Merge remote-tracking branch 'origin/main' into issue_nerve_462

#### Description

- `PUT /api/v2/quick_filters/{source}` (and the legacy v1 update) now
returns 400 for fields whose values are unique per span/log, so a quick
filter on them has nothing to pick from: trace/span/parent-span IDs
(incl. legacy `traceID`/`spanID`/`parentSpanID`), `timestamp`, log
`body`, `gen_ai.tool.call.id`, free-text payloads
(gen_ai/OpenInference/Langfuse/Traceloop messages,
`exception.message`/`stacktrace`, `db.statement`/`db.query.text`), token
counts (`gen_ai.usage.*`, `llm.token_count.*`, `ai.usage.*`, …) and the
per-span `signoz.gen_ai.*.cost` keys. The list is hard-coded in
`quickfiltertypes`.
- `trace_id` is removed from the default traces quick filters, including
the seeds in migrations `030`/`031` (separate commit), so `147` is a
no-op on fresh installs.
- Migration `147` strips these fields from every stored quick filter;
other entries are kept byte-for-byte.

#### Issues closed by this PR

Closes #13157

#### Additional Information

- Follows the approach agreed in SigNoz/platform-pod#3282, replacing the
frontend-only blocklist from #13182.
- Changelog: `trace_id`, `span_id` and other high-cardinality fields
(token counts, costs, message payloads) are no longer supported as quick
filters and are removed from existing quick filter settings; filter by
them from the search bar instead.
- The quick filter settings panel still lists these fields as
suggestions; adding one now surfaces the API error. Hiding them is out
of scope.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/e2eci.yaml

@@ -88,7 +88,7 @@ jobs:
             postgres:15 \
             clickhouse/clickhouse-server:25.12.5 \
             clickhouse/clickhouse-keeper:25.12.5 \
-            signoz/signoz-otel-collector:v0.144.16-rc.1 \
+            signoz/signoz-schema-migrator:v0.144.9 \
             wiremock/wiremock:2.35.1-1 \
             | xargs -P 0 -n 1 docker pull -q
       - name: python

.github/workflows/integrationci.yaml

@@ -40,7 +40,6 @@ jobs:
         suite:
           - alertmanager
           - alertmanagerrotation
-          - auditquerier
           - basepath
           - callbackauthn
           - cloudintegrations
@@ -84,8 +83,8 @@ jobs:
           - wal
         clickhouse-version:
           - 25.12.5
-        signoz-otel-collector-version:
-          - v0.144.16-rc.1
+        schema-migrator-version:
+          - v0.144.6
         postgres-version:
           - 15
     if: |
@@ -156,4 +155,4 @@ jobs:
             --sqlite-mode ${{matrix.sqlite-mode}} \
             --postgres-version ${{matrix.postgres-version}} \
             --clickhouse-version ${{matrix.clickhouse-version}} \
-            --signoz-otel-collector-version ${{matrix.signoz-otel-collector-version}}
+            --schema-migrator-version ${{matrix.schema-migrator-version}}

docs/api/openapi.yml

@@ -3970,6 +3970,9 @@ components:
       - logs-field
       - traces-field
       - metrics-field
+      - llm-pricing-rule
+      - span-mapper-group
+      - span-mapper
       type: string
     CoretypesObject:
       properties:
@@ -16087,9 +16090,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - llm-pricing-rule:list
       - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:list
       summary: List pricing rules
       tags:
       - llmpricingrules
@@ -16134,9 +16137,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - llm-pricing-rule:update
       - tokenizer:
-        - ADMIN
+        - llm-pricing-rule:update
       summary: Create or update pricing rules
       tags:
       - llmpricingrules
@@ -16182,9 +16185,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - llm-pricing-rule:delete
       - tokenizer:
-        - ADMIN
+        - llm-pricing-rule:delete
       summary: Delete a pricing rule
       tags:
       - llmpricingrules
@@ -16240,9 +16243,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - llm-pricing-rule:read
       - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:read
       summary: Get a pricing rule
       tags:
       - llmpricingrules
@@ -16295,9 +16298,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - llm-pricing-rule:list
+        - traces:read
       - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:list
+        - traces:read
       summary: List unmapped models
       tags:
       - llmpricingrules
@@ -18154,9 +18159,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - span-mapper-group:list
       - tokenizer:
-        - VIEWER
+        - span-mapper-group:list
       summary: List span attribute mapping groups
       tags:
       - spanmapper
@@ -18217,9 +18222,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper-group:create
       - tokenizer:
-        - ADMIN
+        - span-mapper-group:create
       summary: Create a span attribute mapping group
       tags:
       - spanmapper
@@ -18264,9 +18269,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper-group:delete
       - tokenizer:
-        - ADMIN
+        - span-mapper-group:delete
       summary: Delete a span attribute mapping group
       tags:
       - spanmapper
@@ -18322,9 +18327,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper-group:update
       - tokenizer:
-        - ADMIN
+        - span-mapper-group:update
       summary: Update a span attribute mapping group
       tags:
       - spanmapper
@@ -18387,9 +18392,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - span-mapper-group:read
       - tokenizer:
-        - VIEWER
+        - span-mapper-group:read
       summary: List span mappers for a group
       tags:
       - spanmapper
@@ -18462,9 +18467,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper:create
+        - span-mapper-group:attach
       - tokenizer:
-        - ADMIN
+        - span-mapper:create
+        - span-mapper-group:attach
       summary: Create a span mapper
       tags:
       - spanmapper
@@ -18514,9 +18521,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper:delete
+        - span-mapper-group:detach
       - tokenizer:
-        - ADMIN
+        - span-mapper:delete
+        - span-mapper-group:detach
       summary: Delete a span mapper
       tags:
       - spanmapper
@@ -18577,9 +18586,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - span-mapper:update
+        - span-mapper-group:update
       - tokenizer:
-        - ADMIN
+        - span-mapper:update
+        - span-mapper-group:update
       summary: Update a span mapper
       tags:
       - spanmapper
@@ -18587,7 +18598,8 @@ paths:
   /api/v1/span_mapper_groups/test:
     post:
       deprecated: false
-      description: Tests how span mappers would transform sample spans
+      description: Tests how span mappers would transform sample spans. Groups sent
+        without mappers are read from the store by name.
       operationId: TestSpanMappers
       requestBody:
         content:
@@ -18641,9 +18653,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - span-mapper-group:read
       - tokenizer:
-        - VIEWER
+        - span-mapper-group:read
       summary: Test span mappers against sample spans
       tags:
       - spanmapper

docs/contributing/tests/integration.md

@@ -256,7 +256,7 @@ Tests can be configured using pytest options:
 - `--sqlite-mode` — SQLite journal mode: `delete` or `wal` (default: `delete`). Only relevant when `--sqlstore-provider=sqlite`.
 - `--postgres-version` — PostgreSQL version (default: `15`)
 - `--clickhouse-version` — ClickHouse version, also used for ClickHouse Keeper (default: `25.12.5`)
-- `--signoz-otel-collector-version`: SigNoz OTel collector version, used to run the ClickHouse migrations (default: `v0.144.16-rc.1`)
+- `--schema-migrator-version` — SigNoz schema migrator version (default: `v0.144.9`)
 - `--with-web` — Build the frontend into the SigNoz image (required for e2e)
 
 Example:

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -3611,6 +3611,9 @@ export enum CoretypesKindDTO {
 	'logs-field' = 'logs-field',
 	'traces-field' = 'traces-field',
 	'metrics-field' = 'metrics-field',
+	'llm-pricing-rule' = 'llm-pricing-rule',
+	'span-mapper-group' = 'span-mapper-group',
+	'span-mapper' = 'span-mapper',
 }
 export enum CoretypesTypeDTO {
 	user = 'user',

frontend/src/api/generated/services/spanmapper/index.ts

@@ -803,7 +803,7 @@ export const useUpdateSpanMapper = <
 	return useMutation(getUpdateSpanMapperMutationOptions(options));
 };
 /**
- * Tests how span mappers would transform sample spans
+ * Tests how span mappers would transform sample spans. Groups sent without mappers are read from the store by name.
  * @summary Test span mappers against sample spans
  */
 export const testSpanMappers = (

frontend/src/components/ListFilter/FilterZone/FilterChips.tsx

@@ -1,18 +1,13 @@
-import { ConfigProvider, Select } from 'antd';
-import { Checkbox } from '@signozhq/ui/checkbox';
+import { Select } from 'antd';
 import cx from 'classnames';
 
 import type { UpdatedWindow } from '../dsl/types';
 import type { CreatorOption } from '../types';
 import { UPDATED_OPTIONS } from './constants';
+import MultiSelectFilter from './MultiSelectFilter';
 
 import styles from './FilterZone.module.scss';
 
-// The option checkbox already marks selection, so selected rows stay regular weight.
-const CREATOR_SELECT_THEME = {
-	components: { Select: { optionSelectedFontWeight: 400 } },
-};
-
 interface Props {
 	createdBy: string[];
 	updated: UpdatedWindow;
@@ -52,36 +47,16 @@ function FilterChips({
 
 	return (
 		<div className={styles.chips}>
-			<ConfigProvider theme={CREATOR_SELECT_THEME}>
-				<Select
-					mode="multiple"
-					showSearch
-					allowClear
-					className={cx(styles.select, styles.selectWide)}
-					placeholder="Created by"
-					value={createdBy}
-					options={creatorOptionsData}
-					optionFilterProp="label"
-					maxTagCount={1}
-					menuItemSelectedIcon={null}
-					data-testid={`${testIdPrefix}-filter-created-by`}
-					disabled={disabled}
-					onClear={onClearCreatedBy}
-					optionRender={(option): JSX.Element => (
-						<div className={styles.creatorOption}>
-							<div className={styles.creatorCheck}>
-								<Checkbox
-									color="primary"
-									value={createdBy.includes(option.value as string)}
-								/>
-							</div>
-							<span className={styles.creatorLabel}>{option.label}</span>
-						</div>
-					)}
-					onChange={(value): void => onCreatedByChange(value as string[])}
-					onDropdownVisibleChange={runOnClose}
-				/>
-			</ConfigProvider>
+			<MultiSelectFilter
+				value={createdBy}
+				options={creatorOptionsData}
+				placeholder="Created by"
+				testId={`${testIdPrefix}-filter-created-by`}
+				disabled={disabled}
+				onClear={onClearCreatedBy}
+				onChange={onCreatedByChange}
+				onDropdownVisibleChange={runOnClose}
+			/>
 			<Select
 				showSearch
 				className={cx(styles.select, styles.selectNarrow)}

frontend/src/components/ListFilter/FilterZone/FilterZone.module.scss

@@ -86,21 +86,21 @@
 	}
 }
 
-// Created-by option: a presentational checkbox + label (antd handles the toggle).
-.creatorOption {
+// Multi-select option: a presentational checkbox + label (antd handles the toggle).
+.checkOption {
 	display: flex;
 	align-items: center;
 	gap: 8px;
 }
 
-.creatorCheck {
+.checkOptionBox {
 	// Flex, not block: a line box would shift with the check mark's baseline.
 	display: flex;
 	flex-shrink: 0;
 	pointer-events: none;
 }
 
-.creatorLabel {
+.checkOptionLabel {
 	overflow: hidden;
 	text-overflow: ellipsis;
 	white-space: nowrap;

frontend/src/components/ListFilter/FilterZone/MultiSelectFilter.tsx

@@ -0,0 +1,72 @@
+import { ConfigProvider, Select } from 'antd';
+import { Checkbox } from '@signozhq/ui/checkbox';
+import cx from 'classnames';
+
+import styles from './FilterZone.module.scss';
+
+// The option checkbox already marks selection, so selected rows stay regular weight.
+const CHECKBOX_SELECT_THEME = {
+	components: { Select: { optionSelectedFontWeight: 400 } },
+};
+
+export interface MultiSelectFilterOption {
+	value: string;
+	label: string;
+}
+
+interface Props {
+	value: string[];
+	options: MultiSelectFilterOption[];
+	placeholder: string;
+	testId: string;
+	onChange: (values: string[]) => void;
+	onClear?: () => void;
+	onDropdownVisibleChange?: (open: boolean) => void;
+	disabled?: boolean;
+}
+
+function MultiSelectFilter({
+	value,
+	options,
+	placeholder,
+	testId,
+	onChange,
+	onClear,
+	onDropdownVisibleChange,
+	disabled = false,
+}: Props): JSX.Element {
+	return (
+		<ConfigProvider theme={CHECKBOX_SELECT_THEME}>
+			<Select
+				mode="multiple"
+				showSearch
+				allowClear
+				className={cx(styles.select, styles.selectWide)}
+				placeholder={placeholder}
+				value={value}
+				options={options}
+				optionFilterProp="label"
+				maxTagCount={1}
+				menuItemSelectedIcon={null}
+				data-testid={testId}
+				disabled={disabled}
+				onClear={onClear}
+				optionRender={(option): JSX.Element => (
+					<div className={styles.checkOption}>
+						<div className={styles.checkOptionBox}>
+							<Checkbox
+								color="primary"
+								value={value.includes(option.value as string)}
+							/>
+						</div>
+						<span className={styles.checkOptionLabel}>{option.label}</span>
+					</div>
+				)}
+				onChange={(next): void => onChange(next as string[])}
+				onDropdownVisibleChange={onDropdownVisibleChange}
+			/>
+		</ConfigProvider>
+	);
+}
+
+export default MultiSelectFilter;

frontend/src/container/ListAlertRules/__tests__/ListAlertRules.search.test.tsx

@@ -129,15 +129,29 @@ describe('ListAlertRules — search', () => {
 		});
 	});
 
-	it('sends each selected state as a repeated states= param', async () => {
+	it('sends the selected states once, as repeated states= params, when the dropdown closes', async () => {
 		const user = userEvent.setup({ delay: null });
 		renderListAlertRules();
 
 		await screen.findByText('High CPU Alert');
 
-		await user.click(screen.getByTestId('alert-rules-filter-states'));
-		await user.click(await screen.findByRole('option', { name: 'Firing' }));
-		await user.click(await screen.findByRole('option', { name: 'Disabled' }));
+		await user.click(
+			within(screen.getByTestId('alert-rules-filter-states')).getByRole(
+				'combobox',
+			),
+		);
+		const dropdown = await waitFor(() => {
+			const element = document.querySelector<HTMLElement>('.ant-select-dropdown');
+			expect(element).not.toBeNull();
+			return element as HTMLElement;
+		});
+		await user.click(within(dropdown).getByText('Firing'));
+		await user.click(within(dropdown).getByText('Disabled'));
+
+		expect(requests.some((r) => r.has('states'))).toBe(false);
+		expect(getCurrentNuqsSearchParams().has('states')).toBe(false);
+
+		await user.click(document.body);
 
 		await waitFor(() => {
 			expect(lastRequest(requests).getAll('states')).toStrictEqual([
@@ -145,11 +159,12 @@ describe('ListAlertRules — search', () => {
 				'disabled',
 			]);
 		});
+		expect(requests.filter((r) => r.has('states'))).toHaveLength(1);
 		expect(lastRequest(requests).has('states[]')).toBe(false);
 		await waitFor(() => {
 			expect(getCurrentNuqsSearchParams().get('states')).toBe('firing,disabled');
 		});
-	});
+	}, 15_000);
 
 	it('Clear empties the query and the states', async () => {
 		const user = userEvent.setup({ delay: null });

frontend/src/container/ListAlertRules/components/RuleStatesFilter.module.scss

@@ -1,4 +0,0 @@
-.statesSelect {
-	width: 240px;
-	flex: none;
-}

frontend/src/container/ListAlertRules/components/RuleStatesFilter.tsx

@@ -1,10 +1,12 @@
-import { useCallback } from 'react';
-import { ComboboxSimple, type ComboboxSimpleItem } from '@signozhq/ui/combobox';
+import { useEffect, useState } from 'react';
 import { RuletypesAlertStateDTO } from 'api/generated/services/sigNoz.schemas';
+import MultiSelectFilter, {
+	type MultiSelectFilterOption,
+} from 'components/ListFilter/FilterZone/MultiSelectFilter';
 
-import styles from './RuleStatesFilter.module.scss';
+import { isSameStates } from '../utils';
 
-const STATE_ITEMS: ComboboxSimpleItem[] = [
+const STATE_OPTIONS: MultiSelectFilterOption[] = [
 	{ value: RuletypesAlertStateDTO.firing, label: 'Firing' },
 	{ value: RuletypesAlertStateDTO.pending, label: 'Pending' },
 	{ value: RuletypesAlertStateDTO.recovering, label: 'Recovering' },
@@ -22,26 +24,35 @@ function RuleStatesFilter({
 	states,
 	onChange,
 }: RuleStatesFilterProps): JSX.Element {
-	const handleChange = useCallback(
-		(values: unknown): void => {
-			if (Array.isArray(values)) {
-				onChange(values as string[]);
-			}
-		},
-		[onChange],
-	);
+	const [draft, setDraft] = useState(states);
+	const [open, setOpen] = useState(false);
+
+	useEffect(() => {
+		setDraft(states);
+	}, [states]);
+
+	const handleChange = (next: string[]): void => {
+		setDraft(next);
+		if (!open) {
+			onChange(next);
+		}
+	};
+
+	const handleDropdownVisibleChange = (nextOpen: boolean): void => {
+		setOpen(nextOpen);
+		if (!nextOpen && !isSameStates(draft, states)) {
+			onChange(draft);
+		}
+	};
 
 	return (
-		<ComboboxSimple
-			className={styles.statesSelect}
-			multiple
-			value={states}
-			onChange={handleChange}
-			placeholder="Filter by state"
-			inputPlaceholder="Select one or more"
-			items={STATE_ITEMS}
-			maxDisplayedPills={2}
+		<MultiSelectFilter
+			value={draft}
+			options={STATE_OPTIONS}
+			placeholder="State"
 			testId="alert-rules-filter-states"
+			onChange={handleChange}
+			onDropdownVisibleChange={handleDropdownVisibleChange}
 		/>
 	);
 }

frontend/src/container/ListAlertRules/utils.ts

@@ -86,6 +86,12 @@ export function toOrderBy(
 		: null;
 }
 
+export function isSameStates(a: string[], b: string[]): boolean {
+	return (
+		a.length === b.length && [...a].sort().join(',') === [...b].sort().join(',')
+	);
+}
+
 export function isSameRuleListFilter(
 	a: RuleListFilter,
 	b: RuleListFilter,
@@ -94,8 +100,7 @@ export function isSameRuleListFilter(
 		a.query.trim() === b.query.trim() &&
 		a.sort === b.sort &&
 		a.order === b.order &&
-		a.states.length === b.states.length &&
-		[...a.states].sort().join(',') === [...b.states].sort().join(',')
+		isSameStates(a.states, b.states)
 	);
 }
 

frontend/src/pages/AlertList/AlertRules/stories/AlertRules.stories.tsx

@@ -15,6 +15,7 @@ import {
 	openRenameViewPopover,
 	openRowActions,
 	openSaveViewPopover,
+	openStatesFilter,
 	toggleAlert,
 } from './__story_mockdata__/alertRules.play';
 
@@ -179,6 +180,11 @@ export const ColumnPicker: Story = {
 	play: openColumnPicker,
 };
 
+/** The State dropdown, open with a state picked. */
+export const StateFilterOpen: Story = {
+	play: openStatesFilter,
+};
+
 /**
  * Every label badge in the Labels column, held open: each one repeats its own
  * `key: value` with a copy button. The rules carry two labels apiece, which fit

frontend/src/pages/AlertList/AlertRules/stories/__story_mockdata__/alertRules.play.ts

@@ -3,6 +3,7 @@
  * Do not hand-edit: regenerate instead.
  */
 
+import { DEFAULT_RULE_VIEW } from 'container/ListAlertRules/list.config';
 import { expect, screen, userEvent, within } from 'storybook/test';
 
 import type { PageStoryArgs } from '@/storybook/runtime/resolveStory';
@@ -111,6 +112,34 @@ export const openColumnPicker = async ({
 	await screen.findByText(/toggle columns/i);
 };
 
+export const openStatesFilter = async ({
+	canvasElement,
+	args,
+}: PlayContext): Promise<void> => {
+	if (
+		args.rules === 0 &&
+		args.view === DEFAULT_RULE_VIEW &&
+		args.dataState === 'loaded'
+	) {
+		return;
+	}
+
+	const filter = await within(canvasElement).findByTestId(
+		'alert-rules-filter-states',
+		undefined,
+		untilLoaded,
+	);
+
+	await userEvent.click(filter.querySelector('.ant-select-selector') ?? filter);
+	const option = (await screen.findAllByText('Firing')).find((node) =>
+		node.closest('.ant-select-dropdown'),
+	);
+	if (screen.queryAllByRole('checkbox', { checked: true }).length === 0) {
+		await userEvent.click(option ?? filter);
+	}
+	await screen.findAllByRole('checkbox', { checked: true });
+};
+
 export const toggleAlert = async ({
 	canvasElement,
 	args,

frontend/src/schemas/generated/transactionGroups.schema.json

@@ -74,7 +74,10 @@
         "meter-metrics",
         "logs-field",
         "traces-field",
-        "metrics-field"
+        "metrics-field",
+        "llm-pricing-rule",
+        "span-mapper-group",
+        "span-mapper"
       ],
       "type": "string"
     },

pkg/apiserver/signozapiserver/llmpricingrule.go

@@ -4,14 +4,16 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/querybuilder"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/llmpricingruletypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.List),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.List, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListLLMPricingRules",
 			Tags:                []string{"llmpricingrules"},
@@ -25,14 +27,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.CreateOrUpdate),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.CreateOrUpdate, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                 "CreateOrUpdateLLMPricingRules",
 			Tags:               []string{"llmpricingrules"},
@@ -43,14 +51,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:  http.StatusNoContent,
 			ErrorStatusCodes:   []int{http.StatusBadRequest},
 			Deprecated:         false,
-			SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(handler.TelemetryResourceDef{
+			Verb:      coretypes.VerbUpdate,
+			Category:  coretypes.ActionCategoryConfigurationChange,
+			Selector:  llmpricingruletypes.RuleSelector,
+			Resources: llmpricingruletypes.UpdatableRulesResources,
+		}),
 	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/unmapped_models", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.ListUnmappedModels),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.ListUnmappedModels, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListUnmappedLLMModels",
 			Tags:                []string{"llmpricingrules"},
@@ -63,14 +77,28 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList), coretypes.ResourceTelemetryResourceTraces.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+				Verb:     coretypes.VerbList,
+				Category: coretypes.ActionCategoryDataAccess,
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.TelemetryResourceDef{
+				Verb:      coretypes.VerbRead,
+				Category:  coretypes.ActionCategoryDataAccess,
+				Selector:  querybuilder.TelemetrySelector,
+				Resources: querybuilder.BuilderQueryWildcardResources(coretypes.ResourceTelemetryResourceTraces),
+			},
+		),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.Get),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Get, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -83,14 +111,21 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.Delete),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Delete, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "DeleteLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -103,8 +138,15 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbDelete)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

pkg/apiserver/signozapiserver/spanmapper.go

@@ -3,15 +3,17 @@ package signozapiserver
 import (
 	"net/http"
 
-	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
-	"github.com/SigNoz/signoz/pkg/types/spantypes"
 	"github.com/gorilla/mux"
+
+	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types/spantypes"
 )
 
 func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 	if err := router.Handle("/api/v1/span_mapper_groups", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.spanMapperHandler.ListGroups),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.ListGroups, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListSpanMapperGroups",
 			Tags:                []string{"spanmapper"},
@@ -25,14 +27,20 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.CreateGroup),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.CreateGroup, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "CreateSpanMapperGroup",
 			Tags:                []string{"spanmapper"},
@@ -45,19 +53,26 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusCreated,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusConflict},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbCreate)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/test", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.spanMapperHandler.TestMappers),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.TestMappers, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "TestSpanMappers",
 			Tags:                []string{"spanmapper"},
 			Summary:             "Test span mappers against sample spans",
-			Description:         "Tests how span mappers would transform sample spans",
+			Description:         "Tests how span mappers would transform sample spans. Groups sent without mappers are read from the store by name.",
 			Request:             new(spantypes.PostableSpanMapperTest),
 			RequestContentType:  "application/json",
 			Response:            new(spantypes.GettableSpanMapperTest),
@@ -65,14 +80,20 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.UpdateGroup),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.UpdateGroup, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                 "UpdateSpanMapperGroup",
 			Tags:               []string{"spanmapper"},
@@ -83,14 +104,21 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:  http.StatusNoContent,
 			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:         false,
-			SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("groupId"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.DeleteGroup),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.DeleteGroup, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "DeleteSpanMapperGroup",
 			Tags:                []string{"spanmapper"},
@@ -103,14 +131,21 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbDelete)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("groupId"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}/span_mappers", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.spanMapperHandler.ListMappers),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.ListMappers, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListSpanMappers",
 			Tags:                []string{"spanmapper"},
@@ -123,14 +158,21 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("groupId"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}/span_mappers", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.CreateMapper),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.CreateMapper, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "CreateSpanMapper",
 			Tags:                []string{"spanmapper"},
@@ -143,14 +185,32 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusCreated,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound, http.StatusConflict},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapper.Scope(coretypes.VerbCreate), coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbAttach)}),
 		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceSpanMapper,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachParentChildResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				ParentResource: coretypes.ResourceMetaResourceSpanMapperGroup,
+				ParentID:       coretypes.PathParam("groupId"),
+				ParentSelector: coretypes.IDSelector,
+				ChildResource:  coretypes.ResourceMetaResourceSpanMapper,
+				ChildIDs:       coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+			},
+		),
 	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}/span_mappers/{mapperId}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.UpdateMapper),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.UpdateMapper, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                 "UpdateSpanMapper",
 			Tags:               []string{"spanmapper"},
@@ -161,14 +221,30 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:  http.StatusNoContent,
 			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
 			Deprecated:         false,
-			SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapper.Scope(coretypes.VerbUpdate), coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceSpanMapper,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("mapperId"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceSpanMapperGroup,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("groupId"),
+				Selector: coretypes.IDSelector,
+			},
+		),
 	)).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/span_mapper_groups/{groupId}/span_mappers/{mapperId}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.spanMapperHandler.DeleteMapper),
+		provider.authzMiddleware.CheckResources(provider.spanMapperHandler.DeleteMapper, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "DeleteSpanMapper",
 			Tags:                []string{"spanmapper"},
@@ -181,8 +257,26 @@ func (provider *provider) addSpanMapperRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceSpanMapper.Scope(coretypes.VerbDelete), coretypes.ResourceMetaResourceSpanMapperGroup.Scope(coretypes.VerbDetach)}),
 		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceSpanMapper,
+				Verb:     coretypes.VerbDelete,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("mapperId"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachParentChildResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				ParentResource: coretypes.ResourceMetaResourceSpanMapperGroup,
+				ParentID:       coretypes.PathParam("groupId"),
+				ParentSelector: coretypes.IDSelector,
+				ChildResource:  coretypes.ResourceMetaResourceSpanMapper,
+				ChildIDs:       coretypes.OneID(coretypes.PathParam("mapperId")),
+			},
+		),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

pkg/signoz/provider.go

@@ -273,6 +273,9 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddRuleTuplesFactory(sqlstore),
 		sqlmigration.NewRestructureJiraChannelSpecFactory(sqlstore),
 		sqlmigration.NewMigrateRulesV1ToV2Alpha1Factory(sqlstore),
+		sqlmigration.NewAddLLMPricingRuleTuplesFactory(sqlstore),
+		sqlmigration.NewRemoveUnsupportedQuickFiltersFactory(),
+		sqlmigration.NewAddSpanMapperTuplesFactory(sqlstore),
 	)
 }
 

pkg/sqlmigration/030_create_quick_filters.go

@@ -58,7 +58,6 @@ func (m *createQuickFilters) Up(ctx context.Context, db *bun.DB) error {
 			{"key": "httpMethod", "dataType": "string", "type": "tag"},
 			{"key": "httpRoute", "dataType": "string", "type": "tag"},
 			{"key": "httpUrl", "dataType": "string", "type": "tag"},
-			{"key": "traceID", "dataType": "string", "type": "tag"},
 		}},
 		{"logs", []map[string]any{
 			{"key": "severity_text", "dataType": "string", "type": "resource"},

pkg/sqlmigration/031_update_quick_filters.go

@@ -58,7 +58,6 @@ func (migration *updateQuickFilters) Up(ctx context.Context, db *bun.DB) error {
 			{"key": "http.method", "dataType": "string", "type": "tag"},
 			{"key": "http.route", "dataType": "string", "type": "tag"},
 			{"key": "http_url", "dataType": "string", "type": "tag"},
-			{"key": "trace_id", "dataType": "string", "type": "tag"},
 		}},
 		{"logs", []map[string]any{
 			{"key": "severity_text", "dataType": "string", "type": "resource"},

pkg/sqlmigration/146_add_llm_pricing_rule_tuples.go

@@ -0,0 +1,163 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+)
+
+type addLLMPricingRuleTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddLLMPricingRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_llm_pricing_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addLLMPricingRuleTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addLLMPricingRuleTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addLLMPricingRuleTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "list"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "list"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
+	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
+		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
+		if err != nil {
+			return err
+		}
+		managedRoleGroups[roleName] = string(data)
+	}
+
+	for _, orgID := range orgIDs {
+		for roleName, data := range managedRoleGroups {
+			if _, err := tx.NewUpdate().
+				Model(new(roles)).
+				Set("transaction_groups = ?", data).
+				Where("org_id = ?", orgID).
+				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
+				Where("name = ?", roleName).
+				Exec(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addLLMPricingRuleTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/sqlmigration/147_remove_unsupported_quick_filters.go

@@ -0,0 +1,192 @@
+package sqlmigration
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"log/slog"
+	"strings"
+
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/migrate"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+)
+
+var unsupportedQuickFilterNames = map[string]struct{}{
+	// IDs and per-record values
+	"trace_id":            {},
+	"traceID":             {},
+	"span_id":             {},
+	"spanID":              {},
+	"parent_span_id":      {},
+	"parentSpanID":        {},
+	"timestamp":           {},
+	"body":                {},
+	"gen_ai.tool.call.id": {},
+
+	// Free-text payloads
+	"gen_ai.input.messages":       {},
+	"gen_ai.output.messages":      {},
+	"gen_ai.system_instructions":  {},
+	"gen_ai.prompt":               {},
+	"gen_ai.completion":           {},
+	"gen_ai.tool.call.arguments":  {},
+	"gen_ai.tool.call.result":     {},
+	"ai.prompt.messages":          {},
+	"ai.toolCall.result":          {},
+	"llm.input_messages":          {},
+	"input.value":                 {},
+	"output.value":                {},
+	"langfuse.observation.input":  {},
+	"langfuse.observation.output": {},
+	"traceloop.entity.input":      {},
+	"traceloop.entity.output":     {},
+	"final_result":                {},
+	"exception.message":           {},
+	"exception.stacktrace":        {},
+	"db.statement":                {},
+	"db.query.text":               {},
+
+	// Token counts
+	"gen_ai.usage.input_tokens":                              {},
+	"gen_ai.usage.output_tokens":                             {},
+	"gen_ai.usage.total_tokens":                              {},
+	"gen_ai.usage.prompt_tokens":                             {},
+	"gen_ai.usage.completion_tokens":                         {},
+	"gen_ai.usage.cached_input_tokens":                       {},
+	"gen_ai.usage.input_tokens.cached":                       {},
+	"gen_ai.usage.cache_read.input_tokens":                   {},
+	"gen_ai.usage.cache_read_input_tokens":                   {},
+	"gen_ai.usage.cache_creation.input_tokens":               {},
+	"gen_ai.usage.cache_creation_input_tokens":               {},
+	"gen_ai.usage.cache_write.input_tokens":                  {},
+	"gen_ai.usage.reasoning.output_tokens":                   {},
+	"gen_ai.usage.reasoning_tokens":                          {},
+	"gen_ai.usage.prompt_token_details.cached_read_tokens":   {},
+	"gen_ai.usage.completion_token_details.reasoning_tokens": {},
+	"ai.usage.inputTokens":                                   {},
+	"ai.usage.outputTokens":                                  {},
+	"ai.usage.promptTokens":                                  {},
+	"ai.usage.completionTokens":                              {},
+	"llm.token_count.prompt":                                 {},
+	"llm.token_count.completion":                             {},
+	"llm.token_count.total":                                  {},
+	"llm.token_count.prompt_details.cache_read":              {},
+	"llm.token_count.prompt_details.cache_write":             {},
+	"llm.token_count.completion_details.reasoning":           {},
+	"llm.usage.prompt_tokens":                                {},
+	"llm.usage.completion_tokens":                            {},
+	"llm.usage.total_tokens":                                 {},
+	"input_tokens":                                           {},
+	"output_tokens":                                          {},
+	"cache_read_tokens":                                      {},
+	"cache_creation_tokens":                                  {},
+
+	// Per-span costs
+	"signoz.gen_ai.usage.input_tokens.cost":             {},
+	"signoz.gen_ai.usage.output_tokens.cost":            {},
+	"signoz.gen_ai.usage.cache_read.input_tokens.cost":  {},
+	"signoz.gen_ai.usage.cache_write.input_tokens.cost": {},
+	"signoz.gen_ai.usage.tokens.cost":                   {},
+}
+
+type unsupportedQuickFilterRow struct {
+	bun.BaseModel `bun:"table:quick_filter"`
+
+	ID     string `bun:"id,pk"`
+	Filter string `bun:"filter"`
+}
+
+type unsupportedQuickFilterEntry struct {
+	Name string `json:"name"`
+}
+
+type removeUnsupportedQuickFilters struct {
+	settings factory.ProviderSettings
+}
+
+func NewRemoveUnsupportedQuickFiltersFactory() factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("drop_unsupported_quick_filters"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &removeUnsupportedQuickFilters{settings: ps}, nil
+	})
+}
+
+func (migration *removeUnsupportedQuickFilters) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *removeUnsupportedQuickFilters) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var rows []*unsupportedQuickFilterRow
+	if err := tx.NewSelect().Model(&rows).Scan(ctx); err != nil {
+		return err
+	}
+
+	var migrated, skipped int
+	for _, row := range rows {
+		filtered, changed, ok := removeUnsupportedQuickFilterEntries(row.Filter)
+		if !ok {
+			migration.settings.Logger.WarnContext(ctx, "quick filter could not be parsed, leaving it untouched", slog.String("quick_filter_id", row.ID), slog.String("raw_filter", row.Filter))
+			skipped++
+			continue
+		}
+		if !changed {
+			continue
+		}
+
+		migrated++
+		if _, err := tx.NewUpdate().Model((*unsupportedQuickFilterRow)(nil)).Set("filter = ?", filtered).Where("id = ?", row.ID).Exec(ctx); err != nil {
+			return err
+		}
+	}
+
+	migration.settings.Logger.InfoContext(ctx, "removed unsupported quick filters", slog.Int("total", len(rows)), slog.Int("migrated", migrated), slog.Int("skipped", skipped))
+
+	return tx.Commit()
+}
+
+func (migration *removeUnsupportedQuickFilters) Down(context.Context, *bun.DB) error {
+	return nil
+}
+
+// removeUnsupportedQuickFilterEntries drops entries whose name is in
+// unsupportedQuickFilterNames and re-encodes the rest unchanged. changed=false
+// means nothing was dropped and the row must not be written; ok=false means
+// unparseable.
+func removeUnsupportedQuickFilterEntries(filter string) (filtered string, changed bool, ok bool) {
+	var entries []json.RawMessage
+	if err := json.Unmarshal([]byte(filter), &entries); err != nil {
+		return "", false, false
+	}
+
+	kept := make([]json.RawMessage, 0, len(entries))
+	for _, rawEntry := range entries {
+		var entry unsupportedQuickFilterEntry
+		if err := json.Unmarshal(rawEntry, &entry); err != nil {
+			kept = append(kept, rawEntry)
+			continue
+		}
+		if _, unsupported := unsupportedQuickFilterNames[entry.Name]; unsupported {
+			continue
+		}
+		kept = append(kept, rawEntry)
+	}
+
+	if len(kept) == len(entries) {
+		return "", false, true
+	}
+
+	var buf bytes.Buffer
+	encoder := json.NewEncoder(&buf)
+	encoder.SetEscapeHTML(false)
+	if err := encoder.Encode(kept); err != nil {
+		return "", false, false
+	}
+	return strings.TrimSuffix(buf.String(), "\n"), true, true
+}

pkg/sqlmigration/148_add_span_mapper_tuples.go

@@ -0,0 +1,229 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"slices"
+	"time"
+
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+)
+
+type addSpanMapperTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddSpanMapperTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_span_mapper_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addSpanMapperTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addSpanMapperTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addSpanMapperTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	tuples := []migrationTuple{
+		{"signoz-admin", "metaresource", "span-mapper-group", "read"},
+		{"signoz-admin", "metaresource", "span-mapper-group", "update"},
+		{"signoz-admin", "metaresource", "span-mapper-group", "delete"},
+		{"signoz-admin", "metaresource", "span-mapper-group", "create"},
+		{"signoz-admin", "metaresource", "span-mapper-group", "list"},
+		{"signoz-admin", "metaresource", "span-mapper-group", "attach"},
+		{"signoz-admin", "metaresource", "span-mapper-group", "detach"},
+		{"signoz-admin", "metaresource", "span-mapper", "update"},
+		{"signoz-admin", "metaresource", "span-mapper", "delete"},
+		{"signoz-admin", "metaresource", "span-mapper", "create"},
+		{"signoz-editor", "metaresource", "span-mapper-group", "read"},
+		{"signoz-editor", "metaresource", "span-mapper-group", "list"},
+		{"signoz-viewer", "metaresource", "span-mapper-group", "read"},
+		{"signoz-viewer", "metaresource", "span-mapper-group", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	for _, orgID := range orgIDs {
+		if err := addManagedRoleTransactionGroups(ctx, tx, orgID, tuples); err != nil {
+			return err
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addSpanMapperTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}
+
+type migrationTransactionGroup struct {
+	Relation    string               `json:"relation"`
+	ObjectGroup migrationObjectGroup `json:"objectGroup"`
+}
+
+type migrationObjectGroup struct {
+	Resource  migrationObjectResource `json:"resource"`
+	Selectors []string                `json:"selectors"`
+}
+
+type migrationObjectResource struct {
+	Type string `json:"type"`
+	Kind string `json:"kind"`
+}
+
+// addManagedRoleTransactionGroups merges each tuple as a wildcard grant into its managed role's stored transaction groups.
+func addManagedRoleTransactionGroups(ctx context.Context, tx bun.Tx, orgID string, tuples []migrationTuple) error {
+	tuplesByRole := make(map[string][]migrationTuple)
+	for _, tuple := range tuples {
+		tuplesByRole[tuple.roleName] = append(tuplesByRole[tuple.roleName], tuple)
+	}
+
+	for roleName, roleTuples := range tuplesByRole {
+		var data sql.NullString
+		err := tx.NewSelect().
+			Table("role").
+			Column("transaction_groups").
+			Where("org_id = ?", orgID).
+			Where("type = ?", "managed").
+			Where("name = ?", roleName).
+			Scan(ctx, &data)
+		if err == sql.ErrNoRows || (err == nil && !data.Valid) {
+			continue
+		}
+		if err != nil {
+			return err
+		}
+
+		var groups []*migrationTransactionGroup
+		if err := json.Unmarshal([]byte(data.String), &groups); err != nil {
+			return err
+		}
+
+		for _, tuple := range roleTuples {
+			index := slices.IndexFunc(groups, func(group *migrationTransactionGroup) bool {
+				return group.Relation == tuple.relation && group.ObjectGroup.Resource.Type == tuple.objectType && group.ObjectGroup.Resource.Kind == tuple.objectName
+			})
+			if index == -1 {
+				groups = append(groups, &migrationTransactionGroup{
+					Relation:    tuple.relation,
+					ObjectGroup: migrationObjectGroup{Resource: migrationObjectResource{Type: tuple.objectType, Kind: tuple.objectName}, Selectors: []string{"*"}},
+				})
+				continue
+			}
+			if !slices.Contains(groups[index].ObjectGroup.Selectors, "*") {
+				groups[index].ObjectGroup.Selectors = append(groups[index].ObjectGroup.Selectors, "*")
+			}
+		}
+
+		updated, err := json.Marshal(groups)
+		if err != nil {
+			return err
+		}
+
+		if _, err := tx.NewUpdate().
+			Table("role").
+			Set("transaction_groups = ?", string(updated)).
+			Where("org_id = ?", orgID).
+			Where("type = ?", "managed").
+			Where("name = ?", roleName).
+			Exec(ctx); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}

pkg/types/coretypes/kind.go

@@ -80,6 +80,9 @@ func (name Kind) Enum() []any {
 		KindLogsField,
 		KindTracesField,
 		KindMetricsField,
+		KindLLMPricingRule,
+		KindSpanMapperGroup,
+		KindSpanMapper,
 	}
 }
 

pkg/types/coretypes/registry_kind.go

@@ -40,6 +40,9 @@ var Kinds = []Kind{
 	KindLogsField,
 	KindTracesField,
 	KindMetricsField,
+	KindLLMPricingRule,
+	KindSpanMapperGroup,
+	KindSpanMapper,
 }
 
 var (
@@ -82,4 +85,7 @@ var (
 	KindLogsField                    = MustNewKind("logs-field")
 	KindTracesField                  = MustNewKind("traces-field")
 	KindMetricsField                 = MustNewKind("metrics-field")
+	KindLLMPricingRule               = MustNewKind("llm-pricing-rule")
+	KindSpanMapperGroup              = MustNewKind("span-mapper-group")
+	KindSpanMapper                   = MustNewKind("span-mapper")
 )

pkg/types/coretypes/registry_managed_role.go

@@ -226,6 +226,22 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — admin writes, viewer reads
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		// span-mapper-group and span-mapper — admin manages, viewer reads
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapper}, WildCardSelectorString)},
+		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapper}, WildCardSelectorString)},
+		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapper}, WildCardSelectorString)},
 	},
 	SigNozEditorRoleName: {
 		// cloud-integration — editor can read accounts
@@ -331,6 +347,12 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — read only (admin writes)
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		// span-mapper-group — read only (admin manages)
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
 	},
 	SigNozViewerRoleName: {
 		// cloud-integration — viewer can read accounts
@@ -395,6 +417,12 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// metrics-field — viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — read only
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		// span-mapper-group — read only
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSpanMapperGroup}, WildCardSelectorString)},
 	},
 	SigNozAnonymousRoleName: {
 		// public-dashboard — anonymous read

pkg/types/coretypes/registry_resource.go

@@ -40,6 +40,9 @@ var Resources = []Resource{
 	ResourceMetaResourceLogsField,
 	ResourceMetaResourceTracesField,
 	ResourceMetaResourceMetricsField,
+	ResourceMetaResourceLLMPricingRule,
+	ResourceMetaResourceSpanMapperGroup,
+	ResourceMetaResourceSpanMapper,
 }
 
 var (
@@ -82,4 +85,7 @@ var (
 	ResourceMetaResourceLogsField                        = NewResourceMetaResource(KindLogsField)
 	ResourceMetaResourceTracesField                      = NewResourceMetaResource(KindTracesField)
 	ResourceMetaResourceMetricsField                     = NewResourceMetaResource(KindMetricsField, VerbList, VerbRead, VerbUpdate)
+	ResourceMetaResourceLLMPricingRule                   = NewResourceMetaResource(KindLLMPricingRule, VerbList, VerbRead, VerbUpdate, VerbDelete)
+	ResourceMetaResourceSpanMapperGroup                  = NewResourceMetaResource(KindSpanMapperGroup)
+	ResourceMetaResourceSpanMapper                       = NewResourceMetaResource(KindSpanMapper, VerbCreate, VerbUpdate, VerbDelete)
 )

pkg/types/llmpricingruletypes/resource.go

@@ -0,0 +1,58 @@
+package llmpricingruletypes
+
+import (
+	"context"
+	"encoding/json"
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+// UpdatableRulesResources resolves the pricing rules an upsert body writes to.
+//
+// A rule with isOverride and an id is an edit, checked by that id. Everything
+// else resolves to the wildcard: isOverride without an id is a create, sourceId
+// without isOverride is a sync row, and an empty list has nothing to check.
+func UpdatableRulesResources(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
+	// Decoded with the handler's request type so duplicate or case-variant keys
+	// resolve to the rows actually written; valuer lowercases uppercase ids.
+	var body UpdatableLLMPricingRules
+	if err := json.Unmarshal(ec.RequestBody, &body); err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInvalidInput, ErrCodePricingRuleInvalidInput, "invalid pricing rules body")
+	}
+
+	ids := make([]string, 0, len(body.Rules))
+	wildcard := len(body.Rules) == 0
+	for _, rule := range body.Rules {
+		if rule == nil || rule.ID == nil || rule.IsOverride == nil {
+			wildcard = true
+			continue
+		}
+
+		if !slices.Contains(ids, rule.ID.StringValue()) {
+			ids = append(ids, rule.ID.StringValue())
+		}
+	}
+	if wildcard {
+		ids = append(ids, coretypes.WildCardSelectorString)
+	}
+
+	resources := make([]coretypes.ResourceWithID, 0, len(ids))
+	for _, id := range ids {
+		resources = append(resources, coretypes.ResourceWithID{Resource: coretypes.ResourceMetaResourceLLMPricingRule, ID: id})
+	}
+
+	return resources, nil
+}
+
+// RuleSelector exists because IDSelector would turn the wildcard entry into
+// the wildcard twice; an id still resolves to the id plus the wildcard.
+func RuleSelector(ctx context.Context, resource coretypes.Resource, id string, orgID valuer.UUID) ([]coretypes.Selector, error) {
+	if id == coretypes.WildCardSelectorString {
+		return coretypes.WildcardSelector(ctx, resource, id, orgID)
+	}
+
+	return coretypes.IDSelector(ctx, resource, id, orgID)
+}

pkg/types/llmpricingruletypes/resource_test.go

@@ -0,0 +1,126 @@
+package llmpricingruletypes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+func TestUpdatableRulesResources(t *testing.T) {
+	testCases := []struct {
+		name    string
+		body    string
+		want    []string
+		wantErr bool
+	}{
+		{
+			name: "EmptyRules_Wildcard",
+			body: `{"rules":[]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "Edit_ID",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}]}`,
+			want: []string{"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e"},
+		},
+		{
+			name: "Create_Wildcard",
+			body: `{"rules":[{"modelPattern":["m*"],"modelName":"gpt","isOverride":true}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "SyncRow_Wildcard",
+			body: `{"rules":[{"modelPattern":["m*"],"sourceId":"4e9a0b12-3c4d-4e5f-8a6b-7c8d9e0f1a2b"}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "Mixed_DedupedIDsThenWildcardOnce",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true},{"modelPattern":["m*"],"modelName":"new","isOverride":true},{"modelPattern":["m*"],"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":false},{"modelPattern":["m*"],"sourceId":"7bcd3e45-6f7a-4b8c-9d9e-0f1a2b3c4d5e"}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d", "*"},
+		},
+		{
+			name: "UppercaseID_Lowercased",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"8CDE4F56-7A8B-4C9D-8E0F-1A2B3C4D5E6F","isOverride":true}]}`,
+			want: []string{"8cde4f56-7a8b-4c9d-8e0f-1a2b3c4d5e6f"},
+		},
+		{
+			name: "DuplicateIDKey_LastWins",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d"},
+		},
+		{
+			name: "CaseVariantIDKey_LastWins",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","ID":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d"},
+		},
+		{
+			name: "DuplicateRulesArray_CreateRow_Wildcard",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}],"rules":[{"modelPattern":["n*"],"modelName":"new","isOverride":true}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "DuplicateRulesArray_SyncRow_Wildcard",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}],"rules":[{"modelPattern":["n*"],"sourceId":"4e9a0b12-3c4d-4e5f-8a6b-7c8d9e0f1a2b"}]}`,
+			want: []string{"*"},
+		},
+		{
+			name:    "InvalidID_Rejected",
+			body:    `{"rules":[{"modelPattern":["m*"],"id":"not-a-uuid","isOverride":true}]}`,
+			wantErr: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			resources, err := UpdatableRulesResources(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+			if testCase.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			got := make([]string, 0, len(resources))
+			for _, resource := range resources {
+				got = append(got, resource.ID)
+			}
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}
+
+func TestRuleSelector(t *testing.T) {
+	testCases := []struct {
+		name string
+		id   string
+		want []string
+	}{
+		{
+			name: "Wildcard_WildcardOnly",
+			id:   "*",
+			want: []string{"*"},
+		},
+		{
+			name: "ID_IDThenWildcard",
+			id:   "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+			want: []string{"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "*"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			selectors, err := RuleSelector(context.Background(), coretypes.ResourceMetaResourceLLMPricingRule, testCase.id, valuer.GenerateUUID())
+			require.NoError(t, err)
+
+			got := make([]string, 0, len(selectors))
+			for _, selector := range selectors {
+				got = append(got, selector.String())
+			}
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}

pkg/types/quickfiltertypes/filter.go

@@ -40,6 +40,86 @@ var (
 	SourceAiObservability = Source{valuer.NewString("ai_observability")}
 )
 
+// unsupportedFilterNames are fields whose values are (near-)unique per span or
+// log, so a quick filter on them would list nothing useful to pick from.
+var unsupportedFilterNames = map[string]struct{}{
+	// IDs and per-record values
+	"trace_id":            {},
+	"traceID":             {},
+	"span_id":             {},
+	"spanID":              {},
+	"parent_span_id":      {},
+	"parentSpanID":        {},
+	"timestamp":           {},
+	"body":                {},
+	"gen_ai.tool.call.id": {},
+
+	// Free-text payloads
+	"gen_ai.input.messages":       {},
+	"gen_ai.output.messages":      {},
+	"gen_ai.system_instructions":  {},
+	"gen_ai.prompt":               {},
+	"gen_ai.completion":           {},
+	"gen_ai.tool.call.arguments":  {},
+	"gen_ai.tool.call.result":     {},
+	"ai.prompt.messages":          {},
+	"ai.toolCall.result":          {},
+	"llm.input_messages":          {},
+	"input.value":                 {},
+	"output.value":                {},
+	"langfuse.observation.input":  {},
+	"langfuse.observation.output": {},
+	"traceloop.entity.input":      {},
+	"traceloop.entity.output":     {},
+	"final_result":                {},
+	"exception.message":           {},
+	"exception.stacktrace":        {},
+	"db.statement":                {},
+	"db.query.text":               {},
+
+	// Token counts
+	"gen_ai.usage.input_tokens":                              {},
+	"gen_ai.usage.output_tokens":                             {},
+	"gen_ai.usage.total_tokens":                              {},
+	"gen_ai.usage.prompt_tokens":                             {},
+	"gen_ai.usage.completion_tokens":                         {},
+	"gen_ai.usage.cached_input_tokens":                       {},
+	"gen_ai.usage.input_tokens.cached":                       {},
+	"gen_ai.usage.cache_read.input_tokens":                   {},
+	"gen_ai.usage.cache_read_input_tokens":                   {},
+	"gen_ai.usage.cache_creation.input_tokens":               {},
+	"gen_ai.usage.cache_creation_input_tokens":               {},
+	"gen_ai.usage.cache_write.input_tokens":                  {},
+	"gen_ai.usage.reasoning.output_tokens":                   {},
+	"gen_ai.usage.reasoning_tokens":                          {},
+	"gen_ai.usage.prompt_token_details.cached_read_tokens":   {},
+	"gen_ai.usage.completion_token_details.reasoning_tokens": {},
+	"ai.usage.inputTokens":                                   {},
+	"ai.usage.outputTokens":                                  {},
+	"ai.usage.promptTokens":                                  {},
+	"ai.usage.completionTokens":                              {},
+	"llm.token_count.prompt":                                 {},
+	"llm.token_count.completion":                             {},
+	"llm.token_count.total":                                  {},
+	"llm.token_count.prompt_details.cache_read":              {},
+	"llm.token_count.prompt_details.cache_write":             {},
+	"llm.token_count.completion_details.reasoning":           {},
+	"llm.usage.prompt_tokens":                                {},
+	"llm.usage.completion_tokens":                            {},
+	"llm.usage.total_tokens":                                 {},
+	"input_tokens":                                           {},
+	"output_tokens":                                          {},
+	"cache_read_tokens":                                      {},
+	"cache_creation_tokens":                                  {},
+
+	// Per-span costs
+	"signoz.gen_ai.usage.input_tokens.cost":             {},
+	"signoz.gen_ai.usage.output_tokens.cost":            {},
+	"signoz.gen_ai.usage.cache_read.input_tokens.cost":  {},
+	"signoz.gen_ai.usage.cache_write.input_tokens.cost": {},
+	"signoz.gen_ai.usage.tokens.cost":                   {},
+}
+
 func (Source) Enum() []any {
 	return []any{
 		SourceTraces,
@@ -184,7 +264,6 @@ func NewDefaultQuickFilter(orgID valuer.UUID) ([]*StorableQuickFilter, error) {
 		{Name: "http.method", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
 		{Name: "http.route", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeString},
 		{Name: "http_url", FieldContext: telemetrytypes.FieldContextSpan, FieldDataType: telemetrytypes.FieldDataTypeString},
-		{Name: "trace_id", FieldContext: telemetrytypes.FieldContextSpan, FieldDataType: telemetrytypes.FieldDataTypeString},
 	}
 
