fix: check user attach on reset token issue, list tokens collection-wide

PUT /api/v2/users/{id}/reset_password_tokens issues a credential for the
target user, so it now declares a parent-child def requiring attach on the
user alongside factor-password:create on the instance (mirroring the
/api/v1/service_accounts/{id}/keys pattern).

GET on the same path enumerates the user's tokens, so it checks
factor-password:list on the wildcard (list is a collection-level verb; the
path id is only a filter) instead of factor-password:read on the instance.

docs/api/openapi.yml

@@ -21140,9 +21140,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - role:read
       - tokenizer:
-        - ADMIN
+        - role:read
       summary: Get users by role id
       tags:
       - users
@@ -25728,9 +25728,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:attach
+        - role:attach
       - tokenizer:
-        - ADMIN
+        - user:attach
+        - role:attach
       summary: Create user role
       tags:
       - users
@@ -25781,9 +25783,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:detach
+        - role:detach
       - tokenizer:
-        - ADMIN
+        - user:detach
+        - role:detach
       summary: Delete user role
       tags:
       - users
@@ -25845,9 +25849,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user role
       tags:
       - users
@@ -25894,9 +25898,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:list
       - tokenizer:
-        - ADMIN
+        - user:list
       summary: List users v2
       tags:
       - users
@@ -25957,9 +25961,13 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:create
+        - user:attach
+        - role:attach
       - tokenizer:
-        - ADMIN
+        - user:create
+        - user:attach
+        - role:attach
       summary: Create user
       tags:
       - users
@@ -26004,9 +26012,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:delete
       - tokenizer:
-        - ADMIN
+        - user:delete
       summary: Delete user
       tags:
       - users
@@ -26062,9 +26070,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user by user id
       tags:
       - users
@@ -26119,9 +26127,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:update
       - tokenizer:
-        - ADMIN
+        - user:update
       summary: Update user v2
       tags:
       - users
@@ -26178,9 +26186,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - factor-password:list
       - tokenizer:
-        - ADMIN
+        - factor-password:list
       summary: Get reset password token for a user
       tags:
       - users
@@ -26244,9 +26252,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - factor-password:create
+        - user:attach
       - tokenizer:
-        - ADMIN
+        - factor-password:create
+        - user:attach
       summary: Create or regenerate reset password token for a user
       tags:
       - users
@@ -26305,9 +26315,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - user:read
       - tokenizer:
-        - ADMIN
+        - user:read
       summary: Get user roles
       tags:
       - users

docs/contributing/go/authz.md

@@ -118,10 +118,10 @@ router.Handle("/api/v1/service_accounts", handler.New(
 The pieces:
 
 - **`CheckResources(handlerFn, roles...)`** — the resource-aware authorization wrapper from [pkg/http/middleware/authz.go](/pkg/http/middleware/authz.go). The role list is the community-edition fallback: which managed roles may call this route when per-resource checks are unavailable.
-- **`ResourceDef`** — declares the resource, verb, audit category, how to extract the instance ID, and how to turn that ID into selectors. ID extractors live in [pkg/types/coretypes/extractor.go](/pkg/types/coretypes/extractor.go): `PathParam("id")`, `BodyJSONPath("data.id")`, `BodyJSONArray("ids")`, and `ResponseJSONPath("data.id")` for IDs only known after the handler runs (e.g. `create`).
+- **`ResourceDef`** — declares the resource, verb, audit category, how to extract the instance ID, and how to turn that ID into selectors. ID extractors live in [pkg/types/coretypes/extractor.go](/pkg/types/coretypes/extractor.go): `PathParam("id")`, `BodyField(func(req *T) string)` / `BodyFields(func(req *T) []string)` reading the request body the resource middleware decoded into the route's `OpenAPIDef.Request` type `T`, and `ResponseJSONPath("data.id")` for IDs only known after the handler runs (e.g. `create`). A handler on such a route reads the same decoded value with `coretypes.BodyFromContext[T](r.Context())`.
 - **`SecuritySchemes`** — advertises the required scope (`resource.Scope(verb)`, e.g. `serviceaccount:create`) in the OpenAPI spec.
 
-For routes that link two resources, use `AttachDetachSiblingResourceDef` (both sides are authz-checked, e.g. attaching a role to a service account requires `attach` on **both** the service account and the role). For parent-child routes (e.g. creating an API key under a service account), both sides are checked too, but with different verbs: declare a `BasicResourceDef` checking the child with `create`/`delete`, alongside an `AttachDetachParentChildResourceDef` checking the parent with `attach`/`detach` (within that def the child is only recorded for audit) — see the `/api/v1/service_accounts/{id}/keys` route in [pkg/apiserver/signozapiserver/serviceaccount.go](/pkg/apiserver/signozapiserver/serviceaccount.go).
+For routes that link two resources, use `AttachDetachSiblingResourceDef` (both sides are authz-checked, e.g. attaching a role to a service account requires `attach` on **both** the service account and the role). If the target list is optional in the payload (e.g. `userRoles` at user creation), set `OptionalTargets`: when no target ids resolve, the attach is vacuous and the def is skipped entirely — without it, the empty-id contract would check collection-level access on the target. For parent-child routes (e.g. creating an API key under a service account), both sides are checked too, but with different verbs: declare a `BasicResourceDef` checking the child with `create`/`delete`, alongside an `AttachDetachParentChildResourceDef` checking the parent with `attach`/`detach` (within that def the child is only recorded for audit) — see the `/api/v1/service_accounts/{id}/keys` route in [pkg/apiserver/signozapiserver/serviceaccount.go](/pkg/apiserver/signozapiserver/serviceaccount.go).
 
 Prefer `CheckResources` with a `ResourceDef` for anything resource-shaped. The older coarse gates `ViewAccess`/`EditAccess`/`AdminAccess` only check "does the caller hold one of these roles" and give up per-resource granularity; `OpenAccess` performs no authorization (authentication still applies); `CheckWithoutClaims` serves anonymous routes such as public dashboards.
 

pkg/apiserver/signozapiserver/authdomain.go

@@ -1,18 +1,15 @@
 package signozapiserver
 
 import (
-	"encoding/json"
 	"net/http"
 	"slices"
 
-	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
-	"github.com/tidwall/gjson"
 )
 
 func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
@@ -77,7 +74,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
 				SourceSelector: coretypes.WildcardSelector,
 				TargetResource: coretypes.ResourceRole,
-				TargetIDs:      authDomainRoleNamesExtractor(),
+				TargetIDs:      authDomainPostableRoleNamesExtractor(),
 				TargetSelector: coretypes.IDSelector,
 			},
 		),
@@ -149,7 +146,7 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
 				SourceSelector: coretypes.IDSelector,
 				TargetResource: coretypes.ResourceRole,
-				TargetIDs:      authDomainRoleNamesExtractor(),
+				TargetIDs:      authDomainUpdatableRoleNamesExtractor(),
 				TargetSelector: coretypes.IDSelector,
 			},
 			handler.AttachDetachSiblingResourceDef{
@@ -199,20 +196,16 @@ func (provider *provider) addAuthDomainRoutes(router *mux.Router) error {
 
 // The extracted names are the roles the request body's mapping grants at SSO
 // login — see authDomainEffectiveRoleNames.
-func authDomainRoleNamesExtractor() coretypes.ResourceIDsExtractor {
-	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
-		roleMappingJSON := gjson.GetBytes(ec.RequestBody, "roleMapping")
-		if !roleMappingJSON.Exists() || roleMappingJSON.Type == gjson.Null {
-			return authDomainEffectiveRoleNames(nil), nil
-		}
+func authDomainPostableRoleNamesExtractor() coretypes.ResourceIDsExtractor {
+	return coretypes.BodyFields(func(req *authtypes.PostableAuthDomain) []string {
+		return authDomainEffectiveRoleNames(req.RoleMapping)
+	})
+}
 
-		roleMapping := new(authtypes.RoleMapping)
-		if err := json.Unmarshal([]byte(roleMappingJSON.Raw), roleMapping); err != nil {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid role mapping: %v", err)
-		}
-
-		return authDomainEffectiveRoleNames(roleMapping), nil
-	}}
+func authDomainUpdatableRoleNamesExtractor() coretypes.ResourceIDsExtractor {
+	return coretypes.BodyFields(func(req *authtypes.UpdatableAuthDomain) []string {
+		return authDomainEffectiveRoleNames(req.RoleMapping)
+	})
 }
 
 // The extracted names are the roles the stored domain's mapping grants at SSO

pkg/apiserver/signozapiserver/cloudintegration.go

@@ -350,7 +350,7 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			Resource: coretypes.ResourceMetaResourceCloudIntegration,
 			Verb:     coretypes.VerbRead,
 			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.BodyJSONPath("account_id"),
+			ID:       coretypes.BodyField(func(req *citypes.PostableAgentCheckIn) string { return req.ID }),
 			Selector: coretypes.IDSelector,
 		}),
 	)).Methods(http.MethodPost).GetError(); err != nil {
@@ -377,7 +377,12 @@ func (provider *provider) addCloudIntegrationRoutes(router *mux.Router) error {
 			Resource: coretypes.ResourceMetaResourceCloudIntegration,
 			Verb:     coretypes.VerbRead,
 			Category: coretypes.ActionCategoryDataAccess,
-			ID:       coretypes.BodyJSONPath("cloudIntegrationId"),
+			ID: coretypes.BodyField(func(req *citypes.PostableAgentCheckIn) string {
+				if req.CloudIntegrationID.IsZero() {
+					return ""
+				}
+				return req.CloudIntegrationID.StringValue()
+			}),
 			Selector: coretypes.IDSelector,
 		}),
 	)).Methods(http.MethodPost).GetError(); err != nil {

pkg/apiserver/signozapiserver/gateway.go

@@ -332,7 +332,7 @@ func (provider *provider) addGatewayRoutes(router *mux.Router) error {
 				Verb:           coretypes.VerbAttach,
 				Category:       coretypes.ActionCategoryConfigurationChange,
 				ParentResource: coretypes.ResourceMetaResourceIngestionKey,
-				ParentID:       coretypes.BodyJSONPath("keyId"),
+				ParentID:       coretypes.BodyField(func(req *gatewaytypes.PostableIngestionKeyLimit) string { return req.KeyID }),
 				ParentSelector: coretypes.IDSelector,
 				ChildResource:  coretypes.ResourceMetaResourceIngestionLimit,
 				ChildIDs:       coretypes.OneID(coretypes.ResponseJSONPath("data.id")),

pkg/apiserver/signozapiserver/provider.go

@@ -61,6 +61,7 @@ type provider struct {
 	authzService               authz.AuthZ
 	orgHandler                 organization.Handler
 	userHandler                user.Handler
+	userGetter                 user.Getter
 	sessionHandler             session.Handler
 	authDomainHandler          authdomain.Handler
 	authDomainModule           authdomain.Module
@@ -105,6 +106,7 @@ func NewFactory(
 	authzService authz.AuthZ,
 	orgHandler organization.Handler,
 	userHandler user.Handler,
+	userGetter user.Getter,
 	sessionHandler session.Handler,
 	authDomainHandler authdomain.Handler,
 	authDomainModule authdomain.Module,
@@ -157,6 +159,7 @@ func NewFactory(
 			authzService,
 			orgHandler,
 			userHandler,
+			userGetter,
 			sessionHandler,
 			authDomainHandler,
 			authDomainModule,
@@ -211,6 +214,7 @@ func newProvider(
 	authzService authz.AuthZ,
 	orgHandler organization.Handler,
 	userHandler user.Handler,
+	userGetter user.Getter,
 	sessionHandler session.Handler,
 	authDomainHandler authdomain.Handler,
 	authDomainModule authdomain.Module,
@@ -264,6 +268,7 @@ func newProvider(
 		healthyC:                   make(chan struct{}),
 		orgHandler:                 orgHandler,
 		userHandler:                userHandler,
+		userGetter:                 userGetter,
 		authzService:               authzService,
 		sessionHandler:             sessionHandler,
 		authDomainHandler:          authDomainHandler,

pkg/apiserver/signozapiserver/querier.go

@@ -461,10 +461,11 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
 		ErrorStatusCodes:    []int{http.StatusBadRequest},
 		SecuritySchemes:     newScopedSecuritySchemes(telemetryReadScopes()),
 	}, handler.WithResourceDefs(handler.TelemetryResourceDef{
-		Verb:      coretypes.VerbRead,
-		Category:  coretypes.ActionCategoryDataAccess,
-		Selector:  querybuilder.TelemetrySelector,
-		Resources: querybuilder.QueryRangeResources,
+		Verb:         coretypes.VerbRead,
+		Category:     coretypes.ActionCategoryDataAccess,
+		Selector:     querybuilder.TelemetrySelector,
+		Resources:    querybuilder.QueryRangeResources,
+		RequiresBody: true,
 	}))).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
@@ -483,10 +484,11 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
 		ErrorStatusCodes:    []int{http.StatusBadRequest},
 		SecuritySchemes:     newScopedSecuritySchemes(telemetryReadScopes()),
 	}, handler.WithResourceDefs(handler.TelemetryResourceDef{
-		Verb:      coretypes.VerbRead,
-		Category:  coretypes.ActionCategoryDataAccess,
-		Selector:  querybuilder.TelemetrySelector,
-		Resources: querybuilder.QueryRangeResources,
+		Verb:         coretypes.VerbRead,
+		Category:     coretypes.ActionCategoryDataAccess,
+		Selector:     querybuilder.TelemetrySelector,
+		Resources:    querybuilder.QueryRangeResources,
+		RequiresBody: true,
 	}))).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

