refactor(qb): build IN as an OR of equalities

The IN and NOT IN cases route each value back through the condition builder
with `=` / `!=`, instead of assembling the comparisons themselves. Whatever a
builder does for a scalar comparison then applies to the list form without
being restated.

Applied to logs, traces, audit and resourcefilter, which all fanned a list out
into per-value comparisons already. Metrics and rulestatehistory build a real
sb.In, so there is nothing to delegate to. telemetrymetadata is left alone as
well: it applies a key-existence guard at a single exit, so a recursed arm
comes back already wrapped, and either the guard nests or the case has to skip
the shared tail and lose the invariant that every case is guarded.

This fixes `body.<path>[*] IN [...]` with use_json_body off, which returned a
500. The list shape made the path extract as Array(String), and comparing that
to each scalar is something ClickHouse rejects outright (code 130); extracting
per value reads the field instead. Covered end-to-end by the new case in
querierlogs/06_json_body.py, which fails on main and passes here.

resourcefilter changes shape without changing results: each value is paired
with its own index filter — `(e1 AND k AND l1) OR (e2 AND k AND l2)` rather
than `(e1 OR e2) AND k AND (l1 OR l2)` — which selects the same rows because
each equality implies its own filter.

frontend/src/components/EditMemberDrawer/__tests__/EditMemberDrawer.test.tsx

@@ -5,9 +5,10 @@ import {
 	useCreateResetPasswordToken,
 	useDeleteUser,
 	useGetResetPasswordToken,
-	useCreateUserRole,
-	useDeleteUserRole,
+	useGetRolesByUserID,
 	useGetUser,
+	useRemoveUserRoleByUserIDAndRoleID,
+	useSetRoleByUserID,
 	useUpdateMyUserV2,
 	useUpdateUser,
 } from 'api/generated/services/users';
@@ -24,14 +25,15 @@ import EditMemberDrawer, { EditMemberDrawerProps } from '../EditMemberDrawer';
 jest.mock('api/generated/services/users', () => ({
 	useDeleteUser: jest.fn(),
 	useGetUser: jest.fn(),
-	useDeleteUserRole: jest.fn(),
+	useGetRolesByUserID: jest.fn(),
+	useRemoveUserRoleByUserIDAndRoleID: jest.fn(),
 	useUpdateUser: jest.fn(),
 	useUpdateMyUserV2: jest.fn(),
-	useCreateUserRole: jest.fn(),
+	useSetRoleByUserID: jest.fn(),
 	useGetResetPasswordToken: jest.fn(),
 	useCreateResetPasswordToken: jest.fn(),
-	getGetUserQueryKey: ({ id }: { id: string }): string[] => [
-		`/api/v2/users/${id}`,
+	getGetRolesByUserIDQueryKey: ({ id }: { id: string }): string[] => [
+		`/api/v2/users/${id}/roles`,
 	],
 }));
 
@@ -192,7 +194,11 @@ describe('EditMemberDrawer', () => {
 			isLoading: false,
 			refetch: jest.fn(),
 		});
-		(useDeleteUserRole as jest.Mock).mockReturnValue({
+		(useGetRolesByUserID as jest.Mock).mockReturnValue({
+			data: { data: [managedRoles[0]] },
+			isLoading: false,
+		});
+		(useRemoveUserRoleByUserIDAndRoleID as jest.Mock).mockReturnValue({
 			mutateAsync: mockRemoveMutateAsync.mockResolvedValue({}),
 			isLoading: false,
 		});
@@ -204,7 +210,7 @@ describe('EditMemberDrawer', () => {
 			mutateAsync: jest.fn().mockResolvedValue({}),
 			isLoading: false,
 		});
-		(useCreateUserRole as jest.Mock).mockReturnValue({
+		(useSetRoleByUserID as jest.Mock).mockReturnValue({
 			mutateAsync: jest.fn().mockResolvedValue({}),
 			isLoading: false,
 		});
@@ -306,12 +312,12 @@ describe('EditMemberDrawer', () => {
 		expect(onClose).not.toHaveBeenCalled();
 	});
 
-	it('adding a new role creates a user role without removing existing ones', async () => {
+	it('adding a new role calls setRole without removing existing ones', async () => {
 		const onComplete = jest.fn();
 		const user = userEvent.setup({ pointerEventsCheck: 0 });
 		const mockSet = jest.fn().mockResolvedValue({});
 
-		(useCreateUserRole as jest.Mock).mockReturnValue({
+		(useSetRoleByUserID as jest.Mock).mockReturnValue({
 			mutateAsync: mockSet,
 			isLoading: false,
 		});
@@ -328,14 +334,15 @@ describe('EditMemberDrawer', () => {
 
 		await waitFor(() => {
 			expect(mockSet).toHaveBeenCalledWith({
-				data: { userId: 'user-1', roleId: managedRoles[1].id },
+				pathParams: { id: 'user-1' },
+				data: { name: 'signoz-editor' },
 			});
 			expect(mockRemoveMutateAsync).not.toHaveBeenCalled();
 			expect(onComplete).toHaveBeenCalled();
 		});
 	});
 
-	it('deselecting a role deletes the user role by its assignment id', async () => {
+	it('deselecting a role calls removeRole with the role id', async () => {
 		const onComplete = jest.fn();
 		const user = userEvent.setup({ pointerEventsCheck: 0 });
 
@@ -354,7 +361,7 @@ describe('EditMemberDrawer', () => {
 
 		await waitFor(() => {
 			expect(mockRemoveMutateAsync).toHaveBeenCalledWith({
-				pathParams: { id: 'ur-1' },
+				pathParams: { id: 'user-1', roleId: managedRoles[0].id },
 			});
 			expect(onComplete).toHaveBeenCalled();
 		});

frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityEvents/EntityEvents.tsx

@@ -22,7 +22,6 @@ import { InfraMonitoringEntity } from 'container/InfraMonitoringK8sV2/constants'
 import LoadingContainer from 'container/InfraMonitoringK8sV2/LoadingContainer';
 import RunQueryBtn from 'container/QueryBuilder/components/RunQueryBtn/RunQueryBtn';
 import { ChevronDown, ChevronRight } from '@signozhq/icons';
-import { saveRecentQueryByExpression } from 'lib/recentQueries/saveRecentQuery';
 import { useQueryState } from 'nuqs';
 import { DataSource } from 'types/common/queryBuilder';
 import { parseAsJsonNoValidate } from 'utils/nuqsParsers';
@@ -117,7 +116,6 @@ function EntityEventsContent({
 					: newUserExpression || '',
 			);
 			if (validation.isValid) {
-				saveRecentQueryByExpression(DataSource.LOGS, newUserExpression);
 				querySearchOnRun(newUserExpression || '');
 
 				void logEvent(InfraMonitoringEvents.FilterApplied, {

frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityLogs/EntityLogs.tsx

@@ -29,7 +29,6 @@ import { getOldLogsOperatorFromNew } from 'hooks/logs/useActiveLog';
 import useLogDetailHandlers from 'hooks/logs/useLogDetailHandlers';
 import useScrollToLog from 'hooks/logs/useScrollToLog';
 import { generateFilterQuery } from 'lib/logs/generateFilterQuery';
-import { saveRecentQueryByExpression } from 'lib/recentQueries/saveRecentQuery';
 import { ILog } from 'types/api/logs/log';
 import { DataSource } from 'types/common/queryBuilder';
 import { validateQuery } from 'utils/queryValidationUtils';
@@ -133,7 +132,6 @@ function EntityLogsContent({
 			);
 
 			if (validation.isValid) {
-				saveRecentQueryByExpression(DataSource.LOGS, newUserExpression);
 				querySearchOnRun(newUserExpression);
 
 				void logEvent(InfraMonitoringEvents.FilterApplied, {

frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityTraces/EntityTraces.tsx

@@ -22,7 +22,6 @@ import { InfraMonitoringEntity } from 'container/InfraMonitoringK8sV2/constants'
 import RunQueryBtn from 'container/QueryBuilder/components/RunQueryBtn/RunQueryBtn';
 import { PER_PAGE_OPTIONS } from 'container/TracesExplorer/ListView/configs';
 import { TracesLoading } from 'container/TracesExplorer/TraceLoading/TraceLoading';
-import { saveRecentQueryByExpression } from 'lib/recentQueries/saveRecentQuery';
 import { useQueryState } from 'nuqs';
 import { DataSource } from 'types/common/queryBuilder';
 import { parseAsJsonNoValidate } from 'utils/nuqsParsers';
@@ -99,7 +98,6 @@ function EntityTracesContent({
 					: newUserExpression || '',
 			);
 			if (validation.isValid) {
-				saveRecentQueryByExpression(DataSource.TRACES, newUserExpression);
 				querySearchOnRun(newUserExpression || '');
 
 				void logEvent(InfraMonitoringEvents.FilterApplied, {

frontend/src/container/MetricsExplorer/Summary/MetricsSearch.tsx

@@ -2,7 +2,6 @@ import { useCallback } from 'react';
 import QuerySearch from 'components/QueryBuilderV2/QueryV2/QuerySearch/QuerySearch';
 import RunQueryBtn from 'container/QueryBuilder/components/RunQueryBtn/RunQueryBtn';
 import DateTimeSelectionV2 from 'container/TopNav/DateTimeSelectionV2';
-import { saveRecentQueryByExpression } from 'lib/recentQueries/saveRecentQuery';
 import { DataSource } from 'types/common/queryBuilder';
 
 import { MetricsSearchProps } from './types';
@@ -24,14 +23,12 @@ function MetricsSearch({
 	);
 
 	const handleStageAndRunQuery = useCallback(() => {
-		saveRecentQueryByExpression(DataSource.METRICS, currentQueryFilterExpression);
 		onChange(currentQueryFilterExpression);
 		onRunQuery?.();
 	}, [currentQueryFilterExpression, onChange, onRunQuery]);
 
 	const handleRunQuery = useCallback(
 		(expression: string): void => {
-			saveRecentQueryByExpression(DataSource.METRICS, expression);
 			setCurrentQueryFilterExpression(expression);
 			onChange(expression);
 		},

frontend/src/hooks/member/useMemberRoleManager.ts

@@ -1,22 +1,19 @@
 import { useCallback, useMemo } from 'react';
-import type {
-	AuthtypesGettableRoleDTO,
-	AuthtypesUserRoleDTO,
-} from 'api/generated/services/sigNoz.schemas';
+import { useQueryClient } from 'react-query';
+import type { AuthtypesGettableRoleDTO } from 'api/generated/services/sigNoz.schemas';
 import {
-	useCreateUserRole,
-	useDeleteUserRole,
-	useGetUser,
+	getGetRolesByUserIDQueryKey,
+	useGetRolesByUserID,
+	useRemoveUserRoleByUserIDAndRoleID,
+	useSetRoleByUserID,
 } from 'api/generated/services/users';
 import { retryOn429 } from 'utils/errorUtils';
 
 const enum PromiseStatus {
+	Fulfilled = 'fulfilled',
 	Rejected = 'rejected',
 }
 
-// Stable identity so the memos below do not recompute on every render.
-const EMPTY_USER_ROLES: AuthtypesUserRoleDTO[] = [];
-
 export interface MemberRoleUpdateFailure {
 	roleName: string;
 	error: unknown;
@@ -36,30 +33,30 @@ export function useMemberRoleManager(
 	userId: string,
 	enabled: boolean,
 ): UseMemberRoleManagerResult {
-	const { data, isLoading } = useGetUser(
+	const queryClient = useQueryClient();
+
+	const { data, isLoading } = useGetRolesByUserID(
 		{ id: userId },
 		{ query: { enabled: !!userId && enabled } },
 	);
 
-	const userRoles = data?.data?.userRoles ?? EMPTY_USER_ROLES;
-
 	const currentRoles = useMemo<AuthtypesGettableRoleDTO[]>(
-		() => userRoles.map((userRole) => userRole.role),
-		[userRoles],
+		() => data?.data ?? [],
+		[data?.data],
 	);
 
-	// DELETE /api/v2/user_roles/{id} is keyed by the user_role join row, not the role.
-	const assignmentIdByRoleId = useMemo(
-		() => new Map(userRoles.map((userRole) => [userRole.roleId, userRole.id])),
-		[userRoles],
-	);
+	const { mutateAsync: setRole } = useSetRoleByUserID({
+		mutation: { retry: retryOn429 },
+	});
+	const { mutateAsync: removeRole } = useRemoveUserRoleByUserIDAndRoleID({
+		mutation: { retry: retryOn429 },
+	});
 
-	const { mutateAsync: createUserRole } = useCreateUserRole({
-		mutation: { retry: retryOn429 },
-	});
-	const { mutateAsync: deleteUserRole } = useDeleteUserRole({
-		mutation: { retry: retryOn429 },
-	});
+	const invalidateRoles = useCallback(
+		() =>
+			queryClient.invalidateQueries(getGetRolesByUserIDQueryKey({ id: userId })),
+		[userId, queryClient],
+	);
 
 	const applyDiff = useCallback(
 		async (
@@ -83,33 +80,30 @@ export function useMemberRoleManager(
 			const allOperations = [
 				...addedRoles.map((role) => ({
 					role,
-					run: (): ReturnType<typeof createUserRole> =>
-						createUserRole({ data: { userId, roleId: role.id ?? '' } }),
+					run: (): ReturnType<typeof setRole> =>
+						setRole({
+							pathParams: { id: userId },
+							data: { name: role.name ?? '' },
+						}),
+				})),
+				...removedRoles.map((role) => ({
+					role,
+					run: (): ReturnType<typeof removeRole> =>
+						removeRole({ pathParams: { id: userId, roleId: role.id ?? '' } }),
 				})),
-				...removedRoles
-					.map((role) => ({
-						role,
-						assignmentId: assignmentIdByRoleId.get(role.id ?? ''),
-					}))
-					.filter(
-						(
-							entry,
-						): entry is {
-							role: AuthtypesGettableRoleDTO;
-							assignmentId: string;
-						} => !!entry.assignmentId,
-					)
-					.map(({ role, assignmentId }) => ({
-						role,
-						run: (): ReturnType<typeof deleteUserRole> =>
-							deleteUserRole({ pathParams: { id: assignmentId } }),
-					})),
 			];
 
 			const results = await Promise.allSettled(
 				allOperations.map((op) => op.run()),
 			);
 
+			const successCount = results.filter(
+				(r) => r.status === PromiseStatus.Fulfilled,
+			).length;
+			if (successCount > 0) {
+				await invalidateRoles();
+			}
+
 			const failures: MemberRoleUpdateFailure[] = [];
 			results.forEach((result, index) => {
 				if (result.status === PromiseStatus.Rejected) {
@@ -119,6 +113,7 @@ export function useMemberRoleManager(
 						error: result.reason,
 						onRetry: async (): Promise<void> => {
 							await run();
+							await invalidateRoles();
 						},
 					});
 				}
@@ -126,7 +121,7 @@ export function useMemberRoleManager(
 
 			return failures;
 		},
-		[userId, currentRoles, assignmentIdByRoleId, createUserRole, deleteUserRole],
+		[userId, currentRoles, setRole, removeRole, invalidateRoles],
 	);
 
 	return { currentRoles, isLoading, applyDiff };

frontend/src/lib/recentQueries/saveRecentQuery.ts

@@ -19,30 +19,6 @@ type CompositeWithBuilder = {
 	builder?: { queryData?: IBuilderQuery[] };
 };
 
-export function saveRecentQueryByExpression(
-	dataSource: IBuilderQuery['dataSource'],
-	expression: string | null | undefined,
-	source = '',
-): void {
-	const trimmed = expression?.trim();
-	if (!trimmed) {
-		return;
-	}
-	const validation = validateQuery(trimmed);
-	if (!validation.isValid) {
-		return;
-	}
-	const signal = toSignal(dataSource);
-	if (!signal) {
-		return;
-	}
-	store.save({
-		signal,
-		source,
-		filter: { expression: trimmed },
-	});
-}
-
 // Persists each builder query in the composite as a recent entry. Call this
 // only from explicit user-driven Run triggers — reacting to stagedQuery or any
 // other derived state pollutes recents with navigation/refresh/go-to traffic.
@@ -55,10 +31,22 @@ export function saveRecentQuery(
 	}
 
 	queryData.forEach((q) => {
-		saveRecentQueryByExpression(
-			q.dataSource,
-			q.filter?.expression,
-			q.source ?? '',
-		);
+		const expression = q.filter?.expression?.trim();
+		if (!expression) {
+			return;
+		}
+		const validation = validateQuery(expression);
+		if (!validation.isValid) {
+			return;
+		}
+		const signal = toSignal(q.dataSource);
+		if (!signal) {
+			return;
+		}
+		store.save({
+			signal,
+			source: q.source ?? '',
+			filter: q.filter ?? { expression: '' },
+		});
 	});
 }

pkg/modules/dashboard/impldashboard/v2_module.go

@@ -245,13 +245,11 @@ func (module *module) PatchV2(ctx context.Context, orgID valuer.UUID, id valuer.
 }
 
 func (module *module) DeleteV2(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
-	// Read the storable, not the decoded v2 dashboard: deleting must work even
-	// when the stored data is corrupt or never migrated off the v1 schema.
-	storable, err := module.store.Get(ctx, orgID, id)
+	existing, err := module.GetV2(ctx, orgID, id)
 	if err != nil {
 		return err
 	}
-	if err := storable.ErrIfNotDeletable(); err != nil {
+	if err := existing.ErrIfNotDeletable(); err != nil {
 		return err
 	}
 

pkg/statementbuilder/logsstatementbuilder/stmt_builder_test.go

@@ -469,6 +469,8 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 			expectedErr: nil,
 		},
 		{
+			// The `[*]` path is extracted per value, not as an Array(String) compared to a
+			// scalar — ClickHouse rejects that outright (code 130).
 			name:        "IN operator with json search",
 			requestType: qbtypes.RequestTypeRaw,
 			query: qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]{
@@ -479,7 +481,7 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((JSONExtract(JSON_QUERY(body, '$.\"user_names\"[*]'), 'Array(String)') = ?) AND JSON_EXISTS(body, '$.\"user_names\"[*]')) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Query:    "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE ((JSON_VALUE(body, '$.\"user_names\"[*]') = ?) AND JSON_EXISTS(body, '$.\"user_names\"[*]')) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
 				Args:     []any{"john_doe", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 				Warnings: []string{querybuilder.NewKeyNotFoundWarning("user_names[*]")},
 			},

pkg/statementbuilder/resourcefilter/condition_builder.go

@@ -180,20 +180,16 @@ func (b *defaultConditionBuilder) conditionForKey(
 		if !ok {
 			return "", qbtypes.ErrInValues
 		}
+		// each value carries its own index filter, since `=` derives one from the value
 		inConditions := make([]string, 0, len(values))
 		for _, v := range values {
-			inConditions = append(inConditions, sb.E(fieldName, querybuilder.FormatValueForContains(v)))
-		}
-		mainCondition := sb.Or(inConditions...)
-		valConditions := make([]string, 0, len(values))
-		if valuesForIndexFilter, ok := valueForIndexFilter.([]string); ok {
-			for _, v := range valuesForIndexFilter {
-				valConditions = append(valConditions, sb.Like(column.Name, v))
+			cond, err := b.conditionForKey(ctx, startNs, endNs, key, qbtypes.FilterOperatorEqual, v, sb)
+			if err != nil {
+				return "", err
 			}
+			inConditions = append(inConditions, cond)
 		}
-		mainCondition = sb.And(mainCondition, keyIdxFilter, sb.Or(valConditions...))
-
-		return mainCondition, nil
+		return sb.Or(inConditions...), nil
 	case qbtypes.FilterOperatorNotIn:
 		values, ok := value.([]any)
 		if !ok {
@@ -201,17 +197,13 @@ func (b *defaultConditionBuilder) conditionForKey(
 		}
 		notInConditions := make([]string, 0, len(values))
 		for _, v := range values {
-			notInConditions = append(notInConditions, sb.NE(fieldName, querybuilder.FormatValueForContains(v)))
-		}
-		mainCondition := sb.And(notInConditions...)
-		valConditions := make([]string, 0, len(values))
-		if valuesForIndexFilter, ok := valueForIndexFilter.([]string); ok {
-			for _, v := range valuesForIndexFilter {
-				valConditions = append(valConditions, sb.NotLike(column.Name, v))
+			cond, err := b.conditionForKey(ctx, startNs, endNs, key, qbtypes.FilterOperatorNotEqual, v, sb)
+			if err != nil {
+				return "", err
 			}
+			notInConditions = append(notInConditions, cond)
 		}
-		mainCondition = sb.And(mainCondition, sb.And(valConditions...))
-		return mainCondition, nil
+		return sb.And(notInConditions...), nil
 
 	case qbtypes.FilterOperatorExists:
 		return sb.And(

pkg/statementbuilder/resourcefilter/condition_builder_test.go

@@ -109,8 +109,8 @@ func TestConditionBuilder(t *testing.T) {
 			},
 			op:           qbtypes.FilterOperatorIn,
 			value:        []any{"watch", "redis"},
-			expected:     "(simpleJSONExtractString(labels, 'k8s.namespace.name') = ? OR simpleJSONExtractString(labels, 'k8s.namespace.name') = ?) AND labels LIKE ? AND (labels LIKE ? OR labels LIKE ?)",
-			expectedArgs: []any{"watch", "redis", "%k8s.namespace.name%", "%k8s.namespace.name\":\"watch%", "%k8s.namespace.name\":\"redis%"},
+			expected:     "((simpleJSONExtractString(labels, 'k8s.namespace.name') = ? AND labels LIKE ? AND labels LIKE ?) OR (simpleJSONExtractString(labels, 'k8s.namespace.name') = ? AND labels LIKE ? AND labels LIKE ?))",
+			expectedArgs: []any{"watch", "%k8s.namespace.name%", "%k8s.namespace.name\":\"watch%", "redis", "%k8s.namespace.name%", "%k8s.namespace.name\":\"redis%"},
 		},
 		{
 			name: "string_not_in",
@@ -120,8 +120,8 @@ func TestConditionBuilder(t *testing.T) {
 			},
 			op:           qbtypes.FilterOperatorNotIn,
 			value:        []any{"watch", "redis"},
-			expected:     "(simpleJSONExtractString(labels, 'k8s.namespace.name') <> ? AND simpleJSONExtractString(labels, 'k8s.namespace.name') <> ?) AND (labels NOT LIKE ? AND labels NOT LIKE ?)",
-			expectedArgs: []any{"watch", "redis", "%k8s.namespace.name\":\"watch%", "%k8s.namespace.name\":\"redis%"},
+			expected:     "((simpleJSONExtractString(labels, 'k8s.namespace.name') <> ? AND labels NOT LIKE ?) AND (simpleJSONExtractString(labels, 'k8s.namespace.name') <> ? AND labels NOT LIKE ?))",
+			expectedArgs: []any{"watch", "%k8s.namespace.name\":\"watch%", "redis", "%k8s.namespace.name\":\"redis%"},
 		},
 		{
 			name: "string_exists",
@@ -173,8 +173,8 @@ func TestConditionBuilder(t *testing.T) {
 			},
 			op:           qbtypes.FilterOperatorIn,
 			value:        []any{1, 2},
-			expected:     "(simpleJSONExtractString(labels, 'test_num') = ? OR simpleJSONExtractString(labels, 'test_num') = ?) AND labels LIKE ? AND (labels LIKE ? OR labels LIKE ?)",
-			expectedArgs: []any{"1", "2", "%test_num%", "%test_num\":\"1%", "%test_num\":\"2%"},
+			expected:     "((simpleJSONExtractString(labels, 'test_num') = ? AND labels LIKE ? AND labels LIKE ?) OR (simpleJSONExtractString(labels, 'test_num') = ? AND labels LIKE ? AND labels LIKE ?))",
+			expectedArgs: []any{"1", "%test_num%", "%test_num\":\"1%", "2", "%test_num%", "%test_num\":\"2%"},
 		},
 		{
 			name: "number_between",

pkg/statementbuilder/resourcefilter/statement_builder_test.go

@@ -229,8 +229,8 @@ func TestResourceFilterStatementBuilder_Traces(t *testing.T) {
 			start: testStartNs,
 			end:   testEndNs,
 			expected: &qbtypes.Statement{
-				Query: "SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE ((simpleJSONExtractString(labels, 'service.name') = ? OR simpleJSONExtractString(labels, 'service.name') = ?) AND labels LIKE ? AND (labels LIKE ? OR labels LIKE ?)) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint",
-				Args:  []any{"redis", "postgres", "%service.name%", "%service.name\":\"redis%", "%service.name\":\"postgres%", expectedBucketStart, expectedBucketEnd},
+				Query: "SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE ((simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?) OR (simpleJSONExtractString(labels, 'service.name') = ? AND labels LIKE ? AND labels LIKE ?)) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint",
+				Args:  []any{"redis", "%service.name%", "%service.name\":\"redis%", "postgres", "%service.name%", "%service.name\":\"postgres%", expectedBucketStart, expectedBucketEnd},
 			},
 		},
 		{
@@ -244,8 +244,8 @@ func TestResourceFilterStatementBuilder_Traces(t *testing.T) {
 			start: testStartNs,
 			end:   testEndNs,
 			expected: &qbtypes.Statement{
-				Query: "SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE ((simpleJSONExtractString(labels, 'service.name') <> ? AND simpleJSONExtractString(labels, 'service.name') <> ?) AND (labels NOT LIKE ? AND labels NOT LIKE ?)) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint",
-				Args:  []any{"redis", "postgres", "%service.name\":\"redis%", "%service.name\":\"postgres%", expectedBucketStart, expectedBucketEnd},
+				Query: "SELECT fingerprint FROM signoz_traces.distributed_traces_v3_resource WHERE ((simpleJSONExtractString(labels, 'service.name') <> ? AND labels NOT LIKE ?) AND (simpleJSONExtractString(labels, 'service.name') <> ? AND labels NOT LIKE ?)) AND seen_at_ts_bucket_start >= ? AND seen_at_ts_bucket_start <= ? GROUP BY fingerprint",
+				Args:  []any{"redis", "%service.name\":\"redis%", "postgres", "%service.name\":\"postgres%", expectedBucketStart, expectedBucketEnd},
 			},
 		},
 		{

pkg/telemetryschema/audittelemetryschema/condition_builder.go

@@ -94,7 +94,11 @@ func (c *conditionBuilder) conditionFor(
 		}
 		conditions := []string{}
 		for _, value := range values {
-			conditions = append(conditions, sb.E(fieldExpression, value))
+			cond, err := c.conditionFor(ctx, orgID, startNs, endNs, key, qbtypes.FilterOperatorEqual, value, sb)
+			if err != nil {
+				return "", err
+			}
+			conditions = append(conditions, cond)
 		}
 		return sb.Or(conditions...), nil
 	case qbtypes.FilterOperatorNotIn:
@@ -104,7 +108,11 @@ func (c *conditionBuilder) conditionFor(
 		}
 		conditions := []string{}
 		for _, value := range values {
-			conditions = append(conditions, sb.NE(fieldExpression, value))
+			cond, err := c.conditionFor(ctx, orgID, startNs, endNs, key, qbtypes.FilterOperatorNotEqual, value, sb)
+			if err != nil {
+				return "", err
+			}
+			conditions = append(conditions, cond)
 		}
 		return sb.And(conditions...), nil
 	case qbtypes.FilterOperatorExists, qbtypes.FilterOperatorNotExists:

pkg/telemetryschema/logstelemetryschema/condition_builder.go

@@ -410,7 +410,11 @@ func (c *conditionBuilder) conditionForResolvedKey(
 		// instead of using IN, we use `=` + `OR` to make use of index
 		conditions := []string{}
 		for _, value := range values {
-			conditions = append(conditions, sb.E(fieldExpression, value))
+			cond, err := c.conditionForResolvedKey(ctx, orgID, startNs, endNs, key, qbtypes.FilterOperatorEqual, value, sb)
+			if err != nil {
+				return "", err
+			}
+			conditions = append(conditions, cond)
 		}
 		return sb.Or(conditions...), nil
 	case qbtypes.FilterOperatorNotIn:
@@ -421,7 +425,11 @@ func (c *conditionBuilder) conditionForResolvedKey(
 		// instead of using NOT IN, we use `!=` + `AND` to make use of index
 		conditions := []string{}
 		for _, value := range values {
-			conditions = append(conditions, sb.NE(fieldExpression, value))
+			cond, err := c.conditionForResolvedKey(ctx, orgID, startNs, endNs, key, qbtypes.FilterOperatorNotEqual, value, sb)
+			if err != nil {
+				return "", err
+			}
+			conditions = append(conditions, cond)
 		}
 		return sb.And(conditions...), nil
 

pkg/telemetryschema/logstelemetryschema/condition_builder_test.go

@@ -905,3 +905,52 @@ func TestConditionForJSONBodySearch(t *testing.T) {
 		})
 	}
 }
+
+// IN on the body column routes each value back through the `=` path; the SQL it produces
+// must stay what the shared IN handling produced before, including for a mixed-type list.
+func TestConditionForBodyIn(t *testing.T) {
+	testCases := []struct {
+		name         string
+		values       []any
+		expectedSQL  string
+		expectedArgs []any
+	}{
+		{
+			name:         "strings",
+			values:       []any{"alpha", "beta"},
+			expectedSQL:  "(body = ? OR body = ?)",
+			expectedArgs: []any{"alpha", "beta"},
+		},
+		{
+			name:         "mixed types are stringified before they reach the column",
+			values:       []any{"alpha", float64(1), true},
+			expectedSQL:  "(body = ? OR body = ? OR body = ?)",
+			expectedArgs: []any{"alpha", "1", "true"},
+		},
+	}
+
+	fl := flaggertest.New(t)
+	fm := NewFieldMapper(fl)
+	conditionBuilder := NewConditionBuilder(fm, fl)
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			key := telemetrytypes.TelemetryFieldKey{
+				Name:          "body",
+				FieldContext:  telemetrytypes.FieldContextLog,
+				FieldDataType: telemetrytypes.FieldDataTypeString,
+			}
+			sb := sqlbuilder.NewSelectBuilder()
+			sb.Select("1").From("t")
+			cond, _, err := conditionBuilder.ConditionFor(context.Background(), valuer.UUID{}, 0, 0, &key,
+				map[string][]*telemetrytypes.TelemetryFieldKey{key.Name: {&key}}, qbtypes.ConditionBuilderOptions{},
+				qbtypes.FilterOperatorIn, tc.values, sb)
+			require.NoError(t, err)
+			sb.Where(cond...)
+
+			sql, args := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
+			assert.Contains(t, sql, tc.expectedSQL)
+			assert.Equal(t, tc.expectedArgs, args)
+		})
+	}
+}

pkg/telemetryschema/tracestelemetryschema/condition_builder.go

@@ -135,7 +135,11 @@ func (c *conditionBuilder) conditionFor(
 		// instead of using IN, we use `=` + `OR` to make use of index
 		conditions := []string{}
 		for _, value := range values {
-			conditions = append(conditions, sb.E(fieldExpression, value))
+			cond, err := c.conditionFor(ctx, orgID, startNs, endNs, key, qbtypes.FilterOperatorEqual, value, sb)
+			if err != nil {
+				return "", err
+			}
+			conditions = append(conditions, cond)
 		}
 		return sb.Or(conditions...), nil
 	case qbtypes.FilterOperatorNotIn:
@@ -146,7 +150,11 @@ func (c *conditionBuilder) conditionFor(
 		// instead of using NOT IN, we use `!=` + `AND` to make use of index
 		conditions := []string{}
 		for _, value := range values {
-			conditions = append(conditions, sb.NE(fieldExpression, value))
+			cond, err := c.conditionFor(ctx, orgID, startNs, endNs, key, qbtypes.FilterOperatorNotEqual, value, sb)
+			if err != nil {
+				return "", err
+			}
+			conditions = append(conditions, cond)
 		}
 		return sb.And(conditions...), nil
 

pkg/types/dashboardtypes/dashboard.go

@@ -201,18 +201,6 @@ func (storableDashboardData *StorableDashboardData) GetWidgetIds() []string {
 	return widgetIds
 }
 
-// ErrIfNotDeletable gates deletion on the columns alone, never on Data, so a
-// dashboard whose data is corrupt or stuck on the v1 schema stays deletable.
-func (storable StorableDashboard) ErrIfNotDeletable() error {
-	if storable.Locked {
-		return errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "cannot delete a locked dashboard, please unlock the dashboard to delete")
-	}
-	if !storable.Source.isUserDeletable() {
-		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be deleted", storable.Source)
-	}
-	return nil
-}
-
 func (dashboard *Dashboard) ErrIfNotMutable() error {
 	if dashboard.Source == SourceIntegration {
 		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "integration dashboards cannot be modified")

pkg/types/dashboardtypes/dashboard_test.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"testing"
 
-	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/stretchr/testify/assert"
 )
@@ -82,64 +81,3 @@ func TestCanUpdate_MultipleDeletions_ByDiff(t *testing.T) {
 		})
 	}
 }
-
-func TestStorableDashboardErrIfNotDeletable(t *testing.T) {
-	testCases := []struct {
-		subtestName     string
-		locked          bool
-		source          Source
-		data            StorableDashboardData
-		expectDeletable bool
-	}{
-		{
-			subtestName:     "user dashboard on the v2 schema",
-			source:          SourceUser,
-			data:            StorableDashboardData{"metadata": map[string]any{"schemaVersion": SchemaVersion}},
-			expectDeletable: true,
-		},
-		{
-			subtestName:     "user dashboard still on the v1 schema",
-			source:          SourceUser,
-			data:            StorableDashboardData{"widgets": makeTestWidgets("a")},
-			expectDeletable: true,
-		},
-		{
-			subtestName:     "user dashboard with unreadable data",
-			source:          SourceUser,
-			data:            StorableDashboardData{"metadata": "not-an-object"},
-			expectDeletable: true,
-		},
-		{
-			subtestName:     "locked user dashboard",
-			locked:          true,
-			source:          SourceUser,
-			data:            StorableDashboardData{"widgets": makeTestWidgets("a")},
-			expectDeletable: false,
-		},
-		{
-			subtestName:     "system dashboard",
-			source:          SourceSystem,
-			data:            StorableDashboardData{"widgets": makeTestWidgets("a")},
-			expectDeletable: false,
-		},
-		{
-			subtestName:     "integration dashboard",
-			source:          SourceIntegration,
-			data:            StorableDashboardData{"widgets": makeTestWidgets("a")},
-			expectDeletable: false,
-		},
-	}
-
-	for _, tc := range testCases {
-		t.Run(tc.subtestName, func(t *testing.T) {
-			storable := StorableDashboard{
-				Identifiable: types.Identifiable{ID: valuer.GenerateUUID()},
-				OrgID:        valuer.GenerateUUID(),
-				Locked:       tc.locked,
-				Source:       tc.source,
-				Data:         tc.data,
-			}
-			assert.Equal(t, tc.expectDeletable, storable.ErrIfNotDeletable() == nil)
-		})
-	}
-}

pkg/types/dashboardtypes/perses_dashboard.go

@@ -129,6 +129,16 @@ func (d *DashboardV2) LockUnlock(lock bool, isAdmin bool, updatedBy string) erro
 	return nil
 }
 
+func (d *DashboardV2) ErrIfNotDeletable() error {
+	if d.Locked {
+		return errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "cannot delete a locked dashboard, please unlock the dashboard to delete")
+	}
+	if !d.Source.isUserDeletable() {
+		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be deleted", d.Source)
+	}
+	return nil
+}
+
 func (d *DashboardV2) ErrIfNotClonable() error {
 	if !d.Source.isClonable() {
 		return errors.Newf(errors.TypeInvalidInput, ErrCodeDashboardImmutable, "%s dashboards cannot be cloned", d.Source)

tests/fixtures/cloudintegrations.py

@@ -26,14 +26,14 @@ class ProviderAccountSpec:
     provider: str
     # params for the account created by default.
     initial_params: dict
+    # params for the config an update (PUT) test sends.
+    updated_params: dict
     # params -> the provider-keyed `config` block for a POST/PUT body.
     build_config: Callable[[dict], dict]
     # params -> the full config block the API is expected to return under
     # config[provider] on GET/list. This may differ from what build_config sends:
     # e.g. AWS accepts deploymentRegion on POST but the API does not echo it back.
     expected_config: Callable[[dict], dict]
-    # only the suites that exercise updates need to supply it.
-    updated_params: dict = field(default_factory=dict)
     # id shown in parametrized test names; defaults to the provider slug.
     id: str = field(default="")
 
@@ -42,29 +42,6 @@ class ProviderAccountSpec:
             object.__setattr__(self, "id", self.provider)
 
 
-# Per-provider service shape.
-@dataclass(frozen=True)
-class ProviderServiceSpec:
-    provider: str
-    service_id: str
-    # GCP ships every service with supportedSignals.logs false, so a logs block
-    # is neither required on write nor persisted.
-    supports_logs: bool
-    account_config: dict
-    # id shown in parametrized test names; defaults to the provider slug.
-    id: str = field(default="")
-
-    def __post_init__(self) -> None:
-        if not self.id:
-            object.__setattr__(self, "id", self.provider)
-
-    def build_service_config(self, metrics_enabled: bool, logs_enabled: bool | None = None) -> dict:
-        config: dict = {"metrics": {"enabled": metrics_enabled}}
-        if self.supports_logs:
-            config["logs"] = {"enabled": metrics_enabled if logs_enabled is None else logs_enabled}
-        return {self.provider: config}
-
-
 @pytest.fixture(scope="function")
 def deprecated_create_cloud_integration_account(
     request: pytest.FixtureRequest,

tests/integration/tests/cloudintegrations/02_create_account.py

@@ -1,52 +1,14 @@
 from collections.abc import Callable
 from http import HTTPStatus
 
-import pytest
 import requests
 
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD, add_license
-from fixtures.cloudintegrations import ProviderAccountSpec
 from fixtures.logger import setup_logger
 
 logger = setup_logger(__name__)
 
-AWS_ACCOUNT_SPEC = ProviderAccountSpec(
-    provider="aws",
-    initial_params={"deployment_region": "us-east-1", "regions": ["us-east-1", "us-west-2"]},
-    build_config=lambda p: {"aws": {"deploymentRegion": p["deployment_region"], "regions": p["regions"]}},
-    expected_config=lambda p: {"regions": p["regions"]},
-)
-
-GCP_ACCOUNT_SPEC = ProviderAccountSpec(
-    provider="gcp",
-    initial_params={
-        "deployment_project_id": "signoz-test-project",
-        "deployment_region": "us-central1",
-        "project_ids": ["signoz-test-project"],
-    },
-    build_config=lambda p: {
-        "gcp": {
-            "deploymentProjectId": p["deployment_project_id"],
-            "deploymentRegion": p["deployment_region"],
-            "projectIds": p["project_ids"],
-        }
-    },
-    expected_config=lambda p: {
-        "deploymentProjectId": p["deployment_project_id"],
-        "deploymentRegion": p["deployment_region"],
-        "projectIds": p["project_ids"],
-    },
-)
-
-PROVIDER_ACCOUNT_SPECS = [AWS_ACCOUNT_SPEC, GCP_ACCOUNT_SPEC]
-
-provider_spec = pytest.mark.parametrize(
-    "spec",
-    PROVIDER_ACCOUNT_SPECS,
-    ids=[s.id for s in PROVIDER_ACCOUNT_SPECS],
-)
-
 
 def test_apply_license(
     signoz: types.SigNoz,
@@ -58,19 +20,19 @@ def test_apply_license(
     add_license(signoz, make_http_mocks, get_token)
 
 
-@provider_spec
 def test_create_account(
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderAccountSpec,
 ) -> None:
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    cloud_provider = "aws"
 
     data = create_cloud_integration_account(
         admin_token,
-        spec.provider,
-        config=spec.build_config(spec.initial_params),
+        cloud_provider,
+        deployment_region="us-east-1",
+        regions=["us-east-1", "us-west-2"],
     )
 
     assert "id" in data, "Response data should contain 'id' field"
@@ -78,17 +40,12 @@ def test_create_account(
 
     assert "connectionArtifact" in data, "Response data should contain 'connectionArtifact' field"
     artifact = data["connectionArtifact"]
+    assert "aws" in artifact, "connectionArtifact should contain 'aws' field"
+    assert "connectionUrl" in artifact["aws"], "connectionArtifact.aws should contain 'connectionUrl'"
 
-    if spec.provider == "aws":
-        assert "aws" in artifact, "connectionArtifact should contain 'aws' field"
-        assert "connectionUrl" in artifact["aws"], "connectionArtifact.aws should contain 'connectionUrl'"
-
-        connection_url = artifact["aws"]["connectionUrl"]
-        assert "console.aws.amazon.com/cloudformation" in connection_url, "connectionUrl should be an AWS CloudFormation URL"
-        assert f"region={spec.initial_params['deployment_region']}" in connection_url, "connectionUrl should contain the deployment region"
-    else:
-        # GCP is a manual flow: no one-click install artifact.
-        assert artifact.get("gcp") is None, f"GCP should not return a connection artifact, got: {artifact}"
+    connection_url = artifact["aws"]["connectionUrl"]
+    assert "console.aws.amazon.com/cloudformation" in connection_url, "connectionUrl should be an AWS CloudFormation URL"
+    assert "region=us-east-1" in connection_url, "connectionUrl should contain the deployment region"
 
 
 def test_create_account_unsupported_provider(
@@ -119,36 +76,3 @@ def test_create_account_unsupported_provider(
 
     response_data = response.json()
     assert "error" in response_data, "Response should contain 'error' field"
-
-
-def test_create_gcp_account_without_project_ids(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-) -> None:
-    """GCP account config requires at least one project ID to monitor."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    response = requests.post(
-        signoz.self.host_configs["8080"].get("/api/v1/cloud_integrations/gcp/accounts"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        json={
-            "config": {
-                "gcp": {
-                    "deploymentProjectId": "signoz-test-project",
-                    "deploymentRegion": "us-central1",
-                    "projectIds": [],
-                }
-            },
-            "credentials": {
-                "sigNozApiURL": "https://test.signoz.cloud",
-                "sigNozApiKey": "test-key",
-                "ingestionUrl": "https://ingest.test.signoz.cloud",
-                "ingestionKey": "test-ingestion-key",
-            },
-        },
-        timeout=10,
-    )
-
-    assert response.status_code == HTTPStatus.BAD_REQUEST, f"Expected 400 for empty projectIds, got {response.status_code}: {response.text}"
-    assert "error" in response.json(), "Response should contain 'error' field"

tests/integration/tests/cloudintegrations/03_agent_check_in.py

@@ -2,53 +2,14 @@ import uuid
 from collections.abc import Callable
 from http import HTTPStatus
 
-import pytest
-
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD, add_license
-from fixtures.cloudintegrations import (
-    ProviderAccountSpec,
-    simulate_agent_checkin,
-)
+from fixtures.cloudintegrations import simulate_agent_checkin
 from fixtures.logger import setup_logger
 
 logger = setup_logger(__name__)
 
-AWS_ACCOUNT_SPEC = ProviderAccountSpec(
-    provider="aws",
-    initial_params={"deployment_region": "us-east-1", "regions": ["us-east-1"]},
-    build_config=lambda p: {"aws": {"deploymentRegion": p["deployment_region"], "regions": p["regions"]}},
-    expected_config=lambda p: {"regions": p["regions"]},
-)
-
-GCP_ACCOUNT_SPEC = ProviderAccountSpec(
-    provider="gcp",
-    initial_params={
-        "deployment_project_id": "signoz-test-project",
-        "deployment_region": "us-central1",
-        "project_ids": ["signoz-test-project"],
-    },
-    build_config=lambda p: {
-        "gcp": {
-            "deploymentProjectId": p["deployment_project_id"],
-            "deploymentRegion": p["deployment_region"],
-            "projectIds": p["project_ids"],
-        }
-    },
-    expected_config=lambda p: {
-        "deploymentProjectId": p["deployment_project_id"],
-        "deploymentRegion": p["deployment_region"],
-        "projectIds": p["project_ids"],
-    },
-)
-
-PROVIDER_ACCOUNT_SPECS = [AWS_ACCOUNT_SPEC, GCP_ACCOUNT_SPEC]
-
-provider_spec = pytest.mark.parametrize(
-    "spec",
-    PROVIDER_ACCOUNT_SPECS,
-    ids=[s.id for s in PROVIDER_ACCOUNT_SPECS],
-)
+CLOUD_PROVIDER = "aws"
 
 
 def test_apply_license(
@@ -61,28 +22,22 @@ def test_apply_license(
     add_license(signoz, make_http_mocks, get_token)
 
 
-@provider_spec
 def test_agent_check_in(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderAccountSpec,
 ) -> None:
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(
-        admin_token,
-        spec.provider,
-        config=spec.build_config(spec.initial_params),
-    )
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER, regions=["us-east-1"])
     account_id = account["id"]
     provider_account_id = str(uuid.uuid4())
 
     response = simulate_agent_checkin(
         signoz,
         admin_token,
-        spec.provider,
+        CLOUD_PROVIDER,
         account_id,
         provider_account_id,
         data={"version": "v0.0.8"},
@@ -92,63 +47,57 @@ def test_agent_check_in(
 
     data = response.json()["data"]
 
+    # New camelCase fields
     assert data["cloudIntegrationId"] == account_id, "cloudIntegrationId should match"
     assert data["providerAccountId"] == provider_account_id, "providerAccountId should match"
     assert "integrationConfig" in data, "Response should contain 'integrationConfig'"
     assert data["removedAt"] is None, "removedAt should be null for a live account"
 
-    if spec.provider == "aws":
-        # Backward compat for agents deployed before the camelCase response; AWS only.
-        assert data["account_id"] == account_id, "account_id (compat) should match"
-        assert data["cloud_account_id"] == provider_account_id, "cloud_account_id (compat) should match"
-        assert "integration_config" in data, "Response should contain 'integration_config' (compat)"
-        assert "removed_at" in data, "Response should contain 'removed_at' (compat)"
+    # Backward-compat snake_case fields
+    assert data["account_id"] == account_id, "account_id (compat) should match"
+    assert data["cloud_account_id"] == provider_account_id, "cloud_account_id (compat) should match"
+    assert "integration_config" in data, "Response should contain 'integration_config' (compat)"
+    assert "removed_at" in data, "Response should contain 'removed_at' (compat)"
 
-        integration_config = data["integrationConfig"]
-        assert "aws" in integration_config, "integrationConfig should contain 'aws' block"
-        assert integration_config["aws"]["enabledRegions"] == spec.initial_params["regions"], "enabledRegions should match account config"
-    else:
-        # GCP is a manual flow: the agent carries its own configuration.
-        assert data["integrationConfig"].get("gcp") is None, f"GCP should not return an integration config, got: {data['integrationConfig']}"
+    # integrationConfig should reflect the configured regions
+    integration_config = data["integrationConfig"]
+    assert "aws" in integration_config, "integrationConfig should contain 'aws' block"
+    assert integration_config["aws"]["enabledRegions"] == ["us-east-1"], "enabledRegions should match account config"
 
 
-@provider_spec
 def test_agent_check_in_account_not_found(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    spec: ProviderAccountSpec,
 ) -> None:
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
     fake_id = str(uuid.uuid4())
 
-    response = simulate_agent_checkin(signoz, admin_token, spec.provider, fake_id, str(uuid.uuid4()))
+    response = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, fake_id, str(uuid.uuid4()))
 
     assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}: {response.text}"
 
 
-@provider_spec
 def test_duplicate_cloud_account_checkins(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderAccountSpec,
 ) -> None:
     """Test that two different accounts cannot check in with the same providerAccountId."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account1 = create_cloud_integration_account(admin_token, spec.provider, config=spec.build_config(spec.initial_params))
-    account2 = create_cloud_integration_account(admin_token, spec.provider, config=spec.build_config(spec.initial_params))
+    account1 = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
+    account2 = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
 
     assert account1["id"] != account2["id"], "Two accounts should have different IDs"
 
     same_provider_account_id = str(uuid.uuid4())
 
     # First check-in: account1 claims the provider account ID
-    response = simulate_agent_checkin(signoz, admin_token, spec.provider, account1["id"], same_provider_account_id)
+    response = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account1["id"], same_provider_account_id)
     assert response.status_code == HTTPStatus.OK, f"Expected 200 for first check-in, got {response.status_code}: {response.text}"
 
     # Second check-in: account2 tries to claim the same provider account ID → 409
-    response = simulate_agent_checkin(signoz, admin_token, spec.provider, account2["id"], same_provider_account_id)
+    response = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account2["id"], same_provider_account_id)
     assert response.status_code == HTTPStatus.CONFLICT, f"Expected 409 for duplicate providerAccountId, got {response.status_code}: {response.text}"

tests/integration/tests/cloudintegrations/05_services.py

@@ -2,47 +2,18 @@ import uuid
 from collections.abc import Callable
 from http import HTTPStatus
 
-import pytest
 import requests
 from sqlalchemy import bindparam, sql
 
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD, add_license
-from fixtures.cloudintegrations import (
-    ProviderServiceSpec,
-    simulate_agent_checkin,
-)
+from fixtures.cloudintegrations import simulate_agent_checkin
 from fixtures.logger import setup_logger
 
 logger = setup_logger(__name__)
 
-AWS_SERVICE_SPEC = ProviderServiceSpec(
-    provider="aws",
-    service_id="rds",
-    supports_logs=True,
-    account_config={"aws": {"deploymentRegion": "us-east-1", "regions": ["us-east-1"]}},
-)
-
-GCP_SERVICE_SPEC = ProviderServiceSpec(
-    provider="gcp",
-    service_id="cloudsql_postgres",
-    supports_logs=False,
-    account_config={
-        "gcp": {
-            "deploymentProjectId": "signoz-test-project",
-            "deploymentRegion": "us-central1",
-            "projectIds": ["signoz-test-project"],
-        }
-    },
-)
-
-PROVIDER_SERVICE_SPECS = [AWS_SERVICE_SPEC, GCP_SERVICE_SPEC]
-
-provider_spec = pytest.mark.parametrize(
-    "spec",
-    PROVIDER_SERVICE_SPECS,
-    ids=[s.id for s in PROVIDER_SERVICE_SPECS],
-)
+CLOUD_PROVIDER = "aws"
+SERVICE_ID = "rds"
 
 
 def test_apply_license(
@@ -55,18 +26,16 @@ def test_apply_license(
     add_license(signoz, make_http_mocks, get_token)
 
 
-@provider_spec
 def test_list_services_without_account(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    spec: ProviderServiceSpec,
 ) -> None:
     """List the cloud provider's supported services"""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/services"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/services"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -84,37 +53,35 @@ def test_list_services_without_account(
     assert "icon" in service, "Service should have 'icon' field"
     assert "enabled" in service, "Service should have 'enabled' field"
 
-    listed_ids = {s["id"] for s in data["services"]}
-    assert spec.service_id in listed_ids, f"'{spec.service_id}' should be listed for {spec.provider}"
+
+EC2_SERVICE_ID = "ec2"
 
 
-@provider_spec
 def test_list_account_services(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
-    """ListAccountServicesMetadata reflects enabled state per service."""
+    """ListAccountServicesMetadata reflects enabled state after enabling a service."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
     account_id = account["id"]
 
-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
     assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
 
     put_response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{EC2_SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": True}}}},
         timeout=10,
     )
-    assert put_response.status_code == HTTPStatus.NO_CONTENT, f"Enable {spec.service_id} failed: {put_response.status_code}: {put_response.text}"
+    assert put_response.status_code == HTTPStatus.NO_CONTENT, f"Enable ec2 failed: {put_response.status_code}: {put_response.text}"
 
     list_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -125,28 +92,21 @@ def test_list_account_services(
     assert isinstance(data["services"], list), "services should be a list"
     assert len(data["services"]) > 0, "services list should be non-empty"
 
-    enabled_service = next((s for s in data["services"] if s["id"] == spec.service_id), None)
-    assert enabled_service is not None, f"Service '{spec.service_id}' not found in services list"
-    assert enabled_service["enabled"] is True, f"Service should be enabled, got: {enabled_service['enabled']}"
-
-    # The listing must report state per service, not blanket-enable or echo the write.
-    untouched_service = next((s for s in data["services"] if s["id"] != spec.service_id), None)
-    assert untouched_service is not None, "Expected more than one service in the listing"
-    assert untouched_service["enabled"] is False, f"Service '{untouched_service['id']}' was never enabled, got: {untouched_service['enabled']}"
+    ec2_service = next((s for s in data["services"] if s["id"] == EC2_SERVICE_ID), None)
+    assert ec2_service is not None, f"EC2 service '{EC2_SERVICE_ID}' not found in services list"
+    assert ec2_service["enabled"] is True, f"EC2 service should be enabled, got: {ec2_service['enabled']}"
 
 
-@provider_spec
 def test_get_service_details_without_account(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    spec: ProviderServiceSpec,
 ) -> None:
     """Get full service definition without specifying an account."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -154,36 +114,31 @@ def test_get_service_details_without_account(
     assert response.status_code == HTTPStatus.OK, f"Expected 200, got {response.status_code}"
 
     data = response.json()["data"]
-    assert data["id"] == spec.service_id, f"id should be '{spec.service_id}'"
+    assert data["id"] == SERVICE_ID, f"id should be '{SERVICE_ID}'"
     assert "title" in data, "Service should have 'title'"
     assert "overview" in data, "Service should have 'overview' (markdown)"
     assert "assets" in data, "Service should have 'assets'"
     assert isinstance(data["assets"]["dashboards"], list), "assets.dashboards should be a list"
     assert data["cloudIntegrationService"] is None, "cloudIntegrationService should be null without account context"
 
-    assert data["supportedSignals"]["metrics"] is True, "metrics should be a supported signal"
-    assert data["supportedSignals"]["logs"] is spec.supports_logs, f"logs support should be {spec.supports_logs} for {spec.provider}"
 
-
-@provider_spec
 def test_get_account_service(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
     """Get service for a specific account — all disabled by default."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
     account_id = account["id"]
 
-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
     assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
 
     response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -191,22 +146,20 @@ def test_get_account_service(
     assert response.status_code == HTTPStatus.OK, f"Expected 200, got {response.status_code}"
 
     data = response.json()["data"]
-    assert data["id"] == spec.service_id, f"id should be '{spec.service_id}'"
+    assert data["id"] == SERVICE_ID, f"id should be '{SERVICE_ID}'"
     assert data["cloudIntegrationService"] is None, "cloudIntegrationService should be null before any config is set"
 
 
-@provider_spec
 def test_get_service_not_found(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    spec: ProviderServiceSpec,
 ) -> None:
     """Get a non-existent service ID returns 400 (invalid service ID is a bad request)."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/services/non-existent-service"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/services/non-existent-service"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -214,34 +167,32 @@ def test_get_service_not_found(
     assert response.status_code == HTTPStatus.BAD_REQUEST, f"Expected 400, got {response.status_code}"
 
 
-@provider_spec
 def test_update_service_config(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
     """Enable a service and verify the config is persisted via GET."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
     account_id = account["id"]
 
-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
     assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
 
     put_response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": True}}}},
         timeout=10,
     )
 
     assert put_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204, got {put_response.status_code}: {put_response.text}"
 
     get_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -250,39 +201,33 @@ def test_update_service_config(
     data = get_response.json()["data"]
     svc = data["cloudIntegrationService"]
     assert svc is not None, "cloudIntegrationService should be non-null after UpdateService"
-    assert svc["config"][spec.provider]["metrics"]["enabled"] is True, "metrics should be enabled"
+    assert svc["config"]["aws"]["metrics"]["enabled"] is True, "metrics should be enabled"
+    assert svc["config"]["aws"]["logs"]["enabled"] is True, "logs should be enabled"
     assert svc["cloudIntegrationId"] == account_id, "cloudIntegrationId should match the account"
 
-    if spec.supports_logs:
-        assert svc["config"][spec.provider]["logs"]["enabled"] is True, "logs should be enabled"
-    else:
-        assert svc["config"][spec.provider].get("logs") is None, f"logs should not be stored for {spec.provider}, got: {svc['config'][spec.provider]}"
 
-
-@provider_spec
 def test_update_service_config_disable(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
     """Enable then disable a service — config change is persisted."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
     account_id = account["id"]
 
-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
     assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
 
-    endpoint = signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}")
+    endpoint = signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}")
 
     # Enable
     r = requests.put(
         endpoint,
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": True}}}},
         timeout=10,
     )
     assert r.status_code == HTTPStatus.NO_CONTENT, f"Enable failed: {r.status_code}: {r.text}"
@@ -291,13 +236,13 @@ def test_update_service_config_disable(
     r = requests.put(
         endpoint,
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(False)},
+        json={"config": {"aws": {"metrics": {"enabled": False}, "logs": {"enabled": False}}}},
         timeout=10,
     )
     assert r.status_code == HTTPStatus.NO_CONTENT, f"Disable failed: {r.status_code}: {r.text}"
 
     get_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -305,57 +250,28 @@ def test_update_service_config_disable(
     assert get_response.status_code == HTTPStatus.OK
     svc = get_response.json()["data"]["cloudIntegrationService"]
     assert svc is not None, "cloudIntegrationService should still be present after disable"
-    assert svc["config"][spec.provider]["metrics"]["enabled"] is False, "metrics should be disabled"
-
-    if spec.supports_logs:
-        assert svc["config"][spec.provider]["logs"]["enabled"] is False, "logs should be disabled"
+    assert svc["config"]["aws"]["metrics"]["enabled"] is False, "metrics should be disabled"
+    assert svc["config"]["aws"]["logs"]["enabled"] is False, "logs should be disabled"
 
 
-@provider_spec
 def test_update_service_account_not_found(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
-    spec: ProviderServiceSpec,
 ) -> None:
     """PUT with a non-existent account UUID returns 404."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
     response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{uuid.uuid4()}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{uuid.uuid4()}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}}}},
         timeout=10,
     )
 
     assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}"
 
 
-def test_update_gcp_service_without_metrics_config(
-    signoz: types.SigNoz,
-    create_user_admin: types.Operation,  # pylint: disable=unused-argument
-    get_token: Callable[[str, str], str],
-    create_cloud_integration_account: Callable,
-) -> None:
-    """GCP services support metrics only, so a config omitting metrics is rejected."""
-    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
-
-    account = create_cloud_integration_account(admin_token, "gcp", config=GCP_SERVICE_SPEC.account_config)
-    account_id = account["id"]
-
-    checkin = simulate_agent_checkin(signoz, admin_token, "gcp", account_id, str(uuid.uuid4()))
-    assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
-
-    response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/gcp/accounts/{account_id}/services/{GCP_SERVICE_SPEC.service_id}"),
-        headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": {"gcp": {"logs": {"enabled": True}}}},
-        timeout=10,
-    )
-
-    assert response.status_code == HTTPStatus.BAD_REQUEST, f"Expected 400 when metrics config is missing, got {response.status_code}: {response.text}"
-
-
 def test_list_services_unsupported_provider(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
@@ -373,32 +289,30 @@ def test_list_services_unsupported_provider(
     assert response.status_code == HTTPStatus.BAD_REQUEST, f"Expected 400, got {response.status_code}"
 
 
-@provider_spec
 def test_list_services_account_removed(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
     """List services for a deleted account returns 404."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
     account_id = account["id"]
 
-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
     assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
 
     delete_response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
     assert delete_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204 on delete, got {delete_response.status_code}"
 
     response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -406,32 +320,30 @@ def test_list_services_account_removed(
     assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}"
 
 
-@provider_spec
 def test_get_service_details_account_removed(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
     """Get service details for a deleted account returns 404."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
     account_id = account["id"]
 
-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
     assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
 
     delete_response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
     assert delete_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204 on delete, got {delete_response.status_code}"
 
     response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -439,68 +351,64 @@ def test_get_service_details_account_removed(
     assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}"
 
 
-@provider_spec
 def test_update_service_account_removed(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
     """PUT service config for a deleted account returns 404."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
     account_id = account["id"]
 
-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
     assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
 
     delete_response = requests.delete(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
     assert delete_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204 on delete, got {delete_response.status_code}"
 
     response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True)},
+        json={"config": {"aws": {"metrics": {"enabled": True}}}},
         timeout=10,
     )
 
     assert response.status_code == HTTPStatus.NOT_FOUND, f"Expected 404, got {response.status_code}"
 
 
-@provider_spec
 def test_enable_metrics_provisions_dashboards(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
     """Enabling metrics provisions dashboards visible in GetService and present in the DB."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
     account_id = account["id"]
 
-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
     assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
 
     put_response = requests.put(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True, logs_enabled=False)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": False}}}},
         timeout=10,
     )
     assert put_response.status_code == HTTPStatus.NO_CONTENT, f"Expected 204, got {put_response.status_code}: {put_response.text}"
 
     # Assertion 1: GetService returns provisioned dashboard UUIDs
     get_svc_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -509,7 +417,7 @@ def test_enable_metrics_provisions_dashboards(
     data = get_svc_response.json()["data"]
     svc = data["cloudIntegrationService"]
     assert svc is not None, "cloudIntegrationService should be non-null after enabling metrics"
-    assert svc["config"][spec.provider]["metrics"]["enabled"] is True
+    assert svc["config"]["aws"]["metrics"]["enabled"] is True
 
     dashboards_in_service = data["assets"]["dashboards"]
     assert isinstance(dashboards_in_service, list) and len(dashboards_in_service) > 0, "assets.dashboards should be non-empty after enabling metrics"
@@ -537,37 +445,35 @@ def test_enable_metrics_provisions_dashboards(
     assert provisioned_ids == db_ids, f"Dashboards {provisioned_ids - db_ids} are missing from the DB"
 
 
-@provider_spec
 def test_disable_metrics_deprovisions_dashboards(
     signoz: types.SigNoz,
     create_user_admin: types.Operation,  # pylint: disable=unused-argument
     get_token: Callable[[str, str], str],
     create_cloud_integration_account: Callable,
-    spec: ProviderServiceSpec,
 ) -> None:
     """Disabling metrics removes provisioned dashboards from both GetService and the dashboards list."""
     admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
 
-    account = create_cloud_integration_account(admin_token, spec.provider, config=spec.account_config)
+    account = create_cloud_integration_account(admin_token, CLOUD_PROVIDER)
     account_id = account["id"]
 
-    checkin = simulate_agent_checkin(signoz, admin_token, spec.provider, account_id, str(uuid.uuid4()))
+    checkin = simulate_agent_checkin(signoz, admin_token, CLOUD_PROVIDER, account_id, str(uuid.uuid4()))
     assert checkin.status_code == HTTPStatus.OK, f"Check-in failed: {checkin.text}"
 
-    endpoint = signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}")
+    endpoint = signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}")
 
     # Enable metrics to provision dashboards first
     enable_response = requests.put(
         endpoint,
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(True, logs_enabled=False)},
+        json={"config": {"aws": {"metrics": {"enabled": True}, "logs": {"enabled": False}}}},
         timeout=10,
     )
     assert enable_response.status_code == HTTPStatus.NO_CONTENT, f"Enable failed: {enable_response.status_code}: {enable_response.text}"
 
     # Capture the provisioned dashboard IDs before disabling
     get_svc_response = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )
@@ -579,14 +485,14 @@ def test_disable_metrics_deprovisions_dashboards(
     disable_response = requests.put(
         endpoint,
         headers={"Authorization": f"Bearer {admin_token}"},
-        json={"config": spec.build_service_config(False)},
+        json={"config": {"aws": {"metrics": {"enabled": False}, "logs": {"enabled": False}}}},
         timeout=10,
     )
     assert disable_response.status_code == HTTPStatus.NO_CONTENT, f"Disable failed: {disable_response.status_code}: {disable_response.text}"
 
     # Assertion 1: GetService no longer returns UUID dashboard IDs
     get_svc_after = requests.get(
-        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{spec.provider}/accounts/{account_id}/services/{spec.service_id}"),
+        signoz.self.host_configs["8080"].get(f"/api/v1/cloud_integrations/{CLOUD_PROVIDER}/accounts/{account_id}/services/{SERVICE_ID}"),
         headers={"Authorization": f"Bearer {admin_token}"},
         timeout=10,
     )

tests/integration/tests/queriercommon/01_filter_expression.py

@@ -1,14 +1,20 @@
+import os
 from collections.abc import Callable
+from concurrent.futures import ThreadPoolExecutor, as_completed
 from datetime import UTC, datetime, timedelta
 from http import HTTPStatus
 
 import pytest
+import requests
 
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.logs import Logs
 from fixtures.querier import get_column_data_from_response, make_query_request
 
+TESTDATA_DIR = os.path.join(os.path.dirname(__file__), "..", "..", "testdata")
+FILTER_EXPRESSIONS_FILE = os.path.join(TESTDATA_DIR, "filter_expressions_10000.txt")
+
 
 @pytest.mark.parametrize(
     "expression,expected_logs",
@@ -174,3 +180,101 @@ def test_not_filter_expression(
     assert response.status_code == HTTPStatus.OK
     assert response.json()["status"] == "success"
     assert set(get_column_data_from_response(response.json(), "body")) == expected_logs
+
+
+def test_filter_expressions_no_server_error(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    insert_logs,
+    get_token: Callable[[str, str], str],
+) -> None:
+    """
+    Reads every line from filter_expressions_10000.txt and fires it as a filter
+    expression against the logs query endpoint.
+
+    Expressions may be valid (200) or invalid (400) — both are acceptable.
+    A 500 means the server crashed on the input and is a test failure.
+    All failing expressions are collected before asserting so the full list is
+    visible in one run.
+    """
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    now = datetime.now(tz=UTC)
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=5),
+                body="alpha-log",
+                resources={
+                    "f1": "v10",
+                    "f2": "v20",
+                    "f3": "v30",
+                },
+                attributes={
+                    "f4": 40,
+                    "f5": 50,
+                    "f6": 60,
+                },
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=3),
+                body="beta-log",
+                resources={
+                    "f4": "v41",
+                    "f5": "v51",
+                    "f6": "v61",
+                },
+                attributes={
+                    "f1": 11,
+                    "f2": 21,
+                    "f3": 31,
+                },
+            ),
+        ]
+    )
+
+    def _make_raw_logs_query(
+        signoz: types.SigNoz,
+        token: str,
+        filter_expression: str,
+    ) -> requests.Response:
+        """Helper to query raw logs with a filter expression over the last 30 seconds."""
+        now = datetime.now(tz=UTC)
+        return make_query_request(
+            signoz,
+            token,
+            start_ms=int((now - timedelta(seconds=30)).timestamp() * 1000),
+            end_ms=int(now.timestamp() * 1000),
+            request_type="raw",
+            queries=[
+                {
+                    "type": "builder_query",
+                    "spec": {
+                        "name": "A",
+                        "signal": "logs",
+                        "disabled": False,
+                        "limit": 100,
+                        "offset": 0,
+                        "filter": {"expression": filter_expression},
+                        "order": [
+                            {"key": {"name": "timestamp"}, "direction": "desc"},
+                            {"key": {"name": "id"}, "direction": "desc"},
+                        ],
+                        "having": {"expression": ""},
+                        "aggregations": [{"expression": "count()"}],
+                    },
+                }
+            ],
+        )
+
+    failures: list[str] = []
+    with ThreadPoolExecutor(max_workers=40) as executor:
+        with open(FILTER_EXPRESSIONS_FILE, encoding="utf-8") as f:
+            futures = {executor.submit(_make_raw_logs_query, signoz, token, expr.rstrip("\n")): expr.rstrip("\n") for expr in f}
+            for future in as_completed(futures):
+                expr = futures[future]
+                if future.result().status_code == HTTPStatus.INTERNAL_SERVER_ERROR:
+                    failures.append(expr)
+
+    assert len(failures) <= 0, f"{len(failures)} expression(s) caused HTTP 500:\n" + "\n".join(f"  {expr!r}" for expr in failures)

tests/integration/tests/querierlogs/06_json_body.py

@@ -3,11 +3,13 @@ from collections.abc import Callable
 from datetime import UTC, datetime, timedelta
 from http import HTTPStatus
 
+import pytest
 import requests
 
 from fixtures import types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD
 from fixtures.logs import Logs
+from fixtures.querier import build_order_by, build_raw_query, get_rows, make_query_request
 
 
 def test_logs_json_body_simple_searches(
@@ -911,3 +913,61 @@ def test_logs_json_body_listing(
     assert len(results) == 1
     count = results[0]["data"][0][0]
     assert count == 4  # 4 logs have status="success"
+
+
+@pytest.mark.parametrize(
+    "expression,expected_services",
+    [
+        pytest.param("body.service IN ['auth', 'payment']", {"auth", "payment"}, id="in_scalar_path"),
+        pytest.param("body.status IN [200, 500]", {"auth", "payment"}, id="in_number_path"),
+        pytest.param("body.service NOT IN ['auth']", {"payment", "search"}, id="not_in_scalar_path"),
+        # An `[]` path is extracted as an array. Comparing that array to each scalar in the
+        # list is something ClickHouse rejects outright (code 130), so this shape used to
+        # fail the whole query; per-value extraction reads the first element instead.
+        pytest.param("body.user_names[*] IN ['alpha', 'gamma']", {"auth", "payment"}, id="in_array_path"),
+    ],
+)
+def test_logs_json_body_in_operator(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+    expression: str,
+    expected_services: set[str],
+) -> None:
+    """IN over a body JSON path fans out to one comparison per value."""
+    now = datetime.now(tz=UTC).replace(second=0, microsecond=0)
+    specs = [("auth", 200, ["alpha", "beta"]), ("payment", 500, ["gamma"]), ("search", 404, ["beta", "alpha"])]
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=i + 1),
+                resources={"service.name": "api"},
+                body=json.dumps({"service": service, "status": status, "user_names": user_names}),
+            )
+            for i, (service, status, user_names) in enumerate(specs)
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    response = make_query_request(
+        signoz,
+        token,
+        start_ms=int((now - timedelta(minutes=5)).timestamp() * 1000),
+        end_ms=int(now.timestamp() * 1000),
+        request_type="raw",
+        queries=[
+            build_raw_query(
+                "A",
+                "logs",
+                filter_expression=expression,
+                order=[build_order_by("timestamp", "desc")],
+                limit=100,
+            )
+        ],
+    )
+
+    assert response.status_code == HTTPStatus.OK, response.text
+    assert response.json()["status"] == "success"
+    # flag off: the body comes back as the raw JSON string
+    assert {json.loads(row["data"]["body"])["service"] for row in get_rows(response)} == expected_services