Merge branch 'feat/fga-rule-history' into feat/fga-rules

# Conflicts:
#	pkg/types/ruletypes/api_params.go

docs/api/openapi.yml

@@ -15064,9 +15064,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - planned-maintenance:list
       - tokenizer:
-        - VIEWER
+        - planned-maintenance:list
       summary: List downtime schedules
       tags:
       - downtimeschedules
@@ -15121,9 +15121,13 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - planned-maintenance:create
+        - planned-maintenance:attach
+        - rule:attach
       - tokenizer:
-        - EDITOR
+        - planned-maintenance:create
+        - planned-maintenance:attach
+        - rule:attach
       summary: Create downtime schedule
       tags:
       - downtimeschedules
@@ -15168,9 +15172,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - planned-maintenance:delete
       - tokenizer:
-        - EDITOR
+        - planned-maintenance:delete
       summary: Delete downtime schedule
       tags:
       - downtimeschedules
@@ -15226,9 +15230,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - planned-maintenance:read
       - tokenizer:
-        - VIEWER
+        - planned-maintenance:read
       summary: Get downtime schedule by ID
       tags:
       - downtimeschedules
@@ -15283,9 +15287,17 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - planned-maintenance:update
+        - planned-maintenance:attach
+        - planned-maintenance:detach
+        - rule:attach
+        - rule:detach
       - tokenizer:
-        - EDITOR
+        - planned-maintenance:update
+        - planned-maintenance:attach
+        - planned-maintenance:detach
+        - rule:attach
+        - rule:detach
       summary: Update downtime schedule
       tags:
       - downtimeschedules
@@ -16696,9 +16708,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - route-policy:list
       - tokenizer:
-        - VIEWER
+        - route-policy:list
       summary: List route policies
       tags:
       - routepolicies
@@ -16753,9 +16765,13 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - route-policy:create
+        - route-policy:attach
+        - notification-channel:attach
       - tokenizer:
-        - ADMIN
+        - route-policy:create
+        - route-policy:attach
+        - notification-channel:attach
       summary: Create route policy
       tags:
       - routepolicies
@@ -16800,9 +16816,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - route-policy:delete
       - tokenizer:
-        - ADMIN
+        - route-policy:delete
       summary: Delete route policy
       tags:
       - routepolicies
@@ -16858,9 +16874,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - route-policy:read
       - tokenizer:
-        - VIEWER
+        - route-policy:read
       summary: Get route policy by ID
       tags:
       - routepolicies
@@ -16927,9 +16943,17 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - ADMIN
+        - route-policy:update
+        - route-policy:attach
+        - route-policy:detach
+        - notification-channel:attach
+        - notification-channel:detach
       - tokenizer:
-        - ADMIN
+        - route-policy:update
+        - route-policy:attach
+        - route-policy:detach
+        - notification-channel:attach
+        - notification-channel:detach
       summary: Update route policy
       tags:
       - routepolicies
@@ -24919,9 +24943,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: List rule saved views
       tags:
       - rules
@@ -24977,9 +25001,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: Create rule saved view
       tags:
       - rules
@@ -25031,9 +25055,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: Delete rule saved view
       tags:
       - rules
@@ -25100,9 +25124,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: Update rule saved view
       tags:
       - rules
@@ -25151,9 +25175,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: List alert rules
       tags:
       - rules
@@ -26006,9 +26030,23 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       - tokenizer:
-        - EDITOR
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       summary: Create alert rule
       tags:
       - rules
@@ -26053,9 +26091,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:delete
       - tokenizer:
-        - EDITOR
+        - rule:delete
       summary: Delete alert rule
       tags:
       - rules
@@ -26111,9 +26149,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get alert rule by ID
       tags:
       - rules
@@ -26978,9 +27016,27 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:update
+        - rule:attach
+        - rule:detach
+        - notification-channel:attach
+        - notification-channel:detach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       - tokenizer:
-        - EDITOR
+        - rule:update
+        - rule:attach
+        - rule:detach
+        - notification-channel:attach
+        - notification-channel:detach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       summary: Patch alert rule
       tags:
       - rules
@@ -27833,9 +27889,27 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:update
+        - rule:attach
+        - rule:detach
+        - notification-channel:attach
+        - notification-channel:detach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       - tokenizer:
-        - EDITOR
+        - rule:update
+        - rule:attach
+        - rule:detach
+        - notification-channel:attach
+        - notification-channel:detach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       summary: Update alert rule
       tags:
       - rules
@@ -27902,9 +27976,25 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:read
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       - tokenizer:
-        - EDITOR
+        - rule:read
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       summary: Clone alert rule
       tags:
       - rules
@@ -28064,9 +28154,15 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
+        - logs-field:list
+        - traces-field:list
+        - metrics-field:list
       - tokenizer:
-        - VIEWER
+        - rule:read
+        - logs-field:list
+        - traces-field:list
+        - metrics-field:list
       summary: Get rule history filter keys
       tags:
       - rules
@@ -28242,9 +28338,15 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
+        - logs-field:read
+        - traces-field:read
+        - metrics-field:read
       - tokenizer:
-        - VIEWER
+        - rule:read
+        - logs-field:read
+        - traces-field:read
+        - metrics-field:read
       summary: Get rule history filter values
       tags:
       - rules
@@ -28317,9 +28419,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get rule overall status timeline
       tags:
       - rules
@@ -28389,9 +28491,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
       - tokenizer:
-        - VIEWER
+        - rule:read
       summary: Get rule history stats
       tags:
       - rules
@@ -28481,9 +28583,19 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       - tokenizer:
-        - VIEWER
+        - rule:read
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       summary: Get rule history timeline
       tags:
       - rules
@@ -28556,9 +28668,19 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:read
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       - tokenizer:
-        - VIEWER
+        - rule:read
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       summary: Get top contributors to rule firing
       tags:
       - rules
@@ -29412,9 +29534,23 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - EDITOR
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       - tokenizer:
-        - EDITOR
+        - rule:create
+        - rule:attach
+        - notification-channel:attach
+        - logs:read
+        - traces:read
+        - metrics:read
+        - audit-logs:read
+        - meter-metrics:read
       summary: Test alert rule
       tags:
       - rules
@@ -31509,9 +31645,9 @@ paths:
           description: Internal Server Error
       security:
       - api_key:
-        - VIEWER
+        - rule:list
       - tokenizer:
-        - VIEWER
+        - rule:list
       summary: List alert rules (v3)
       tags:
       - rules

frontend/src/components/QueryBuilderV2/QueryV2/MerticsAggregateSection/MetricsAggregateSection.tsx

@@ -129,7 +129,6 @@ const MetricsAggregateSection = memo(function MetricsAggregateSection({
 										onChange={handleChangeOperator}
 										operators={operators}
 										className="metrics-operators-select"
-										data-testid="metrics-time-aggregation"
 									/>
 								</div>
 							</div>
@@ -193,10 +192,7 @@ const MetricsAggregateSection = memo(function MetricsAggregateSection({
 										AGGREGATE ACROSS TIME SERIES
 									</div>
 								</Tooltip>
-								<div
-									className="metrics-aggregation-section-content-item-value"
-									data-testid="metrics-space-aggregation"
-								>
+								<div className="metrics-aggregation-section-content-item-value">
 									<SpaceAggregationOptions
 										panelType={panelType}
 										key={`${panelType}${queryAggregation.spaceAggregation}${queryAggregation.timeAggregation}`}
@@ -233,10 +229,7 @@ const MetricsAggregateSection = memo(function MetricsAggregateSection({
 				<div className="metrics-space-aggregation-section">
 					<div className="metrics-aggregation-section-content">
 						<div className="metrics-aggregation-section-content-item">
-							<div
-								className="metrics-aggregation-section-content-item-value"
-								data-testid="metrics-space-aggregation"
-							>
+							<div className="metrics-aggregation-section-content-item-value">
 								<SpaceAggregationOptions
 									panelType={panelType}
 									key={`${panelType}${queryAggregation.spaceAggregation}${queryAggregation.timeAggregation}`}

frontend/src/components/QueryBuilderV2/QueryV2/QueryAddOns/HavingFilter/HavingFilter.tsx

@@ -332,7 +332,6 @@ function HavingFilter({
 					value={input}
 					onChange={handleChange}
 					theme={isDarkMode ? copilot : githubLight}
-					data-testid="having-editor"
 					className="having-filter-select-editor"
 					width="100%"
 					extensions={[

frontend/src/components/QueryBuilderV2/QueryV2/QueryAggregation/QueryAggregationSelect.tsx

@@ -615,7 +615,6 @@ function QueryAggregationSelect({
 					setInput(value);
 					onChange?.(value);
 				}}
-				data-testid="query-aggregation-editor"
 				className={`query-aggregation-select-editor ${
 					validationError ? 'error' : ''
 				}`}

frontend/src/components/QueryBuilderV2/QueryV2/QuerySearch/QuerySearch.tsx

@@ -1607,7 +1607,6 @@ function QuerySearch({
 					onChange={handleChange}
 					onUpdate={handleUpdate}
 					onCreateEditor={handleEditorCreate}
-					data-testid="query-where-clause-editor"
 					className={cx('query-where-clause-editor', {
 						isValid: validation.isValid === true,
 						hasErrors: validation.errors.length > 0,
@@ -1681,7 +1680,6 @@ function QuerySearch({
 						className={cx('query-status-container', {
 							hasErrors: validation.errors.length > 0,
 						})}
-						data-testid="query-validation-status"
 					>
 						<Popover
 							placement="bottomRight"

frontend/src/components/QueryBuilderV2/QueryV2/QueryV2.tsx

@@ -183,7 +183,6 @@ export const QueryV2 = forwardRef(function QueryV2(
 		<div
 			className={cx('query-v2', { 'where-clause-view': showOnlyWhereClause })}
 			ref={ref}
-			data-testid={`query-${query.queryName}`}
 		>
 			<div className="qb-content-section">
 				{(!showOnlyWhereClause || showTraceOperator) && (
@@ -247,7 +246,6 @@ export const QueryV2 = forwardRef(function QueryV2(
 							{isMultiQueryAllowed && (
 								<Dropdown
 									items={queryActionItems}
-									testId="query-actions"
 									nativeButton={false}
 									align="end"
 									side="bottom"

frontend/src/components/QueryBuilderV2/QueryV2/TraceOperator/TraceOperator.tsx

@@ -61,10 +61,7 @@ export default function TraceOperator({
 	);
 
 	return (
-		<div
-			className={cx('qb-trace-operator', !isRawQuery && 'non-list-view')}
-			data-testid="trace-operator"
-		>
+		<div className={cx('qb-trace-operator', !isRawQuery && 'non-list-view')}>
 			<div className="qb-trace-operator-container">
 				<div
 					className={cx(

frontend/src/components/QueryBuilderV2/QueryV2/TraceOperator/TraceOperatorEditor.tsx

@@ -378,7 +378,6 @@ function TraceOperatorEditor({
 					theme={isDarkMode ? copilot : githubLight}
 					onChange={handleChange}
 					onUpdate={handleUpdate}
-					data-testid="trace-operator-editor"
 					className={cx('query-where-clause-editor', {
 						isValid: validation.isValid === true,
 						hasErrors: validation.errors.length > 0,

frontend/src/container/QueryBuilder/components/Formula/Formula.tsx

@@ -112,7 +112,7 @@ export function Formula({
 	);
 
 	return (
-		<Row gutter={[0, 15]} data-testid={`formula-${formula.queryName}`}>
+		<Row gutter={[0, 15]}>
 			<QBEntityOptions
 				isCollapsed={isCollapse}
 				showFunctions={false}
@@ -130,7 +130,6 @@ export function Formula({
 						<Input.TextArea
 							name="expression"
 							className="formula-expression"
-							data-testid="formula-expression"
 							onChange={handleChange}
 							size="middle"
 							value={formula.expression}
@@ -142,7 +141,6 @@ export function Formula({
 						<Input
 							name="legend"
 							className="formula-legend"
-							data-testid="formula-legend"
 							onChange={handleChange}
 							size="middle"
 							value={formula.legend}

frontend/src/container/QueryBuilder/components/QBEntityOptions/QBEntityOptions.tsx

@@ -98,7 +98,6 @@ export default function QBEntityOptions({
 									value="search"
 									className="periscope-btn collapse"
 									onClick={onCollapseEntity}
-									data-testid="qb-entity-collapse"
 								>
 									{isCollapsed ? <ChevronRight size={16} /> : <ChevronDown size={16} />}
 								</Button>
@@ -109,7 +108,6 @@ export default function QBEntityOptions({
 									className="periscope-btn visibility-toggle"
 									onClick={onToggleVisibility}
 									disabled={isRawQuery && !showTraceOperator}
-									data-testid="qb-entity-visibility"
 								>
 									{entityData.disabled ? <EyeOff size={16} /> : <Eye size={16} />}
 								</Button>
@@ -117,11 +115,7 @@ export default function QBEntityOptions({
 
 							{entityType === 'query' && showCloneOption && (
 								<Tooltip title={`Clone Query ${entityData.queryName}`}>
-									<Button
-										className={cx('periscope-btn')}
-										onClick={handleCloneEntity}
-										data-testid="qb-entity-clone"
-									>
+									<Button className={cx('periscope-btn')} onClick={handleCloneEntity}>
 										<Copy size={14} />
 									</Button>
 								</Tooltip>
@@ -137,7 +131,6 @@ export default function QBEntityOptions({
 										: '',
 									isLogsExplorerPage && lastUsedQuery === index ? 'sync-btn' : '',
 								)}
-								data-testid="qb-entity-name"
 							>
 								{entityData.queryName}
 							</Button>
@@ -192,11 +185,7 @@ export default function QBEntityOptions({
 				</div>
 
 				{showDeleteButton && !isRawQuery && (
-					<Button
-						className="periscope-btn ghost"
-						onClick={onDelete}
-						data-testid="qb-entity-delete"
-					>
+					<Button className="periscope-btn ghost" onClick={onDelete}>
 						<Trash2 size={14} />
 					</Button>
 				)}

frontend/src/lib/authz/hooks/useAuthZ/permissions.type.ts

@@ -21,7 +21,15 @@ export default {
 			{
 				kind: 'notification-channel',
 				type: 'metaresource',
-				allowedVerbs: ['create', 'delete', 'list', 'read', 'update'],
+				allowedVerbs: [
+					'attach',
+					'create',
+					'delete',
+					'detach',
+					'list',
+					'read',
+					'update',
+				],
 			},
 			{
 				kind: 'quick-filter',

frontend/src/pages/DashboardPage/DashboardContainer/PanelEditor/PanelEditorQueryBuilder/PanelEditorQueryBuilder.tsx

@@ -166,10 +166,7 @@ function PanelEditorQueryBuilder({
 		return modes.map((queryType) => ({
 			key: queryType,
 			label: (
-				<div
-					className={styles.queryTypeTab}
-					data-testid={`query-type-tab-${queryType}`}
-				>
+				<div className={styles.queryTypeTab}>
 					{queryTypeComponents[queryType].icon}
 					<Typography>{queryTypeComponents[queryType].label}</Typography>
 				</div>

pkg/alertmanager/alertmanager.go

@@ -34,6 +34,9 @@ type Alertmanager interface {
 	// ListChannels lists all channels for the organization.
 	ListChannels(context.Context, string) ([]*alertmanagertypes.Channel, error)
 
+	// GetChannelIDsByNames resolves display names to channel ids and rejects unknown names.
+	GetChannelIDsByNames(context.Context, string, []string) ([]string, error)
+
 	// ListAllChannels lists all channels for all organizations. It is used by the legacy alertmanager only.
 	ListAllChannels(context.Context) ([]*alertmanagertypes.Channel, error)
 

pkg/alertmanager/alertmanagertest/alertmanager.go

@@ -1023,6 +1023,80 @@ func (_c *MockAlertmanager_GetChannelByID_Call) RunAndReturn(run func(context1 c
 	return _c
 }
 
+// GetChannelIDsByNames provides a mock function for the type MockAlertmanager
+func (_mock *MockAlertmanager) GetChannelIDsByNames(context1 context.Context, s string, strings []string) ([]string, error) {
+	ret := _mock.Called(context1, s, strings)
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetChannelIDsByNames")
+	}
+
+	var r0 []string
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, []string) ([]string, error)); ok {
+		return returnFunc(context1, s, strings)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, []string) []string); ok {
+		r0 = returnFunc(context1, s, strings)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).([]string)
+		}
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, string, []string) error); ok {
+		r1 = returnFunc(context1, s, strings)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// MockAlertmanager_GetChannelIDsByNames_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetChannelIDsByNames'
+type MockAlertmanager_GetChannelIDsByNames_Call struct {
+	*mock.Call
+}
+
+// GetChannelIDsByNames is a helper method to define mock.On call
+//   - context1 context.Context
+//   - s string
+//   - strings []string
+func (_e *MockAlertmanager_Expecter) GetChannelIDsByNames(context1 any, s any, strings any) *MockAlertmanager_GetChannelIDsByNames_Call {
+	return &MockAlertmanager_GetChannelIDsByNames_Call{Call: _e.mock.On("GetChannelIDsByNames", context1, s, strings)}
+}
+
+func (_c *MockAlertmanager_GetChannelIDsByNames_Call) Run(run func(context1 context.Context, s string, strings []string)) *MockAlertmanager_GetChannelIDsByNames_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		var arg2 []string
+		if args[2] != nil {
+			arg2 = args[2].([]string)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *MockAlertmanager_GetChannelIDsByNames_Call) Return(strings1 []string, err error) *MockAlertmanager_GetChannelIDsByNames_Call {
+	_c.Call.Return(strings1, err)
+	return _c
+}
+
+func (_c *MockAlertmanager_GetChannelIDsByNames_Call) RunAndReturn(run func(context1 context.Context, s string, strings []string) ([]string, error)) *MockAlertmanager_GetChannelIDsByNames_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // GetConfig provides a mock function for the type MockAlertmanager
 func (_mock *MockAlertmanager) GetConfig(context1 context.Context, s string) (*alertmanagertypes.Config, error) {
 	ret := _mock.Called(context1, s)

pkg/alertmanager/signozalertmanager/provider.go

@@ -147,6 +147,19 @@ func (provider *provider) ListChannels(ctx context.Context, orgID string) ([]*al
 	return channels, err
 }
 
+func (provider *provider) GetChannelIDsByNames(ctx context.Context, orgID string, names []string) ([]string, error) {
+	if len(names) == 0 {
+		return nil, nil
+	}
+
+	channels, _, err := provider.configStore.ListChannels(ctx, orgID, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	return alertmanagertypes.MapChannelNamesToIDs(channels, names)
+}
+
 func (provider *provider) ListNotificationChannels(ctx context.Context, orgID string, params *alertmanagertypes.ListChannelsParams) (*alertmanagertypes.ListableNotificationChannel, error) {
 	channels, total, err := provider.configStore.ListChannels(ctx, orgID, params)
 	if err != nil {
@@ -528,6 +541,10 @@ func (provider *provider) CreateRoutePolicy(ctx context.Context, routeRequest *a
 		return nil, err
 	}
 
+	if _, err := provider.GetChannelIDsByNames(ctx, orgID.String(), routeRequest.Channels); err != nil {
+		return nil, err
+	}
+
 	route := alertmanagertypes.RoutePolicy{
 		Expression:     routeRequest.Expression,
 		ExpressionKind: routeRequest.ExpressionKind,
@@ -720,6 +737,10 @@ func (provider *provider) UpdateRoutePolicyByID(ctx context.Context, routeID str
 		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "invalid route: %v", err)
 	}
 
+	if _, err := provider.GetChannelIDsByNames(ctx, orgID.String(), route.Channels); err != nil {
+		return nil, err
+	}
+
 	existingRoute, err := provider.notificationManager.GetRoutePolicyByID(ctx, claims.OrgID, routeID)
 	if err != nil {
 		return nil, errors.NewInvalidInputf(errors.CodeNotFound, "route not found: %v", err)

pkg/apiserver/signozapiserver/alertmanager.go

@@ -4,6 +4,7 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
+	"github.com/SigNoz/signoz/pkg/ruler"
 	"github.com/SigNoz/signoz/pkg/types"
 	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
 	"github.com/SigNoz/signoz/pkg/types/authtypes"
@@ -330,88 +331,167 @@ func (provider *provider) addAlertmanagerRoutes(router *mux.Router) error {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetAllRoutePolicies), handler.OpenAPIDef{
-		ID:                  "GetAllRoutePolicies",
-		Tags:                []string{"routepolicies"},
-		Summary:             "List route policies",
-		Description:         "This endpoint lists all route policies for the organization",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetAllRoutePolicies, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetAllRoutePolicies",
+			Tags:                []string{"routepolicies"},
+			Summary:             "List route policies",
+			Description:         "This endpoint lists all route policies for the organization",
+			Response:            make([]*alertmanagertypes.GettableRoutePolicy, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.alertmanagerHandler.GetRoutePolicyByID), handler.OpenAPIDef{
-		ID:                  "GetRoutePolicyByID",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Get route policy by ID",
-		Description:         "This endpoint returns a route policy by ID",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(alertmanagertypes.GettableRoutePolicy),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.GetRoutePolicyByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRoutePolicyByID",
+			Tags:                []string{"routepolicies"},
+			Summary:             "Get route policy by ID",
+			Description:         "This endpoint returns a route policy by ID",
+			Response:            new(alertmanagertypes.GettableRoutePolicy),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.CreateRoutePolicy), handler.OpenAPIDef{
-		ID:                  "CreateRoutePolicy",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Create route policy",
-		Description:         "This endpoint creates a route policy",
-		Request:             new(alertmanagertypes.PostableRoutePolicy),
-		RequestContentType:  "application/json",
-		Response:            new(alertmanagertypes.GettableRoutePolicy),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.CreateRoutePolicy, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRoutePolicy",
+			Tags:                []string{"routepolicies"},
+			Summary:             "Create route policy",
+			Description:         "This endpoint creates a route policy",
+			Request:             new(alertmanagertypes.PostableRoutePolicy),
+			RequestContentType:  "application/json",
+			Response:            new(alertmanagertypes.GettableRoutePolicy),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRoutePolicy,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewCreateRoutePolicyChannelAttachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.UpdateRoutePolicy), handler.OpenAPIDef{
-		ID:                  "UpdateRoutePolicy",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Update route policy",
-		Description:         "This endpoint updates a route policy by ID",
-		Request:             new(alertmanagertypes.PostableRoutePolicy),
-		RequestContentType:  "application/json",
-		Response:            new(alertmanagertypes.GettableRoutePolicy),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.UpdateRoutePolicy, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateRoutePolicy",
+			Tags:                []string{"routepolicies"},
+			Summary:             "Update route policy",
+			Description:         "This endpoint updates a route policy by ID",
+			Request:             new(alertmanagertypes.PostableRoutePolicy),
+			RequestContentType:  "application/json",
+			Response:            new(alertmanagertypes.GettableRoutePolicy),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRoutePolicy,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewUpdateRoutePolicyChannelAttachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRoutePolicy,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewUpdateRoutePolicyChannelDetachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(provider.authzMiddleware.AdminAccess(provider.alertmanagerHandler.DeleteRoutePolicyByID), handler.OpenAPIDef{
-		ID:                  "DeleteRoutePolicyByID",
-		Tags:                []string{"routepolicies"},
-		Summary:             "Delete route policy",
-		Description:         "This endpoint deletes a route policy by ID",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/route_policies/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.alertmanagerHandler.DeleteRoutePolicyByID, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteRoutePolicyByID",
+			Tags:              []string{"routepolicies"},
+			Summary:           "Delete route policy",
+			Description:       "This endpoint deletes a route policy by ID",
+			SuccessStatusCode: http.StatusNoContent,
+			ErrorStatusCodes:  []int{http.StatusNotFound},
+			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRoutePolicy.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRoutePolicy,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 

pkg/apiserver/signozapiserver/provider.go

@@ -91,9 +91,11 @@ type provider struct {
 	ruleStateHistoryHandler    rulestatehistory.Handler
 	spanMapperHandler          spanmapper.Handler
 	alertmanagerHandler        alertmanager.Handler
+	alertmanagerService        alertmanager.Alertmanager
 	prometheusHandler          prometheus.Handler
 	traceDetailHandler         tracedetail.Handler
 	rulerHandler               ruler.Handler
+	rulerService               ruler.Ruler
 	llmPricingRuleHandler      llmpricingrule.Handler
 	statsHandler               statsreporter.Handler
 	savedViewHandler           savedview.Handler
@@ -136,10 +138,12 @@ func NewFactory(
 	ruleStateHistoryHandler rulestatehistory.Handler,
 	spanMapperHandler spanmapper.Handler,
 	alertmanagerHandler alertmanager.Handler,
+	alertmanagerService alertmanager.Alertmanager,
 	prometheusHandler prometheus.Handler,
 	llmPricingRuleHandler llmpricingrule.Handler,
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
+	rulerService ruler.Ruler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
 	globalConfig global.Config,
@@ -189,10 +193,12 @@ func NewFactory(
 			ruleStateHistoryHandler,
 			spanMapperHandler,
 			alertmanagerHandler,
+			alertmanagerService,
 			prometheusHandler,
 			llmPricingRuleHandler,
 			traceDetailHandler,
 			rulerHandler,
+			rulerService,
 			statsHandler,
 			savedViewHandler,
 			globalConfig,
@@ -244,10 +250,12 @@ func newProvider(
 	ruleStateHistoryHandler rulestatehistory.Handler,
 	spanMapperHandler spanmapper.Handler,
 	alertmanagerHandler alertmanager.Handler,
+	alertmanagerService alertmanager.Alertmanager,
 	prometheusHandler prometheus.Handler,
 	llmPricingRuleHandler llmpricingrule.Handler,
 	traceDetailHandler tracedetail.Handler,
 	rulerHandler ruler.Handler,
+	rulerService ruler.Ruler,
 	statsHandler statsreporter.Handler,
 	savedViewHandler savedview.Handler,
 	globalConfig global.Config,
@@ -299,9 +307,11 @@ func newProvider(
 		ruleStateHistoryHandler:    ruleStateHistoryHandler,
 		spanMapperHandler:          spanMapperHandler,
 		alertmanagerHandler:        alertmanagerHandler,
+		alertmanagerService:        alertmanagerService,
 		prometheusHandler:          prometheusHandler,
 		traceDetailHandler:         traceDetailHandler,
 		rulerHandler:               rulerHandler,
+		rulerService:               rulerService,
 		llmPricingRuleHandler:      llmPricingRuleHandler,
 		statsHandler:               statsHandler,
 		savedViewHandler:           savedViewHandler,

pkg/apiserver/signozapiserver/ruler.go

@@ -4,273 +4,633 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/querybuilder"
+	"github.com/SigNoz/signoz/pkg/ruler"
 	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/ruletypes"
 	"github.com/gorilla/mux"
 )
 
 func (provider *provider) addRulerRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRules), handler.OpenAPIDef{
-		ID:                  "ListRules",
-		Tags:                []string{"rules"},
-		Summary:             "List alert rules",
-		Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
-		Response:            make([]*ruletypes.Rule, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		Deprecated:          true,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRules",
+			Tags:                []string{"rules"},
+			Summary:             "List alert rules",
+			Description:         "This endpoint lists all alert rules with their current evaluation state. Deprecated: use ListRulesV3, which supports filtering, sorting and pagination.",
+			Response:            make([]*ruletypes.Rule, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			Deprecated:          true,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v3/rules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRulesV3), handler.OpenAPIDef{
-		ID:                  "ListRulesV3",
-		Tags:                []string{"rules"},
-		Summary:             "List alert rules (v3)",
-		Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). In the filter DSL, a non-reserved key is matched as a rule label directly (`team = infra`); a key that collides with a reserved keyword matches either interpretation (negative operators exclude both), and `labels.<key>` targets only the label. The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
-		RequestQuery:        new(ruletypes.ListRulesParams),
-		Response:            new(ruletypes.ListableRules),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v3/rules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRulesV3, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRulesV3",
+			Tags:                []string{"rules"},
+			Summary:             "List alert rules (v3)",
+			Description:         "Returns a page of alert rules with their current evaluation state, trimmed to the fields the list page renders. Supports a filter DSL (`query`), a repeated `states` filter applied after the state overlay, sort (`updated_at`/`created_at`/`name`/`state`/`severity`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`). In the filter DSL, a non-reserved key is matched as a rule label directly (`team = infra`); a key that collides with a reserved keyword matches either interpretation (negative operators exclude both), and `labels.<key>` targets only the label. The response also carries the org's label pairs and the reserved filter keys for building filter suggestions.",
+			RequestQuery:        new(ruletypes.ListRulesParams),
+			Response:            new(ruletypes.ListableRules),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetRuleByID), handler.OpenAPIDef{
-		ID:                  "GetRuleByID",
-		Tags:                []string{"rules"},
-		Summary:             "Get alert rule by ID",
-		Description:         "This endpoint returns an alert rule by ID",
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetRuleByID",
+			Tags:                []string{"rules"},
+			Summary:             "Get alert rule by ID",
+			Description:         "This endpoint returns an alert rule by ID",
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateRule), handler.OpenAPIDef{
-		ID:                  "CreateRule",
-		Tags:                []string{"rules"},
-		Summary:             "Create alert rule",
-		Description:         "This endpoint creates a new alert rule",
-		Request:             new(ruletypes.PostableRule),
-		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRule",
+			Tags:                []string{"rules"},
+			Summary:             "Create alert rule",
+			Description:         "This endpoint creates a new alert rule",
+			Request:             new(ruletypes.PostableRule),
+			RequestContentType:  "application/json",
+			RequestExamples:     postableRuleExamples(),
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes: newScopedSecuritySchemes(append([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+			}, telemetryReadScopes()...)),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewCreateRuleChannelAttachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.TelemetryResourceDef{
+				Verb:      coretypes.VerbRead,
+				Category:  coretypes.ActionCategoryDataAccess,
+				Selector:  querybuilder.TelemetrySelector,
+				Resources: ruler.NewRuleBodyTelemetryResources(),
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}/clone", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CloneRuleByID), handler.OpenAPIDef{
-		ID:                  "CloneRuleByID",
-		Tags:                []string{"rules"},
-		Summary:             "Clone alert rule",
-		Description:         "This endpoint creates a new alert rule from the stored definition of an existing one. The clone keeps every modeled field of the source, including its enabled/disabled state, and gets the source's name suffixed with \" - Copy\" (or a bumped \" - Copy (n)\" counter when the source is itself a copy). The clone is owned by the caller.",
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}/clone", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CloneRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CloneRuleByID",
+			Tags:                []string{"rules"},
+			Summary:             "Clone alert rule",
+			Description:         "This endpoint creates a new alert rule from the stored definition of an existing one. The clone keeps every modeled field of the source, including its enabled/disabled state, and gets the source's name suffixed with \" - Copy\" (or a bumped \" - Copy (n)\" counter when the source is itself a copy). The clone is owned by the caller.",
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes: newScopedSecuritySchemes(append([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+			}, telemetryReadScopes()...)),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbRead,
+				Category: coretypes.ActionCategoryDataAccess,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewCloneRuleChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.TelemetryResourceDef{
+				Verb:      coretypes.VerbRead,
+				Category:  coretypes.ActionCategoryDataAccess,
+				Selector:  querybuilder.TelemetrySelector,
+				Resources: ruler.NewRuleQueryTelemetryResources(provider.rulerService),
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
+		return err
+	}
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                 "UpdateRuleByID",
+			Tags:               []string{"rules"},
+			Summary:            "Update alert rule",
+			Description:        "This endpoint updates an alert rule by ID",
+			Request:            new(ruletypes.PostableRule),
+			RequestContentType: "application/json",
+			RequestExamples:    postableRuleExamples(),
+			SuccessStatusCode:  http.StatusNoContent,
+			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes: newScopedSecuritySchemes(append([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
+			}, telemetryReadScopes()...)),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewReplaceRuleChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewReplaceRuleChannelDetachExtractor(provider.alertmanagerService, provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.TelemetryResourceDef{
+				Verb:      coretypes.VerbRead,
+				Category:  coretypes.ActionCategoryDataAccess,
+				Selector:  querybuilder.TelemetrySelector,
+				Resources: ruler.NewRuleBodyTelemetryResources(),
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateRuleByID), handler.OpenAPIDef{
-		ID:                 "UpdateRuleByID",
-		Tags:               []string{"rules"},
-		Summary:            "Update alert rule",
-		Description:        "This endpoint updates an alert rule by ID",
-		Request:            new(ruletypes.PostableRule),
-		RequestContentType: "application/json",
-		RequestExamples:    postableRuleExamples(),
-		SuccessStatusCode:  http.StatusNoContent,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteRuleByID",
+			Tags:              []string{"rules"},
+			Summary:           "Delete alert rule",
+			Description:       "This endpoint deletes an alert rule by ID",
+			SuccessStatusCode: http.StatusNoContent,
+			ErrorStatusCodes:  []int{http.StatusNotFound},
+			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteRuleByID), handler.OpenAPIDef{
-		ID:                "DeleteRuleByID",
-		Tags:              []string{"rules"},
-		Summary:           "Delete alert rule",
-		Description:       "This endpoint deletes an alert rule by ID",
-		SuccessStatusCode: http.StatusNoContent,
-		ErrorStatusCodes:  []int{http.StatusNotFound},
-		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.PatchRuleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "PatchRuleByID",
+			Tags:                []string{"rules"},
+			Summary:             "Patch alert rule",
+			Description:         "This endpoint applies a partial update to an alert rule by ID",
+			Request:             new(ruletypes.PostableRule),
+			RequestContentType:  "application/json",
+			RequestExamples:     postableRuleExamples(),
+			Response:            new(ruletypes.Rule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes: newScopedSecuritySchemes(append([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbDetach),
+			}, telemetryReadScopes()...)),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewPatchRuleChannelAttachExtractor(provider.alertmanagerService, provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewPatchRuleChannelDetachExtractor(provider.alertmanagerService, provider.rulerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.TelemetryResourceDef{
+				Verb:      coretypes.VerbRead,
+				Category:  coretypes.ActionCategoryDataAccess,
+				Selector:  querybuilder.TelemetrySelector,
+				Resources: ruler.NewOptionalRuleBodyTelemetryResources(),
+				Optional:  true,
+			},
+		),
+	)).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.PatchRuleByID), handler.OpenAPIDef{
-		ID:                  "PatchRuleByID",
-		Tags:                []string{"rules"},
-		Summary:             "Patch alert rule",
-		Description:         "This endpoint applies a partial update to an alert rule by ID",
-		Request:             new(ruletypes.PostableRule),
-		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
-		Response:            new(ruletypes.Rule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPatch).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rules/test", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.TestRule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "TestRule",
+			Tags:                []string{"rules"},
+			Summary:             "Test alert rule",
+			Description:         "This endpoint fires a test notification for the given rule definition",
+			Request:             new(ruletypes.PostableRule),
+			RequestContentType:  "application/json",
+			RequestExamples:     postableRuleExamples(),
+			Response:            new(ruletypes.GettableTestRule),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes: newScopedSecuritySchemes(append([]string{
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceNotificationChannel.Scope(coretypes.VerbAttach),
+			}, telemetryReadScopes()...)),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceRule,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourceRule,
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceNotificationChannel,
+				TargetIDs:      ruler.NewCreateRuleChannelAttachExtractor(provider.alertmanagerService),
+				TargetSelector: coretypes.IDSelector,
+			},
+			handler.TelemetryResourceDef{
+				Verb:      coretypes.VerbRead,
+				Category:  coretypes.ActionCategoryDataAccess,
+				Selector:  querybuilder.TelemetrySelector,
+				Resources: ruler.NewRuleBodyTelemetryResources(),
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rules/test", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.TestRule), handler.OpenAPIDef{
-		ID:                  "TestRule",
-		Tags:                []string{"rules"},
-		Summary:             "Test alert rule",
-		Description:         "This endpoint fires a test notification for the given rule definition",
-		Request:             new(ruletypes.PostableRule),
-		RequestContentType:  "application/json",
-		RequestExamples:     postableRuleExamples(),
-		Response:            new(ruletypes.GettableTestRule),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListRuleViews, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListRuleViews",
+			Tags:                []string{"rules"},
+			Summary:             "List rule saved views",
+			Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
+			Response:            new(ruletypes.ListableRuleViews),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListRuleViews), handler.OpenAPIDef{
-		ID:                  "ListRuleViews",
-		Tags:                []string{"rules"},
-		Summary:             "List rule saved views",
-		Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
-		Response:            new(ruletypes.ListableRuleViews),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Create rule saved view",
+			Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
+			Request:             new(ruletypes.PostableRuleView),
+			RequestContentType:  "application/json",
+			Response:            new(ruletypes.RuleView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.CreateRuleView), handler.OpenAPIDef{
-		ID:                  "CreateRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Create rule saved view",
-		Description:         "Persists the calling user's rule listing state (query, states, sort, order) as a named, reusable view shared across the org.",
-		Request:             new(ruletypes.PostableRuleView),
-		RequestContentType:  "application/json",
-		Response:            new(ruletypes.RuleView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Update rule saved view",
+			Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
+			Request:             new(ruletypes.UpdatableRuleView),
+			RequestContentType:  "application/json",
+			Response:            new(ruletypes.RuleView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.UpdateRuleView), handler.OpenAPIDef{
-		ID:                  "UpdateRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Update rule saved view",
-		Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
-		Request:             new(ruletypes.UpdatableRuleView),
-		RequestContentType:  "application/json",
-		Response:            new(ruletypes.RuleView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteRuleView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteRuleView",
+			Tags:                []string{"rules"},
+			Summary:             "Delete rule saved view",
+			Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v2/rule_views/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.DeleteRuleView), handler.OpenAPIDef{
-		ID:                  "DeleteRuleView",
-		Tags:                []string{"rules"},
-		Summary:             "Delete rule saved view",
-		Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.ListDowntimeSchedules, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListDowntimeSchedules",
+			Tags:                []string{"downtimeschedules"},
+			Summary:             "List downtime schedules",
+			Description:         "This endpoint lists all planned maintenance / downtime schedules",
+			RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
+			Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.ListDowntimeSchedules), handler.OpenAPIDef{
-		ID:                  "ListDowntimeSchedules",
-		Tags:                []string{"downtimeschedules"},
-		Summary:             "List downtime schedules",
-		Description:         "This endpoint lists all planned maintenance / downtime schedules",
-		RequestQuery:        new(alertmanagertypes.ListPlannedMaintenanceParams),
-		Response:            make([]*alertmanagertypes.PlannedMaintenance, 0),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.GetDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetDowntimeScheduleByID",
+			Tags:                []string{"downtimeschedules"},
+			Summary:             "Get downtime schedule by ID",
+			Description:         "This endpoint returns a downtime schedule by ID",
+			Response:            new(alertmanagertypes.PlannedMaintenance),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusNotFound},
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.rulerHandler.GetDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                  "GetDowntimeScheduleByID",
-		Tags:                []string{"downtimeschedules"},
-		Summary:             "Get downtime schedule by ID",
-		Description:         "This endpoint returns a downtime schedule by ID",
-		Response:            new(alertmanagertypes.PlannedMaintenance),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusNotFound},
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.CreateDowntimeSchedule, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateDowntimeSchedule",
+			Tags:                []string{"downtimeschedules"},
+			Summary:             "Create downtime schedule",
+			Description:         "This endpoint creates a new planned maintenance / downtime schedule",
+			Request:             new(alertmanagertypes.PostablePlannedMaintenance),
+			RequestContentType:  "application/json",
+			Response:            new(alertmanagertypes.PlannedMaintenance),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbCreate),
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				SourceIDs:      coretypes.OneID(coretypes.ResponseJSONPath("data.id")),
+				SourceSelector: coretypes.WildcardSelector,
+				TargetResource: coretypes.ResourceMetaResourceRule,
+				TargetIDs:      ruler.DowntimeRuleIDsExtractor,
+				TargetSelector: ruler.DowntimeRuleSelector,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.CreateDowntimeSchedule), handler.OpenAPIDef{
-		ID:                  "CreateDowntimeSchedule",
-		Tags:                []string{"downtimeschedules"},
-		Summary:             "Create downtime schedule",
-		Description:         "This endpoint creates a new planned maintenance / downtime schedule",
-		Request:             new(alertmanagertypes.PostablePlannedMaintenance),
-		RequestContentType:  "application/json",
-		Response:            new(alertmanagertypes.PlannedMaintenance),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.UpdateDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                 "UpdateDowntimeScheduleByID",
+			Tags:               []string{"downtimeschedules"},
+			Summary:            "Update downtime schedule",
+			Description:        "This endpoint updates a downtime schedule by ID",
+			Request:            new(alertmanagertypes.PostablePlannedMaintenance),
+			RequestContentType: "application/json",
+			SuccessStatusCode:  http.StatusNoContent,
+			ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbUpdate),
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbDetach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbAttach),
+				coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbDetach),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				Verb:     coretypes.VerbUpdate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbAttach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceRule,
+				TargetIDs:      ruler.NewDowntimeRuleAttachExtractor(provider.rulerService),
+				TargetSelector: ruler.DowntimeRuleSelector,
+			},
+			handler.AttachDetachSiblingResourceDef{
+				Verb:           coretypes.VerbDetach,
+				Category:       coretypes.ActionCategoryConfigurationChange,
+				SourceResource: coretypes.ResourceMetaResourcePlannedMaintenance,
+				SourceIDs:      coretypes.OneID(coretypes.PathParam("id")),
+				SourceSelector: coretypes.IDSelector,
+				TargetResource: coretypes.ResourceMetaResourceRule,
+				TargetIDs:      ruler.NewDowntimeRuleDetachExtractor(provider.rulerService),
+				TargetSelector: ruler.DowntimeRuleSelector,
+			},
+		),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}
 
-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.UpdateDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                 "UpdateDowntimeScheduleByID",
-		Tags:               []string{"downtimeschedules"},
-		Summary:            "Update downtime schedule",
-		Description:        "This endpoint updates a downtime schedule by ID",
-		Request:            new(alertmanagertypes.PostablePlannedMaintenance),
-		RequestContentType: "application/json",
-		SuccessStatusCode:  http.StatusNoContent,
-		ErrorStatusCodes:   []int{http.StatusBadRequest, http.StatusNotFound},
-		SecuritySchemes:    newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
-		return err
-	}
-
-	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.rulerHandler.DeleteDowntimeScheduleByID), handler.OpenAPIDef{
-		ID:                "DeleteDowntimeScheduleByID",
-		Tags:              []string{"downtimeschedules"},
-		Summary:           "Delete downtime schedule",
-		Description:       "This endpoint deletes a downtime schedule by ID",
-		SuccessStatusCode: http.StatusNoContent,
-		ErrorStatusCodes:  []int{http.StatusNotFound},
-		SecuritySchemes:   newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/downtime_schedules/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.rulerHandler.DeleteDowntimeScheduleByID, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                "DeleteDowntimeScheduleByID",
+			Tags:              []string{"downtimeschedules"},
+			Summary:           "Delete downtime schedule",
+			Description:       "This endpoint deletes a downtime schedule by ID",
+			SuccessStatusCode: http.StatusNoContent,
+			ErrorStatusCodes:  []int{http.StatusNotFound},
+			SecuritySchemes:   newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourcePlannedMaintenance.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourcePlannedMaintenance,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}
 

pkg/apiserver/signozapiserver/rulestatehistory.go

@@ -4,7 +4,10 @@ import (
 	"net/http"
 
 	"github.com/SigNoz/signoz/pkg/http/handler"
-	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/querybuilder"
+	"github.com/SigNoz/signoz/pkg/ruler"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
 	"github.com/SigNoz/signoz/pkg/types/rulestatehistorytypes"
 	"github.com/SigNoz/signoz/pkg/types/telemetrytypes"
 	"github.com/gorilla/mux"
@@ -13,7 +16,7 @@ import (
 func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 
 	if err := router.Handle("/api/v2/rules/{id}/history/stats", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryStats),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryStats, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryStats",
 			Tags:                []string{"rules"},
@@ -24,13 +27,21 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/timeline", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryTimeline, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTimeline",
 			Tags:                []string{"rules"},
@@ -41,13 +52,26 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, telemetryReadScopes()...)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}, handler.TelemetryResourceDef{
+			Verb:      coretypes.VerbRead,
+			Category:  coretypes.ActionCategoryDataAccess,
+			Selector:  querybuilder.TelemetrySelector,
+			Resources: ruler.NewRuleQueryTelemetryResources(provider.rulerService),
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/top_contributors", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryContributors),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryContributors, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryTopContributors",
 			Tags:                []string{"rules"},
@@ -58,13 +82,26 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, telemetryReadScopes()...)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}, handler.TelemetryResourceDef{
+			Verb:      coretypes.VerbRead,
+			Category:  coretypes.ActionCategoryDataAccess,
+			Selector:  querybuilder.TelemetrySelector,
+			Resources: ruler.NewRuleQueryTelemetryResources(provider.rulerService),
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/filter_keys", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterKeys, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterKeys",
 			Tags:                []string{"rules"},
@@ -75,13 +112,26 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, buildFieldScopes(coretypes.VerbList)...)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}, handler.TelemetryResourceDef{
+			Verb:      coretypes.VerbList,
+			Category:  coretypes.ActionCategoryDataAccess,
+			Selector:  coretypes.WildcardSelector,
+			Resources: ruler.NewRuleQueryFieldResources(provider.rulerService),
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/filter_values", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryFilterValues, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryFilterValues",
 			Tags:                []string{"rules"},
@@ -92,13 +142,26 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes(append([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}, buildFieldScopes(coretypes.VerbRead)...)),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}, handler.TelemetryResourceDef{
+			Verb:      coretypes.VerbRead,
+			Category:  coretypes.ActionCategoryDataAccess,
+			Selector:  coretypes.WildcardSelector,
+			Resources: ruler.NewRuleQueryFieldResources(provider.rulerService),
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	if err := router.Handle("/api/v2/rules/{id}/history/overall_status", handler.New(
-		provider.authzMiddleware.ViewAccess(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus),
+		provider.authzMiddleware.CheckResources(provider.ruleStateHistoryHandler.GetRuleHistoryOverallStatus, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
 		handler.OpenAPIDef{
 			ID:                  "GetRuleHistoryOverallStatus",
 			Tags:                []string{"rules"},
@@ -109,10 +172,26 @@ func (provider *provider) addRuleStateHistoryRoutes(router *mux.Router) error {
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusUnauthorized, http.StatusInternalServerError},
-			SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-		})).Methods(http.MethodGet).GetError(); err != nil {
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceRule.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceRule,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}
 
 	return nil
 }
+
+func buildFieldScopes(verb coretypes.Verb) []string {
+	return []string{
+		coretypes.ResourceMetaResourceLogsField.Scope(verb),
+		coretypes.ResourceMetaResourceTracesField.Scope(verb),
+		coretypes.ResourceMetaResourceMetricsField.Scope(verb),
+	}
+}

pkg/http/handler/resourcedef.go

@@ -109,6 +109,8 @@ type TelemetryResourceDef struct {
 	Category  coretypes.ActionCategory
 	Selector  coretypes.SelectorFunc
 	Resources coretypes.ResourceExtractor
+	// Optional skips the check instead of failing when the request carries no telemetry resources.
+	Optional bool
 }
 
 func (def TelemetryResourceDef) resolveRequest(ec coretypes.ExtractorContext) []coretypes.ResolvedResource {
@@ -116,6 +118,9 @@ func (def TelemetryResourceDef) resolveRequest(ec coretypes.ExtractorContext) []
 	if err != nil {
 		return []coretypes.ResolvedResource{coretypes.NewResolvedResourceWithError(def.Verb, def.Category, err)}
 	}
+	if len(refs) == 0 && def.Optional {
+		return nil
+	}
 	if len(refs) == 0 {
 		return []coretypes.ResolvedResource{coretypes.NewResolvedResourceWithError(
 			def.Verb,

pkg/http/handler/resourcedef_test.go

@@ -69,3 +69,43 @@ func TestAttachDetachSiblingResourceDefKeepsEmptySingleID(t *testing.T) {
 	require.True(t, ok)
 	assert.Equal(t, []string{""}, withTarget.TargetIDs())
 }
+
+func TestTelemetryResourceDefWithoutResources(t *testing.T) {
+	testCases := []struct {
+		name     string
+		optional bool
+		wantLen  int
+		wantErr  bool
+	}{
+		{
+			name:     "Required_Errors",
+			optional: false,
+			wantLen:  1,
+			wantErr:  true,
+		},
+		{
+			name:     "Optional_ResolvesNothing",
+			optional: true,
+			wantLen:  0,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			def := TelemetryResourceDef{
+				Verb:      coretypes.VerbRead,
+				Category:  coretypes.ActionCategoryDataAccess,
+				Selector:  coretypes.WildcardSelector,
+				Resources: func(coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) { return nil, nil },
+				Optional:  testCase.optional,
+			}
+
+			resolved := ResolveRequest([]ResourceDef{def}, coretypes.ExtractorContext{})
+
+			require.Len(t, resolved, testCase.wantLen)
+			if testCase.wantErr {
+				assert.Error(t, resolved[0].Err())
+			}
+		})
+	}
+}

pkg/query-service/rules/manager.go

@@ -1043,29 +1043,24 @@ func (m *Manager) PatchRule(ctx context.Context, ruleStr string, id valuer.UUID)
 		return nil, err
 	}
 
-	storedRule := ruletypes.PostableRule{}
-	if err := json.Unmarshal([]byte(storedJSON.Data), &storedRule); err != nil {
-		m.logger.ErrorContext(ctx, "failed to unmarshal rule from db", slog.String("rule.id", id.StringValue()), errors.Attr(err))
-		return nil, err
-	}
-
-	if err := json.Unmarshal([]byte(ruleStr), &storedRule); err != nil {
+	storedRule, err := ruletypes.NewPatchedPostableRule([]byte(storedJSON.Data), []byte(ruleStr))
+	if err != nil {
 		m.logger.ErrorContext(ctx, "failed to unmarshal patched rule with given id", slog.String("rule.id", id.StringValue()), errors.Attr(err))
 		return nil, err
 	}
 	if err := storedRule.Validate(); err != nil {
 		return nil, err
 	}
-	if err := m.validateChannels(ctx, claims.OrgID, &storedRule); err != nil {
+	if err := m.validateChannels(ctx, claims.OrgID, storedRule); err != nil {
 		return nil, err
 	}
 	// deploy or un-deploy task according to patched (new) rule state
-	if err := m.syncRuleStateWithTask(ctx, orgID, taskName, &storedRule); err != nil {
+	if err := m.syncRuleStateWithTask(ctx, orgID, taskName, storedRule); err != nil {
 		m.logger.ErrorContext(ctx, "failed to sync stored rule state with the task", slog.String("task.name", taskName), errors.Attr(err))
 		return nil, err
 	}
 
-	newStoredJson, err := json.Marshal(&storedRule)
+	newStoredJson, err := json.Marshal(storedRule)
 	if err != nil {
 		m.logger.ErrorContext(ctx, "failed to marshal new stored rule with given id", slog.String("rule.id", id.StringValue()), errors.Attr(err))
 		return nil, err
@@ -1078,7 +1073,7 @@ func (m *Manager) PatchRule(ctx context.Context, ruleStr string, id valuer.UUID)
 
 	err = m.ruleStore.EditRule(ctx, storedJSON, func(ctx context.Context) error { return nil })
 	if err != nil {
-		if err := m.syncRuleStateWithTask(ctx, orgID, taskName, &storedRule); err != nil {
+		if err := m.syncRuleStateWithTask(ctx, orgID, taskName, storedRule); err != nil {
 			m.logger.ErrorContext(ctx, "failed to restore rule after patch failure", "task_name", taskName, errors.Attr(err))
 		}
 		return nil, err
@@ -1087,7 +1082,7 @@ func (m *Manager) PatchRule(ctx context.Context, ruleStr string, id valuer.UUID)
 	// prepare http response
 	response := ruletypes.GettableRule{
 		Id:           id.StringValue(),
-		PostableRule: storedRule,
+		PostableRule: *storedRule,
 	}
 
 	// fetch state of rule from memory

pkg/ruler/authz.go

@@ -0,0 +1,463 @@
+package ruler
+
+import (
+	"context"
+	"encoding/json"
+
+	"github.com/SigNoz/signoz/pkg/alertmanager"
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/querybuilder"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types/ruletypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/gorilla/mux"
+	"github.com/tidwall/gjson"
+)
+
+const (
+	attachedSide diffSide = iota
+	detachedSide
+)
+
+type diffSide int
+
+type incomingChannelsFunc func(stored *ruletypes.GettableRule, body []byte) ([]string, error)
+
+var DowntimeRuleIDsExtractor = coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+	ids, err := coretypes.BodyJSONArray("alertIds").Fn(ec)
+	if err != nil {
+		return nil, err
+	}
+
+	return defaultToAllRules(ids), nil
+}}
+
+var DowntimeRuleSelector coretypes.SelectorFunc = func(ctx context.Context, resource coretypes.Resource, id string, orgID valuer.UUID) ([]coretypes.Selector, error) {
+	if id == coretypes.WildCardSelectorString {
+		return coretypes.WildcardSelector(ctx, resource, id, orgID)
+	}
+
+	return coretypes.IDSelector(ctx, resource, id, orgID)
+}
+
+func NewDowntimeRuleAttachExtractor(rulerService Ruler) coretypes.ResourceIDsExtractor {
+	return newDowntimeDiffExtractor(rulerService, attachedSide)
+}
+
+func NewDowntimeRuleDetachExtractor(rulerService Ruler) coretypes.ResourceIDsExtractor {
+	return newDowntimeDiffExtractor(rulerService, detachedSide)
+}
+
+func newDowntimeDiffExtractor(rulerService Ruler, side diffSide) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		scheduleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return nil, err
+		}
+
+		stored, err := rulerService.MaintenanceStore().GetPlannedMaintenanceByID(ec.Request.Context(), scheduleID)
+		if err != nil {
+			return nil, err
+		}
+
+		incoming, err := DowntimeRuleIDsExtractor.Fn(ec)
+		if err != nil {
+			return nil, err
+		}
+
+		attached, detached := diffDowntimeRuleLinks(stored.RuleIDs, incoming)
+		if side == detachedSide {
+			return detached, nil
+		}
+
+		return attached, nil
+	}}
+}
+
+func NewCreateRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		ctx := ec.Request.Context()
+		orgID, err := orgIDFromContext(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		names, err := parseRuleChannels(ec.RequestBody)
+		if err != nil {
+			return nil, err
+		}
+
+		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), names)
+	}}
+}
+
+func NewCloneRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		ctx := ec.Request.Context()
+		orgID, err := orgIDFromContext(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		stored, err := fetchStoredRule(ec, rulerService)
+		if err != nil {
+			return nil, err
+		}
+
+		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), stored.Channels())
+	}}
+}
+
+func NewReplaceRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
+	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parseReplacedRuleChannels, attachedSide)
+}
+
+func NewReplaceRuleChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
+	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parseReplacedRuleChannels, detachedSide)
+}
+
+func NewPatchRuleChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
+	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parsePatchedRuleChannels, attachedSide)
+}
+
+func NewPatchRuleChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler) coretypes.ResourceIDsExtractor {
+	return newRuleChannelDiffExtractor(alertmanagerService, rulerService, parsePatchedRuleChannels, detachedSide)
+}
+
+func newRuleChannelDiffExtractor(alertmanagerService alertmanager.Alertmanager, rulerService Ruler, incoming incomingChannelsFunc, side diffSide) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		ctx := ec.Request.Context()
+		orgID, err := orgIDFromContext(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		stored, err := fetchStoredRule(ec, rulerService)
+		if err != nil {
+			return nil, err
+		}
+
+		incomingNames, err := incoming(stored, ec.RequestBody)
+		if err != nil {
+			return nil, err
+		}
+
+		attached, detached := diffLinks(stored.Channels(), incomingNames)
+		if side == detachedSide {
+			return resolveStoredChannelIDs(ctx, alertmanagerService, orgID, detached)
+		}
+
+		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), attached)
+	}}
+}
+
+func parseReplacedRuleChannels(_ *ruletypes.GettableRule, body []byte) ([]string, error) {
+	return parseRuleChannels(body)
+}
+
+func parsePatchedRuleChannels(stored *ruletypes.GettableRule, body []byte) ([]string, error) {
+	patched, err := applyRulePatch(stored, body)
+	if err != nil {
+		return nil, err
+	}
+
+	return patched.Channels(), nil
+}
+
+func applyRulePatch(stored *ruletypes.GettableRule, body []byte) (*ruletypes.PostableRule, error) {
+	encoded, err := json.Marshal(stored.PostableRule)
+	if err != nil {
+		return nil, err
+	}
+
+	return ruletypes.NewPatchedPostableRule(encoded, body)
+}
+
+func parseRuleChannels(body []byte) ([]string, error) {
+	rule := new(ruletypes.PostableRule)
+	if err := json.Unmarshal(body, rule); err != nil {
+		return nil, err
+	}
+
+	return rule.Channels(), nil
+}
+
+func diffDowntimeRuleLinks(stored, incoming []string) (attached, detached []string) {
+	return diffLinks(defaultToAllRules(stored), incoming)
+}
+
+func defaultToAllRules(ids []string) []string {
+	if len(ids) == 0 {
+		return []string{coretypes.WildCardSelectorString}
+	}
+
+	return ids
+}
+
+func NewCreateRoutePolicyChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		ctx := ec.Request.Context()
+		orgID, err := orgIDFromContext(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		names, err := coretypes.BodyJSONArray("channels").Fn(ec)
+		if err != nil {
+			return nil, err
+		}
+
+		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), names)
+	}}
+}
+
+func NewUpdateRoutePolicyChannelAttachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
+	return newRoutePolicyDiffExtractor(alertmanagerService, attachedSide)
+}
+
+func NewUpdateRoutePolicyChannelDetachExtractor(alertmanagerService alertmanager.Alertmanager) coretypes.ResourceIDsExtractor {
+	return newRoutePolicyDiffExtractor(alertmanagerService, detachedSide)
+}
+
+func newRoutePolicyDiffExtractor(alertmanagerService alertmanager.Alertmanager, side diffSide) coretypes.ResourceIDsExtractor {
+	return coretypes.ResourceIDsExtractor{Phase: coretypes.PhaseRequest, Fn: func(ec coretypes.ExtractorContext) ([]string, error) {
+		if ec.Request == nil {
+			return nil, nil
+		}
+
+		ctx := ec.Request.Context()
+		orgID, err := orgIDFromContext(ctx)
+		if err != nil {
+			return nil, err
+		}
+
+		stored, err := alertmanagerService.GetRoutePolicyByID(ctx, mux.Vars(ec.Request)["id"])
+		if err != nil {
+			return nil, err
+		}
+
+		incoming, err := coretypes.BodyJSONArray("channels").Fn(ec)
+		if err != nil {
+			return nil, err
+		}
+
+		attached, detached := diffLinks(stored.Channels, incoming)
+		if side == detachedSide {
+			return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), detached)
+		}
+
+		return alertmanagerService.GetChannelIDsByNames(ctx, orgID.StringValue(), attached)
+	}}
+}
+
+func resolveStoredChannelIDs(ctx context.Context, alertmanagerService alertmanager.Alertmanager, orgID valuer.UUID, names []string) ([]string, error) {
+	if len(names) == 0 {
+		return nil, nil
+	}
+
+	idByName, err := mapChannelIDsByName(ctx, alertmanagerService, orgID)
+	if err != nil {
+		return nil, err
+	}
+
+	ids := make([]string, 0, len(names))
+	for _, name := range names {
+		if id, ok := idByName[name]; ok {
+			ids = append(ids, id)
+		}
+	}
+
+	return ids, nil
+}
+
+func mapChannelIDsByName(ctx context.Context, alertmanagerService alertmanager.Alertmanager, orgID valuer.UUID) (map[string]string, error) {
+	channels, err := alertmanagerService.ListChannels(ctx, orgID.StringValue())
+	if err != nil {
+		return nil, err
+	}
+
+	idByName := make(map[string]string, len(channels))
+	for _, channel := range channels {
+		idByName[channel.DisplayName] = channel.ID.StringValue()
+	}
+
+	return idByName, nil
+}
+
+func orgIDFromContext(ctx context.Context) (valuer.UUID, error) {
+	claims, err := authtypes.ClaimsFromContext(ctx)
+	if err != nil {
+		return valuer.UUID{}, err
+	}
+
+	return valuer.NewUUID(claims.OrgID)
+}
+
+func NewRuleQueryTelemetryResources(rulerService Ruler) coretypes.ResourceExtractor {
+	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
+		body, err := fetchStoredCompositeQuery(ec, rulerService)
+		if err != nil {
+			return nil, err
+		}
+
+		return querybuilder.QueryRangeResources(coretypes.ExtractorContext{Request: ec.Request, RequestBody: body})
+	}
+}
+
+func NewRuleQueryFieldResources(rulerService Ruler) coretypes.ResourceExtractor {
+	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
+		body, err := fetchStoredCompositeQuery(ec, rulerService)
+		if err != nil {
+			return nil, err
+		}
+
+		return mapFieldResources(body)
+	}
+}
+
+func NewRuleBodyTelemetryResources() coretypes.ResourceExtractor {
+	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
+		compositeQuery := gjson.GetBytes(ec.RequestBody, "condition.compositeQuery")
+		if !compositeQuery.Exists() {
+			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "condition.compositeQuery is required")
+		}
+
+		body, err := json.Marshal(map[string]json.RawMessage{"compositeQuery": json.RawMessage(compositeQuery.Raw)})
+		if err != nil {
+			return nil, err
+		}
+
+		return querybuilder.QueryRangeResources(coretypes.ExtractorContext{Request: ec.Request, RequestBody: body})
+	}
+}
+
+func NewOptionalRuleBodyTelemetryResources() coretypes.ResourceExtractor {
+	return func(ec coretypes.ExtractorContext) ([]coretypes.ResourceWithID, error) {
+		if !gjson.GetBytes(ec.RequestBody, "condition.compositeQuery").Exists() {
+			return nil, nil
+		}
+
+		return NewRuleBodyTelemetryResources()(ec)
+	}
+}
+
+func fetchStoredRule(ec coretypes.ExtractorContext, rulerService Ruler) (*ruletypes.GettableRule, error) {
+	ruleID, err := valuer.NewUUID(mux.Vars(ec.Request)["id"])
+	if err != nil {
+		return nil, err
+	}
+
+	return rulerService.GetRule(ec.Request.Context(), ruleID)
+}
+
+func fetchStoredCompositeQuery(ec coretypes.ExtractorContext, rulerService Ruler) ([]byte, error) {
+	if ec.Request == nil {
+		return nil, nil
+	}
+
+	stored, err := fetchStoredRule(ec, rulerService)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(map[string]any{"compositeQuery": stored.RuleCondition.CompositeQuery})
+}
+
+func mapFieldResources(body []byte) ([]coretypes.ResourceWithID, error) {
+	telemetry, err := querybuilder.QueryRangeResources(coretypes.ExtractorContext{RequestBody: body})
+	if err != nil {
+		return nil, err
+	}
+
+	seen := make(map[string]struct{}, 3)
+	refs := make([]coretypes.ResourceWithID, 0, 3)
+	for _, ref := range telemetry {
+		field, err := fieldResourceForKind(ref.Resource.Kind())
+		if err != nil {
+			return nil, err
+		}
+
+		kind := field.Kind().String()
+		if _, ok := seen[kind]; ok {
+			continue
+		}
+		seen[kind] = struct{}{}
+		refs = append(refs, coretypes.ResourceWithID{Resource: field})
+	}
+
+	return refs, nil
+}
+
+func fieldResourceForKind(kind coretypes.Kind) (coretypes.Resource, error) {
+	switch kind {
+	case coretypes.KindLogs, coretypes.KindAuditLogs:
+		return coretypes.ResourceMetaResourceLogsField, nil
+	case coretypes.KindTraces:
+		return coretypes.ResourceMetaResourceTracesField, nil
+	case coretypes.KindMetrics, coretypes.KindMeterMetrics:
+		return coretypes.ResourceMetaResourceMetricsField, nil
+	default:
+		return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "no field resource for telemetry kind %q", kind.String())
+	}
+}
+
+func diffLinks(stored, incoming []string) (attached, detached []string) {
+	storedSet := make(map[string]struct{}, len(stored))
+	for _, id := range stored {
+		storedSet[id] = struct{}{}
+	}
+
+	incomingSet := make(map[string]struct{}, len(incoming))
+	for _, id := range incoming {
+		incomingSet[id] = struct{}{}
+	}
+
+	seen := make(map[string]struct{}, len(incoming))
+	attached = make([]string, 0, len(incoming))
+	for _, id := range incoming {
+		if _, ok := storedSet[id]; ok {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		attached = append(attached, id)
+	}
+
+	clear(seen)
+	detached = make([]string, 0, len(stored))
+	for _, id := range stored {
+		if _, ok := incomingSet[id]; ok {
+			continue
+		}
+		if _, ok := seen[id]; ok {
+			continue
+		}
+		seen[id] = struct{}{}
+		detached = append(detached, id)
+	}
+
+	return attached, detached
+}

pkg/ruler/authz_test.go

@@ -0,0 +1,588 @@
+package ruler
+
+import (
+	"context"
+	"encoding/json"
+	"testing"
+
+	"github.com/SigNoz/signoz/pkg/alertmanager/alertmanagertest"
+	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/types/alertmanagertypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/SigNoz/signoz/pkg/types/ruletypes"
+	"github.com/SigNoz/signoz/pkg/valuer"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+func TestDiffLinks(t *testing.T) {
+	testCases := []struct {
+		name         string
+		stored       []string
+		incoming     []string
+		wantAttached []string
+		wantDetached []string
+	}{
+		{
+			name:         "BothEmpty_NothingChanges",
+			wantAttached: []string{},
+			wantDetached: []string{},
+		},
+		{
+			name:         "NoStored_EverythingAttaches",
+			incoming:     []string{"slack", "pager"},
+			wantAttached: []string{"slack", "pager"},
+			wantDetached: []string{},
+		},
+		{
+			name:         "NoIncoming_EverythingDetaches",
+			stored:       []string{"slack", "pager"},
+			wantAttached: []string{},
+			wantDetached: []string{"slack", "pager"},
+		},
+		{
+			name:         "Unchanged_NothingChanges",
+			stored:       []string{"slack", "pager"},
+			incoming:     []string{"pager", "slack"},
+			wantAttached: []string{},
+			wantDetached: []string{},
+		},
+		{
+			name:         "OneAddedOneRemoved_BothSidesReported",
+			stored:       []string{"slack", "pager"},
+			incoming:     []string{"slack", "email"},
+			wantAttached: []string{"email"},
+			wantDetached: []string{"pager"},
+		},
+		{
+			name:         "DuplicateIncoming_CollapsedOnce",
+			incoming:     []string{"slack", "slack"},
+			wantAttached: []string{"slack"},
+			wantDetached: []string{},
+		},
+		{
+			name:         "DuplicateStored_CollapsedOnce",
+			stored:       []string{"pager", "pager"},
+			wantAttached: []string{},
+			wantDetached: []string{"pager"},
+		},
+		{
+			name:         "IncomingOrderPreserved",
+			stored:       []string{"keep"},
+			incoming:     []string{"zebra", "keep", "apple"},
+			wantAttached: []string{"zebra", "apple"},
+			wantDetached: []string{},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			attached, detached := diffLinks(testCase.stored, testCase.incoming)
+
+			assert.Equal(t, testCase.wantAttached, attached)
+			assert.Equal(t, testCase.wantDetached, detached)
+		})
+	}
+}
+
+func TestDiffDowntimeRuleLinks(t *testing.T) {
+	testCases := []struct {
+		name         string
+		stored       []string
+		incoming     []string
+		wantAttached []string
+		wantDetached []string
+	}{
+		{
+			name:         "AllToAll_NoChange",
+			stored:       nil,
+			incoming:     []string{"*"},
+			wantAttached: []string{},
+			wantDetached: []string{},
+		},
+		{
+			name:         "NarrowFromAllToOne_DetachesAllAttachesOne",
+			stored:       nil,
+			incoming:     []string{"r1"},
+			wantAttached: []string{"r1"},
+			wantDetached: []string{"*"},
+		},
+		{
+			name:         "WidenFromOneToAll_DetachesOneAttachesAll",
+			stored:       []string{"r1"},
+			incoming:     []string{"*"},
+			wantAttached: []string{"*"},
+			wantDetached: []string{"r1"},
+		},
+		{
+			name:         "SwapRules_DiffsIDs",
+			stored:       []string{"r1"},
+			incoming:     []string{"r2"},
+			wantAttached: []string{"r2"},
+			wantDetached: []string{"r1"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			attached, detached := diffDowntimeRuleLinks(testCase.stored, testCase.incoming)
+
+			assert.ElementsMatch(t, testCase.wantAttached, attached)
+			assert.ElementsMatch(t, testCase.wantDetached, detached)
+		})
+	}
+}
+
+func TestDowntimeRuleIDsExtractor(t *testing.T) {
+	testCases := []struct {
+		name    string
+		body    string
+		wantIDs []string
+	}{
+		{
+			name:    "MissingAlertIds_AllRules",
+			body:    `{"name": "window"}`,
+			wantIDs: []string{"*"},
+		},
+		{
+			name:    "EmptyAlertIds_AllRules",
+			body:    `{"alertIds": []}`,
+			wantIDs: []string{"*"},
+		},
+		{
+			name:    "ExplicitAlertIds_Kept",
+			body:    `{"alertIds": ["r1", "r2"]}`,
+			wantIDs: []string{"r1", "r2"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			ids, err := DowntimeRuleIDsExtractor.Fn(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+
+			require.NoError(t, err)
+			assert.Equal(t, testCase.wantIDs, ids)
+		})
+	}
+}
+
+func TestMapFieldResources(t *testing.T) {
+	testCases := []struct {
+		name      string
+		body      string
+		wantKinds []coretypes.Kind
+		wantErr   bool
+	}{
+		{
+			name:      "Builder_Logs_LogsField",
+			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs"}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindLogsField},
+		},
+		{
+			name:      "Builder_Traces_TracesField",
+			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"traces"}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindTracesField},
+		},
+		{
+			name:      "Builder_Metrics_MetricsField",
+			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"metrics"}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
+		},
+		{
+			name:      "SubQuery_Metrics_MetricsField",
+			body:      `{"compositeQuery":{"queries":[{"type":"builder_sub_query","spec":{"signal":"metrics"}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
+		},
+		{
+			name:      "BuilderAI_TracesField",
+			body:      `{"compositeQuery":{"queries":[{"type":"builder_ai_query","spec":{}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindTracesField},
+		},
+		{
+			name:      "PromQL_MetricsField",
+			body:      `{"compositeQuery":{"queries":[{"type":"promql","spec":{}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
+		},
+		{
+			name:      "ClickHouseSQL_AllThreeFields",
+			body:      `{"compositeQuery":{"queries":[{"type":"clickhouse_sql","spec":{}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindLogsField, coretypes.KindTracesField, coretypes.KindMetricsField},
+		},
+		{
+			name:      "Builder_AuditLogs_LogsField",
+			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs","source":"audit"}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindLogsField},
+		},
+		{
+			name:      "Builder_MeterMetrics_MetricsField",
+			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"metrics","source":"meter"}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
+		},
+		{
+			name:      "TwoBuilderSameSignal_Deduped",
+			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"metrics"}},{"type":"builder_query","spec":{"signal":"metrics"}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindMetricsField},
+		},
+		{
+			name:      "FormulaAlongsideBuilder_FormulaSkipped",
+			body:      `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"logs"}},{"type":"builder_formula","spec":{}}]}}`,
+			wantKinds: []coretypes.Kind{coretypes.KindLogsField},
+		},
+		{
+			name:    "NoQueries_Errors",
+			body:    `{"compositeQuery":{"queries":[]}}`,
+			wantErr: true,
+		},
+		{
+			name:    "UnknownSignal_Errors",
+			body:    `{"compositeQuery":{"queries":[{"type":"builder_query","spec":{"signal":"events"}}]}}`,
+			wantErr: true,
+		},
+		{
+			name:    "UnknownQueryType_Errors",
+			body:    `{"compositeQuery":{"queries":[{"type":"graphql","spec":{}}]}}`,
+			wantErr: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			refs, err := mapFieldResources([]byte(testCase.body))
+
+			if testCase.wantErr {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			kinds := make([]coretypes.Kind, 0, len(refs))
+			for _, ref := range refs {
+				kinds = append(kinds, ref.Resource.Kind())
+			}
+			assert.Equal(t, testCase.wantKinds, kinds)
+		})
+	}
+}
+
+func v1RuleJSON(preferredChannels string) string {
+	return `{
+		"alert": "TestAlert",
+		"version": "v5",
+		"condition": {
+			"compositeQuery": {
+				"queryType": "builder",
+				"queries": [{
+					"type": "builder_query",
+					"spec": {
+						"name": "A",
+						"signal": "metrics",
+						"aggregations": [{"metricName": "cpu", "spaceAggregation": "p50"}],
+						"stepInterval": "5m"
+					}
+				}]
+			},
+			"target": 10.0,
+			"matchType": "1",
+			"op": "1"
+		}` + preferredChannels + `
+	}`
+}
+
+func v2RuleJSON(channels string) string {
+	return `{
+		"alert": "TestAlert",
+		"version": "v5",
+		"schemaVersion": "v2alpha1",
+		"ruleType": "threshold_rule",
+		"condition": {
+			"compositeQuery": {
+				"queryType": "builder",
+				"queries": [{
+					"type": "builder_query",
+					"spec": {
+						"name": "A",
+						"signal": "metrics",
+						"aggregations": [{"metricName": "cpu", "spaceAggregation": "p50"}],
+						"stepInterval": "5m"
+					}
+				}]
+			},
+			"thresholds": {
+				"kind": "basic",
+				"spec": [{"name": "critical", "target": 90.0, "matchType": "1", "op": "1", "channels": ` + channels + `}]
+			}
+		},
+		"evaluation": {
+			"kind": "rolling",
+			"spec": {"evalWindow": "5m", "frequency": "1m"}
+		},
+		"notificationSettings": {
+			"renotify": {"enabled": true, "interval": "4h", "alertStates": ["firing"]}
+		}
+	}`
+}
+
+func TestParseRuleChannels(t *testing.T) {
+	testCases := []struct {
+		name         string
+		body         string
+		wantChannels []string
+		wantErr      bool
+	}{
+		{
+			name:         "V1PreferredChannels_FoldedIntoThresholds",
+			body:         v1RuleJSON(`, "preferredChannels": ["slack", "pager"]`),
+			wantChannels: []string{"slack", "pager"},
+		},
+		{
+			name:         "V1NoChannels_Empty",
+			body:         v1RuleJSON(""),
+			wantChannels: nil,
+		},
+		{
+			name:         "V2ThresholdChannels_ReadDirectly",
+			body:         v2RuleJSON(`["email"]`),
+			wantChannels: []string{"email"},
+		},
+		{
+			name:         "V2EmptyChannels_Empty",
+			body:         v2RuleJSON(`[]`),
+			wantChannels: nil,
+		},
+		{
+			name:    "NotJSON_Errors",
+			body:    "not json",
+			wantErr: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			channels, err := parseRuleChannels([]byte(testCase.body))
+
+			if testCase.wantErr {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, testCase.wantChannels, channels)
+		})
+	}
+}
+
+func TestIncomingRuleChannels(t *testing.T) {
+	testCases := []struct {
+		name            string
+		incoming        incomingChannelsFunc
+		stored          string
+		body            string
+		wantChannels    []string
+		wantStoredAfter []string
+	}{
+		{
+			name:            "Replaced_IgnoresStored",
+			incoming:        parseReplacedRuleChannels,
+			stored:          v2RuleJSON(`["slack"]`),
+			body:            v2RuleJSON(`["pager"]`),
+			wantChannels:    []string{"pager"},
+			wantStoredAfter: []string{"slack"},
+		},
+		{
+			name:            "Patched_OmitsCondition_StoredChannelsSurvive",
+			incoming:        parsePatchedRuleChannels,
+			stored:          v2RuleJSON(`["slack"]`),
+			body:            `{"disabled": true}`,
+			wantChannels:    []string{"slack"},
+			wantStoredAfter: []string{"slack"},
+		},
+		{
+			name:            "Patched_SetsChannels_StoredChannelsReplaced",
+			incoming:        parsePatchedRuleChannels,
+			stored:          v2RuleJSON(`["slack"]`),
+			body:            v2RuleJSON(`["pager"]`),
+			wantChannels:    []string{"pager"},
+			wantStoredAfter: []string{"slack"},
+		},
+		{
+			name:            "Patched_EmptiesChannels_NoChannelsLeft",
+			incoming:        parsePatchedRuleChannels,
+			stored:          v2RuleJSON(`["slack"]`),
+			body:            v2RuleJSON(`[]`),
+			wantChannels:    nil,
+			wantStoredAfter: []string{"slack"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			stored := new(ruletypes.GettableRule)
+			require.NoError(t, json.Unmarshal([]byte(testCase.stored), &stored.PostableRule))
+
+			channels, err := testCase.incoming(stored, []byte(testCase.body))
+
+			require.NoError(t, err)
+			assert.Equal(t, testCase.wantChannels, channels)
+			assert.Equal(t, testCase.wantStoredAfter, stored.Channels())
+		})
+	}
+}
+
+func TestRuleBodyTelemetryResources(t *testing.T) {
+	testCases := []struct {
+		name     string
+		body     string
+		wantKind coretypes.Kind
+		wantID   string
+		wantErr  bool
+	}{
+		{
+			name:     "V5Body_NoFilter_MetricsWildcard",
+			body:     v2RuleJSON(`[]`),
+			wantKind: coretypes.KindMetrics,
+			wantID:   "builder_query/*",
+		},
+		{
+			name:     "V1Body_PreferredChannels_MetricsWildcard",
+			body:     v1RuleJSON(`, "preferredChannels": ["slack"]`),
+			wantKind: coretypes.KindMetrics,
+			wantID:   "builder_query/*",
+		},
+		{
+			name:    "MissingCondition_Errors",
+			body:    `{"alert": "TestAlert", "version": "v5"}`,
+			wantErr: true,
+		},
+		{
+			name:    "NotJSON_Errors",
+			body:    "not json",
+			wantErr: true,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			refs, err := NewRuleBodyTelemetryResources()(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+
+			if testCase.wantErr {
+				assert.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			require.Len(t, refs, 1)
+			assert.Equal(t, testCase.wantKind, refs[0].Resource.Kind())
+			assert.Equal(t, testCase.wantID, refs[0].ID)
+		})
+	}
+}
+
+func TestApplyRulePatch(t *testing.T) {
+	logsQuery := `{"condition": {"compositeQuery": {"queryType": "builder", "queries": [{"type": "builder_query", "spec": {"name": "A", "signal": "logs", "stepInterval": "5m"}}]}}}`
+	testCases := []struct {
+		name         string
+		body         string
+		wantSignal   string
+		wantChannels []string
+	}{
+		{
+			name:         "BodyWithoutCondition_KeepsStoredQueryAndChannels",
+			body:         `{"disabled": true}`,
+			wantSignal:   "metrics",
+			wantChannels: []string{"slack"},
+		},
+		{
+			name:         "BodyWithNewQuery_ReplacesSignalKeepsThresholds",
+			body:         logsQuery,
+			wantSignal:   "logs",
+			wantChannels: []string{"slack"},
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			stored := new(ruletypes.GettableRule)
+			require.NoError(t, json.Unmarshal([]byte(v2RuleJSON(`["slack"]`)), &stored.PostableRule))
+
+			patched, err := applyRulePatch(stored, []byte(testCase.body))
+
+			require.NoError(t, err)
+			require.NotNil(t, patched.RuleCondition)
+			require.NotNil(t, patched.RuleCondition.CompositeQuery)
+			encoded, err := json.Marshal(patched.RuleCondition.CompositeQuery)
+			require.NoError(t, err)
+			assert.Contains(t, string(encoded), `"signal":"`+testCase.wantSignal+`"`)
+			assert.Equal(t, testCase.wantChannels, patched.Channels())
+		})
+	}
+}
+
+func TestOptionalRuleBodyTelemetryResources(t *testing.T) {
+	testCases := []struct {
+		name     string
+		body     string
+		wantRefs int
+	}{
+		{
+			name:     "BodyWithoutCondition_NoResources",
+			body:     `{"disabled": true}`,
+			wantRefs: 0,
+		},
+		{
+			name:     "BodyWithQuery_MetricsResource",
+			body:     v2RuleJSON(`[]`),
+			wantRefs: 1,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			refs, err := NewOptionalRuleBodyTelemetryResources()(coretypes.ExtractorContext{RequestBody: []byte(testCase.body)})
+
+			require.NoError(t, err)
+			assert.Len(t, refs, testCase.wantRefs)
+		})
+	}
+}
+
+func TestResolveStoredChannelIDs(t *testing.T) {
+	channels := []*alertmanagertypes.Channel{
+		{Identifiable: types.Identifiable{ID: valuer.GenerateUUID()}, Name: "slack", DisplayName: "slack"},
+	}
+	testCases := []struct {
+		name    string
+		names   []string
+		wantIDs []string
+	}{
+		{
+			name:    "KnownName_Resolved",
+			names:   []string{"slack"},
+			wantIDs: []string{channels[0].ID.StringValue()},
+		},
+		{
+			name:    "UnknownName_Skipped",
+			names:   []string{"slack", "gone"},
+			wantIDs: []string{channels[0].ID.StringValue()},
+		},
+		{
+			name:    "NoNames_NoLookup",
+			names:   nil,
+			wantIDs: nil,
+		},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			alertmanagerService := alertmanagertest.NewMockAlertmanager(t)
+			if len(testCase.names) > 0 {
+				alertmanagerService.EXPECT().ListChannels(mock.Anything, mock.Anything).Return(channels, nil)
+			}
+
+			ids, err := resolveStoredChannelIDs(context.Background(), alertmanagerService, valuer.GenerateUUID(), testCase.names)
+
+			require.NoError(t, err)
+			assert.Equal(t, testCase.wantIDs, ids)
+		})
+	}
+}

pkg/signoz/openapi.go

@@ -100,10 +100,12 @@ func NewOpenAPI(ctx context.Context, instrumentation instrumentation.Instrumenta
 		struct{ rulestatehistory.Handler }{},
 		struct{ spanmapper.Handler }{},
 		struct{ alertmanager.Handler }{},
+		struct{ alertmanager.Alertmanager }{},
 		struct{ prometheus.Handler }{},
 		struct{ llmpricingrule.Handler }{},
 		struct{ tracedetail.Handler }{},
 		struct{ ruler.Handler }{},
+		struct{ ruler.Ruler }{},
 		struct{ statsreporter.Handler }{},
 		struct{ savedview.Handler }{},
 		global.Config{},

pkg/signoz/provider.go

@@ -48,6 +48,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/prometheus/clickhouseprometheusv2"
 	"github.com/SigNoz/signoz/pkg/querier"
 	"github.com/SigNoz/signoz/pkg/querier/signozquerier"
+	"github.com/SigNoz/signoz/pkg/ruler"
 	"github.com/SigNoz/signoz/pkg/sharder"
 	"github.com/SigNoz/signoz/pkg/sharder/noopsharder"
 	"github.com/SigNoz/signoz/pkg/sharder/singlesharder"
@@ -266,6 +267,9 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewAddMetricsFieldTuplesFactory(sqlstore),
 		sqlmigration.NewAddGCPConnectionMethodFactory(),
 		sqlmigration.NewDeleteOrphanSARolesFactory(),
+		sqlmigration.NewAddRoutePolicyTuplesFactory(sqlstore),
+		sqlmigration.NewAddDowntimeTuplesFactory(sqlstore),
+		sqlmigration.NewAddRuleTuplesFactory(sqlstore),
 	)
 }
 
@@ -330,7 +334,7 @@ func NewQuerierProviderFactories(telemetryStore telemetrystore.TelemetryStore, p
 	)
 }
 
-func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
+func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.AuthZ, modules Modules, handlers Handlers, globalConfig global.Config, gatewayService gateway.Gateway, identNResolver identn.IdentNResolver, sharder sharder.Sharder, auditor auditor.Auditor, web web.Web, alertmanagerService alertmanager.Alertmanager, rulerService ruler.Ruler) factory.NamedMap[factory.ProviderFactory[apiserver.APIServer, apiserver.Config]] {
 	return factory.MustNewNamedMap(
 		signozapiserver.NewFactory(
 			orgGetter,
@@ -367,10 +371,12 @@ func NewAPIServerProviderFactories(orgGetter organization.Getter, authz authz.Au
 			handlers.RuleStateHistory,
 			handlers.SpanMapperHandler,
 			handlers.AlertmanagerHandler,
+			alertmanagerService,
 			handlers.PrometheusHandler,
 			handlers.LLMPricingRuleHandler,
 			handlers.TraceDetail,
 			handlers.RulerHandler,
+			rulerService,
 			handlers.StatsHandler,
 			handlers.SavedView,
 			globalConfig,

pkg/signoz/provider_test.go

@@ -106,6 +106,8 @@ func TestNewProviderFactories(t *testing.T) {
 			nil,
 			nil,
 			nil,
+			nil,
+			nil,
 		)
 	})
 }

pkg/signoz/signoz.go

@@ -622,7 +622,7 @@ func New(
 		ctx,
 		providerSettings,
 		config.APIServer,
-		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web),
+		NewAPIServerProviderFactories(orgGetter, authz, modules, handlers, config.Global, gateway, identNResolver, sharder, auditor, web, alertmanager, rulerInstance),
 		"signoz",
 	)
 	if err != nil {

pkg/sqlmigration/140_add_route_policy_tuples.go

@@ -0,0 +1,173 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addRoutePolicyTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddRoutePolicyTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_route_policy_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addRoutePolicyTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addRoutePolicyTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addRoutePolicyTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	crudVerbs := []string{"create", "read", "update", "delete", "list"}
+	readVerbs := []string{"read", "list"}
+	linkVerbs := []string{"attach", "detach"}
+
+	tuples := make([]migrationTuple, 0, 15)
+	for _, verb := range crudVerbs {
+		tuples = append(tuples, migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "route-policy", verb})
+	}
+	for _, verb := range readVerbs {
+		tuples = append(tuples,
+			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "route-policy", verb},
+			migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "route-policy", verb},
+		)
+	}
+	for _, verb := range linkVerbs {
+		tuples = append(tuples,
+			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "route-policy", verb},
+			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "notification-channel", verb},
+			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "notification-channel", verb},
+		)
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
+	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
+		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
+		if err != nil {
+			return err
+		}
+		managedRoleGroups[roleName] = string(data)
+	}
+
+	for _, orgID := range orgIDs {
+		for roleName, data := range managedRoleGroups {
+			if _, err := tx.NewUpdate().
+				Model(new(roles)).
+				Set("transaction_groups = ?", data).
+				Where("org_id = ?", orgID).
+				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
+				Where("name = ?", roleName).
+				Exec(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addRoutePolicyTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/sqlmigration/141_add_downtime_tuples.go

@@ -0,0 +1,174 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/SigNoz/signoz/pkg/types/coretypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addDowntimeTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddDowntimeTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_downtime_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addDowntimeTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addDowntimeTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addDowntimeTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	crudVerbs := []string{"create", "read", "update", "delete", "list"}
+	readVerbs := []string{"read", "list"}
+	linkVerbs := []string{"attach", "detach"}
+
+	tuples := make([]migrationTuple, 0, 20)
+	for _, verb := range crudVerbs {
+		tuples = append(tuples,
+			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "planned-maintenance", verb},
+			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "planned-maintenance", verb},
+		)
+	}
+	for _, verb := range readVerbs {
+		tuples = append(tuples, migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "planned-maintenance", verb})
+	}
+	for _, objectName := range []string{"planned-maintenance", "rule"} {
+		for _, verb := range linkVerbs {
+			tuples = append(tuples,
+				migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", objectName, verb},
+				migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", objectName, verb},
+			)
+		}
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
+	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
+		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
+		if err != nil {
+			return err
+		}
+		managedRoleGroups[roleName] = string(data)
+	}
+
+	for _, orgID := range orgIDs {
+		for roleName, data := range managedRoleGroups {
+			if _, err := tx.NewUpdate().
+				Model(new(roles)).
+				Set("transaction_groups = ?", data).
+				Where("org_id = ?", orgID).
+				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
+				Where("name = ?", roleName).
+				Exec(ctx); err != nil {
+				return err
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addDowntimeTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/sqlmigration/142_add_rule_tuples.go

@@ -0,0 +1,140 @@
+package sqlmigration
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addRuleTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddRuleTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_rule_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addRuleTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addRuleTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addRuleTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	err = tx.NewSelect().
+		Table("organizations").
+		Column("id").
+		Scan(ctx, &orgIDs)
+	if err != nil && err != sql.ErrNoRows {
+		return err
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	crudVerbs := []string{"create", "read", "update", "delete", "list"}
+	readVerbs := []string{"read", "list"}
+
+	tuples := make([]migrationTuple, 0, 12)
+	for _, verb := range crudVerbs {
+		tuples = append(tuples,
+			migrationTuple{authtypes.SigNozAdminRoleName, "metaresource", "rule", verb},
+			migrationTuple{authtypes.SigNozEditorRoleName, "metaresource", "rule", verb},
+		)
+	}
+	for _, verb := range readVerbs {
+		tuples = append(tuples, migrationTuple{authtypes.SigNozViewerRoleName, "metaresource", "rule", verb})
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addRuleTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}

pkg/types/alertmanagertypes/channel.go

@@ -150,6 +150,24 @@ func NewConfigFromChannels(globalConfig GlobalConfig, routeConfig RouteConfig, c
 	return cfg, nil
 }
 
+func MapChannelNamesToIDs(channels Channels, names []string) ([]string, error) {
+	idByName := make(map[string]string, len(channels))
+	for _, channel := range channels {
+		idByName[channel.DisplayName] = channel.ID.StringValue()
+	}
+
+	ids := make([]string, 0, len(names))
+	for _, name := range names {
+		id, ok := idByName[name]
+		if !ok {
+			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "notification channel %q does not exist", name)
+		}
+		ids = append(ids, id)
+	}
+
+	return ids, nil
+}
+
 func NewStatsFromChannels(channels Channels) map[string]any {
 	stats := make(map[string]any)
 	for _, channel := range channels {

pkg/types/alertmanagertypes/channel_test.go

@@ -6,9 +6,12 @@ import (
 	"testing"
 	"time"
 
+	"github.com/SigNoz/signoz/pkg/types"
+	"github.com/SigNoz/signoz/pkg/valuer"
 	"github.com/prometheus/alertmanager/config"
 	"github.com/prometheus/common/model"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestNewConfigFromChannels(t *testing.T) {
@@ -296,3 +299,36 @@ func TestNewChannelFromReceiverGoogleChat(t *testing.T) {
 		channel.Data,
 	)
 }
+
+func TestMapChannelNamesToIDs(t *testing.T) {
+	slackID := valuer.GenerateUUID()
+	pagerID := valuer.GenerateUUID()
+	channels := Channels{
+		{Identifiable: types.Identifiable{ID: slackID}, DisplayName: "slack"},
+		{Identifiable: types.Identifiable{ID: pagerID}, DisplayName: "pager"},
+	}
+
+	testCases := []struct {
+		name    string
+		names   []string
+		want    []string
+		wantErr bool
+	}{
+		{name: "AllKnown_IDsInRequestOrder", names: []string{"pager", "slack"}, want: []string{pagerID.StringValue(), slackID.StringValue()}},
+		{name: "UnknownName_Errors", names: []string{"slack", "missing"}, wantErr: true},
+		{name: "NoNames_Empty", names: nil, want: []string{}},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			got, err := MapChannelNamesToIDs(channels, testCase.names)
+			if testCase.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, testCase.want, got)
+		})
+	}
+}

pkg/types/coretypes/registry_managed_role.go

@@ -134,12 +134,16 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		// rule — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		// saved-view — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
@@ -172,12 +176,16 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		// route-policy — admin writes, viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		// apdex-setting — admin updates, viewer reads
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindApdexSetting}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindApdexSetting}, WildCardSelectorString)},
@@ -241,12 +249,16 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindPlannedMaintenance}, WildCardSelectorString)},
 		// rule — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbDelete, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbCreate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRule}, WildCardSelectorString)},
 		// saved-view — full CRUD
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
 		{Verb: VerbUpdate, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindSavedView}, WildCardSelectorString)},
@@ -282,6 +294,8 @@ var ManagedRoleToTransactions = map[string][]Transaction{
 		// notification-channel — read only (admin writes)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
+		{Verb: VerbAttach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
+		{Verb: VerbDetach, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindNotificationChannel}, WildCardSelectorString)},
 		// route-policy — read only (admin writes)
 		{Verb: VerbRead, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},
 		{Verb: VerbList, Object: *MustNewObject(ResourceRef{Type: TypeMetaResource, Kind: KindRoutePolicy}, WildCardSelectorString)},

pkg/types/coretypes/registry_resource.go

@@ -48,7 +48,7 @@ var (
 	ResourceRole                                         = NewResourceRole()
 	ResourceServiceAccount                               = NewResourceServiceAccount()
 	ResourceUser                                         = NewResourceUser()
-	ResourceMetaResourceNotificationChannel              = NewResourceMetaResource(KindNotificationChannel, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
+	ResourceMetaResourceNotificationChannel              = NewResourceMetaResource(KindNotificationChannel)
 	ResourceMetaResourceRoutePolicy                      = NewResourceMetaResource(KindRoutePolicy)
 	ResourceMetaResourceApdexSetting                     = NewResourceMetaResource(KindApdexSetting)
 	ResourceMetaResourceAuthDomain                       = NewResourceMetaResource(KindAuthDomain)

pkg/types/ruletypes/api_params.go

@@ -336,6 +336,19 @@ func (r *PostableRule) UnmarshalJSON(bytes []byte) error {
 	return r.validate()
 }
 
+func NewPatchedPostableRule(stored, patch []byte) (*PostableRule, error) {
+	patched := new(PostableRule)
+	if err := json.Unmarshal(stored, patched); err != nil {
+		return nil, err
+	}
+
+	if err := json.Unmarshal(patch, patched); err != nil {
+		return nil, err
+	}
+
+	return patched, nil
+}
+
 var _ jsonschema.Preparer = PostableRule{}
 
 // PrepareJSONSchema marks version and source deprecated: nothing reads them,

tests/e2e/drivers/query-builder.ts

@@ -1,715 +0,0 @@
-/**
- * AI-owned. Generated and maintained by coding agents alongside the specs that
- * use it. Do not hand-edit: regenerate it with the spec that needs the change.
- */
-import {
-	expect,
-	type Locator,
-	type Page,
-	type Request,
-} from '@playwright/test';
-
-import { ownDropdown } from '../helpers/alert-forms/shared';
-import { postToSeeder } from '../helpers/alerts/seeding';
-import { watchConsole, type ConsoleWatch } from '../helpers/common';
-import { isQueryRange } from '../helpers/query-range-mock';
-import { dismissQuickFiltersAnnouncement } from '../helpers/quick-filters';
-
-import { driver, kit, seeded } from './kit';
-
-export const EXPLORER = {
-	logs: '/logs/logs-explorer',
-	traces: '/traces-explorer',
-	metrics: '/metrics-explorer/explorer',
-} as const;
-
-/** A monotonic Sum in the golden dataset. */
-export const SUM_METRIC = 'signoz_calls_total';
-/** Another golden Sum, for switching between metrics of one type. */
-export const OTHER_SUM_METRIC = 'signoz_latency_count';
-
-/** The golden dataset has only Sums; these are seeded per worker. */
-export interface MetricTypes {
-	gauge: string;
-	histogram: string;
-}
-
-/** Inside the golden dataset's window. */
-export const RELATIVE_TIME = '6h';
-
-/** One entry of a v5 `query_range` body's `compositeQuery.queries`. */
-export interface V5Query {
-	type: string;
-	spec: {
-		name?: string;
-		signal?: string;
-		disabled?: boolean;
-		filter?: { expression?: string };
-		aggregations?: {
-			expression?: string;
-			metricName?: string;
-			timeAggregation?: string;
-			spaceAggregation?: string;
-			reduceTo?: string;
-		}[];
-		groupBy?: { name: string }[];
-		having?: { expression?: string };
-		order?: { key: { name: string }; direction: string }[];
-		limit?: number;
-		stepInterval?: number;
-		[key: string]: unknown;
-	};
-}
-
-export interface V5Body {
-	requestType: string;
-	compositeQuery: { queries: V5Query[] };
-}
-
-export interface FilterEditor {
-	root(): Locator;
-	/** The contenteditable CodeMirror surface. */
-	content(): Locator;
-	/** Replaces the expression by typing it key by key. */
-	type(text: string): Promise<void>;
-	/** Appends at the caret without clearing. */
-	append(text: string): Promise<void>;
-	clear(): Promise<void>;
-	press(key: string): Promise<void>;
-	/** The document text, placeholder excluded, lines joined with `\n`. */
-	expression(): Promise<string>;
-	lineCount(): Locator;
-	/** The open autocomplete popup. */
-	suggestions(): Locator;
-	/**
-	 * Ctrl+Space: opens the popup at the caret. Typing opens it only once the
-	 * debounced key fetch answers, which a loaded stack can delay past a test's
-	 * next step.
-	 */
-	openSuggestions(): Promise<void>;
-	suggestion(label: string | RegExp): Locator;
-}
-
-export interface QueryBlock {
-	root(): Locator;
-	filter: FilterEditor;
-	/** The filter's status icon: shown only while unfocused and non-empty. */
-	filterStatus(): Locator;
-	aggregation: FilterEditor;
-	/** The aggregation's "every … Seconds" input. */
-	step(): Locator;
-	metric: MetricControls;
-	addOns: AddOns;
-	/** The "…" menu: offered only where several queries are allowed. */
-	actions(): Locator;
-	/** A row of the open "…" menu. */
-	menuItem(action: 'clone' | 'delete'): Locator;
-	clone(): Promise<void>;
-	delete(): Promise<void>;
-	toggleVisibility(): Promise<void>;
-	collapse(): Promise<void>;
-	/** The data-source dropdown's value; only on hosts that let it change. */
-	signal(): Locator;
-	setSignal(label: 'Logs' | 'Traces' | 'Metrics'): Promise<void>;
-}
-
-export interface FormulaBlock {
-	root(): Locator;
-	expression(): Locator;
-	legend(): Locator;
-	delete(): Promise<void>;
-}
-
-/** `query-add-on-<field>` toggle values: a documented DOM contract. */
-export type AddOnField =
-	| 'group_by'
-	| 'having'
-	| 'order_by'
-	| 'limit'
-	| 'legend_format'
-	| 'reduce_to';
-
-export interface AddOns {
-	/** The toggle row; its children name the add-ons on offer. */
-	toggles(): Locator;
-	/** Idempotent: leaves an already-open add-on open. */
-	open(field: AddOnField): Promise<void>;
-	content(field: AddOnField): Locator;
-	groupBy: {
-		/** Types `key` and picks the suggestion with that exact name. */
-		add(key: string): Promise<void>;
-		remove(key: string): Promise<void>;
-		/** The selected keys, in order. */
-		values(): Promise<string[]>;
-	};
-	having: FilterEditor;
-	limit(): Locator;
-	legend(): Locator;
-	reduceTo: {
-		/** The selected value. */
-		value(): Locator;
-		set(label: string): Promise<void>;
-	};
-}
-
-/** The metrics aggregation section: metric picker plus time/space selects. */
-export interface MetricControls {
-	select(name: string): Promise<void>;
-	/** The metric name input. */
-	input(): Locator;
-	/** The selected value. Absent for histograms. */
-	timeAggregation(): Locator;
-	/** The selected value. */
-	spaceAggregation(): Locator;
-	setTimeAggregation(label: string): Promise<void>;
-	setSpaceAggregation(label: string): Promise<void>;
-	/** Labels offered by the space-aggregation select, as shown. */
-	spaceOptions(): Promise<string[]>;
-}
-
-export interface QuickFilterValue {
-	checkbox(): Locator;
-	/** Toggles the value; returns the query_range bodies the toggle fired. */
-	toggle(): Promise<V5Body[]>;
-}
-
-/** The explorer's tab, carried in the `panelTypes` param. */
-export type ExplorerView = 'list' | 'graph' | 'table';
-
-export interface OpenOptions {
-	/** Serialised the way the app writes it. */
-	query?: unknown;
-	/** A `compositeQuery` value sent as given, for malformed input. */
-	raw?: string;
-	view?: ExplorerView;
-}
-
-export interface QueryBuilderDriver {
-	/**
-	 * Resolves once the page's own first query_range has answered: the explorer
-	 * rewrites its URL and re-mounts the builder until then, which drops
-	 * keystrokes. Returns the bodies that load fired.
-	 */
-	openExplorer(path: string, options?: OpenOptions): Promise<V5Body[]>;
-	query(name: string): QueryBlock;
-	/** Adds the next query (B, C, …) and waits for its block. */
-	addQuery(name: string): Promise<QueryBlock>;
-	/** Builder query names, top to bottom. */
-	queryNames(): Promise<string[]>;
-	/** Panel-editor query-type tab, by its queryType (`builder`, `promql`, …). */
-	tab(queryType: string): Locator;
-	promql(): Locator;
-	formula(name: string): FormulaBlock;
-	addFormula(name: string): Promise<FormulaBlock>;
-	traceOperator: {
-		root(): Locator;
-		/** "Add Trace Matching": offered on traces hosts that allow it. */
-		addButton(): Locator;
-		add(): Promise<void>;
-		remove(): Promise<void>;
-		editor: FilterEditor;
-	};
-	/**
-	 * Explorer "Add to dashboard": picks the dashboard titled `title` and waits
-	 * for the new-panel editor the export navigates to.
-	 */
-	addToDashboard(title: string): Promise<void>;
-	runButton(): Locator;
-	/** The logs explorer's results area, below the builder. */
-	logsResults(): Locator;
-	/** Clicks Run; returns every query_range body the click fired. */
-	run(): Promise<V5Body[]>;
-	/**
-	 * Clicks Run until `read()` equals `expected`. For panel-editor structural
-	 * edits, whose draft can lag the DOM: an early Run is a cache hit that
-	 * sends nothing. Never clicks while the button is Cancel.
-	 */
-	rerunUntil(read: () => unknown, expected: unknown): Promise<void>;
-	/**
-	 * Ctrl/Cmd+Enter from the focused field; returns the fired bodies. Waits two
-	 * frames first: editor changes reach React state on its next scheduler task,
-	 * and a keypress inside the same frame as the last keystroke reads the
-	 * previous render — a gap no person can produce.
-	 */
-	runShortcut(): Promise<V5Body[]>;
-	/** A value in an explorer's checkbox quick filter, by its header title. */
-	quickFilter(title: string, value: string): QuickFilterValue;
-	/** The spec of query `name` in the first body that has it. */
-	spec(bodies: V5Body[], name: string): V5Query['spec'];
-	/** Every query_range body sent since the test started. */
-	sent(): V5Body[];
-	/**
-	 * Query `name`'s spec in the newest body that has it, whatever sent it. The
-	 * panel editor fetches on structural edits, so Run after one can be a cache
-	 * hit that sends nothing: poll this rather than waiting on Run.
-	 */
-	latest(name: string): V5Query['spec'] | undefined;
-	/** The URL's `compositeQuery`, parsed. */
-	urlQuery(): Record<string, unknown> | null;
-	console: ConsoleWatch;
-}
-
-/** CodeMirror renders its placeholder inside the empty line. */
-const EDITOR_DOC = async (root: Locator): Promise<string> => {
-	const lines = root.locator('.cm-content .cm-line');
-	const texts = await lines.allTextContents();
-	const placeholders = await lines.evaluateAll((nodes) =>
-		nodes.map((node) => node.querySelector('.cm-placeholder')?.textContent ?? ''),
-	);
-	return texts
-		.map((text, i) =>
-			placeholders[i] ? text.replace(placeholders[i], '') : text,
-		)
-		.join('\n');
-};
-
-function editorAt(page: Page, root: () => Locator): FilterEditor {
-	const content = (): Locator => root().locator('.cm-content');
-	const editor: FilterEditor = {
-		root,
-		content,
-		async type(text) {
-			await editor.clear();
-			await page.keyboard.type(text);
-		},
-		async append(text) {
-			await content().click();
-			await page.keyboard.press('End');
-			await page.keyboard.type(text);
-		},
-		async clear() {
-			await content().click();
-			await page.keyboard.press('ControlOrMeta+a');
-			await page.keyboard.press('Backspace');
-			await expect.poll(() => EDITOR_DOC(root())).toBe('');
-		},
-		press: (key) => page.keyboard.press(key),
-		expression: () => EDITOR_DOC(root()),
-		lineCount: () => root().locator('.cm-line'),
-		suggestions: () => page.locator('.cm-tooltip-autocomplete'),
-		async openSuggestions() {
-			await expect(async () => {
-				await page.keyboard.press('Control+Space');
-				await expect(editor.suggestions()).toBeVisible({ timeout: 2_000 });
-			}).toPass({ timeout: 15_000 });
-		},
-		suggestion: (label) =>
-			page
-				.locator('.cm-tooltip-autocomplete [role="option"]')
-				.filter({ hasText: label }),
-	};
-	return editor;
-}
-
-/**
- * Opens the antd select inside `select` and returns its options. Scoped to the
- * list the select owns: a previous select's list can still be mid-close.
- */
-async function openSelect(page: Page, select: Locator): Promise<Locator> {
-	await select.locator('.ant-select-selector').click();
-	const list = await ownDropdown(page, select);
-	await expect(list).toBeVisible();
-	return list.locator('.ant-select-item-option');
-}
-
-/** antd renders select options with trailing whitespace ("Sum "). */
-const exactly = (label: string): RegExp => new RegExp(`^\\s*${label}\\s*$`);
-
-/** A reduce-to option or value by its operator: "Sum of values in timeframe". */
-export const reduceToLabel = (operator: string): RegExp =>
-	new RegExp(`^\\s*${operator} of values`);
-
-const ADD_ON_CONTENT: Record<AddOnField, string> = {
-	group_by: 'group-by-content',
-	having: 'having-content',
-	order_by: 'order-by-content',
-	limit: 'limit-content',
-	legend_format: 'legend-format-content',
-	reduce_to: 'reduce-to-content',
-};
-
-function addOnsAt(page: Page, root: () => Locator): AddOns {
-	const content = (field: AddOnField): Locator =>
-		root().getByTestId(ADD_ON_CONTENT[field]);
-	const groupBy = (): Locator => root().getByTestId('group-by');
-	const addOns: AddOns = {
-		toggles: () => root().locator('[data-testid^="query-add-on-"]'),
-		async open(field) {
-			if (await content(field).isVisible()) {
-				return;
-			}
-			await root().getByTestId(`query-add-on-${field}`).click();
-			await expect(content(field)).toBeVisible();
-		},
-		content,
-		groupBy: {
-			async add(key) {
-				const options = await openSelect(page, groupBy());
-				await groupBy().locator('input').fill(key);
-				await options
-					.filter({ hasText: exactly(key) })
-					.first()
-					.click();
-				await page.keyboard.press('Escape');
-				await expect(
-					groupBy().locator('.ant-select-selection-item', { hasText: key }),
-				).toBeVisible();
-			},
-			async remove(key) {
-				await groupBy()
-					.locator('.ant-select-selection-item', { hasText: key })
-					.locator('.ant-select-selection-item-remove')
-					.click();
-			},
-			async values() {
-				const texts = await groupBy()
-					.locator('.ant-select-selection-item-content')
-					.allTextContents();
-				return texts.map((text) => text.trim());
-			},
-		},
-		having: editorAt(page, () => root().getByTestId('having-editor')),
-		limit: () => content('limit').getByTestId('input-Limit'),
-		legend: () => content('legend_format').getByTestId('input-Legend format'),
-		reduceTo: {
-			value: () =>
-				root().getByTestId('reduce-to').locator('.ant-select-selection-item'),
-			// Labels read "<Op> of values in timeframe"; matched on the operator.
-			async set(label) {
-				const options = await openSelect(page, root().getByTestId('reduce-to'));
-				await options.filter({ hasText: reduceToLabel(label) }).click();
-				await expect(addOns.reduceTo.value()).toHaveText(reduceToLabel(label));
-			},
-		},
-	};
-	return addOns;
-}
-
-function metricAt(page: Page, root: () => Locator): MetricControls {
-	const picker = (): Locator =>
-		root().locator('[data-testid^="metric-name-selector-"]');
-	const time = (): Locator => root().getByTestId('metrics-time-aggregation');
-	const space = (): Locator => root().getByTestId('metrics-space-aggregation');
-	return {
-		async select(name) {
-			// An antd AutoComplete: the testid is on a wrapper.
-			const field = picker();
-			const options = await openSelect(page, field);
-			await field.locator('input').fill(name);
-			// Options carry the metric's type and unit next to its name.
-			await options.filter({ hasText: name }).first().click();
-		},
-		// The selection item, not the root: these selects render their list
-		// inside the root, so its text includes every option.
-		input: () => picker().locator('input'),
-		timeAggregation: () => time().locator('.ant-select-selection-item'),
-		spaceAggregation: () => space().locator('.ant-select-selection-item'),
-		async setTimeAggregation(label) {
-			const options = await openSelect(page, time());
-			await options.filter({ hasText: exactly(label) }).click();
-			await expect(this.timeAggregation()).toHaveText(label);
-		},
-		async setSpaceAggregation(label) {
-			const options = await openSelect(page, space());
-			await options.filter({ hasText: exactly(label) }).click();
-			await expect(this.spaceAggregation()).toHaveText(label);
-		},
-		async spaceOptions() {
-			const options = await openSelect(page, space());
-			const labels = await options.allTextContents();
-			await page.keyboard.press('Escape');
-			return labels.map((label) => label.trim());
-		},
-	};
-}
-
-/**
- * Two frames: an edit reaches React state on its next scheduler task, and an
- * action in the same frame reads the previous render. A long render delays
- * the frame itself, so this cannot pass before the commit.
- */
-async function afterRender(page: Page): Promise<void> {
-	await page.evaluate(
-		() =>
-			new Promise<void>((resolve) => {
-				// Runs in the browser; the e2e tsconfig has no DOM lib.
-				const { requestAnimationFrame: frame } = globalThis as unknown as {
-					requestAnimationFrame(this: void, callback: () => void): number;
-				};
-				frame(() => frame(() => resolve()));
-			}),
-	);
-}
-
-function queryBuilderDriver(page: Page): QueryBuilderDriver {
-	const bodies: V5Body[] = [];
-	page.on('request', (request: Request) => {
-		if (isQueryRange(request.url()) && request.method() === 'POST') {
-			bodies.push(request.postDataJSON() as V5Body);
-		}
-	});
-	const consoleWatch = watchConsole(page, {
-		// ANTLR reports every partial expression on console.error, prefixed
-		// with its position (`line 1:14 ...`).
-		ignore: ['line 1:', 'line 2:', 'line 3:'],
-	});
-
-	// Waits on a request the action started: a response to one already in
-	// flight (e.g. after a structural edit) would end the wait too early.
-	const firedBy = async (action: () => Promise<void>): Promise<V5Body[]> => {
-		const before = bodies.length;
-		const answered = page
-			.waitForRequest((r) => isQueryRange(r.url()) && r.method() === 'POST')
-			.then((request) => request.response());
-		await action();
-		await answered;
-		return bodies.slice(before);
-	};
-
-	const qb: QueryBuilderDriver = {
-		async openExplorer(path, { query, raw, view } = {}) {
-			await dismissQuickFiltersAnnouncement(page);
-			const params = [`relativeTime=${RELATIVE_TIME}`];
-			if (view) {
-				params.push(`panelTypes=${encodeURIComponent(JSON.stringify(view))}`);
-			}
-			const composite =
-				raw ??
-				(query === undefined
-					? undefined
-					: encodeURIComponent(JSON.stringify(query)));
-			if (composite !== undefined) {
-				params.push(`compositeQuery=${composite}`);
-			}
-			const url = `${path}?${params.join('&')}`;
-			// The metrics explorer runs nothing until a metric is chosen; its
-			// settle point is the metric list instead.
-			if (path === EXPLORER.metrics) {
-				await Promise.all([
-					page.waitForResponse((r) => r.url().includes('/api/v2/metrics')),
-					page.goto(url),
-				]);
-				await expect(qb.query('A').filter.content()).toBeVisible();
-				return [];
-			}
-			const fired = await firedBy(async () => {
-				await page.goto(url);
-			});
-			await expect(qb.query('A').filter.content()).toBeVisible();
-			return fired;
-		},
-		query(name) {
-			const root = (): Locator => page.getByTestId(`query-${name}`);
-			// Index-suffixed testids follow screen position, not the query's
-			// name (A, C, B after a delete and re-add): match them in the block.
-			const signalSelect = (): Locator =>
-				root().locator('[data-testid^="query-data-source-selector-"]');
-			return {
-				root,
-				filter: editorAt(page, () =>
-					root().getByTestId('query-where-clause-editor'),
-				),
-				filterStatus: () => root().getByTestId('query-validation-status'),
-				aggregation: editorAt(page, () =>
-					root().getByTestId('query-aggregation-editor'),
-				),
-				step: () => root().getByTestId('input-Seconds'),
-				metric: metricAt(page, root),
-				addOns: addOnsAt(page, root),
-				actions: () => root().getByTestId('query-actions'),
-				menuItem: (action) =>
-					page.getByTestId(`query-actions-item-${action}-query`),
-				async clone() {
-					await root().getByTestId('query-actions').click();
-					await page.getByTestId('query-actions-item-clone-query').click();
-					await afterRender(page);
-				},
-				async delete() {
-					await root().getByTestId('query-actions').click();
-					await page.getByTestId('query-actions-item-delete-query').click();
-					await expect(root()).toHaveCount(0);
-					await afterRender(page);
-				},
-				async toggleVisibility() {
-					await root().getByTestId('qb-entity-visibility').click();
-					// The icon is the only visible change and carries no state.
-					await afterRender(page);
-				},
-				collapse: () => root().getByTestId('qb-entity-collapse').click(),
-				signal: () => signalSelect().locator('.ant-select-selection-item'),
-				async setSignal(label) {
-					const options = await openSelect(page, signalSelect());
-					await options.filter({ hasText: exactly(label) }).click();
-					await expect(this.signal()).toHaveText(label);
-				},
-			};
-		},
-		tab: (queryType) => page.getByTestId(`query-type-tab-${queryType}`),
-		promql: () => page.getByTestId('promql-query-input').first(),
-		async addQuery(name) {
-			await page.getByTestId('add-new-query-button').click();
-			const block = qb.query(name);
-			await expect(block.filter.content()).toBeVisible();
-			return block;
-		},
-		queryNames: () =>
-			page.locator('[data-testid^="query-"]').evaluateAll((nodes) =>
-				nodes
-					.map((node) => node.getAttribute('data-testid') ?? '')
-					.filter((id) => /^query-[A-Z]$/.test(id))
-					.map((id) => id.slice('query-'.length)),
-			),
-		formula(name) {
-			const root = (): Locator => page.getByTestId(`formula-${name}`);
-			return {
-				root,
-				expression: () => root().getByTestId('formula-expression'),
-				legend: () => root().getByTestId('formula-legend'),
-				async delete() {
-					await root().getByTestId('qb-entity-delete').click();
-					await expect(root()).toHaveCount(0);
-					// The block leaves the DOM before the editor's draft follows.
-					await afterRender(page);
-				},
-			};
-		},
-		async addFormula(name) {
-			await page.getByTestId('add-formula-button').click();
-			const formula = qb.formula(name);
-			await expect(formula.expression()).toBeVisible();
-			return formula;
-		},
-		traceOperator: {
-			root: () => page.getByTestId('trace-operator'),
-			// No testid; the label is followed by a "Beta" tag inside the button.
-			addButton: () =>
-				page.getByRole('button').filter({ hasText: /^Add Trace Matching/ }),
-			async add() {
-				await qb.traceOperator.addButton().click();
-				await expect(qb.traceOperator.editor.content()).toBeVisible();
-			},
-			async remove() {
-				// The only direct button child: the trash icon, no testid.
-				await qb.traceOperator.root().locator(':scope > button').click();
-				await expect(qb.traceOperator.root()).toHaveCount(0);
-			},
-			editor: editorAt(page, () => page.getByTestId('trace-operator-editor')),
-		},
-		async addToDashboard(title) {
-			await page.getByTestId('explorer-add-to-dashboard').click();
-			const dialog = page.getByTestId('export-panel-dialog');
-			await dialog
-				.getByTestId('export-dashboard-select')
-				.locator('input')
-				.fill(title);
-			await dialog.locator(`.ant-select-item-option[title="${title}"]`).click();
-			await dialog.getByTestId('export-panel-export').click();
-			await page.waitForURL(/\/panel\/new\?/);
-			await expect(qb.query('A').filter.content()).toBeVisible();
-		},
-		runButton: () => page.locator('[data-run-query-btn]').first(),
-		// No testid on the container.
-		logsResults: () => page.locator('.logs-explorer-views'),
-		async run() {
-			await afterRender(page);
-			return firedBy(() => qb.runButton().click());
-		},
-		async rerunUntil(read, expected) {
-			await expect(async () => {
-				await expect(qb.runButton()).toHaveText(/Run Query/);
-				await afterRender(page);
-				await qb.runButton().click();
-				await expect.poll(read, { timeout: 3_000 }).toEqual(expected);
-			}).toPass({ timeout: 25_000 });
-		},
-		async runShortcut() {
-			await afterRender(page);
-			return firedBy(() => page.keyboard.press('ControlOrMeta+Enter'));
-		},
-		quickFilter(title, value) {
-			const checkbox = (): Locator =>
-				page.getByTestId(`checkbox-${title}-${value}`);
-			return {
-				checkbox,
-				toggle: () => firedBy(() => checkbox().click()),
-			};
-		},
-		spec(fired, name) {
-			for (const body of fired) {
-				const match = body.compositeQuery?.queries?.find(
-					(q) => q.spec?.name === name,
-				);
-				if (match) {
-					return match.spec;
-				}
-			}
-			throw new Error(`no query ${name} in ${fired.length} query_range bodies`);
-		},
-		sent: () => bodies,
-		latest: (name) =>
-			[...bodies]
-				.reverse()
-				.flatMap((body) => body.compositeQuery?.queries ?? [])
-				.find((query) => query.spec?.name === name)?.spec,
-		urlQuery() {
-			const raw = new URL(page.url()).searchParams.get('compositeQuery');
-			if (!raw) {
-				return null;
-			}
-			// The app encodes before URLSearchParams encodes again.
-			return JSON.parse(decodeURIComponent(raw)) as Record<string, unknown>;
-		},
-		console: consoleWatch,
-	};
-	return qb;
-}
-
-/** Layers `qb` onto another host's test, e.g. the alert-rule fixtures. */
-export const withQueryBuilder = driver('qb', ({ page }) =>
-	queryBuilderDriver(page),
-);
-
-const HISTOGRAM_BOUNDS = ['1', '2', '4', '+Inf'];
-
-/** Ten minutes of a gauge and a cumulative histogram, names unique per worker. */
-export const withMetricTypes = seeded(
-	'metricTypes',
-	async ({ page, workerIndex }) => {
-		const suffix = `${workerIndex}_${Date.now()}`;
-		const types: MetricTypes = {
-			gauge: `e2e_qb_gauge_${suffix}`,
-			histogram: `e2e_qb_histogram_${suffix}`,
-		};
-		const now = Date.now();
-		const points: Record<string, unknown>[] = [];
-		for (let minute = 0; minute < 10; minute += 1) {
-			const timestamp = new Date(now - (10 - minute) * 60_000).toISOString();
-			points.push({
-				metric_name: types.gauge,
-				labels: { host: 'qb-host' },
-				timestamp,
-				value: 10 + minute,
-				type_: 'Gauge',
-				temporality: 'Unspecified',
-				is_monotonic: false,
-			});
-			HISTOGRAM_BOUNDS.forEach((le, bucket) => {
-				points.push({
-					metric_name: types.histogram,
-					labels: { le },
-					timestamp,
-					value: (minute + 1) * (bucket + 1),
-					type_: 'Histogram',
-					temporality: 'Cumulative',
-					is_monotonic: false,
-				});
-			});
-		}
-		await postToSeeder(page, '/telemetry/metrics', points);
-		return types;
-	},
-);
-
-export const test = withQueryBuilder(kit);
-
-export { expect } from './kit';

tests/e2e/helpers/alert-forms/shared.ts

@@ -85,17 +85,8 @@ export async function pickChannelByName(
 	channelName: string,
 ): Promise<void> {
 	const tagsBefore = await selectedTags(select).count();
-	// A re-render of the condition section (e.g. after a query edit) can close
-	// the select as the click opens it; re-click only while it is still closed.
-	await expect(async () => {
-		const isOpen = await select.evaluate((node) =>
-			node.classList.contains('ant-select-open'),
-		);
-		if (!isOpen) {
-			await select.click();
-		}
-		await expect(select).toHaveClass(/ant-select-open/, { timeout: 2_000 });
-	}).toPass({ timeout: 15_000 });
+	await select.click();
+	await expect(select).toHaveClass(/ant-select-open/);
 
 	// `fill` on the combobox input rather than `keyboard.type`: the query is a ~30
 	// character channel name and every keystroke re-runs antd's filter, so typing it

tests/e2e/helpers/alerts/seeding.ts

@@ -15,7 +15,7 @@ import type {
 
 // ─── Seeding telemetry ───────────────────────────────────────────────────
 
-export async function postToSeeder(
+async function postToSeeder(
 	page: Page,
 	path: string,
 	data: unknown,

tests/e2e/helpers/query-range-mock.ts

@@ -272,9 +272,7 @@ export async function holdQueryRange(
 	});
 	await page.route(QUERY_RANGE_GLOB, async (route) => {
 		await gate;
-		// A cancelled run aborts its request while it is held; there is
-		// nothing left to answer.
-		await fulfill(route, body).catch(() => undefined);
+		await fulfill(route, body);
 	});
 	return { release: () => release() };
 }

tests/e2e/tests/query-builder/addons.spec.ts

@@ -1,152 +0,0 @@
-import {
-	expect,
-	EXPLORER,
-	SUM_METRIC,
-	test,
-} from '../../drivers/query-builder';
-
-const HAVING = ['count() > 10', 'count() IN [1, 2]', 'count() NOT IN [1, 2]'];
-
-test.describe('Query builder — add-ons', () => {
-	for (const explorer of ['logs', 'traces'] as const) {
-		test(`TC-21 ${explorer} group by keeps order through removal and reload`, async ({
-			qb,
-		}) => {
-			await qb.openExplorer(EXPLORER[explorer], { view: 'graph' });
-			const addOns = qb.query('A').addOns;
-			await addOns.open('group_by');
-
-			await addOns.groupBy.add('service.name');
-			await addOns.groupBy.add('deployment.environment');
-			await addOns.groupBy.add('k8s.namespace.name');
-			await addOns.groupBy.remove('service.name');
-			const fired = await qb.run();
-
-			const expected = ['deployment.environment', 'k8s.namespace.name'];
-			expect(qb.spec(fired, 'A').groupBy?.map((key) => key.name)).toEqual(
-				expected,
-			);
-			const reloaded = await qb.openExplorer(EXPLORER[explorer], {
-				view: 'graph',
-				query: qb.urlQuery(),
-			});
-			expect(qb.spec(reloaded, 'A').groupBy?.map((key) => key.name)).toEqual(
-				expected,
-			);
-			expect(await qb.query('A').addOns.groupBy.values()).toEqual(expected);
-		});
-	}
-
-	test('TC-21 metrics group by offers the metric’s own attributes', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.metrics);
-		const query = qb.query('A');
-		await query.metric.select(SUM_METRIC);
-
-		await query.addOns.groupBy.add('operation');
-		const fired = await qb.run();
-
-		expect(qb.spec(fired, 'A').groupBy?.map((key) => key.name)).toEqual([
-			'operation',
-		]);
-	});
-
-	for (const having of HAVING) {
-		test(`TC-22 having "${having}" is sent verbatim and accepted`, async ({
-			qb,
-		}) => {
-			await qb.openExplorer(EXPLORER.logs, { view: 'graph' });
-			const addOns = qb.query('A').addOns;
-			await addOns.open('group_by');
-			await addOns.groupBy.add('service.name');
-			await addOns.open('having');
-
-			await addOns.having.type(having);
-			await addOns.having.press('Escape');
-			const fired = await qb.run();
-
-			expect(qb.spec(fired, 'A').having?.expression).toBe(having);
-			expect(qb.console.failedResponses).toEqual([]);
-		});
-	}
-
-	test('TC-23 the logs list orders by timestamp then id, traces by timestamp only', async ({
-		qb,
-	}) => {
-		const logs = await qb.openExplorer(EXPLORER.logs, { view: 'list' });
-		expect(qb.spec(logs, 'A').order?.map((o) => o.key.name)).toEqual([
-			'timestamp',
-			'id',
-		]);
-
-		const traces = await qb.openExplorer(EXPLORER.traces, { view: 'list' });
-		expect(qb.spec(traces, 'A').order?.map((o) => o.key.name)).toEqual([
-			'timestamp',
-		]);
-	});
-
-	test('TC-24 a positive limit is sent; empty and zero send none', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs, { view: 'graph' });
-		const addOns = qb.query('A').addOns;
-		await addOns.open('group_by');
-		await addOns.groupBy.add('service.name');
-		await addOns.open('limit');
-
-		await addOns.limit().fill('10');
-		expect(qb.spec(await qb.run(), 'A').limit).toBe(10);
-
-		await addOns.limit().fill('');
-		expect(qb.spec(await qb.run(), 'A')).not.toHaveProperty('limit');
-
-		await addOns.limit().fill('3');
-		await qb.run();
-		await addOns.limit().fill('0');
-		expect(qb.spec(await qb.run(), 'A')).not.toHaveProperty('limit');
-	});
-
-	// known: the input accepts a negative limit; Run then sends nothing, and the
-	// next Run sends it and the backend answers 400.
-	test.fixme('TC-24 a negative limit is never sent', async ({ qb }) => {
-		await qb.openExplorer(EXPLORER.logs, { view: 'graph' });
-		const addOns = qb.query('A').addOns;
-		await addOns.open('limit');
-
-		await addOns.limit().fill('-5');
-		await qb.runButton().click();
-		await qb.runButton().click();
-
-		expect(qb.sent().map((body) => qb.spec([body], 'A').limit)).not.toContain(-5);
-		expect(qb.console.failedResponses).toEqual([]);
-	});
-
-	test('TC-25 the legend prefills from group by and a custom one is kept', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs, { view: 'graph' });
-		const addOns = qb.query('A').addOns;
-		await addOns.open('group_by');
-		await addOns.groupBy.add('service.name');
-		await addOns.groupBy.add('deployment.environment');
-
-		await addOns.open('legend_format');
-		await expect(addOns.legend()).toHaveValue(
-			'service.name = {{service.name}}, deployment.environment = {{deployment.environment}}',
-		);
-
-		await addOns.legend().fill('{{service.name}} logs');
-		await addOns.groupBy.add('k8s.namespace.name');
-		await expect(addOns.legend()).toHaveValue('{{service.name}} logs');
-		expect(qb.spec(await qb.run(), 'A').legend).toBe('{{service.name}} logs');
-	});
-
-	test('TC-25 the legend opens empty without a group by', async ({ qb }) => {
-		await qb.openExplorer(EXPLORER.logs, { view: 'graph' });
-
-		await qb.query('A').addOns.open('legend_format');
-
-		await expect(qb.query('A').addOns.legend()).toHaveValue('');
-	});
-});

tests/e2e/tests/query-builder/aggregation.spec.ts

@@ -1,80 +0,0 @@
-import { expect, EXPLORER, test } from '../../drivers/query-builder';
-
-// One comma-separated term per entry in the request's `aggregations`.
-const EXPRESSIONS: Record<string, string[]> = {
-	'a count': ['count()'],
-	'a distinct count': ['count_distinct(service.name)'],
-	'a percentile of a span field': ['p99(duration_nano)'],
-	'two aggregations': ['count()', 'p99(duration_nano)'],
-};
-
-test.describe('Query builder — logs and traces aggregations', () => {
-	for (const [label, terms] of Object.entries(EXPRESSIONS)) {
-		test(`TC-17 ${label} reaches the request`, async ({ qb }) => {
-			await qb.openExplorer(EXPLORER.traces, { view: 'graph' });
-			const aggregation = qb.query('A').aggregation;
-
-			await aggregation.type(terms.join(', '));
-			await aggregation.press('Escape');
-			const fired = await qb.run();
-
-			expect(qb.spec(fired, 'A').aggregations?.map((a) => a.expression)).toEqual(
-				terms,
-			);
-		});
-	}
-
-	test('TC-18 the step interval reaches the request', async ({
-		authedPage: page,
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.traces, { view: 'graph' });
-
-		await qb.query('A').step().fill('120');
-		await page.keyboard.press('Tab');
-		const fired = await qb.run();
-
-		expect(qb.spec(fired, 'A').stepInterval).toBe(120);
-	});
-
-	test('TC-30 a trace operator replaces per-query aggregation until removed', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.traces, { view: 'graph' });
-		await (await qb.addQuery('B')).filter.type("http.status_code = '500'");
-		await qb.query('B').filter.press('Escape');
-
-		await qb.traceOperator.add();
-		await qb.traceOperator.editor.type('A => B');
-		await qb.traceOperator.editor.press('Escape');
-		for (const name of ['A', 'B']) {
-			await expect(qb.query(name).aggregation.root()).toHaveCount(0);
-			await expect(qb.query(name).addOns.toggles()).toHaveCount(0);
-		}
-		const fired = await qb.run();
-		const operator = fired
-			.flatMap((body) => body.compositeQuery.queries)
-			.find((query) => query.type === 'builder_trace_operator');
-		expect(operator?.spec).toMatchObject({ expression: 'A => B' });
-
-		await qb.traceOperator.remove();
-		await expect(qb.query('A').aggregation.root()).toBeVisible();
-		await qb.rerunUntil(
-			() =>
-				qb
-					.sent()
-					.at(-1)
-					?.compositeQuery.queries.some(
-						(query) => query.type === 'builder_trace_operator',
-					),
-			false,
-		);
-	});
-
-	test('TC-30 the logs explorer offers no trace matching', async ({ qb }) => {
-		await qb.openExplorer(EXPLORER.logs, { view: 'graph' });
-
-		await expect(qb.query('A').root()).toBeVisible();
-		await expect(qb.traceOperator.addButton()).toHaveCount(0);
-	});
-});

tests/e2e/tests/query-builder/alerts.spec.ts

@@ -1,85 +0,0 @@
-import { withQueryBuilder } from '../../drivers/query-builder';
-import {
-	expect,
-	test as alertRulesTest,
-} from '../../fixtures/alerts/alert-rules';
-import { AlertType } from '../../helpers/alert-forms/constants';
-import { gotoCreateAlertV2 } from '../../helpers/alert-forms/navigation';
-import {
-	selectThresholdChannel,
-	v2SaveButton,
-} from '../../helpers/alert-forms/v2';
-import { gotoAlertOverview } from '../../helpers/alerts/navigation';
-
-const test = withQueryBuilder(alertRulesTest);
-
-const FILTER_A = "http.method = 'GET'";
-const FILTER_B = "http.status_code = '500'";
-const TRACE_MATCH = 'A => B';
-
-interface SavedRule {
-	condition?: {
-		compositeQuery?: {
-			queries?: {
-				type: string;
-				spec: {
-					name?: string;
-					expression?: string;
-					filter?: { expression?: string };
-				};
-			}[];
-		};
-	};
-}
-
-test.describe('Query builder — alerts', () => {
-	test('TC-06 a trace-matching traces alert saves and reopens intact', async ({
-		authedPage: page,
-		alertChannel,
-		ownedRules,
-		qb,
-	}) => {
-		await gotoCreateAlertV2(page, { alertType: AlertType.TRACES });
-		await page.getByTestId('alert-name-input').fill(`e2e-qb-tc06-${Date.now()}`);
-
-		await qb.query('A').filter.type(FILTER_A);
-		await qb.query('A').filter.press('Escape');
-		const b = await qb.addQuery('B');
-		await b.filter.type(FILTER_B);
-		await b.filter.press('Escape');
-		await qb.traceOperator.add();
-		await qb.traceOperator.editor.type(TRACE_MATCH);
-		await qb.traceOperator.editor.press('Escape');
-		// Blur first: the editor's blur re-renders the condition section, which
-		// otherwise closes the channel select as its click opens it.
-		await qb.traceOperator.editor.content().blur();
-		await selectThresholdChannel(page, 0, alertChannel.name);
-
-		const [response] = await Promise.all([
-			page.waitForResponse(
-				(r) => r.url().includes('/api/v2/rules') && r.request().method() === 'POST',
-			),
-			v2SaveButton(page).click(),
-		]);
-		await ownedRules.register(response);
-		const saved = response.request().postDataJSON() as SavedRule;
-		const queries = saved.condition?.compositeQuery?.queries ?? [];
-		expect(queries).toEqual(
-			expect.arrayContaining([
-				expect.objectContaining({
-					type: 'builder_trace_operator',
-					spec: expect.objectContaining({ expression: TRACE_MATCH }),
-				}),
-			]),
-		);
-
-		const { data } = (await response.json()) as { data: { id: string } };
-		await gotoAlertOverview(page, String(data.id));
-
-		await expect.poll(() => qb.query('A').filter.expression()).toBe(FILTER_A);
-		await expect.poll(() => qb.query('B').filter.expression()).toBe(FILTER_B);
-		await expect
-			.poll(() => qb.traceOperator.editor.expression())
-			.toBe(TRACE_MATCH);
-	});
-});

tests/e2e/tests/query-builder/dashboards.spec.ts

@@ -1,72 +0,0 @@
-import { emptyDashboard, test as editorTest } from '../../drivers/panel-editor';
-import {
-	expect,
-	EXPLORER,
-	withQueryBuilder,
-} from '../../drivers/query-builder';
-
-const test = withQueryBuilder(editorTest);
-
-const FILTER = "severity_text = 'ERROR'";
-const AGGREGATION = 'count_distinct(service.name)';
-
-interface StoredQuery {
-	spec: {
-		filter?: { expression?: string };
-		aggregations?: { expression?: string }[];
-	};
-}
-
-/** Where a non-List panel keeps its builder queries in the v2 dashboard spec. */
-interface StoredPanel {
-	spec: {
-		queries: {
-			spec: { plugin: { kind: string; spec: { queries: StoredQuery[] } } };
-		}[];
-	};
-}
-
-test.describe('Query builder — explorer to dashboard', () => {
-	test('TC-05 a logs explorer query survives add to dashboard, save and reopen', async ({
-		dashboards,
-		editor,
-		qb,
-	}) => {
-		const dashboard = emptyDashboard();
-		const title = dashboard.spec.display.name;
-		const id = await dashboards.seed(dashboard);
-
-		await qb.openExplorer(EXPLORER.logs, { view: 'graph' });
-		await qb.query('A').filter.type(FILTER);
-		await qb.query('A').filter.press('Escape');
-		await qb.query('A').aggregation.type(AGGREGATION);
-		await qb.query('A').aggregation.press('Escape');
-		await qb.run();
-
-		await qb.addToDashboard(title);
-		await expect.poll(() => qb.query('A').filter.expression()).toBe(FILTER);
-		await expect
-			.poll(() => qb.query('A').aggregation.expression())
-			.toBe(AGGREGATION);
-
-		await editor.save();
-		// The shared spec types model only bare BuilderQuery plugins.
-		const panels = (await dashboards.get(id)).spec.panels as unknown as Record<
-			string,
-			StoredPanel
-		>;
-		const [panelId] = Object.keys(panels);
-		const plugin = panels[panelId].spec.queries[0].spec.plugin;
-		expect(plugin.kind).toBe('signoz/CompositeQuery');
-		expect(plugin.spec.queries[0].spec).toMatchObject({
-			filter: { expression: FILTER },
-			aggregations: [{ expression: AGGREGATION }],
-		});
-
-		await dashboards.openEditor(id, panelId);
-		await expect.poll(() => qb.query('A').filter.expression()).toBe(FILTER);
-		await expect
-			.poll(() => qb.query('A').aggregation.expression())
-			.toBe(AGGREGATION);
-	});
-});

tests/e2e/tests/query-builder/filter.spec.ts

@@ -1,284 +0,0 @@
-import { expect, EXPLORER, test } from '../../drivers/query-builder';
-
-// Typing is real keystrokes: the regressions here (caret jumps, swallowed
-// Enter, the run shortcut) only show up through the keyboard path.
-
-const RECENT_KEPT = "service.name = 'frontend' AND severity_text = 'WARN'";
-const RECENT_REMOVED = 'logger.name EXISTS';
-
-const COMPOUND: Record<string, string> = {
-	'NOT over a parenthesised OR':
-		"NOT (severity_text = 'INFO' OR severity_text = 'WARN') AND service.name = 'frontend'",
-	'nested groups':
-		"(service.name = 'frontend' AND (severity_text = 'ERROR' OR severity_text = 'WARN'))",
-	'NOT IN with EXISTS':
-		"service.name NOT IN ['frontend', 'adservice'] AND logger.name EXISTS",
-};
-
-const queryWithFilter = (expression: string): unknown => ({
-	queryType: 'builder',
-	builder: {
-		queryFormulas: [],
-		queryData: [
-			{
-				queryName: 'A',
-				dataSource: 'logs',
-				expression: 'A',
-				filter: { expression },
-				aggregations: [{ expression: 'count()' }],
-			},
-		],
-	},
-});
-
-const VERBATIM: Record<string, string> = {
-	'an escaped quote': "logger.name = 'it\\'s'",
-	'a double-quoted string': 'logger.name = "double quoted"',
-	'a quoted numeric string': "logger.name = '123'",
-	'a bare number': 'logger.name = 123',
-	'a boolean': 'logger.name = true',
-	'spaces and a backslash': "logger.name = 'a b\\\\c'",
-};
-
-test.describe('Query builder — filter editor', () => {
-	test('TC-07 key, operator and value suggestions build the expression', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs);
-		const filter = qb.query('A').filter;
-
-		await filter.type('severity_te');
-		await filter.openSuggestions();
-		await filter.suggestion('severity_text').first().click();
-		await expect.poll(() => filter.expression()).toMatch(/^severity_text\s*$/);
-
-		await filter.openSuggestions();
-		await expect(filter.suggestion(/^=/).first()).toBeVisible();
-		await filter.append('= ');
-		await filter.openSuggestions();
-		await filter.suggestion('ERROR').first().click();
-		await expect
-			.poll(() => filter.expression())
-			.toMatch(/^severity_text = 'ERROR'\s*$/);
-
-		const fired = await qb.run();
-		expect(qb.spec(fired, 'A').filter?.expression?.trim()).toBe(
-			"severity_text = 'ERROR'",
-		);
-	});
-
-	for (const [label, expression] of Object.entries(VERBATIM)) {
-		test(`TC-08 ${label} is sent and restored verbatim`, async ({
-			authedPage: page,
-			qb,
-		}) => {
-			await qb.openExplorer(EXPLORER.logs);
-			const filter = qb.query('A').filter;
-
-			await filter.type(expression);
-			await filter.press('Escape');
-			const fired = await qb.run();
-			expect(qb.spec(fired, 'A').filter?.expression).toBe(expression);
-
-			await page.reload();
-			await expect(filter.content()).toBeVisible();
-			await expect.poll(() => filter.expression()).toBe(expression);
-			await expect(qb.query('A').filterStatus()).toHaveCount(0);
-		});
-	}
-
-	test('TC-11 the status icon shows only for an unfocused invalid filter', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs);
-		const query = qb.query('A');
-
-		await query.filter.type('service.name =');
-		await expect(query.filterStatus()).toHaveCount(0);
-
-		await query.filter.content().blur();
-		await expect(query.filterStatus()).toBeVisible();
-
-		await query.filter.type("service.name = 'frontend'");
-		await query.filter.content().blur();
-		await expect(query.filterStatus()).toHaveCount(0);
-
-		await query.filter.clear();
-		await query.filter.content().blur();
-		await expect(query.filterStatus()).toHaveCount(0);
-	});
-
-	test('TC-12 Enter and Shift+Enter never insert a newline or run', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs);
-		const filter = qb.query('A').filter;
-		await filter.type("severity_text = 'ERROR'");
-		await filter.press('Escape');
-		await expect(filter.suggestions()).toHaveCount(0);
-		const sentBefore = qb.sent().length;
-
-		await filter.press('Enter');
-		await filter.press('Shift+Enter');
-
-		await expect(filter.lineCount()).toHaveCount(1);
-		await expect.poll(() => filter.expression()).toBe("severity_text = 'ERROR'");
-		expect(qb.sent()).toHaveLength(sentBefore);
-	});
-
-	for (const explorer of ['logs', 'traces'] as const) {
-		test(`TC-13 Cmd/Ctrl+Enter in the ${explorer} filter runs the edited query`, async ({
-			qb,
-		}) => {
-			await qb.openExplorer(EXPLORER[explorer]);
-			const filter = qb.query('A').filter;
-			await filter.type("service.name = 'frontend'");
-
-			const fired = await qb.runShortcut();
-
-			expect(qb.spec(fired, 'A').filter?.expression).toBe(
-				"service.name = 'frontend'",
-			);
-			await expect(filter.lineCount()).toHaveCount(1);
-			expect(qb.urlQuery()).toMatchObject({ queryType: 'builder' });
-		});
-	}
-
-	test('TC-14 Escape closes suggestions and keeps the text', async ({ qb }) => {
-		await qb.openExplorer(EXPLORER.logs);
-		const filter = qb.query('A').filter;
-
-		await filter.type('serv');
-		await filter.openSuggestions();
-		await filter.press('Escape');
-
-		await expect(filter.suggestions()).toHaveCount(0);
-		await expect.poll(() => filter.expression()).toBe('serv');
-		await filter.press('i');
-		await expect.poll(() => filter.expression()).toBe('servi');
-
-		await filter.press('Escape');
-		await filter.press('Escape');
-		await expect.poll(() => filter.expression()).toBe('servi');
-		await expect(filter.content()).toBeFocused();
-	});
-
-	test('TC-09 value suggestions fill an IN list', async ({ qb }) => {
-		await qb.openExplorer(EXPLORER.logs);
-		const filter = qb.query('A').filter;
-
-		await filter.type('service.name IN ');
-		await filter.openSuggestions();
-		await filter.suggestion('frontend').first().click();
-		await expect
-			.poll(() => filter.expression())
-			.toBe("service.name IN ['frontend'] ");
-
-		await filter.type("service.name IN ['frontend', 'cartservice']");
-		await filter.press('Escape');
-		const fired = await qb.run();
-
-		expect(qb.spec(fired, 'A').filter?.expression).toBe(
-			"service.name IN ['frontend', 'cartservice']",
-		);
-		await expect(qb.query('A').filterStatus()).toHaveCount(0);
-	});
-
-	for (const [label, expression] of Object.entries(COMPOUND)) {
-		test(`TC-10 ${label} is valid and sent verbatim`, async ({ qb }) => {
-			await qb.openExplorer(EXPLORER.logs);
-			const query = qb.query('A');
-
-			await query.filter.type(expression);
-			await query.filter.press('Escape');
-			await query.filter.content().blur();
-			await expect(query.filterStatus()).toHaveCount(0);
-			const fired = await qb.run();
-
-			expect(qb.spec(fired, 'A').filter?.expression).toBe(expression);
-		});
-	}
-
-	test('TC-15 an expression with CRLF from the URL loads without a RangeError', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs, {
-			query: queryWithFilter("body CONTAINS 'line1\r\nline2'"),
-		});
-
-		await expect.poll(() => qb.query('A').filter.expression()).toContain('line1');
-		expect(qb.console.errors.filter((e) => e.includes('RangeError'))).toEqual([]);
-		await qb.query('A').filter.append(" AND severity_text = 'ERROR'");
-		await expect
-			.poll(() => qb.query('A').filter.expression())
-			.toMatch(/severity_text = 'ERROR'$/);
-		expect(qb.console.errors).toEqual([]);
-	});
-
-	test('TC-15 recent searches are offered, applied and deleted', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs);
-		const filter = qb.query('A').filter;
-		for (const expression of [RECENT_KEPT, RECENT_REMOVED]) {
-			await filter.type(expression);
-			await filter.press('Escape');
-			await qb.run();
-		}
-
-		await filter.clear();
-		await filter.openSuggestions();
-		await expect(filter.suggestion(RECENT_KEPT)).toBeVisible();
-		await expect(filter.suggestion(RECENT_REMOVED)).toBeVisible();
-
-		await filter.suggestion(RECENT_KEPT).click();
-		await expect.poll(() => filter.expression()).toBe(RECENT_KEPT);
-
-		await filter.clear();
-		await filter.openSuggestions();
-		await filter
-			.suggestion(RECENT_REMOVED)
-			.getByRole('button', { name: 'Remove from recent searches' })
-			.click();
-		await expect(filter.suggestion(RECENT_REMOVED)).toHaveCount(0);
-	});
-
-	test('TC-15 recent searches survive a reload and stay with their signal', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs);
-		await qb.query('A').filter.type(RECENT_KEPT);
-		await qb.query('A').filter.press('Escape');
-		await qb.run();
-
-		await qb.openExplorer(EXPLORER.logs);
-		await qb.query('A').filter.clear();
-		await qb.query('A').filter.openSuggestions();
-		await expect(qb.query('A').filter.suggestion(RECENT_KEPT)).toBeVisible();
-
-		await qb.openExplorer(EXPLORER.traces);
-		await qb.query('A').filter.clear();
-		await qb.query('A').filter.openSuggestions();
-		await expect(qb.query('A').filter.suggestion(RECENT_KEPT)).toHaveCount(0);
-	});
-
-	test('TC-16 a quick-filter value toggles between excluded and cleared', async ({
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs);
-		const filter = qb.query('A').filter;
-		const handTyped = "service.name = 'frontend'";
-		const excluded = `${handTyped} severity_text not in ['ERROR']`;
-		const error = qb.quickFilter('Severity Text', 'ERROR');
-		await filter.type(handTyped);
-		await qb.run();
-
-		for (const expected of [excluded, handTyped, excluded]) {
-			const fired = await error.toggle();
-
-			expect(qb.spec(fired, 'A').filter?.expression).toBe(expected);
-			await expect.poll(() => filter.expression()).toBe(expected);
-		}
-		await expect(error.checkbox()).toHaveAttribute('aria-checked', 'false');
-	});
-});

tests/e2e/tests/query-builder/metrics.spec.ts

@@ -1,106 +0,0 @@
-import {
-	expect,
-	EXPLORER,
-	type MetricTypes,
-	OTHER_SUM_METRIC,
-	SUM_METRIC,
-	test as base,
-	withMetricTypes,
-} from '../../drivers/query-builder';
-
-const test = withMetricTypes(base);
-
-const MOMENT_AGGREGATIONS = ['Sum', 'Avg', 'Min', 'Max'];
-
-interface TypeDefaults {
-	metric: (types: MetricTypes) => string;
-	time?: string;
-	space: string;
-	spaceOptions: string[];
-}
-
-const DEFAULTS: Record<string, TypeDefaults> = {
-	sum: {
-		metric: () => SUM_METRIC,
-		time: 'Rate',
-		space: 'Sum',
-		spaceOptions: MOMENT_AGGREGATIONS,
-	},
-	gauge: {
-		metric: (types) => types.gauge,
-		time: 'Avg',
-		space: 'Avg',
-		spaceOptions: MOMENT_AGGREGATIONS,
-	},
-	histogram: {
-		metric: (types) => types.histogram,
-		space: 'P90',
-		spaceOptions: ['P50', 'P75', 'P90', 'P95', 'P99'],
-	},
-};
-
-test.describe('Query builder — metric aggregations', () => {
-	for (const [type, expected] of Object.entries(DEFAULTS)) {
-		test(`TC-19 a ${type} metric gets its type's default aggregations`, async ({
-			metricTypes,
-			qb,
-		}) => {
-			const metricName = expected.metric(metricTypes);
-			await qb.openExplorer(EXPLORER.metrics);
-			const metric = qb.query('A').metric;
-
-			await metric.select(metricName);
-
-			await expect(metric.spaceAggregation()).toHaveText(expected.space);
-			expect(await metric.spaceOptions()).toEqual(expected.spaceOptions);
-			const fired = await qb.run();
-			expect(qb.spec(fired, 'A').aggregations?.[0]).toMatchObject({
-				metricName,
-				spaceAggregation: expected.space.toLowerCase(),
-				...(expected.time && { timeAggregation: expected.time.toLowerCase() }),
-			});
-		});
-	}
-
-	test('TC-19 a histogram has no time aggregation control', async ({
-		metricTypes,
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.metrics);
-
-		await qb.query('A').metric.select(metricTypes.histogram);
-
-		await expect(qb.query('A').metric.spaceAggregation()).toHaveText('P90');
-		await expect(qb.query('A').metric.timeAggregation()).toHaveCount(0);
-	});
-
-	test('TC-20 aggregations reset only when the metric type changes', async ({
-		metricTypes,
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.metrics);
-		const metric = qb.query('A').metric;
-
-		await metric.select(SUM_METRIC);
-		await metric.setTimeAggregation('Increase');
-		await metric.setSpaceAggregation('Max');
-
-		await metric.select(OTHER_SUM_METRIC);
-		await expect(metric.timeAggregation()).toHaveText('Increase');
-		await expect(metric.spaceAggregation()).toHaveText('Max');
-
-		await metric.select(metricTypes.gauge);
-		await expect(metric.timeAggregation()).toHaveText('Avg');
-		await expect(metric.spaceAggregation()).toHaveText('Avg');
-
-		await metric.select(SUM_METRIC);
-		await expect(metric.timeAggregation()).toHaveText('Rate');
-		await expect(metric.spaceAggregation()).toHaveText('Sum');
-		const fired = await qb.run();
-		expect(qb.spec(fired, 'A').aggregations?.[0]).toMatchObject({
-			metricName: SUM_METRIC,
-			timeAggregation: 'rate',
-			spaceAggregation: 'sum',
-		});
-	});
-});

tests/e2e/tests/query-builder/multi-query.spec.ts

@@ -1,112 +0,0 @@
-import {
-	metricsQuery,
-	SINGLE_PANEL_ID,
-	singlePanelDashboard,
-	test as editorTest,
-} from '../../drivers/panel-editor';
-import {
-	expect,
-	OTHER_SUM_METRIC,
-	SUM_METRIC,
-	withQueryBuilder,
-} from '../../drivers/query-builder';
-
-// In the panel editor a new query starts as metrics with no metric picked, and
-// Run does nothing until one is: each added query picks a metric first.
-const test = withQueryBuilder(editorTest);
-
-const CLONED_FILTER = "operation = '/ads/get'";
-
-test.describe('Query builder — multiple queries', () => {
-	test('TC-28 a deleted name is reused by the next added query', async ({
-		dashboards,
-		qb,
-	}) => {
-		await dashboards.seedAndEdit(
-			singlePanelDashboard({ query: metricsQuery() }),
-			SINGLE_PANEL_ID,
-		);
-		for (const name of ['B', 'C']) {
-			await (await qb.addQuery(name)).metric.select(OTHER_SUM_METRIC);
-		}
-		expect(await qb.queryNames()).toEqual(['A', 'B', 'C']);
-
-		await qb.query('B').delete();
-		expect(await qb.queryNames()).toEqual(['A', 'C']);
-		const reAdded = await qb.addQuery('B');
-		expect(await qb.queryNames()).toEqual(['A', 'C', 'B']);
-		await reAdded.metric.select(SUM_METRIC);
-		await expect(reAdded.metric.input()).toHaveValue(SUM_METRIC);
-		await expect(qb.query('C').metric.input()).toHaveValue(OTHER_SUM_METRIC);
-	});
-
-	test('TC-28 a clone and a hidden query reach the request', async ({
-		dashboards,
-		qb,
-	}) => {
-		await dashboards.seedAndEdit(
-			singlePanelDashboard({ query: metricsQuery({ filter: CLONED_FILTER }) }),
-			SINGLE_PANEL_ID,
-		);
-		await (await qb.addQuery('B')).metric.select(OTHER_SUM_METRIC);
-
-		await qb.query('A').clone();
-		await expect
-			.poll(() => qb.query('C').filter.expression())
-			.toBe(CLONED_FILTER);
-		await qb.query('B').toggleVisibility();
-		await qb.runButton().click();
-
-		await expect.poll(() => qb.latest('B')?.disabled).toBe(true);
-		expect(qb.latest('C')).toMatchObject({
-			filter: { expression: CLONED_FILTER },
-			aggregations: [expect.objectContaining({ metricName: SUM_METRIC })],
-		});
-	});
-
-	test('TC-28 the last remaining query offers no delete', async ({
-		dashboards,
-		qb,
-	}) => {
-		await dashboards.seedAndEdit(
-			singlePanelDashboard({ query: metricsQuery() }),
-			SINGLE_PANEL_ID,
-		);
-		await (await qb.addQuery('B')).metric.select(OTHER_SUM_METRIC);
-
-		await qb.query('B').delete();
-		await qb.query('A').actions().click();
-
-		await expect(qb.query('A').menuItem('clone')).toBeVisible();
-		await expect(qb.query('A').menuItem('delete')).toHaveCount(0);
-	});
-
-	test('TC-29 a formula over two queries reaches the request', async ({
-		dashboards,
-		qb,
-	}) => {
-		await dashboards.seedAndEdit(
-			singlePanelDashboard({ query: metricsQuery() }),
-			SINGLE_PANEL_ID,
-		);
-		await (await qb.addQuery('B')).metric.select(OTHER_SUM_METRIC);
-
-		const formula = await qb.addFormula('F1');
-		await formula.expression().fill('A / B');
-		await formula.legend().fill('ratio');
-		await qb.runButton().click();
-		await expect
-			.poll(() => qb.latest('F1'))
-			.toMatchObject({ expression: 'A / B', legend: 'ratio' });
-
-		await formula.delete();
-		await qb.rerunUntil(
-			() =>
-				qb
-					.sent()
-					.at(-1)
-					?.compositeQuery.queries.map((q) => q.spec.name),
-			['A', 'B'],
-		);
-	});
-});

tests/e2e/tests/query-builder/panel-editor.spec.ts

@@ -1,203 +0,0 @@
-import {
-	logsCountQuery,
-	metricsQuery,
-	PanelKind,
-	SINGLE_PANEL_ID,
-	singlePanelDashboard,
-	test as editorTest,
-} from '../../drivers/panel-editor';
-import {
-	expect,
-	reduceToLabel,
-	SUM_METRIC,
-	withMetricTypes,
-	withQueryBuilder,
-} from '../../drivers/query-builder';
-
-const test = withMetricTypes(withQueryBuilder(editorTest));
-
-const LOGS_FILTER = "severity_text = 'ERROR'";
-const TRACES_FILTER = "http.method = 'GET'";
-const PROMQL = 'sum(rate(signoz_calls_total[5m]))';
-
-const QUERIES = {
-	logs: () => logsCountQuery(),
-	traces: () => logsCountQuery({ signal: 'traces' }),
-	metrics: () => metricsQuery(),
-};
-
-const ALL = ['group_by', 'having', 'order_by', 'limit', 'legend_format'];
-const NO_HAVING = ['group_by', 'order_by', 'limit', 'legend_format'];
-const METRICS = ['having', 'order_by', 'limit', 'legend_format'];
-
-/**
- * Add-on toggles each panel kind offers per signal. Metrics group by lives in
- * the aggregation row, so it is never a toggle there.
- */
-const ADD_ONS: Record<
-	keyof typeof QUERIES,
-	Partial<Record<string, string[]>>
-> = {
-	logs: {
-		[PanelKind.TimeSeries]: ALL,
-		[PanelKind.BarChart]: ALL,
-		[PanelKind.Table]: ALL,
-		[PanelKind.PieChart]: ALL,
-		[PanelKind.Number]: ['legend_format'],
-		[PanelKind.Heatmap]: NO_HAVING,
-	},
-	traces: {
-		[PanelKind.TimeSeries]: ALL,
-		[PanelKind.BarChart]: ALL,
-		[PanelKind.Table]: ALL,
-		[PanelKind.PieChart]: ALL,
-		[PanelKind.Number]: ['legend_format'],
-		[PanelKind.Heatmap]: NO_HAVING,
-	},
-	metrics: {
-		[PanelKind.TimeSeries]: METRICS,
-		[PanelKind.BarChart]: METRICS,
-		[PanelKind.Table]: [...METRICS, 'reduce_to'],
-		[PanelKind.PieChart]: [...METRICS, 'reduce_to'],
-		[PanelKind.Number]: ['legend_format', 'reduce_to'],
-		[PanelKind.Heatmap]: ['order_by', 'limit', 'legend_format', 'bucket_options'],
-	},
-};
-
-test.describe('Query builder — panel editor', () => {
-	for (const [signal, kinds] of Object.entries(ADD_ONS)) {
-		for (const [kind, expected] of Object.entries(kinds)) {
-			test(`TC-27 ${signal} on ${kind.replace('signoz/', '')} offers its add-ons`, async ({
-				dashboards,
-				qb,
-			}) => {
-				await dashboards.seedAndEdit(
-					singlePanelDashboard({
-						kind: kind as PanelKind,
-						query: QUERIES[signal as keyof typeof QUERIES](),
-					}),
-					SINGLE_PANEL_ID,
-				);
-
-				await expect(qb.query('A').addOns.toggles()).toHaveCount(
-					expected?.length ?? 0,
-				);
-				const toggles = await qb
-					.query('A')
-					.addOns.toggles()
-					.evaluateAll((nodes) =>
-						nodes.map((node) =>
-							(node.getAttribute('data-testid') ?? '').replace('query-add-on-', ''),
-						),
-					);
-				expect(toggles).toEqual(expected);
-			});
-		}
-	}
-
-	test('TC-27 a limit hidden by a kind switch reopens with its value', async ({
-		dashboards,
-		editor,
-		qb,
-	}) => {
-		await dashboards.seedAndEdit(
-			singlePanelDashboard({ query: logsCountQuery() }),
-			SINGLE_PANEL_ID,
-		);
-		const addOns = qb.query('A').addOns;
-		await addOns.open('limit');
-		await addOns.limit().fill('7');
-
-		await editor.switchType(PanelKind.Number);
-		await expect(addOns.content('limit')).toHaveCount(0);
-		await editor.switchType(PanelKind.TimeSeries);
-
-		await expect(addOns.limit()).toHaveValue('7');
-		// The kind switch already fetched: Run can be a cache hit.
-		await qb.runButton().click();
-		await expect.poll(() => qb.latest('A')?.limit).toBe(7);
-	});
-
-	test('TC-26 reduce-to follows the metric type and keeps a choice within it', async ({
-		dashboards,
-		metricTypes,
-		qb,
-	}) => {
-		await dashboards.seedAndEdit(
-			singlePanelDashboard({ kind: PanelKind.Table, query: metricsQuery() }),
-			SINGLE_PANEL_ID,
-		);
-		const query = qb.query('A');
-		await expect(query.addOns.reduceTo.value()).toHaveText(reduceToLabel('Sum'));
-
-		await query.addOns.reduceTo.set('Max');
-		await query.metric.select('signoz_latency_count');
-		await expect(query.addOns.reduceTo.value()).toHaveText(reduceToLabel('Max'));
-
-		await query.metric.select(metricTypes.gauge);
-		await expect(query.addOns.reduceTo.value()).toHaveText(
-			reduceToLabel('Average'),
-		);
-
-		await query.metric.select(SUM_METRIC);
-		await expect(query.addOns.reduceTo.value()).toHaveText(reduceToLabel('Sum'));
-		expect(qb.spec(await qb.run(), 'A').aggregations?.[0]).toMatchObject({
-			metricName: SUM_METRIC,
-			reduceTo: 'sum',
-		});
-	});
-
-	test('TC-31 switching signal restores the query left on each signal', async ({
-		dashboards,
-		qb,
-	}) => {
-		await dashboards.seedAndEdit(
-			singlePanelDashboard({ query: logsCountQuery({ groupBy: [] }) }),
-			SINGLE_PANEL_ID,
-		);
-		const query = qb.query('A');
-		await query.filter.type(LOGS_FILTER);
-		await query.filter.press('Escape');
-
-		await query.setSignal('Traces');
-		await expect.poll(() => query.filter.expression()).toBe('');
-		await query.filter.type(TRACES_FILTER);
-		await query.filter.press('Escape');
-
-		await query.setSignal('Logs');
-		await expect.poll(() => query.filter.expression()).toBe(LOGS_FILTER);
-		await query.setSignal('Traces');
-		await expect.poll(() => query.filter.expression()).toBe(TRACES_FILTER);
-		await qb.runButton().click();
-		await expect
-			.poll(() => qb.latest('A'))
-			.toMatchObject({
-				signal: 'traces',
-				filter: { expression: TRACES_FILTER },
-			});
-	});
-
-	test('TC-33 a PromQL query is sent as promql and kept across tab switches', async ({
-		dashboards,
-		qb,
-	}) => {
-		await dashboards.seedAndEdit(
-			singlePanelDashboard({ query: metricsQuery() }),
-			SINGLE_PANEL_ID,
-		);
-
-		await qb.tab('promql').click();
-		await qb.promql().fill(PROMQL);
-		const fired = await qb.run();
-		expect(fired.at(-1)?.compositeQuery.queries[0]).toMatchObject({
-			type: 'promql',
-			spec: { name: 'A', query: PROMQL },
-		});
-
-		await qb.tab('clickhouse_sql').click();
-		await qb.tab('builder').click();
-		await expect(qb.query('A').metric.spaceAggregation()).toHaveText('Sum');
-		await qb.tab('promql').click();
-		await expect(qb.promql()).toHaveValue(PROMQL);
-	});
-});

tests/e2e/tests/query-builder/run.spec.ts

@@ -1,80 +0,0 @@
-import { expect, EXPLORER, test } from '../../drivers/query-builder';
-import {
-	holdQueryRange,
-	mockQueryRange,
-	mockQueryRangeError,
-	QueryRange,
-	unmockQueryRange,
-} from '../../helpers/query-range-mock';
-
-test.describe('Query builder — run and cancel', () => {
-	test('TC-34 a held run can be cancelled and the next run goes through', async ({
-		authedPage: page,
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs);
-		const held = await holdQueryRange(page, QueryRange.empty());
-		await qb.query('A').filter.type("severity_text = 'WARN'");
-		await qb.query('A').filter.press('Escape');
-
-		await qb.runButton().click();
-		await expect(qb.runButton()).toHaveText('Cancel');
-		await qb.runButton().click();
-		await expect(qb.runButton()).toHaveText(/Run Query/);
-		await expect(qb.logsResults()).toContainText('Query cancelled');
-
-		held.release();
-		await unmockQueryRange(page);
-		await qb.query('A').filter.type("severity_text = 'ERROR'");
-		await qb.query('A').filter.press('Escape');
-		// The cancelled query is re-sent alongside; the newest request wins.
-		await qb.run();
-		expect(qb.latest('A')?.filter?.expression).toBe("severity_text = 'ERROR'");
-		await expect(qb.logsResults()).not.toContainText('Query cancelled');
-	});
-
-	test('TC-35 a failed run keeps the query editable and the next run recovers', async ({
-		authedPage: page,
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs);
-		await mockQueryRangeError(page, 'mocked query failure');
-		await qb.query('A').filter.type("severity_text = 'INFO'");
-		await qb.query('A').filter.press('Escape');
-
-		await qb.runButton().click();
-		// The failed request is retried before the error settles.
-		await expect(qb.runButton()).toHaveText(/Run Query/, { timeout: 20_000 });
-		await expect(qb.logsResults()).toContainText('mocked query failure');
-		await expect
-			.poll(() => qb.query('A').filter.expression())
-			.toBe("severity_text = 'INFO'");
-
-		await unmockQueryRange(page);
-		await qb.query('A').filter.type("severity_text = 'WARN'");
-		await qb.query('A').filter.press('Escape');
-		const fired = await qb.run();
-		expect(qb.spec(fired, 'A').filter?.expression).toBe("severity_text = 'WARN'");
-		await expect(qb.logsResults()).not.toContainText('mocked query failure');
-	});
-
-	test('TC-35 an empty result leaves the query unchanged', async ({
-		authedPage: page,
-		qb,
-	}) => {
-		await qb.openExplorer(EXPLORER.logs);
-		await mockQueryRange(page, QueryRange.empty());
-		await qb.query('A').filter.type("service.name = 'nothing-here'");
-		await qb.query('A').filter.press('Escape');
-
-		const fired = await qb.run();
-
-		expect(qb.spec(fired, 'A').filter?.expression).toBe(
-			"service.name = 'nothing-here'",
-		);
-		await expect
-			.poll(() => qb.query('A').filter.expression())
-			.toBe("service.name = 'nothing-here'");
-		expect(qb.console.errors).toEqual([]);
-	});
-});

tests/e2e/tests/query-builder/url.spec.ts

@@ -1,198 +0,0 @@
-import { expect, EXPLORER, test } from '../../drivers/query-builder';
-
-// A shared or hand-edited explorer link must never take the page down: the
-// param is parsed, repaired and rewritten before the builder mounts.
-
-const MALFORMED: Record<string, string> = {
-	'not JSON': 'not-json',
-	'truncated JSON': '%7B',
-	'a JSON string': encodeURIComponent('"a string"'),
-	'a JSON array': encodeURIComponent('[]'),
-	'JSON null': 'null',
-	'an empty JSON string': '%22%22',
-	'double encoded': encodeURIComponent(
-		encodeURIComponent(JSON.stringify({ queryType: 'builder' })),
-	),
-};
-
-const PARTIAL: Record<string, unknown> = {
-	'an empty object': {},
-	'builder with no builder block': { queryType: 'builder' },
-	'builder with no queryData': { queryType: 'builder', builder: {} },
-	'empty queryData': {
-		queryType: 'builder',
-		builder: { queryData: [], queryFormulas: [] },
-	},
-	'a query with no dataSource': {
-		queryType: 'builder',
-		builder: { queryData: [{ queryName: 'A' }] },
-	},
-	'an unknown queryType': { queryType: 'zzz' },
-	'non-array promql and clickhouse blocks': {
-		queryType: 'builder',
-		promql: {},
-		clickhouse_sql: 'x',
-		builder: { queryData: [{ queryName: 'A', dataSource: 'logs' }] },
-	},
-};
-
-/**
- * Saved before the v5 builder: structured filters, a having array and an
- * aggregate operator. The old having filter wrote `columnName` upper-cased
- * (`COUNT()`).
- */
-const legacyLogsQuery = (having: unknown[]): unknown => ({
-	queryType: 'builder',
-	promql: [],
-	clickhouse_sql: [],
-	builder: {
-		queryFormulas: [],
-		queryData: [
-			{
-				queryName: 'A',
-				dataSource: 'logs',
-				expression: 'A',
-				disabled: false,
-				aggregateOperator: 'count',
-				aggregateAttribute: { key: '', dataType: '', type: '', isColumn: false },
-				filters: {
-					op: 'AND',
-					items: [
-						{
-							id: 'f1',
-							key: {
-								key: 'severity_text',
-								dataType: 'string',
-								type: '',
-								isColumn: true,
-							},
-							op: '=',
-							value: 'ERROR',
-						},
-					],
-				},
-				having,
-				groupBy: [],
-				orderBy: [],
-				functions: [],
-				legend: '',
-				limit: null,
-				stepInterval: 60,
-				reduceTo: 'avg',
-			},
-		],
-	},
-});
-
-const FIRST = "service.name = 'frontend'";
-const SECOND = "service.name = 'cartservice'";
-
-interface UrlQuery {
-	builder?: { queryData?: { filter?: { expression?: string } }[] };
-}
-
-test.describe('Query builder — URL handling', () => {
-	for (const [label, raw] of Object.entries(MALFORMED)) {
-		test(`TC-01 logs explorer survives ${label} and still runs`, async ({
-			qb,
-		}) => {
-			await qb.openExplorer(EXPLORER.logs, { raw });
-
-			await expect(qb.query('A').filter.content()).toBeVisible();
-			await qb.query('A').filter.type("severity_text = 'ERROR'");
-			const fired = await qb.run();
-
-			expect(qb.spec(fired, 'A').filter?.expression).toBe(
-				"severity_text = 'ERROR'",
-			);
-			expect(qb.urlQuery()).toMatchObject({ queryType: 'builder' });
-			expect(qb.console.errors).toEqual([]);
-		});
-	}
-
-	for (const [label, query] of Object.entries(PARTIAL)) {
-		test(`TC-02 logs explorer repairs ${label}`, async ({ qb }) => {
-			const loaded = await qb.openExplorer(EXPLORER.logs, { query });
-
-			expect(qb.spec(loaded, 'A').signal).toBe('logs');
-			await expect
-				.poll(() => qb.urlQuery())
-				.toMatchObject({
-					queryType: 'builder',
-					builder: { queryData: [{ queryName: 'A', dataSource: 'logs' }] },
-				});
-			expect(qb.console.errors).toEqual([]);
-		});
-	}
-
-	test('TC-03 legacy filters and aggregate operator convert to v5 expressions', async ({
-		qb,
-	}) => {
-		const loaded = await qb.openExplorer(EXPLORER.logs, {
-			view: 'graph',
-			query: legacyLogsQuery([]),
-		});
-
-		const spec = qb.spec(loaded, 'A');
-		expect(spec.filter?.expression).toMatch(/^severity_text\s*=\s*'ERROR'$/);
-		expect(spec.aggregations?.[0]?.expression).toBe('count()');
-		expect(spec).not.toHaveProperty('filters');
-		await expect
-			.poll(() => qb.query('A').filter.expression())
-			.toMatch(/^severity_text\s*=\s*'ERROR'$/);
-		expect(qb.console.errors).toEqual([]);
-	});
-
-	// known: convertHavingToExpression keeps the stored `COUNT()` casing, which
-	// the v5 backend rejects with a 400 ("Invalid references in `Having`").
-	test.fixme('TC-03 a legacy having as the old builder stored it still runs', async ({
-		qb,
-	}) => {
-		const loaded = await qb.openExplorer(EXPLORER.logs, {
-			view: 'graph',
-			query: legacyLogsQuery([{ columnName: 'COUNT()', op: '>', value: 5 }]),
-		});
-
-		expect(qb.spec(loaded, 'A').having?.expression).toMatch(
-			/^count\(\)\s*>\s*5$/i,
-		);
-		expect(qb.console.failedResponses).toEqual([]);
-	});
-
-	for (const explorer of ['logs', 'traces'] as const) {
-		test(`TC-04 ${explorer} explorer query follows back, forward and reload`, async ({
-			authedPage: page,
-			qb,
-		}) => {
-			await qb.openExplorer(EXPLORER[explorer]);
-			const filter = qb.query('A').filter;
-			const urlFilter = (): unknown =>
-				(qb.urlQuery() as UrlQuery | null)?.builder?.queryData?.[0]?.filter
-					?.expression;
-
-			await filter.type(FIRST);
-			await qb.run();
-			await filter.type(SECOND);
-			await qb.run();
-
-			await page.goBack();
-			await expect.poll(urlFilter).toBe(FIRST);
-			await expect.poll(() => filter.expression()).toBe(FIRST);
-
-			await page.goForward();
-			await expect.poll(urlFilter).toBe(SECOND);
-			await expect.poll(() => filter.expression()).toBe(SECOND);
-
-			await filter.type("service.name = 'unsaved'");
-			const sentBefore = qb.sent().length;
-			await page.reload();
-			await expect.poll(() => filter.expression()).toBe(SECOND);
-			await expect
-				.poll(() => qb.sent().slice(sentBefore).length)
-				.toBeGreaterThan(0);
-			expect(qb.spec(qb.sent().slice(sentBefore), 'A').filter?.expression).toBe(
-				SECOND,
-			);
-		});
-	}
-});

tests/integration/testdata/role/managed_role_transactions.json

@@ -188,7 +188,9 @@
         "read",
         "update",
         "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
       ]
     },
     {
@@ -199,7 +201,9 @@
         "read",
         "update",
         "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
       ]
     },
     {
@@ -256,7 +260,9 @@
         "read",
         "update",
         "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
       ]
     },
     {
@@ -267,7 +273,9 @@
         "read",
         "update",
         "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
       ]
     },
     {
@@ -416,7 +424,9 @@
         "read",
         "update",
         "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
       ]
     },
     {
@@ -427,7 +437,9 @@
         "read",
         "update",
         "delete",
-        "list"
+        "list",
+        "attach",
+        "detach"
       ]
     },
     {
@@ -492,7 +504,9 @@
       "kind": "notification-channel",
       "verbs": [
         "read",
-        "list"
+        "list",
+        "attach",
+        "detach"
       ]
     },
     {