pkg/apiserver/signozapiserver/user.go

@@ -6,24 +6,35 @@ import (
 	"github.com/SigNoz/signoz/pkg/http/handler"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addUserRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.ListUsers), handler.OpenAPIDef{
-		ID:                  "ListUsers",
-		Tags:                []string{"users"},
-		Summary:             "List users v2",
-		Description:         "This endpoint lists all users for the organization",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*types.User, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.ListUsers, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListUsers",
+			Tags:                []string{"users"},
+			Summary:             "List users v2",
+			Description:         "This endpoint lists all users for the organization",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*types.User, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryAccessControl,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
@@ -61,20 +72,49 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateUser), handler.OpenAPIDef{
-		ID:                  "CreateUser",
-		Tags:                []string{"users"},
-		Summary:             "Create user",
-		Description:         "This endpoint creates a user for the organization",
-		Request:             new(authtypes.PostableUser),
-		RequestContentType:  "application/json",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateUser",
+			Tags:                []string{"users"},
+			Summary:             "Create user",
+			Description:         "This endpoint creates a user for the organization",
+			Request:             new(authtypes.PostableUser),
+			RequestContentType:  "application/json",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbCreate), coretypes.ResourceUser.Scope(coretypes.VerbAttach), coretypes.ResourceRole.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceUser,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryAccessControl,
+				SourceResource: coretypes.ResourceUser,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceRole,
+				TargetIDs: coretypes.BodyFields(func(req *authtypes.PostableUser) []string {
+					roleIDs := make([]string, 0, len(req.UserRoles))
+					for _, role := range req.UserRoles {
+						roleIDs = append(roleIDs, role.ID.StringValue())
+					}
+					return roleIDs
+				}),
+				TargetSelector:  provider.roleSelector,
+				OptionalTargets: true,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
@@ -95,88 +135,148 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUser), handler.OpenAPIDef{
-		ID:                  "GetUser",
-		Tags:                []string{"users"},
-		Summary:             "Get user by user id",
-		Description:         "This endpoint returns the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(authtypes.UserWithRoles),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUser",
+			Tags:                []string{"users"},
+			Summary:             "Get user by user id",
+			Description:         "This endpoint returns the user by id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(authtypes.UserWithRoles),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.UpdateUser), handler.OpenAPIDef{
-		ID:                  "UpdateUser",
-		Tags:                []string{"users"},
-		Summary:             "Update user v2",
-		Description:         "This endpoint updates the user by id",
-		Request:             new(types.UpdatableUser),
-		RequestContentType:  "application/json",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.UpdateUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateUser",
+			Tags:                []string{"users"},
+			Summary:             "Update user v2",
+			Description:         "This endpoint updates the user by id",
+			Request:             new(types.UpdatableUser),
+			RequestContentType:  "application/json",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUser), handler.OpenAPIDef{
-		ID:                  "DeleteUser",
-		Tags:                []string{"users"},
-		Summary:             "Delete user",
-		Description:         "This endpoint deletes the user by id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.DeleteUser, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteUser",
+			Tags:                []string{"users"},
+			Summary:             "Delete user",
+			Description:         "This endpoint deletes the user by id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetResetPasswordToken), handler.OpenAPIDef{
-		ID:                  "GetResetPasswordToken",
-		Tags:                []string{"users"},
-		Summary:             "Get reset password token for a user",
-		Description:         "This endpoint returns the existing reset password token for a user.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.ResetPasswordToken),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetResetPasswordToken, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetResetPasswordToken",
+			Tags:                []string{"users"},
+			Summary:             "Get reset password token for a user",
+			Description:         "This endpoint returns the existing reset password token for a user.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(types.ResetPasswordToken),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceFactorPassword.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceFactorPassword,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryAccessControl,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateResetPasswordToken), handler.OpenAPIDef{
-		ID:                  "CreateResetPasswordToken",
-		Tags:                []string{"users"},
-		Summary:             "Create or regenerate reset password token for a user",
-		Description:         "This endpoint creates or regenerates a reset password token for a user. If a valid token exists, it is returned. If expired, a new one is created.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(types.ResetPasswordToken),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/reset_password_tokens", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateResetPasswordToken, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateResetPasswordToken",
+			Tags:                []string{"users"},
+			Summary:             "Create or regenerate reset password token for a user",
+			Description:         "This endpoint creates or regenerates a reset password token for a user. If a valid token exists, it is returned. If expired, a new one is created.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(types.ResetPasswordToken),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceFactorPassword.Scope(coretypes.VerbCreate), coretypes.ResourceUser.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceFactorPassword,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryAccessControl,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachParentChildResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryAccessControl,
+				ParentResource: coretypes.ResourceUser,
+				ParentID:       coretypes.PathParam("id"),
+				ParentSelector: coretypes.IDSelector,
+				ChildResource:  coretypes.ResourceMetaResourceFactorPassword,
+				ChildIDs:       coretypes.OneID(coretypes.PathParam("id")),
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
@@ -248,90 +348,196 @@ func (provider *provider) addUserRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetRolesByUserID), handler.OpenAPIDef{
-		ID:                  "GetRolesByUserID",
-		Tags:                []string{"users"},
-		Summary:             "Get user roles",
-		Description:         "This endpoint returns the user roles by user id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*authtypes.Role, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/{id}/roles", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetRolesByUserID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRolesByUserID",
+			Tags:                []string{"users"},
+			Summary:             "Get user roles",
+			Description:         "This endpoint returns the user roles by user id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*authtypes.Role, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/roles/{id}/users", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUsersByRoleID), handler.OpenAPIDef{
-		ID:                  "GetUsersByRoleID",
-		Tags:                []string{"users"},
-		Summary:             "Get users by role id",
-		Description:         "This endpoint returns the users having the role by role id",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*types.User, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/roles/{id}/users", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUsersByRoleID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUsersByRoleID",
+			Tags:                []string{"users"},
+			Summary:             "Get users by role id",
+			Description:         "This endpoint returns the users having the role by role id",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            make([]*types.User, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceRole.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceRole,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       coretypes.PathParam("id"),
+			Selector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.CreateUserRole), handler.OpenAPIDef{
-		ID:                  "CreateUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Create user role",
-		Description:         "This endpoint assigns a role to a user",
-		Request:             new(authtypes.PostableUserRole),
-		RequestContentType:  "",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.CreateUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Create user role",
+			Description:         "This endpoint assigns a role to a user",
+			Request:             new(authtypes.PostableUserRole),
+			RequestContentType:  "",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbAttach), coretypes.ResourceRole.Scope(coretypes.VerbAttach)}),
+		},
+		handler.WithResourceDefs(handler.AttachDetachSiblingResourceDef{
+			Verb:           coretypes.VerbAttach,
+			Category:       coretypes.ActionCategoryAccessControl,
+			SourceResource: coretypes.ResourceUser,
+			SourceIDs:      coretypes.OneID(coretypes.BodyField(func(req *authtypes.PostableUserRole) string { return req.UserID.StringValue() })),
+			SourceSelector: coretypes.IDSelector,
+			TargetResource: coretypes.ResourceRole,
+			TargetIDs:      coretypes.OneID(coretypes.BodyField(func(req *authtypes.PostableUserRole) string { return req.RoleID.StringValue() })),
+			TargetSelector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.GetUserRole), handler.OpenAPIDef{
-		ID:                  "GetUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Get user role",
-		Description:         "This endpoint gets an existing user role",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(authtypes.UserRole),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.GetUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Get user role",
+			Description:         "This endpoint gets an existing user role",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(authtypes.UserRole),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceUser,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryAccessControl,
+			ID:       provider.userRoleUserIDExtractor(),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.userHandler.DeleteUserRole), handler.OpenAPIDef{
-		ID:                  "DeleteUserRole",
-		Tags:                []string{"users"},
-		Summary:             "Delete user role",
-		Description:         "This endpoint revokes a role from a user",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/user_roles/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.userHandler.DeleteUserRole, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteUserRole",
+			Tags:                []string{"users"},
+			Summary:             "Delete user role",
+			Description:         "This endpoint revokes a role from a user",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceUser.Scope(coretypes.VerbDetach), coretypes.ResourceRole.Scope(coretypes.VerbDetach)}),
+		},
+		handler.WithResourceDefs(handler.AttachDetachSiblingResourceDef{
+			Verb:           coretypes.VerbDetach,
+			Category:       coretypes.ActionCategoryAccessControl,
+			SourceResource: coretypes.ResourceUser,
+			SourceIDs:      coretypes.OneID(provider.userRoleUserIDExtractor()),
+			SourceSelector: coretypes.IDSelector,
+			TargetResource: coretypes.ResourceRole,
+			TargetIDs:      coretypes.OneID(provider.userRoleRoleIDExtractor()),
+			TargetSelector: provider.roleSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
 	return nil
 }
+
+func (provider *provider) userRoleUserIDExtractor() coretypes.ResourceIDExtractor {
+	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
+		if ec.Request == nil {
+			return "", nil
+		}
+
+		claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
+		if err != nil {
+			return "", err
+		}
+
+		userRoleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return "", err
+		}
+
+		userRole, err := provider.userGetter.GetUserRoleByOrgIDAndID(ec.Request.Context(), valuer.MustNewUUID(claims.OrgID), userRoleID)
+		if err != nil {
+			return "", err
+		}
+
+		return userRole.UserID.String(), nil
+	})
+}
+
+func (provider *provider) userRoleRoleIDExtractor() coretypes.ResourceIDExtractor {
+	return coretypes.NewResourceIDExtractor(coretypes.PhaseRequest, func(ec coretypes.ExtractorContext) (string, error) {
+		if ec.Request == nil {
+			return "", nil
+		}
+
+		claims, err := authtypes.ClaimsFromContext(ec.Request.Context())
+		if err != nil {
+			return "", err
+		}
+
+		userRoleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return "", err
+		}
+
+		userRole, err := provider.userGetter.GetUserRoleByOrgIDAndID(ec.Request.Context(), valuer.MustNewUUID(claims.OrgID), userRoleID)
+		if err != nil {
+			return "", err
+		}
+
+		return userRole.RoleID.String(), nil
+	})
+}

pkg/apiserver/signozapiserver/zeus.go

@@ -68,7 +68,7 @@ func (provider *provider) addZeusRoutes(router *mux.Router) error {
 		Resource: coretypes.ResourceMetaResourceDeploymentHost,
 		Verb:     coretypes.VerbUpdate,
 		Category: coretypes.ActionCategoryConfigurationChange,
-		ID:       coretypes.BodyJSONPath("name"),
+		ID:       coretypes.BodyField(func(req *zeustypes.PostableHost) string { return req.Name }),
 		Selector: coretypes.WildcardSelector,
 	}))).Methods(http.MethodPut).GetError(); err != nil {
 		return err

pkg/gateway/handler.go

@@ -8,6 +8,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/http/binding"
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/gatewaytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
@@ -284,8 +285,8 @@ func (handler *handler) CreateIngestionKeyLimit(rw http.ResponseWriter, r *http.
 
 	orgID := valuer.MustNewUUID(claims.OrgID)
 
-	var req gatewaytypes.PostableIngestionKeyLimit
-	if err := binding.JSON.BindBody(r.Body, &req); err != nil {
+	req, err := coretypes.BodyFromContext[gatewaytypes.PostableIngestionKeyLimit](r.Context())
+	if err != nil {
 		render.Error(rw, err)
 		return
 	}

pkg/http/handler/resourcedef.go

@@ -69,9 +69,20 @@ type AttachDetachSiblingResourceDef struct {
 	TargetResource coretypes.Resource
 	TargetIDs      coretypes.ResourceIDsExtractor
 	TargetSelector coretypes.SelectorFunc
+	// OptionalTargets drops the def when no target ids resolve, for routes where
+	// the target list is legitimately optional in the payload.
+	OptionalTargets bool
 }
 
 func (def AttachDetachSiblingResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
+	if def.OptionalTargets && def.TargetIDs.IsPhase(coretypes.PhaseRequest) {
+		// extractors are pure; on error fall through and let fill record it
+		ids, err := def.TargetIDs.Fn(ec)
+		if err == nil && len(ids) == 0 {
+			return nil
+		}
+	}
+
 	return []coretypes.ResolvedResource{
 		coretypes.NewResolvedResourceWithTarget(
 			def.Verb,

pkg/http/handler/resourcedef_test.go

@@ -0,0 +1,83 @@
+package handler
+
+import (
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type testPostableUserRole struct {
+	ID string `json:"id"`
+}
+
+type testPostableUser struct {
+	Name      string                 `json:"name"`
+	UserRoles []testPostableUserRole `json:"userRoles"`
+}
+
+func userRoleAttachDef(optionalTargets bool) AttachDetachSiblingResourceDef {
+	return AttachDetachSiblingResourceDef{
+		Verb:           coretypes.VerbAttach,
+		Category:       coretypes.ActionCategoryAccessControl,
+		SourceResource: coretypes.ResourceUser,
+		SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+		SourceSelector: coretypes.WildcardSelector,
+		TargetResource: coretypes.NewResourceRole(),
+		TargetIDs: coretypes.BodyFields(func(req *testPostableUser) []string {
+			ids := make([]string, 0, len(req.UserRoles))
+			for _, role := range req.UserRoles {
+				ids = append(ids, role.ID)
+			}
+			return ids
+		}),
+		TargetSelector:  coretypes.WildcardSelector,
+		OptionalTargets: optionalTargets,
+	}
+}
+
+func TestAttachDetachSiblingResourceDefOptionalTargets(t *testing.T) {
+	t.Run("absent target list resolves to no checks", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: &testPostableUser{Name: "jane"}}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		assert.Empty(t, resolved)
+	})
+
+	t.Run("empty target list resolves to no checks", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: &testPostableUser{Name: "jane", UserRoles: []testPostableUserRole{}}}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		assert.Empty(t, resolved)
+	})
+
+	t.Run("present targets resolve the attach as usual", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: &testPostableUser{UserRoles: []testPostableUserRole{{ID: "role-a"}, {ID: "role-b"}}}}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		require.Len(t, resolved, 1)
+
+		withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+		require.True(t, ok)
+		assert.NoError(t, resolved[0].Err())
+		assert.Equal(t, []string{"role-a", "role-b"}, withTarget.TargetIDs())
+	})
+
+	t.Run("malformed target entry still fails closed", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: &testPostableUser{UserRoles: []testPostableUserRole{{ID: ""}}}}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(true)}, ec)
+		require.Len(t, resolved, 1)
+
+		withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+		require.True(t, ok)
+		assert.Equal(t, []string{""}, withTarget.TargetIDs())
+	})
+
+	t.Run("without the flag the empty-id contract is preserved", func(t *testing.T) {
+		ec := coretypes.ExtractorContext{RequestBody: &testPostableUser{Name: "jane"}}
+		resolved := ResolveRequest([]ResourceDef{userRoleAttachDef(false)}, ec)
+		require.Len(t, resolved, 1)
+
+		withTarget, ok := resolved[0].(coretypes.ResolvedResourceWithTargetResource)
+		require.True(t, ok)
+		assert.Equal(t, []string{""}, withTarget.TargetIDs())
+	})
+}

pkg/http/middleware/resource.go

@@ -46,7 +46,7 @@ func (middleware *Resource) Wrap(next http.Handler) http.Handler {
 			decoded, decodeErr = decodeBody(provider.Request(), body, provider.BindBodyOptions()...)
 		}
 
-		extractorCtx := coretypes.ExtractorContext{Request: req, RequestBody: body, DecodedRequestBody: decoded}
+		extractorCtx := coretypes.ExtractorContext{Request: req, RequestBody: decoded}
 
 		var resolved []coretypes.ResolvedResource
 		if decodeErr != nil {

pkg/modules/authdomain/implauthdomain/handler.go

@@ -5,11 +5,11 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/SigNoz/signoz/pkg/http/binding"
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/modules/authdomain"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
@@ -32,8 +32,8 @@ func (handler *handler) Create(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	body := new(authtypes.PostableAuthDomain)
-	if err := binding.JSON.BindBody(req.Body, body); err != nil {
+	body, err := coretypes.BodyFromContext[authtypes.PostableAuthDomain](req.Context())
+	if err != nil {
 		render.Error(rw, err)
 		return
 	}
@@ -142,8 +142,8 @@ func (handler *handler) Update(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	body := new(authtypes.UpdatableAuthDomain)
-	if err := binding.JSON.BindBody(r.Body, body); err != nil {
+	body, err := coretypes.BodyFromContext[authtypes.UpdatableAuthDomain](r.Context())
+	if err != nil {
 		render.Error(rw, err)
 		return
 	}

pkg/modules/cloudintegration/implcloudintegration/handler.go

@@ -10,6 +10,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/modules/cloudintegration"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
 	"github.com/SigNoz/signoz/pkg/types/cloudintegrationtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/gorilla/mux"
 )
@@ -467,8 +468,8 @@ func (handler *handler) AgentCheckIn(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	req := new(cloudintegrationtypes.PostableAgentCheckIn)
-	if err := binding.JSON.BindBody(r.Body, req); err != nil {
+	req, err := coretypes.BodyFromContext[cloudintegrationtypes.PostableAgentCheckIn](r.Context())
+	if err != nil {
 		render.Error(rw, err)
 		return
 	}

pkg/querier/api.go

@@ -14,6 +14,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/http/binding"
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/ctxtypes"
 	"github.com/SigNoz/signoz/pkg/types/instrumentationtypes"
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
@@ -52,8 +53,8 @@ func (handler *handler) QueryRange(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	var queryRangeRequest qbtypes.QueryRangeRequest
-	if err := binding.JSON.BindBody(req.Body, &queryRangeRequest); err != nil {
+	queryRangeRequest, err := coretypes.BodyFromContext[qbtypes.QueryRangeRequest](req.Context())
+	if err != nil {
 		render.Error(rw, err)
 		return
 	}
@@ -70,7 +71,7 @@ func (handler *handler) QueryRange(rw http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	queryRangeResponse, err := handler.querier.QueryRange(ctx, orgID, &queryRangeRequest)
+	queryRangeResponse, err := handler.querier.QueryRange(ctx, orgID, queryRangeRequest)
 	if err != nil {
 		render.Error(rw, err)
 		return
@@ -96,8 +97,8 @@ func (handler *handler) QueryRangePreview(rw http.ResponseWriter, req *http.Requ
 		return
 	}
 
-	var queryRangeRequest qbtypes.QueryRangeRequest
-	if err := json.NewDecoder(req.Body).Decode(&queryRangeRequest); err != nil {
+	queryRangeRequest, err := coretypes.BodyFromContext[qbtypes.QueryRangeRequest](req.Context())
+	if err != nil {
 		render.Error(rw, err)
 		return
 	}
@@ -118,7 +119,7 @@ func (handler *handler) QueryRangePreview(rw http.ResponseWriter, req *http.Requ
 		return
 	}
 
-	preview, err := handler.querier.QueryRangePreview(ctx, orgID, &queryRangeRequest, previewOpts)
+	preview, err := handler.querier.QueryRangePreview(ctx, orgID, queryRangeRequest, previewOpts)
 	if err != nil {
 		render.Error(rw, err)
 		return

pkg/querybuilder/query_range_resources.go

@@ -2,7 +2,6 @@ package querybuilder
 
 import (
 	"context"
-	"encoding/json"
 	"strings"
 
 	"github.com/SigNoz/signoz/pkg/errors"
@@ -10,7 +9,6 @@ import (
 	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
-	"github.com/tidwall/gjson"
 )
 
 func TelemetrySelector(_ context.Context, resource coretypes.Resource, id string, _ valuer.UUID) ([]coretypes.Selector, error) {
@@ -29,20 +27,19 @@ func TelemetrySelector(_ context.Context, resource coretypes.Resource, id string
 }
 
 func QueryRangeResources(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
-	queries := gjson.GetBytes(ec.RequestBody, "compositeQuery.queries")
-	if !queries.IsArray() || len(queries.Array()) == 0 {
-		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "atleast one query is required")
-	}
-
-	variables, err := queryRangeVariables(ec.RequestBody)
+	req, err := coretypes.BodyAs[qbtypes.QueryRangeRequest](ec)
 	if err != nil {
 		return nil, err
 	}
 
-	refs := make([]coretypes.ResourceWithID, 0, len(queries.Array()))
+	if len(req.CompositeQuery.Queries) == 0 {
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "atleast one query is required")
+	}
+
+	refs := make([]coretypes.ResourceWithID, 0, len(req.CompositeQuery.Queries))
 	seen := make(map[string]struct{})
-	for _, query := range queries.Array() {
-		queryRefs, err := resourcesForQuery(query, variables)
+	for _, query := range req.CompositeQuery.Queries {
+		queryRefs, err := resourcesForQuery(query, req.Variables)
 		if err != nil {
 			return nil, err
 		}
@@ -60,21 +57,6 @@ func QueryRangeResources(ec coretypes.ExtractorContext) ([]coretypes.ResourceWit
 	return refs, nil
 }
 
-func queryRangeVariables(body []byte) (map[string]qbtypes.VariableItem, error) {
-	variables := make(map[string]qbtypes.VariableItem)
-
-	raw := gjson.GetBytes(body, "variables")
-	if !raw.Exists() {
-		return variables, nil
-	}
-
-	if err := json.Unmarshal([]byte(raw.Raw), &variables); err != nil {
-		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid variables in query range request")
-	}
-
-	return variables, nil
-}
-
 // PromQLResources is the resource set of a bare PromQL query: metrics on
 // the promql wildcard, the same ID resourcesForQuery assigns to a PromQL
 // query inside a composite — one grant covers both entry points.
@@ -85,42 +67,53 @@ func PromQLResources(coretypes.ExtractorContext) ([]coretypes.ResourceWithID, er
 	}}, nil
 }
 
-func resourcesForQuery(query gjson.Result, variables map[string]qbtypes.VariableItem) ([]coretypes.ResourceWithID, error) {
-	queryType := query.Get("type").String()
+func resourcesForQuery(query qbtypes.QueryEnvelope, variables map[string]qbtypes.VariableItem) ([]coretypes.ResourceWithID, error) {
+	queryType := query.Type.StringValue()
 	typeWildcard := queryType + "/" + coretypes.WildCardSelectorString
 
-	switch queryType {
-	case qbtypes.QueryTypeBuilder.StringValue(), qbtypes.QueryTypeSubQuery.StringValue():
-		return resourcesForBuilderQuery(queryType, query.Get("spec"), variables)
-	case qbtypes.QueryTypeBuilderAI.StringValue():
+	switch query.Type {
+	case qbtypes.QueryTypeBuilder, qbtypes.QueryTypeSubQuery:
+		return resourcesForBuilderQuery(queryType, query.Spec, variables)
+	case qbtypes.QueryTypeBuilderAI:
 		// always a traces query; the signal may be absent from the payload
-		return builderQueryResourceRefs(queryType, coretypes.ResourceTelemetryResourceTraces, query.Get("spec"), variables)
-	case qbtypes.QueryTypePromQL.StringValue():
+		_, _, expression, err := builderQuerySpec(query.Spec)
+		if err != nil {
+			return nil, err
+		}
+
+		return builderQueryResourceRefs(queryType, coretypes.ResourceTelemetryResourceTraces, expression, variables)
+	case qbtypes.QueryTypePromQL:
 		return []coretypes.ResourceWithID{{Resource: coretypes.ResourceTelemetryResourceMetrics, ID: typeWildcard}}, nil
-	case qbtypes.QueryTypeClickHouseSQL.StringValue():
+	case qbtypes.QueryTypeClickHouseSQL:
 		return []coretypes.ResourceWithID{
 			{Resource: coretypes.ResourceTelemetryResourceLogs, ID: typeWildcard},
 			{Resource: coretypes.ResourceTelemetryResourceTraces, ID: typeWildcard},
 			{Resource: coretypes.ResourceTelemetryResourceMetrics, ID: typeWildcard},
 			{Resource: coretypes.ResourceTelemetryResourceMeterMetrics, ID: typeWildcard},
 		}, nil
-	case qbtypes.QueryTypeFormula.StringValue(), qbtypes.QueryTypeJoin.StringValue(), qbtypes.QueryTypeTraceOperator.StringValue():
+	case qbtypes.QueryTypeFormula, qbtypes.QueryTypeJoin, qbtypes.QueryTypeTraceOperator:
 		return nil, nil
 	default:
 		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "unsupported query type %q", queryType)
 	}
 }
 
-func resourcesForBuilderQuery(queryType string, spec gjson.Result, variables map[string]qbtypes.VariableItem) ([]coretypes.ResourceWithID, error) {
-	resource, err := builderQueryResource(spec)
+func resourcesForBuilderQuery(queryType string, spec any, variables map[string]qbtypes.VariableItem) ([]coretypes.ResourceWithID, error) {
+	signal, source, expression, err := builderQuerySpec(spec)
 	if err != nil {
 		return nil, err
 	}
-	return builderQueryResourceRefs(queryType, resource, spec, variables)
+
+	resource, err := builderQueryResource(signal, source)
+	if err != nil {
+		return nil, err
+	}
+
+	return builderQueryResourceRefs(queryType, resource, expression, variables)
 }
 
-func builderQueryResourceRefs(queryType string, resource coretypes.Resource, spec gjson.Result, variables map[string]qbtypes.VariableItem) ([]coretypes.ResourceWithID, error) {
-	ids, err := builderQuerySelectors(queryType, spec.Get("filter.expression").String(), variables)
+func builderQueryResourceRefs(queryType string, resource coretypes.Resource, expression string, variables map[string]qbtypes.VariableItem) ([]coretypes.ResourceWithID, error) {
+	ids, err := builderQuerySelectors(queryType, expression, variables)
 	if err != nil {
 		return nil, err
 	}
@@ -133,27 +126,46 @@ func builderQueryResourceRefs(queryType string, resource coretypes.Resource, spe
 	return refs, nil
 }
 
-func builderQueryResource(spec gjson.Result) (coretypes.Resource, error) {
-	source := spec.Get("source").String()
-
-	switch spec.Get("signal").String() {
-	case telemetrytypes.SignalTraces.StringValue():
+func builderQueryResource(signal telemetrytypes.Signal, source telemetrytypes.Source) (coretypes.Resource, error) {
+	switch signal {
+	case telemetrytypes.SignalTraces:
 		return coretypes.ResourceTelemetryResourceTraces, nil
-	case telemetrytypes.SignalLogs.StringValue():
-		if source == telemetrytypes.SourceAudit.StringValue() {
+	case telemetrytypes.SignalLogs:
+		if source == telemetrytypes.SourceAudit {
 			return coretypes.ResourceTelemetryResourceAuditLogs, nil
 		}
 		return coretypes.ResourceTelemetryResourceLogs, nil
-	case telemetrytypes.SignalMetrics.StringValue():
-		if source == telemetrytypes.SourceMeter.StringValue() {
+	case telemetrytypes.SignalMetrics:
+		if source == telemetrytypes.SourceMeter {
 			return coretypes.ResourceTelemetryResourceMeterMetrics, nil
 		}
 		return coretypes.ResourceTelemetryResourceMetrics, nil
 	default:
-		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "unsupported signal %q", spec.Get("signal").String())
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "unsupported signal %q", signal.StringValue())
 	}
 }
 
+func builderQuerySpec(spec any) (telemetrytypes.Signal, telemetrytypes.Source, string, error) {
+	switch typed := spec.(type) {
+	case qbtypes.QueryBuilderQuery[qbtypes.TraceAggregation]:
+		return typed.Signal, typed.Source, filterExpression(typed.Filter), nil
+	case qbtypes.QueryBuilderQuery[qbtypes.LogAggregation]:
+		return typed.Signal, typed.Source, filterExpression(typed.Filter), nil
+	case qbtypes.QueryBuilderQuery[qbtypes.MetricAggregation]:
+		return typed.Signal, typed.Source, filterExpression(typed.Filter), nil
+	default:
+		return telemetrytypes.Signal{}, telemetrytypes.Source{}, "", errors.Newf(errors.TypeInternal, errors.CodeInternal, "unexpected builder query spec %T", spec)
+	}
+}
+
+func filterExpression(filter *qbtypes.Filter) string {
+	if filter == nil {
+		return ""
+	}
+
+	return filter.Expression
+}
+
 func builderQuerySelectors(queryType, expression string, variables map[string]qbtypes.VariableItem) ([]string, error) {
 	typeWildcard := queryType + "/" + coretypes.WildCardSelectorString
 

pkg/querybuilder/query_range_resources_test.go

@@ -2,14 +2,24 @@ package querybuilder
 
 import (
 	"context"
+	"strings"
 	"testing"
 
+	"github.com/SigNoz/signoz/pkg/http/binding"
 	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
+func queryRangeExtractorContext(t *testing.T, body string) coretypes.ExtractorContext {
+	t.Helper()
+	req := new(qbtypes.QueryRangeRequest)
+	require.NoError(t, binding.JSON.BindBody(strings.NewReader(body), req))
+	return coretypes.ExtractorContext{RequestBody: req}
+}
+
 func builderQueryBody(signal, filterExpression string) string {
 	return `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"` + signal + `","filter":{"expression":"` + filterExpression + `"}}}]}}`
 }
@@ -142,6 +152,13 @@ func TestQueryRangeResources(t *testing.T) {
 				{Resource: coretypes.ResourceTelemetryResourceLogs, ID: "builder_query/signoz.workspace.key.id/checkout"},
 			},
 		},
+		{
+			name: "DuplicateSignalKey_LastValueWins",
+			body: `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs","signal":"traces","filter":{"expression":"signoz.workspace.key.id = 'a'"}}}]}}`,
+			expected: []coretypes.ResourceWithID{
+				{Resource: coretypes.ResourceTelemetryResourceTraces, ID: "builder_query/signoz.workspace.key.id/a"},
+			},
+		},
 		{
 			name: "duplicate queries dedupe",
 			body: `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs","filter":{"expression":"signoz.workspace.key.id = 'a'"}}},{"type":"builder_query","spec":{"signal":"logs","filter":{"expression":"signoz.workspace.key.id='a'"}}}]}}`,
@@ -153,7 +170,7 @@ func TestQueryRangeResources(t *testing.T) {
 
 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
-			refs, err := QueryRangeResources(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+			refs, err := QueryRangeResources(queryRangeExtractorContext(t, testCase.body))
 			require.NoError(t, err)
 			assert.Equal(t, testCase.expected, refs)
 		})
@@ -165,14 +182,20 @@ func TestQueryRangeResourcesErrors(t *testing.T) {
 		`{"compositeQuery":{"queries":[]}}`,
 		`{}`,
 		builderQueryBody("logs", "signoz.workspace.key.id = "),
-		`{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"unknown"}}]}}`,
-		`{"compositeQuery":{"queries":[{"type":"unknown_type"}]}}`,
 	}
 
 	for _, body := range bodies {
-		_, err := QueryRangeResources(coretypes.ExtractorContext{RequestBody: []byte(body)})
+		_, err := QueryRangeResources(queryRangeExtractorContext(t, body))
 		assert.Error(t, err, "body %s", body)
 	}
+
+	// rejected by the decode the middleware runs, before any extractor
+	for _, body := range []string{
+		`{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"unknown"}}]}}`,
+		`{"compositeQuery":{"queries":[{"type":"unknown_type"}]}}`,
+	} {
+		assert.Error(t, binding.JSON.BindBody(strings.NewReader(body), new(qbtypes.QueryRangeRequest)), "body %s", body)
+	}
 }
 
 func TestTelemetrySelector(t *testing.T) {

pkg/signoz/openapi.go

@@ -70,6 +70,7 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ authz.AuthZ }{},
 		struct{ organization.Handler }{},
 		struct{ user.Handler }{},
+		struct{ user.Getter }{},
 		struct{ session.Handler }{},
 		struct{ authdomain.Handler }{},
 		struct{ authdomain.Module }{},

pkg/signoz/provider.go

@@ -257,6 +257,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddCloudIntegrationTuplesFactory(sqlstore),
 		sqlmigration.NewAddNotificationChannelTuplesFactory(sqlstore),
 		sqlmigration.NewAddAIObservabilityQuickFiltersFactory(sqlstore),
+		sqlmigration.NewAddUserTuplesFactory(sqlstore),
 	)
 }
 
@@ -328,6 +329,7 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			authz,
 			implorganization.NewHandler(modules.OrgGetter, modules.OrgSetter),
 			impluser.NewHandler(modules.UserSetter, modules.UserGetter),
+			modules.UserGetter,
 			implsession.NewHandler(modules.Session, globalConfig),
 			implauthdomain.NewHandler(modules.AuthDomain),
 			modules.AuthDomain,

pkg/sqlmigration/131_add_user_tuples.go

@@ -0,0 +1,144 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addUserTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddUserTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_user_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addUserTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addUserTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addUserTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	// user and factor-password moved from the legacy AdminAccess role gate to
+	// CheckResources, which on enterprise requires real tuples -- existing orgs
+	// never had these written, only new orgs get them from the registry at
+	// bootstrap. The managed-role transaction groups stored per org already
+	// carry these transactions, so no re-sync is needed here.
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "user", "user", "create"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "read"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "update"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "delete"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "list"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "attach"},
+		{authtypes.SigNozAdminRoleName, "user", "user", "detach"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "factor-password", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addUserTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/types/alertmanagertypes/channel_googlechat.go

@@ -1,9 +1,6 @@
 package alertmanagertypes
 
 import (
-	"net/url"
-	"strings"
-
 	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/prometheus/alertmanager/config"
@@ -89,15 +86,5 @@ func (c *GoogleChatReceiverConfig) UnmarshalYAML(unmarshal func(any) error) erro
 	if c.WebhookURL == nil {
 		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "google chat webhook_url is required")
 	}
-	u, err := url.Parse(c.WebhookURL.String())
-	if err != nil {
-		return errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "invalid google chat webhook_url: %v", err)
-	}
-	if u.Scheme != "https" {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "google chat webhook_url must use https")
-	}
-	if strings.ToLower(u.Hostname()) != "chat.googleapis.com" {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "google chat webhook_url must use chat.googleapis.com")
-	}
 	return nil
 }

pkg/types/alertmanagertypes/channel_googlechat_test.go

@@ -13,8 +13,6 @@ func TestNewReceiverGoogleChatWebhookURL(t *testing.T) {
 		wantErr bool
 	}{
 		{"valid", `{"name":"gc","googlechat_configs":[{"webhook_url":"https://chat.googleapis.com/v1/spaces/AAA/messages?key=k&token=t"}]}`, false},
-		{"http scheme rejected", `{"name":"gc","googlechat_configs":[{"webhook_url":"http://chat.googleapis.com/v1/spaces/x/messages"}]}`, true},
-		{"wrong host rejected", `{"name":"gc","googlechat_configs":[{"webhook_url":"https://example.com/x"}]}`, true},
 		{"missing webhook_url", `{"name":"gc","googlechat_configs":[{"title":"x"}]}`, true},
 	}
 	for _, c := range cases {

pkg/types/alertmanagertypes/channel_incidentio.go

@@ -1,8 +1,6 @@
 package alertmanagertypes
 
 import (
-	"fmt"
-	"net/url"
 	"strings"
 
 	"github.com/SigNoz/signoz/pkg/errors"
@@ -64,11 +62,6 @@ func newChannelIncidentIOConfigFromReceiver(name string, receiver *Receiver) (Ch
 	}, nil
 }
 
-// incidentIOEventsPathPrefix is the path of incident.io's HTTP alert source
-// endpoint (Alert Events V2 API). The full URL is per-source:
-// https://api.incident.io/v2/alert_events/http/<source_config_id>.
-const incidentIOEventsPathPrefix = "/v2/alert_events/http/"
-
 // The description is markdown; incident.io renders it natively. The templates
 // mirror Google Chat / Jira / JSM for a consistent default across channels.
 const (
@@ -132,19 +125,8 @@ func (c *IncidentIOReceiverConfig) UnmarshalYAML(unmarshal func(any) error) erro
 		c.Description = DefaultIncidentIODescriptionTemplate
 	}
 
-	// Values are stored and sent exactly as configured, so anything that is
-	// not already canonical is rejected rather than rewritten.
-	if c.URL != strings.TrimSpace(c.URL) {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "incidentio url must not have leading or trailing whitespace")
-	}
-	u, err := url.Parse(c.URL)
-	if c.URL == "" || err != nil || u.Scheme != "https" || u.Host == "" ||
-		!strings.Contains(u.Path, incidentIOEventsPathPrefix) ||
-		strings.HasSuffix(u.Path, incidentIOEventsPathPrefix) {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, fmt.Sprintf("incidentio url must be an alert events URL (https://api.incident.io%s<source_config_id>)", incidentIOEventsPathPrefix))
-	}
-	if strings.HasSuffix(c.URL, "/") {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "incidentio url must not end with a trailing slash")
+	if c.URL == "" {
+		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "incidentio url is required")
 	}
 
 	token := string(c.Token)

pkg/types/alertmanagertypes/channel_incidentio_test.go

@@ -45,11 +45,6 @@ func TestIncidentIOReceiverConfigValidation(t *testing.T) {
 		json string
 	}{
 		{"missing url", `{"name":"incio","incidentio_configs":[{"token":"k"}]}`},
-		{"http url", `{"name":"incio","incidentio_configs":[{"url":"http://api.incident.io/v2/alert_events/http/abc","token":"k"}]}`},
-		{"not an alert events url", `{"name":"incio","incidentio_configs":[{"url":"https://api.incident.io/v2/incidents","token":"k"}]}`},
-		{"missing source config id", `{"name":"incio","incidentio_configs":[{"url":"https://api.incident.io/v2/alert_events/http/","token":"k"}]}`},
-		{"trailing slash", fmt.Sprintf(`{"name":"incio","incidentio_configs":[{"url":"%s/","token":"k"}]}`, testIncidentIOURL)},
-		{"whitespace around url", fmt.Sprintf(`{"name":"incio","incidentio_configs":[{"url":" %s ","token":"k"}]}`, testIncidentIOURL)},
 		{"missing token", fmt.Sprintf(`{"name":"incio","incidentio_configs":[{"url":"%s"}]}`, testIncidentIOURL)},
 		{"bearer prefixed token", fmt.Sprintf(`{"name":"incio","incidentio_configs":[{"url":"%s","token":"Bearer tok-123"}]}`, testIncidentIOURL)},
 		{"lowercase bearer prefixed token", fmt.Sprintf(`{"name":"incio","incidentio_configs":[{"url":"%s","token":"bearer tok-123"}]}`, testIncidentIOURL)},

pkg/types/alertmanagertypes/channel_jira.go

@@ -2,7 +2,6 @@ package alertmanagertypes
 
 import (
 	"fmt"
-	"net/url"
 	"strings"
 	"time"
 
@@ -153,7 +152,6 @@ const defaultJiraReopenDuration = model.Duration(3 * 24 * time.Hour)
 // Service accounts authenticate against the api.atlassian.com gateway (keyed by
 // cloud id) instead of the site host; they are identified by their email domain.
 const (
-	jiraCloudHostSuffix           = ".atlassian.net"
 	jiraServiceAccountEmailDomain = "@serviceaccount.atlassian.com"
 	jiraGatewayBaseURL            = "https://api.atlassian.com/ex/jira/"
 )
@@ -204,11 +202,13 @@ func (c *JiraReceiverConfig) UnmarshalYAML(unmarshal func(any) error) error {
 	if c.ReopenDuration <= 0 {
 		c.ReopenDuration = defaultJiraReopenDuration
 	}
+
 	// sub-minute windows truncate to 0 in the reopen JQL and silently disable
 	// reopening, so reject them.
 	if c.ReopenDuration < model.Duration(time.Minute) {
 		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "jira reopen_duration must be at least 1m")
 	}
+
 	if c.Summary == "" {
 		c.Summary = DefaultJiraSummaryTemplate
 	}
@@ -216,19 +216,9 @@ func (c *JiraReceiverConfig) UnmarshalYAML(unmarshal func(any) error) error {
 		c.Description = DefaultJiraDescriptionTemplate
 	}
 
-	// Values are stored and sent exactly as configured, so anything that is
-	// not already canonical is rejected rather than rewritten.
-	if c.Site != strings.TrimSpace(c.Site) {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "jira site must not have leading or trailing whitespace")
+	if c.Site == "" {
+		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "jira site is required")
 	}
-	u, err := url.Parse(c.Site)
-	if c.Site == "" || err != nil || u.Scheme != "https" || !strings.HasSuffix(strings.ToLower(u.Hostname()), jiraCloudHostSuffix) {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, fmt.Sprintf("jira site must be a Jira Cloud URL (https://<site>%s)", jiraCloudHostSuffix))
-	}
-	if strings.HasSuffix(c.Site, "/") {
-		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "jira site must not end with a trailing slash")
-	}
-
 	if c.Project == "" {
 		return errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, "jira project is required")
 	}

pkg/types/alertmanagertypes/channel_jira_test.go

@@ -11,19 +11,19 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-func jiraReceiverJSON(site, project, issueType string, withAuth bool) string {
+func jiraReceiverJSON(project, issueType string, withAuth bool) string {
 	auth := ""
 	if withAuth {
 		auth = `,"http_config":{"basic_auth":{"username":"me@acme.com","password":"token"}}`
 	}
 	return fmt.Sprintf(
-		`{"name":"jira","jira_configs":[{"site":%q,"project":%q,"issue_type":%q%s}]}`,
-		site, project, issueType, auth,
+		`{"name":"jira","jira_configs":[{"site":"https://acme.atlassian.net","project":%q,"issue_type":%q%s}]}`,
+		project, issueType, auth,
 	)
 }
 
 func TestJiraReceiverConfigDefaults(t *testing.T) {
-	r, err := NewReceiver(jiraReceiverJSON("https://acme.atlassian.net", "KAN", "Task", true))
+	r, err := NewReceiver(jiraReceiverJSON("KAN", "Task", true))
 	require.NoError(t, err)
 	require.Len(t, r.JiraConfigs, 1)
 
@@ -93,17 +93,10 @@ func TestJiraReceiverConfigValidation(t *testing.T) {
 		json string
 	}{
 		{"missing site", `{"name":"j","jira_configs":[{"project":"KAN","issue_type":"Task","http_config":{"basic_auth":{"username":"e","password":"t"}}}]}`},
-		{"http site", jiraReceiverJSON("http://acme.atlassian.net", "KAN", "Task", true)},
-		{"non-cloud host", jiraReceiverJSON("https://jira.acme.com", "KAN", "Task", true)},
-		{"lookalike host suffix", jiraReceiverJSON("https://www.iamnotatlassian.net", "KAN", "Task", true)},
-		{"bare atlassian.net", jiraReceiverJSON("https://atlassian.net", "KAN", "Task", true)},
-		{"trailing slash site", jiraReceiverJSON("https://acme.atlassian.net/", "KAN", "Task", true)},
-		{"padded site", jiraReceiverJSON(" https://acme.atlassian.net ", "KAN", "Task", true)},
-		{"missing project", jiraReceiverJSON("https://acme.atlassian.net", "", "Task", true)},
-		{"missing issue_type", jiraReceiverJSON("https://acme.atlassian.net", "KAN", "", true)},
-		{"missing basic auth", jiraReceiverJSON("https://acme.atlassian.net", "KAN", "Task", false)},
+		{"missing project", jiraReceiverJSON("", "Task", true)},
+		{"missing issue_type", jiraReceiverJSON("KAN", "", true)},
+		{"missing basic auth", jiraReceiverJSON("KAN", "Task", false)},
 		{"invalid reopen_duration format", `{"name":"j","jira_configs":[{"site":"https://acme.atlassian.net","project":"KAN","issue_type":"Task","reopen_duration":"3days","http_config":{"basic_auth":{"username":"e","password":"t"}}}]}`},
-		{"sub-minute reopen_duration", `{"name":"j","jira_configs":[{"site":"https://acme.atlassian.net","project":"KAN","issue_type":"Task","reopen_duration":"30s","http_config":{"basic_auth":{"username":"e","password":"t"}}}]}`},
 	}
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {

pkg/types/alertmanagertypes/channelconvertors_test.go

@@ -4,7 +4,6 @@ import (
 	"reflect"
 	"testing"
 
-	"github.com/SigNoz/signoz/pkg/errors"
 	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/prometheus/alertmanager/config"
 	commoncfg "github.com/prometheus/common/config"
@@ -368,26 +367,6 @@ func TestPostableChannelToReceiverRoundTripsWebhookAuthModes(t *testing.T) {
 	}
 }
 
-// The SigNoz notifiers validate in their UnmarshalYAML, which ToReceiver reaches
-// only through the defaulting round-trip. A spec that passes Validate can still
-// be rejected there, and the request has to fail as invalid input rather than as
-// an internal error.
-func TestPostableChannelToReceiverReportsNotifierValidationAsInvalidInput(t *testing.T) {
-	postable := PostableNotificationChannel{
-		Name:        "channel",
-		DisplayName: "channel",
-		Config: ChannelConfig{Kind: ChannelKindIncidentIO, Spec: &ChannelIncidentIOConfig{
-			URL: "https://api.incident.io/v2/incidents", Token: "token",
-			Title: valuer.MustNewUnsetOrNonEmptyString("incidentio title"), Description: valuer.MustNewUnsetOrNonEmptyString("incidentio description"),
-		}},
-	}
-	require.NoError(t, postable.Validate())
-
-	_, err := postable.ToReceiver()
-	require.Error(t, err)
-	assert.True(t, errors.Ast(err, errors.TypeInvalidInput), "got %v", err)
-}
-
 // rejectUnsupportedHTTPConfig enumerates the fields it rejects, so one added
 // upstream would pass unnoticed and be dropped on read. Pinning the counts turns
 // a dependency bump into a failing test rather than silent data loss.

pkg/types/coretypes/extractor.go

@@ -25,13 +25,12 @@ type ExtractPhase int
 type extractorContextKey struct{}
 
 // ExtractorContext carries everything an extractor may read: Request + RequestBody
-// are filled pre-handler, ResponseBody post-handler. DecodedRequestBody is
-// RequestBody decoded by the resource middleware into the route's declared request type.
+// are filled pre-handler, ResponseBody post-handler. RequestBody is the body
+// decoded by the resource middleware into the route's declared request type.
 type ExtractorContext struct {
-	Request            *http.Request
-	RequestBody        []byte
-	DecodedRequestBody any
-	ResponseBody       []byte
+	Request      *http.Request
+	RequestBody  any
+	ResponseBody []byte
 }
 
 func NewContextWithExtractorContext(ctx context.Context, ec ExtractorContext) context.Context {
@@ -48,13 +47,13 @@ func ExtractorContextFromContext(ctx context.Context) (ExtractorContext, error)
 }
 
 func BodyAs[T any](ec ExtractorContext) (*T, error) {
-	if ec.DecodedRequestBody == nil {
+	if ec.RequestBody == nil {
 		return nil, errors.New(errors.TypeInternal, errCodeRequestTypeUndeclared, "route does not declare a request type")
 	}
 
-	typed, ok := ec.DecodedRequestBody.(*T)
+	typed, ok := ec.RequestBody.(*T)
 	if !ok {
-		return nil, errors.Newf(errors.TypeInternal, errCodeRequestTypeMismatch, "route declares request type %T, expected %T", ec.DecodedRequestBody, (*T)(nil))
+		return nil, errors.Newf(errors.TypeInternal, errCodeRequestTypeMismatch, "route declares request type %T, expected %T", ec.RequestBody, (*T)(nil))
 	}
 
 	return typed, nil
@@ -146,29 +145,6 @@ func BodyFields[T any](pick func(*T) []string) ResourceIDsExtractor {
 	}}
 }
 
-func BodyJSONPath(path string) ResourceIDExtractor {
-	return ResourceIDExtractor{Phase: PhaseRequest, Fn: func(ec ExtractorContext) (string, error) {
-		return gjson.GetBytes(ec.RequestBody, path).String(), nil
-	}}
-}
-
-func BodyJSONArray(path string) ResourceIDsExtractor {
-	return ResourceIDsExtractor{Phase: PhaseRequest, Fn: func(ec ExtractorContext) ([]string, error) {
-		result := gjson.GetBytes(ec.RequestBody, path)
-		if !result.Exists() {
-			return nil, nil
-		}
-
-		array := result.Array()
-		ids := make([]string, 0, len(array))
-		for _, r := range array {
-			ids = append(ids, r.String())
-		}
-
-		return ids, nil
-	}}
-}
-
 func ResponseJSONPath(path string) ResourceIDExtractor {
 	return ResourceIDExtractor{Phase: PhaseResponse, Fn: func(ec ExtractorContext) (string, error) {
 		return gjson.GetBytes(ec.ResponseBody, path).String(), nil

pkg/zeus/handler.go

@@ -8,6 +8,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/http/render"
 	"github.com/SigNoz/signoz/pkg/licensing"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/zeustypes"
 	"github.com/SigNoz/signoz/pkg/valuer"
 )
@@ -94,8 +95,8 @@ func (h *handler) PutHost(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	req := new(zeustypes.PostableHost)
-	if err := binding.JSON.BindBody(r.Body, req); err != nil {
+	req, err := coretypes.BodyFromContext[zeustypes.PostableHost](r.Context())
+	if err != nil {
 		render.Error(rw, err)
 		return
 	}

tests/integration/tests/alertmanager/04_notification_channels_v2.py

@@ -336,10 +336,7 @@ def test_create_rejects_a_duplicate_display_name(
         pytest.param({"name": "webhook-both-auth", "config": {"kind": "webhook", "spec": {"url": "https://webhook.test/hook", "username": "u", "password": "p", "bearerToken": "t"}}}, id="webhook_basic_auth_with_bearer_token"),
         # The last three reach the notifier's own validation rather than the
         # spec's, so they assert it still surfaces as a 400 through v2.
-        pytest.param({"name": "jira-server-site", "config": {"kind": "jira", "spec": {"site": "https://jira.acme.com", "project": "OPS", "issueType": "Bug", "email": "a@integration.test", "apiToken": "t", "summary": "Alert", "description": "body"}}}, id="jira_site_not_jira_cloud"),
-        pytest.param(
-            {"name": "jira-short-reopen", "config": {"kind": "jira", "spec": {"site": "https://acme.atlassian.net", "project": "OPS", "issueType": "Bug", "email": "a@integration.test", "apiToken": "t", "summary": "Alert", "description": "body", "reopenDuration": "30s"}}}, id="jira_reopen_duration_below_a_minute"
-        ),
+        pytest.param({"name": "jira-short-reopen", "config": {"kind": "jira", "spec": {"site": "https://acme.atlassian.net", "project": "OPS", "issueType": "Bug", "email": "a@integration.test", "apiToken": "t", "summary": "Alert", "description": "body", "reopenDuration": "30s"}}}, id="jira_reopen_duration_below_a_minute"),
         pytest.param({"name": "incidentio-bearer", "config": {"kind": "incidentio", "spec": {"url": "https://api.incident.io/v2/alert_events/http/01ABCDEF", "token": "Bearer incidentio-token", "title": "Alert", "description": "body"}}}, id="incidentio_token_with_bearer_prefix"),
         pytest.param({"name": "slack-empty-title", "config": {"kind": "slack", "spec": {"apiUrl": "https://hooks.slack.test/services/T/B/X", "title": ""}}}, id="empty_string_on_a_defaulted_field"),
         pytest.param({"name": "jsmops-empty-tags", "config": {"kind": "jsmops", "spec": {"apiKey": "jsm-api-key", "tags": ""}}}, id="empty_string_on_a_defaulted_signoz_field"),

tests/integration/tests/querierauthz/03_query_types.py

@@ -2,6 +2,8 @@ from collections.abc import Callable
 from datetime import UTC, datetime, timedelta
 from http import HTTPStatus
 
+import requests
+
 from fixtures import querier, types
 from fixtures.auth import USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD, change_user_role, create_active_user
 from fixtures.querier import make_query_request
@@ -150,3 +152,27 @@ def test_managed_viewer_meter_and_clickhouse_allowed_audit_denied(
     # audit-logs builder queries remain admin-only.
     audit = make_query_request(signoz, token, start, end, audit_query, request_type=querier.RequestType.RAW)
     assert audit.status_code == HTTPStatus.FORBIDDEN, audit.text
+
+
+def test_duplicate_signal_key_is_checked_on_the_bound_value(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    now = datetime.now(tz=UTC)
+    start, end = int((now - timedelta(hours=1)).timestamp() * 1000), int(now.timestamp() * 1000)
+
+    # raw string: json= would collapse the duplicate "signal" key
+    body = (
+        f'{{"schemaVersion":"v1","start":{start},"end":{end},"requestType":"scalar",'
+        '"compositeQuery":{"queries":[{"type":"builder_query","spec":{"name":"A","signal":"traces","signal":"logs",'
+        '"disabled":false,"filter":{"expression":"signoz.workspace.key.id = \'key-a\'"},'
+        '"aggregations":[{"expression":"count()"}]}}]},"noCache":true}'
+    )
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=querier.QUERY_TIMEOUT,
+        headers={"authorization": f"Bearer {get_token(key_a_email, user_password)}", "content-type": "application/json"},
+        data=body,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text