Compare commits

..

8 Commits

Author SHA1 Message Date
srikanthccv
9f57f8067b chore: generate openapi specs 2026-11-09 22:10:02 +05:30
srikanthccv
55e9fc94aa docs(querier): say the anomaly threshold has no default
Assisted-by: Claude Fable 5.1
2026-11-09 22:10:02 +05:30
Srikanth Chekuri
00ef0093ec Merge branch 'main' into srikanth/query-range-function-examples 2026-11-09 22:07:10 +05:30
srikanthccv
fea0ae6bb1 chore: generate openapi specs 2026-11-09 22:04:52 +05:30
srikanthccv
5123aff0c8 docs(querier): state the edge behaviour of median and the first cumulativeSum point
Assisted-by: Claude Fable 5.1
2026-11-09 22:04:52 +05:30
Srikanth Chekuri
fa6b7cd966 Merge branch 'main' into srikanth/query-range-function-examples 2026-11-09 19:05:41 +05:30
srikanthccv
858ff3992e chore: generate openapi specs 2026-11-09 07:33:34 +05:30
srikanthccv
e4c381aa31 docs(querier): add query_range examples for every builder function
One request per function family, with the arguments, their values and
what the function does to the series.

Assisted-by: Claude Fable 5.1
2026-11-09 07:33:34 +05:30
17 changed files with 548 additions and 810 deletions

View File

@@ -3970,7 +3970,6 @@ components:
- logs-field
- traces-field
- metrics-field
- llm-pricing-rule
type: string
CoretypesObject:
properties:
@@ -16149,9 +16148,9 @@ paths:
description: Internal Server Error
security:
- api_key:
- llm-pricing-rule:list
- VIEWER
- tokenizer:
- llm-pricing-rule:list
- VIEWER
summary: List pricing rules
tags:
- llmpricingrules
@@ -16196,9 +16195,9 @@ paths:
description: Internal Server Error
security:
- api_key:
- llm-pricing-rule:update
- ADMIN
- tokenizer:
- llm-pricing-rule:update
- ADMIN
summary: Create or update pricing rules
tags:
- llmpricingrules
@@ -16244,9 +16243,9 @@ paths:
description: Internal Server Error
security:
- api_key:
- llm-pricing-rule:delete
- ADMIN
- tokenizer:
- llm-pricing-rule:delete
- ADMIN
summary: Delete a pricing rule
tags:
- llmpricingrules
@@ -16302,9 +16301,9 @@ paths:
description: Internal Server Error
security:
- api_key:
- llm-pricing-rule:read
- VIEWER
- tokenizer:
- llm-pricing-rule:read
- VIEWER
summary: Get a pricing rule
tags:
- llmpricingrules
@@ -16357,11 +16356,9 @@ paths:
description: Internal Server Error
security:
- api_key:
- llm-pricing-rule:list
- traces:read
- VIEWER
- tokenizer:
- llm-pricing-rule:list
- traces:read
- VIEWER
summary: List unmapped models
tags:
- llmpricingrules
@@ -32732,6 +32729,305 @@ paths:
requestType: time_series
schemaVersion: v1
start: 1640995200000
function_anomaly_request_rate:
description: 'anomaly is the one function with named arguments. seasonality
says which past periods predict the current value: hourly, daily
or weekly, daily when absent. z_score_threshold is how many standard
deviations from the prediction count as an anomaly. It has no default:
a request without it gets bounds of zero width, so send it. 3 is
the value the UI sends. The response carries, next to the values,
a predicted series, an upper and a lower bound series and an anomaly
score series. The scoring runs in the enterprise build; the community
build returns the series unchanged.'
summary: 'anomaly: request rate scored against its daily pattern'
value:
compositeQuery:
queries:
- spec:
aggregations:
- metricName: http.server.duration.count
spaceAggregation: sum
timeAggregation: rate
functions:
- args:
- name: seasonality
value: daily
- name: z_score_threshold
value: 3
name: anomaly
groupBy:
- fieldContext: resource
name: service.name
name: A
signal: metrics
stepInterval: 300s
type: builder_query
end: 1640998800000
requestType: time_series
schemaVersion: v1
start: 1640995200000
function_cumulativesum_errors_so_far:
description: cumulativeSum replaces each point with the sum of every
point up to and including it, so a per-step count becomes a running
total whose first point is the first count. It takes no arguments.
The total resets with the window, so a longer time range gives a
larger final value; it is a view of the window, not a counter.
summary: 'cumulativeSum: 5xx responses since the start of the window'
value:
compositeQuery:
queries:
- spec:
aggregations:
- alias: server_errors
expression: count()
filter:
expression: http.response.status_code >= 500
functions:
- name: cumulativeSum
groupBy:
- fieldContext: resource
name: service.name
name: A
signal: traces
stepInterval: 60s
type: builder_query
end: 1640998800000
requestType: time_series
schemaVersion: v1
start: 1640995200000
function_cutoffmin_hide_idle_hosts:
description: The four threshold functions take one number. cutOffMin
and cutOffMax remove the points below or above the threshold, so
an idle host disappears from the chart instead of drawing a line
along the bottom. clampMin and clampMax keep the points and replace
the value with the threshold, which caps spikes without hiding them.
system.cpu.utilization is a ratio, so 0.05 is 5%.
summary: 'cutOffMin: drop hosts below 5% CPU from the chart'
value:
compositeQuery:
queries:
- spec:
aggregations:
- metricName: system.cpu.utilization
spaceAggregation: avg
timeAggregation: avg
functions:
- args:
- value: 0.05
name: cutOffMin
groupBy:
- fieldContext: resource
name: host.name
name: A
signal: metrics
stepInterval: 60s
type: builder_query
end: 1640998800000
requestType: time_series
schemaVersion: v1
start: 1640995200000
function_ewma_smoothed_latency:
description: 'ewma3, ewma5 and ewma7 replace each point with an exponentially
weighted average of the point and the points before it. The number
in the name is the window the default weight is derived from: alpha
= 2 / (n + 1), so 0.5, 0.333 and 0.25. One optional argument overrides
alpha; a value close to 1 follows the raw series, a value close
to 0 smooths harder. 0.3 here smooths a little more than ewma5''s
default.'
summary: 'ewma5: smoothed p95 latency'
value:
compositeQuery:
queries:
- spec:
aggregations:
- metricName: http.server.duration.bucket
spaceAggregation: p95
functions:
- args:
- value: 0.3
name: ewma5
groupBy:
- fieldContext: resource
name: service.name
name: A
signal: metrics
stepInterval: 60s
type: builder_query
end: 1640998800000
requestType: time_series
schemaVersion: v1
start: 1640995200000
function_fillzero_sparse_errors:
description: A count over sparse events returns a point only for steps
that had a match, so a chart of failed spans has gaps where nothing
failed. fillZero adds a zero at every missing step. With no arguments
the server fills the request window at the query's step, which is
the common case. The three optional arguments are start, end and
step in milliseconds, for callers that want to fill a different
grid.
summary: 'fillZero: a zero at every step with no failed spans'
value:
compositeQuery:
queries:
- spec:
aggregations:
- alias: failed_spans
expression: count()
filter:
expression: has_error = true
functions:
- name: fillZero
groupBy:
- fieldContext: resource
name: service.name
name: A
signal: traces
stepInterval: 60s
type: builder_query
end: 1640998800000
requestType: time_series
schemaVersion: v1
start: 1640995200000
function_log10_network_bytes:
description: log2 and log10 replace each value with its logarithm,
so a loopback device moving kilobytes and an uplink moving gigabytes
fit on one chart. They take no arguments. Zero and negative values
have no logarithm and are not drawn. absolute, also without arguments,
is the usual companion for a signed series before a logarithm.
summary: 'log10: network throughput across devices that differ by
orders of magnitude'
value:
compositeQuery:
queries:
- spec:
aggregations:
- metricName: system.network.io
spaceAggregation: sum
timeAggregation: rate
filter:
expression: direction = 'transmit'
functions:
- name: log10
groupBy:
- fieldContext: attribute
name: device
name: A
signal: metrics
stepInterval: 60s
type: builder_query
end: 1640998800000
requestType: time_series
schemaVersion: v1
start: 1640995200000
function_median_despiked_request_rate:
description: median3, median5 and median7 replace each point with
the median of the surrounding 3, 5 or 7 points. A spike that lasts
one step vanishes, a shift that lasts longer than half the window
stays. The first and last half window, 2 points each for median5,
have no full window and keep their values, so the newest spike stays
visible; a series shorter than the window is returned unchanged.
They take no arguments. Use them when the raw series is noisy and
the chart is for a trend, not for catching the spike.
summary: 'median5: request rate without one-step spikes'
value:
compositeQuery:
queries:
- spec:
aggregations:
- metricName: http.server.duration.count
spaceAggregation: sum
timeAggregation: rate
functions:
- name: median5
groupBy:
- fieldContext: resource
name: service.name
name: A
signal: metrics
stepInterval: 60s
type: builder_query
end: 1640998800000
requestType: time_series
schemaVersion: v1
start: 1640995200000
function_runningdiff_disk_growth:
description: 'runningDiff turns a gauge into the change between consecutive
points, so a filesystem usage gauge becomes bytes written per step.
It takes no arguments and drops the first point of the window, since
that point has nothing to difference against; the server reads one
step before the window to keep the first interval. Functions apply
in order: clampMin with 0 runs on the differences and replaces the
negative value a cleanup or a volume reset produces with zero.'
summary: 'runningDiff then clampMin: bytes written to disk per step'
value:
compositeQuery:
queries:
- spec:
aggregations:
- metricName: system.filesystem.usage
spaceAggregation: sum
timeAggregation: latest
filter:
expression: state = 'used'
functions:
- name: runningDiff
- args:
- value: 0
name: clampMin
groupBy:
- fieldContext: resource
name: host.name
name: A
signal: metrics
stepInterval: 60s
type: builder_query
end: 1640998800000
requestType: time_series
schemaVersion: v1
start: 1640995200000
function_timeshift_week_over_week:
description: timeShift moves every point of its query forward by the
argument, in seconds, so a series read from the past lands on the
current timestamps. B here reads the hour exactly seven days (604800
s) before the requested window and comes back on this week's timestamps,
so it overlays A on a chart and the formula can subtract it point
by point. The argument is positive; it says how far back to read.
summary: 'timeShift: this week''s error logs next to last week''s'
value:
compositeQuery:
queries:
- spec:
aggregations:
- alias: errors
expression: count()
filter:
expression: severity_text = 'ERROR'
name: A
signal: logs
stepInterval: 60s
type: builder_query
- spec:
aggregations:
- alias: errors
expression: count()
filter:
expression: severity_text = 'ERROR'
functions:
- args:
- value: 604800
name: timeShift
name: B
signal: logs
stepInterval: 60s
type: builder_query
- spec:
expression: A - B
name: F1
type: builder_formula
end: 1640998800000
requestType: time_series
schemaVersion: v1
start: 1640995200000
logs_raw:
summary: 'Raw: fetch raw log records'
value:

View File

@@ -3611,7 +3611,6 @@ export enum CoretypesKindDTO {
'logs-field' = 'logs-field',
'traces-field' = 'traces-field',
'metrics-field' = 'metrics-field',
'llm-pricing-rule' = 'llm-pricing-rule',
}
export enum CoretypesTypeDTO {
user = 'user',

View File

@@ -74,8 +74,7 @@
"meter-metrics",
"logs-field",
"traces-field",
"metrics-field",
"llm-pricing-rule"
"metrics-field"
],
"type": "string"
},

View File

@@ -4,16 +4,14 @@ import (
"net/http"
"github.com/SigNoz/signoz/pkg/http/handler"
"github.com/SigNoz/signoz/pkg/querybuilder"
"github.com/SigNoz/signoz/pkg/types/authtypes"
"github.com/SigNoz/signoz/pkg/types/coretypes"
"github.com/SigNoz/signoz/pkg/types"
"github.com/SigNoz/signoz/pkg/types/llmpricingruletypes"
"github.com/gorilla/mux"
)
func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.List, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.List),
handler.OpenAPIDef{
ID: "ListLLMPricingRules",
Tags: []string{"llmpricingrules"},
@@ -27,20 +25,14 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
SuccessStatusCode: http.StatusOK,
ErrorStatusCodes: []int{http.StatusBadRequest},
Deprecated: false,
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList)}),
SecuritySchemes: newSecuritySchemes(types.RoleViewer),
},
handler.WithResourceDefs(handler.BasicResourceDef{
Resource: coretypes.ResourceMetaResourceLLMPricingRule,
Verb: coretypes.VerbList,
Category: coretypes.ActionCategoryDataAccess,
Selector: coretypes.WildcardSelector,
}),
)).Methods(http.MethodGet).GetError(); err != nil {
return err
}
if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.CreateOrUpdate, authtypes.SigNozAdminRoleName),
provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.CreateOrUpdate),
handler.OpenAPIDef{
ID: "CreateOrUpdateLLMPricingRules",
Tags: []string{"llmpricingrules"},
@@ -51,20 +43,14 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
SuccessStatusCode: http.StatusNoContent,
ErrorStatusCodes: []int{http.StatusBadRequest},
Deprecated: false,
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbUpdate)}),
SecuritySchemes: newSecuritySchemes(types.RoleAdmin),
},
handler.WithResourceDefs(handler.TelemetryResourceDef{
Verb: coretypes.VerbUpdate,
Category: coretypes.ActionCategoryConfigurationChange,
Selector: llmpricingruletypes.RuleSelector,
Resources: llmpricingruletypes.UpdatableRulesResources,
}),
)).Methods(http.MethodPut).GetError(); err != nil {
return err
}
if err := router.Handle("/api/v1/llm_pricing_rules/unmapped_models", handler.New(
provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.ListUnmappedModels, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.ListUnmappedModels),
handler.OpenAPIDef{
ID: "ListUnmappedLLMModels",
Tags: []string{"llmpricingrules"},
@@ -77,28 +63,14 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
SuccessStatusCode: http.StatusOK,
ErrorStatusCodes: []int{http.StatusBadRequest},
Deprecated: false,
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList), coretypes.ResourceTelemetryResourceTraces.Scope(coretypes.VerbRead)}),
SecuritySchemes: newSecuritySchemes(types.RoleViewer),
},
handler.WithResourceDefs(
handler.BasicResourceDef{
Resource: coretypes.ResourceMetaResourceLLMPricingRule,
Verb: coretypes.VerbList,
Category: coretypes.ActionCategoryDataAccess,
Selector: coretypes.WildcardSelector,
},
handler.TelemetryResourceDef{
Verb: coretypes.VerbRead,
Category: coretypes.ActionCategoryDataAccess,
Selector: querybuilder.TelemetrySelector,
Resources: querybuilder.BuilderQueryWildcardResources(coretypes.ResourceTelemetryResourceTraces),
},
),
)).Methods(http.MethodGet).GetError(); err != nil {
return err
}
if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Get, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.Get),
handler.OpenAPIDef{
ID: "GetLLMPricingRule",
Tags: []string{"llmpricingrules"},
@@ -111,21 +83,14 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
SuccessStatusCode: http.StatusOK,
ErrorStatusCodes: []int{http.StatusNotFound},
Deprecated: false,
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbRead)}),
SecuritySchemes: newSecuritySchemes(types.RoleViewer),
},
handler.WithResourceDefs(handler.BasicResourceDef{
Resource: coretypes.ResourceMetaResourceLLMPricingRule,
Verb: coretypes.VerbRead,
Category: coretypes.ActionCategoryDataAccess,
ID: coretypes.PathParam("id"),
Selector: coretypes.IDSelector,
}),
)).Methods(http.MethodGet).GetError(); err != nil {
return err
}
if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Delete, authtypes.SigNozAdminRoleName),
provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.Delete),
handler.OpenAPIDef{
ID: "DeleteLLMPricingRule",
Tags: []string{"llmpricingrules"},
@@ -138,15 +103,8 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
SuccessStatusCode: http.StatusNoContent,
ErrorStatusCodes: []int{http.StatusNotFound},
Deprecated: false,
SecuritySchemes: newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbDelete)}),
SecuritySchemes: newSecuritySchemes(types.RoleAdmin),
},
handler.WithResourceDefs(handler.BasicResourceDef{
Resource: coretypes.ResourceMetaResourceLLMPricingRule,
Verb: coretypes.VerbDelete,
Category: coretypes.ActionCategoryConfigurationChange,
ID: coretypes.PathParam("id"),
Selector: coretypes.IDSelector,
}),
)).Methods(http.MethodDelete).GetError(); err != nil {
return err
}

View File

@@ -30,7 +30,7 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
Description: "Execute a composite query over a time range. Supports builder queries (traces, logs, metrics), formulas, trace operators, PromQL, and ClickHouse SQL.",
Request: new(qbtypes.QueryRangeRequest),
RequestContentType: "application/json",
RequestExamples: []handler.OpenAPIExample{
RequestExamples: append([]handler.OpenAPIExample{
{
Name: "traces_time_series",
Summary: "Time series: count spans grouped by service",
@@ -598,7 +598,7 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
},
},
},
},
}, queryRangeFunctionExamples()...),
Response: new(qbtypes.QueryRangeResponse),
ResponseContentType: "application/json",
SuccessStatusCode: http.StatusOK,

View File

@@ -0,0 +1,202 @@
package signozapiserver
import "github.com/SigNoz/signoz/pkg/http/handler"
// timeSeriesExample wraps builder query specs in a one hour time series
// request, the shape every function example shares.
func timeSeriesExample(name, summary, description string, queries ...map[string]any) handler.OpenAPIExample {
list := make([]any, 0, len(queries))
for _, query := range queries {
list = append(list, query)
}
return handler.OpenAPIExample{
Name: name,
Summary: summary,
Description: description,
Value: map[string]any{
"schemaVersion": "v1",
"start": 1640995200000,
"end": 1640998800000,
"requestType": "time_series",
"compositeQuery": map[string]any{"queries": list},
},
}
}
func builderQueryEnvelope(spec map[string]any) map[string]any {
return map[string]any{"type": "builder_query", "spec": spec}
}
// function builds a function entry with positional arguments; anomaly is the
// one function that takes named arguments and is written out in full.
func function(name string, args ...any) map[string]any {
list := make([]any, 0, len(args))
for _, arg := range args {
list = append(list, map[string]any{"value": arg})
}
entry := map[string]any{"name": name}
if len(list) > 0 {
entry["args"] = list
}
return entry
}
// queryRangeFunctionExamples shows every function a builder query can carry,
// what its arguments mean and the values they take. Functions run in the
// order listed, after the aggregation and before formulas.
func queryRangeFunctionExamples() []handler.OpenAPIExample {
return []handler.OpenAPIExample{
timeSeriesExample(
"function_timeshift_week_over_week",
"timeShift: this week's error logs next to last week's",
"timeShift moves every point of its query forward by the argument, in seconds, so a series read from the past lands on the current timestamps. B here reads the hour exactly seven days (604800 s) before the requested window and comes back on this week's timestamps, so it overlays A on a chart and the formula can subtract it point by point. The argument is positive; it says how far back to read.",
builderQueryEnvelope(map[string]any{
"name": "A",
"signal": "logs",
"aggregations": []any{map[string]any{"expression": "count()", "alias": "errors"}},
"stepInterval": "60s",
"filter": map[string]any{"expression": "severity_text = 'ERROR'"},
}),
builderQueryEnvelope(map[string]any{
"name": "B",
"signal": "logs",
"aggregations": []any{map[string]any{"expression": "count()", "alias": "errors"}},
"stepInterval": "60s",
"filter": map[string]any{"expression": "severity_text = 'ERROR'"},
"functions": []any{function("timeShift", 604800)},
}),
map[string]any{
"type": "builder_formula",
"spec": map[string]any{"name": "F1", "expression": "A - B"},
},
),
timeSeriesExample(
"function_fillzero_sparse_errors",
"fillZero: a zero at every step with no failed spans",
"A count over sparse events returns a point only for steps that had a match, so a chart of failed spans has gaps where nothing failed. fillZero adds a zero at every missing step. With no arguments the server fills the request window at the query's step, which is the common case. The three optional arguments are start, end and step in milliseconds, for callers that want to fill a different grid.",
builderQueryEnvelope(map[string]any{
"name": "A",
"signal": "traces",
"aggregations": []any{map[string]any{"expression": "count()", "alias": "failed_spans"}},
"stepInterval": "60s",
"filter": map[string]any{"expression": "has_error = true"},
"groupBy": []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
"functions": []any{function("fillZero")},
}),
),
timeSeriesExample(
"function_cutoffmin_hide_idle_hosts",
"cutOffMin: drop hosts below 5% CPU from the chart",
"The four threshold functions take one number. cutOffMin and cutOffMax remove the points below or above the threshold, so an idle host disappears from the chart instead of drawing a line along the bottom. clampMin and clampMax keep the points and replace the value with the threshold, which caps spikes without hiding them. system.cpu.utilization is a ratio, so 0.05 is 5%.",
builderQueryEnvelope(map[string]any{
"name": "A",
"signal": "metrics",
"aggregations": []any{
map[string]any{"metricName": "system.cpu.utilization", "timeAggregation": "avg", "spaceAggregation": "avg"},
},
"stepInterval": "60s",
"groupBy": []any{map[string]any{"name": "host.name", "fieldContext": "resource"}},
"functions": []any{function("cutOffMin", 0.05)},
}),
),
timeSeriesExample(
"function_runningdiff_disk_growth",
"runningDiff then clampMin: bytes written to disk per step",
"runningDiff turns a gauge into the change between consecutive points, so a filesystem usage gauge becomes bytes written per step. It takes no arguments and drops the first point of the window, since that point has nothing to difference against; the server reads one step before the window to keep the first interval. Functions apply in order: clampMin with 0 runs on the differences and replaces the negative value a cleanup or a volume reset produces with zero.",
builderQueryEnvelope(map[string]any{
"name": "A",
"signal": "metrics",
"aggregations": []any{
map[string]any{"metricName": "system.filesystem.usage", "timeAggregation": "latest", "spaceAggregation": "sum"},
},
"stepInterval": "60s",
"filter": map[string]any{"expression": "state = 'used'"},
"groupBy": []any{map[string]any{"name": "host.name", "fieldContext": "resource"}},
"functions": []any{function("runningDiff"), function("clampMin", 0)},
}),
),
timeSeriesExample(
"function_ewma_smoothed_latency",
"ewma5: smoothed p95 latency",
"ewma3, ewma5 and ewma7 replace each point with an exponentially weighted average of the point and the points before it. The number in the name is the window the default weight is derived from: alpha = 2 / (n + 1), so 0.5, 0.333 and 0.25. One optional argument overrides alpha; a value close to 1 follows the raw series, a value close to 0 smooths harder. 0.3 here smooths a little more than ewma5's default.",
builderQueryEnvelope(map[string]any{
"name": "A",
"signal": "metrics",
"aggregations": []any{
map[string]any{"metricName": "http.server.duration.bucket", "spaceAggregation": "p95"},
},
"stepInterval": "60s",
"groupBy": []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
"functions": []any{function("ewma5", 0.3)},
}),
),
timeSeriesExample(
"function_median_despiked_request_rate",
"median5: request rate without one-step spikes",
"median3, median5 and median7 replace each point with the median of the surrounding 3, 5 or 7 points. A spike that lasts one step vanishes, a shift that lasts longer than half the window stays. The first and last half window, 2 points each for median5, have no full window and keep their values, so the newest spike stays visible; a series shorter than the window is returned unchanged. They take no arguments. Use them when the raw series is noisy and the chart is for a trend, not for catching the spike.",
builderQueryEnvelope(map[string]any{
"name": "A",
"signal": "metrics",
"aggregations": []any{
map[string]any{"metricName": "http.server.duration.count", "timeAggregation": "rate", "spaceAggregation": "sum"},
},
"stepInterval": "60s",
"groupBy": []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
"functions": []any{function("median5")},
}),
),
timeSeriesExample(
"function_cumulativesum_errors_so_far",
"cumulativeSum: 5xx responses since the start of the window",
"cumulativeSum replaces each point with the sum of every point up to and including it, so a per-step count becomes a running total whose first point is the first count. It takes no arguments. The total resets with the window, so a longer time range gives a larger final value; it is a view of the window, not a counter.",
builderQueryEnvelope(map[string]any{
"name": "A",
"signal": "traces",
"aggregations": []any{map[string]any{"expression": "count()", "alias": "server_errors"}},
"stepInterval": "60s",
"filter": map[string]any{"expression": "http.response.status_code >= 500"},
"groupBy": []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
"functions": []any{function("cumulativeSum")},
}),
),
timeSeriesExample(
"function_log10_network_bytes",
"log10: network throughput across devices that differ by orders of magnitude",
"log2 and log10 replace each value with its logarithm, so a loopback device moving kilobytes and an uplink moving gigabytes fit on one chart. They take no arguments. Zero and negative values have no logarithm and are not drawn. absolute, also without arguments, is the usual companion for a signed series before a logarithm.",
builderQueryEnvelope(map[string]any{
"name": "A",
"signal": "metrics",
"aggregations": []any{
map[string]any{"metricName": "system.network.io", "timeAggregation": "rate", "spaceAggregation": "sum"},
},
"stepInterval": "60s",
"filter": map[string]any{"expression": "direction = 'transmit'"},
"groupBy": []any{map[string]any{"name": "device", "fieldContext": "attribute"}},
"functions": []any{function("log10")},
}),
),
timeSeriesExample(
"function_anomaly_request_rate",
"anomaly: request rate scored against its daily pattern",
"anomaly is the one function with named arguments. seasonality says which past periods predict the current value: hourly, daily or weekly, daily when absent. z_score_threshold is how many standard deviations from the prediction count as an anomaly. It has no default: a request without it gets bounds of zero width, so send it. 3 is the value the UI sends. The response carries, next to the values, a predicted series, an upper and a lower bound series and an anomaly score series. The scoring runs in the enterprise build; the community build returns the series unchanged.",
builderQueryEnvelope(map[string]any{
"name": "A",
"signal": "metrics",
"aggregations": []any{
map[string]any{"metricName": "http.server.duration.count", "timeAggregation": "rate", "spaceAggregation": "sum"},
},
"stepInterval": "300s",
"groupBy": []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
"functions": []any{
map[string]any{
"name": "anomaly",
"args": []any{
map[string]any{"name": "seasonality", "value": "daily"},
map[string]any{"name": "z_score_threshold", "value": 3},
},
},
},
}),
),
}
}

View File

@@ -0,0 +1,23 @@
package signozapiserver
import (
"encoding/json"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
)
func TestQueryRangeFunctionExamplesAreValidRequests(t *testing.T) {
for _, example := range queryRangeFunctionExamples() {
t.Run(example.Name, func(t *testing.T) {
raw, err := json.Marshal(example.Value)
require.NoError(t, err)
var req qbtypes.QueryRangeRequest
require.NoError(t, json.Unmarshal(raw, &req))
assert.NoError(t, req.Validate())
})
}
}

View File

@@ -272,7 +272,6 @@ func NewSQLMigrationProviderFactories(
sqlmigration.NewAddDowntimeTuplesFactory(sqlstore),
sqlmigration.NewAddRuleTuplesFactory(sqlstore),
sqlmigration.NewRestructureJiraChannelSpecFactory(sqlstore),
sqlmigration.NewAddLLMPricingRuleTuplesFactory(sqlstore),
)
}

View File

@@ -1,162 +0,0 @@
package sqlmigration
import (
"context"
"database/sql"
"encoding/json"
"time"
"github.com/SigNoz/signoz/pkg/factory"
"github.com/SigNoz/signoz/pkg/sqlstore"
"github.com/SigNoz/signoz/pkg/types/authtypes"
"github.com/SigNoz/signoz/pkg/types/coretypes"
"github.com/oklog/ulid/v2"
"github.com/uptrace/bun"
"github.com/uptrace/bun/dialect"
"github.com/uptrace/bun/migrate"
)
type addLLMPricingRuleTuples struct {
sqlstore sqlstore.SQLStore
}
func NewAddLLMPricingRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
return factory.NewProviderFactory(factory.MustNewName("add_llm_pricing_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
return &addLLMPricingRuleTuples{sqlstore: sqlstore}, nil
})
}
func (migration *addLLMPricingRuleTuples) Register(migrations *migrate.Migrations) error {
return migrations.Register(migration.Up, migration.Down)
}
func (migration *addLLMPricingRuleTuples) Up(ctx context.Context, db *bun.DB) error {
tx, err := db.BeginTx(ctx, nil)
if err != nil {
return err
}
defer func() { _ = tx.Rollback() }()
var storeID string
err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
if err != nil {
return err
}
var orgIDs []string
err = tx.NewSelect().
Table("organizations").
Column("id").
Scan(ctx, &orgIDs)
if err != nil && err != sql.ErrNoRows {
return err
}
isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
tuples := []migrationTuple{
{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "read"},
{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "update"},
{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "delete"},
{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "list"},
{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "read"},
{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "list"},
{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "read"},
{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "list"},
}
for _, orgID := range orgIDs {
for _, tuple := range tuples {
entropy := ulid.DefaultEntropy()
now := time.Now().UTC()
tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
if isPG {
user := "role:" + roleSubject + "#assignee"
result, err := tx.ExecContext(ctx, `
INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
)
if err != nil {
return err
}
rowsAffected, err := result.RowsAffected()
if err != nil {
return err
}
if rowsAffected == 0 {
continue
}
_, err = tx.ExecContext(ctx, `
INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
ON CONFLICT (store, ulid, object_type) DO NOTHING`,
storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
)
if err != nil {
return err
}
} else {
result, err := tx.ExecContext(ctx, `
INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
)
if err != nil {
return err
}
rowsAffected, err := result.RowsAffected()
if err != nil {
return err
}
if rowsAffected == 0 {
continue
}
_, err = tx.ExecContext(ctx, `
INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
ON CONFLICT (store, ulid, object_type) DO NOTHING`,
storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
)
if err != nil {
return err
}
}
}
}
managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
for roleName, transactions := range coretypes.ManagedRoleToTransactions {
data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
if err != nil {
return err
}
managedRoleGroups[roleName] = string(data)
}
for _, orgID := range orgIDs {
for roleName, data := range managedRoleGroups {
if _, err := tx.NewUpdate().
Model(new(roles)).
Set("transaction_groups = ?", data).
Where("org_id = ?", orgID).
Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
Where("name = ?", roleName).
Exec(ctx); err != nil {
return err
}
}
}
return tx.Commit()
}
func (migration *addLLMPricingRuleTuples) Down(context.Context, *bun.DB) error {
return nil
}

View File

@@ -80,7 +80,6 @@ func (name Kind) Enum() []any {
KindLogsField,
KindTracesField,
KindMetricsField,
KindLLMPricingRule,
}
}

View File

@@ -40,7 +40,6 @@ var Kinds = []Kind{
KindLogsField,
KindTracesField,
KindMetricsField,
KindLLMPricingRule,
}
var (
@@ -83,5 +82,4 @@ var (
KindLogsField = MustNewKind("logs-field")
KindTracesField = MustNewKind("traces-field")
KindMetricsField = MustNewKind("metrics-field")
KindLLMPricingRule = MustNewKind("llm-pricing-rule")
)

View File

@@ -226,11 +226,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
// llm-pricing-rule — admin writes, viewer reads
{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
},
SigNozEditorRoleName: {
// cloud-integration — editor can read accounts
@@ -336,9 +331,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
// llm-pricing-rule — read only (admin writes)
{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
},
SigNozViewerRoleName: {
// cloud-integration — viewer can read accounts
@@ -403,9 +395,6 @@ var ManagedRoleToTransactions = map[string][]Transaction{
// metrics-field — viewer reads
{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
// llm-pricing-rule — read only
{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
},
SigNozAnonymousRoleName: {
// public-dashboard — anonymous read

View File

@@ -40,7 +40,6 @@ var Resources = []Resource{
ResourceMetaResourceLogsField,
ResourceMetaResourceTracesField,
ResourceMetaResourceMetricsField,
ResourceMetaResourceLLMPricingRule,
}
var (
@@ -83,5 +82,4 @@ var (
ResourceMetaResourceLogsField = NewResourceMetaResource(KindLogsField)
ResourceMetaResourceTracesField = NewResourceMetaResource(KindTracesField)
ResourceMetaResourceMetricsField = NewResourceMetaResource(KindMetricsField, VerbList, VerbRead, VerbUpdate)
ResourceMetaResourceLLMPricingRule = NewResourceMetaResource(KindLLMPricingRule, VerbList, VerbRead, VerbUpdate, VerbDelete)
)

View File

@@ -1,58 +0,0 @@
package llmpricingruletypes
import (
"context"
"encoding/json"
"slices"
"github.com/SigNoz/signoz/pkg/errors"
"github.com/SigNoz/signoz/pkg/types/coretypes"
"github.com/SigNoz/signoz/pkg/valuer"
)
// UpdatableRulesResources resolves the pricing rules an upsert body writes to.
//
// A rule with isOverride and an id is an edit, checked by that id. Everything
// else resolves to the wildcard: isOverride without an id is a create, sourceId
// without isOverride is a sync row, and an empty list has nothing to check.
func UpdatableRulesResources(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
// Decoded with the handler's request type so duplicate or case-variant keys
// resolve to the rows actually written; valuer lowercases uppercase ids.
var body UpdatableLLMPricingRules
if err := json.Unmarshal(ec.RequestBody, &body); err != nil {
return nil, errors.Wrapf(err, errors.TypeInvalidInput, ErrCodePricingRuleInvalidInput, "invalid pricing rules body")
}
ids := make([]string, 0, len(body.Rules))
wildcard := len(body.Rules) == 0
for _, rule := range body.Rules {
if rule == nil || rule.ID == nil || rule.IsOverride == nil {
wildcard = true
continue
}
if !slices.Contains(ids, rule.ID.StringValue()) {
ids = append(ids, rule.ID.StringValue())
}
}
if wildcard {
ids = append(ids, coretypes.WildCardSelectorString)
}
resources := make([]coretypes.ResourceWithID, 0, len(ids))
for _, id := range ids {
resources = append(resources, coretypes.ResourceWithID{Resource: coretypes.ResourceMetaResourceLLMPricingRule, ID: id})
}
return resources, nil
}
// RuleSelector exists because IDSelector would turn the wildcard entry into
// the wildcard twice; an id still resolves to the id plus the wildcard.
func RuleSelector(ctx context.Context, resource coretypes.Resource, id string, orgID valuer.UUID) ([]coretypes.Selector, error) {
if id == coretypes.WildCardSelectorString {
return coretypes.WildcardSelector(ctx, resource, id, orgID)
}
return coretypes.IDSelector(ctx, resource, id, orgID)
}

View File

@@ -1,126 +0,0 @@
package llmpricingruletypes
import (
"context"
"testing"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/SigNoz/signoz/pkg/types/coretypes"
"github.com/SigNoz/signoz/pkg/valuer"
)
func TestUpdatableRulesResources(t *testing.T) {
testCases := []struct {
name string
body string
want []string
wantErr bool
}{
{
name: "EmptyRules_Wildcard",
body: `{"rules":[]}`,
want: []string{"*"},
},
{
name: "Edit_ID",
body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}]}`,
want: []string{"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e"},
},
{
name: "Create_Wildcard",
body: `{"rules":[{"modelPattern":["m*"],"modelName":"gpt","isOverride":true}]}`,
want: []string{"*"},
},
{
name: "SyncRow_Wildcard",
body: `{"rules":[{"modelPattern":["m*"],"sourceId":"4e9a0b12-3c4d-4e5f-8a6b-7c8d9e0f1a2b"}]}`,
want: []string{"*"},
},
{
name: "Mixed_DedupedIDsThenWildcardOnce",
body: `{"rules":[{"modelPattern":["m*"],"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true},{"modelPattern":["m*"],"modelName":"new","isOverride":true},{"modelPattern":["m*"],"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":false},{"modelPattern":["m*"],"sourceId":"7bcd3e45-6f7a-4b8c-9d9e-0f1a2b3c4d5e"}]}`,
want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d", "*"},
},
{
name: "UppercaseID_Lowercased",
body: `{"rules":[{"modelPattern":["m*"],"id":"8CDE4F56-7A8B-4C9D-8E0F-1A2B3C4D5E6F","isOverride":true}]}`,
want: []string{"8cde4f56-7a8b-4c9d-8e0f-1a2b3c4d5e6f"},
},
{
name: "DuplicateIDKey_LastWins",
body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true}]}`,
want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d"},
},
{
name: "CaseVariantIDKey_LastWins",
body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","ID":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true}]}`,
want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d"},
},
{
name: "DuplicateRulesArray_CreateRow_Wildcard",
body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}],"rules":[{"modelPattern":["n*"],"modelName":"new","isOverride":true}]}`,
want: []string{"*"},
},
{
name: "DuplicateRulesArray_SyncRow_Wildcard",
body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}],"rules":[{"modelPattern":["n*"],"sourceId":"4e9a0b12-3c4d-4e5f-8a6b-7c8d9e0f1a2b"}]}`,
want: []string{"*"},
},
{
name: "InvalidID_Rejected",
body: `{"rules":[{"modelPattern":["m*"],"id":"not-a-uuid","isOverride":true}]}`,
wantErr: true,
},
}
for _, testCase := range testCases {
t.Run(testCase.name, func(t *testing.T) {
resources, err := UpdatableRulesResources(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
if testCase.wantErr {
require.Error(t, err)
return
}
require.NoError(t, err)
got := make([]string, 0, len(resources))
for _, resource := range resources {
got = append(got, resource.ID)
}
assert.Equal(t, testCase.want, got)
})
}
}
func TestRuleSelector(t *testing.T) {
testCases := []struct {
name string
id string
want []string
}{
{
name: "Wildcard_WildcardOnly",
id: "*",
want: []string{"*"},
},
{
name: "ID_IDThenWildcard",
id: "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
want: []string{"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "*"},
},
}
for _, testCase := range testCases {
t.Run(testCase.name, func(t *testing.T) {
selectors, err := RuleSelector(context.Background(), coretypes.ResourceMetaResourceLLMPricingRule, testCase.id, valuer.GenerateUUID())
require.NoError(t, err)
got := make([]string, 0, len(selectors))
for _, selector := range selectors {
got = append(got, selector.String())
}
assert.Equal(t, testCase.want, got)
})
}
}

View File

@@ -305,16 +305,6 @@
"list"
]
},
{
"type": "metaresource",
"kind": "llm-pricing-rule",
"verbs": [
"read",
"update",
"delete",
"list"
]
},
{
"type": "metaresource",
"kind": "ttl-setting",
@@ -552,14 +542,6 @@
"list"
]
},
{
"type": "metaresource",
"kind": "llm-pricing-rule",
"verbs": [
"read",
"list"
]
},
{
"type": "metaresource",
"kind": "ttl-setting",
@@ -739,14 +721,6 @@
"list"
]
},
{
"type": "metaresource",
"kind": "llm-pricing-rule",
"verbs": [
"read",
"list"
]
},
{
"type": "metaresource",
"kind": "ttl-setting",

View File

@@ -1,350 +0,0 @@
import json
from collections.abc import Callable
from http import HTTPStatus
import pytest
import requests
from wiremock.resources.mappings import Mapping
from fixtures import types
from fixtures.auth import (
USER_ADMIN_EMAIL,
USER_ADMIN_PASSWORD,
add_license,
change_user_role,
create_active_user,
)
from fixtures.llmpricingrules import (
LLM_PRICING_RULES_URL,
delete_all_llm_pricing_rules,
list_llm_pricing_rules,
upsert_llm_pricing_rules,
)
from fixtures.role import find_role_by_name, transaction_group
user_password = "password123Z$"
editor_email = "llm-pricing-editor@integration.test"
viewer_email = "llm-pricing-viewer@integration.test"
updater_role = "llm-pricing-updater"
updater_email = "llm-pricing-updater@integration.test"
scoped_role = "llm-pricing-scoped"
scoped_email = "llm-pricing-scoped@integration.test"
lister_role = "llm-pricing-lister"
lister_email = "llm-pricing-lister@integration.test"
trace_reader_role = "llm-pricing-trace-reader"
trace_reader_email = "llm-pricing-trace-reader@integration.test"
PROBE_RULE = {
"modelName": "authz-probe",
"provider": "OpenAI",
"modelPattern": ["authz-probe*"],
"unit": "per_million_tokens",
"pricing": {"input": 1, "output": 2},
"isOverride": True,
"enabled": True,
}
OTHER_RULE = {
"modelName": "authz-probe-other",
"provider": "Anthropic",
"modelPattern": ["authz-probe-other*"],
"unit": "per_million_tokens",
"pricing": {"input": 3, "output": 4},
"isOverride": True,
"enabled": True,
}
def test_setup(
signoz: types.SigNoz,
create_user_admin: types.Operation, # pylint: disable=unused-argument
make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
get_token: Callable[[str, str], str],
create_role: Callable[..., str],
) -> None:
add_license(signoz, make_http_mocks, get_token)
admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
delete_all_llm_pricing_rules(signoz, admin_token)
assert upsert_llm_pricing_rules(signoz, admin_token, [PROBE_RULE, OTHER_RULE]).status_code == HTTPStatus.NO_CONTENT
probe_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
headers = {"Authorization": f"Bearer {admin_token}"}
# A --reuse stack keeps users and roles from earlier runs, and probe_id changes every run.
response = requests.get(signoz.self.host_configs["8080"].get("/api/v1/roles"), headers=headers, timeout=5)
assert response.status_code == HTTPStatus.OK, response.text
existing_roles = {role["name"]: role["id"] for role in response.json()["data"]}
grants = {
updater_role: [transaction_group("update", "metaresource", "llm-pricing-rule", ["*"])],
scoped_role: [
transaction_group("read", "metaresource", "llm-pricing-rule", [probe_id]),
transaction_group("update", "metaresource", "llm-pricing-rule", [probe_id]),
transaction_group("delete", "metaresource", "llm-pricing-rule", [probe_id]),
],
lister_role: [transaction_group("list", "metaresource", "llm-pricing-rule", ["*"])],
trace_reader_role: [
transaction_group("list", "metaresource", "llm-pricing-rule", ["*"]),
transaction_group("read", "telemetryresource", "traces", ["builder_query/*"]),
],
}
for name, transaction_groups in grants.items():
if name not in existing_roles:
create_role(admin_token, name, transaction_groups)
continue
response = requests.put(
signoz.self.host_configs["8080"].get(f"/api/v1/roles/{existing_roles[name]}"),
json={"description": "", "transactionGroups": transaction_groups},
headers=headers,
timeout=5,
)
assert response.status_code == HTTPStatus.NO_CONTENT, response.text
response = requests.get(signoz.self.host_configs["8080"].get("/api/v2/users"), headers=headers, timeout=5)
assert response.status_code == HTTPStatus.OK, response.text
existing_emails = {user["email"] for user in response.json()["data"]}
for email, role in (
(editor_email, "signoz-editor"),
(viewer_email, "signoz-viewer"),
(updater_email, updater_role),
(scoped_email, scoped_role),
(lister_email, lister_role),
(trace_reader_email, trace_reader_role),
):
if email in existing_emails:
continue
user_id = create_active_user(signoz, admin_token, email=email, role="signoz-viewer", password=user_password)
if role != "signoz-viewer":
change_user_role(signoz, admin_token, user_id, "signoz-viewer", role)
@pytest.mark.parametrize(
"path",
[LLM_PRICING_RULES_URL, f"{LLM_PRICING_RULES_URL}/unmapped_models"],
ids=["list", "unmapped_models"],
)
@pytest.mark.parametrize(
("email", "expected"),
[
(USER_ADMIN_EMAIL, HTTPStatus.OK),
(editor_email, HTTPStatus.OK),
(viewer_email, HTTPStatus.OK),
(updater_email, HTTPStatus.FORBIDDEN),
(scoped_email, HTTPStatus.FORBIDDEN),
],
ids=["admin", "editor", "viewer", "updater", "scoped"],
)
def test_reads_need_list_grant(
signoz: types.SigNoz,
get_token: Callable[[str, str], str],
path: str,
email: str,
expected: HTTPStatus,
) -> None:
token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
response = requests.get(
signoz.self.host_configs["8080"].get(path),
headers={"Authorization": f"Bearer {token}"},
timeout=10,
)
assert response.status_code == expected, response.text
if expected == HTTPStatus.FORBIDDEN:
assert "llm-pricing-rule:list" in response.text
@pytest.mark.parametrize(
("email", "path", "expected"),
[
(lister_email, LLM_PRICING_RULES_URL, HTTPStatus.OK),
(lister_email, f"{LLM_PRICING_RULES_URL}/unmapped_models", HTTPStatus.FORBIDDEN),
(trace_reader_email, f"{LLM_PRICING_RULES_URL}/unmapped_models", HTTPStatus.OK),
],
ids=["lister_list", "lister_unmapped_models", "trace_reader_unmapped_models"],
)
def test_unmapped_models_needs_traces_read(
signoz: types.SigNoz,
get_token: Callable[[str, str], str],
email: str,
path: str,
expected: HTTPStatus,
) -> None:
response = requests.get(
signoz.self.host_configs["8080"].get(path),
headers={"Authorization": f"Bearer {get_token(email, user_password)}"},
timeout=10,
)
assert response.status_code == expected, response.text
if expected == HTTPStatus.FORBIDDEN:
assert "traces:read" in response.text
@pytest.mark.parametrize(
("email", "model_name", "expected"),
[
(USER_ADMIN_EMAIL, PROBE_RULE["modelName"], HTTPStatus.OK),
(editor_email, PROBE_RULE["modelName"], HTTPStatus.OK),
(viewer_email, PROBE_RULE["modelName"], HTTPStatus.OK),
(updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
(scoped_email, PROBE_RULE["modelName"], HTTPStatus.OK),
(scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
],
ids=["admin", "editor", "viewer", "updater", "scoped_granted", "scoped_other"],
)
def test_get_needs_read_grant(
signoz: types.SigNoz,
get_token: Callable[[str, str], str],
email: str,
model_name: str,
expected: HTTPStatus,
) -> None:
admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
response = requests.get(
signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
headers={"Authorization": f"Bearer {token}"},
timeout=10,
)
assert response.status_code == expected, response.text
if expected == HTTPStatus.FORBIDDEN:
assert "llm-pricing-rule:read" in response.text
@pytest.mark.parametrize(
("email", "expected"),
[
(editor_email, HTTPStatus.FORBIDDEN),
(viewer_email, HTTPStatus.FORBIDDEN),
(scoped_email, HTTPStatus.NO_CONTENT),
(updater_email, HTTPStatus.NO_CONTENT),
(USER_ADMIN_EMAIL, HTTPStatus.NO_CONTENT),
],
ids=["editor", "viewer", "scoped", "updater", "admin"],
)
def test_upsert_needs_update_grant(
signoz: types.SigNoz,
get_token: Callable[[str, str], str],
email: str,
expected: HTTPStatus,
) -> None:
admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
response = upsert_llm_pricing_rules(signoz, token, [{**PROBE_RULE, "id": rule_id}])
assert response.status_code == expected, response.text
if expected == HTTPStatus.FORBIDDEN:
assert "llm-pricing-rule:update" in response.text
@pytest.mark.parametrize(
"shape",
["other_rule", "create", "sync_row", "own_and_other"],
ids=["other_rule", "create", "sync_row", "own_and_other"],
)
def test_upsert_scoped_to_granted_rule(
signoz: types.SigNoz,
get_token: Callable[[str, str], str],
shape: str,
) -> None:
admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
rules = {r["modelName"]: r for r in list_llm_pricing_rules(signoz, admin_token)}
own = {**PROBE_RULE, "id": rules[PROBE_RULE["modelName"]]["id"]}
other = {**OTHER_RULE, "id": rules[OTHER_RULE["modelName"]]["id"]}
sync_row = {**{k: v for k, v in PROBE_RULE.items() if k != "isOverride"}, "sourceId": "11111111-1111-4111-8111-111111111199"}
bodies = {"other_rule": [other], "create": [PROBE_RULE], "sync_row": [sync_row], "own_and_other": [own, other]}
response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), bodies[shape])
assert response.status_code == HTTPStatus.FORBIDDEN, response.text
assert "llm-pricing-rule:update" in response.text
@pytest.mark.parametrize("second_row", ["create", "sync_row"], ids=["create", "sync_row"])
def test_upsert_duplicate_rules_array_needs_wildcard(
signoz: types.SigNoz,
get_token: Callable[[str, str], str],
second_row: str,
) -> None:
admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
own = {**PROBE_RULE, "id": next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])}
rows = {
"create": {**PROBE_RULE, "modelName": "authz-probe-dup"},
"sync_row": {**{k: v for k, v in PROBE_RULE.items() if k != "isOverride"}, "sourceId": "11111111-1111-4111-8111-111111111198"},
}
response = requests.put(
signoz.self.host_configs["8080"].get(LLM_PRICING_RULES_URL),
data=f'{{"rules":[{json.dumps(own)}],"rules":[{json.dumps(rows[second_row])}]}}',
headers={"Authorization": f"Bearer {get_token(scoped_email, user_password)}", "Content-Type": "application/json"},
timeout=10,
)
assert response.status_code == HTTPStatus.FORBIDDEN, response.text
assert "llm-pricing-rule:update" in response.text
def test_revoke_update_grant(
signoz: types.SigNoz,
get_token: Callable[[str, str], str],
) -> None:
admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
response = requests.put(
signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, scoped_role)}"),
json={
"description": "",
"transactionGroups": [
transaction_group("read", "metaresource", "llm-pricing-rule", [rule_id]),
transaction_group("delete", "metaresource", "llm-pricing-rule", [rule_id]),
],
},
headers={"Authorization": f"Bearer {admin_token}"},
timeout=10,
)
assert response.status_code == HTTPStatus.NO_CONTENT, response.text
response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), [{**PROBE_RULE, "id": rule_id}])
assert response.status_code == HTTPStatus.FORBIDDEN, response.text
assert "llm-pricing-rule:update" in response.text
@pytest.mark.parametrize(
("email", "model_name", "expected"),
[
(editor_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
(viewer_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
(updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
(scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
(scoped_email, PROBE_RULE["modelName"], HTTPStatus.NO_CONTENT),
(USER_ADMIN_EMAIL, OTHER_RULE["modelName"], HTTPStatus.NO_CONTENT),
],
ids=["editor", "viewer", "updater", "scoped_other", "scoped_granted", "admin"],
)
def test_delete_needs_delete_grant(
signoz: types.SigNoz,
get_token: Callable[[str, str], str],
email: str,
model_name: str,
expected: HTTPStatus,
) -> None:
admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
response = requests.delete(
signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
headers={"Authorization": f"Bearer {token}"},
timeout=10,
)
assert response.status_code == expected, response.text
if expected == HTTPStatus.FORBIDDEN:
assert "llm-pricing-rule:delete" in response.text
def test_cleanup(
signoz: types.SigNoz,
get_token: Callable[[str, str], str],
) -> None:
delete_all_llm_pricing_rules(signoz, get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD))