Merge branch 'main' into issue_nerve_463

Assisted-by: Claude Opus 5.5

docs/api/openapi.yml

@@ -3970,6 +3970,7 @@ components:
       - logs-field
       - traces-field
       - metrics-field
+      - llm-pricing-rule
       type: string
     CoretypesObject:
       properties:
@@ -16148,9 +16149,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - llm-pricing-rule:list
       - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:list
       summary: List pricing rules
       tags:
       - llmpricingrules
@@ -16195,9 +16196,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - llm-pricing-rule:update
       - tokenizer:
-        - ADMIN
+        - llm-pricing-rule:update
       summary: Create or update pricing rules
       tags:
       - llmpricingrules
@@ -16243,9 +16244,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - llm-pricing-rule:delete
       - tokenizer:
-        - ADMIN
+        - llm-pricing-rule:delete
       summary: Delete a pricing rule
       tags:
       - llmpricingrules
@@ -16301,9 +16302,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - llm-pricing-rule:read
       - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:read
       summary: Get a pricing rule
       tags:
       - llmpricingrules
@@ -16356,9 +16357,11 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - llm-pricing-rule:list
+        - traces:read
       - tokenizer:
-        - VIEWER
+        - llm-pricing-rule:list
+        - traces:read
       summary: List unmapped models
       tags:
       - llmpricingrules
@@ -32729,301 +32732,6 @@ paths:
                   requestType: time_series
                   schemaVersion: v1
                   start: 1640995200000
-              function_anomaly_request_rate:
-                description: 'anomaly is the one function with named arguments. seasonality
-                  says which past periods predict the current value: hourly, daily
-                  or weekly, daily when absent. z_score_threshold is how many standard
-                  deviations from the prediction count as an anomaly, 3 when absent.
-                  The response carries, next to the values, a predicted series, an
-                  upper and a lower bound series and an anomaly score series. The
-                  scoring runs in the enterprise build; the community build returns
-                  the series unchanged.'
-                summary: 'anomaly: request rate scored against its daily pattern'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: http.server.duration.count
-                          spaceAggregation: sum
-                          timeAggregation: rate
-                        functions:
-                        - args:
-                          - name: seasonality
-                            value: daily
-                          - name: z_score_threshold
-                            value: 3
-                          name: anomaly
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 300s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_cumulativesum_errors_so_far:
-                description: cumulativeSum replaces each point with the sum of every
-                  point up to it, so a per-step count becomes a running total that
-                  starts at zero at the window start. It takes no arguments. The total
-                  resets with the window, so a longer time range gives a larger final
-                  value; it is a view of the window, not a counter.
-                summary: 'cumulativeSum: 5xx responses since the start of the window'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - alias: server_errors
-                          expression: count()
-                        filter:
-                          expression: http.response.status_code >= 500
-                        functions:
-                        - name: cumulativeSum
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: traces
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_cutoffmin_hide_idle_hosts:
-                description: The four threshold functions take one number. cutOffMin
-                  and cutOffMax remove the points below or above the threshold, so
-                  an idle host disappears from the chart instead of drawing a line
-                  along the bottom. clampMin and clampMax keep the points and replace
-                  the value with the threshold, which caps spikes without hiding them.
-                  system.cpu.utilization is a ratio, so 0.05 is 5%.
-                summary: 'cutOffMin: drop hosts below 5% CPU from the chart'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: system.cpu.utilization
-                          spaceAggregation: avg
-                          timeAggregation: avg
-                        functions:
-                        - args:
-                          - value: 0.05
-                          name: cutOffMin
-                        groupBy:
-                        - fieldContext: resource
-                          name: host.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_ewma_smoothed_latency:
-                description: 'ewma3, ewma5 and ewma7 replace each point with an exponentially
-                  weighted average of the point and the points before it. The number
-                  in the name is the window the default weight is derived from: alpha
-                  = 2 / (n + 1), so 0.5, 0.333 and 0.25. One optional argument overrides
-                  alpha; a value close to 1 follows the raw series, a value close
-                  to 0 smooths harder. 0.3 here smooths a little more than ewma5''s
-                  default.'
-                summary: 'ewma5: smoothed p95 latency'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: http.server.duration.bucket
-                          spaceAggregation: p95
-                        functions:
-                        - args:
-                          - value: 0.3
-                          name: ewma5
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_fillzero_sparse_errors:
-                description: A count over sparse events returns a point only for steps
-                  that had a match, so a chart of failed spans has gaps where nothing
-                  failed. fillZero adds a zero at every missing step. With no arguments
-                  the server fills the request window at the query's step, which is
-                  the common case. The three optional arguments are start, end and
-                  step in milliseconds, for callers that want to fill a different
-                  grid.
-                summary: 'fillZero: a zero at every step with no failed spans'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - alias: failed_spans
-                          expression: count()
-                        filter:
-                          expression: has_error = true
-                        functions:
-                        - name: fillZero
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: traces
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_log10_network_bytes:
-                description: log2 and log10 replace each value with its logarithm,
-                  so a loopback device moving kilobytes and an uplink moving gigabytes
-                  fit on one chart. They take no arguments. Zero and negative values
-                  have no logarithm and are not drawn. absolute, also without arguments,
-                  is the usual companion for a signed series before a logarithm.
-                summary: 'log10: network throughput across devices that differ by
-                  orders of magnitude'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: system.network.io
-                          spaceAggregation: sum
-                          timeAggregation: rate
-                        filter:
-                          expression: direction = 'transmit'
-                        functions:
-                        - name: log10
-                        groupBy:
-                        - fieldContext: attribute
-                          name: device
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_median_despiked_request_rate:
-                description: median3, median5 and median7 replace each point with
-                  the median of the surrounding 3, 5 or 7 points. A spike that lasts
-                  one step vanishes, a shift that lasts longer than half the window
-                  stays. They take no arguments. Use them when the raw series is noisy
-                  and the chart is for a trend, not for catching the spike.
-                summary: 'median5: request rate without one-step spikes'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: http.server.duration.count
-                          spaceAggregation: sum
-                          timeAggregation: rate
-                        functions:
-                        - name: median5
-                        groupBy:
-                        - fieldContext: resource
-                          name: service.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_runningdiff_disk_growth:
-                description: 'runningDiff turns a gauge into the change between consecutive
-                  points, so a filesystem usage gauge becomes bytes written per step.
-                  It takes no arguments and drops the first point of the window, since
-                  that point has nothing to difference against; the server reads one
-                  step before the window to keep the first interval. Functions apply
-                  in order: clampMin with 0 runs on the differences and replaces the
-                  negative value a cleanup or a volume reset produces with zero.'
-                summary: 'runningDiff then clampMin: bytes written to disk per step'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - metricName: system.filesystem.usage
-                          spaceAggregation: sum
-                          timeAggregation: latest
-                        filter:
-                          expression: state = 'used'
-                        functions:
-                        - name: runningDiff
-                        - args:
-                          - value: 0
-                          name: clampMin
-                        groupBy:
-                        - fieldContext: resource
-                          name: host.name
-                        name: A
-                        signal: metrics
-                        stepInterval: 60s
-                      type: builder_query
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
-              function_timeshift_week_over_week:
-                description: timeShift moves every point of its query forward by the
-                  argument, in seconds, so a series read from the past lands on the
-                  current timestamps. B here reads the hour exactly seven days (604800
-                  s) before the requested window and comes back on this week's timestamps,
-                  so it overlays A on a chart and the formula can subtract it point
-                  by point. The argument is positive; it says how far back to read.
-                summary: 'timeShift: this week''s error logs next to last week''s'
-                value:
-                  compositeQuery:
-                    queries:
-                    - spec:
-                        aggregations:
-                        - alias: errors
-                          expression: count()
-                        filter:
-                          expression: severity_text = 'ERROR'
-                        name: A
-                        signal: logs
-                        stepInterval: 60s
-                      type: builder_query
-                    - spec:
-                        aggregations:
-                        - alias: errors
-                          expression: count()
-                        filter:
-                          expression: severity_text = 'ERROR'
-                        functions:
-                        - args:
-                          - value: 604800
-                          name: timeShift
-                        name: B
-                        signal: logs
-                        stepInterval: 60s
-                      type: builder_query
-                    - spec:
-                        expression: A - B
-                        name: F1
-                      type: builder_formula
-                  end: 1640998800000
-                  requestType: time_series
-                  schemaVersion: v1
-                  start: 1640995200000
               logs_raw:
                 summary: 'Raw: fetch raw log records'
                 value:

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -3611,6 +3611,7 @@ export enum CoretypesKindDTO {
 	'logs-field' = 'logs-field',
 	'traces-field' = 'traces-field',
 	'metrics-field' = 'metrics-field',
+	'llm-pricing-rule' = 'llm-pricing-rule',
 }
 export enum CoretypesTypeDTO {
 	user = 'user',

frontend/src/schemas/generated/transactionGroups.schema.json

@@ -74,7 +74,8 @@
         "meter-metrics",
         "logs-field",
         "traces-field",
-        "metrics-field"
+        "metrics-field",
+        "llm-pricing-rule"
       ],
       "type": "string"
     },

pkg/apiserver/signozapiserver/llmpricingrule.go

@@ -4,14 +4,16 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/querybuilder"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/llmpricingruletypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.List),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.List, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListLLMPricingRules",
 			Tags:                []string{"llmpricingrules"},
@@ -25,14 +27,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.CreateOrUpdate),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.CreateOrUpdate, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                 "CreateOrUpdateLLMPricingRules",
 			Tags:               []string{"llmpricingrules"},
@@ -43,14 +51,20 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:  http.StatusNoContent,
 			ErrorStatusCodes:   []int{http.StatusBadRequest},
 			Deprecated:         false,
-			SecuritySchemes:    newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:    newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbUpdate)}),
 		},
+		handler.WithResourceDefs(handler.TelemetryResourceDef{
+			Verb:      coretypes.VerbUpdate,
+			Category:  coretypes.ActionCategoryConfigurationChange,
+			Selector:  llmpricingruletypes.RuleSelector,
+			Resources: llmpricingruletypes.UpdatableRulesResources,
+		}),
 	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/unmapped_models", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.ListUnmappedModels),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.ListUnmappedModels, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "ListUnmappedLLMModels",
 			Tags:                []string{"llmpricingrules"},
@@ -63,14 +77,28 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbList), coretypes.ResourceTelemetryResourceTraces.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+				Verb:     coretypes.VerbList,
+				Category: coretypes.ActionCategoryDataAccess,
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.TelemetryResourceDef{
+				Verb:      coretypes.VerbRead,
+				Category:  coretypes.ActionCategoryDataAccess,
+				Selector:  querybuilder.TelemetrySelector,
+				Resources: querybuilder.BuilderQueryWildcardResources(coretypes.ResourceTelemetryResourceTraces),
+			},
+		),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.llmPricingRuleHandler.Get),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Get, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -83,14 +111,21 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbRead)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v1/llm_pricing_rules/{id}", handler.New(
-		provider.authzMiddleware.AdminAccess(provider.llmPricingRuleHandler.Delete),
+		provider.authzMiddleware.CheckResources(provider.llmPricingRuleHandler.Delete, authtypes.SigNozAdminRoleName),
 		handler.OpenAPIDef{
 			ID:                  "DeleteLLMPricingRule",
 			Tags:                []string{"llmpricingrules"},
@@ -103,8 +138,15 @@ func (provider *provider) addLLMPricingRuleRoutes(router *mux.Router) error {
 			SuccessStatusCode:   http.StatusNoContent,
 			ErrorStatusCodes:    []int{http.StatusNotFound},
 			Deprecated:          false,
-			SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceLLMPricingRule.Scope(coretypes.VerbDelete)}),
 		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceLLMPricingRule,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
 	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

pkg/apiserver/signozapiserver/querier.go

@@ -30,7 +30,7 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
 		Description:        "Execute a composite query over a time range. Supports builder queries (traces, logs, metrics), formulas, trace operators, PromQL, and ClickHouse SQL.",
 		Request:            new(qbtypes.QueryRangeRequest),
 		RequestContentType: "application/json",
-		RequestExamples: append([]handler.OpenAPIExample{
+		RequestExamples: []handler.OpenAPIExample{
 			{
 				Name:    "traces_time_series",
 				Summary: "Time series: count spans grouped by service",
@@ -598,7 +598,7 @@ func (provider *provider) addQuerierRoutes(router *mux.Router) error {
 					},
 				},
 			},
-		}, queryRangeFunctionExamples()...),
+		},
 		Response:            new(qbtypes.QueryRangeResponse),
 		ResponseContentType: "application/json",
 		SuccessStatusCode:   http.StatusOK,

pkg/apiserver/signozapiserver/querier_examples.go

@@ -1,202 +0,0 @@
-package signozapiserver
-
-import "github.com/SigNoz/signoz/pkg/http/handler"
-
-// timeSeriesExample wraps builder query specs in a one hour time series
-// request, the shape every function example shares.
-func timeSeriesExample(name, summary, description string, queries ...map[string]any) handler.OpenAPIExample {
-	list := make([]any, 0, len(queries))
-	for _, query := range queries {
-		list = append(list, query)
-	}
-	return handler.OpenAPIExample{
-		Name:        name,
-		Summary:     summary,
-		Description: description,
-		Value: map[string]any{
-			"schemaVersion":  "v1",
-			"start":          1640995200000,
-			"end":            1640998800000,
-			"requestType":    "time_series",
-			"compositeQuery": map[string]any{"queries": list},
-		},
-	}
-}
-
-func builderQueryEnvelope(spec map[string]any) map[string]any {
-	return map[string]any{"type": "builder_query", "spec": spec}
-}
-
-// function builds a function entry with positional arguments; anomaly is the
-// one function that takes named arguments and is written out in full.
-func function(name string, args ...any) map[string]any {
-	list := make([]any, 0, len(args))
-	for _, arg := range args {
-		list = append(list, map[string]any{"value": arg})
-	}
-	entry := map[string]any{"name": name}
-	if len(list) > 0 {
-		entry["args"] = list
-	}
-	return entry
-}
-
-// queryRangeFunctionExamples shows every function a builder query can carry,
-// what its arguments mean and the values they take. Functions run in the
-// order listed, after the aggregation and before formulas.
-func queryRangeFunctionExamples() []handler.OpenAPIExample {
-	return []handler.OpenAPIExample{
-		timeSeriesExample(
-			"function_timeshift_week_over_week",
-			"timeShift: this week's error logs next to last week's",
-			"timeShift moves every point of its query forward by the argument, in seconds, so a series read from the past lands on the current timestamps. B here reads the hour exactly seven days (604800 s) before the requested window and comes back on this week's timestamps, so it overlays A on a chart and the formula can subtract it point by point. The argument is positive; it says how far back to read.",
-			builderQueryEnvelope(map[string]any{
-				"name":         "A",
-				"signal":       "logs",
-				"aggregations": []any{map[string]any{"expression": "count()", "alias": "errors"}},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "severity_text = 'ERROR'"},
-			}),
-			builderQueryEnvelope(map[string]any{
-				"name":         "B",
-				"signal":       "logs",
-				"aggregations": []any{map[string]any{"expression": "count()", "alias": "errors"}},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "severity_text = 'ERROR'"},
-				"functions":    []any{function("timeShift", 604800)},
-			}),
-			map[string]any{
-				"type": "builder_formula",
-				"spec": map[string]any{"name": "F1", "expression": "A - B"},
-			},
-		),
-		timeSeriesExample(
-			"function_fillzero_sparse_errors",
-			"fillZero: a zero at every step with no failed spans",
-			"A count over sparse events returns a point only for steps that had a match, so a chart of failed spans has gaps where nothing failed. fillZero adds a zero at every missing step. With no arguments the server fills the request window at the query's step, which is the common case. The three optional arguments are start, end and step in milliseconds, for callers that want to fill a different grid.",
-			builderQueryEnvelope(map[string]any{
-				"name":         "A",
-				"signal":       "traces",
-				"aggregations": []any{map[string]any{"expression": "count()", "alias": "failed_spans"}},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "has_error = true"},
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions":    []any{function("fillZero")},
-			}),
-		),
-		timeSeriesExample(
-			"function_cutoffmin_hide_idle_hosts",
-			"cutOffMin: drop hosts below 5% CPU from the chart",
-			"The four threshold functions take one number. cutOffMin and cutOffMax remove the points below or above the threshold, so an idle host disappears from the chart instead of drawing a line along the bottom. clampMin and clampMax keep the points and replace the value with the threshold, which caps spikes without hiding them. system.cpu.utilization is a ratio, so 0.05 is 5%.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "system.cpu.utilization", "timeAggregation": "avg", "spaceAggregation": "avg"},
-				},
-				"stepInterval": "60s",
-				"groupBy":      []any{map[string]any{"name": "host.name", "fieldContext": "resource"}},