 	logsFilters := []telemetrytypes.TelemetryFieldKey{
@@ -263,6 +342,9 @@ func validateFilters(filters []telemetrytypes.TelemetryFieldKey) error {
 		if filter.Name == "" {
 			return errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "filter name is required")
 		}
+		if _, unsupported := unsupportedFilterNames[filter.Name]; unsupported {
+			return errors.Newf(errors.TypeInvalidInput, errors.CodeInvalidInput, "%s is not supported as a quick filter as it has too many unique values, use the search bar to filter by it instead", filter.Name)
+		}
 	}
 	return nil
 }

pkg/types/quickfiltertypes/filter_test.go

@@ -0,0 +1,58 @@
+package quickfiltertypes
+
+import (
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestNewStorableQuickFilter(t *testing.T) {
+	serviceName := telemetrytypes.TelemetryFieldKey{Name: "service.name", FieldContext: telemetrytypes.FieldContextResource, FieldDataType: telemetrytypes.FieldDataTypeString}
+
+	testCases := []struct {
+		name        string
+		filter      telemetrytypes.TelemetryFieldKey
+		rejectedKey string
+	}{
+		{name: "SupportedNumberField_Accepted", filter: telemetrytypes.TelemetryFieldKey{Name: "duration_nano", FieldContext: telemetrytypes.FieldContextSpan, FieldDataType: telemetrytypes.FieldDataTypeNumber}},
+		{name: "TraceID_Rejected", filter: telemetrytypes.TelemetryFieldKey{Name: "trace_id", FieldContext: telemetrytypes.FieldContextSpan, FieldDataType: telemetrytypes.FieldDataTypeString}, rejectedKey: "trace_id"},
+		{name: "LogSpanID_Rejected", filter: telemetrytypes.TelemetryFieldKey{Name: "span_id", FieldContext: telemetrytypes.FieldContextLog, FieldDataType: telemetrytypes.FieldDataTypeString}, rejectedKey: "span_id"},
+		{name: "LegacyParentSpanID_Rejected", filter: telemetrytypes.TelemetryFieldKey{Name: "parentSpanID", FieldContext: telemetrytypes.FieldContextSpan, FieldDataType: telemetrytypes.FieldDataTypeString}, rejectedKey: "parentSpanID"},
+		{name: "LogBody_Rejected", filter: telemetrytypes.TelemetryFieldKey{Name: "body", FieldContext: telemetrytypes.FieldContextLog, FieldDataType: telemetrytypes.FieldDataTypeString}, rejectedKey: "body"},
+		{name: "GenAIInputTokens_Rejected", filter: telemetrytypes.TelemetryFieldKey{Name: "gen_ai.usage.input_tokens", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeNumber}, rejectedKey: "gen_ai.usage.input_tokens"},
+		{name: "OpenInferenceTokenCount_Rejected", filter: telemetrytypes.TelemetryFieldKey{Name: "llm.token_count.prompt", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeNumber}, rejectedKey: "llm.token_count.prompt"},
+		{name: "GenAITotalCost_Rejected", filter: telemetrytypes.TelemetryFieldKey{Name: "signoz.gen_ai.usage.tokens.cost", FieldContext: telemetrytypes.FieldContextAttribute, FieldDataType: telemetrytypes.FieldDataTypeNumber}, rejectedKey: "signoz.gen_ai.usage.tokens.cost"},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			_, err := NewStorableQuickFilter(valuer.GenerateUUID(), SourceTraces, []telemetrytypes.TelemetryFieldKey{serviceName, testCase.filter})
+			if testCase.rejectedKey == "" {
+				assert.NoError(t, err)
+				return
+			}
+
+			require.Error(t, err)
+			assert.True(t, errors.Ast(err, errors.TypeInvalidInput))
+			assert.Contains(t, err.Error(), testCase.rejectedKey)
+		})
+	}
+}
+
+func TestNewDefaultQuickFilterHasNoUnsupportedFields(t *testing.T) {
+	defaults, err := NewDefaultQuickFilter(valuer.GenerateUUID())
+	require.NoError(t, err)
+
+	for _, storable := range defaults {
+		sourceFilters, err := NewSourceFilterFromStorableQuickFilter(storable)
+		require.NoError(t, err)
+		for _, filter := range sourceFilters.Filters {
+			_, unsupported := unsupportedFilterNames[filter.Name]
+			assert.False(t, unsupported, "default %s quick filters contain %s", storable.Source.StringValue(), filter.Name)
+		}
+	}
+}

tests/conftest.py

@@ -114,8 +114,8 @@ def pytest_addoption(parser: pytest.Parser):
         help="clickhouse version",
     )
     parser.addoption(
-        "--signoz-otel-collector-version",
+        "--schema-migrator-version",
         action="store",
-        default="v0.144.16-rc.1",
-        help="signoz-otel-collector version, used to run clickhouse migrations",
+        default="v0.144.9",  # todo(nikhil): change to 0.144.10
+        help="schema migrator version",
     )

tests/fixtures/metrics.py

@@ -990,7 +990,7 @@ def insert_reduced_metrics_to_clickhouse(
 ) -> None:
     """Insert reduced series into distributed_time_series_v4_reduced and 60s
     buckets into the reduced samples tables. These tables exist only when
-    the signoz-otel-collector version includes the metrics cardinality-control
+    the schema migrator version includes the metrics cardinality-control
     migration."""
     if time_series:
         conn.insert(

tests/fixtures/migrator.py

@@ -19,28 +19,37 @@ def create_migrator(  # pylint: disable=too-many-arguments,too-many-positional-a
     """
     Factory function for running schema migrations. Accepts optional
     env_overrides to customize the migrator environment; the release comes
-    from the --signoz-otel-collector-version option.
+    from the --schema-migrator-version option.
     """
 
     def create() -> None:
-        collector_version = request.config.getoption("--signoz-otel-collector-version")
+        migrator_version = request.config.getoption("--schema-migrator-version")
         client = docker.from_env()
 
-        environment = {
-            "SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_DSN": clickhouse.env["SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN"],
-            "SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_CLUSTER": "cluster",
-            "SIGNOZ_OTEL_COLLECTOR_CLICKHOUSE_REPLICATION": "true",
-            "SIGNOZ_OTEL_COLLECTOR_TIMEOUT": "10m",
-            **(env_overrides or {}),
-        }
+        environment = dict(env_overrides) if env_overrides else {}
 
         container = client.containers.run(
-            image=f"signoz/signoz-otel-collector:{collector_version}",
-            entrypoint="/bin/sh",
-            command=[
-                "-c",
-                "/signoz-otel-collector migrate bootstrap && /signoz-otel-collector migrate sync up && /signoz-otel-collector migrate async up",
-            ],
+            image=f"signoz/signoz-schema-migrator:{migrator_version}",
+            command=f"sync --replication=true --cluster-name=cluster --up= --dsn={clickhouse.env['SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN']}",
+            detach=True,
+            auto_remove=False,
+            network=network.id,
+            environment=environment,
+        )
+
+        result = container.wait()
+
+        if result["StatusCode"] != 0:
+            logs = container.logs().decode(encoding="utf-8")
+            container.remove()
+            print(logs)
+            raise RuntimeError("failed to run migrations on clickhouse")
+
+        container.remove()
+
+        container = client.containers.run(
+            image=f"signoz/signoz-schema-migrator:{migrator_version}",
+            command=f"async --replication=true --cluster-name=cluster --up= --dsn={clickhouse.env['SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN']}",
             detach=True,
             auto_remove=False,
             network=network.id,

tests/integration/testdata/role/managed_role_transactions.json

@@ -305,6 +305,38 @@
         "list"
       ]
     },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "update",
+        "delete",
+        "list"
+      ]
+    },
+    {
+      "type": "metaresource",
+      "kind": "span-mapper-group",
+      "verbs": [
+        "read",
+        "update",
+        "delete",
+        "create",
+        "list",
+        "attach",
+        "detach"
+      ]
+    },
+    {
+      "type": "metaresource",
+      "kind": "span-mapper",
+      "verbs": [
+        "update",
+        "delete",
+        "create"
+      ]
+    },
     {
       "type": "metaresource",
       "kind": "ttl-setting",
@@ -542,6 +574,22 @@
         "list"
       ]
     },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
+    {
+      "type": "metaresource",
+      "kind": "span-mapper-group",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
     {
       "type": "metaresource",
       "kind": "ttl-setting",
@@ -721,6 +769,22 @@
         "list"
       ]
     },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
+    {
+      "type": "metaresource",
+      "kind": "span-mapper-group",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
     {
       "type": "metaresource",
       "kind": "ttl-setting",

tests/integration/tests/llmpricingrules/02_authz.py

@@ -0,0 +1,350 @@
+import json
+from collections.abc import Callable
+from http import HTTPStatus
+
+import pytest
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+)
+from fixtures.llmpricingrules import (
+    LLM_PRICING_RULES_URL,
+    delete_all_llm_pricing_rules,
+    list_llm_pricing_rules,
+    upsert_llm_pricing_rules,
+)
+from fixtures.role import find_role_by_name, transaction_group
+
+user_password = "password123Z$"
+editor_email = "llm-pricing-editor@integration.test"
+viewer_email = "llm-pricing-viewer@integration.test"
+updater_role = "llm-pricing-updater"
+updater_email = "llm-pricing-updater@integration.test"
+scoped_role = "llm-pricing-scoped"
+scoped_email = "llm-pricing-scoped@integration.test"
+lister_role = "llm-pricing-lister"
+lister_email = "llm-pricing-lister@integration.test"
+trace_reader_role = "llm-pricing-trace-reader"
+trace_reader_email = "llm-pricing-trace-reader@integration.test"
+
+PROBE_RULE = {
+    "modelName": "authz-probe",
+    "provider": "OpenAI",
+    "modelPattern": ["authz-probe*"],
+    "unit": "per_million_tokens",
+    "pricing": {"input": 1, "output": 2},
+    "isOverride": True,
+    "enabled": True,
+}
+
+OTHER_RULE = {
+    "modelName": "authz-probe-other",
+    "provider": "Anthropic",
+    "modelPattern": ["authz-probe-other*"],
+    "unit": "per_million_tokens",
+    "pricing": {"input": 3, "output": 4},
+    "isOverride": True,
+    "enabled": True,
+}
+
+
+def test_setup(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    delete_all_llm_pricing_rules(signoz, admin_token)
+    assert upsert_llm_pricing_rules(signoz, admin_token, [PROBE_RULE, OTHER_RULE]).status_code == HTTPStatus.NO_CONTENT
+    probe_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+
+    headers = {"Authorization": f"Bearer {admin_token}"}
+
+    # A --reuse stack keeps users and roles from earlier runs, and probe_id changes every run.
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v1/roles"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_roles = {role["name"]: role["id"] for role in response.json()["data"]}
+    grants = {
+        updater_role: [transaction_group("update", "metaresource", "llm-pricing-rule", ["*"])],
+        scoped_role: [
+            transaction_group("read", "metaresource", "llm-pricing-rule", [probe_id]),
+            transaction_group("update", "metaresource", "llm-pricing-rule", [probe_id]),
+            transaction_group("delete", "metaresource", "llm-pricing-rule", [probe_id]),
+        ],
+        lister_role: [transaction_group("list", "metaresource", "llm-pricing-rule", ["*"])],
+        trace_reader_role: [
+            transaction_group("list", "metaresource", "llm-pricing-rule", ["*"]),
+            transaction_group("read", "telemetryresource", "traces", ["builder_query/*"]),
+        ],
+    }
+    for name, transaction_groups in grants.items():
+        if name not in existing_roles:
+            create_role(admin_token, name, transaction_groups)
+            continue
+        response = requests.put(
+            signoz.self.host_configs["8080"].get(f"/api/v1/roles/{existing_roles[name]}"),
+            json={"description": "", "transactionGroups": transaction_groups},
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v2/users"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_emails = {user["email"] for user in response.json()["data"]}
+    for email, role in (
+        (editor_email, "signoz-editor"),
+        (viewer_email, "signoz-viewer"),
+        (updater_email, updater_role),
+        (scoped_email, scoped_role),
+        (lister_email, lister_role),
+        (trace_reader_email, trace_reader_role),
+    ):
+        if email in existing_emails:
+            continue
+        user_id = create_active_user(signoz, admin_token, email=email, role="signoz-viewer", password=user_password)
+        if role != "signoz-viewer":
+            change_user_role(signoz, admin_token, user_id, "signoz-viewer", role)
+
+
+@pytest.mark.parametrize(
+    "path",
+    [LLM_PRICING_RULES_URL, f"{LLM_PRICING_RULES_URL}/unmapped_models"],
+    ids=["list", "unmapped_models"],
+)
+@pytest.mark.parametrize(
+    ("email", "expected"),
+    [
+        (USER_ADMIN_EMAIL, HTTPStatus.OK),
+        (editor_email, HTTPStatus.OK),
+        (viewer_email, HTTPStatus.OK),
+        (updater_email, HTTPStatus.FORBIDDEN),
+        (scoped_email, HTTPStatus.FORBIDDEN),
+    ],
+    ids=["admin", "editor", "viewer", "updater", "scoped"],
+)
+def test_reads_need_list_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    path: str,
+    email: str,
+    expected: HTTPStatus,
+) -> None:
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(path),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:list" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "path", "expected"),
+    [
+        (lister_email, LLM_PRICING_RULES_URL, HTTPStatus.OK),
+        (lister_email, f"{LLM_PRICING_RULES_URL}/unmapped_models", HTTPStatus.FORBIDDEN),
+        (trace_reader_email, f"{LLM_PRICING_RULES_URL}/unmapped_models", HTTPStatus.OK),
+    ],
+    ids=["lister_list", "lister_unmapped_models", "trace_reader_unmapped_models"],
+)
+def test_unmapped_models_needs_traces_read(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    path: str,
+    expected: HTTPStatus,
+) -> None:
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(path),
+        headers={"Authorization": f"Bearer {get_token(email, user_password)}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "traces:read" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "model_name", "expected"),
+    [
+        (USER_ADMIN_EMAIL, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (editor_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
+    ],
+    ids=["admin", "editor", "viewer", "updater", "scoped_granted", "scoped_other"],
+)
+def test_get_needs_read_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    model_name: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:read" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "expected"),
+    [
+        (editor_email, HTTPStatus.FORBIDDEN),
+        (viewer_email, HTTPStatus.FORBIDDEN),
+        (scoped_email, HTTPStatus.NO_CONTENT),
+        (updater_email, HTTPStatus.NO_CONTENT),
+        (USER_ADMIN_EMAIL, HTTPStatus.NO_CONTENT),
+    ],
+    ids=["editor", "viewer", "scoped", "updater", "admin"],
+)
+def test_upsert_needs_update_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = upsert_llm_pricing_rules(signoz, token, [{**PROBE_RULE, "id": rule_id}])
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize(
+    "shape",
+    ["other_rule", "create", "sync_row", "own_and_other"],
+    ids=["other_rule", "create", "sync_row", "own_and_other"],
+)
+def test_upsert_scoped_to_granted_rule(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    shape: str,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rules = {r["modelName"]: r for r in list_llm_pricing_rules(signoz, admin_token)}
+    own = {**PROBE_RULE, "id": rules[PROBE_RULE["modelName"]]["id"]}
+    other = {**OTHER_RULE, "id": rules[OTHER_RULE["modelName"]]["id"]}
+    sync_row = {**{k: v for k, v in PROBE_RULE.items() if k != "isOverride"}, "sourceId": "11111111-1111-4111-8111-111111111199"}
+    bodies = {"other_rule": [other], "create": [PROBE_RULE], "sync_row": [sync_row], "own_and_other": [own, other]}
+
+    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), bodies[shape])
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize("second_row", ["create", "sync_row"], ids=["create", "sync_row"])
+def test_upsert_duplicate_rules_array_needs_wildcard(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    second_row: str,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    own = {**PROBE_RULE, "id": next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])}
+    rows = {
+        "create": {**PROBE_RULE, "modelName": "authz-probe-dup"},
+        "sync_row": {**{k: v for k, v in PROBE_RULE.items() if k != "isOverride"}, "sourceId": "11111111-1111-4111-8111-111111111198"},
+    }
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(LLM_PRICING_RULES_URL),
+        data=f'{{"rules":[{json.dumps(own)}],"rules":[{json.dumps(rows[second_row])}]}}',
+        headers={"Authorization": f"Bearer {get_token(scoped_email, user_password)}", "Content-Type": "application/json"},
+        timeout=10,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+def test_revoke_update_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, scoped_role)}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "llm-pricing-rule", [rule_id]),
+                transaction_group("delete", "metaresource", "llm-pricing-rule", [rule_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=10,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), [{**PROBE_RULE, "id": rule_id}])
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "model_name", "expected"),
+    [
+        (editor_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.NO_CONTENT),
+        (USER_ADMIN_EMAIL, OTHER_RULE["modelName"], HTTPStatus.NO_CONTENT),
+    ],
+    ids=["editor", "viewer", "updater", "scoped_other", "scoped_granted", "admin"],
+)
+def test_delete_needs_delete_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    model_name: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:delete" in response.text
+
+
+def test_cleanup(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    delete_all_llm_pricing_rules(signoz, get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD))

tests/integration/tests/quickfilter/01_quick_filter.py

@@ -266,6 +266,18 @@ def test_update_quick_filters_rejects_invalid_input(
             {"filters": [{"key": "service.name", "dataType": "string", "type": "resource"}]},
         ),
         ("invalid", {"filters": []}),
+        (
+            "traces",
+            {"filters": [{"name": "trace_id", "fieldContext": "span", "fieldDataType": "string"}]},
+        ),
+        (
+            "logs",
+            {"filters": [{"name": "span_id", "fieldContext": "log", "fieldDataType": "string"}]},
+        ),
+        (
+            "ai_observability",
+            {"filters": [{"name": "gen_ai.usage.input_tokens", "fieldContext": "attribute", "fieldDataType": "number"}]},
+        ),
     ]:
         response = requests.put(
             signoz.self.host_configs["8080"].get(f"/api/v2/quick_filters/{source}"),
@@ -292,6 +304,7 @@ def test_default_traces_filters_are_served_as_the_fields_api_serves_them(
     filters = {field_key["name"]: field_key for field_key in response.json()["data"]["filters"]}
 
     assert "hasError" not in filters
+    assert "trace_id" not in filters
     assert (filters["has_error"]["fieldContext"], filters["has_error"]["fieldDataType"]) == ("span", "bool")
     assert (filters["name"]["fieldContext"], filters["name"]["fieldDataType"]) == ("span", "string")
     assert (filters["duration_nano"]["fieldContext"], filters["duration_nano"]["fieldDataType"]) == ("span", "number")

tests/integration/tests/spanmapper/03_authz.py

@@ -0,0 +1,353 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import pytest
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+    find_user_by_email,
+)
+from fixtures.role import find_role_by_name, transaction_group
+from fixtures.types import Operation, SigNoz, TestContainerDocker
+
+GROUPS_PATH = "/api/v1/span_mapper_groups"
+
+_EDITOR_EMAIL = "editor+spanmapperauthz@integration.test"
+_VIEWER_EMAIL = "viewer+spanmapperauthz@integration.test"
+_ACTOR_ROLE_NAME = "span-mapper-fga-actor"
+_ACTOR_EMAIL = "customrole+spanmapperauthz@integration.test"
+_PASSWORD = "password123Z$"
+
+# Instance verbs are granted on _TARGET_A and its mapper only; _TARGET_B must stay forbidden.
+_TARGET_A = "span-mapper-authz-target-a"
+_TARGET_B = "span-mapper-authz-target-b"
+
+_MAPPER = {
+    "name": "span_mapper_authz.target",
+    "fieldContext": "attribute",
+    "config": {"sources": [{"key": "authz.source", "context": "attribute", "operation": "copy", "priority": 1, "enabled": True}]},
+    "enabled": True,
+}
+
+_SIMULATE = {
+    "spans": [{"attributes": {"authz.source": "x"}, "resource": {}}],
+    "groups": [{"name": _TARGET_A, "condition": {"attributes": [{"value": "authz.a", "enabled": True}], "resource": []}, "enabled": True}],
+}
+
+
+def test_setup_users_and_targets(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {admin_token}"}
+
+    # A --reuse stack may already hold part of this state; create only what is missing.
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v2/users"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_emails = {user["email"] for user in response.json()["data"]}
+    for email, role in ((_EDITOR_EMAIL, "signoz-editor"), (_VIEWER_EMAIL, "signoz-viewer")):
+        if email not in existing_emails:
+            create_active_user(signoz, admin_token, email=email, role=role, password=_PASSWORD)
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_groups = {group["name"] for group in response.json()["data"]["items"]}
+    for name, substring in ((_TARGET_A, "authz.a"), (_TARGET_B, "authz.b")):
+        if name in existing_groups:
+            continue
+        response = requests.post(
+            signoz.self.host_configs["8080"].get(GROUPS_PATH),
+            json={"name": name, "condition": {"attributes": [{"value": substring, "enabled": True}], "resource": []}, "enabled": True},
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {group["name"]: group["id"] for group in response.json()["data"]["items"]}
+    for name in (_TARGET_A, _TARGET_B):
+        response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[name]}/span_mappers"), headers=headers, timeout=5)
+        assert response.status_code == HTTPStatus.OK, response.text
+        if any(mapper["name"] == _MAPPER["name"] for mapper in response.json()["data"]["items"]):
+            continue
+        response = requests.post(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[name]}/span_mappers"), json=_MAPPER, headers=headers, timeout=5)
+        assert response.status_code == HTTPStatus.CREATED, response.text
+
+
+def test_mapper_is_only_reachable_through_its_own_group(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    # The authz check on the mapper routes trusts the group id in the path, so the
+    # store must refuse a mapper addressed through another group.
+    headers = {"Authorization": f"Bearer {get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {group["name"]: group["id"] for group in response.json()["data"]["items"]}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    mapper_b = response.json()["data"]["items"][0]["id"]
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{mapper_b}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_FOUND, f"update B's mapper via A: expected 404, got {response.status_code}: {response.text}"
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{mapper_b}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_FOUND, f"delete B's mapper via A: expected 404, got {response.status_code}: {response.text}"
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    assert {mapper["id"] for mapper in response.json()["data"]["items"]} == {mapper_b}
+
+
+@pytest.mark.parametrize("email", [_VIEWER_EMAIL, _EDITOR_EMAIL], ids=["viewer", "editor"])
+def test_managed_readers_allowed_on_reads_and_simulate(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    email: str,
+):
+    headers = {"Authorization": f"Bearer {get_token(email, _PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_a = {group["name"]: group["id"] for group in response.json()["data"]["items"]}[_TARGET_A]
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{target_a}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    assert {mapper["name"] for mapper in response.json()["data"]["items"]} == {_MAPPER["name"]}
+
+    response = requests.post(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/test"), json=_SIMULATE, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+
+
+@pytest.mark.parametrize("email", [_VIEWER_EMAIL, _EDITOR_EMAIL], ids=["viewer", "editor"])
+def test_managed_readers_forbidden_on_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    email: str,
+):
+    headers = {"Authorization": f"Bearer {get_token(email, _PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_a = {group["name"]: group["id"] for group in response.json()["data"]["items"]}[_TARGET_A]
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{target_a}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    mapper_id = response.json()["data"]["items"][0]["id"]
+
+    for method, path, body in (
+        ("POST", GROUPS_PATH, {"name": "span-mapper-authz-denied", "condition": {"attributes": [{"value": "authz.denied", "enabled": True}], "resource": []}, "enabled": True}),
+        ("PATCH", f"{GROUPS_PATH}/{target_a}", {"enabled": True}),
+        ("DELETE", f"{GROUPS_PATH}/{target_a}", None),
+        ("POST", f"{GROUPS_PATH}/{target_a}/span_mappers", {**_MAPPER, "name": "span_mapper_authz.denied"}),
+        ("PATCH", f"{GROUPS_PATH}/{target_a}/span_mappers/{mapper_id}", {"enabled": True}),
+        ("DELETE", f"{GROUPS_PATH}/{target_a}/span_mappers/{mapper_id}", None),
+    ):
+        response = requests.request(method, signoz.self.host_configs["8080"].get(path), json=body, headers=headers, timeout=5)
+        assert response.status_code == HTTPStatus.FORBIDDEN, f"{method} {path}: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_apply_license(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+
+def test_setup_scoped_actor(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {admin_token}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_a = {group["name"]: group["id"] for group in response.json()["data"]["items"]}[_TARGET_A]
+
+    # Adding a mapper needs create on the collection plus attach on the group;
+    # removing one needs delete on the mapper plus detach on the group; editing
+    # one needs update on both.
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v1/roles"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    if not any(role["name"] == _ACTOR_ROLE_NAME for role in response.json()["data"]):
+        create_role(
+            admin_token,
+            _ACTOR_ROLE_NAME,
+            [
+                transaction_group("list", "metaresource", "span-mapper-group", ["*"]),
+                transaction_group("read", "metaresource", "span-mapper-group", [target_a]),
+                transaction_group("update", "metaresource", "span-mapper-group", [target_a]),
+                transaction_group("attach", "metaresource", "span-mapper-group", [target_a]),
+                transaction_group("detach", "metaresource", "span-mapper-group", [target_a]),
+                transaction_group("create", "metaresource", "span-mapper", ["*"]),
+                transaction_group("delete", "metaresource", "span-mapper", ["*"]),
+                transaction_group("update", "metaresource", "span-mapper", ["*"]),
+            ],
+        )
+
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v2/users"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    actor = next((user for user in response.json()["data"] if user["email"] == _ACTOR_EMAIL), None)
+    user_id = actor["id"] if actor else create_active_user(signoz, admin_token, email=_ACTOR_EMAIL, role="signoz-viewer", password=_PASSWORD)
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"/api/v2/users/{user_id}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    if not any(ur["role"]["name"] == _ACTOR_ROLE_NAME for ur in response.json()["data"]["userRoles"]):
+        change_user_role(signoz, admin_token, user_id, "signoz-viewer", _ACTOR_ROLE_NAME)
+
+
+def test_access_scoped_to_granted_group_and_mapper(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    headers = {"Authorization": f"Bearer {get_token(_ACTOR_EMAIL, _PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {group["name"]: group["id"] for group in response.json()["data"]["items"]}
+    assert {_TARGET_A, _TARGET_B} <= set(ids)
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, f"list granted group's mappers: {response.text}"
+    mapper_a = response.json()["data"]["items"][0]["id"]
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"list other group's mappers: expected 403, got {response.status_code}: {response.text}"
+
+    # Simulate reads saved groups by name, so it needs read on every group.
+    response = requests.post(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/test"), json=_SIMULATE, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"simulate: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"update granted group: {response.text}"
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"update other group: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers"),
+        json={**_MAPPER, "name": "span_mapper_authz.actor"},
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, f"create mapper in granted group: {response.text}"
+    created = response.json()["data"]["id"]
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{created}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"delete mapper in granted group: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"),
+        json={**_MAPPER, "name": "span_mapper_authz.actor"},
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"create mapper in other group: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{mapper_a}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"update granted mapper: {response.text}"
+
+    admin_headers = {"Authorization": f"Bearer {get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)}"}
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers"), headers=admin_headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    mapper_b = response.json()["data"]["items"][0]["id"]
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers/{mapper_b}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"update other mapper: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.patch(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{mapper_b}"), json={"enabled": True}, headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_FOUND, f"update B's mapper via A: expected 404, got {response.status_code}: {response.text}"
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_B]}/span_mappers/{mapper_b}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"delete other mapper: expected 403, got {response.status_code}: {response.text}"
+
+    # detach on A plus delete on "*" passes authz for B's mapper addressed through
+    # A's path; the store must still refuse it.
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}/span_mappers/{mapper_b}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.NOT_FOUND, f"delete B's mapper via A: expected 404, got {response.status_code}: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(GROUPS_PATH),
+        json={"name": "span-mapper-authz-actor", "condition": {"attributes": [{"value": "authz.actor", "enabled": True}], "resource": []}, "enabled": True},
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"create group: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[_TARGET_A]}"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"delete granted group: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_revoke_group_read(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    admin_headers = {"Authorization": f"Bearer {admin_token}"}
+    headers = {"Authorization": f"Bearer {get_token(_ACTOR_EMAIL, _PASSWORD)}"}
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=admin_headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_a = {group["name"]: group["id"] for group in response.json()["data"]["items"]}[_TARGET_A]
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{target_a}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, f"read before revoke: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, _ACTOR_ROLE_NAME)}"),
+        json={"description": "", "transactionGroups": [transaction_group("list", "metaresource", "span-mapper-group", ["*"])]},
+        headers=admin_headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{target_a}/span_mappers"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"read after revoke: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_span_mapper_authz_cleanup(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    headers = {"Authorization": f"Bearer {admin_token}"}
+    actor = find_user_by_email(signoz, admin_token, _ACTOR_EMAIL)
+
+    # Back to viewer so a rerun on the same stack can set the actor up again.
+    change_user_role(signoz, admin_token, actor["id"], _ACTOR_ROLE_NAME, "signoz-viewer")
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, _ACTOR_ROLE_NAME)}"),
+        headers=headers,
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {_ACTOR_ROLE_NAME}: {response.text}"
+
+    response = requests.get(signoz.self.host_configs["8080"].get(GROUPS_PATH), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {group["name"]: group["id"] for group in response.json()["data"]["items"]}
+    for name in (_TARGET_A, _TARGET_B):
+        response = requests.delete(signoz.self.host_configs["8080"].get(f"{GROUPS_PATH}/{ids[name]}"), headers=headers, timeout=5)
+        assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {name}: {response.text}"