
-			TData
-		>;
-	},
-) => {
-	const { query: queryOptions } = options ?? {};
-
-	const queryKey =
-		queryOptions?.queryKey ?? getGetTraceSummaryQueryKey({ traceID });
-
-	const queryFn: QueryFunction<Awaited<ReturnType<typeof getTraceSummary>>> = ({
-		signal,
-	}) => getTraceSummary({ traceID }, signal);
-
-	return {
-		queryKey,
-		queryFn,
-		enabled: traceID !== null && traceID !== undefined,
-		...queryOptions,
-	} as UseQueryOptions<
-		Awaited<ReturnType<typeof getTraceSummary>>,
-		TError,
-		TData
-	> & { queryKey: QueryKey };
-};
-
-export type GetTraceSummaryQueryResult = NonNullable<
-	Awaited<ReturnType<typeof getTraceSummary>>
->;
-export type GetTraceSummaryQueryError = ErrorType<RenderErrorResponseDTO>;
-
-/**
- * @summary Get summary for a trace
- */
-
-export function useGetTraceSummary<
-	TData = Awaited<ReturnType<typeof getTraceSummary>>,
-	TError = ErrorType<RenderErrorResponseDTO>,
->(
-	{ traceID }: GetTraceSummaryPathParameters,
-	options?: {
-		query?: UseQueryOptions<
-			Awaited<ReturnType<typeof getTraceSummary>>,
-			TError,
-			TData
-		>;
-	},
-): UseQueryResult<TData, TError> & { queryKey: QueryKey } {
-	const queryOptions = getGetTraceSummaryQueryOptions({ traceID }, options);
-
-	const query = useQuery(queryOptions) as UseQueryResult<TData, TError> & {
-		queryKey: QueryKey;
-	};
-
-	return withQueryKey(query, queryOptions.queryKey);
-}
-
-/**
- * @summary Get summary for a trace
- */
-export const invalidateGetTraceSummary = async (
-	queryClient: QueryClient,
-	{ traceID }: GetTraceSummaryPathParameters,
-	options?: InvalidateOptions,
-): Promise<QueryClient> => {
-	await queryClient.invalidateQueries(
-		{ queryKey: getGetTraceSummaryQueryKey({ traceID }) },
-		options,
-	);
-
-	return queryClient;
-};
-
 /**
  * Returns the flamegraph view of spans for a given trace ID.
  * @summary Get flamegraph view for a trace

pkg/apiserver/signozapiserver/provider.go

@@ -85,6 +85,7 @@ type provider struct {
 	querierHandler             querier.Handler
 	serviceAccountHandler      serviceaccount.Handler
 	serviceAccountGetter       serviceaccount.Getter
+	userGetter                 user.Getter
 	factoryHandler             factory.Handler
 	cloudIntegrationHandler    cloudintegration.Handler
 	ruleStateHistoryHandler    rulestatehistory.Handler
@@ -129,6 +130,7 @@ func NewFactory(
 	querierHandler querier.Handler,
 	serviceAccountHandler serviceaccount.Handler,
 	serviceAccountGetter serviceaccount.Getter,
+	userGetter user.Getter,
 	factoryHandler factory.Handler,
 	cloudIntegrationHandler cloudintegration.Handler,
 	ruleStateHistoryHandler rulestatehistory.Handler,
@@ -181,6 +183,7 @@ func NewFactory(
 			querierHandler,
 			serviceAccountHandler,
 			serviceAccountGetter,
+			userGetter,
 			factoryHandler,
 			cloudIntegrationHandler,
 			ruleStateHistoryHandler,
@@ -235,6 +238,7 @@ func newProvider(
 	querierHandler querier.Handler,
 	serviceAccountHandler serviceaccount.Handler,
 	serviceAccountGetter serviceaccount.Getter,
+	userGetter user.Getter,
 	factoryHandler factory.Handler,
 	cloudIntegrationHandler cloudintegration.Handler,
 	ruleStateHistoryHandler rulestatehistory.Handler,
@@ -289,6 +293,7 @@ func newProvider(
 		querierHandler:             querierHandler,
 		serviceAccountHandler:      serviceAccountHandler,
 		serviceAccountGetter:       serviceAccountGetter,
+		userGetter:                 userGetter,
 		factoryHandler:             factoryHandler,
 		cloudIntegrationHandler:    cloudIntegrationHandler,
 		ruleStateHistoryHandler:    ruleStateHistoryHandler,

pkg/apiserver/signozapiserver/tracedetail.go

@@ -10,23 +10,6 @@ import (
 )
 
 func (provider *provider) addTraceDetailRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v1/traces/{traceID}/summary", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.traceDetailHandler.GetTraceSummary),
-		handler.OpenAPIDef{
-			ID:                  "GetTraceSummary",
-			Tags:                []string{"tracedetail"},
-			Summary:             "Get summary for a trace",
-			Description:         "Returns the trace-level fields of the waterfall (time range, root, span counts, missing spans) and, when the trace has gen_ai spans, its token and cost totals. Computed in one aggregate query.",
-			Response:            new(spantypes.GettableTraceSummary),
-			ResponseContentType: "application/json",
-			SuccessStatusCode:   http.StatusOK,
-			ErrorStatusCodes:    []int{http.StatusNotFound},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		},
-	)).Methods(http.MethodGet).GetError(); err != nil {
-		return err
-	}
-
 	if err := router.Handle("/api/v4/traces/{traceID}/waterfall", handler.New(
 		provider.authzMiddleware.ViewAccess(provider.traceDetailHandler.GetWaterfallV4),
 		handler.OpenAPIDef{

pkg/apiserver/signozapiserver/user.go

@@ -6,24 +6,35 @@ import (
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addUserRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.ListUsers), handler.OpenAPIDef{
-		ID:                  "ListUsers",
-		Tags:                []string{"users"},
-		Summary:             "List users v2",
-		Description:         "This endpoint lists all users for the organization",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*types.User, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.ListUsers, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListUsers",
+			Tags:                []string{"users"},
+			Summary:             "List users v2",
+			Description:         "This endpoint lists all users for the organization",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*types.User, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryAccessControl,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
@@ -61,20 +72,46 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateUser), handler.OpenAPIDef{
-		ID:                  "CreateUser",
-		Tags:                []string{"users"},
-		Summary:             "Create user",
-		Description:         "This endpoint creates a user for the organization",
-		Request:             new(authtypes.PostableUser),
-		RequestContentType:  "application/json",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateUser",
+			Tags:                []string{"users"},
+			Summary:             "Create user",
+			Description:         "This endpoint creates a user for the organization",
+			Request:             new(authtypes.PostableUser),
+			RequestContentType:  "application/json",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
+			Deprecated:          false,
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceUser.Scope(coretypes.VerbCreate),
+				coretypes.ResourceUser.Scope(coretypes.VerbAttach),
+				coretypes.ResourceRole.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceUser,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryAccessControl,
+				SourceResource: coretypes.ResourceUser,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceRole,
+				TargetIDs:      coretypes.BodyJSONArray("userRoles.#.id"),
+				TargetSelector: provider.roleSelector,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
@@ -95,88 +132,152 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUser), handler.OpenAPIDef{
-		ID:                  "GetUser",
-		Tags:                []string{"users"},
-		Summary:             "Get user by user id",
-		Description:         "This endpoint returns the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(authtypes.UserWithRoles),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUser",
+			Tags:                []string{"users"},
+			Summary:             "Get user by user id",
+			Description:         "This endpoint returns the user by id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(authtypes.UserWithRoles),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.UpdateUser), handler.OpenAPIDef{
-		ID:                  "UpdateUser",
-		Tags:                []string{"users"},
-		Summary:             "Update user v2",
-		Description:         "This endpoint updates the user by id",
-		Request:             new(types.UpdatableUser),
-		RequestContentType:  "application/json",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.UpdateUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateUser",
+			Tags:                []string{"users"},
+			Summary:             "Update user v2",
+			Description:         "This endpoint updates the user by id",
+			Request:             new(types.UpdatableUser),
+			RequestContentType:  "application/json",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUser), handler.OpenAPIDef{
-		ID:                  "DeleteUser",
-		Tags:                []string{"users"},
-		Summary:             "Delete user",
-		Description:         "This endpoint deletes the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.DeleteUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteUser",
+			Tags:                []string{"users"},
+			Summary:             "Delete user",
+			Description:         "This endpoint deletes the user by id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetResetPasswordToken), handler.OpenAPIDef{
-		ID:                  "GetResetPasswordToken",
-		Tags:                []string{"users"},
-		Summary:             "Get reset password token for a user",
-		Description:         "This endpoint returns the existing reset password token for a user.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.ResetPasswordToken),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetResetPasswordToken, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetResetPasswordToken",
+			Tags:                []string{"users"},
+			Summary:             "Get reset password token for a user",
+			Description:         "This endpoint returns the existing reset password token for a user.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(types.ResetPasswordToken),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceFactorPassword.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceFactorPassword,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateResetPasswordToken), handler.OpenAPIDef{
-		ID:                  "CreateResetPasswordToken",
-		Tags:                []string{"users"},
-		Summary:             "Create or regenerate reset password token for a user",
-		Description:         "This endpoint creates or regenerates a reset password token for a user. If a valid token exists, it is returned. If expired, a new one is created.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.ResetPasswordToken),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateResetPasswordToken, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateResetPasswordToken",
+			Tags:                []string{"users"},
+			Summary:             "Create or regenerate reset password token for a user",
+			Description:         "This endpoint creates or regenerates a reset password token for a user. If a valid token exists, it is returned. If expired, a new one is created.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(types.ResetPasswordToken),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceFactorPassword.Scope(coretypes.VerbCreate),
+				coretypes.ResourceUser.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceFactorPassword,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachParentChildResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryAccessControl,
+				ParentResource: coretypes.ResourceUser,
+				ParentID:       coretypes.PathParam("id"),
+				ParentSelector: coretypes.IDSelector,
+				ChildResource:  coretypes.ResourceMetaResourceFactorPassword,
+				ChildIDs:       coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
@@ -209,7 +310,7 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		SuccessStatusCode:   http.StatusNoContent,
 		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+		SecuritySchemes:     []handler.OpenAPISecurityScheme{{Name: authtypes.IdentNProviderTokenizer.StringValue()}},
 	})).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
@@ -248,90 +349,190 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetRolesByUserID), handler.OpenAPIDef{
-		ID:                  "GetRolesByUserID",
-		Tags:                []string{"users"},
-		Summary:             "Get user roles",
-		Description:         "This endpoint returns the user roles by user id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*authtypes.Role, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetRolesByUserID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRolesByUserID",
+			Tags:                []string{"users"},
+			Summary:             "Get user roles",
+			Description:         "This endpoint returns the user roles by user id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*authtypes.Role, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/roles/{id}/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUsersByRoleID), handler.OpenAPIDef{
-		ID:                  "GetUsersByRoleID",
-		Tags:                []string{"users"},
-		Summary:             "Get users by role id",
-		Description:         "This endpoint returns the users having the role by role id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*types.User, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/roles/{id}/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUsersByRoleID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUsersByRoleID",
+			Tags:                []string{"users"},
+			Summary:             "Get users by role id",
+			Description:         "This endpoint returns the users having the role by role id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*types.User, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceRole.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceRole,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateUserRole), handler.OpenAPIDef{
-		ID:                  "CreateUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Create user role",
-		Description:         "This endpoint assigns a role to a user",
-		Request:             new(authtypes.PostableUserRole),
-		RequestContentType:  "",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Create user role",
+			Description:         "This endpoint assigns a role to a user",
+			Request:             new(authtypes.PostableUserRole),
+			RequestContentType:  "",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbAttach), coretypes.ResourceRole.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(handler.AttachDetachSiblingResourceDef{
+			Verb:           coretypes.VerbAttach,
+			Category:       coretypes.ActionCategoryAccessControl,
+			SourceResource: coretypes.ResourceUser,
+			SourceIDs:      coretypes.OneID(coretypes.BodyJSONPath("userId")),
+			SourceSelector: coretypes.IDSelector,
+			TargetResource: coretypes.ResourceRole,
+			TargetIDs:      coretypes.OneID(coretypes.BodyJSONPath("roleId")),
+			TargetSelector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUserRole), handler.OpenAPIDef{
-		ID:                  "GetUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Get user role",
-		Description:         "This endpoint gets an existing user role",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(authtypes.UserRole),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Get user role",
+			Description:         "This endpoint gets an existing user role",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(authtypes.UserRole),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       provider.userRoleUserIDExtractor(),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUserRole), handler.OpenAPIDef{
-		ID:                  "DeleteUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Delete user role",
-		Description:         "This endpoint revokes a role from a user",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.DeleteUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Delete user role",
+			Description:         "This endpoint revokes a role from a user",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbDetach), coretypes.ResourceRole.Scope(coretypes.VerbDetach)}),
+		},
+		handler.WithResourceDefs(handler.AttachDetachSiblingResourceDef{
+			Verb:           coretypes.VerbDetach,
+			Category:       coretypes.ActionCategoryAccessControl,
+			SourceResource: coretypes.ResourceUser,
+			SourceIDs:      coretypes.OneID(provider.userRoleUserIDExtractor()),
+			SourceSelector: coretypes.IDSelector,
+			TargetResource: coretypes.ResourceRole,
+			TargetIDs:      coretypes.OneID(provider.userRoleRoleIDExtractor()),
+			TargetSelector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
 	return nil
 }
+
+func (provider *provider) userRoleUserIDExtractor() coretypes.ResourceIDExtractor {
+	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
+		if ec.Request == nil {
+			return "", nil
+		}
+
+		userRole, err := provider.userRoleFromRequest(ec.Request)
+		if err != nil {
+			return "", err
+		}
+
+		return userRole.UserID.String(), nil
+	})
+}
+
+func (provider *provider) userRoleRoleIDExtractor() coretypes.ResourceIDExtractor {
+	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
+		if ec.Request == nil {
+			return "", nil
+		}
+
+		userRole, err := provider.userRoleFromRequest(ec.Request)
+		if err != nil {
+			return "", err
+		}
+
+		return userRole.RoleID.String(), nil
+	})
+}
+
+func (provider *provider) userRoleFromRequest(req *http.Request) (*authtypes.UserRole, error) {
+	claims, err := authtypes.ClaimsFromContext(req.Context())
+	if err != nil {
+		return nil, err
+	}
+
+	userRoleID, err := valuer.NewUUID(mux.Vars(req)["id"])
+	if err != nil {
+		return nil, err
+	}
+
+	return provider.userGetter.GetUserRoleByOrgIDAndID(req.Context(), valuer.MustNewUUID(claims.OrgID), userRoleID)
+}

pkg/http/handler/resourcedef.go

@@ -56,20 +56,23 @@ type AttachDetachSiblingResourceDef struct {
 }
 
 func (def AttachDetachSiblingResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
-	return []coretypes.ResolvedResource{
-		coretypes.NewResolvedResourceWithTarget(
-			def.Verb,
-			def.Category,
-			def.SourceResource,
-			def.SourceIDs,
-			def.SourceSelector,
-			def.TargetResource,
-			def.TargetIDs,
-			def.TargetSelector,
-			false,
-			ec,
-		),
+	resolved := coretypes.NewResolvedResourceWithTarget(
+		def.Verb,
+		def.Category,
+		def.SourceResource,
+		def.SourceIDs,
+		def.SourceSelector,
+		def.TargetResource,
+		def.TargetIDs,
+		def.TargetSelector,
+		false,
+		ec,
+	)
+	if resolved.HasNoLinks() {
+		return nil
 	}
+
+	return []coretypes.ResolvedResource{resolved}
 }
 
 // AttachDetachParentChildResourceDef authz-checks only the parent; the child

pkg/http/handler/resourcedef_test.go

@@ -0,0 +1,71 @@
+package handler
+
+import (
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAttachDetachSiblingResourceDefResolvesNothingWithoutLinks(t *testing.T) {
+	def := AttachDetachSiblingResourceDef{
+		Verb:           coretypes.VerbAttach,
+		Category:       coretypes.ActionCategoryAccessControl,
+		SourceResource: coretypes.ResourceUser,
+		SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+		SourceSelector: coretypes.WildcardSelector,
+		TargetResource: coretypes.ResourceRole,
+		TargetIDs:      coretypes.BodyJSONArray("userRoles.#.id"),
+		TargetSelector: coretypes.IDSelector,
+	}
+
+	testCases := []struct {
+		name              string
+		body              string
+		expectedResolved  int
+		expectedTargetIDs []string
+	}{
+		{name: "NoRolesKey_ResolvesNothing", body: `{"email":"jane@example.com"}`, expectedResolved: 0},
+		{name: "EmptyRoles_ResolvesNothing", body: `{"userRoles":[]}`, expectedResolved: 0},
+		{name: "OneRole_ResolvesOne", body: `{"userRoles":[{"id":"signoz-viewer"}]}`, expectedResolved: 1, expectedTargetIDs: []string{"signoz-viewer"}},
+		{name: "TwoRoles_ResolvesOneWithBothTargets", body: `{"userRoles":[{"id":"signoz-viewer"},{"id":"signoz-editor"}]}`, expectedResolved: 1, expectedTargetIDs: []string{"signoz-viewer", "signoz-editor"}},
+		{name: "EmptyRoleID_KeepsFailingClosed", body: `{"userRoles":[{"id":""}]}`, expectedResolved: 1, expectedTargetIDs: []string{""}},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			resolved := ResolveRequest([]ResourceDef{def}, coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+			require.Len(t, resolved, testCase.expectedResolved)
+			if testCase.expectedResolved == 0 {
+				return
+			}
+
+			withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+			require.True(t, ok)
+			assert.NoError(t, withTarget.Err())
+			assert.Equal(t, []string{""}, withTarget.SourceIDs())
+			assert.Equal(t, testCase.expectedTargetIDs, withTarget.TargetIDs())
+		})
+	}
+}
+
+func TestAttachDetachSiblingResourceDefKeepsEmptySingleID(t *testing.T) {
+	def := AttachDetachSiblingResourceDef{
+		Verb:           coretypes.VerbAttach,
+		Category:       coretypes.ActionCategoryAccessControl,
+		SourceResource: coretypes.ResourceUser,
+		SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+		SourceSelector: coretypes.WildcardSelector,
+		TargetResource: coretypes.ResourceRole,
+		TargetIDs:      coretypes.OneID(coretypes.BodyJSONPath("roleId")),
+		TargetSelector: coretypes.IDSelector,
+	}
+
+	resolved := ResolveRequest([]ResourceDef{def}, coretypes.ExtractorContext{RequestBody: []byte(`{"userId":"u1"}`)})
+	require.Len(t, resolved, 1)
+
+	withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+	require.True(t, ok)
+	assert.Equal(t, []string{""}, withTarget.TargetIDs())
+}

pkg/modules/tracedetail/impltracedetail/handler.go

@@ -6,9 +6,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/http/binding"
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/spantypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
 
@@ -20,27 +18,6 @@ func NewHandler(module tracedetail.Module) tracedetail.Handler {
 	return &handler{module: module}
 }
 
-func (h *handler) GetTraceSummary(rw http.ResponseWriter, r *http.Request) {
-	claims, err := authtypes.ClaimsFromContext(r.Context())
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-	orgID, err := valuer.NewUUID(claims.OrgID)
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	stats, err := h.module.GetTraceStats(r.Context(), orgID, mux.Vars(r)["traceID"])
-	if err != nil {
-		render.Error(rw, err)
-		return
-	}
-
-	render.Success(rw, http.StatusOK, spantypes.NewGettableTraceSummary(stats))
-}
-
 func (h *handler) GetWaterfallV4(rw http.ResponseWriter, r *http.Request) {
 	req := new(spantypes.PostableWaterfall)
 	if err := binding.JSON.BindBody(r.Body, req); err != nil {

pkg/modules/tracedetail/impltracedetail/module.go

@@ -8,7 +8,6 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/tracedetail"
 	"github.com/SigNoz/signoz/pkg/types/spantypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
 	"go.opentelemetry.io/otel/metric"
 )
 
@@ -40,21 +39,6 @@ func NewModule(traceStore spantypes.TraceStore, providerSettings factory.Provide
 	return m
 }
 
-func (m *module) GetTraceStats(ctx context.Context, orgID valuer.UUID, traceID string) (*spantypes.TraceStats, error) {
-	summary, err := m.store.GetTraceSummary(ctx, traceID)
-	if err != nil {
-		return nil, err
-	}
-	stats, err := m.store.GetTraceStats(ctx, orgID, traceID, summary)
-	if err != nil {
-		return nil, err
-	}
-	if stats.TotalSpans == 0 {
-		return nil, spantypes.ErrTraceNotFound
-	}
-	return stats, nil
-}
-
 // GetWaterfallV4 is the OOM-safe V4 waterfall.
 // For large traces (NumSpans > effectiveLimit) it uses a two-step fetch:
 // minimal fields for all spans to build the tree, then full fields for the

pkg/modules/tracedetail/impltracedetail/store.go

@@ -10,15 +10,9 @@ import (
 
 	"github.com/SigNoz/signoz/pkg/clickhousesql"
 	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/flagger"
-	"github.com/SigNoz/signoz/pkg/querybuilder"
-	"github.com/SigNoz/signoz/pkg/telemetryschema/tracestelemetryschema"
 	"github.com/SigNoz/signoz/pkg/telemetrystore"
-	"github.com/SigNoz/signoz/pkg/types/aiobservabilitytypes"
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/spantypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
 const colServiceName = `resource_string_service$$$$name` // $ gets escaped so $$$$ converts to $$.
@@ -44,18 +38,10 @@ type spanDurationRow struct {
 
 type traceStore struct {
 	telemetryStore telemetrystore.TelemetryStore
-	metadataStore  telemetrytypes.MetadataStore
-	storage        qbtypes.Storage
-	flagger        flagger.Flagger
 }
 
-func NewTraceStore(ts telemetrystore.TelemetryStore, metadataStore telemetrytypes.MetadataStore, fl flagger.Flagger) *traceStore {
-	return &traceStore{
-		telemetryStore: ts,
-		metadataStore:  metadataStore,
-		storage:        tracestelemetryschema.NewStorage(),
-		flagger:        fl,
-	}
+func NewTraceStore(ts telemetrystore.TelemetryStore) *traceStore {
+	return &traceStore{telemetryStore: ts}
 }
 
 func (s *traceStore) GetTraceSummary(ctx context.Context, traceID string) (*spantypes.TraceSummary, error) {
@@ -79,131 +65,6 @@ func (s *traceStore) GetTraceSummary(ctx context.Context, traceID string) (*span
 	return &summary, nil
 }
 
-func (s *traceStore) GetTraceStats(ctx context.Context, orgID valuer.UUID, traceID string, summary *spantypes.TraceSummary) (*spantypes.TraceStats, error) {
-	table := fmt.Sprintf("%s.%s", spantypes.TraceDB, spantypes.TraceTable)
-	spans := sqlbuilder.NewSelectBuilder()
-
-	genAIColumns, err := s.genAISpanColumns(ctx, orgID, summary, spans)
-	if err != nil {
-		return nil, err
-	}
-
-	// A span whose parent was never recorded hangs off a synthetic "Missing Span" root in the waterfall.
-	ids := sqlbuilder.NewSelectBuilder()
-	ids.Select("span_id")
-	ids.From(table)
-	ids.Where(
-		ids.E("trace_id", traceID),
-		ids.GE("ts_bucket_start", summary.Start.Unix()-1800),
-		ids.LE("ts_bucket_start", summary.End.Unix()),
-	)
-	missingParent := fmt.Sprintf("parent_span_id <> '' AND parent_span_id GLOBAL NOT IN (%s)", spans.Var(ids))
-
-	spans.Select(
-		"toUnixTimestamp64Nano(timestamp) AS span_start_ns",
-		"span_start_ns + duration_nano AS span_end_ns",
-		"span_id",
-		"has_error",
-		"("+missingParent+") AS has_missing_parent",
-		"(parent_span_id = '' OR has_missing_parent) AS is_root",
-		"if(parent_span_id = '', name, 'Missing Span') AS root_name",
-		"if(parent_span_id = '', "+colServiceName+", '') AS root_service",
-	)
-	spans.SelectMore(genAIColumns...)
-	spans.From(table)
-	spans.Where(
-		spans.E("trace_id", traceID),
-		spans.GE("ts_bucket_start", summary.Start.Unix()-1800),
-		spans.LE("ts_bucket_start", summary.End.Unix()),
-	)
-	spans.SQL("LIMIT 1 BY span_id")
-
-	sb := sqlbuilder.NewSelectBuilder()
-	sb.Select(
-		"toUInt64(min(span_start_ns)) AS start_ns",
-		"toUInt64(max(span_end_ns)) AS end_ns",
-		"count() AS total_spans",
-		"countIf(has_error) AS total_error_spans",
-		"countIf(has_missing_parent) > 0 AS has_missing_spans",
-		"argMinIf(root_service, (span_start_ns, root_name), is_root) AS root_service_name",
-		"argMinIf(root_name, (span_start_ns, root_name), is_root) AS root_entry_point",
-		"countIf(is_gen_ai) AS gen_ai_span_count",
-		"toUInt64(coalesce(sum(input_tokens_value), 0)) AS input_tokens",
-		"toUInt64(coalesce(sum(output_tokens_value), 0)) AS output_tokens",
-		"toUInt64(coalesce(sum(cache_read_tokens_value), 0)) AS cache_read_tokens",
-		"toUInt64(coalesce(sum(cache_write_tokens_value), 0)) AS cache_write_tokens",
-		"toUInt64(coalesce(sum(reasoning_tokens_value), 0)) AS reasoning_tokens",
-		"sum(total_cost_value) AS total_cost",
-	)
-	sb.From(sb.BuilderAs(spans, "spans"))
-	query, args := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
-
-	var stats spantypes.TraceStats
-	err = s.telemetryStore.ClickhouseDB().QueryRow(ctx, query, args...).Scan(
-		&stats.StartNs, &stats.EndNs, &stats.TotalSpans, &stats.TotalErrorSpans, &stats.HasMissingSpans,
-		&stats.RootServiceName, &stats.RootEntryPoint, &stats.GenAISpanCount,
-		&stats.Tokens.Input, &stats.Tokens.Output, &stats.Tokens.CacheRead, &stats.Tokens.CacheWrite, &stats.Tokens.Reasoning,
-		&stats.TotalCost,
-	)
-	if err != nil {
-		return nil, errors.WrapInternalf(err, errors.CodeInternal, "error querying trace stats")
-	}
-	return &stats, nil
-}
-
-// genAISpanColumns renders the per-span gen_ai gate and value reads through the shared
-// traces storage, so each attribute is read from the column its evolutions place it in
-// over the trace's own time window. Exists predicates bind their args into sb.
-func (s *traceStore) genAISpanColumns(ctx context.Context, orgID valuer.UUID, summary *spantypes.TraceSummary, sb *sqlbuilder.SelectBuilder) ([]string, error) {
-	// no data type: metadata reports token counts as number, so a float64 request would
-	// miss them and fall back to a map read without evolutions
-	attributeKey := func(name string) *telemetrytypes.TelemetryFieldKey {
-		return &telemetrytypes.TelemetryFieldKey{Name: name, Signal: telemetrytypes.SignalTraces, FieldContext: telemetrytypes.FieldContextAttribute}
-	}
-
-	selectors := make([]*telemetrytypes.FieldKeySelector, 0, len(aiobservabilitytypes.GenAISpanGateKeys)+len(spantypes.TraceStatsGenAIColumns))
-	addSelector := func(name string) {
-		selectors = append(selectors, &telemetrytypes.FieldKeySelector{
-			Name:              name,
-			Signal:            telemetrytypes.SignalTraces,
-			FieldContext:      telemetrytypes.FieldContextAttribute,
-			SelectorMatchType: telemetrytypes.FieldSelectorMatchTypeExact,
-		})
-	}
-	for _, name := range aiobservabilitytypes.GenAISpanGateKeys {
-		addSelector(name)
-	}
-	for _, col := range spantypes.TraceStatsGenAIColumns {
-		addSelector(col.Key)
-	}
-	keys, _, err := s.metadataStore.GetKeysMulti(ctx, orgID, querybuilder.ExpandKeySelectorsForFamilies(ctx, orgID, s.flagger, selectors))
-	if err != nil {
-		return nil, err
-	}
-
-	q := querybuilder.NewQueryInfo(ctx, orgID, s.flagger, telemetrytypes.SignalTraces, nil, uint64(summary.Start.UnixNano()), uint64(summary.End.UnixNano()))
-
-	gate := make([]string, 0, len(aiobservabilitytypes.GenAISpanGateKeys))
-	for _, name := range aiobservabilitytypes.GenAISpanGateKeys {
-		conds, _, err := querybuilder.Conditions(ctx, q, s.storage, attributeKey(name), qbtypes.FilterOperatorExists, nil, keys, false, sb)
-		if err != nil {
-			return nil, err
-		}
-		gate = append(gate, conds...)
-	}
-	columns := []string{sb.Or(gate...) + " AS is_gen_ai"}
-
-	for _, col := range spantypes.TraceStatsGenAIColumns {
-		expr, err := querybuilder.ResolveColumn(ctx, q, s.storage, attributeKey(col.Key), telemetrytypes.FieldDataTypeFloat64, keys)
-		if err != nil {
-			return nil, err
-		}
-		// a materialized column name carries `$$`, which Build would otherwise unescape
-		columns = append(columns, sqlbuilder.Escape(expr)+" AS "+col.Column+"_value")
-	}
-	return columns, nil
-}
-
 func (s *traceStore) GetTraceSpans(ctx context.Context, traceID string, summary *spantypes.TraceSummary) ([]spantypes.StorableSpan, error) {
 	// DISTINCT ON (span_id) is ClickHouse-specific syntax not supported by sqlbuilder
 	query := fmt.Sprintf(`

pkg/modules/tracedetail/tracedetail.go

@@ -6,12 +6,10 @@ import (
 
 	"github.com/SigNoz/signoz/pkg/types/spantypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
 )
 
 // Handler exposes HTTP handlers for trace detail APIs.
 type Handler interface {
-	GetTraceSummary(http.ResponseWriter, *http.Request)
 	GetWaterfallV4(http.ResponseWriter, *http.Request)
 	GetTraceAggregations(http.ResponseWriter, *http.Request)
 	GetFlamegraph(http.ResponseWriter, *http.Request)
@@ -19,7 +17,6 @@ type Handler interface {
 
 // Module defines the business logic for trace detail operations.
 type Module interface {
-	GetTraceStats(ctx context.Context, orgID valuer.UUID, traceID string) (*spantypes.TraceStats, error)
 	GetWaterfallV4(ctx context.Context, traceID string, selectedSpanID string, uncollapsedSpans []string) (*spantypes.GettableWaterfallTrace, error)
 	GetTraceAggregations(ctx context.Context, traceID string, req *spantypes.PostableTraceAggregations) (*spantypes.GettableTraceAggregations, error)
 	GetFlamegraph(ctx context.Context, traceID string, selectedSpanID string, selectFields []telemetrytypes.TelemetryFieldKey) (*spantypes.GettableFlamegraphTrace, error)

pkg/modules/user/impluser/handler.go

@@ -184,11 +184,6 @@ func (handler *handler) UpdateUser(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if userID == claims.UserID {
-		render.Error(w, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "users cannot call this api on self"))
-		return
-	}
-
 	updatableUser := new(types.UpdatableUser)
 	if err := json.NewDecoder(r.Body).Decode(&updatableUser); err != nil {
 		render.Error(w, err)
@@ -431,11 +426,6 @@ func (handler *handler) CreateUserRole(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if req.UserID.String() == claims.UserID {
-		render.Error(w, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "users cannot call this api on self"))
-		return
-	}
-
 	userRole, err := handler.setter.AddUserRoleByRoleID(ctx, valuer.MustNewUUID(claims.OrgID), req.UserID, req.RoleID)
 	if err != nil {
 		render.Error(w, err)
@@ -492,11 +482,6 @@ func (handler *handler) DeleteUserRole(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if userRole.UserID.String() == claims.UserID {
-		render.Error(w, errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "users cannot call this api on self"))
-		return
-	}
-
 	if err := handler.setter.RemoveUserRole(ctx, valuer.MustNewUUID(claims.OrgID), userRole.UserID, userRole.RoleID); err != nil {
 		render.Error(w, err)
 		return

pkg/signoz/module.go

@@ -161,7 +161,7 @@ func NewModules(
 		LogsPipeline:         impllogspipeline.NewModule(sqlstore),
 		RuleStateHistory:     implrulestatehistory.NewModule(implrulestatehistory.NewStore(telemetryStore, telemetryMetadataStore, providerSettings.Logger), ruleStore),
 		CloudIntegration:     cloudIntegrationModule,
-		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore, telemetryMetadataStore, fl), providerSettings, config.TraceDetail),
+		TraceDetail:          impltracedetail.NewModule(impltracedetail.NewTraceStore(telemetryStore), providerSettings, config.TraceDetail),
 		SpanMapper:           spanMapper,
 		LLMPricingRule:       impllmpricingrule.NewModule(impllmpricingrule.NewStore(sqlstore), querier),
 		Tag:                  tagModule,

pkg/signoz/openapi.go

@@ -94,6 +94,7 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ querier.Handler }{},
 		struct{ serviceaccount.Handler }{},
 		struct{ serviceaccount.Getter }{},
+		struct{ user.Getter }{},
 		struct{ factory.Handler }{},
 		struct{ cloudintegration.Handler }{},
 		struct{ rulestatehistory.Handler }{},

pkg/signoz/provider.go

@@ -258,6 +258,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddNotificationChannelTuplesFactory(sqlstore),
 		sqlmigration.NewAddAIObservabilityQuickFiltersFactory(sqlstore),
 		sqlmigration.NewAddChannelSpecFactory(sqlschema),
+		sqlmigration.NewAddUserTuplesFactory(sqlstore),
 	)
 }
 
@@ -353,6 +354,7 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.QuerierHandler,
 			handlers.ServiceAccountHandler,
 			modules.ServiceAccountGetter,
+			modules.UserGetter,
 			handlers.RegistryHandler,
 			handlers.CloudIntegrationHandler,
 			handlers.RuleStateHistory,

pkg/sqlmigration/132_add_user_tuples.go

@@ -0,0 +1,141 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addUserTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddUserTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_user_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addUserTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addUserTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addUserTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	// user and factor-password moved from the legacy AdminAccess gate to
+	// CheckResources. Existing organizations never had these tuples written;
+	// only new organizations receive them from the managed-role registry at bootstrap.
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "user", "user", "create"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "list"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "read"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "update"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "delete"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "attach"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "detach"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return tx.Commit()
+}
+
+func (migration *addUserTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/telemetryschema/aitelemetryschema/const.go

@@ -19,7 +19,6 @@ var (
 		aiobservabilitytypes.GenAIUsageOutputTokens:             genAIAttribute(aiobservabilitytypes.GenAIUsageOutputTokens, telemetrytypes.FieldDataTypeFloat64),
 		aiobservabilitytypes.GenAIUsageCacheReadInputTokens:     genAIAttribute(aiobservabilitytypes.GenAIUsageCacheReadInputTokens, telemetrytypes.FieldDataTypeFloat64),
 		aiobservabilitytypes.GenAIUsageCacheCreationInputTokens: genAIAttribute(aiobservabilitytypes.GenAIUsageCacheCreationInputTokens, telemetrytypes.FieldDataTypeFloat64),
-		aiobservabilitytypes.GenAIUsageReasoningOutputTokens:    genAIAttribute(aiobservabilitytypes.GenAIUsageReasoningOutputTokens, telemetrytypes.FieldDataTypeFloat64),
 		aiobservabilitytypes.SignozGenAITotalCost:               genAIAttribute(aiobservabilitytypes.SignozGenAITotalCost, telemetrytypes.FieldDataTypeFloat64),
 
 		aiobservabilitytypes.GenAIInputMessages:  genAIAttribute(aiobservabilitytypes.GenAIInputMessages, telemetrytypes.FieldDataTypeString),

pkg/types/aiobservabilitytypes/keys.go

@@ -15,7 +15,6 @@ const (
 	GenAIUsageOutputTokens             = "gen_ai.usage.output_tokens"
 	GenAIUsageCacheReadInputTokens     = "gen_ai.usage.cache_read.input_tokens"
 	GenAIUsageCacheCreationInputTokens = "gen_ai.usage.cache_creation.input_tokens"
-	GenAIUsageReasoningOutputTokens    = "gen_ai.usage.reasoning.output_tokens"
 
 	GenAIInputMessages  = "gen_ai.input.messages"
 	GenAIOutputMessages = "gen_ai.output.messages"

pkg/types/coretypes/extractor.go

@@ -52,7 +52,7 @@ func OneID(extractor ResourceIDExtractor) ResourceIDsExtractor {
 
 	return ResourceIDsExtractor{Phase: extractor.Phase, Fn: func(ec ExtractorContext) ([]string, error) {
 		id, err := extractor.Fn(ec)
-		if err != nil || id == "" {
+		if err != nil {
 			return nil, err
 		}
 		return []string{id}, nil

pkg/types/coretypes/resolved.go

@@ -31,6 +31,8 @@ type ResolvedResourceWithTargetResource interface {
 	// IsParentChild true: the target is a child audited along but not authz-checked
 	// (only the source is); false: a sibling peer that is also authz-checked.
 	IsParentChild() bool
+	// HasNoLinks true: a request-phase ids extractor ran and found nothing to link.
+	HasNoLinks() bool
 }
 
 func NewContextWithResolvedResources(ctx context.Context, resolved []ResolvedResource) context.Context {

pkg/types/coretypes/resolved_resource_with_target.go

@@ -12,6 +12,7 @@ type resolvedResourceWithTarget struct {
 	targetExtractor ResourceIDsExtractor
 	targetIDs       []string
 	parentChild     bool
+	noLinks         bool
 	err             error
 }
 
@@ -44,29 +45,40 @@ func NewResolvedResourceWithTarget(
 }
 
 func (resolved *resolvedResourceWithTarget) fill(phase ExtractPhase, ec ExtractorContext) {
-	if resolved.sourceExtractor.IsPhase(phase) {
-		ids, err := resolved.sourceExtractor.Fn(ec)
-		if err != nil && phase == PhaseRequest {
-			resolved.err = err
-			return
-		}
-
-		if len(ids) > 0 {
-			resolved.sourceIDs = ids
-		}
+	if err := resolved.fillSide(phase, ec, resolved.sourceExtractor, &resolved.sourceIDs); err != nil {
+		resolved.err = err
+		return
 	}
 
-	if resolved.targetExtractor.IsPhase(phase) {
-		ids, err := resolved.targetExtractor.Fn(ec)
-		if err != nil && phase == PhaseRequest {
-			resolved.err = err
-			return
+	if err := resolved.fillSide(phase, ec, resolved.targetExtractor, &resolved.targetIDs); err != nil {
+		resolved.err = err
+	}
+}
+
+func (resolved *resolvedResourceWithTarget) fillSide(phase ExtractPhase, ec ExtractorContext, extractor ResourceIDsExtractor, ids *[]string) error {
+	if !extractor.IsPhase(phase) {
+		return nil
+	}
+
+	extracted, err := extractor.Fn(ec)
+	if err != nil {
+		if phase == PhaseRequest {
+			return err
 		}
 
-		if len(ids) > 0 {
-			resolved.targetIDs = ids
-		}
+		return nil
 	}
+
+	if len(extracted) == 0 {
+		if phase == PhaseRequest {
+			resolved.noLinks = true
+		}
+
+		return nil
+	}
+
+	*ids = extracted
+	return nil
 }
 
 func (resolved *resolvedResourceWithTarget) Err() error {
@@ -117,6 +129,10 @@ func (resolved *resolvedResourceWithTarget) IsParentChild() bool {
 	return resolved.parentChild
 }
 
+func (resolved *resolvedResourceWithTarget) HasNoLinks() bool {
+	return resolved.noLinks
+}
+
 func (resolved *resolvedResourceWithTarget) ResolveResponse(ec ExtractorContext) {
 	resolved.fill(PhaseResponse, ec)
 }

pkg/types/spantypes/store.go

@@ -32,7 +32,6 @@ type SpanMapperStore interface {
 // TraceStore defines the data access interface for trace detail queries.
 type TraceStore interface {
 	GetTraceSummary(ctx context.Context, traceID string) (*TraceSummary, error)
-	GetTraceStats(ctx context.Context, orgID valuer.UUID, traceID string, summary *TraceSummary) (*TraceStats, error)
 	GetTraceSpans(ctx context.Context, traceID string, summary *TraceSummary) ([]StorableSpan, error)
 	GetMinimalSpans(ctx context.Context, traceID string, start, end time.Time) ([]MinimalSpan, error)
 	GetTraceSpansByIDs(ctx context.Context, traceID string, start, end time.Time, spanIDs []string) ([]StorableSpan, error)

pkg/types/spantypes/trace_summary.go

@@ -1,76 +0,0 @@
-package spantypes
-
-import "github.com/SigNoz/signoz/pkg/types/aiobservabilitytypes"
-
-// TraceStatsGenAIColumns pairs each summed TraceStats column with the gen_ai attribute it sums.
-var TraceStatsGenAIColumns = []TraceStatsGenAIColumn{
-	{Column: "input_tokens", Key: aiobservabilitytypes.GenAIUsageInputTokens},
-	{Column: "output_tokens", Key: aiobservabilitytypes.GenAIUsageOutputTokens},
-	{Column: "cache_read_tokens", Key: aiobservabilitytypes.GenAIUsageCacheReadInputTokens},
-	{Column: "cache_write_tokens", Key: aiobservabilitytypes.GenAIUsageCacheCreationInputTokens},
-	{Column: "reasoning_tokens", Key: aiobservabilitytypes.GenAIUsageReasoningOutputTokens},
-	{Column: "total_cost", Key: aiobservabilitytypes.SignozGenAITotalCost},
-}
-
-type TraceStatsGenAIColumn struct {
-	Column string
-	Key    string
-}
-
-// TraceStats is the single-row result of the trace summary aggregate query.
-type TraceStats struct {
-	StartNs         uint64
-	EndNs           uint64
-	RootServiceName string
-	RootEntryPoint  string
-	TotalSpans      uint64
-	TotalErrorSpans uint64
-	HasMissingSpans bool
-	GenAISpanCount  uint64
-	Tokens          TraceAITokens
-	TotalCost       *float64
-}
-
-// GettableTraceSummary is the response for the trace summary API; the trace-level
-// fields match the waterfall response.
-type GettableTraceSummary struct {
-	StartTimestampMillis  uint64          `json:"startTimestampMillis"`
-	EndTimestampMillis    uint64          `json:"endTimestampMillis"`
-	RootServiceName       string          `json:"rootServiceName"`
-	RootServiceEntryPoint string          `json:"rootServiceEntryPoint"`
-	TotalSpansCount       uint64          `json:"totalSpansCount"`
-	TotalErrorSpansCount  uint64          `json:"totalErrorSpansCount"`
-	HasMissingSpans       bool            `json:"hasMissingSpans"`
-	AI                    *TraceAISummary `json:"ai,omitempty"`
-}
-
-// TraceAISummary is present when any span carries a gen_ai gate key.
-type TraceAISummary struct {
-	Tokens TraceAITokens `json:"tokens"`
-	// TotalCost is null when no span carries a cost attribute.
-	TotalCost *float64 `json:"totalCost" nullable:"true"`
-}
-
-type TraceAITokens struct {
-	Input      uint64 `json:"input"`
-	Output     uint64 `json:"output"`
-	CacheRead  uint64 `json:"cacheRead"`
-	CacheWrite uint64 `json:"cacheWrite"`
-	Reasoning  uint64 `json:"reasoning"`
-}
-
-func NewGettableTraceSummary(stats *TraceStats) *GettableTraceSummary {
-	summary := &GettableTraceSummary{
-		StartTimestampMillis:  stats.StartNs / 1_000_000,
-		EndTimestampMillis:    stats.EndNs / 1_000_000,
-		RootServiceName:       stats.RootServiceName,
-		RootServiceEntryPoint: stats.RootEntryPoint,
-		TotalSpansCount:       stats.TotalSpans,
-		TotalErrorSpansCount:  stats.TotalErrorSpans,
-		HasMissingSpans:       stats.HasMissingSpans,
-	}
-	if stats.GenAISpanCount > 0 {
-		summary.AI = &TraceAISummary{Tokens: stats.Tokens, TotalCost: stats.TotalCost}
-	}
-	return summary
-}

tests/fixtures/traces.py

@@ -895,7 +895,6 @@ _TRACES_TABLES_TO_TRUNCATE = [
     "span_attributes_keys",
     "signoz_error_index_v2",
     "top_level_operations",
-    "trace_summary",
 ]
 
 

tests/integration/tests/passwordauthn/01_register.py

@@ -7,251 +7,44 @@ from fixtures import types
 from fixtures.auth import (
     USER_ADMIN_EMAIL,
     USER_ADMIN_PASSWORD,
-    USER_EDITOR_EMAIL,
-    USER_EDITOR_NAME,
-    USER_EDITOR_PASSWORD,
-    USER_VIEWER_EMAIL,
     assert_user_has_role,
     find_user_with_roles_by_email,
 )
-from fixtures.logger import setup_logger
-from fixtures.role import find_role_by_name
-
-logger = setup_logger(__name__)
 
 
 def test_register_with_invalid_input(signoz: types.SigNoz) -> None:
     response = requests.post(
         signoz.self.host_configs["8080"].get("/api/v1/register"),
-        json={
-            "name": "admin",
-            "orgId": "",
-            "orgName": "integration.test",
-            "email": "admin@integration.test",
-            "password": "password",  # invalid password
-        },
-        timeout=2,
+        json={"name": "admin", "orgId": "", "orgName": "integration.test", "email": USER_ADMIN_EMAIL, "password": "password"},
+        timeout=5,
     )
-
     assert response.status_code == HTTPStatus.BAD_REQUEST
 
     response = requests.post(
         signoz.self.host_configs["8080"].get("/api/v1/register"),
-        json={
-            "name": "admin",
-            "orgId": "",
-            "orgName": "integration.test",
-            "email": "admin",  # invalid email
-            "password": "password123Z$",
-        },
-        timeout=2,
+        json={"name": "admin", "orgId": "", "orgName": "integration.test", "email": "admin", "password": USER_ADMIN_PASSWORD},
+        timeout=5,
     )
-
     assert response.status_code == HTTPStatus.BAD_REQUEST
 
 
 def test_register(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    response = requests.get(signoz.self.host_configs["8080"].get("/api/v1/version"), timeout=2)
-
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v1/version"), timeout=5)
     assert response.status_code == HTTPStatus.OK
     assert response.json()["setupCompleted"] is False
 
     response = requests.post(
         signoz.self.host_configs["8080"].get("/api/v1/register"),
-        json={
-            "name": "admin",
-            "orgId": "",
-            "orgName": "integration.test",
-            "email": USER_ADMIN_EMAIL,
-            "password": USER_ADMIN_PASSWORD,
-        },
-        timeout=2,
+        json={"name": "admin", "orgId": "", "orgName": "integration.test", "email": USER_ADMIN_EMAIL, "password": USER_ADMIN_PASSWORD},
+        timeout=5,
     )
     assert response.status_code == HTTPStatus.OK
 
-    response = requests.get(signoz.self.host_configs["8080"].get("/api/v1/version"), timeout=2)
-
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v1/version"), timeout=5)
     assert response.status_code == HTTPStatus.OK
     assert response.json()["setupCompleted"] is True
 
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # Verify admin user exists via v2
     found_user = find_user_with_roles_by_email(signoz, admin_token, USER_ADMIN_EMAIL)
+    assert found_user["isRoot"] is True
     assert_user_has_role(found_user, "signoz-admin")
-
-
-def test_invite(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    # Create the editor user as a pending invite
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        json={
-            "email": USER_EDITOR_EMAIL,
-            "displayName": USER_EDITOR_NAME,
-            "userRoles": [{"id": find_role_by_name(signoz, admin_token, "signoz-editor")}],
-        },
-        timeout=2,
-        headers={"Authorization": f"Bearer {admin_token}"},
-    )
-    assert response.status_code == HTTPStatus.CREATED, response.text
-    user_id = response.json()["data"]["id"]
-
-    # Verify the user appears in the users list but as pending_invite status
-    found_user = find_user_with_roles_by_email(signoz, admin_token, USER_EDITOR_EMAIL)
-    assert found_user["status"] == "pending_invite"
-    assert_user_has_role(found_user, "signoz-editor")
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}/reset_password_tokens"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.CREATED, response.text
-
-    # Reset the password to complete the invite flow (activates the user and also grants authz)
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
-        json={"password": USER_EDITOR_PASSWORD, "token": response.json()["data"]["token"]},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT
-
-    # Verify the user can now log in
-    editor_token = get_token(USER_EDITOR_EMAIL, USER_EDITOR_PASSWORD)
-    assert editor_token is not None
-
-    # Verify that the editor user status has been updated to ACTIVE
-    admin_token_fresh = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    found_user = find_user_with_roles_by_email(signoz, admin_token_fresh, USER_EDITOR_EMAIL)
-
-    assert_user_has_role(found_user, "signoz-editor")
-    assert found_user["displayName"] == USER_EDITOR_NAME
-    assert found_user["email"] == USER_EDITOR_EMAIL
-    assert found_user["status"] == "active"
-
-
-def test_revoke_invite(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    # Invite the viewer user
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        json={
-            "email": USER_VIEWER_EMAIL,
-            "userRoles": [{"id": find_role_by_name(signoz, admin_token, "signoz-viewer")}],
-        },
-        timeout=2,
-        headers={"Authorization": f"Bearer {admin_token}"},
-    )
-    assert response.status_code == HTTPStatus.CREATED, response.text
-    user_id = response.json()["data"]["id"]
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}/reset_password_tokens"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.CREATED, response.text
-    reset_token = response.json()["data"]["token"]
-
-    # Delete the pending invite user (revoke the invite)
-    response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}"),
-        timeout=2,
-        headers={"Authorization": f"Bearer {admin_token}"},
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT
-
-    # Try to use the reset token — should fail (user deleted)
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
-        json={"password": "password123Z$", "token": reset_token},
-        timeout=2,
-    )
-    assert response.status_code in (HTTPStatus.BAD_REQUEST, HTTPStatus.NOT_FOUND)
-
-
-def test_provision_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Mirrors the zeus provisioning flow."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    provisioned_email = "zeus-provisioned@integration.test"
-    provisioned_name = "zeus provisioned user"
-    provisioned_password = "password123Z$"
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v1/roles"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    role_id = next(role["id"] for role in response.json()["data"] if role["name"] == "signoz-admin")
-
-    create_payload = {
-        "email": provisioned_email,
-        "displayName": provisioned_name,
-        "userRoles": [{"id": role_id}],
-    }
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        json=create_payload,
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.CREATED, response.text
-    user_id = response.json()["data"]["id"]
-
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        json=create_payload,
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.CONFLICT, response.text
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    existing_id = next(user["id"] for user in response.json()["data"] if user["email"] == provisioned_email.strip().lower())
-    assert existing_id == user_id
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}/reset_password_tokens"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.CREATED, response.text
-    reset_token = response.json()["data"]["token"]
-    assert reset_token != ""
-
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
-        json={"password": provisioned_password, "token": reset_token},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/sessions/context"),
-        params={"email": provisioned_email, "ref": f"{signoz.self.host_configs['8080'].base()}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    org_id = response.json()["data"]["orgs"][0]["id"]
-
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/sessions/email_password"),
-        json={"email": provisioned_email, "password": provisioned_password, "orgId": org_id},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    assert response.json()["data"]["accessToken"] != ""
-
-    provisioned_user = find_user_with_roles_by_email(signoz, admin_token, provisioned_email)
-    assert provisioned_user["status"] == "active"
-    assert provisioned_user["displayName"] == provisioned_name
-    assert_user_has_role(provisioned_user, "signoz-admin")

tests/integration/tests/passwordauthn/02_license.py

@@ -11,6 +11,7 @@ from wiremock.client import (
 )
 
 from fixtures import types
+from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 
 
 def test_apply_license(
@@ -52,7 +53,7 @@ def test_apply_license(
         ],
     )
 
-    access_token = get_token("admin@integration.test", "password123Z$")
+    access_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.post(
         url=signoz.self.host_configs["8080"].get("/api/v4/licenses"),
@@ -121,7 +122,7 @@ def test_refresh_license(
         ],
     )
 
-    access_token = get_token("admin@integration.test", "password123Z$")
+    access_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.put(
         url=signoz.self.host_configs["8080"].get("/api/v4/licenses/0196360e-90cd-7a74-8313-1aa815ce2a67"),
@@ -182,7 +183,7 @@ def test_license_checkout(
         ],
     )
 
-    access_token = get_token("admin@integration.test", "password123Z$")
+    access_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.post(
         url=signoz.self.host_configs["8080"].get("/api/v1/subscriptions"),
@@ -229,7 +230,7 @@ def test_license_portal(
         ],
     )
 
-    access_token = get_token("admin@integration.test", "password123Z$")
+    access_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.put(
         url=signoz.self.host_configs["8080"].get("/api/v1/subscriptions"),

tests/integration/tests/passwordauthn/03_invite.py

@@ -0,0 +1,221 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    USERS_BASE,
+    assert_user_has_role,
+    create_active_user,
+    find_user_with_roles_by_email,
+)
+from fixtures.role import find_role_by_name
+
+_INVITED_EMAIL = "editor+invite@integration.test"
+_INVITED_NAME = "invited editor"
+_INVITED_PASSWORD = "password123Z$"
+_REVOKED_EMAIL = "viewer+invite-revoked@integration.test"
+_DUPLICATE_EMAIL = "duplicate+invite@integration.test"
+_REINVITED_EMAIL = "reinvite+invite@integration.test"
+_PROVISIONED_EMAIL = "admin+invite-provisioned@integration.test"
+_PROVISIONED_NAME = "provisioned admin"
+_PROVISIONED_PASSWORD = "password123Z$"
+
+
+def test_invite(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": _INVITED_EMAIL, "displayName": _INVITED_NAME, "userRoles": [{"id": find_role_by_name(signoz, admin_token, "signoz-editor")}]},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    user_id = response.json()["data"]["id"]
+
+    found_user = find_user_with_roles_by_email(signoz, admin_token, _INVITED_EMAIL)
+    assert found_user["status"] == "pending_invite"
+    assert_user_has_role(found_user, "signoz-editor")
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{user_id}/reset_password_tokens"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
+        json={"password": _INVITED_PASSWORD, "token": response.json()["data"]["token"]},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+    assert get_token(_INVITED_EMAIL, _INVITED_PASSWORD) is not None
+
+    found_user = find_user_with_roles_by_email(signoz, admin_token, _INVITED_EMAIL)
+    assert found_user["status"] == "active"
+    assert found_user["displayName"] == _INVITED_NAME
+    assert found_user["email"] == _INVITED_EMAIL
+    assert_user_has_role(found_user, "signoz-editor")
+
+
+def test_revoke_invite(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": _REVOKED_EMAIL, "userRoles": [{"id": find_role_by_name(signoz, admin_token, "signoz-viewer")}]},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    user_id = response.json()["data"]["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{user_id}/reset_password_tokens"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    reset_token = response.json()["data"]["token"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{user_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
+        json={"password": "password123Z$", "token": reset_token},
+        timeout=5,
+    )
+    assert response.status_code in (HTTPStatus.BAD_REQUEST, HTTPStatus.NOT_FOUND)
+
+
+def test_duplicate_invite_rejected(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    editor_role_id = find_role_by_name(signoz, admin_token, "signoz-editor")
+    viewer_role_id = find_role_by_name(signoz, admin_token, "signoz-viewer")
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": _DUPLICATE_EMAIL, "userRoles": [{"id": editor_role_id}]},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    user_id = response.json()["data"]["id"]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": _DUPLICATE_EMAIL, "userRoles": [{"id": viewer_role_id}]},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CONFLICT
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{user_id}/reset_password_tokens"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
+        json={"password": "password123Z$", "token": response.json()["data"]["token"]},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": _DUPLICATE_EMAIL, "userRoles": [{"id": viewer_role_id}]},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CONFLICT
+
+
+def test_reinvite_deleted_user_creates_new_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    user_id = create_active_user(signoz, admin_token, email=_REINVITED_EMAIL, role="signoz-editor", password="password123Z$", name="reinvite user")
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{user_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+    reinvited_user_id = create_active_user(signoz, admin_token, email=_REINVITED_EMAIL, role="signoz-viewer", password="newPassword123Z$", name="reinvite user v2")
+    assert reinvited_user_id != user_id
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{reinvited_user_id}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    assert_user_has_role(response.json()["data"], "signoz-viewer")
+
+    assert get_token(_REINVITED_EMAIL, "newPassword123Z$") is not None
+
+
+def test_provisioned_admin_can_login(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    """Mirrors the zeus provisioning flow: invite an admin, activate, and log in with an explicit org id."""
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": _PROVISIONED_EMAIL, "displayName": _PROVISIONED_NAME, "userRoles": [{"id": find_role_by_name(signoz, admin_token, "signoz-admin")}]},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    user_id = response.json()["data"]["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{user_id}/reset_password_tokens"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    reset_token = response.json()["data"]["token"]
+    assert reset_token != ""
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
+        json={"password": _PROVISIONED_PASSWORD, "token": reset_token},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/sessions/context"),
+        params={"email": _PROVISIONED_EMAIL, "ref": f"{signoz.self.host_configs['8080'].base()}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    org_id = response.json()["data"]["orgs"][0]["id"]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/sessions/email_password"),
+        json={"email": _PROVISIONED_EMAIL, "password": _PROVISIONED_PASSWORD, "orgId": org_id},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    assert response.json()["data"]["accessToken"] != ""
+
+    provisioned_user = find_user_with_roles_by_email(signoz, admin_token, _PROVISIONED_EMAIL)
+    assert provisioned_user["status"] == "active"
+    assert provisioned_user["displayName"] == _PROVISIONED_NAME
+    assert_user_has_role(provisioned_user, "signoz-admin")

tests/integration/tests/passwordauthn/04_password.py

@@ -6,9 +6,6 @@ from sqlalchemy import sql
 
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD, create_active_user, find_user_by_email
-from fixtures.logger import setup_logger
-
-logger = setup_logger(__name__)
 
 PASSWORD_USER_EMAIL = "admin+password@integration.test"
 PASSWORD_USER_PASSWORD = "password123Z$"
@@ -36,7 +33,7 @@ def test_change_password(signoz: types.SigNoz, get_token: Callable[[str, str], s
             "oldPassword": "password",
             "newPassword": PASSWORD_USER_PASSWORD,
         },
-        timeout=2,
+        timeout=5,
         headers={"Authorization": f"Bearer {token}"},
     )
 
@@ -49,7 +46,7 @@ def test_change_password(signoz: types.SigNoz, get_token: Callable[[str, str], s
             "oldPassword": PASSWORD_USER_PASSWORD,
             "newPassword": "password123Znew$",
         },
-        timeout=2,
+        timeout=5,
         headers={"Authorization": f"Bearer {token}"},
     )
 
@@ -70,7 +67,7 @@ def test_reset_password(signoz: types.SigNoz, get_token: Callable[[str, str], st
     response = requests.put(
         signoz.self.host_configs["8080"].get(f"/api/v2/users/{found_user['id']}/reset_password_tokens"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
 
     assert response.status_code == HTTPStatus.CREATED, response.text
@@ -83,7 +80,7 @@ def test_reset_password(signoz: types.SigNoz, get_token: Callable[[str, str], st
     response = requests.put(
         signoz.self.host_configs["8080"].get(f"/api/v2/users/{found_user['id']}/reset_password_tokens"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
     assert response.status_code == HTTPStatus.CREATED, response.text
     assert response.json()["data"]["token"] == token
@@ -92,7 +89,7 @@ def test_reset_password(signoz: types.SigNoz, get_token: Callable[[str, str], st
     response = requests.get(
         signoz.self.host_configs["8080"].get(f"/api/v2/users/{found_user['id']}/reset_password_tokens"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
     assert response.status_code == HTTPStatus.OK, response.text
     assert response.json()["data"]["token"] == token
@@ -101,7 +98,7 @@ def test_reset_password(signoz: types.SigNoz, get_token: Callable[[str, str], st
     response = requests.post(
         signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
         json={"password": "password", "token": token},
-        timeout=2,
+        timeout=5,
     )
 
     assert response.status_code == HTTPStatus.BAD_REQUEST
@@ -110,7 +107,7 @@ def test_reset_password(signoz: types.SigNoz, get_token: Callable[[str, str], st
     response = requests.post(
         signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
         json={"password": "password123Z$NEWNEW#!", "token": token},
-        timeout=2,
+        timeout=5,
     )
 
     assert response.status_code == HTTPStatus.NO_CONTENT
@@ -121,7 +118,7 @@ def test_reset_password(signoz: types.SigNoz, get_token: Callable[[str, str], st
     response = requests.post(
         signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
         json={"password": "password123Z$REPLAY#!", "token": token},
-        timeout=2,
+        timeout=5,
     )
     assert response.status_code == HTTPStatus.NOT_FOUND, response.text
 
@@ -143,7 +140,7 @@ def test_reset_password_with_no_password(signoz: types.SigNoz, get_token: Callab
     response = requests.get(
         signoz.self.host_configs["8080"].get(f"/api/v2/users/{found_user['id']}/reset_password_tokens"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
     assert response.status_code == HTTPStatus.NOT_FOUND, response.text
 
@@ -151,7 +148,7 @@ def test_reset_password_with_no_password(signoz: types.SigNoz, get_token: Callab
     response = requests.put(
         signoz.self.host_configs["8080"].get(f"/api/v2/users/{found_user['id']}/reset_password_tokens"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
 
     assert response.status_code == HTTPStatus.CREATED, response.text
@@ -163,7 +160,7 @@ def test_reset_password_with_no_password(signoz: types.SigNoz, get_token: Callab
     response = requests.post(
         signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
         json={"password": "FINALPASSword123!#[", "token": token},
-        timeout=2,
+        timeout=5,
     )
 
     assert response.status_code == HTTPStatus.NO_CONTENT
@@ -258,7 +255,7 @@ def test_forgot_password_creates_reset_token(signoz: types.SigNoz, get_token: Ca
     response = requests.get(
         signoz.self.host_configs["8080"].get(f"/api/v2/users/{found_user['id']}/reset_password_tokens"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
     assert response.status_code == HTTPStatus.OK, response.text
     token_data = response.json()["data"]
@@ -271,7 +268,7 @@ def test_forgot_password_creates_reset_token(signoz: types.SigNoz, get_token: Ca
     response = requests.post(
         signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
         json={"password": "newSecurePassword123Z$!", "token": reset_token},
-        timeout=2,
+        timeout=5,
     )
     assert response.status_code == HTTPStatus.NO_CONTENT
 
@@ -280,11 +277,12 @@ def test_forgot_password_creates_reset_token(signoz: types.SigNoz, get_token: Ca
     assert user_token is not None
 
     # Verify old password no longer works
-    try:
-        get_token(forgot_email, "originalPassword123Z$")
-        assert False, "Old password should not work after reset"
-    except AssertionError:
-        pass  # Expected - old password should fail
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/sessions/email_password"),
+        json={"email": forgot_email, "password": "originalPassword123Z$", "orgId": org_id},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.UNAUTHORIZED, response.text
 
 
 def test_reset_password_with_expired_token(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
@@ -361,6 +359,6 @@ def test_reset_password_with_expired_token(signoz: types.SigNoz, get_token: Call
     response = requests.post(
         signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
         json={"password": "expiredTokenPassword123Z$!", "token": reset_token},
-        timeout=2,
+        timeout=5,
     )
     assert response.status_code == HTTPStatus.UNAUTHORIZED

tests/integration/tests/passwordauthn/05_duplicate_invite.py

@@ -1,70 +0,0 @@
-from collections.abc import Callable
-from http import HTTPStatus
-
-import requests
-
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.role import find_role_by_name
-from fixtures.types import SigNoz
-
-DUPLICATE_USER_EMAIL = "duplicate@integration.test"
-
-
-def test_duplicate_user_invite_rejected(
-    signoz: SigNoz,
-    get_token: Callable[[str, str], str],
-):
-    """
-    Verify that the unique index on (email, org_id) in the users table prevents
-    creating duplicate users. This invites a new user, accepts the invite, then
-    tries to invite and accept the same email again expecting a failure.
-    """
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    viewer_role_id = find_role_by_name(signoz, admin_token, "signoz-viewer")
-
-    # Invite a new user
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        json={
-            "email": DUPLICATE_USER_EMAIL,
-            "userRoles": [{"id": find_role_by_name(signoz, admin_token, "signoz-editor")}],
-        },
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.CREATED, response.text
-    user_id = response.json()["data"]["id"]
-
-    # Invite the same email again while still pending — should fail
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        json={"email": DUPLICATE_USER_EMAIL, "userRoles": [{"id": viewer_role_id}]},
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.CONFLICT
-
-    # activate the user
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}/reset_password_tokens"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.CREATED, response.text
-
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/factor_password/reset"),
-        json={"password": "password123Z$", "token": response.json()["data"]["token"]},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT
-
-    # Try to invite the same email again once active — should fail
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        json={"email": DUPLICATE_USER_EMAIL, "userRoles": [{"id": viewer_role_id}]},
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.CONFLICT

tests/integration/tests/passwordauthn/05_user.py

@@ -0,0 +1,161 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    USERS_BASE,
+    assert_user_has_role,
+    create_active_user,
+    find_user_by_email,
+    find_user_with_roles_by_email,
+)
+
+_EDITOR_EMAIL = "editor+user@integration.test"
+_EDITOR_PASSWORD = "password123Z$"
+_SELF_ADMIN_EMAIL = "admin+user-self@integration.test"
+_SELF_ADMIN_PASSWORD = "password123Z$"
+_DELETED_EMAIL = "deleted+user@integration.test"
+_DELETED_PASSWORD = "password123Z$"
+
+
+def test_setup_users(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    create_active_user(signoz, admin_token, email=_EDITOR_EMAIL, role="signoz-editor", password=_EDITOR_PASSWORD, name="user editor")
+    create_active_user(signoz, admin_token, email=_SELF_ADMIN_EMAIL, role="signoz-admin", password=_SELF_ADMIN_PASSWORD, name="self admin")
+
+
+def test_list_users(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = requests.get(signoz.self.host_configs["8080"].get(USERS_BASE), headers={"Authorization": f"Bearer {admin_token}"}, timeout=5)
+    assert response.status_code == HTTPStatus.OK
+    users = {user["email"]: user for user in response.json()["data"]}
+
+    assert users[USER_ADMIN_EMAIL]["isRoot"] is True
+    assert users[USER_ADMIN_EMAIL]["status"] == "active"
+    assert users[_EDITOR_EMAIL]["isRoot"] is False
+    assert users[_EDITOR_EMAIL]["status"] == "active"
+
+
+def test_get_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    editor = find_user_with_roles_by_email(signoz, admin_token, _EDITOR_EMAIL)
+    assert editor["email"] == _EDITOR_EMAIL
+    assert editor["status"] == "active"
+    assert_user_has_role(editor, "signoz-editor")
+
+
+def test_get_my_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    editor_token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/me"), headers={"Authorization": f"Bearer {editor_token}"}, timeout=5)
+    assert response.status_code == HTTPStatus.OK
+    data = response.json()["data"]
+    assert data["email"] == _EDITOR_EMAIL
+    assert data["isRoot"] is False
+    assert_user_has_role(data, "signoz-editor")
+
+
+def test_update_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    editor_id = find_user_by_email(signoz, admin_token, _EDITOR_EMAIL)["id"]
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{editor_id}"),
+        json={"displayName": "updated editor"},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+    assert find_user_by_email(signoz, admin_token, _EDITOR_EMAIL)["displayName"] == "updated editor"
+
+
+def test_update_my_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    editor_token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/me"),
+        json={"displayName": "self updated editor"},
+        headers={"Authorization": f"Bearer {editor_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/me"), headers={"Authorization": f"Bearer {editor_token}"}, timeout=5)
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["data"]["displayName"] == "self updated editor"
+
+
+def test_admin_can_update_self_via_id(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    self_admin_id = find_user_by_email(signoz, admin_token, _SELF_ADMIN_EMAIL)["id"]
+    self_admin_token = get_token(_SELF_ADMIN_EMAIL, _SELF_ADMIN_PASSWORD)
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{self_admin_id}"),
+        json={"displayName": "self admin updated"},
+        headers={"Authorization": f"Bearer {self_admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/me"), headers={"Authorization": f"Bearer {self_admin_token}"}, timeout=5)
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["data"]["displayName"] == "self admin updated"
+
+
+def test_root_user_is_immutable(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    root_id = find_user_by_email(signoz, admin_token, USER_ADMIN_EMAIL)["id"]
+    headers = {"Authorization": f"Bearer {admin_token}"}
+
+    response = requests.put(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{root_id}"), json={"displayName": "should fail"}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_IMPLEMENTED, response.text
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{root_id}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_IMPLEMENTED, response.text
+
+    response = requests.put(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{root_id}/reset_password_tokens"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_IMPLEMENTED, response.text
+
+
+def test_delete_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    user_id = create_active_user(signoz, admin_token, email=_DELETED_EMAIL, role="signoz-viewer", password=_DELETED_PASSWORD, name="deleted user")
+    user_token = get_token(_DELETED_EMAIL, _DELETED_PASSWORD)
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/me"), headers={"Authorization": f"Bearer {user_token}"}, timeout=5)
+    assert response.status_code == HTTPStatus.OK
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{user_id}"), headers={"Authorization": f"Bearer {admin_token}"}, timeout=5)
+    assert response.status_code == HTTPStatus.NO_CONTENT
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{user_id}"), headers={"Authorization": f"Bearer {admin_token}"}, timeout=5)
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["data"]["status"] == "deleted"
+    assert response.json()["data"]["userRoles"] == []
+
+    assert find_user_by_email(signoz, admin_token, _DELETED_EMAIL)["status"] == "deleted"
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/me"), headers={"Authorization": f"Bearer {user_token}"}, timeout=5)
+    assert response.status_code == HTTPStatus.UNAUTHORIZED
+
+
+def test_editor_cannot_manage_other_users(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    root_id = find_user_by_email(signoz, admin_token, USER_ADMIN_EMAIL)["id"]
+    headers = {"Authorization": f"Bearer {get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(USERS_BASE), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{root_id}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN
+
+    response = requests.put(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{root_id}"), json={"displayName": "hacked"}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{root_id}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN

tests/integration/tests/passwordauthn/06_invite_status.py

@@ -1,132 +0,0 @@
-from collections.abc import Callable
-from http import HTTPStatus
-
-import requests
-
-from fixtures.auth import (
-    USER_ADMIN_EMAIL,
-    USER_ADMIN_PASSWORD,
-    assert_user_has_role,
-    create_active_user,
-)
-from fixtures.types import SigNoz
-
-
-def test_reinvite_deleted_user(
-    signoz: SigNoz,
-    get_token: Callable[[str, str], str],
-):
-    """
-    Verify that a deleted user if re-inivited creates a new user altogether:
-    1. Invite and activate a user
-    2. Call the delete user api
-    3. Re-invite the same email — should succeed and create a new user with pending_invite status
-    4. Reset password for the new user
-    5. Get User API returns two users now, one deleted and one active
-    """
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    reinvite_user_email = "reinvite@integration.test"
-
-    user_id = create_active_user(
-        signoz,
-        admin_token,
-        email=reinvite_user_email,
-        role="signoz-editor",
-        password="password123Z$",
-        name="reinvite user",
-    )
-
-    # call the delete api which now soft deletes the user
-    response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT
-
-    # Re-invite the same email — should succeed and create a different user
-    reinvited_user_id = create_active_user(
-        signoz,
-        admin_token,
-        email=reinvite_user_email,
-        role="signoz-viewer",
-        password="newPassword123Z$",
-        name="reinvite user v2",
-    )
-    assert reinvited_user_id != user_id
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{reinvited_user_id}"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
-    )
-    assert response.status_code == HTTPStatus.OK, response.text
-    assert_user_has_role(response.json()["data"], "signoz-viewer")
-
-    # Verify user can log in with new password
-    user_token = get_token(reinvite_user_email, "newPassword123Z$")
-    assert user_token is not None
-
-
-def test_delete_user(
-    signoz: SigNoz,
-    get_token: Callable[[str, str], str],
-):
-    """
-    Verify that after soft-deleting a user:
-    1. GET /api/v2/users shows the user with status == "deleted"
-    2. GET /api/v2/users/{id} returns the user with empty userRoles (roles revoked)
-    """
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    user_id = create_active_user(
-        signoz,
-        admin_token,
-        email="delete-verify-v2@integration.test",
-        role="signoz-editor",
-        password="password123Z$",
-        name="delete verify v2",
-    )
-
-    # verify user is active via v2
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()["data"]
-    assert data["status"] == "active"
-    assert len(data["userRoles"]) == 1
-
-    # delete the user
-    response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT
-
-    # verify status is deleted in the users list
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    users = response.json()["data"]
-    deleted_user = next((u for u in users if u["id"] == user_id), None)
-    assert deleted_user is not None
-    assert deleted_user["status"] == "deleted"
-
-    # verify roles are revoked
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()["data"]
-    assert data["status"] == "deleted"
-    assert len(data["userRoles"]) == 0

tests/integration/tests/passwordauthn/06_user_role.py

@@ -7,8 +7,6 @@ from fixtures import types
 from fixtures.auth import (
     USER_ADMIN_EMAIL,
     USER_ADMIN_PASSWORD,
-    USER_EDITOR_EMAIL,
-    USER_EDITOR_PASSWORD,
     change_user_role,
     create_active_user,
 )
@@ -47,7 +45,7 @@ def test_change_role(
     # Make some API call which is protected
     response = requests.get(
         signoz.self.host_configs["8080"].get("/api/v1/org/preferences"),
-        timeout=2,
+        timeout=5,
         headers={"Authorization": f"Bearer {new_user_token}"},
     )
 
@@ -61,7 +59,7 @@ def test_change_role(
         signoz.self.host_configs["8080"].get(f"/api/v2/users/{new_user_id}"),
         json={"displayName": "role change user"},
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
     assert response.status_code == HTTPStatus.NO_CONTENT
 
@@ -77,7 +75,7 @@ def test_change_role(
 
     response = requests.get(
         signoz.self.host_configs["8080"].get("/api/v1/org/preferences"),
-        timeout=2,
+        timeout=5,
         headers={"Authorization": f"Bearer {new_user_token}"},
     )
 
@@ -275,11 +273,97 @@ def test_user_with_roles_reflects_change(
     assert "signoz-admin" in role_names
 
 
-def test_admin_cannot_assign_role_to_self(
+def test_admin_can_change_own_roles(
     signoz: types.SigNoz,
     get_token: Callable[[str, str], str],
 ):
-    """Verify POST /api/v2/user_roles for the caller's own user is rejected (self-mutation guard)."""
+    """Verify a non-root admin can assign a role to and remove a role from their own user."""
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    self_token = get_token(ROLECHANGE_USER_EMAIL, ROLECHANGE_USER_PASSWORD)
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
+        headers={"Authorization": f"Bearer {self_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    self_id = response.json()["data"]["id"]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/user_roles"),
+        json={"userId": self_id, "roleId": find_role_by_name(signoz, admin_token, "signoz-editor")},
+        headers={"Authorization": f"Bearer {self_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    editor_entry_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/user_roles/{editor_entry_id}"),
+        headers={"Authorization": f"Bearer {self_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
+        headers={"Authorization": f"Bearer {self_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    assert {ur["role"]["name"] for ur in response.json()["data"]["userRoles"]} == {"signoz-admin"}
+
+
+def test_self_demotion_is_immediate_and_recoverable(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+):
+    """Verify a non-root admin who removes their own admin role loses access on the next call and root can restore it."""
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    self_token = get_token(ROLECHANGE_USER_EMAIL, ROLECHANGE_USER_PASSWORD)
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
+        headers={"Authorization": f"Bearer {self_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+    me = response.json()["data"]
+    admin_entry_id = next(ur["id"] for ur in me["userRoles"] if ur["role"]["name"] == "signoz-admin")
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/user_roles/{admin_entry_id}"),
+        headers={"Authorization": f"Bearer {self_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users"),
+        headers={"Authorization": f"Bearer {self_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/user_roles"),
+        json={"userId": me["id"], "roleId": find_role_by_name(signoz, admin_token, "signoz-admin")},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users"),
+        headers={"Authorization": f"Bearer {self_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK
+
+
+def test_root_roles_cannot_be_changed(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+):
+    """Verify role assignment and removal on the root user are rejected by the root user guard."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
     response = requests.get(
         signoz.self.host_configs["8080"].get("/api/v2/users/me"),
@@ -295,22 +379,7 @@ def test_admin_cannot_assign_role_to_self(
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=5,
     )
-    assert response.status_code == HTTPStatus.BAD_REQUEST
-
-
-def test_admin_cannot_remove_own_role(
-    signoz: types.SigNoz,
-    get_token: Callable[[str, str], str],
-):
-    """Verify DELETE /api/v2/user_roles/{id} for the caller's own assignment is rejected (self-mutation guard)."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    admin_data = response.json()["data"]
+    assert response.status_code == HTTPStatus.NOT_IMPLEMENTED
 
     admin_entry_id = next((ur["id"] for ur in admin_data["userRoles"] if ur["role"]["name"] == "signoz-admin"), None)
     assert admin_entry_id is not None
@@ -320,7 +389,7 @@ def test_admin_cannot_remove_own_role(
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=5,
     )
-    assert response.status_code == HTTPStatus.BAD_REQUEST
+    assert response.status_code == HTTPStatus.NOT_IMPLEMENTED
 
 
 def test_editor_cannot_manage_roles(
@@ -340,7 +409,15 @@ def test_editor_cannot_manage_roles(
         name="viewer roleauth",
     )
 
-    editor_token = get_token(USER_EDITOR_EMAIL, USER_EDITOR_PASSWORD)
+    create_active_user(
+        signoz,
+        admin_token,
+        email="editor+roleauth@integration.test",
+        role="signoz-editor",
+        password=ROLECHANGE_USER_PASSWORD,
+        name="editor roleauth",
+    )
+    editor_token = get_token("editor+roleauth@integration.test", ROLECHANGE_USER_PASSWORD)
 
     # GET roles — forbidden
     response = requests.get(

tests/integration/tests/passwordauthn/07_user_fga.py

@@ -0,0 +1,275 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    USER_ROLES_BASE,
+    USERS_BASE,
+    add_license,
+    change_user_role,
+    create_active_user,
+    find_user_by_email,
+)
+from fixtures.role import find_role_by_name, transaction_group
+
+_ACTOR_ROLE_NAME = "user-fga-actor"
+_ACTOR_EMAIL = "customrole+userfga@integration.test"
+_ACTOR_PASSWORD = "password123Z$"
+
+_EDITOR_EMAIL = "editor+userfga@integration.test"
+_EDITOR_PASSWORD = "password123Z$"
+
+# Instance verbs are granted on _TARGET_EMAIL's id only; _OTHER_EMAIL must stay forbidden.
+_TARGET_EMAIL = "target+userfga@integration.test"
+_OTHER_EMAIL = "other+userfga@integration.test"
+_TARGET_PASSWORD = "password123Z$"
+
+_INVITED_VIEWER_EMAIL = "invited-viewer+userfga@integration.test"
+_INVITED_EDITOR_EMAIL = "invited-editor+userfga@integration.test"
+_INVITED_NO_ROLE_EMAIL = "invited-norole+userfga@integration.test"
+
+
+def _set_actor_role(signoz: types.SigNoz, admin_token: str, transaction_groups: list[dict]) -> None:
+    role_id = find_role_by_name(signoz, admin_token, _ACTOR_ROLE_NAME)
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{role_id}"),
+        json={"description": "", "transactionGroups": transaction_groups},
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.NO_CONTENT, resp.text
+
+
+def test_apply_license(
+    signoz: types.SigNoz,
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+
+def test_setup_actor_and_targets(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    create_active_user(signoz, admin_token, email=_EDITOR_EMAIL, role="signoz-editor", password=_EDITOR_PASSWORD, name="user-fga-editor")
+    create_active_user(signoz, admin_token, email=_TARGET_EMAIL, role="signoz-viewer", password=_TARGET_PASSWORD, name="user-fga-target")
+    create_active_user(signoz, admin_token, email=_OTHER_EMAIL, role="signoz-viewer", password=_TARGET_PASSWORD, name="user-fga-other")
+
+    target_id = find_user_by_email(signoz, admin_token, _TARGET_EMAIL)["id"]
+    create_role(
+        admin_token,
+        _ACTOR_ROLE_NAME,
+        [
+            transaction_group("read", "user", "user", [target_id]),
+            transaction_group("list", "user", "user", ["*"]),
+        ],
+    )
+
+    actor_id = create_active_user(signoz, admin_token, email=_ACTOR_EMAIL, role="signoz-viewer", password=_ACTOR_PASSWORD, name="user-fga-actor")
+    change_user_role(signoz, admin_token, actor_id, "signoz-viewer", _ACTOR_ROLE_NAME)
+
+
+def test_editor_cannot_issue_reset_token(signoz: types.SigNoz, get_token: Callable[[str, str], str]):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    target_id = find_user_by_email(signoz, admin_token, _TARGET_EMAIL)["id"]
+    editor_token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    resp = requests.put(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{target_id}/reset_password_tokens"), headers={"Authorization": f"Bearer {editor_token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"editor reset token: expected 403, got {resp.status_code}: {resp.text}"
+
+
+def test_read_scoped_to_granted_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+    target_id = find_user_by_email(signoz, admin_token, _TARGET_EMAIL)["id"]
+    other_id = find_user_by_email(signoz, admin_token, _OTHER_EMAIL)["id"]
+
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{target_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, f"get granted user: {resp.text}"
+
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{target_id}/roles"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, f"get granted user roles: {resp.text}"
+
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{other_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"get other user: expected 403, got {resp.status_code}: {resp.text}"
+
+    # list is collection-scoped: list on "*" returns every user, including the one
+    # the actor cannot read individually.
+    resp = requests.get(signoz.self.host_configs["8080"].get(USERS_BASE), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, resp.text
+    ids = {user["id"] for user in resp.json()["data"]}
+    assert {target_id, other_id} <= ids
+
+    resp = requests.put(
+        signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{target_id}"),
+        json={"displayName": "user-fga-target-renamed"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"update user without grant: expected 403, got {resp.status_code}: {resp.text}"
+
+
+def test_reset_password_token_scoped_to_granted_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    target_id = find_user_by_email(signoz, admin_token, _TARGET_EMAIL)["id"]
+    other_id = find_user_by_email(signoz, admin_token, _OTHER_EMAIL)["id"]
+
+    _set_actor_role(
+        signoz,
+        admin_token,
+        [
+            transaction_group("read", "user", "user", [target_id]),
+            transaction_group("attach", "user", "user", [target_id]),
+            transaction_group("create", "metaresource", "factor-password", ["*"]),
+            transaction_group("list", "metaresource", "factor-password", ["*"]),
+        ],
+    )
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    resp = requests.put(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{target_id}/reset_password_tokens"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.CREATED, f"create reset token for granted user: {resp.text}"
+
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{target_id}/reset_password_tokens"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, f"get reset token for granted user: {resp.text}"
+
+    resp = requests.put(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{other_id}/reset_password_tokens"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"create reset token for other user: expected 403, got {resp.status_code}: {resp.text}"
+
+    # user:attach alone is not enough: factor-password:create is checked too.
+    _set_actor_role(signoz, admin_token, [transaction_group("attach", "user", "user", [target_id])])
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    resp = requests.put(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{target_id}/reset_password_tokens"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"create reset token without factor-password:create: expected 403, got {resp.status_code}: {resp.text}"
+
+
+def test_user_role_attach_detach_dual_scoped(signoz: types.SigNoz, get_token: Callable[[str, str], str]):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    target_id = find_user_by_email(signoz, admin_token, _TARGET_EMAIL)["id"]
+    other_id = find_user_by_email(signoz, admin_token, _OTHER_EMAIL)["id"]
+    editor_role_id = find_role_by_name(signoz, admin_token, "signoz-editor")
+    admin_role_id = find_role_by_name(signoz, admin_token, "signoz-admin")
+
+    # attach/detach granted on the target user id AND the signoz-editor role name only.
+    _set_actor_role(
+        signoz,
+        admin_token,
+        [
+            transaction_group("read", "user", "user", [target_id]),
+            transaction_group("attach", "user", "user", [target_id]),
+            transaction_group("detach", "user", "user", [target_id]),
+            transaction_group("attach", "role", "role", ["signoz-editor"]),
+            transaction_group("detach", "role", "role", ["signoz-editor"]),
+        ],
+    )
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    resp = requests.post(
+        signoz.self.host_configs["8080"].get(USER_ROLES_BASE),
+        json={"userId": target_id, "roleId": editor_role_id},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.CREATED, f"assign editor to target: {resp.text}"
+    editor_entry_id = resp.json()["data"]["id"]
+
+    resp = requests.get(signoz.self.host_configs["8080"].get(f"{USER_ROLES_BASE}/{editor_entry_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.OK, f"get user role of granted user: {resp.text}"
+
+    resp = requests.post(
+        signoz.self.host_configs["8080"].get(USER_ROLES_BASE),
+        json={"userId": other_id, "roleId": editor_role_id},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"assign editor to other user: expected 403, got {resp.status_code}: {resp.text}"
+
+    resp = requests.post(
+        signoz.self.host_configs["8080"].get(USER_ROLES_BASE),
+        json={"userId": target_id, "roleId": admin_role_id},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"assign admin to target: expected 403, got {resp.status_code}: {resp.text}"
+
+    resp = requests.delete(signoz.self.host_configs["8080"].get(f"{USER_ROLES_BASE}/{editor_entry_id}"), headers={"Authorization": f"Bearer {token}"}, timeout=5)
+    assert resp.status_code == HTTPStatus.NO_CONTENT, f"remove editor from target: {resp.text}"
+
+
+def test_invite_checks_role_attach_per_role(signoz: types.SigNoz, get_token: Callable[[str, str], str]):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    viewer_role_id = find_role_by_name(signoz, admin_token, "signoz-viewer")
+    editor_role_id = find_role_by_name(signoz, admin_token, "signoz-editor")
+
+    _set_actor_role(
+        signoz,
+        admin_token,
+        [
+            transaction_group("create", "user", "user", ["*"]),
+            transaction_group("attach", "user", "user", ["*"]),
+            transaction_group("attach", "role", "role", ["signoz-viewer"]),
+        ],
+    )
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    resp = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": _INVITED_VIEWER_EMAIL, "displayName": "invited-viewer", "userRoles": [{"id": viewer_role_id}]},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.CREATED, f"invite with viewer: {resp.text}"
+
+    resp = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": _INVITED_EDITOR_EMAIL, "displayName": "invited-editor", "userRoles": [{"id": editor_role_id}]},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"invite with editor: expected 403, got {resp.status_code}: {resp.text}"
+
+    # No roles in the body: nothing to attach, so neither user:attach nor role:attach is checked.
+    _set_actor_role(signoz, admin_token, [transaction_group("create", "user", "user", ["*"])])
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    resp = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": _INVITED_NO_ROLE_EMAIL, "displayName": "invited-norole", "userRoles": []},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.CREATED, f"invite without roles: {resp.text}"
+
+    resp = requests.post(
+        signoz.self.host_configs["8080"].get(USERS_BASE),
+        json={"email": "invited-viewer-denied+userfga@integration.test", "displayName": "invited-viewer-denied", "userRoles": [{"id": viewer_role_id}]},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert resp.status_code == HTTPStatus.FORBIDDEN, f"invite with viewer without role:attach: expected 403, got {resp.status_code}: {resp.text}"
+
+
+def test_cleanup(signoz: types.SigNoz, get_token: Callable[[str, str], str]):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {admin_token}"}
+
+    actor_id = find_user_by_email(signoz, admin_token, _ACTOR_EMAIL)["id"]
+    change_user_role(signoz, admin_token, actor_id, _ACTOR_ROLE_NAME, "signoz-viewer")
+
+    role_id = find_role_by_name(signoz, admin_token, _ACTOR_ROLE_NAME)
+    resp = requests.delete(signoz.self.host_configs["8080"].get(f"/api/v1/roles/{role_id}"), headers=headers, timeout=5)
+    assert resp.status_code == HTTPStatus.NO_CONTENT, resp.text
+
+    for email in (_ACTOR_EMAIL, _EDITOR_EMAIL, _TARGET_EMAIL, _OTHER_EMAIL, _INVITED_VIEWER_EMAIL, _INVITED_NO_ROLE_EMAIL):
+        user_id = find_user_by_email(signoz, admin_token, email)["id"]
+        resp = requests.delete(signoz.self.host_configs["8080"].get(f"{USERS_BASE}/{user_id}"), headers=headers, timeout=5)
+        assert resp.status_code == HTTPStatus.NO_CONTENT, f"delete {email}: {resp.text}"

tests/integration/tests/passwordauthn/08_user.py

@@ -1,216 +0,0 @@
-from collections.abc import Callable
-from http import HTTPStatus
-
-import requests
-
-from fixtures import types
-from fixtures.auth import (
-    USER_ADMIN_EMAIL,
-    USER_ADMIN_PASSWORD,
-    USER_EDITOR_EMAIL,
-    USER_EDITOR_PASSWORD,
-    assert_user_has_role,
-    create_active_user,
-    find_user_by_email,
-    find_user_with_roles_by_email,
-)
-
-
-def test_list_users(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify GET /api/v2/users returns all users with correct fields."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    users = response.json()["data"]
-
-    admin_user = next((u for u in users if u["email"] == USER_ADMIN_EMAIL), None)
-    assert admin_user is not None
-    assert admin_user["isRoot"] is True
-    assert admin_user["status"] == "active"
-
-    editor_user = next((u for u in users if u["email"] == USER_EDITOR_EMAIL), None)
-    assert editor_user is not None
-    assert editor_user["status"] == "active"
-
-
-def test_get_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify GET /api/v2/users/{id} returns user with roles."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    editor_user = find_user_by_email(signoz, admin_token, USER_EDITOR_EMAIL)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{editor_user['id']}"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()["data"]
-    assert data["email"] == USER_EDITOR_EMAIL
-    assert data["status"] == "active"
-    assert len(data["userRoles"]) >= 1
-    assert_user_has_role(data, "signoz-editor")
-
-
-def test_get_my_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify GET /api/v2/users/me returns authenticated user with roles."""
-    editor_token = get_token(USER_EDITOR_EMAIL, USER_EDITOR_PASSWORD)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
-        headers={"Authorization": f"Bearer {editor_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    data = response.json()["data"]
-    assert data["email"] == USER_EDITOR_EMAIL
-    assert data["status"] == "active"
-    assert data["isRoot"] is False
-    assert_user_has_role(data, "signoz-editor")
-
-
-def test_update_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify PUT /api/v2/users/{id} updates displayName."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    editor_user = find_user_by_email(signoz, admin_token, USER_EDITOR_EMAIL)
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{editor_user['id']}"),
-        json={"displayName": "updated editor"},
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT
-
-    updated = find_user_with_roles_by_email(signoz, admin_token, USER_EDITOR_EMAIL)
-    assert updated["displayName"] == "updated editor"
-
-
-def test_update_my_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify PUT /api/v2/users/me updates own displayName."""
-    editor_token = get_token(USER_EDITOR_EMAIL, USER_EDITOR_PASSWORD)
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
-        json={"displayName": "self updated editor"},
-        headers={"Authorization": f"Bearer {editor_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
-        headers={"Authorization": f"Bearer {editor_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    assert response.json()["data"]["displayName"] == "self updated editor"
-
-
-def test_admin_cannot_update_self_via_id(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify PUT /api/v2/users/{own_id} is rejected (self-mutation guard)."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    admin_id = response.json()["data"]["id"]
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{admin_id}"),
-        json={"displayName": "should fail"},
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.BAD_REQUEST
-
-
-def test_editor_cannot_list_users(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify non-admin cannot call GET /api/v2/users."""
-    editor_token = get_token(USER_EDITOR_EMAIL, USER_EDITOR_PASSWORD)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users"),
-        headers={"Authorization": f"Bearer {editor_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.FORBIDDEN
-
-
-def test_editor_cannot_get_other_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify non-admin cannot call GET /api/v2/users/{other_id}."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    editor_token = get_token(USER_EDITOR_EMAIL, USER_EDITOR_PASSWORD)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    admin_id = response.json()["data"]["id"]
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{admin_id}"),
-        headers={"Authorization": f"Bearer {editor_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.FORBIDDEN
-
-
-def test_editor_cannot_update_other_user(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify non-admin cannot call PUT /api/v2/users/{other_id}."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    editor_token = get_token(USER_EDITOR_EMAIL, USER_EDITOR_PASSWORD)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-    admin_id = response.json()["data"]["id"]
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{admin_id}"),
-        json={"displayName": "hacked"},
-        headers={"Authorization": f"Bearer {editor_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.FORBIDDEN
-
-
-def test_deleted_user_session_is_revoked(signoz: types.SigNoz, get_token: Callable[[str, str], str]) -> None:
-    """Verify a deleted user's existing session stops authenticating immediately."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    user_id = create_active_user(signoz, admin_token, "revoked@integration.test", "signoz-viewer", "password123Z$", "revoked")
-    user_token = get_token("revoked@integration.test", "password123Z$")
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
-        headers={"Authorization": f"Bearer {user_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.OK
-
-    response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get("/api/v2/users/me"),
-        headers={"Authorization": f"Bearer {user_token}"},
-        timeout=5,
-    )
-    assert response.status_code == HTTPStatus.UNAUTHORIZED

tests/integration/tests/passwordauthn/08_user_unique_index.py

@@ -49,7 +49,7 @@ def test_unique_index_allows_multiple_deleted_rows(
             "userRoles": [{"id": find_role_by_name(signoz, admin_token, "signoz-editor")}],
         },
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
     assert resp.status_code == HTTPStatus.CREATED, resp.text
     first_user_id = resp.json()["data"]["id"]
@@ -57,7 +57,7 @@ def test_unique_index_allows_multiple_deleted_rows(
     resp = requests.delete(
         signoz.self.host_configs["8080"].get(f"/api/v2/users/{first_user_id}"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
     assert resp.status_code == HTTPStatus.NO_CONTENT
 
@@ -70,7 +70,7 @@ def test_unique_index_allows_multiple_deleted_rows(
             "userRoles": [{"id": find_role_by_name(signoz, admin_token, "signoz-editor")}],
         },
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
     assert resp.status_code == HTTPStatus.CREATED, resp.text
     second_user_id = resp.json()["data"]["id"]
@@ -79,7 +79,7 @@ def test_unique_index_allows_multiple_deleted_rows(
     resp = requests.delete(
         signoz.self.host_configs["8080"].get(f"/api/v2/users/{second_user_id}"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=2,
+        timeout=5,
     )
     assert resp.status_code == HTTPStatus.NO_CONTENT
 

tests/integration/tests/tracedetail/01_summary.py

@@ -1,280 +0,0 @@
-from collections.abc import Callable
-from datetime import UTC, datetime, timedelta
-from http import HTTPStatus
-
-import pytest
-import requests
-
-from fixtures import types
-from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
-from fixtures.querierai import root_span
-from fixtures.traces import TraceIdGenerator, Traces, TracesKind, TracesStatusCode
-
-WATERFALL_FIELDS = (
-    "startTimestampMillis",
-    "endTimestampMillis",
-    "rootServiceName",
-    "rootServiceEntryPoint",
-    "totalSpansCount",
-    "totalErrorSpansCount",
-    "hasMissingSpans",
-)
-
-
-@pytest.mark.parametrize("attribute_backend", ["map", "json"])
-def test_summary_ai_trace(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-    use_attribute_backend: Callable[[str], None],
-    attribute_backend: str,
-) -> None:
-    """The summary carries the waterfall's trace-level fields and, for a trace with gen_ai
-    spans, token totals over every LLM span and the cost summed over the spans that carry it.
-    Spans are written to one layout only, so a read from the wrong column sums to zero."""
-    use_attribute_backend(attribute_backend)
-    write_mode = "json_only" if attribute_backend == "json" else "legacy_only"
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    service = f"td-summary-{attribute_backend}"
-    resources = {"service.name": service}
-    trace_id = TraceIdGenerator.trace_id()
-    root_id = TraceIdGenerator.span_id()
-
-    insert_traces(
-        [
-            root_span(now=now, trace_id=trace_id, span_id=root_id, resources=resources, duration_s=4),
-            Traces(
-                timestamp=now - timedelta(seconds=4),
-                duration=timedelta(seconds=1),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="chat gpt-4o-mini",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attributes={
-                    "gen_ai.request.model": "gpt-4o-mini",
-                    "gen_ai.usage.input_tokens": 100,
-                    "gen_ai.usage.output_tokens": 20,
-                    "gen_ai.usage.cache_read.input_tokens": 7,
-                    "_signoz.gen_ai.total_cost": 0.01,
-                },
-                attribute_write_mode=write_mode,
-            ),
-            # a failed LLM call: counted in tokens and errors, but priced by nobody
-            Traces(
-                timestamp=now - timedelta(seconds=3),
-                duration=timedelta(seconds=0.5),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="chat gpt-4o-mini",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_ERROR,
-                resources=resources,
-                attributes={
-                    "gen_ai.request.model": "gpt-4o-mini",
-                    "gen_ai.usage.input_tokens": 50,
-                    "gen_ai.usage.output_tokens": 5,
-                },
-                attribute_write_mode=write_mode,
-            ),
-            Traces(
-                timestamp=now - timedelta(seconds=2),
-                duration=timedelta(seconds=0.5),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="execute_tool",
-                kind=TracesKind.SPAN_KIND_INTERNAL,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attributes={"gen_ai.tool.name": "get_weather"},
-                attribute_write_mode=write_mode,
-            ),
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    headers = {"authorization": f"Bearer {token}", "content-type": "application/json"}
-
-    summary = requests.get(signoz.self.host_configs["8080"].get(f"/api/v1/traces/{trace_id}/summary"), timeout=10, headers=headers)
-    assert summary.status_code == HTTPStatus.OK, summary.text
-    summary = summary.json()["data"]
-
-    waterfall = requests.post(
-        signoz.self.host_configs["8080"].get(f"/api/v4/traces/{trace_id}/waterfall"),
-        timeout=10,
-        headers=headers,
-        json={"selectedSpanId": "", "uncollapsedSpans": []},
-    )
-    assert waterfall.status_code == HTTPStatus.OK, waterfall.text
-    waterfall = waterfall.json()["data"]
-
-    assert {k: summary[k] for k in WATERFALL_FIELDS} == {k: waterfall[k] for k in WATERFALL_FIELDS}
-    assert summary["rootServiceName"] == service
-    assert summary["rootServiceEntryPoint"] == "POST /api/chat"
-    assert summary["totalSpansCount"] == 4
-    assert summary["totalErrorSpansCount"] == 1
-    assert summary["hasMissingSpans"] is False
-
-    assert summary["ai"]["tokens"] == {"input": 150, "output": 25, "cacheRead": 7, "cacheWrite": 0, "reasoning": 0}
-    assert summary["ai"]["totalCost"] == pytest.approx(0.01)
-
-
-def test_summary_ai_trace_across_json_rollout(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-    seed_attribute_evolution: Callable[[str, datetime], None],
-) -> None:
-    """A trace that straddles the attribute JSON rollout has LLM spans written only to the legacy
-    maps before it and to the JSON column after it. The summary window covers both, so the gen_ai
-    reads must fall back across columns and sum every span."""
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    rollout = now - timedelta(minutes=30)
-    seed_attribute_evolution("traces", rollout)
-
-    service = "td-summary-rollout"
-    resources = {"service.name": service}
-    trace_id = TraceIdGenerator.trace_id()
-    root_id = TraceIdGenerator.span_id()
-
-    insert_traces(
-        [
-            Traces(
-                timestamp=rollout - timedelta(minutes=10),
-                duration=timedelta(minutes=15),
-                trace_id=trace_id,
-                span_id=root_id,
-                parent_span_id="",
-                name="long agent run",
-                kind=TracesKind.SPAN_KIND_SERVER,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attribute_write_mode="legacy_only",
-            ),
-            Traces(
-                timestamp=rollout - timedelta(minutes=5),
-                duration=timedelta(seconds=1),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="chat gpt-4o-mini",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attributes={"gen_ai.request.model": "gpt-4o-mini", "gen_ai.usage.input_tokens": 100, "gen_ai.usage.output_tokens": 20, "_signoz.gen_ai.total_cost": 0.01},
-                attribute_write_mode="legacy_only",
-            ),
-            Traces(
-                timestamp=rollout + timedelta(minutes=4),
-                duration=timedelta(seconds=1),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=root_id,
-                name="chat gpt-4o-mini",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-                attributes={"gen_ai.request.model": "gpt-4o-mini", "gen_ai.usage.input_tokens": 50, "gen_ai.usage.output_tokens": 5, "_signoz.gen_ai.total_cost": 0.02},
-                attribute_write_mode="json_only",
-            ),
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    summary = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/traces/{trace_id}/summary"),
-        timeout=10,
-        headers={"authorization": f"Bearer {token}"},
-    )
-    assert summary.status_code == HTTPStatus.OK, summary.text
-    summary = summary.json()["data"]
-
-    assert summary["totalSpansCount"] == 3
-    assert summary["rootServiceEntryPoint"] == "long agent run"
-    assert summary["ai"]["tokens"] == {"input": 150, "output": 25, "cacheRead": 0, "cacheWrite": 0, "reasoning": 0}
-    assert summary["ai"]["totalCost"] == pytest.approx(0.03)
-
-
-def test_summary_non_ai_trace_with_missing_root(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    insert_traces: Callable[[list[Traces]], None],
-) -> None:
-    """A trace whose recorded spans all hang off an unrecorded parent reports the synthetic
-    "Missing Span" root exactly as the waterfall does, and a trace without gen_ai spans has
-    no `ai` block."""
-    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
-    resources = {"service.name": "td-summary-orphan"}
-    trace_id = TraceIdGenerator.trace_id()
-    missing_parent_id = TraceIdGenerator.span_id()
-
-    insert_traces(
-        [
-            Traces(
-                timestamp=now - timedelta(seconds=5),
-                duration=timedelta(seconds=2),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=missing_parent_id,
-                name="SELECT users",
-                kind=TracesKind.SPAN_KIND_CLIENT,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-            ),
-            Traces(
-                timestamp=now - timedelta(seconds=4),
-                duration=timedelta(seconds=1),
-                trace_id=trace_id,
-                span_id=TraceIdGenerator.span_id(),
-                parent_span_id=missing_parent_id,
-                name="publish event",
-                kind=TracesKind.SPAN_KIND_PRODUCER,
-                status_code=TracesStatusCode.STATUS_CODE_OK,
-                resources=resources,
-            ),
-        ]
-    )
-
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    headers = {"authorization": f"Bearer {token}", "content-type": "application/json"}
-
-    summary = requests.get(signoz.self.host_configs["8080"].get(f"/api/v1/traces/{trace_id}/summary"), timeout=10, headers=headers)
-    assert summary.status_code == HTTPStatus.OK, summary.text
-    summary = summary.json()["data"]
-
-    waterfall = requests.post(
-        signoz.self.host_configs["8080"].get(f"/api/v4/traces/{trace_id}/waterfall"),
-        timeout=10,
-        headers=headers,
-        json={"selectedSpanId": "", "uncollapsedSpans": []},
-    )
-    assert waterfall.status_code == HTTPStatus.OK, waterfall.text
-    waterfall = waterfall.json()["data"]
-
-    assert {k: summary[k] for k in WATERFALL_FIELDS} == {k: waterfall[k] for k in WATERFALL_FIELDS}
-    assert summary["hasMissingSpans"] is True
-    assert summary["rootServiceName"] == ""
-    assert summary["rootServiceEntryPoint"] == "Missing Span"
-    assert summary["totalSpansCount"] == 2
-    assert "ai" not in summary
-
-
-def test_summary_unknown_trace(
-    signoz: types.SigNoz,
-    create_user_admin: None,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-) -> None:
-    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/traces/{TraceIdGenerator.trace_id()}/summary"),
-        timeout=10,
-        headers={"authorization": f"Bearer {token}"},
-    )
-    assert response.status_code == HTTPStatus.NOT_FOUND, response.text