-				"functions":    []any{function("cutOffMin", 0.05)},
-			}),
-		),
-		timeSeriesExample(
-			"function_runningdiff_disk_growth",
-			"runningDiff then clampMin: bytes written to disk per step",
-			"runningDiff turns a gauge into the change between consecutive points, so a filesystem usage gauge becomes bytes written per step. It takes no arguments and drops the first point of the window, since that point has nothing to difference against; the server reads one step before the window to keep the first interval. Functions apply in order: clampMin with 0 runs on the differences and replaces the negative value a cleanup or a volume reset produces with zero.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "system.filesystem.usage", "timeAggregation": "latest", "spaceAggregation": "sum"},
-				},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "state = 'used'"},
-				"groupBy":      []any{map[string]any{"name": "host.name", "fieldContext": "resource"}},
-				"functions":    []any{function("runningDiff"), function("clampMin", 0)},
-			}),
-		),
-		timeSeriesExample(
-			"function_ewma_smoothed_latency",
-			"ewma5: smoothed p95 latency",
-			"ewma3, ewma5 and ewma7 replace each point with an exponentially weighted average of the point and the points before it. The number in the name is the window the default weight is derived from: alpha = 2 / (n + 1), so 0.5, 0.333 and 0.25. One optional argument overrides alpha; a value close to 1 follows the raw series, a value close to 0 smooths harder. 0.3 here smooths a little more than ewma5's default.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "http.server.duration.bucket", "spaceAggregation": "p95"},
-				},
-				"stepInterval": "60s",
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions":    []any{function("ewma5", 0.3)},
-			}),
-		),
-		timeSeriesExample(
-			"function_median_despiked_request_rate",
-			"median5: request rate without one-step spikes",
-			"median3, median5 and median7 replace each point with the median of the surrounding 3, 5 or 7 points. A spike that lasts one step vanishes, a shift that lasts longer than half the window stays. They take no arguments. Use them when the raw series is noisy and the chart is for a trend, not for catching the spike.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "http.server.duration.count", "timeAggregation": "rate", "spaceAggregation": "sum"},
-				},
-				"stepInterval": "60s",
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions":    []any{function("median5")},
-			}),
-		),
-		timeSeriesExample(
-			"function_cumulativesum_errors_so_far",
-			"cumulativeSum: 5xx responses since the start of the window",
-			"cumulativeSum replaces each point with the sum of every point up to it, so a per-step count becomes a running total that starts at zero at the window start. It takes no arguments. The total resets with the window, so a longer time range gives a larger final value; it is a view of the window, not a counter.",
-			builderQueryEnvelope(map[string]any{
-				"name":         "A",
-				"signal":       "traces",
-				"aggregations": []any{map[string]any{"expression": "count()", "alias": "server_errors"}},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "http.response.status_code >= 500"},
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions":    []any{function("cumulativeSum")},
-			}),
-		),
-		timeSeriesExample(
-			"function_log10_network_bytes",
-			"log10: network throughput across devices that differ by orders of magnitude",
-			"log2 and log10 replace each value with its logarithm, so a loopback device moving kilobytes and an uplink moving gigabytes fit on one chart. They take no arguments. Zero and negative values have no logarithm and are not drawn. absolute, also without arguments, is the usual companion for a signed series before a logarithm.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "system.network.io", "timeAggregation": "rate", "spaceAggregation": "sum"},
-				},
-				"stepInterval": "60s",
-				"filter":       map[string]any{"expression": "direction = 'transmit'"},
-				"groupBy":      []any{map[string]any{"name": "device", "fieldContext": "attribute"}},
-				"functions":    []any{function("log10")},
-			}),
-		),
-		timeSeriesExample(
-			"function_anomaly_request_rate",
-			"anomaly: request rate scored against its daily pattern",
-			"anomaly is the one function with named arguments. seasonality says which past periods predict the current value: hourly, daily or weekly, daily when absent. z_score_threshold is how many standard deviations from the prediction count as an anomaly, 3 when absent. The response carries, next to the values, a predicted series, an upper and a lower bound series and an anomaly score series. The scoring runs in the enterprise build; the community build returns the series unchanged.",
-			builderQueryEnvelope(map[string]any{
-				"name":   "A",
-				"signal": "metrics",
-				"aggregations": []any{
-					map[string]any{"metricName": "http.server.duration.count", "timeAggregation": "rate", "spaceAggregation": "sum"},
-				},
-				"stepInterval": "300s",
-				"groupBy":      []any{map[string]any{"name": "service.name", "fieldContext": "resource"}},
-				"functions": []any{
-					map[string]any{
-						"name": "anomaly",
-						"args": []any{
-							map[string]any{"name": "seasonality", "value": "daily"},
-							map[string]any{"name": "z_score_threshold", "value": 3},
-						},
-					},
-				},
-			}),
-		),
-	}
-}

pkg/apiserver/signozapiserver/querier_examples_test.go

@@ -1,21 +0,0 @@
-package signozapiserver
-
-import (
-	"encoding/json"
-	"testing"
-
-	qbtypes "github.com/SigNoz/signoz/pkg/types/querybuildertypes/querybuildertypesv5"
-	"github.com/stretchr/testify/require"
-)
-
-func TestQueryRangeFunctionExamplesAreValidRequests(t *testing.T) {
-	for _, ex := range queryRangeFunctionExamples() {
-		t.Run(ex.Name, func(t *testing.T) {
-			raw, err := json.Marshal(ex.Value)
-			require.NoError(t, err)
-			var req qbtypes.QueryRangeRequest
-			require.NoError(t, json.Unmarshal(raw, &req))
-			require.NoError(t, req.Validate())
-		})
-	}
-}

pkg/signoz/provider.go

@@ -272,6 +272,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddDowntimeTuplesFactory(sqlstore),
 		sqlmigration.NewAddRuleTuplesFactory(sqlstore),
 		sqlmigration.NewRestructureJiraChannelSpecFactory(sqlstore),
+		sqlmigration.NewAddLLMPricingRuleTuplesFactory(sqlstore),
 	)
 }
 

pkg/sqlmigration/145_add_llm_pricing_rule_tuples.go

@@ -0,0 +1,162 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addLLMPricingRuleTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddLLMPricingRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_llm_pricing_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addLLMPricingRuleTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addLLMPricingRuleTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addLLMPricingRuleTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "llm-pricing-rule", "list"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "llm-pricing-rule", "list"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "read"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "llm-pricing-rule", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
+	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
+		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
+		if err != nil {
+			return err
+		}
+		managedRoleGroups[roleName] = string(data)
+	}
+
+	for _, orgID := range orgIDs {
+		for roleName, data := range managedRoleGroups {
+			if _, err := tx.NewUpdate().
+				Model(new(roles)).
+				Set("transaction_groups = ?", data).
+				Where("org_id = ?", orgID).
+				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
+				Where("name = ?", roleName).
+				Exec(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addLLMPricingRuleTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/types/coretypes/kind.go

@@ -80,6 +80,7 @@ func (name Kind) Enum() []any {
 		KindLogsField,
 		KindTracesField,
 		KindMetricsField,
+		KindLLMPricingRule,
 	}
 }
 

pkg/types/coretypes/registry_kind.go

@@ -40,6 +40,7 @@ var Kinds = []Kind{
 	KindLogsField,
 	KindTracesField,
 	KindMetricsField,
+	KindLLMPricingRule,
 }
 
 var (
@@ -82,4 +83,5 @@ var (
 	KindLogsField                    = MustNewKind("logs-field")
 	KindTracesField                  = MustNewKind("traces-field")
 	KindMetricsField                 = MustNewKind("metrics-field")
+	KindLLMPricingRule               = MustNewKind("llm-pricing-rule")
 )

pkg/types/coretypes/registry_managed_role.go

@@ -226,6 +226,11 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — admin writes, viewer reads
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
 	},
 	SigNozEditorRoleName: {
 		// cloud-integration — editor can read accounts
@@ -331,6 +336,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — read only (admin writes)
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
 	},
 	SigNozViewerRoleName: {
 		// cloud-integration — viewer can read accounts
@@ -395,6 +403,9 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// metrics-field — viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindMetricsField}, WildCardSelectorString)},
+		// llm-pricing-rule — read only
+		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
+		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindLLMPricingRule}, WildCardSelectorString)},
 	},
 	SigNozAnonymousRoleName: {
 		// public-dashboard — anonymous read

pkg/types/coretypes/registry_resource.go

@@ -40,6 +40,7 @@ var Resources = []Resource{
 	ResourceMetaResourceLogsField,
 	ResourceMetaResourceTracesField,
 	ResourceMetaResourceMetricsField,
+	ResourceMetaResourceLLMPricingRule,
 }
 
 var (
@@ -82,4 +83,5 @@ var (
 	ResourceMetaResourceLogsField                        = NewResourceMetaResource(KindLogsField)
 	ResourceMetaResourceTracesField                      = NewResourceMetaResource(KindTracesField)
 	ResourceMetaResourceMetricsField                     = NewResourceMetaResource(KindMetricsField, VerbList, VerbRead, VerbUpdate)
+	ResourceMetaResourceLLMPricingRule                   = NewResourceMetaResource(KindLLMPricingRule, VerbList, VerbRead, VerbUpdate, VerbDelete)
 )

pkg/types/llmpricingruletypes/resource.go

@@ -0,0 +1,58 @@
+package llmpricingruletypes
+
+import (
+	"context"
+	"encoding/json"
+	"slices"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+// UpdatableRulesResources resolves the pricing rules an upsert body writes to.
+//
+// A rule with isOverride and an id is an edit, checked by that id. Everything
+// else resolves to the wildcard: isOverride without an id is a create, sourceId
+// without isOverride is a sync row, and an empty list has nothing to check.
+func UpdatableRulesResources(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
+	// Decoded with the handler's request type so duplicate or case-variant keys
+	// resolve to the rows actually written; valuer lowercases uppercase ids.
+	var body UpdatableLLMPricingRules
+	if err := json.Unmarshal(ec.RequestBody, &body); err != nil {
+		return nil, errors.Wrapf(err, errors.TypeInvalidInput, ErrCodePricingRuleInvalidInput, "invalid pricing rules body")
+	}
+
+	ids := make([]string, 0, len(body.Rules))
+	wildcard := len(body.Rules) == 0
+	for _, rule := range body.Rules {
+		if rule == nil || rule.ID == nil || rule.IsOverride == nil {
+			wildcard = true
+			continue
+		}
+
+		if !slices.Contains(ids, rule.ID.StringValue()) {
+			ids = append(ids, rule.ID.StringValue())
+		}
+	}
+	if wildcard {
+		ids = append(ids, coretypes.WildCardSelectorString)
+	}
+
+	resources := make([]coretypes.ResourceWithID, 0, len(ids))
+	for _, id := range ids {
+		resources = append(resources, coretypes.ResourceWithID{Resource: coretypes.ResourceMetaResourceLLMPricingRule, ID: id})
+	}
+
+	return resources, nil
+}
+
+// RuleSelector exists because IDSelector would turn the wildcard entry into
+// the wildcard twice; an id still resolves to the id plus the wildcard.
+func RuleSelector(ctx context.Context, resource coretypes.Resource, id string, orgID valuer.UUID) ([]coretypes.Selector, error) {
+	if id == coretypes.WildCardSelectorString {
+		return coretypes.WildcardSelector(ctx, resource, id, orgID)
+	}
+
+	return coretypes.IDSelector(ctx, resource, id, orgID)
+}

pkg/types/llmpricingruletypes/resource_test.go

@@ -0,0 +1,126 @@
+package llmpricingruletypes
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+)
+
+func TestUpdatableRulesResources(t *testing.T) {
+	testCases := []struct {
+		name    string
+		body    string
+		want    []string
+		wantErr bool
+	}{
+		{
+			name: "EmptyRules_Wildcard",
+			body: `{"rules":[]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "Edit_ID",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}]}`,
+			want: []string{"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e"},
+		},
+		{
+			name: "Create_Wildcard",
+			body: `{"rules":[{"modelPattern":["m*"],"modelName":"gpt","isOverride":true}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "SyncRow_Wildcard",
+			body: `{"rules":[{"modelPattern":["m*"],"sourceId":"4e9a0b12-3c4d-4e5f-8a6b-7c8d9e0f1a2b"}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "Mixed_DedupedIDsThenWildcardOnce",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true},{"modelPattern":["m*"],"modelName":"new","isOverride":true},{"modelPattern":["m*"],"id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":false},{"modelPattern":["m*"],"sourceId":"7bcd3e45-6f7a-4b8c-9d9e-0f1a2b3c4d5e"}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d", "*"},
+		},
+		{
+			name: "UppercaseID_Lowercased",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"8CDE4F56-7A8B-4C9D-8E0F-1A2B3C4D5E6F","isOverride":true}]}`,
+			want: []string{"8cde4f56-7a8b-4c9d-8e0f-1a2b3c4d5e6f"},
+		},
+		{
+			name: "DuplicateIDKey_LastWins",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","id":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d"},
+		},
+		{
+			name: "CaseVariantIDKey_LastWins",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","ID":"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d","isOverride":true}]}`,
+			want: []string{"6abc2d34-5e6f-4a7b-8c8d-9e0f1a2b3c4d"},
+		},
+		{
+			name: "DuplicateRulesArray_CreateRow_Wildcard",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}],"rules":[{"modelPattern":["n*"],"modelName":"new","isOverride":true}]}`,
+			want: []string{"*"},
+		},
+		{
+			name: "DuplicateRulesArray_SyncRow_Wildcard",
+			body: `{"rules":[{"modelPattern":["m*"],"id":"0b6d1a4e-5c1f-4d2a-9e3b-1f2a3b4c5d6e","isOverride":true}],"rules":[{"modelPattern":["n*"],"sourceId":"4e9a0b12-3c4d-4e5f-8a6b-7c8d9e0f1a2b"}]}`,
+			want: []string{"*"},
+		},
+		{
+			name:    "InvalidID_Rejected",
+			body:    `{"rules":[{"modelPattern":["m*"],"id":"not-a-uuid","isOverride":true}]}`,
+			wantErr: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			resources, err := UpdatableRulesResources(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+			if testCase.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			got := make([]string, 0, len(resources))
+			for _, resource := range resources {
+				got = append(got, resource.ID)
+			}
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}
+
+func TestRuleSelector(t *testing.T) {
+	testCases := []struct {
+		name string
+		id   string
+		want []string
+	}{
+		{
+			name: "Wildcard_WildcardOnly",
+			id:   "*",
+			want: []string{"*"},
+		},
+		{
+			name: "ID_IDThenWildcard",
+			id:   "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d",
+			want: []string{"a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d", "*"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			selectors, err := RuleSelector(context.Background(), coretypes.ResourceMetaResourceLLMPricingRule, testCase.id, valuer.GenerateUUID())
+			require.NoError(t, err)
+
+			got := make([]string, 0, len(selectors))
+			for _, selector := range selectors {
+				got = append(got, selector.String())
+			}
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}

tests/integration/testdata/role/managed_role_transactions.json

@@ -305,6 +305,16 @@
         "list"
       ]
     },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "update",
+        "delete",
+        "list"
+      ]
+    },
     {
       "type": "metaresource",
       "kind": "ttl-setting",
@@ -542,6 +552,14 @@
         "list"
       ]
     },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
     {
       "type": "metaresource",
       "kind": "ttl-setting",
@@ -721,6 +739,14 @@
         "list"
       ]
     },
+    {
+      "type": "metaresource",
+      "kind": "llm-pricing-rule",
+      "verbs": [
+        "read",
+        "list"
+      ]
+    },
     {
       "type": "metaresource",
       "kind": "ttl-setting",

tests/integration/tests/llmpricingrules/02_authz.py

@@ -0,0 +1,350 @@
+import json
+from collections.abc import Callable
+from http import HTTPStatus
+
+import pytest
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures import types
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+)
+from fixtures.llmpricingrules import (
+    LLM_PRICING_RULES_URL,
+    delete_all_llm_pricing_rules,
+    list_llm_pricing_rules,
+    upsert_llm_pricing_rules,
+)
+from fixtures.role import find_role_by_name, transaction_group
+
+user_password = "password123Z$"
+editor_email = "llm-pricing-editor@integration.test"
+viewer_email = "llm-pricing-viewer@integration.test"
+updater_role = "llm-pricing-updater"
+updater_email = "llm-pricing-updater@integration.test"
+scoped_role = "llm-pricing-scoped"
+scoped_email = "llm-pricing-scoped@integration.test"
+lister_role = "llm-pricing-lister"
+lister_email = "llm-pricing-lister@integration.test"
+trace_reader_role = "llm-pricing-trace-reader"
+trace_reader_email = "llm-pricing-trace-reader@integration.test"
+
+PROBE_RULE = {
+    "modelName": "authz-probe",
+    "provider": "OpenAI",
+    "modelPattern": ["authz-probe*"],
+    "unit": "per_million_tokens",
+    "pricing": {"input": 1, "output": 2},
+    "isOverride": True,
+    "enabled": True,
+}
+
+OTHER_RULE = {
+    "modelName": "authz-probe-other",
+    "provider": "Anthropic",
+    "modelPattern": ["authz-probe-other*"],
+    "unit": "per_million_tokens",
+    "pricing": {"input": 3, "output": 4},
+    "isOverride": True,
+    "enabled": True,
+}
+
+
+def test_setup(
+    signoz: types.SigNoz,
+    create_user_admin: types.Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[types.TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    delete_all_llm_pricing_rules(signoz, admin_token)
+    assert upsert_llm_pricing_rules(signoz, admin_token, [PROBE_RULE, OTHER_RULE]).status_code == HTTPStatus.NO_CONTENT
+    probe_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+
+    headers = {"Authorization": f"Bearer {admin_token}"}
+
+    # A --reuse stack keeps users and roles from earlier runs, and probe_id changes every run.
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v1/roles"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_roles = {role["name"]: role["id"] for role in response.json()["data"]}
+    grants = {
+        updater_role: [transaction_group("update", "metaresource", "llm-pricing-rule", ["*"])],
+        scoped_role: [
+            transaction_group("read", "metaresource", "llm-pricing-rule", [probe_id]),
+            transaction_group("update", "metaresource", "llm-pricing-rule", [probe_id]),
+            transaction_group("delete", "metaresource", "llm-pricing-rule", [probe_id]),
+        ],
+        lister_role: [transaction_group("list", "metaresource", "llm-pricing-rule", ["*"])],
+        trace_reader_role: [
+            transaction_group("list", "metaresource", "llm-pricing-rule", ["*"]),
+            transaction_group("read", "telemetryresource", "traces", ["builder_query/*"]),
+        ],
+    }
+    for name, transaction_groups in grants.items():
+        if name not in existing_roles:
+            create_role(admin_token, name, transaction_groups)
+            continue
+        response = requests.put(
+            signoz.self.host_configs["8080"].get(f"/api/v1/roles/{existing_roles[name]}"),
+            json={"description": "", "transactionGroups": transaction_groups},
+            headers=headers,
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.get(signoz.self.host_configs["8080"].get("/api/v2/users"), headers=headers, timeout=5)
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_emails = {user["email"] for user in response.json()["data"]}
+    for email, role in (
+        (editor_email, "signoz-editor"),
+        (viewer_email, "signoz-viewer"),
+        (updater_email, updater_role),
+        (scoped_email, scoped_role),
+        (lister_email, lister_role),
+        (trace_reader_email, trace_reader_role),
+    ):
+        if email in existing_emails:
+            continue
+        user_id = create_active_user(signoz, admin_token, email=email, role="signoz-viewer", password=user_password)
+        if role != "signoz-viewer":
+            change_user_role(signoz, admin_token, user_id, "signoz-viewer", role)
+
+
+@pytest.mark.parametrize(
+    "path",
+    [LLM_PRICING_RULES_URL, f"{LLM_PRICING_RULES_URL}/unmapped_models"],
+    ids=["list", "unmapped_models"],
+)
+@pytest.mark.parametrize(
+    ("email", "expected"),
+    [
+        (USER_ADMIN_EMAIL, HTTPStatus.OK),
+        (editor_email, HTTPStatus.OK),
+        (viewer_email, HTTPStatus.OK),
+        (updater_email, HTTPStatus.FORBIDDEN),
+        (scoped_email, HTTPStatus.FORBIDDEN),
+    ],
+    ids=["admin", "editor", "viewer", "updater", "scoped"],
+)
+def test_reads_need_list_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    path: str,
+    email: str,
+    expected: HTTPStatus,
+) -> None:
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(path),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:list" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "path", "expected"),
+    [
+        (lister_email, LLM_PRICING_RULES_URL, HTTPStatus.OK),
+        (lister_email, f"{LLM_PRICING_RULES_URL}/unmapped_models", HTTPStatus.FORBIDDEN),
+        (trace_reader_email, f"{LLM_PRICING_RULES_URL}/unmapped_models", HTTPStatus.OK),
+    ],
+    ids=["lister_list", "lister_unmapped_models", "trace_reader_unmapped_models"],
+)
+def test_unmapped_models_needs_traces_read(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    path: str,
+    expected: HTTPStatus,
+) -> None:
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(path),
+        headers={"Authorization": f"Bearer {get_token(email, user_password)}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "traces:read" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "model_name", "expected"),
+    [
+        (USER_ADMIN_EMAIL, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (editor_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.OK),
+        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
+    ],
+    ids=["admin", "editor", "viewer", "updater", "scoped_granted", "scoped_other"],
+)
+def test_get_needs_read_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    model_name: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:read" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "expected"),
+    [
+        (editor_email, HTTPStatus.FORBIDDEN),
+        (viewer_email, HTTPStatus.FORBIDDEN),
+        (scoped_email, HTTPStatus.NO_CONTENT),
+        (updater_email, HTTPStatus.NO_CONTENT),
+        (USER_ADMIN_EMAIL, HTTPStatus.NO_CONTENT),
+    ],
+    ids=["editor", "viewer", "scoped", "updater", "admin"],
+)
+def test_upsert_needs_update_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = upsert_llm_pricing_rules(signoz, token, [{**PROBE_RULE, "id": rule_id}])
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize(
+    "shape",
+    ["other_rule", "create", "sync_row", "own_and_other"],
+    ids=["other_rule", "create", "sync_row", "own_and_other"],
+)
+def test_upsert_scoped_to_granted_rule(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    shape: str,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rules = {r["modelName"]: r for r in list_llm_pricing_rules(signoz, admin_token)}
+    own = {**PROBE_RULE, "id": rules[PROBE_RULE["modelName"]]["id"]}
+    other = {**OTHER_RULE, "id": rules[OTHER_RULE["modelName"]]["id"]}
+    sync_row = {**{k: v for k, v in PROBE_RULE.items() if k != "isOverride"}, "sourceId": "11111111-1111-4111-8111-111111111199"}
+    bodies = {"other_rule": [other], "create": [PROBE_RULE], "sync_row": [sync_row], "own_and_other": [own, other]}
+
+    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), bodies[shape])
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize("second_row", ["create", "sync_row"], ids=["create", "sync_row"])
+def test_upsert_duplicate_rules_array_needs_wildcard(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    second_row: str,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    own = {**PROBE_RULE, "id": next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])}
+    rows = {
+        "create": {**PROBE_RULE, "modelName": "authz-probe-dup"},
+        "sync_row": {**{k: v for k, v in PROBE_RULE.items() if k != "isOverride"}, "sourceId": "11111111-1111-4111-8111-111111111198"},
+    }
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(LLM_PRICING_RULES_URL),
+        data=f'{{"rules":[{json.dumps(own)}],"rules":[{json.dumps(rows[second_row])}]}}',
+        headers={"Authorization": f"Bearer {get_token(scoped_email, user_password)}", "Content-Type": "application/json"},
+        timeout=10,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+def test_revoke_update_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == PROBE_RULE["modelName"])
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_by_name(signoz, admin_token, scoped_role)}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "llm-pricing-rule", [rule_id]),
+                transaction_group("delete", "metaresource", "llm-pricing-rule", [rule_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=10,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = upsert_llm_pricing_rules(signoz, get_token(scoped_email, user_password), [{**PROBE_RULE, "id": rule_id}])
+    assert response.status_code == HTTPStatus.FORBIDDEN, response.text
+    assert "llm-pricing-rule:update" in response.text
+
+
+@pytest.mark.parametrize(
+    ("email", "model_name", "expected"),
+    [
+        (editor_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (viewer_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (updater_email, PROBE_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, OTHER_RULE["modelName"], HTTPStatus.FORBIDDEN),
+        (scoped_email, PROBE_RULE["modelName"], HTTPStatus.NO_CONTENT),
+        (USER_ADMIN_EMAIL, OTHER_RULE["modelName"], HTTPStatus.NO_CONTENT),
+    ],
+    ids=["editor", "viewer", "updater", "scoped_other", "scoped_granted", "admin"],
+)
+def test_delete_needs_delete_grant(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+    email: str,
+    model_name: str,
+    expected: HTTPStatus,
+) -> None:
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    rule_id = next(r["id"] for r in list_llm_pricing_rules(signoz, admin_token) if r["modelName"] == model_name)
+    token = get_token(email, USER_ADMIN_PASSWORD if email == USER_ADMIN_EMAIL else user_password)
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{LLM_PRICING_RULES_URL}/{rule_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=10,
+    )
+    assert response.status_code == expected, response.text
+    if expected == HTTPStatus.FORBIDDEN:
+        assert "llm-pricing-rule:delete" in response.text
+
+
+def test_cleanup(
+    signoz: types.SigNoz,
+    get_token: Callable[[str, str], str],
+) -> None:
+    delete_all_llm_pricing_rules(signoz, get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD))