Merge remote-tracking branch 'origin/main' into issue_nerve_462

docs/api/openapi.yml

@@ -3659,7 +3659,8 @@ components:
       - logs-field
       - traces-field
       - metrics-field
-      - llm-pricing-rule
+      - span-mapper-group
+      - span-mapper
       type: string
     CoretypesObject:
       properties:
@@ -13764,9 +13765,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - llm-pricing-rule:list
+        - VIEWER
       - tokenizer:
-        - llm-pricing-rule:list
+        - VIEWER
       summary: List pricing rules
       tags:
       - llmpricingrules
@@ -13811,9 +13812,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - llm-pricing-rule:update
+        - ADMIN
       - tokenizer:
-        - llm-pricing-rule:update
+        - ADMIN
       summary: Create or update pricing rules
       tags:
       - llmpricingrules
@@ -13859,9 +13860,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - llm-pricing-rule:delete
+        - ADMIN
       - tokenizer:
-        - llm-pricing-rule:delete
+        - ADMIN
       summary: Delete a pricing rule
       tags:
       - llmpricingrules
@@ -13917,9 +13918,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - llm-pricing-rule:read
+        - VIEWER
       - tokenizer:
-        - llm-pricing-rule:read
+        - VIEWER
       summary: Get a pricing rule
       tags:
       - llmpricingrules
@@ -13972,9 +13973,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - llm-pricing-rule:list
+        - VIEWER
       - tokenizer:
-        - llm-pricing-rule:list
+        - VIEWER
       summary: List unmapped models
       tags:
       - llmpricingrules
@@ -15819,9 +15820,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - span-mapper-group:list
       - tokenizer:
-        - VIEWER
+        - span-mapper-group:list
       summary: List span attribute mapping groups
       tags:
       - spanmapper
@@ -15882,9 +15883,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper-group:create
       - tokenizer:
-        - ADMIN
+        - span-mapper-group:create
       summary: Create a span attribute mapping group
       tags:
       - spanmapper
@@ -15929,9 +15930,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper-group:delete
       - tokenizer:
-        - ADMIN
+        - span-mapper-group:delete
       summary: Delete a span attribute mapping group
       tags:
       - spanmapper
@@ -15987,9 +15988,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper-group:update
       - tokenizer:
-        - ADMIN
+        - span-mapper-group:update
       summary: Update a span attribute mapping group
       tags:
       - spanmapper
@@ -16052,9 +16053,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - span-mapper-group:read
       - tokenizer:
-        - VIEWER
+        - span-mapper-group:read
       summary: List span mappers for a group
       tags:
       - spanmapper
@@ -16127,9 +16128,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper:create
+        - span-mapper-group:attach
       - tokenizer:
-        - ADMIN
+        - span-mapper:create
+        - span-mapper-group:attach
       summary: Create a span mapper
       tags:
       - spanmapper
@@ -16179,9 +16182,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper:delete
+        - span-mapper-group:detach
       - tokenizer:
-        - ADMIN
+        - span-mapper:delete
+        - span-mapper-group:detach
       summary: Delete a span mapper
       tags:
       - spanmapper
@@ -16242,9 +16247,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper:update
       - tokenizer:
-        - ADMIN
+        - span-mapper:update
       summary: Update a span mapper
       tags:
       - spanmapper
@@ -16252,7 +16257,8 @@ paths:
   /api/v1/span_mapper_groups/test:
     post:
       deprecated: false
-      description: Tests how span mappers would transform sample spans
+      description: Tests how span mappers would transform sample spans. Groups sent
+        without mappers are read from the store by name.
       operationId: TestSpanMappers
       requestBody:
         content:
@@ -16306,9 +16312,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - span-mapper-group:read
       - tokenizer:
-        - VIEWER
+        - span-mapper-group:read
       summary: Test span mappers against sample spans
       tags:
       - spanmapper

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -3292,7 +3292,8 @@ export enum CoretypesKindDTO {
 	'logs-field' = 'logs-field',
 	'traces-field' = 'traces-field',
 	'metrics-field' = 'metrics-field',
-	'llm-pricing-rule' = 'llm-pricing-rule',
+	'span-mapper-group' = 'span-mapper-group',
+	'span-mapper' = 'span-mapper',
 }
 export enum CoretypesTypeDTO {
 	user = 'user',

frontend/src/api/generated/services/spanmapper/index.ts

@@ -803,7 +803,7 @@ export const useUpdateSpanMapper = <
 	return useMutation(getUpdateSpanMapperMutationOptions(options));
 };
 /**
- * Tests how span mappers would transform sample spans
+ * Tests how span mappers would transform sample spans. Groups sent without mappers are read from the store by name.
  * @summary Test span mappers against sample spans
  */
 export const testSpanMappers = (

frontend/src/schemas/generated/transactionGroups.schema.json

@@ -75,7 +75,8 @@
         "logs-field",
         "traces-field",
         "metrics-field",
-        "llm-pricing-rule"
+        "span-mapper-group",
+        "span-mapper"
       ],
       "type": "string"
     },

pkg/apiserver/signozapiserver/llmpricingrule.go

@@ -4,15 +4,14 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/llmpricingruletypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.List, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.List),
 		handler.OpenAPIDef{
 			ID:                  "ListLLMPricingRules",
 			Tags:                []string{"llmpricingrules"},
@@ -26,20 +25,14 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList)}),
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
 		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.CreateOrUpdate, authtypes.SigNozAdminRoleName),
+		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.CreateOrUpdate),
 		handler.OpenAPIDef{
 			ID:                 "CreateOrUpdateLLMPricingRules",
 			Tags:               []string{"llmpricingrules"},
@@ -50,20 +43,14 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:  http.StatusNoContent,
 			ErrorStatusCodes:   []int{http.StatusBadRequest},
 			Deprecated:         false,
-			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbUpdate)}),
+			SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
 		},
-		handler.WithResourceDefs(handler.TelemetryResourceDef{
-			Verb:      coretypes.VerbUpdate,
-			Category:  coretypes.ActionCategoryConfigurationChange,
-			Selector:  llmpricingruletypes.RuleSelector,
-			Resources: llmpricingruletypes.UpdatableRulesResources,
-		}),
 	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/unmapped_models", handler.New(
-		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.ListUnmappedModels, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.ListUnmappedModels),
 		handler.OpenAPIDef{
 			ID:                  "ListUnmappedLLMModels",
 			Tags:                []string{"llmpricingrules"},
@@ -76,20 +63,14 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList)}),
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
 		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
-			Verb:     coretypes.VerbList,
-			Category: coretypes.ActionCategoryDataAccess,
-			Selector: coretypes.WildcardSelector,
-		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Get, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.Get),
 		handler.OpenAPIDef{
 			ID:                  "GetLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -102,21 +83,14 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbRead)}),
+			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
 		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
-			Verb:     coretypes.VerbRead,
-			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Delete, authtypes.SigNozAdminRoleName),
+		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.Delete),
 		handler.OpenAPIDef{
 			ID:                  "DeleteLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -129,15 +103,8 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbDelete)}),
+			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
 		},
-		handler.WithResourceDefs(handler.BasicResourceDef{
-			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
-			Verb:     coretypes.VerbDelete,
-			Category: coretypes.ActionCategoryConfigurationChange,
-			ID:       coretypes.PathParam("id"),
-			Selector: coretypes.IDSelector,
-		}),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

pkg/apiserver/signozapiserver/spanmapper.go

@@ -4,14 +4,15 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/spantypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 	if err := router.Handle("/api/v1/span_mapper_groups", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.spanMapperHandler.ListGroups),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.ListGroups, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListSpanMapperGroups",
 			Tags:                []string{"spanmapper"},
@@ -25,14 +26,20 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.CreateGroup),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.CreateGroup, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "CreateSpanMapperGroup",
 			Tags:                []string{"spanmapper"},
@@ -45,19 +52,26 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusCreated,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbCreate)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/test", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.spanMapperHandler.TestMappers),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.TestMappers, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "TestSpanMappers",
 			Tags:                []string{"spanmapper"},
 			Summary:             "Test span mappers against sample spans",
-			Description:         "Tests how span mappers would transform sample spans",
+			Description:         "Tests how span mappers would transform sample spans. Groups sent without mappers are read from the store by name.",
 			Request:             new(spantypes.PostableSpanMapperTest),
 			RequestContentType:  "application/json",
 			Response:            new(spantypes.GettableSpanMapperTest),
@@ -65,14 +79,20 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.UpdateGroup),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.UpdateGroup, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                 "UpdateSpanMapperGroup",
 			Tags:               []string{"spanmapper"},
@@ -83,14 +103,21 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:  http.StatusNoContent,
 			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:         false,
-			SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("groupId"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.DeleteGroup),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.DeleteGroup, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "DeleteSpanMapperGroup",
 			Tags:                []string{"spanmapper"},
@@ -103,14 +130,21 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbDelete)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("groupId"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}/span_mappers", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.spanMapperHandler.ListMappers),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.ListMappers, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListSpanMappers",
 			Tags:                []string{"spanmapper"},
@@ -123,14 +157,21 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("groupId"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}/span_mappers", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.CreateMapper),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.CreateMapper, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "CreateSpanMapper",
 			Tags:                []string{"spanmapper"},
@@ -143,14 +184,32 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusCreated,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound, http.StatusConflict},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapper.Scope(coretypes.VerbCreate), coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbAttach)}),
 		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceSpanMapper,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachParentChildResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				ParentResource: coretypes.ResourceMetaResourceSpanMapperGroup,
+				ParentID:       coretypes.PathParam("groupId"),
+				ParentSelector: coretypes.IDSelector,
+				ChildResource:  coretypes.ResourceMetaResourceSpanMapper,
+				ChildIDs:       coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+			},
+		),
 	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}/span_mappers/{mapperId}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.UpdateMapper),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.UpdateMapper, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                 "UpdateSpanMapper",
 			Tags:               []string{"spanmapper"},
@@ -161,14 +220,21 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:  http.StatusNoContent,
 			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:         false,
-			SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapper.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapper,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("mapperId"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}/span_mappers/{mapperId}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.DeleteMapper),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.DeleteMapper, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "DeleteSpanMapper",
 			Tags:                []string{"spanmapper"},
@@ -181,8 +247,26 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapper.Scope(coretypes.VerbDelete), coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbDetach)}),
 		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceSpanMapper,
+				Verb:     coretypes.VerbDelete,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("mapperId"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachParentChildResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				ParentResource: coretypes.ResourceMetaResourceSpanMapperGroup,
+				ParentID:       coretypes.PathParam("groupId"),
+				ParentSelector: coretypes.IDSelector,
+				ChildResource:  coretypes.ResourceMetaResourceSpanMapper,
+				ChildIDs:       coretypes.OneID(coretypes.PathParam("mapperId")),
+			},
+		),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

pkg/signoz/provider.go

@@ -265,7 +265,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewBackfillTelegramChannelSpecFactory(),
 		sqlmigration.NewAddMetricsFieldTuplesFactory(sqlstore),
 		sqlmigration.NewAddGCPConnectionMethodFactory(),
-		sqlmigration.NewAddLLMPricingRuleTuplesFactory(sqlstore),
+		sqlmigration.NewAddSpanMapperTuplesFactory(sqlstore),
 	)
 }
 

pkg/sqlmigration/140_add_span_mapper_tuples.go

@@ -16,21 +16,21 @@ import (
 	"github.com/uptrace/bun/migrate"
 )
 
-type addLLMPricingRuleTuples struct {
+type addSpanMapperTuples struct {
 	sqlstore sqlstore.SQLStore
 }
 
-func NewAddLLMPricingRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(factory.MustNewName("add_llm_pricing_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-		return &addLLMPricingRuleTuples{sqlstore: sqlstore}, nil
+func NewAddSpanMapperTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_span_mapper_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addSpanMapperTuples{sqlstore: sqlstore}, nil
 	})
 }
 
-func (migration *addLLMPricingRuleTuples) Register(migrations *migrate.Migrations) error {
+func (migration *addSpanMapperTuples) Register(migrations *migrate.Migrations) error {
 	return migrations.Register(migration.Up, migration.Down)
 }
 
-func (migration *addLLMPricingRuleTuples) Up(ctx context.Context, db *bun.DB) error {
+func (migration *addSpanMapperTuples) Up(ctx context.Context, db *bun.DB) error {
 	tx, err := db.BeginTx(ctx, nil)
 	if err != nil {
 		return err
@@ -55,14 +55,20 @@ func (migration *addLLMPricingRuleTuples) Up(ctx context.Context, db *bun.DB) er
 	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
 
 	tuples := []migrationTuple{
-		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "read"},
-		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "update"},
-		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "delete"},
-		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "list"},
-		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "read"},
-		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "list"},
-		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "read"},
-		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "list"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper-group", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper-group", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper-group", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper-group", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper-group", "list"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper-group", "attach"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper-group", "detach"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "span-mapper", "create"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "span-mapper-group", "read"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "span-mapper-group", "list"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "span-mapper-group", "read"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "span-mapper-group", "list"},
 	}
 
 	for _, orgID := range orgIDs {
@@ -157,6 +163,6 @@ func (migration *addLLMPricingRuleTuples) Up(ctx context.Context, db *bun.DB) er
 	return tx.Commit()
 }
 
-func (migration *addLLMPricingRuleTuples) Down(context.Context, *bun.DB) error {
+func (migration *addSpanMapperTuples) Down(context.Context, *bun.DB) error {
 	return nil
 }

pkg/types/coretypes/kind.go

@@ -80,7 +80,8 @@ func (name Kind) Enum() []any {
 		KindLogsField,
 		KindTracesField,
 		KindMetricsField,
-		KindLLMPricingRule,
+		KindSpanMapperGroup,
+		KindSpanMapper,
 	}
 }
 

pkg/types/coretypes/registry_kind.go

@@ -40,7 +40,8 @@ var Kinds = []Kind{
 	KindLogsField,
 	KindTracesField,
 	KindMetricsField,
-	KindLLMPricingRule,
+	KindSpanMapperGroup,
+	KindSpanMapper,
 }
 
 var (
@@ -83,5 +84,6 @@ var (
 	KindLogsField                    = MustNewKind("logs-field")
 	KindTracesField                  = MustNewKind("traces-field")
 	KindMetricsField                 = MustNewKind("metrics-field")
-	KindLLMPricingRule               = MustNewKind("llm-pricing-rule")
+	KindSpanMapperGroup              = MustNewKind("span-mapper-group")
+	KindSpanMapper                   = MustNewKind("span-mapper")
 )

pkg/types/coretypes/registry_managed_role.go

@@ -218,11 +218,17 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
-		// llm-pricing-rule — admin writes, viewer reads
-		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
-		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
-		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
-		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		// span-mapper-group and span-mapper — admin manages, viewer reads
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapper}, WildCardSelectorString)},
+		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapper}, WildCardSelectorString)},
+		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapper}, WildCardSelectorString)},
 	},
 	SigNozEditorRoleName: {
 		// cloud-integration — editor can read accounts
@@ -322,9 +328,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
-		// llm-pricing-rule — read only (admin writes)
-		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
-		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		// span-mapper-group — read only (admin manages)
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
 	},
 	SigNozViewerRoleName: {
 		// cloud-integration — viewer can read accounts
@@ -389,9 +395,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// metrics-field — viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
-		// llm-pricing-rule — read only
-		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
-		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		// span-mapper-group — read only
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
 	},
 	SigNozAnonymousRoleName: {
 		// public-dashboard — anonymous read

pkg/types/coretypes/registry_resource.go

@@ -40,7 +40,8 @@ var Resources = []Resource{
 	ResourceMetaResourceLogsField,
 	ResourceMetaResourceTracesField,
 	ResourceMetaResourceMetricsField,
-	ResourceMetaResourceLLMPricingRule,
+	ResourceMetaResourceSpanMapperGroup,
+	ResourceMetaResourceSpanMapper,
 }
 
 var (
@@ -83,5 +84,6 @@ var (
 	ResourceMetaResourceLogsField                        = NewResourceMetaResource(KindLogsField)
 	ResourceMetaResourceTracesField                      = NewResourceMetaResource(KindTracesField)
 	ResourceMetaResourceMetricsField                     = NewResourceMetaResource(KindMetricsField, VerbList, VerbRead, VerbUpdate)
-	ResourceMetaResourceLLMPricingRule                   = NewResourceMetaResource(KindLLMPricingRule, VerbList, VerbRead, VerbUpdate, VerbDelete)
+	ResourceMetaResourceSpanMapperGroup                  = NewResourceMetaResource(KindSpanMapperGroup)
+	ResourceMetaResourceSpanMapper                       = NewResourceMetaResource(KindSpanMapper, VerbCreate, VerbUpdate, VerbDelete)
 )

pkg/types/llmpricingruletypes/resource.go

@@ -1,62 +0,0 @@
-package llmpricingruletypes
-
-import (
-	"context"
-	"slices"
-
-	"github.com/tidwall/gjson"
-
-	"github.com/SigNoz/signoz/pkg/errors"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
-
-// UpdatableRulesResources resolves the pricing rules an upsert body writes to.
-//
-// A rule with isOverride and an id is an edit, checked by that id. Everything
-// else resolves to the wildcard: isOverride without an id is a create, sourceId
-// without isOverride is a sync row, and an empty list has nothing to check.
-func UpdatableRulesResources(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-	rules := gjson.GetBytes(ec.RequestBody, "rules").Array()
-
-	ids := make([]string, 0, len(rules))
-	wildcard := len(rules) == 0
-	for _, rule := range rules {
-		rawID := rule.Get("id").String()
-		isOverride := rule.Get("isOverride").Type
-		if rawID == "" || (isOverride != gjson.True && isOverride != gjson.False) {
-			wildcard = true
-			continue
-		}
-
-		// Normalised through valuer so an uppercase id still matches the
-		// lowercase selector regex of the metaresource type.
-		id, err := valuer.NewUUID(rawID)
-		if err != nil {
-			return nil, errors.Wrapf(err, errors.TypeInvalidInput, ErrCodePricingRuleInvalidInput, "rule id %q is not a valid uuid", rawID)
-		}
-		if !slices.Contains(ids, id.StringValue()) {
-			ids = append(ids, id.StringValue())
-		}
-	}
-	if wildcard {
-		ids = append(ids, coretypes.WildCardSelectorString)
-	}
-
-	resources := make([]coretypes.ResourceWithID, 0, len(ids))
-	for _, id := range ids {
-		resources = append(resources, coretypes.ResourceWithID{Resource: coretypes.ResourceMetaResourceLLMPricingRule, ID: id})
-	}
-
-	return resources, nil
-}
-
-// RuleSelector exists because IDSelector would turn the wildcard entry into
-// the wildcard twice; an id still resolves to the id plus the wildcard.
-func RuleSelector(ctx context.Context, resource coretypes.Resource, id string, orgID valuer.UUID) ([]coretypes.Selector, error) {
-	if id == coretypes.WildCardSelectorString {
-		return coretypes.WildcardSelector(ctx, resource, id, orgID)
-	}
-
-	return coretypes.IDSelector(ctx, resource, id, orgID)
-}

pkg/types/llmpricingruletypes/resource_test.go

@@ -1,106 +0,0 @@
-package llmpricingruletypes
-
-import (
-	"context"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	"github.com/SigNoz/signoz/pkg/valuer"
-)
-
-func TestUpdatableRulesResources(t *testing.T) {
-	testCases := []struct {
-		name    string
-		body    string
-		want    []string
-		wantErr bool
-	}{
-		{
-			name: "EmptyRules_Wildcard",
-			body: `{"rules":[]}`,
-			want: []string{"*"},
-		},
-		{
-			name: "Edit_ID",
-			body: `{"rules":[{"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}]}`,
-			want: []string{"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e"},
-		},
-		{
-			name: "Create_Wildcard",
-			body: `{"rules":[{"modelName":"gpt","isOverride":true}]}`,
-			want: []string{"*"},
-		},
-		{
-			name: "SyncRow_Wildcard",
-			body: `{"rules":[{"sourceId":"4e9a0b12-3c4d-4e5f-8a6b-7c8d9e0f1a2b"}]}`,
-			want: []string{"*"},
-		},
-		{
-			name: "Mixed_DedupedIDsThenWildcardOnce",
-			body: `{"rules":[{"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true},{"modelName":"new","isOverride":true},{"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":false},{"sourceId":"7bcd3e45-6f7a-4b8c-9d9e-0f1a2b3c4d5e"}]}`,
-			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d", "*"},
-		},
-		{
-			name: "UppercaseID_Lowercased",
-			body: `{"rules":[{"id":"8CDE4F56-7A8B-4C9D-8E0F-1A2B3C4D5E6F","isOverride":true}]}`,
-			want: []string{"8cde4f56-7a8b-4c9d-8e0f-1a2b3c4d5e6f"},
-		},
-		{
-			name:    "InvalidID_Rejected",
-			body:    `{"rules":[{"id":"not-a-uuid","isOverride":true}]}`,
-			wantErr: true,
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			resources, err := UpdatableRulesResources(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
-			if testCase.wantErr {
-				require.Error(t, err)
-				return
-			}
-
-			require.NoError(t, err)
-			got := make([]string, 0, len(resources))
-			for _, resource := range resources {
-				got = append(got, resource.ID)
-			}
-			assert.Equal(t, testCase.want, got)
-		})
-	}
-}
-
-func TestRuleSelector(t *testing.T) {
-	testCases := []struct {
-		name string
-		id   string
-		want []string
-	}{
-		{
-			name: "Wildcard_WildcardOnly",
-			id:   "*",
-			want: []string{"*"},
-		},
-		{
-			name: "ID_IDThenWildcard",
-			id:   "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
-			want: []string{"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "*"},
-		},
-	}
-
-	for _, testCase := range testCases {
-		t.Run(testCase.name, func(t *testing.T) {
-			selectors, err := RuleSelector(context.Background(), coretypes.ResourceMetaResourceLLMPricingRule, testCase.id, valuer.GenerateUUID())
-			require.NoError(t, err)
-
-			got := make([]string, 0, len(selectors))
-			for _, selector := range selectors {
-				got = append(got, selector.String())
-			}
-			assert.Equal(t, testCase.want, got)
-		})
-	}
-}

tests/integration/testdata/role/managed_role_transactions.json

@@ -299,12 +299,24 @@
     },
     {
       "type": "metaresource",
-      "kind": "llm-pricing-rule",
+      "kind": "span-mapper-group",
       "verbs": [
         "read",
         "update",
         "delete",
-        "list"
+        "create",
+        "list",
+        "attach",
+        "detach"
+      ]
+    },
+    {
+      "type": "metaresource",
+      "kind": "span-mapper",
+      "verbs": [
+        "update",
+        "delete",
+        "create"
       ]
     },
     {
@@ -540,7 +552,7 @@
     },
     {
       "type": "metaresource",
-      "kind": "llm-pricing-rule",
+      "kind": "span-mapper-group",
       "verbs": [
         "read",
         "list"
@@ -727,7 +739,7 @@
     },
     {
       "type": "metaresource",
-      "kind": "llm-pricing-rule",
+      "kind": "span-mapper-group",
       "verbs": [
         "read",
         "list"

tests/integration/tests/llmpricingrules/02_authz.py

@@ -1,267 +0,0 @@
-from collections.abc import Callable
-from http import HTTPStatus
-
-import pytest
-import requests
-from wiremock.resources.mappings import Mapping
-
-from fixtures import types
-from fixtures.auth import (
-    USER_ADMIN_EMAIL,
-    USER_ADMIN_PASSWORD,
-    add_license,
-    change_user_role,
-    create_active_user,
-)
-from fixtures.llmpricingrules import (
-    LLM_PRICING_RULES_URL,
-    delete_all_llm_pricing_rules,
-    list_llm_pricing_rules,
-    upsert_llm_pricing_rules,
-)
-from fixtures.role import find_role_by_name, transaction_group
-
-user_password = "password123Z$"
-editor_email = "llm-pricing-editor@integration.test"
-viewer_email = "llm-pricing-viewer@integration.test"
-updater_role = "llm-pricing-updater"
-updater_email = "llm-pricing-updater@integration.test"
-scoped_role = "llm-pricing-scoped"
-scoped_email = "llm-pricing-scoped@integration.test"
-
-PROBE_RULE = {
-    "modelName": "authz-probe",
-    "provider": "OpenAI",
-    "modelPattern": ["authz-probe*"],
-    "unit": "per_million_tokens",
-    "pricing": {"input": 1, "output": 2},
-    "isOverride": True,
-    "enabled": True,
-}
-
-OTHER_RULE = {
-    "modelName": "authz-probe-other",
-    "provider": "Anthropic",
-    "modelPattern": ["authz-probe-other*"],
-    "unit": "per_million_tokens",
-    "pricing": {"input": 3, "output": 4},
-    "isOverride": True,
-    "enabled": True,
-}
-
-
-def test_setup(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
-    get_token: Callable[[str, str], str],
-    create_role: Callable[..., str],
-) -> None:
-    add_license(signoz, make_http_mocks, get_token)
-
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    delete_all_llm_pricing_rules(signoz, admin_token)
-    assert upsert_llm_pricing_rules(signoz, admin_token, [PROBE_RULE, OTHER_RULE]).status_code == HTTPStatus.NO_CONTENT
-    probe_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
-
-    create_active_user(signoz, admin_token, email=editor_email, role="signoz-editor", password=user_password)
-    create_active_user(signoz, admin_token, email=viewer_email, role="signoz-viewer", password=user_password)
-
-    create_role(admin_token, updater_role, [transaction_group("update", "metaresource", "llm-pricing-rule", ["*"])])
-    updater = create_active_user(signoz, admin_token, email=updater_email, role="signoz-viewer", password=user_password)
-    change_user_role(signoz, admin_token, updater, "signoz-viewer", updater_role)
-
-    create_role(
-        admin_token,
-        scoped_role,
-        [
-            transaction_group("read", "metaresource", "llm-pricing-rule", [probe_id]),
-            transaction_group("update", "metaresource", "llm-pricing-rule", [probe_id]),
-            transaction_group("delete", "metaresource", "llm-pricing-rule", [probe_id]),
-        ],
-    )
-    scoped = create_active_user(signoz, admin_token, email=scoped_email, role="signoz-viewer", password=user_password)
-    change_user_role(signoz, admin_token, scoped, "signoz-viewer", scoped_role)
-
-
-@pytest.mark.parametrize(
-    "path",
-    [LLM_PRICING_RULES_URL, f"{LLM_PRICING_RULES_URL}/unmapped_models"],
-    ids=["list", "unmapped_models"],
-)
-@pytest.mark.parametrize(
-    ("email", "expected"),
-    [
-        (USER_ADMIN_EMAIL, HTTPStatus.OK),
-        (editor_email, HTTPStatus.OK),
-        (viewer_email, HTTPStatus.OK),
-        (updater_email, HTTPStatus.FORBIDDEN),
-        (scoped_email, HTTPStatus.FORBIDDEN),
-    ],
-    ids=["admin", "editor", "viewer", "updater", "scoped"],
-)
-def test_reads_need_list_grant(
-    signoz: types.SigNoz,
-    get_token: Callable[[str, str], str],
-    path: str,
-    email: str,
-    expected: HTTPStatus,
-) -> None:
-    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(path),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=10,
-    )
-    assert response.status_code == expected, response.text
-    if expected == HTTPStatus.FORBIDDEN:
-        assert "llm-pricing-rule:list" in response.text
-
-
-@pytest.mark.parametrize(
-    ("email", "model_name", "expected"),
-    [
-        (USER_ADMIN_EMAIL, PROBE_RULE["modelName"], HTTPStatus.OK),
-        (editor_email, PROBE_RULE["modelName"], HTTPStatus.OK),
-        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.OK),
-        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
-        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.OK),
-        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
-    ],
-    ids=["admin", "editor", "viewer", "updater", "scoped_granted", "scoped_other"],
-)
-def test_get_needs_read_grant(
-    signoz: types.SigNoz,
-    get_token: Callable[[str, str], str],
-    email: str,
-    model_name: str,
-    expected: HTTPStatus,
-) -> None:
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
-    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
-
-    response = requests.get(
-        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=10,
-    )
-    assert response.status_code == expected, response.text
-    if expected == HTTPStatus.FORBIDDEN:
-        assert "llm-pricing-rule:read" in response.text
-
-
-@pytest.mark.parametrize(
-    ("email", "expected"),
-    [
-        (editor_email, HTTPStatus.FORBIDDEN),
-        (viewer_email, HTTPStatus.FORBIDDEN),
-        (scoped_email, HTTPStatus.NO_CONTENT),
-        (updater_email, HTTPStatus.NO_CONTENT),
-        (USER_ADMIN_EMAIL, HTTPStatus.NO_CONTENT),
-    ],
-    ids=["editor", "viewer", "scoped", "updater", "admin"],
-)
-def test_upsert_needs_update_grant(
-    signoz: types.SigNoz,
-    get_token: Callable[[str, str], str],
-    email: str,
-    expected: HTTPStatus,
-) -> None:
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
-    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
-
-    response = upsert_llm_pricing_rules(signoz, token, [{**PROBE_RULE, "id": rule_id}])
-    assert response.status_code == expected, response.text
-    if expected == HTTPStatus.FORBIDDEN:
-        assert "llm-pricing-rule:update" in response.text
-
-
-@pytest.mark.parametrize(
-    "shape",
-    ["other_rule", "create", "sync_row", "own_and_other"],
-    ids=["other_rule", "create", "sync_row", "own_and_other"],
-)
-def test_upsert_scoped_to_granted_rule(
-    signoz: types.SigNoz,
-    get_token: Callable[[str, str], str],
-    shape: str,
-) -> None:
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    rules = {r["modelName"]: r for r in list_llm_pricing_rules(signoz, admin_token)}
-    own = {**PROBE_RULE, "id": rules[PROBE_RULE["modelName"]]["id"]}
-    other = {**OTHER_RULE, "id": rules[OTHER_RULE["modelName"]]["id"]}
-    sync_row = {**{k: v for k, v in PROBE_RULE.items() if k != "isOverride"}, "sourceId": "11111111-1111-4111-8111-111111111199"}
-    bodies = {"other_rule": [other], "create": [PROBE_RULE], "sync_row": [sync_row], "own_and_other": [own, other]}
-
-    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), bodies[shape])
-    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
-    assert "llm-pricing-rule:update" in response.text
-
-
-def test_revoke_update_grant(
-    signoz: types.SigNoz,
-    get_token: Callable[[str, str], str],
-) -> None:
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, scoped_role)}"),
-        json={
-            "description": "",
-            "transactionGroups": [
-                transaction_group("read", "metaresource", "llm-pricing-rule", [rule_id]),
-                transaction_group("delete", "metaresource", "llm-pricing-rule", [rule_id]),
-            ],
-        },
-        headers={"Authorization": f"Bearer {admin_token}"},
-        timeout=10,
-    )
-    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
-
-    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), [{**PROBE_RULE, "id": rule_id}])
-    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
-    assert "llm-pricing-rule:update" in response.text
-
-
-@pytest.mark.parametrize(
-    ("email", "model_name", "expected"),
-    [
-        (editor_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
-        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
-        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
-        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
-        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.NO_CONTENT),
-        (USER_ADMIN_EMAIL, OTHER_RULE["modelName"], HTTPStatus.NO_CONTENT),
-    ],
-    ids=["editor", "viewer", "updater", "scoped_other", "scoped_granted", "admin"],
-)
-def test_delete_needs_delete_grant(
-    signoz: types.SigNoz,
-    get_token: Callable[[str, str], str],
-    email: str,
-    model_name: str,
-    expected: HTTPStatus,
-) -> None:
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
-    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
-
-    response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
-        headers={"Authorization": f"Bearer {token}"},
-        timeout=10,
-    )
-    assert response.status_code == expected, response.text
-    if expected == HTTPStatus.FORBIDDEN:
-        assert "llm-pricing-rule:delete" in response.text
-
-
-def test_cleanup(
-    signoz: types.SigNoz,
-    get_token: Callable[[str, str], str],
-) -> None:
-    delete_all_llm_pricing_rules(signoz, get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD))

tests/integration/tests/spanmapper/03_authz.py

@@ -0,0 +1,355 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import pytest
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+    find_user_by_email,
+)
+from fixtures.role import find_role_by_name, transaction_group
+from fixtures.types import Operation, SigNoz, TestContainerDocker
+
+GROUPS_PATH = "/api/v1/span_mapper_groups"
+
+_EDITOR_EMAIL = "editor+spanmapperauthz@integration.test"
+_VIEWER_EMAIL = "viewer+spanmapperauthz@integration.test"
+_ACTOR_ROLE_NAME = "span-mapper-fga-actor"
+_ACTOR_EMAIL = "customrole+spanmapperauthz@integration.test"
+_PASSWORD = "password123Z$"
+
+# Instance verbs are granted on _TARGET_A and its mapper only; _TARGET_B must stay forbidden.
+_TARGET_A = "span-mapper-authz-target-a"
+_TARGET_B = "span-mapper-authz-target-b"
+
+_MAPPER = {
+    "name": "span_mapper_authz.target",
+    "fieldContext": "attribute",
+    "config": {"sources": [{"key": "authz.source", "context": "attribute", "operation": "copy", "priority": 1, "enabled": True}]},
+    "enabled": True,
+}
+
+_SIMULATE = {
+    "spans": [{"attributes": {"authz.source": "x"}, "resource": {}}],
+    "groups": [{"name": _TARGET_A, "condition": {"attributes": [{"value": "authz.a", "enabled": True}], "resource": []}, "enabled": True}],
+}
+
+
+def test_setup_users_and_targets(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {admin_token}"}
+
+    # A --reuse stack may already hold part of this state; create only what is missing.
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v2/users"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_emails = {user["email"] for user in response.json()["data"]}
+    for email, role in ((_EDITOR_EMAIL, "signoz-editor"), (_VIEWER_EMAIL, "signoz-viewer")):
+        if email not in existing_emails:
+            create_active_user(signoz, admin_token, email=email, role=role, password=_PASSWORD)
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_groups = {group["name"] for group in response.json()["data"]["items"]}
+    for name, substring in ((_TARGET_A, "authz.a"), (_TARGET_B, "authz.b")):
+        if name in existing_groups:
+            continue
+        response = requests.post(
+            signoz.self.host_configs["8080"].get(GROUPS_PATH),
+            json={"name": name, "condition": {"attributes": [{"value": substring, "enabled": True}], "resource": []}, "enabled": True},
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {group["name"]: group["id"] for group in response.json()["data"]["items"]}
+    for name in (_TARGET_A, _TARGET_B):
+        response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[name]}/span_mappers"), headers=headers, timeout=5)
+        assert response.status_code == HTTPStatus.OK, response.text
+        if any(mapper["name"] == _MAPPER["name"] for mapper in response.json()["data"]["items"]):
+            continue
+        response = requests.post(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[name]}/span_mappers"), json=_MAPPER, headers=headers, timeout=5)
+        assert response.status_code == HTTPStatus.CREATED, response.text
+
+
+def test_mapper_is_only_reachable_through_its_own_group(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    # The authz check on the mapper routes trusts the group id in the path, so the
+    # store must refuse a mapper addressed through another group.
+    headers = {"Authorization": f"Bearer {get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {group["name"]: group["id"] for group in response.json()["data"]["items"]}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    mapper_b = response.json()["data"]["items"][0]["id"]
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{mapper_b}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_FOUND, f"update B's mapper via A: expected 404, got {response.status_code}: {response.text}"
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{mapper_b}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_FOUND, f"delete B's mapper via A: expected 404, got {response.status_code}: {response.text}"
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    assert {mapper["id"] for mapper in response.json()["data"]["items"]} == {mapper_b}
+
+
+@pytest.mark.parametrize("email", [_VIEWER_EMAIL, _EDITOR_EMAIL], ids=["viewer", "editor"])
+def test_managed_readers_allowed_on_reads_and_simulate(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    email: str,
+):
+    headers = {"Authorization": f"Bearer {get_token(email, _PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_a = {group["name"]: group["id"] for group in response.json()["data"]["items"]}[_TARGET_A]
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{target_a}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    assert {mapper["name"] for mapper in response.json()["data"]["items"]} == {_MAPPER["name"]}
+
+    response = requests.post(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/test"), json=_SIMULATE, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+
+
+@pytest.mark.parametrize("email", [_VIEWER_EMAIL, _EDITOR_EMAIL], ids=["viewer", "editor"])
+def test_managed_readers_forbidden_on_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    email: str,
+):
+    headers = {"Authorization": f"Bearer {get_token(email, _PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_a = {group["name"]: group["id"] for group in response.json()["data"]["items"]}[_TARGET_A]
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{target_a}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    mapper_id = response.json()["data"]["items"][0]["id"]
+
+    for method, path, body in (
+        ("POST", GROUPS_PATH, {"name": "span-mapper-authz-denied", "condition": {"attributes": [{"value": "authz.denied", "enabled": True}], "resource": []}, "enabled": True}),
+        ("PATCH", f"{GROUPS_PATH}/{target_a}", {"enabled": True}),
+        ("DELETE", f"{GROUPS_PATH}/{target_a}", None),
+        ("POST", f"{GROUPS_PATH}/{target_a}/span_mappers", {**_MAPPER, "name": "span_mapper_authz.denied"}),
+        ("PATCH", f"{GROUPS_PATH}/{target_a}/span_mappers/{mapper_id}", {"enabled": True}),
+        ("DELETE", f"{GROUPS_PATH}/{target_a}/span_mappers/{mapper_id}", None),
+    ):
+        response = requests.request(method, signoz.self.host_configs["8080"].get(path), json=body, headers=headers, timeout=5)
+        assert response.status_code == HTTPStatus.FORBIDDEN, f"{method} {path}: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_apply_license(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+
+def test_setup_scoped_actor(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {admin_token}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_a = {group["name"]: group["id"] for group in response.json()["data"]["items"]}[_TARGET_A]
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{target_a}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    mapper_a = response.json()["data"]["items"][0]["id"]
+
+    # Adding a mapper needs create on the collection plus attach on the group;
+    # removing one needs delete on the mapper plus detach on the group.
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v1/roles"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    if not any(role["name"] == _ACTOR_ROLE_NAME for role in response.json()["data"]):
+        create_role(
+            admin_token,
+            _ACTOR_ROLE_NAME,
+            [
+                transaction_group("list", "metaresource", "span-mapper-group", ["*"]),
+                transaction_group("read", "metaresource", "span-mapper-group", [target_a]),
+                transaction_group("update", "metaresource", "span-mapper-group", [target_a]),
+                transaction_group("attach", "metaresource", "span-mapper-group", [target_a]),
+                transaction_group("detach", "metaresource", "span-mapper-group", [target_a]),
+                transaction_group("create", "metaresource", "span-mapper", ["*"]),
+                transaction_group("delete", "metaresource", "span-mapper", ["*"]),
+                transaction_group("update", "metaresource", "span-mapper", [mapper_a]),
+            ],
+        )
+
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v2/users"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    actor = next((user for user in response.json()["data"] if user["email"] == _ACTOR_EMAIL), None)
+    user_id = actor["id"] if actor else create_active_user(signoz, admin_token, email=_ACTOR_EMAIL, role="signoz-viewer", password=_PASSWORD)
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    if not any(ur["role"]["name"] == _ACTOR_ROLE_NAME for ur in response.json()["data"]["userRoles"]):
+        change_user_role(signoz, admin_token, user_id, "signoz-viewer", _ACTOR_ROLE_NAME)
+
+
+def test_access_scoped_to_granted_group_and_mapper(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    headers = {"Authorization": f"Bearer {get_token(_ACTOR_EMAIL, _PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {group["name"]: group["id"] for group in response.json()["data"]["items"]}
+    assert {_TARGET_A, _TARGET_B} <= set(ids)
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, f"list granted group's mappers: {response.text}"
+    mapper_a = response.json()["data"]["items"][0]["id"]
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"list other group's mappers: expected 403, got {response.status_code}: {response.text}"
+
+    # Simulate reads saved groups by name, so it needs read on every group.
+    response = requests.post(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/test"), json=_SIMULATE, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"simulate: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"update granted group: {response.text}"
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"update other group: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers"),
+        json={**_MAPPER, "name": "span_mapper_authz.actor"},
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, f"create mapper in granted group: {response.text}"
+    created = response.json()["data"]["id"]
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{created}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"delete mapper in granted group: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"),
+        json={**_MAPPER, "name": "span_mapper_authz.actor"},
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"create mapper in other group: expected 403, got {response.status_code}: {response.text}"
+
+    # Mapper update is checked on the mapper itself, so the grant on A's mapper
+    # does not extend to B's.
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{mapper_a}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"update granted mapper: {response.text}"
+
+    admin_headers = {"Authorization": f"Bearer {get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)}"}
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"), headers=admin_headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    mapper_b = response.json()["data"]["items"][0]["id"]
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers/{mapper_b}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"update other mapper: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers/{mapper_b}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"delete other mapper: expected 403, got {response.status_code}: {response.text}"
+
+    # detach on A plus delete on "*" passes authz for B's mapper addressed through
+    # A's path; the store must still refuse it.
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{mapper_b}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_FOUND, f"delete B's mapper via A: expected 404, got {response.status_code}: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(GROUPS_PATH),
+        json={"name": "span-mapper-authz-actor", "condition": {"attributes": [{"value": "authz.actor", "enabled": True}], "resource": []}, "enabled": True},
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"create group: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"delete granted group: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_revoke_group_read(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    admin_headers = {"Authorization": f"Bearer {admin_token}"}
+    headers = {"Authorization": f"Bearer {get_token(_ACTOR_EMAIL, _PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=admin_headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_a = {group["name"]: group["id"] for group in response.json()["data"]["items"]}[_TARGET_A]
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{target_a}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, f"read before revoke: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, _ACTOR_ROLE_NAME)}"),
+        json={"description": "", "transactionGroups": [transaction_group("list", "metaresource", "span-mapper-group", ["*"])]},
+        headers=admin_headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{target_a}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"read after revoke: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_span_mapper_authz_cleanup(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {admin_token}"}
+    actor = find_user_by_email(signoz, admin_token, _ACTOR_EMAIL)
+
+    # Back to viewer so a rerun on the same stack can set the actor up again.
+    change_user_role(signoz, admin_token, actor["id"], _ACTOR_ROLE_NAME, "signoz-viewer")
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, _ACTOR_ROLE_NAME)}"),
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {_ACTOR_ROLE_NAME}: {response.text}"
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {group["name"]: group["id"] for group in response.json()["data"]["items"]}
+    for name in (_TARGET_A, _TARGET_B):
+        response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[name]}"), headers=headers, timeout=5)
+        assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {name}: {response.text}"