feat: update tests

.github/CODEOWNERS

@@ -189,9 +189,7 @@ go.mod @therealpandey
 ## Infrastructure Monitoring
 /frontend/src/pages/InfrastructureMonitoring/ @SigNoz/pulse-frontend
 /frontend/src/container/InfraMonitoringHosts/ @SigNoz/pulse-frontend
-/frontend/src/container/InfraMonitoringHostsV2/ @SigNoz/pulse-frontend
 /frontend/src/container/InfraMonitoringK8s/ @SigNoz/pulse-frontend
-/frontend/src/container/InfraMonitoringK8sV2/ @SigNoz/pulse-frontend
 
 ## Alerts
 /frontend/src/pages/AlertList/ @SigNoz/pulse-frontend

docs/api/openapi.yml

@@ -543,31 +543,6 @@ components:
       required:
       - id
       type: object
-    AuthtypesGettableRole:
-      properties:
-        createdAt:
-          format: date-time
-          type: string
-        description:
-          type: string
-        id:
-          type: string
-        name:
-          type: string
-        orgId:
-          type: string
-        type:
-          type: string
-        updatedAt:
-          format: date-time
-          type: string
-      required:
-      - id
-      - name
-      - description
-      - type
-      - orgId
-      type: object
     AuthtypesGettableToken:
       properties:
         accessToken:
@@ -719,6 +694,43 @@ components:
       - detach
       type: string
     AuthtypesRole:
+      properties:
+        createdAt:
+          format: date-time
+          type: string
+        description:
+          type: string
+        id:
+          type: string
+        name:
+          type: string
+        orgId:
+          type: string
+        type:
+          type: string
+        updatedAt:
+          format: date-time
+          type: string
+      required:
+      - id
+      - name
+      - description
+      - type
+      - orgId
+      type: object
+    AuthtypesRoleMapping:
+      properties:
+        defaultRole:
+          type: string
+        groupMappings:
+          additionalProperties:
+            type: string
+          nullable: true
+          type: object
+        useRoleAttribute:
+          type: boolean
+      type: object
+    AuthtypesRoleWithTransactionGroups:
       properties:
         createdAt:
           format: date-time
@@ -746,18 +758,6 @@ components:
       - orgId
       - transactionGroups
       type: object
-    AuthtypesRoleMapping:
-      properties:
-        defaultRole:
-          type: string
-        groupMappings:
-          additionalProperties:
-            type: string
-          nullable: true
-          type: object
-        useRoleAttribute:
-          type: boolean
-      type: object
     AuthtypesSamlConfig:
       properties:
         attributeMapping:
@@ -12022,7 +12022,7 @@ paths:
                 properties:
                   data:
                     items:
-                      $ref: '#/components/schemas/AuthtypesGettableRole'
+                      $ref: '#/components/schemas/AuthtypesRole'
                     type: array
                   status:
                     type: string
@@ -12206,7 +12206,7 @@ paths:
               schema:
                 properties:
                   data:
-                    $ref: '#/components/schemas/AuthtypesRole'
+                    $ref: '#/components/schemas/AuthtypesRoleWithTransactionGroups'
                   status:
                     type: string
                 required:

ee/authz/openfgaauthz/provider.go

@@ -119,6 +119,10 @@ func (provider *provider) CheckTransactions(ctx context.Context, subject string,
 	return results, nil
 }
 
+func (provider *provider) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, objectType coretypes.Type) ([]*coretypes.Object, error) {
+	return provider.openfgaServer.ListObjects(ctx, subject, relation, objectType)
+}
+
 func (provider *provider) Write(ctx context.Context, additions []*openfgav1.TupleKey, deletions []*openfgav1.TupleKey) error {
 	return provider.openfgaServer.Write(ctx, additions, deletions)
 }
@@ -127,6 +131,10 @@ func (provider *provider) ReadTuples(ctx context.Context, tupleKey *openfgav1.Re
 	return provider.openfgaServer.ReadTuples(ctx, tupleKey)
 }
 
+func (provider *provider) Get(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*authtypes.Role, error) {
+	return provider.pkgAuthzService.Get(ctx, orgID, id)
+}
+
 func (provider *provider) GetByOrgIDAndName(ctx context.Context, orgID valuer.UUID, name string) (*authtypes.Role, error) {
 	return provider.pkgAuthzService.GetByOrgIDAndName(ctx, orgID, name)
 }
@@ -175,7 +183,7 @@ func (provider *provider) CreateManagedUserRoleTransactions(ctx context.Context,
 	return provider.Write(ctx, tuples, nil)
 }
 
-func (provider *provider) Create(ctx context.Context, orgID valuer.UUID, role *authtypes.Role) error {
+func (provider *provider) Create(ctx context.Context, orgID valuer.UUID, role *authtypes.RoleWithTransactionGroups) error {
 	_, err := provider.licensing.GetActive(ctx, orgID)
 	if err != nil {
 		return errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
@@ -200,31 +208,70 @@ func (provider *provider) Create(ctx context.Context, orgID valuer.UUID, role *a
 		return err
 	}
 
-	return provider.store.Create(ctx, role)
+	if err := provider.store.Create(ctx, role.Role); err != nil {
+		return err
+	}
+
+	return nil
 }
 
-func (provider *provider) Get(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*authtypes.Role, error) {
-	return provider.store.Get(ctx, orgID, id)
+func (provider *provider) GetOrCreate(ctx context.Context, orgID valuer.UUID, role *authtypes.Role) (*authtypes.Role, error) {
+	_, err := provider.licensing.GetActive(ctx, orgID)
+	if err != nil {
+		return nil, errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
+	}
+
+	existingRole, err := provider.store.GetByOrgIDAndName(ctx, role.OrgID, role.Name)
+	if err != nil {
+		if !errors.Ast(err, errors.TypeNotFound) {
+			return nil, err
+		}
+	}
+
+	if existingRole != nil {
+		return existingRole, nil
+	}
+
+	err = provider.store.Create(ctx, role)
+	if err != nil {
+		return nil, err
+	}
+
+	return role, nil
 }
 
-func (provider *provider) Update(ctx context.Context, orgID valuer.UUID, updatedRole *authtypes.Role) error {
+func (provider *provider) GetWithTransactionGroups(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*authtypes.RoleWithTransactionGroups, error) {
+	_, err := provider.licensing.GetActive(ctx, orgID)
+	if err != nil {
+		return nil, errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
+	}
+
+	role, err := provider.store.Get(ctx, orgID, id)
+	if err != nil {
+		return nil, err
+	}
+
+	tuples, err := provider.readAllTuplesForRole(ctx, role.Name, orgID)
+	if err != nil {
+		return nil, err
+	}
+
+	transactionGroups := authtypes.MustNewTransactionGroupsFromTuples(tuples)
+	return authtypes.MakeRoleWithTransactionGroups(role, transactionGroups), nil
+}
+
+func (provider *provider) Update(ctx context.Context, orgID valuer.UUID, updatedRole *authtypes.RoleWithTransactionGroups) error {
 	_, err := provider.licensing.GetActive(ctx, orgID)
 	if err != nil {
 		return errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
 	}
 
-	existingRole, err := provider.Get(ctx, orgID, updatedRole.ID)
+	existingRole, err := provider.GetWithTransactionGroups(ctx, orgID, updatedRole.ID)
 	if err != nil {
 		return err
 	}
 
-	existingTuples, err := provider.readAllTuplesForRole(ctx, existingRole.Name, orgID)
-	if err != nil {
-		return err
-	}
-
-	existingGroups := authtypes.MustNewTransactionGroupsFromTuples(existingTuples)
-	additions, deletions := existingGroups.Diff(updatedRole.TransactionGroups)
+	additions, deletions := existingRole.TransactionGroups.Diff(updatedRole.TransactionGroups)
 	additionTuples, err := authtypes.NewTuplesFromTransactionGroups(existingRole.Name, orgID, additions)
 	if err != nil {
 		return err
@@ -240,7 +287,7 @@ func (provider *provider) Update(ctx context.Context, orgID valuer.UUID, updated
 		return err
 	}
 
-	return provider.store.Update(ctx, orgID, updatedRole)
+	return provider.store.Update(ctx, orgID, updatedRole.Role)
 }
 
 func (provider *provider) Delete(ctx context.Context, orgID valuer.UUID, id valuer.UUID) error {
@@ -249,7 +296,7 @@ func (provider *provider) Delete(ctx context.Context, orgID valuer.UUID, id valu
 		return errors.New(errors.TypeLicenseUnavailable, errors.CodeLicenseUnavailable, "a valid license is not available").WithAdditional("this feature requires a valid license").WithAdditional(err.Error())
 	}
 
-	role, err := provider.Get(ctx, orgID, id)
+	role, err := provider.GetWithTransactionGroups(ctx, orgID, id)
 	if err != nil {
 		return err
 	}
@@ -265,7 +312,7 @@ func (provider *provider) Delete(ctx context.Context, orgID valuer.UUID, id valu
 		}
 	}
 
-	tuples, err := provider.readAllTuplesForRole(ctx, role.Name, orgID)
+	tuples, err := authtypes.NewTuplesFromTransactionGroups(role.Name, orgID, role.TransactionGroups)
 	if err != nil {
 		return err
 	}
@@ -277,24 +324,6 @@ func (provider *provider) Delete(ctx context.Context, orgID valuer.UUID, id valu
 	return provider.store.Delete(ctx, orgID, id)
 }
 
-func (provider *provider) readAllTuplesForRole(ctx context.Context, roleName string, orgID valuer.UUID) ([]*openfgav1.TupleKey, error) {
-	subject := authtypes.MustNewSubject(coretypes.NewResourceRole(), roleName, orgID, &coretypes.VerbAssignee)
-
-	tuples := make([]*openfgav1.TupleKey, 0)
-	for _, objectType := range provider.registry.Types() {
-		typeTuples, err := provider.openfgaServer.ReadTuples(ctx, &openfgav1.ReadRequestTupleKey{
-			User:   subject,
-			Object: objectType.StringValue() + ":",
-		})
-		if err != nil {
-			return nil, err
-		}
-		tuples = append(tuples, typeTuples...)
-	}
-
-	return tuples, nil
-}
-
 func (provider *provider) getManagedRoleGrantTuples(orgID valuer.UUID, userID valuer.UUID) []*openfgav1.TupleKey {
 	tuples := []*openfgav1.TupleKey{}
 
@@ -346,3 +375,21 @@ func (provider *provider) getManagedRoleTransactionTuples(orgID valuer.UUID) []*
 
 	return tuples
 }
+
+func (provider *provider) readAllTuplesForRole(ctx context.Context, roleName string, orgID valuer.UUID) ([]*openfgav1.TupleKey, error) {
+	subject := authtypes.MustNewSubject(coretypes.NewResourceRole(), roleName, orgID, &coretypes.VerbAssignee)
+
+	tuples := make([]*openfgav1.TupleKey, 0)
+	for _, objectType := range provider.registry.Types() {
+		typeTuples, err := provider.ReadTuples(ctx, &openfgav1.ReadRequestTupleKey{
+			User:   subject,
+			Object: objectType.StringValue() + ":",
+		})
+		if err != nil {
+			return nil, err
+		}
+		tuples = append(tuples, typeTuples...)
+	}
+
+	return tuples, nil
+}

ee/authz/openfgaserver/server.go

@@ -105,6 +105,10 @@ func (server *Server) BatchCheck(ctx context.Context, tupleReq map[string]*openf
 	return server.pkgAuthzService.BatchCheck(ctx, tupleReq)
 }
 
+func (server *Server) ListObjects(ctx context.Context, subject string, relation authtypes.Relation, objectType coretypes.Type) ([]*coretypes.Object, error) {
+	return server.pkgAuthzService.ListObjects(ctx, subject, relation, objectType)
+}
+
 func (server *Server) Write(ctx context.Context, additions []*openfgav1.TupleKey, deletions []*openfgav1.TupleKey) error {
 	return server.pkgAuthzService.Write(ctx, additions, deletions)
 }

frontend/__mocks__/resizableMock.tsx

@@ -0,0 +1,29 @@
+import { PropsWithChildren } from 'react';
+
+type CommonProps = PropsWithChildren<{
+	className?: string;
+	minSize?: number;
+	maxSize?: number;
+	defaultSize?: number;
+	direction?: 'horizontal' | 'vertical';
+	autoSaveId?: string;
+	withHandle?: boolean;
+}>;
+
+export function ResizablePanelGroup({
+	children,
+	className,
+}: CommonProps): JSX.Element {
+	return <div className={className}>{children}</div>;
+}
+
+export function ResizablePanel({
+	children,
+	className,
+}: CommonProps): JSX.Element {
+	return <div className={className}>{children}</div>;
+}
+
+export function ResizableHandle({ className }: CommonProps): JSX.Element {
+	return <div className={className} />;
+}

frontend/jest.config.ts

@@ -21,6 +21,7 @@ const config: Config.InitialOptions = {
 		'\\.md$': '<rootDir>/__mocks__/cssMock.ts',
 		'^uplot$': '<rootDir>/__mocks__/uplotMock.ts',
 		'^motion/react$': '<rootDir>/__mocks__/motionMock.tsx',
+		'^@signozhq/resizable$': '<rootDir>/__mocks__/resizableMock.tsx',
 		'^hooks/useSafeNavigate$': USE_SAFE_NAVIGATE_MOCK_PATH,
 		'^src/hooks/useSafeNavigate$': USE_SAFE_NAVIGATE_MOCK_PATH,
 		'^.*/useSafeNavigate$': USE_SAFE_NAVIGATE_MOCK_PATH,

frontend/package.json

@@ -49,6 +49,7 @@
     "@sentry/vite-plugin": "5.3.0",
     "@signozhq/design-tokens": "2.1.4",
     "@signozhq/icons": "0.4.0",
+    "@signozhq/resizable": "0.0.2",
     "@signozhq/ui": "0.0.23",
     "@tanstack/react-table": "8.21.3",
     "@tanstack/react-virtual": "3.13.22",
@@ -127,7 +128,7 @@
     "timestamp-nano": "^1.0.0",
     "typescript": "5.9.3",
     "uplot": "1.6.31",
-    "uuid": "14.0.1",
+    "uuid": "^8.3.2",
     "vite": "npm:rolldown-vite@7.3.1",
     "vite-plugin-html": "3.2.2",
     "zod": "4.3.6",
@@ -221,5 +222,34 @@
     "*.(scss|css)": [
       "stylelint"
     ]
+  },
+  "resolutions": {
+    "@types/react": "18.0.26",
+    "@types/react-dom": "18.0.10",
+    "debug": "4.3.4",
+    "semver": "7.5.4",
+    "xml2js": "0.5.0",
+    "phin": "^3.7.1",
+    "body-parser": "1.20.3",
+    "http-proxy-middleware": "4.1.1",
+    "cross-spawn": "7.0.5",
+    "cookie": "^0.7.1",
+    "serialize-javascript": "6.0.2",
+    "prismjs": "1.30.0",
+    "got": "11.8.5",
+    "form-data": "4.0.6",
+    "brace-expansion": "^2.0.3",
+    "on-headers": "^1.1.0",
+    "js-cookie": "^3.0.7",
+    "tmp": "0.2.7",
+    "vite": "npm:rolldown-vite@7.3.1",
+    "dompurify": "3.4.11",
+    "js-yaml@3": "3.15.0",
+    "js-yaml@4": "4.2.0",
+    "yaml@1": "1.10.3",
+    "react-router@6": "6.30.4",
+    "markdown-it": "14.2.0",
+    "mdast-util-to-hast@13": "13.2.1",
+    "protocol-buffers-schema": "3.6.1"
   }
 }

frontend/pnpm-workspace.yaml

@@ -1,53 +1,6 @@
-blockExoticSubdeps: true
+trustPolicy: no-downgrade
 minimumReleaseAge: 2880 # 2d
+minimumReleaseAgeStrict: true
 minimumReleaseAgeExclude:
  - '@signozhq/*'
-minimumReleaseAgeStrict: true
-# Security floors for vulnerable transitive deps. Where possible, targets are
-# capped to avoid crossing breaking versions (major; and minor for 0.x).
-# Some entries may still force a breaking bump when no safe release exists
-# within the consumer’s constraint—see per-entry notes.
-overrides:
- # via: direct devDep @babel/core ^7.22.11 (+ babel plugin peers)
- # remove: bump @babel/core in package.json to ^7.29.6
- '@babel/core@<=7.29.0': '>=7.29.6 <8'
- # via: jest > babel-plugin-istanbul > @istanbuljs/load-nyc-config@1.1.0 (js-yaml ^3.13.1)
- # remove: blocked — 1.1.0 is latest and still depends on js-yaml 3.x
- '@istanbuljs/load-nyc-config>js-yaml': '>=4.2.0 <5'
- # via: msw@1.3.2 (devDep) > cookie ^0.4.2
- # remove: upgrade msw to >=2 (ships cookie ^1). Do NOT open the cap: cookie >=1 is
- # ESM-only and breaks msw under jest's CJS sandbox (kills every test suite)
- cookie@<0.7.0: '>=0.7.1 <1'
- # via: direct dep dompurify 3.4.0; @grafana/data@11.6.15 (3.4.0/3.2.4 exact);
- #      @monaco-editor/react > monaco-editor@0.55.1 (3.2.7 exact)
- # remove: bump direct dep to 3.4.11; @grafana/data (latest 13.1.0) and
- #         monaco-editor (latest 0.55.1) still pin vulnerable versions — blocked
- dompurify@<=3.4.10: '>=3.4.11 <4'
- # via: rolldown-vite@7.3.1 (esbuild ^0.27.0); orval@8.9.1 (^0.27.4); ts-jest@29.4.9 (~0.27.4)
- # remove: blocked on rolldown-vite (7.3.1 is latest, still ^0.27.0);
- #         orval >=8.20.0 and ts-jest >=29.4.11 already fixed on their side
- esbuild@>=0.27.3 <0.28.1: '>=0.28.1 <0.29.0'
- # via: react-use@17.5.1 (direct, js-cookie ^2.2.1); @grafana/data > react-use@17.6.0
- # remove: bump react-use to >=17.6.1 (js-cookie ^3); @grafana/data side blocked
- js-cookie@<=3.0.5: '>=3.0.7 <4'
- # via: @orval/core@8.9.1 (devDep, js-yaml 4.1.1 EXACT pin — not deletable);
- #      json-schema-to-typescript@15 > @apidevtools/json-schema-ref-parser (^4.1.0)
- # remove: upgrade orval to >=8.20.0 (drops js-yaml dependency entirely)
- js-yaml@>=4.0.0 <=4.1.1: '>=4.2.0 <5'
- # via: react-syntax-highlighter@15.5.0 (prismjs ^1.27.0 + refractor@3 ~1.27.0 tilde-pinned)
- # remove: bump react-syntax-highlighter to >=16.1.1 (prismjs ^1.30.0, refractor@5)
- prismjs@<1.30.0: '>=1.30.0 <2'
- # via: direct dep react-router-dom-v5-compat@6.30.3 (react-router 6.30.3 exact)
- # remove: bump react-router-dom-v5-compat to 6.30.4. Do NOT open the cap:
- # react-router >=7 requires React 19 and breaks the app-wide CompatRouter
- react-router@>=6.7.0 <6.30.4: '>=6.30.4 <7'
- # via: msw@1.3.2 (devDep) > inquirer@8 > external-editor@3.1.0 (tmp ^0.0.33)
- # remove: upgrade msw to >=2 (drops the inquirer/external-editor chain)
- tmp@<0.2.6: '>=0.2.6 <0.3.0'
- # via: jest > babel-plugin-macros > cosmiconfig@7 (yaml ^1.10.0);
- #      typescript-plugin-css-modules > postcss-load-config@3 (^1.10.2)
- # remove: blocked — babel-plugin-macros 3.1.0 (latest) still uses cosmiconfig@7
- yaml@>=1.0.0 <1.10.3: '>=1.10.3 <2'
-trustPolicy: no-downgrade
-trustPolicyExclude:
- - 'semver@6.3.1 || 5.7.2'
+blockExoticSubdeps: true

frontend/src/api/generated/services/sigNoz.schemas.ts

@@ -2082,39 +2082,6 @@ export interface AuthtypesGettableAuthDomainDTO {
 	updatedAt?: string;
 }
 
-export interface AuthtypesGettableRoleDTO {
-	/**
-	 * @type string
-	 * @format date-time
-	 */
-	createdAt?: string;
-	/**
-	 * @type string
-	 */
-	description: string;
-	/**
-	 * @type string
-	 */
-	id: string;
-	/**
-	 * @type string
-	 */
-	name: string;
-	/**
-	 * @type string
-	 */
-	orgId: string;
-	/**
-	 * @type string
-	 */
-	type: string;
-	/**
-	 * @type string
-	 * @format date-time
-	 */
-	updatedAt?: string;
-}
-
 export interface AuthtypesGettableTokenDTO {
 	/**
 	 * @type string
@@ -2358,6 +2325,39 @@ export interface AuthtypesPostableUserRoleDTO {
 }
 
 export interface AuthtypesRoleDTO {
+	/**
+	 * @type string
+	 * @format date-time
+	 */
+	createdAt?: string;
+	/**
+	 * @type string
+	 */
+	description: string;
+	/**
+	 * @type string
+	 */
+	id: string;
+	/**
+	 * @type string
+	 */
+	name: string;
+	/**
+	 * @type string
+	 */
+	orgId: string;
+	/**
+	 * @type string
+	 */
+	type: string;
+	/**
+	 * @type string
+	 * @format date-time
+	 */
+	updatedAt?: string;
+}
+
+export interface AuthtypesRoleWithTransactionGroupsDTO {
 	/**
 	 * @type string
 	 * @format date-time
@@ -10614,7 +10614,7 @@ export type ListRoles200 = {
 	/**
 	 * @type array
 	 */
-	data: AuthtypesGettableRoleDTO[];
+	data: AuthtypesRoleDTO[];
 	/**
 	 * @type string
 	 */
@@ -10636,7 +10636,7 @@ export type GetRolePathParameters = {
 	id: string;
 };
 export type GetRole200 = {
-	data: AuthtypesRoleDTO;
+	data: AuthtypesRoleWithTransactionGroupsDTO;
 	/**
 	 * @type string
 	 */

frontend/src/api/v1/download/downloadExportData.ts

@@ -1,26 +1,50 @@
 import axios from 'api';
 import { ErrorResponseHandlerV2 } from 'api/ErrorResponseHandlerV2';
-import { AxiosError } from 'axios';
+import { AxiosError, AxiosResponse } from 'axios';
 import { ErrorV2Resp } from 'types/api';
 import { ExportRawDataProps } from 'types/api/exportRawData/getExportRawData';
 
+export interface FetchExportDataProps extends ExportRawDataProps {
+	signal?: AbortSignal;
+}
+
+async function postExportRawData({
+	format,
+	body,
+	signal,
+}: FetchExportDataProps): Promise<AxiosResponse<Blob>> {
+	return axios.post<Blob>(
+		`export_raw_data?format=${encodeURIComponent(format)}`,
+		body,
+		{
+			responseType: 'blob',
+			decompress: true,
+			headers: {
+				Accept: 'application/octet-stream',
+				'Content-Type': 'application/json',
+			},
+			timeout: 0,
+			signal,
+		},
+	);
+}
+
+/**
+ * Fetches a single export_raw_data page and returns it as a Blob.
+ * Callers own retry/cancel/error UX.
+ */
+export async function fetchExportData(
+	props: FetchExportDataProps,
+): Promise<Blob> {
+	const response = await postExportRawData(props);
+	return response.data;
+}
+
 export const downloadExportData = async (
 	props: ExportRawDataProps,
 ): Promise<void> => {
 	try {
-		const response = await axios.post<Blob>(
-			`export_raw_data?format=${encodeURIComponent(props.format)}`,
-			props.body,
-			{
-				responseType: 'blob',
-				decompress: true,
-				headers: {
-					Accept: 'application/octet-stream',
-					'Content-Type': 'application/json',
-				},
-				timeout: 0,
-			},
-		);
+		const response = await postExportRawData(props);
 
 		if (response.status !== 200) {
 			throw new Error(

frontend/src/auto-import-registry.d.ts

@@ -12,4 +12,5 @@
 
 import '@signozhq/design-tokens';
 import '@signozhq/icons';
+import '@signozhq/resizable';
 import '@signozhq/ui';

frontend/src/components/RolesSelect/RolesSelect.tsx

@@ -3,7 +3,7 @@ import { Select } from 'antd';
 import { Checkbox } from '@signozhq/ui/checkbox';
 import { convertToApiError } from 'api/ErrorResponseHandlerForGeneratedAPIs';
 import { useListRoles } from 'api/generated/services/role';
-import type { AuthtypesGettableRoleDTO } from 'api/generated/services/sigNoz.schemas';
+import type { AuthtypesRoleDTO } from 'api/generated/services/sigNoz.schemas';
 import cx from 'classnames';
 import APIError from 'types/api/error';
 import { popupContainer } from 'utils/selectPopupContainer';
@@ -16,7 +16,7 @@ export interface RoleOption {
 }
 
 export function useRoles(): {
-	roles: AuthtypesGettableRoleDTO[];
+	roles: AuthtypesRoleDTO[];
 	isLoading: boolean;
 	isError: boolean;
 	error: APIError | undefined;
@@ -33,7 +33,7 @@ export function useRoles(): {
 }
 
 export function getRoleOptions(
-	roles: AuthtypesGettableRoleDTO[],
+	roles: AuthtypesRoleDTO[],
 	valueField: 'id' | 'name',
 ): RoleOption[] {
 	return roles.map((role) => ({
@@ -79,7 +79,7 @@ interface BaseProps {
 	placeholder?: string;
 	className?: string;
 	getPopupContainer?: (trigger: HTMLElement) => HTMLElement;
-	roles?: AuthtypesGettableRoleDTO[];
+	roles?: AuthtypesRoleDTO[];
 	loading?: boolean;
 	isError?: boolean;
 	error?: APIError;

frontend/src/components/ServiceAccountDrawer/OverviewTab.tsx

@@ -4,7 +4,7 @@ import { Badge } from '@signozhq/ui/badge';
 import { Button } from '@signozhq/ui/button';
 import { Input } from '@signozhq/ui/input';
 import { useCopyToClipboard } from 'react-use';
-import type { AuthtypesGettableRoleDTO } from 'api/generated/services/sigNoz.schemas';
+import type { AuthtypesRoleDTO } from 'api/generated/services/sigNoz.schemas';
 import AuthZTooltip from 'lib/authz/components/AuthZTooltip/AuthZTooltip';
 import { withAuthZContent } from 'lib/authz/components/withAuthZ/withAuthZContent';
 import RolesSelect from 'components/RolesSelect';
@@ -28,7 +28,7 @@ interface OverviewTabProps {
 	localRoles: string[];
 	onRolesChange: (v: string[]) => void;
 	isDisabled: boolean;
-	availableRoles: AuthtypesGettableRoleDTO[];
+	availableRoles: AuthtypesRoleDTO[];
 	rolesLoading?: boolean;
 	rolesError?: boolean;
 	rolesErrorObj?: APIError | undefined;

frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/EntityMetrics.module.scss

@@ -14,28 +14,11 @@
 	box-sizing: border-box;
 }
 
-.entityMetricsTitleContainer {
-	display: flex;
-	align-items: center;
-	gap: 8px;
-}
-
 .entityMetricsTitle {
 	font-size: var(--periscope-font-size-base);
 	color: var(--l2-foreground);
 }
 
-.metricsExplorerLink {
-	display: flex;
-	align-items: center;
-	color: var(--l2-foreground);
-	transition: opacity 0.2s;
-
-	&:hover {
-		color: var(--l3-foreground);
-	}
-}
-
 .metricsHeader {
 	display: flex;
 	justify-content: flex-end;

frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/EntityMetrics.tsx

@@ -1,8 +1,6 @@
 import { useCallback, useMemo, useRef } from 'react';
 import { UseQueryResult } from 'react-query';
-import { Link } from 'react-router-dom';
-import { Compass } from '@signozhq/icons';
-import { Skeleton, Tooltip } from 'antd';
+import { Skeleton } from 'antd';
 import cx from 'classnames';
 import { PANEL_TYPES } from 'constants/queryBuilder';
 import TimeSeries from 'container/DashboardContainer/visualization/charts/TimeSeries/TimeSeries';
@@ -21,7 +19,6 @@ import { GetQueryResultsProps } from 'lib/dashboard/getQueryResults';
 import { useTimezone } from 'providers/Timezone';
 import { SuccessResponse } from 'types/api';
 import { MetricRangePayloadProps } from 'types/api/metrics/getQueryRange';
-import { getMetricsExplorerUrl } from 'utils/explorerUtils';
 
 import { buildEntityMetricsChartConfig } from './configBuilder';
 
@@ -207,31 +204,9 @@ function EntityMetrics<T>({
 						key={entityWidgetInfo[idx].title}
 						className={styles.entityMetricsCol}
 					>
-						<div className={styles.entityMetricsTitleContainer}>
-							<span className={styles.entityMetricsTitle}>
-								{entityWidgetInfo[idx].title}
-							</span>
-							{queryPayloads[idx] &&
-								queryPayloads[idx].graphType !== PANEL_TYPES.TABLE && (
-									<Tooltip title="Open in Metrics Explorer">
-										<Link
-											to={getMetricsExplorerUrl({
-												query: queryPayloads[idx].query,
-												...(selectedInterval && selectedInterval !== 'custom'
-													? { relativeTime: selectedInterval }
-													: {
-															startTimeMs: timeRange.startTime * 1000,
-															endTimeMs: timeRange.endTime * 1000,
-														}),
-											})}
-											className={styles.metricsExplorerLink}
-											data-testid={`open-metrics-explorer-${idx}`}
-										>
-											<Compass size={14} />
-										</Link>
-									</Tooltip>
-								)}
-						</div>
+						<span className={styles.entityMetricsTitle}>
+							{entityWidgetInfo[idx].title}
+						</span>
 						<div className={styles.entityMetricsCard} ref={graphRef}>
 							{renderCardContent(query, idx)}
 						</div>

frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/__tests__/EntityMetrics.test.tsx

@@ -1,5 +1,4 @@
 import { render, screen } from '@testing-library/react';
-import { MemoryRouter } from 'react-router-dom';
 import { InfraMonitoringEntity } from 'container/InfraMonitoringK8sV2/constants';
 import { Time } from 'container/TopNav/DateTimeSelectionV2/types';
 import * as appContextHooks from 'providers/App/App';
@@ -296,19 +295,17 @@ const renderEntityMetrics = (overrides = {}): any => {
 	};
 
 	return render(
-		<MemoryRouter>
-			<EntityMetrics
-				timeRange={defaultProps.timeRange}
-				isModalTimeSelection={defaultProps.isModalTimeSelection}
-				handleTimeChange={defaultProps.handleTimeChange}
-				selectedInterval={defaultProps.selectedInterval}
-				entity={defaultProps.entity}
-				entityWidgetInfo={defaultProps.entityWidgetInfo}
-				getEntityQueryPayload={defaultProps.getEntityQueryPayload}
-				queryKey={defaultProps.queryKey}
-				category={defaultProps.category}
-			/>
-		</MemoryRouter>,
+		<EntityMetrics
+			timeRange={defaultProps.timeRange}
+			isModalTimeSelection={defaultProps.isModalTimeSelection}
+			handleTimeChange={defaultProps.handleTimeChange}
+			selectedInterval={defaultProps.selectedInterval}
+			entity={defaultProps.entity}
+			entityWidgetInfo={defaultProps.entityWidgetInfo}
+			getEntityQueryPayload={defaultProps.getEntityQueryPayload}
+			queryKey={defaultProps.queryKey}
+			category={defaultProps.category}
+		/>,
 	);
 };
 
@@ -337,8 +334,8 @@ const mockTableData: (import('../utils').MetricsTableData[] | null)[] = [
 ];
 
 const mockQueryPayloads = [
-	{ graphType: 'graph', query: { queryType: 'builder' } }, // time_series
-	{ graphType: 'table', query: { queryType: 'builder' } }, // table
+	{ graphType: 'graph' }, // time_series
+	{ graphType: 'table' }, // table
 ];
 
 describe('EntityMetrics', () => {
@@ -445,34 +442,6 @@ describe('EntityMetrics', () => {
 		);
 	});
 
-	it('renders metrics explorer link only for non-table panels', () => {
-		renderEntityMetrics();
-		expect(screen.getByTestId('open-metrics-explorer-0')).toBeInTheDocument();
-		expect(
-			screen.queryByTestId('open-metrics-explorer-1'),
-		).not.toBeInTheDocument();
-	});
-
-	it('builds metrics explorer link with relativeTime when a relative interval is selected', () => {
-		renderEntityMetrics({ selectedInterval: '5m' as Time });
-		const href = screen
-			.getByTestId('open-metrics-explorer-0')
-			.getAttribute('href');
-		expect(href).toContain('relativeTime=5m');
-		expect(href).not.toContain('startTime=');
-		expect(href).not.toContain('endTime=');
-	});
-
-	it('builds metrics explorer link with absolute time range in milliseconds for custom interval', () => {
-		renderEntityMetrics({ selectedInterval: 'custom' as Time });
-		const href = screen
-			.getByTestId('open-metrics-explorer-0')
-			.getAttribute('href');
-		expect(href).toContain(`startTime=${mockTimeRange.startTime * 1000}`);
-		expect(href).toContain(`endTime=${mockTimeRange.endTime * 1000}`);
-		expect(href).not.toContain('relativeTime=');
-	});
-
 	it('passes correct parameters to useEntityMetrics hook', () => {
 		renderEntityMetrics();
 		expect(mockUseEntityMetrics).toHaveBeenCalledWith(

frontend/src/container/RolesSettings/RolesComponents/RolesListingTable.tsx

@@ -3,7 +3,7 @@ import { useHistory } from 'react-router-dom';
 import cx from 'classnames';
 import { Pagination, Skeleton } from 'antd';
 import { useListRoles } from 'api/generated/services/role';
-import { AuthtypesGettableRoleDTO } from 'api/generated/services/sigNoz.schemas';
+import { AuthtypesRoleDTO } from 'api/generated/services/sigNoz.schemas';
 import ErrorInPlace from 'components/ErrorInPlace/ErrorInPlace';
 import ROUTES from 'constants/routes';
 import { useRolesFeatureGate } from 'hooks/useRolesFeatureGate';
@@ -21,7 +21,7 @@ const PAGE_SIZE = 20;
 
 type DisplayItem =
 	| { type: 'section'; label: string; count?: number }
-	| { type: 'role'; role: AuthtypesGettableRoleDTO };
+	| { type: 'role'; role: AuthtypesRoleDTO };
 
 interface RolesListContentProps {
 	searchQuery: string;
@@ -176,7 +176,7 @@ function RolesListContent({ searchQuery }: RolesListContentProps): JSX.Element {
 		);
 	}
 
-	const renderRow = (role: AuthtypesGettableRoleDTO): JSX.Element => (
+	const renderRow = (role: AuthtypesRoleDTO): JSX.Element => (
 		<div
 			key={role.id}
 			className={cx(styles.tableRow, {

frontend/src/container/RolesSettings/hooks/useRolePermissions.ts

@@ -2,7 +2,7 @@ import { useMutation, useQueryClient } from 'react-query';
 import { ErrorType } from 'api/generatedAPIInstance';
 import type {
 	AuthtypesPostableRoleDTO,
-	AuthtypesRoleDTO,
+	AuthtypesRoleWithTransactionGroupsDTO,
 	AuthtypesTransactionGroupDTO,
 	AuthtypesUpdatableRoleDTO,
 } from 'api/generated/services/sigNoz.schemas';
@@ -133,7 +133,7 @@ export function transformTransactionGroupsToResourcePermissions(
 }
 
 export function transformApiToRolePermissions(
-	role: AuthtypesRoleDTO,
+	role: AuthtypesRoleWithTransactionGroupsDTO,
 ): RolePermissionsData {
 	return {
 		roleId: role.id,

frontend/src/hooks/member/useMemberRoleManager.ts

@@ -1,6 +1,6 @@
 import { useCallback, useMemo } from 'react';
 import { useQueryClient } from 'react-query';
-import type { AuthtypesGettableRoleDTO } from 'api/generated/services/sigNoz.schemas';
+import type { AuthtypesRoleDTO } from 'api/generated/services/sigNoz.schemas';
 import {
 	getGetRolesByUserIDQueryKey,
 	useGetRolesByUserID,
@@ -21,11 +21,11 @@ export interface MemberRoleUpdateFailure {
 }
 
 interface UseMemberRoleManagerResult {
-	currentRoles: AuthtypesGettableRoleDTO[];
+	currentRoles: AuthtypesRoleDTO[];
 	isLoading: boolean;
 	applyDiff: (
 		localRoleIds: string[],
-		availableRoles: AuthtypesGettableRoleDTO[],
+		availableRoles: AuthtypesRoleDTO[],
 	) => Promise<MemberRoleUpdateFailure[]>;
 }
 
@@ -40,7 +40,7 @@ export function useMemberRoleManager(
 		{ query: { enabled: !!userId && enabled } },
 	);
 
-	const currentRoles = useMemo<AuthtypesGettableRoleDTO[]>(
+	const currentRoles = useMemo<AuthtypesRoleDTO[]>(
 		() => data?.data ?? [],
 		[data?.data],
 	);
@@ -61,7 +61,7 @@ export function useMemberRoleManager(
 	const applyDiff = useCallback(
 		async (
 			localRoleIds: string[],
-			availableRoles: AuthtypesGettableRoleDTO[],
+			availableRoles: AuthtypesRoleDTO[],
 		): Promise<MemberRoleUpdateFailure[]> => {
 			const currentRoleIds = new Set(
 				currentRoles.map((r) => r.id).filter(Boolean),

frontend/src/hooks/serviceAccount/useServiceAccountRoleManager.ts

@@ -6,7 +6,7 @@ import {
 	useDeleteServiceAccountRoleDeprecated,
 	useGetServiceAccountRoles,
 } from 'api/generated/services/serviceaccount';
-import type { AuthtypesGettableRoleDTO } from 'api/generated/services/sigNoz.schemas';
+import type { AuthtypesRoleDTO } from 'api/generated/services/sigNoz.schemas';
 import { retryOn429 } from 'utils/errorUtils';
 
 const enum PromiseStatus {
@@ -21,11 +21,11 @@ export interface RoleUpdateFailure {
 }
 
 interface UseServiceAccountRoleManagerResult {
-	currentRoles: AuthtypesGettableRoleDTO[];
+	currentRoles: AuthtypesRoleDTO[];
 	isLoading: boolean;
 	applyDiff: (
 		localRoleIds: string[],
-		availableRoles: AuthtypesGettableRoleDTO[],
+		availableRoles: AuthtypesRoleDTO[],
 	) => Promise<RoleUpdateFailure[]>;
 }
 
@@ -40,7 +40,7 @@ export function useServiceAccountRoleManager(
 		{ query: { enabled: options?.enabled ?? true } },
 	);
 
-	const currentRoles = useMemo<AuthtypesGettableRoleDTO[]>(
+	const currentRoles = useMemo<AuthtypesRoleDTO[]>(
 		() => data?.data ?? [],
 		[data?.data],
 	);
@@ -64,7 +64,7 @@ export function useServiceAccountRoleManager(
 	const applyDiff = useCallback(
 		async (
 			localRoleIds: string[],
-			availableRoles: AuthtypesGettableRoleDTO[],
+			availableRoles: AuthtypesRoleDTO[],
 		): Promise<RoleUpdateFailure[]> => {
 			const currentRoleIds = new Set(
 				currentRoles.map((r) => r.id).filter(Boolean),

frontend/src/hooks/useExportData/__tests__/runChunkedExport.test.ts

@@ -0,0 +1,183 @@
+import 'tests/blob-polyfill';
+
+import { fetchExportData } from 'api/v1/download/downloadExportData';
+import { prepareQueryRangePayloadV5 } from 'api/v5/v5';
+import { downloadFile } from 'lib/exportData/downloadFile';
+import { ExportFormat } from 'lib/exportData/types';
+import { Query } from 'types/api/queryBuilder/queryBuilderData';
+
+import { runChunkedExport } from '../runChunkedExport';
+
+jest.mock('api/v1/download/downloadExportData', () => ({
+	fetchExportData: jest.fn(),
+}));
+
+jest.mock('api/v5/v5', () => ({
+	prepareQueryRangePayloadV5: jest.fn(),
+}));
+
+jest.mock('lib/exportData/downloadFile', () => ({
+	downloadFile: jest.fn(),
+	getTimestampedFileName: jest.fn(
+		(base: string, ext: string) => `${base}.${ext}`,
+	),
+}));
+
+const mockFetch = fetchExportData as jest.Mock;
+const mockPreparePayload = prepareQueryRangePayloadV5 as jest.Mock;
+const mockDownloadFile = downloadFile as jest.Mock;
+
+// Minimal query shape — the runner only maps over builder.queryData.
+const query = {
+	builder: { queryData: [{}] },
+} as unknown as Query;
+
+const baseArgs = {
+	query,
+	timeRange: { start: 100, end: 200 },
+	fileNameBase: 'trace-x',
+	format: ExportFormat.Csv,
+	onProgress: jest.fn(),
+};
+
+// EXPORT_PAGE_SIZE is 50_000; rows → parts: 120k → 3, 40k → 1, etc.
+const rowsForParts = (parts: number): number => parts * 50_000;
+
+function runArgs(
+	overrides: Partial<Parameters<typeof runChunkedExport>[0]> = {},
+): Parameters<typeof runChunkedExport>[0] {
+	return {
+		...baseArgs,
+		totalRows: rowsForParts(1),
+		signal: new AbortController().signal,
+		onProgress: jest.fn(),
+		...overrides,
+	};
+}
+
+async function savedFileText(): Promise<string> {
+	expect(mockDownloadFile).toHaveBeenCalledTimes(1);
+	const [blob] = mockDownloadFile.mock.calls[0];
+	return (blob as Blob).text();
+}
+
+describe('runChunkedExport', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+		mockPreparePayload.mockImplementation(({ query: pageQuery }) => ({
+			// Echo the page offset so fetch calls can be asserted per page.
+			queryPayload: { offset: pageQuery.builder.queryData[0].offset },
+		}));
+	});
+
+	it('fetches one page for small exports and saves the file', async () => {
+		mockFetch.mockResolvedValueOnce(new Blob(['h\na,b\n']));
+		const onProgress = jest.fn();
+
+		await runChunkedExport(runArgs({ totalRows: 40_000, onProgress }));
+
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		expect(mockFetch.mock.calls[0][0].body).toStrictEqual({ offset: 0 });
+		expect(onProgress).toHaveBeenCalledWith(100);
+		await expect(savedFileText()).resolves.toBe('h\na,b\n');
+	});
+
+	it('fetches every page with the right offsets and stitches in order', async () => {
+		mockFetch.mockImplementation(({ body }) =>
+			Promise.resolve(new Blob([`h\nrow-${body.offset}\n`])),
+		);
+
+		await runChunkedExport(runArgs({ totalRows: rowsForParts(3) }));
+
+		const offsets = mockFetch.mock.calls.map(([props]) => props.body.offset);
+		expect(offsets.sort((a, b) => a - b)).toStrictEqual([0, 50_000, 100_000]);
+		await expect(savedFileText()).resolves.toBe(
+			'h\nrow-0\nrow-50000\nrow-100000\n',
+		);
+	});
+
+	it('keeps page order even when later pages resolve first', async () => {
+		const resolvers: Record<number, (b: Blob) => void> = {};
+		mockFetch.mockImplementation(
+			({ body }) =>
+				new Promise((resolve) => {
+					resolvers[body.offset] = resolve;
+				}),
+		);
+
+		const promise = runChunkedExport(runArgs({ totalRows: rowsForParts(3) }));
+		// All 3 pages are in flight (concurrency 3); resolve in reverse order.
+		await Promise.resolve();
+		resolvers[100_000](new Blob(['h\nc\n']));
+		resolvers[50_000](new Blob(['h\nb\n']));
+		resolvers[0](new Blob(['h\na\n']));
+		await promise;
+
+		await expect(savedFileText()).resolves.toBe('h\na\nb\nc\n');
+	});
+
+	it('stops claiming pages once the server runs dry', async () => {
+		// Count says 5 pages but the server only has data for page 0.
+		mockFetch.mockImplementation(({ body }) =>
+			Promise.resolve(body.offset === 0 ? new Blob(['h\na\n']) : new Blob([])),
+		);
+
+		await runChunkedExport(runArgs({ totalRows: rowsForParts(5) }));
+
+		// Workers stop claiming once an empty part is observed — exact count is
+		// timing-dependent, but it must never fetch all 5 pages.
+		expect(mockFetch.mock.calls.length).toBeLessThan(5);
+		await expect(savedFileText()).resolves.toBe('h\na\n');
+	});
+
+	it('rejects on page failure, aborts in-flight siblings, saves nothing', async () => {
+		const seenSignals: AbortSignal[] = [];
+		mockFetch.mockImplementation(({ body, signal }) => {
+			seenSignals.push(signal);
+			return body.offset === 50_000
+				? Promise.reject(new Error('boom'))
+				: new Promise(() => {}); // siblings hang until aborted
+		});
+
+		await expect(
+			runChunkedExport(runArgs({ totalRows: rowsForParts(3) })),
+		).rejects.toThrow('boom');
+
+		expect(seenSignals.every((s) => s.aborted)).toBe(true);
+		expect(mockDownloadFile).not.toHaveBeenCalled();
+	});
+
+	it('propagates a user abort to the page fetches', async () => {
+		const controller = new AbortController();
+		mockFetch.mockImplementation(
+			({ signal }) =>
+				new Promise((_resolve, reject) => {
+					signal.addEventListener('abort', () =>
+						reject(new DOMException('Aborted', 'AbortError')),
+					);
+				}),
+		);
+
+		const promise = runChunkedExport(
+			runArgs({ totalRows: rowsForParts(2), signal: controller.signal }),
+		);
+		await Promise.resolve();
+		controller.abort();
+
+		await expect(promise).rejects.toThrow('Aborted');
+		expect(mockDownloadFile).not.toHaveBeenCalled();
+	});
+
+	it('reports whole-number progress per completed part', async () => {
+		mockFetch.mockImplementation(({ body }) =>
+			Promise.resolve(new Blob([`h\nrow-${body.offset}\n`])),
+		);
+		const onProgress = jest.fn();
+
+		await runChunkedExport(runArgs({ totalRows: rowsForParts(3), onProgress }));
+
+		const reported = onProgress.mock.calls.map(([p]) => p);
+		expect(reported).toHaveLength(3);
+		expect(reported).toStrictEqual(expect.arrayContaining([33, 67, 100]));
+	});
+});

frontend/src/hooks/useExportData/constants.ts

@@ -0,0 +1,4 @@
+export const EXPORT_PAGE_SIZE = 50_000;
+
+/** Pages fetched in parallel.*/
+export const EXPORT_CONCURRENCY = 3;

frontend/src/hooks/useExportData/runChunkedExport.ts

@@ -0,0 +1,143 @@
+import { fetchExportData } from 'api/v1/download/downloadExportData';
+import { prepareQueryRangePayloadV5 } from 'api/v5/v5';
+import { PANEL_TYPES } from 'constants/queryBuilder';
+import {
+	downloadFile,
+	getTimestampedFileName,
+} from 'lib/exportData/downloadFile';
+import { stitchCsvParts, stitchJsonlParts } from 'lib/exportData/stitchParts';
+import { ExportFormat } from 'lib/exportData/types';
+import store from 'store';
+import { Query } from 'types/api/queryBuilder/queryBuilderData';
+import { QueryRangePayloadV5 } from 'types/api/v5/queryRange';
+
+import { EXPORT_CONCURRENCY, EXPORT_PAGE_SIZE } from './constants';
+
+export interface ChunkedExportArgs {
+	query: Query;
+	timeRange: { start: number; end: number };
+	// Total rows the query is expected to return; drives the page count.
+	totalRows: number;
+	fileNameBase: string;
+}
+
+interface RunChunkedExportProps extends ChunkedExportArgs {
+	format: ExportFormat;
+	signal: AbortSignal;
+	// 0–100 whole number: parts completed over total parts.
+	onProgress: (progress: number) => void;
+}
+
+const MIME_BY_FORMAT: Record<ExportFormat, string> = {
+	[ExportFormat.Csv]: 'text/csv',
+	[ExportFormat.Jsonl]: 'application/x-ndjson',
+};
+
+/**
+ * Chunked server export: fetches export_raw_data pages through a bounded
+ * worker pool (EXPORT_CONCURRENCY wide — pages are independent since offsets
+ * are precomputable), stitches the parts in page order client-side, and saves
+ * a single file.
+ */
+export async function runChunkedExport({
+	query,
+	timeRange,
+	totalRows,
+	fileNameBase,
+	format,
+	signal,
+	onProgress,
+}: RunChunkedExportProps): Promise<void> {
+	const totalParts = Math.max(1, Math.ceil(totalRows / EXPORT_PAGE_SIZE));
+	const workerCount = Math.min(Math.max(1, EXPORT_CONCURRENCY), totalParts);
+
+	// Internal controller so the first failed page (or a user cancel) stops the
+	// whole fleet instead of letting siblings run to completion for nothing.
+	const fleet = new AbortController();
+	const onExternalAbort = (): void => fleet.abort();
+	signal.addEventListener('abort', onExternalAbort);
+	if (signal.aborted) {
+		fleet.abort();
+	}
+
+	const buildPagePayload = (page: number): QueryRangePayloadV5 => {
+		const pageQuery: Query = {
+			...query,
+			builder: {
+				...query.builder,
+				queryData: query.builder.queryData.map((qd) => ({
+					...qd,
+					limit: EXPORT_PAGE_SIZE,
+					pageSize: EXPORT_PAGE_SIZE,
+					offset: page * EXPORT_PAGE_SIZE,
+				})),
+			},
+		};
+
+		return prepareQueryRangePayloadV5({
+			query: pageQuery,
+			graphType: PANEL_TYPES.LIST,
+			selectedTime: 'GLOBAL_TIME',
+			// Read directly (not via hooks) — the absolute bounds below take
+			// precedence over the global picker in the payload anyway.
+			globalSelectedInterval: store.getState().globalTime.selectedTime,
+			start: timeRange.start,
+			end: timeRange.end,
+		}).queryPayload;
+	};
+
+	// Indexed by page so out-of-order completion can't scramble the stitch order.
+	const parts = new Array<Blob | undefined>(totalParts);
+	let nextPage = 0;
+	let completedParts = 0;
+	let serverRanDry = false;
+
+	const worker = async (): Promise<void> => {
+		while (!serverRanDry) {
+			const page = nextPage;
+			nextPage += 1;
+			if (page >= totalParts) {
+				return;
+			}
+
+			// eslint-disable-next-line no-await-in-loop
+			const part = await fetchExportData({
+				format,
+				body: buildPagePayload(page),
+				signal: fleet.signal,
+			});
+
+			// Empty part = the row count drifted and the server ran dry early;
+			// stop claiming further pages (later in-flight pages are empty too).
+			if (part.size === 0) {
+				serverRanDry = true;
+				return;
+			}
+
+			parts[page] = part;
+			completedParts += 1;
+			onProgress(Math.round((completedParts / totalParts) * 100));
+		}
+	};
+
+	try {
+		await Promise.all(Array.from({ length: workerCount }, () => worker()));
+	} catch (error) {
+		fleet.abort();
+		throw error;
+	} finally {
+		signal.removeEventListener('abort', onExternalAbort);
+	}
+
+	const orderedParts = parts.filter((part): part is Blob => Boolean(part));
+	const stitched =
+		format === ExportFormat.Csv
+			? await stitchCsvParts(orderedParts)
+			: await stitchJsonlParts(orderedParts);
+
+	downloadFile(
+		stitched,
+		getTimestampedFileName(fileNameBase, format),
+		MIME_BY_FORMAT[format],
+	);
+}

frontend/src/lib/exportData/__tests__/stitchParts.test.ts

@@ -0,0 +1,100 @@
+import 'tests/blob-polyfill';
+
+import { stitchCsvParts, stitchJsonlParts } from '../stitchParts';
+
+const blob = (content: string): Blob => new Blob([content]);
+
+describe('stitchCsvParts', () => {
+	it('keeps a single part as-is', async () => {
+		const out = await stitchCsvParts([blob('h1,h2\na,b\n')]);
+		await expect(out.text()).resolves.toBe('h1,h2\na,b\n');
+		expect(out.type).toBe('text/csv');
+	});
+
+	it('strips the header row from parts after the first', async () => {
+		const out = await stitchCsvParts([
+			blob('h1,h2\na,b\n'),
+			blob('h1,h2\nc,d\n'),
+			blob('h1,h2\ne,f\n'),
+		]);
+		await expect(out.text()).resolves.toBe('h1,h2\na,b\nc,d\ne,f\n');
+	});
+
+	it('handles CRLF line endings (the \\r dies with the header)', async () => {
+		const out = await stitchCsvParts([
+			blob('h1,h2\r\na,b\r\n'),
+			blob('h1,h2\r\nc,d\r\n'),
+		]);
+		await expect(out.text()).resolves.toBe('h1,h2\r\na,b\r\nc,d\r\n');
+	});
+
+	it('inserts a newline at the seam when a part lacks a trailing one', async () => {
+		const out = await stitchCsvParts([blob('h1,h2\na,b'), blob('h1,h2\nc,d')]);
+		await expect(out.text()).resolves.toBe('h1,h2\na,b\nc,d\n');
+	});
+
+	it('preserves multi-byte characters around the header boundary', async () => {
+		const out = await stitchCsvParts([
+			blob('höader,h2\naä,b\n'),
+			blob('höader,h2\ncö,d\n'),
+		]);
+		await expect(out.text()).resolves.toBe('höader,h2\naä,b\ncö,d\n');
+	});
+
+	it('strips headers longer than the initial 8KB sniff window', async () => {
+		// Forces findFirstNewlineEnd through its window-doubling path.
+		const hugeHeader = Array.from({ length: 1200 }, (_, i) => `column_${i}`).join(
+			',',
+		);
+		expect(hugeHeader.length).toBeGreaterThan(8192);
+		const out = await stitchCsvParts([
+			blob(`${hugeHeader}\na,b\n`),
+			blob(`${hugeHeader}\nc,d\n`),
+		]);
+		await expect(out.text()).resolves.toBe(`${hugeHeader}\na,b\nc,d\n`);
+	});
+
+	it('skips empty and header-only parts', async () => {
+		const out = await stitchCsvParts([
+			blob('h1,h2\na,b\n'),
+			blob(''),
+			blob('h1,h2\n'),
+			blob('h1,h2'),
+			blob('h1,h2\nc,d\n'),
+		]);
+		await expect(out.text()).resolves.toBe('h1,h2\na,b\nc,d\n');
+	});
+
+	it('returns an empty blob for no parts', async () => {
+		const out = await stitchCsvParts([]);
+		expect(out.size).toBe(0);
+	});
+});
+
+describe('stitchJsonlParts', () => {
+	it('concatenates parts without stripping anything', async () => {
+		const out = await stitchJsonlParts([
+			blob('{"a":1}\n{"a":2}\n'),
+			blob('{"a":3}\n'),
+		]);
+		await expect(out.text()).resolves.toBe('{"a":1}\n{"a":2}\n{"a":3}\n');
+		expect(out.type).toBe('application/x-ndjson');
+	});
+
+	it('guards the seam when a part lacks a trailing newline', async () => {
+		const out = await stitchJsonlParts([blob('{"a":1}'), blob('{"a":2}')]);
+		const text = await out.text();
+		expect(text).toBe('{"a":1}\n{"a":2}\n');
+		// Every line must stay independently parseable.
+		const lines = text.trim().split('\n');
+		expect(lines.map((line) => JSON.parse(line))).toStrictEqual([
+			{ a: 1 },
+			{ a: 2 },
+		]);
+	});
+
+	it('skips empty parts', async () => {
+		const out = await stitchJsonlParts([blob(''), blob('{"a":1}\n'), blob('')]);
+		await expect(out.text()).resolves.toBe('{"a":1}\n');
+	});
+});

frontend/src/lib/exportData/downloadFile.ts

@@ -1,6 +1,6 @@
-/** Triggers a browser download of in-memory string content as a file. */
+/** Triggers a browser download of in-memory content (string or Blob) as a file. */
 export function downloadFile(
-	content: string,
+	content: string | Blob,
 	fileName: string,
 	mime: string,
 ): void {

frontend/src/lib/exportData/stitchParts.ts

@@ -0,0 +1,85 @@
+/**
+ * Stitches sequentially-fetched export parts (Blobs) into one downloadable
+ * Blob. Pure blob surgery — parts are never parsed and `Blob.slice`/`new Blob`
+ * are zero-copy, so nothing here scales with the data size except the final
+ * browser-managed blob itself.
+ */
+
+const HEADER_SNIFF_BYTES = 8192;
+const NEWLINE_BYTE = 0x0a;
+
+/** Byte offset just past the first newline, or -1 when the blob has none. */
+async function findFirstNewlineEnd(blob: Blob): Promise<number> {
+	let sniffBytes = HEADER_SNIFF_BYTES;
+	for (;;) {
+		// eslint-disable-next-line no-await-in-loop
+		const bytes = new Uint8Array(await blob.slice(0, sniffBytes).arrayBuffer());
+		const newlineIdx = bytes.indexOf(NEWLINE_BYTE);
+		if (newlineIdx !== -1) {
+			return newlineIdx + 1;
+		}
+		if (sniffBytes >= blob.size) {
+			return -1;
+		}
+		sniffBytes *= 2;
+	}
+}
+
+async function endsWithNewline(blob: Blob): Promise<boolean> {
+	const lastByte = new Uint8Array(await blob.slice(blob.size - 1).arrayBuffer());
+	return lastByte[0] === NEWLINE_BYTE;
+}
+
+async function stitchParts(
+	parts: Blob[],
+	{
+		stripHeaderAfterFirst,
+		mime,
+	}: { stripHeaderAfterFirst: boolean; mime: string },
+): Promise<Blob> {
+	const pieces: (Blob | string)[] = [];
+
+	for (let index = 0; index < parts.length; index += 1) {
+		let piece = parts[index];
+
+		if (stripHeaderAfterFirst && index > 0) {
+			// Every part re-sends the header row; drop it on parts 2..N. Byte-level
+			// search (not text) so multi-byte characters can't skew the offset.
+			// ASSUMPTION: the first newline byte ends the header row — i.e. no
+			// column name contains an embedded (RFC 4180 quoted) newline. Header
+			// cells are telemetry field names, which can't carry newlines; quoted
+			// newlines in DATA rows are fine (we only search from byte 0).
+			// eslint-disable-next-line no-await-in-loop
+			const headerEnd = await findFirstNewlineEnd(piece);
+			// A part without any newline is header-only — nothing to keep.
+			piece = headerEnd === -1 ? piece.slice(piece.size) : piece.slice(headerEnd);
+		}
+
+		if (piece.size === 0) {
+			continue;
+		}
+
+		pieces.push(piece);
+		// Guard the seam: without a trailing newline the next part's first row
+		// would concatenate onto this part's last row.
+		// eslint-disable-next-line no-await-in-loop
+		if (!(await endsWithNewline(piece))) {
+			pieces.push('\n');
+		}
+	}
+
+	return new Blob(pieces, { type: mime });
+}
+
+/** Combines CSV parts: part 1 keeps its header, parts 2..N are decapitated. */
+export async function stitchCsvParts(parts: Blob[]): Promise<Blob> {
+	return stitchParts(parts, { stripHeaderAfterFirst: true, mime: 'text/csv' });
+}
+
+/** Combines JSONL parts: plain concatenation with a newline guard per seam. */
+export async function stitchJsonlParts(parts: Blob[]): Promise<Blob> {
+	return stitchParts(parts, {
+		stripHeaderAfterFirst: false,
+		mime: 'application/x-ndjson',
+	});
+}

frontend/src/mocks-server/__mockdata__/roles.ts

@@ -1,11 +1,8 @@
-import {
-	AuthtypesGettableRoleDTO,
-	AuthtypesRoleDTO,
-} from 'api/generated/services/sigNoz.schemas';
+import { AuthtypesRoleDTO } from 'api/generated/services/sigNoz.schemas';
 
 const orgId = '019ba2bb-2fa1-7b24-8159-cfca08617ef9';
 
-export const managedRoles: AuthtypesGettableRoleDTO[] = [
+export const managedRoles: AuthtypesRoleDTO[] = [
 	{
 		id: '019c24aa-2248-756f-9833-984f1ab63819',
 		createdAt: '2026-02-03T18:00:55.624356Z',
@@ -38,7 +35,7 @@ export const managedRoles: AuthtypesGettableRoleDTO[] = [
 	},
 ];
 
-export const customRoles: AuthtypesGettableRoleDTO[] = [
+export const customRoles: AuthtypesRoleDTO[] = [
 	{
 		id: '019c24aa-3333-0001-aaaa-111111111111',
 		createdAt: '2026-02-10T10:30:00.000Z',
@@ -59,24 +56,12 @@ export const customRoles: AuthtypesGettableRoleDTO[] = [
 	},
 ];
 
-export const allRoles: AuthtypesGettableRoleDTO[] = [
-	...managedRoles,
-	...customRoles,
-];
+export const allRoles: AuthtypesRoleDTO[] = [...managedRoles, ...customRoles];
 
 export const listRolesSuccessResponse = {
 	status: 'success',
 	data: allRoles,
 };
 
-const customRole: AuthtypesRoleDTO = {
-	...customRoles[0],
-	transactionGroups: [],
-};
-const managedRole: AuthtypesRoleDTO = {
-	...managedRoles[0],
-	transactionGroups: [],
-};
-
-export const customRoleResponse = { status: 'success', data: customRole };
-export const managedRoleResponse = { status: 'success', data: managedRole };
+export const customRoleResponse = { status: 'success', data: customRoles[0] };
+export const managedRoleResponse = { status: 'success', data: managedRoles[0] };

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/TraceDetailsHeader.tsx

@@ -21,6 +21,7 @@ import { DataSource } from 'types/common/queryBuilder';
 import { TraceDetailEventKeys, TraceDetailEvents } from '../events';
 import { useTraceDetailLogEvent } from '../hooks/useTraceDetailLogEvent';
 import { useTraceStore } from '../stores/traceStore';
+import TraceDownloadPanel from './TraceDownloadPanel';
 import EntityMetadataRow from '../EntityMetadata/EntityMetadataRow';
 import AnalyticsPanel from '../SpanDetailsPanel/AnalyticsPanel/AnalyticsPanel';
 import Filters from '../TraceWaterfall/TraceWaterfallStates/Success/Filters/Filters';
@@ -43,6 +44,7 @@ export interface TraceMetadataForHeader {
 	rootServiceEntryPoint: string;
 	rootSpanStatusCode: string;
 	hasMissingSpans: boolean;
+	totalSpansCount: number;
 }
 
 interface TraceDetailsHeaderProps {
@@ -168,6 +170,10 @@ function TraceDetailsHeader({
 										showTraceDetails={showTraceDetails}
 										onToggleTraceDetails={handleToggleTraceDetails}
 										onOpenPreviewFields={(): void => setIsPreviewFieldsOpen(true)}
+										traceId={traceID || ''}
+										startTime={filterMetadata.startTime}
+										endTime={filterMetadata.endTime}
+										totalSpansCount={traceMetadata?.totalSpansCount || 0}
 									/>
 								</div>
 							</TooltipProvider>
@@ -228,6 +234,8 @@ function TraceDetailsHeader({
 				onClose={(): void => setIsAnalyticsOpen(false)}
 				onTabChange={handleAnalyticsTabChange}
 			/>
+
+			<TraceDownloadPanel />
 		</div>
 	);
 }

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/TraceDownloadPanel.module.scss

@@ -0,0 +1,42 @@
+.downloadPanel {
+	display: flex;
+	flex-direction: column;
+	gap: var(--spacing-3);
+	padding: var(--spacing-4);
+}
+
+.header {
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-3);
+}
+
+.title {
+	flex: 1;
+	display: flex;
+	align-items: center;
+	gap: var(--spacing-2);
+	font-size: var(--paragraph-base-400-font-size);
+	font-weight: var(--font-weight-medium);
+	color: var(--secondary-foreground);
+	white-space: nowrap;
+}
+
+.loader {
+	color: var(--bg-robin-500);
+	flex-shrink: 0;
+}
+
+.percent {
+	font-size: var(--paragraph-base-400-font-size);
+	font-weight: var(--font-weight-semibold);
+	color: var(--l2-foreground);
+	flex-shrink: 0;
+}
+
+.cancelBtn {
+	height: 24px;
+	width: 24px;
+	flex-shrink: 0;
+	color: var(--l2-foreground);
+}

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/TraceDownloadPanel.tsx

@@ -0,0 +1,58 @@
+import { useEffect } from 'react';
+import { Button } from '@signozhq/ui/button';
+import { Progress } from '@signozhq/ui/progress';
+import { LoaderCircle, X } from '@signozhq/icons';
+import { FloatingPanel } from 'periscope/components/FloatingPanel';
+
+import { useTraceDownloadStore } from './traceDownloadStore';
+
+import styles from './TraceDownloadPanel.module.scss';
+
+const PANEL_WIDTH = 356;
+const PANEL_HEIGHT = 76;
+
+function TraceDownloadPanel(): JSX.Element {
+	const isDownloading = useTraceDownloadStore((s) => s.isDownloading);
+	const progress = useTraceDownloadStore((s) => s.progress);
+	const cancelDownload = useTraceDownloadStore((s) => s.cancelDownload);
+
+	useEffect(() => cancelDownload, [cancelDownload]);
+
+	const displayProgress = Math.max(1, progress);
+
+	return (
+		<FloatingPanel
+			isOpen={isDownloading}
+			width={PANEL_WIDTH}
+			height={PANEL_HEIGHT}
+			minWidth={PANEL_WIDTH}
+			minHeight={PANEL_HEIGHT}
+			enableResizing={false}
+		>
+			<div className={styles.downloadPanel} data-testid="trace-download-panel">
+				<div className={`${styles.header} floating-panel__drag-handle`}>
+					<span className={styles.title}>
+						Downloading trace
+						<LoaderCircle size={14} className={`animate-spin ${styles.loader}`} />
+					</span>
+					<span className={styles.percent} data-testid="trace-download-percent">
+						{displayProgress}%
+					</span>
+					<Button
+						variant="ghost"
+						size="icon"
+						color="secondary"
+						className={styles.cancelBtn}
+						onClick={cancelDownload}
+						aria-label="Cancel download"
+						data-testid="trace-download-cancel"
+						prefix={<X size={16} />}
+					/>
+				</div>
+				<Progress percent={displayProgress} status="active" showInfo={false} />
+			</div>
+		</FloatingPanel>
+	);
+}
+
+export default TraceDownloadPanel;

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/TraceOptionsMenu.tsx

@@ -12,8 +12,10 @@ import {
 	DropdownMenuTrigger,
 } from '@signozhq/ui/dropdown-menu';
 import { Settings2 } from '@signozhq/icons';
+import { ExportFormat } from 'lib/exportData/types';
 
 import { useTraceStore } from '../stores/traceStore';
+import { useDownloadTrace } from './useDownloadTrace';
 
 import styles from './TraceOptionsMenu.module.scss';
 
@@ -21,6 +23,10 @@ interface TraceOptionsMenuProps {
 	showTraceDetails: boolean;
 	onToggleTraceDetails: () => void;
 	onOpenPreviewFields: () => void;
+	traceId: string;
+	startTime: number;
+	endTime: number;
+	totalSpansCount: number;
 }
 
 // Composed from dropdown-menu primitives (instead of DropdownMenuSimple)
@@ -30,6 +36,10 @@ function TraceOptionsMenu({
 	showTraceDetails,
 	onToggleTraceDetails,
 	onOpenPreviewFields,
+	traceId,
+	startTime,
+	endTime,
+	totalSpansCount,
 }: TraceOptionsMenuProps): JSX.Element {
 	const colorByField = useTraceStore((s) => s.colorByField);
 	const setColorByField = useTraceStore((s) => s.setColorByField);
@@ -37,6 +47,13 @@ function TraceOptionsMenu({
 		(s) => s.availableColorByOptions,
 	);
 
+	const { isDownloading, isExportDisabled, downloadTrace } = useDownloadTrace({
+		traceId,
+		startTime,
+		endTime,
+		totalSpansCount,
+	});
+
 	const handleColorByChange = (name: string): void => {
 		const next = availableColorByOptions.find((o) => o.field.name === name);
 		if (next) {
@@ -81,6 +98,32 @@ function TraceOptionsMenu({
 						</DropdownMenuSubContent>
 					</DropdownMenuSub>
 				)}
+				{!isExportDisabled && (
+					<DropdownMenuSub>
+						<DropdownMenuSubTrigger
+							disabled={isDownloading}
+							data-testid="download-trace-submenu"
+						>
+							Download trace
+						</DropdownMenuSubTrigger>
+						<DropdownMenuSubContent className={styles.traceOptionsDropdown}>
+							<DropdownMenuItem
+								clickable
+								onSelect={(): void => downloadTrace(ExportFormat.Csv)}
+								testId="download-trace-csv"
+							>
+								CSV
+							</DropdownMenuItem>
+							<DropdownMenuItem
+								clickable
+								onSelect={(): void => downloadTrace(ExportFormat.Jsonl)}
+								testId="download-trace-jsonl"
+							>
+								JSONL
+							</DropdownMenuItem>
+						</DropdownMenuSubContent>
+					</DropdownMenuSub>
+				)}
 			</DropdownMenuContent>
 		</DropdownMenu>
 	);

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/__tests__/TraceDetailsHeader.test.tsx

@@ -141,6 +141,7 @@ describe('TraceDetailsHeader – trace metadata row', () => {
 		rootServiceEntryPoint: 'large-trace-root',
 		rootSpanStatusCode: '404',
 		hasMissingSpans: false,
+		totalSpansCount: 42,
 	};
 
 	it('renders the metadata (service, entry point, duration, status) when provided', () => {

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/__tests__/traceDownload.test.tsx

@@ -0,0 +1,228 @@
+import 'tests/blob-polyfill';
+
+import { screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { fetchExportData } from 'api/v1/download/downloadExportData';
+import { downloadFile } from 'lib/exportData/downloadFile';
+import { render } from 'tests/test-utils';
+
+import TraceDownloadPanel from '../TraceDownloadPanel';
+import TraceOptionsMenu from '../TraceOptionsMenu';
+import { MAX_EXPORT_SPANS } from '../useDownloadTrace';
+
+// Integration suite: menu → hook → store → runner → stitchers → panel all run
+// for real; only the true boundaries are mocked (HTTP + file save).
+jest.mock('api/v1/download/downloadExportData', () => ({
+	fetchExportData: jest.fn(),
+}));
+
+jest.mock('lib/exportData/downloadFile', () => ({
+	downloadFile: jest.fn(),
+	getTimestampedFileName: jest.fn(
+		(base: string, ext: string) => `${base}.${ext}`,
+	),
+}));
+
+const mockFetch = fetchExportData as jest.Mock;
+const mockDownloadFile = downloadFile as jest.Mock;
+
+const baseProps = {
+	showTraceDetails: true,
+	onToggleTraceDetails: jest.fn(),
+	onOpenPreviewFields: jest.fn(),
+	traceId: 'trace-123',
+	startTime: 1_000,
+	endTime: 2_000,
+	// 120k spans → 3 export pages of 50k.
+	totalSpansCount: 120_000,
+};
+
+function renderFeature(
+	props: Partial<typeof baseProps> = {},
+): ReturnType<typeof render> {
+	return render(
+		<>
+			<TraceOptionsMenu {...baseProps} {...props} />
+			<TraceDownloadPanel />
+		</>,
+	);
+}
+
+// skipHover: simulated pointer travel fires pointerleave on the subtrigger and
+// radix's grace-area math (zero rects in jsdom) closes the submenu.
+// pointerEventsCheck 0: radix puts pointer-events:none on <body> while open.
+function setupUser(): ReturnType<typeof userEvent.setup> {
+	return userEvent.setup({
+		delay: null,
+		skipHover: true,
+		pointerEventsCheck: 0,
+	});
+}
+
+async function startDownload(
+	format: 'csv' | 'jsonl' = 'csv',
+): Promise<ReturnType<typeof userEvent.setup>> {
+	const user = setupUser();
+	await user.click(screen.getByRole('button', { name: /trace options/i }));
+	await user.click(await screen.findByTestId('download-trace-submenu'));
+	await user.click(await screen.findByTestId(`download-trace-${format}`));
+	return user;
+}
+
+async function savedFileText(): Promise<string> {
+	expect(mockDownloadFile).toHaveBeenCalledTimes(1);
+	const [blob] = mockDownloadFile.mock.calls[0];
+	return (blob as Blob).text();
+}
+
+describe('trace download flow', () => {
+	beforeEach(() => {
+		jest.clearAllMocks();
+	});
+
+	it('downloads a multi-page trace as one stitched CSV', async () => {
+		mockFetch.mockImplementation(({ body }) =>
+			Promise.resolve(
+				new Blob([`h1,h2\nrow-${body.compositeQuery.queries[0].spec.offset}\n`]),
+			),
+		);
+
+		renderFeature();
+		await startDownload('csv');
+
+		await waitFor(() => expect(mockDownloadFile).toHaveBeenCalled());
+
+		// Real query building: trace scoping, page offsets, ±5min window (seconds→ms).
+		const bodies = mockFetch.mock.calls.map(([props]) => props.body);
+		const specs = bodies.map((b) => b.compositeQuery.queries[0].spec);
+		expect(specs[0].filter.expression).toBe("trace_id = 'trace-123'");
+		expect(specs.map((s) => s.offset).sort((a, b) => a - b)).toStrictEqual([
+			0, 50_000, 100_000,
+		]);
+		expect(bodies[0].start).toBe((baseProps.startTime - 300) * 1e3);
+		expect(bodies[0].end).toBe((baseProps.endTime + 300) * 1e3);
+
+		// Stitched in page order, headers deduped, saved under the trace's name.
+		await expect(savedFileText()).resolves.toBe(
+			'h1,h2\nrow-0\nrow-50000\nrow-100000\n',
+		);
+		expect(mockDownloadFile.mock.calls[0][1]).toBe('trace-trace-123.csv');
+
+		// Panel dismissed once the download completed.
+		await waitFor(() =>
+			expect(screen.queryByTestId('trace-download-panel')).not.toBeInTheDocument(),
+		);
+	});
+
+	it('downloads JSONL when that format is chosen', async () => {
+		mockFetch.mockResolvedValue(new Blob(['{"a":1}\n']));
+
+		renderFeature({ totalSpansCount: 10 });
+		await startDownload('jsonl');
+
+		await waitFor(() => expect(mockDownloadFile).toHaveBeenCalled());
+		expect(mockFetch.mock.calls[0][0].format).toBe('jsonl');
+		expect(mockDownloadFile.mock.calls[0][1]).toBe('trace-trace-123.jsonl');
+	});
+
+	it('shows the progress panel while downloading and cancels from its ✕', async () => {
+		// Fetches hang until aborted — the download stays in flight.
+		mockFetch.mockImplementation(
+			({ signal }) =>
+				new Promise((_resolve, reject) => {
+					signal.addEventListener('abort', () =>
+						reject(new DOMException('Aborted', 'AbortError')),
+					);
+				}),
+		);
+
+		renderFeature();
+		const user = await startDownload();
+
+		// Panel appears with the 1% floor (no part finished yet).
+		const panel = await screen.findByTestId('trace-download-panel');
+		expect(panel).toBeInTheDocument();
+		expect(screen.getByTestId('trace-download-percent')).toHaveTextContent('1%');
+
+		await user.click(screen.getByTestId('trace-download-cancel'));
+
+		await waitFor(() =>
+			expect(screen.queryByTestId('trace-download-panel')).not.toBeInTheDocument(),
+		);
+		expect(mockDownloadFile).not.toHaveBeenCalled();
+	});
+
+	it('disables the submenu trigger while a download is running', async () => {
+		mockFetch.mockImplementation(
+			({ signal }) =>
+				new Promise((_resolve, reject) => {
+					signal.addEventListener('abort', () =>
+						reject(new DOMException('Aborted', 'AbortError')),
+					);
+				}),
+		);
+
+		renderFeature();
+		const user = await startDownload();
+
+		// Reopen the menu mid-download: trigger is disabled by REAL store state.
+		await user.click(screen.getByRole('button', { name: /trace options/i }));
+		const trigger = await screen.findByTestId('download-trace-submenu');
+		expect(trigger).toHaveAttribute('data-disabled');
+
+		// Cleanup: stop the in-flight download so the module-scoped guard resets.
+		await user.click(screen.getByTestId('trace-download-cancel'));
+		await waitFor(() =>
+			expect(screen.queryByTestId('trace-download-panel')).not.toBeInTheDocument(),
+		);
+	});
+
+	it('hides the download option entirely above the export cap', async () => {
+		renderFeature({ totalSpansCount: MAX_EXPORT_SPANS + 1 });
+		const user = setupUser();
+		await user.click(screen.getByRole('button', { name: /trace options/i }));
+
+		await expect(
+			screen.findByRole('menuitem', { name: /preview fields/i }),
+		).resolves.toBeInTheDocument();
+		expect(
+			screen.queryByTestId('download-trace-submenu'),
+		).not.toBeInTheDocument();
+	});
+
+	it('saves nothing and dismisses the panel when a page fails', async () => {
+		mockFetch.mockRejectedValue(new Error('boom'));
+
+		renderFeature();
+		await startDownload();
+
+		await waitFor(() =>
+			expect(screen.queryByTestId('trace-download-panel')).not.toBeInTheDocument(),
+		);
+		expect(mockDownloadFile).not.toHaveBeenCalled();
+	});
+
+	it('cancels the in-flight download when the panel unmounts (leaving the page)', async () => {
+		const seenSignals: AbortSignal[] = [];
+		mockFetch.mockImplementation(
+			({ signal }) =>
+				new Promise((_resolve, reject) => {
+					seenSignals.push(signal);
+					signal.addEventListener('abort', () =>
+						reject(new DOMException('Aborted', 'AbortError')),
+					);
+				}),
+		);
+
+		const { unmount } = renderFeature();
+		await startDownload();
+		await screen.findByTestId('trace-download-panel');
+
+		unmount();
+
+		await waitFor(() =>
+			expect(seenSignals.every((signal) => signal.aborted)).toBe(true),
+		);
+		expect(mockDownloadFile).not.toHaveBeenCalled();
+	});
+});

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/traceDownloadStore.ts

@@ -0,0 +1,63 @@
+import {
+	ChunkedExportArgs,
+	runChunkedExport,
+} from 'hooks/useExportData/runChunkedExport';
+import { ExportFormat } from 'lib/exportData/types';
+import { create } from 'zustand';
+
+/** 'skipped' = a download was already in flight; the call was ignored. */
+export type TraceDownloadOutcome = 'completed' | 'cancelled' | 'skipped';
+
+interface TraceDownloadState {
+	isDownloading: boolean;
+	// 0–100
+	progress: number;
+	startDownload: (
+		args: ChunkedExportArgs & { format: ExportFormat },
+	) => Promise<TraceDownloadOutcome>;
+	cancelDownload: () => void;
+}
+
+let abortController: AbortController | null = null;
+
+export const useTraceDownloadStore = create<TraceDownloadState>((set) => ({
+	isDownloading: false,
+	progress: 0,
+
+	startDownload: async ({
+		format,
+		...args
+	}: ChunkedExportArgs & {
+		format: ExportFormat;
+	}): Promise<TraceDownloadOutcome> => {
+		if (abortController) {
+			return 'skipped';
+		}
+
+		const controller = new AbortController();
+		abortController = controller;
+		set({ isDownloading: true, progress: 0 });
+
+		try {
+			await runChunkedExport({
+				...args,
+				format,
+				signal: controller.signal,
+				onProgress: (progress: number): void => set({ progress }),
+			});
+			return 'completed';
+		} catch (error) {
+			if (controller.signal.aborted) {
+				return 'cancelled';
+			}
+			throw error;
+		} finally {
+			abortController = null;
+			set({ isDownloading: false });
+		}
+	},
+
+	cancelDownload: (): void => {
+		abortController?.abort();
+	},
+}));

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/traceExportQuery.ts

@@ -0,0 +1,23 @@
+import { listViewInitialTraceQuery } from 'constants/queryBuilder';
+import { LogsAggregatorOperator } from 'types/common/queryBuilder';
+import { Query } from 'types/api/queryBuilder/queryBuilderData';
+
+export function getTraceExportQuery(traceId: string): Query {
+	const [baseQueryData] = listViewInitialTraceQuery.builder.queryData;
+
+	return {
+		...listViewInitialTraceQuery,
+		builder: {
+			...listViewInitialTraceQuery.builder,
+			queryData: [
+				{
+					...baseQueryData,
+					aggregateOperator: LogsAggregatorOperator.NOOP,
+					filter: { expression: `trace_id = '${traceId}'` },
+					orderBy: [{ columnName: 'timestamp', order: 'asc' }],
+					selectColumns: [],
+				},
+			],
+		},
+	};
+}

frontend/src/pages/TraceDetailsV3/TraceDetailsHeader/useDownloadTrace.ts

@@ -0,0 +1,92 @@
+import { useCallback, useMemo } from 'react';
+import { toast } from '@signozhq/ui/sonner';
+import { ExportFormat } from 'lib/exportData/types';
+
+import { TraceDetailEventKeys, TraceDetailEvents } from '../events';
+import { useTraceDetailLogEvent } from '../hooks/useTraceDetailLogEvent';
+import { useTraceDownloadStore } from './traceDownloadStore';
+import { getTraceExportQuery } from './traceExportQuery';
+
+// Export window pad past the trace bounds so edge spans are never clipped
+// (mirrors SpanDetailsPanel).
+const FIVE_MINUTES_IN_SECONDS = 5 * 60;
+
+// Span-count cap: traces above it hide their download option entirely.
+export const MAX_EXPORT_SPANS = 500_000;
+
+interface UseDownloadTraceProps {
+	traceId: string;
+	// Trace start/end in seconds.
+	startTime: number;
+	endTime: number;
+	totalSpansCount: number;
+}
+
+interface UseDownloadTraceReturn {
+	isDownloading: boolean;
+	isExportDisabled: boolean;
+	downloadTrace: (format: ExportFormat) => void;
+}
+
+export function useDownloadTrace({
+	traceId,
+	startTime,
+	endTime,
+	totalSpansCount,
+}: UseDownloadTraceProps): UseDownloadTraceReturn {
+	const isDownloading = useTraceDownloadStore((s) => s.isDownloading);
+	const startDownload = useTraceDownloadStore((s) => s.startDownload);
+
+	const logTraceEvent = useTraceDetailLogEvent('v3', traceId);
+
+	const query = useMemo(() => getTraceExportQuery(traceId), [traceId]);
+
+	const timeRange = useMemo(
+		() => ({
+			start: startTime - FIVE_MINUTES_IN_SECONDS,
+			end: endTime + FIVE_MINUTES_IN_SECONDS,
+		}),
+		[startTime, endTime],
+	);
+
+	const downloadTrace = useCallback(
+		(format: ExportFormat): void => {
+			logTraceEvent(TraceDetailEvents.DownloadTriggered, {
+				[TraceDetailEventKeys.Format]: format,
+				[TraceDetailEventKeys.TotalSpansCount]: totalSpansCount,
+			});
+
+			const run = async (): Promise<void> => {
+				try {
+					const outcome = await startDownload({
+						query,
+						timeRange,
+						totalRows: totalSpansCount,
+						fileNameBase: `trace-${traceId}`,
+						format,
+					});
+					if (outcome === 'completed') {
+						toast.success('Export completed successfully');
+					} else if (outcome === 'cancelled') {
+						logTraceEvent(TraceDetailEvents.DownloadCancelled, {
+							[TraceDetailEventKeys.Format]: format,
+							[TraceDetailEventKeys.TotalSpansCount]: totalSpansCount,
+						});
+						toast.info('Export cancelled');
+					}
+				} catch (error) {
+					toast.error('Failed to download trace');
+					console.error(error);
+				}
+			};
+			void run();
+		},
+		[query, timeRange, totalSpansCount, traceId, startDownload, logTraceEvent],
+	);
+
+	return {
+		isDownloading,
+		isExportDisabled: totalSpansCount > MAX_EXPORT_SPANS,
+		downloadTrace,
+	};
+}

frontend/src/pages/TraceDetailsV3/events.ts

@@ -6,6 +6,8 @@ export enum TraceDetailEvents {
 	AnalyticsPanelToggled = 'Trace Detail: Analytics panel toggled',
 	AnalyticsTabChanged = 'Trace Detail: Analytics tab changed',
 	SpanPanelTabChanged = 'Trace Detail: Span panel tab changed',
+	DownloadTriggered = 'Trace Detail: Download triggered',
+	DownloadCancelled = 'Trace Detail: Download cancelled',
 }
 
 export enum TraceDetailEventKeys {
@@ -32,6 +34,8 @@ export enum TraceDetailEventKeys {
 	Tab = 'tab',
 	// Span panel tab changed
 	SpanId = 'spanId',
+	// Download triggered (reuses TotalSpansCount for trace size)
+	Format = 'format',
 }
 
 export type TraceDetailView = 'v2' | 'v3';

frontend/src/pages/TraceDetailsV3/index.tsx

@@ -346,6 +346,7 @@ function TraceDetailsV3(): JSX.Element {
 			rootServiceEntryPoint: payload.rootServiceEntryPoint,
 			rootSpanStatusCode: rootSpan?.response_status_code || '',
 			hasMissingSpans: payload.hasMissingSpans || false,
+			totalSpansCount: payload.totalSpansCount || 0,
 		};
 	}, [traceData?.payload]);
 

frontend/src/tests/blob-polyfill.ts

@@ -0,0 +1,34 @@
+/**
+ * jsdom's Blob lacks the modern read methods (arrayBuffer/text). Polyfill via
+ * FileReader (which jsdom does implement); guarded, so it no-ops once jsdom
+ * catches up. Side-effect module — import it at the top of any test touching
+ * Blob contents:
+ *
+ *   import 'tests/blob-polyfill';
+ */
+
+if (typeof Blob.prototype.arrayBuffer === 'undefined') {
+	Blob.prototype.arrayBuffer = function arrayBuffer(
+		this: Blob,
+	): Promise<ArrayBuffer> {
+		return new Promise((resolve, reject) => {
+			const reader = new FileReader();
+			reader.onload = (): void => resolve(reader.result as ArrayBuffer);
+			reader.onerror = (): void => reject(reader.error);
+			reader.readAsArrayBuffer(this);
+		});
+	};
+}
+
+if (typeof Blob.prototype.text === 'undefined') {
+	Blob.prototype.text = function text(this: Blob): Promise<string> {
+		return new Promise((resolve, reject) => {
+			const reader = new FileReader();
+			reader.onload = (): void => resolve(reader.result as string);
+			reader.onerror = (): void => reject(reader.error);
+			reader.readAsText(this);
+		});
+	};
+}
+
+export {};

frontend/src/utils/explorerUtils.ts

@@ -1,8 +1,6 @@
 import { QueryParams } from 'constants/query';
 import { PANEL_TYPES } from 'constants/queryBuilder';
-import ROUTES from 'constants/routes';
 import { ExplorerViews } from 'pages/LogsExplorer/utils';
-import { Query } from 'types/api/queryBuilder/queryBuilderData';
 
 // Mapping between panel types and explorer views
 export const panelTypeToExplorerView: Record<PANEL_TYPES, ExplorerViews> = {
@@ -52,36 +50,3 @@ export const getExplorerViewFromUrl = (
 export const getExplorerViewForPanelType = (
 	panelType: PANEL_TYPES,
 ): ExplorerViews => panelTypeToExplorerView[panelType];
-
-export interface MetricsExplorerUrlParams {
-	query: Query;
-	relativeTime?: string;
-	startTimeMs?: number;
-	endTimeMs?: number;
-}
-
-export const getMetricsExplorerUrl = ({
-	query,
-	relativeTime,
-	startTimeMs,
-	endTimeMs,
-}: MetricsExplorerUrlParams): string => {
-	const params = new URLSearchParams();
-	params.set(
-		QueryParams.compositeQuery,
-		encodeURIComponent(JSON.stringify(query)),
-	);
-
-	if (relativeTime) {
-		params.set(QueryParams.relativeTime, relativeTime);
-	} else {
-		if (startTimeMs !== undefined) {
-			params.set(QueryParams.startTime, String(startTimeMs));
-		}
-		if (endTimeMs !== undefined) {
-			params.set(QueryParams.endTime, String(endTimeMs));
-		}
-	}
-
-	return `${ROUTES.METRICS_EXPLORER_EXPLORER}?${params.toString()}`;
-};

pkg/apiserver/signozapiserver/role.go

@@ -47,7 +47,7 @@ func (provider *provider) addRoleRoutes(router *mux.Router) error {
 			Description:         "This endpoint lists all roles",
 			Request:             nil,
 			RequestContentType:  "",
-			Response:            make([]*authtypes.GettableRole, 0),
+			Response:            make([]*authtypes.Role, 0),
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{},
@@ -73,7 +73,7 @@ func (provider *provider) addRoleRoutes(router *mux.Router) error {
 			Description:         "This endpoint gets a role",
 			Request:             nil,
 			RequestContentType:  "",
-			Response:            new(authtypes.Role),
+			Response:            new(authtypes.RoleWithTransactionGroups),
 			ResponseContentType: "application/json",
 			SuccessStatusCode:   http.StatusOK,
 			ErrorStatusCodes:    []int{},

pkg/authz/authz.go

@@ -30,14 +30,17 @@ type AuthZ interface {
 	// Write accepts the insertion tuples and the deletion tuples.
 	Write(context.Context, []*openfgav1.TupleKey, []*openfgav1.TupleKey) error
 
-	// ReadTuples reads tuples from the authorization server matching the given tuple key filter.
-	ReadTuples(context.Context, *openfgav1.ReadRequestTupleKey) ([]*openfgav1.TupleKey, error)
+	// Lists the selectors for objects assigned to subject (s) with relation (r) on resource (s)
+	ListObjects(context.Context, string, authtypes.Relation, coretypes.Type) ([]*coretypes.Object, error)
 
 	// Creates the role with its transaction groups.
-	Create(context.Context, valuer.UUID, *authtypes.Role) error
+	Create(context.Context, valuer.UUID, *authtypes.RoleWithTransactionGroups) error
+
+	// Gets the role if it exists or creates one.
+	GetOrCreate(context.Context, valuer.UUID, *authtypes.Role) (*authtypes.Role, error)
 
 	// Updates the role's metadata and reconciles its transaction groups.
-	Update(context.Context, valuer.UUID, *authtypes.Role) error
+	Update(context.Context, valuer.UUID, *authtypes.RoleWithTransactionGroups) error
 
 	// Deletes the role and tuples in authorization server.
 	Delete(context.Context, valuer.UUID, valuer.UUID) error
@@ -45,6 +48,9 @@ type AuthZ interface {
 	// Gets the role
 	Get(context.Context, valuer.UUID, valuer.UUID) (*authtypes.Role, error)
 
+	// Gets the role with transaction groups
+	GetWithTransactionGroups(context.Context, valuer.UUID, valuer.UUID) (*authtypes.RoleWithTransactionGroups, error)
+
 	// Gets the role by org_id and name
 	GetByOrgIDAndName(context.Context, valuer.UUID, string) (*authtypes.Role, error)
 
@@ -74,6 +80,9 @@ type AuthZ interface {
 
 	// Bootstrap managed roles transactions and user assignments
 	CreateManagedUserRoleTransactions(context.Context, valuer.UUID, valuer.UUID) error
+
+	// ReadTuples reads tuples from the authorization server matching the given tuple key filter.
+	ReadTuples(context.Context, *openfgav1.ReadRequestTupleKey) ([]*openfgav1.TupleKey, error)
 }
 
 // OnBeforeRoleDelete is a callback invoked before a role is deleted.

pkg/authz/openfgaauthz/provider.go

@@ -83,6 +83,10 @@ func (provider *provider) Get(ctx context.Context, orgID valuer.UUID, id valuer.
 	return provider.store.Get(ctx, orgID, id)
 }
 
+func (provider *provider) GetWithTransactionGroups(ctx context.Context, orgID valuer.UUID, id valuer.UUID) (*authtypes.RoleWithTransactionGroups, error) {
+	return nil, errors.Newf(errors.TypeUnsupported, authtypes.ErrCodeRoleUnsupported, "not implemented")
+}
+
 func (provider *provider) GetByOrgIDAndName(ctx context.Context, orgID valuer.UUID, name string) (*authtypes.Role, error) {
 	return provider.store.GetByOrgIDAndName(ctx, orgID, name)
 }
@@ -177,11 +181,15 @@ func (provider *provider) CreateManagedUserRoleTransactions(ctx context.Context,
 	return provider.Grant(ctx, orgID, []string{authtypes.SigNozAdminRoleName}, authtypes.MustNewSubject(coretypes.NewResourceUser(), userID.String(), orgID, nil))
 }
 
-func (setter *provider) Create(_ context.Context, _ valuer.UUID, _ *authtypes.Role) error {
+func (setter *provider) Create(_ context.Context, _ valuer.UUID, _ *authtypes.RoleWithTransactionGroups) error {
 	return errors.Newf(errors.TypeUnsupported, authtypes.ErrCodeRoleUnsupported, "not implemented")
 }
 
-func (provider *provider) Update(_ context.Context, _ valuer.UUID, _ *authtypes.Role) error {
+func (provider *provider) GetOrCreate(_ context.Context, _ valuer.UUID, _ *authtypes.Role) (*authtypes.Role, error) {
+	return nil, errors.Newf(errors.TypeUnsupported, authtypes.ErrCodeRoleUnsupported, "not implemented")
+}
+
+func (provider *provider) Update(_ context.Context, _ valuer.UUID, _ *authtypes.RoleWithTransactionGroups) error {
 	return errors.Newf(errors.TypeUnsupported, authtypes.ErrCodeRoleUnsupported, "not implemented")
 }
 

pkg/authz/signozauthzapi/handler.go

@@ -36,14 +36,14 @@ func (handler *handler) Create(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	role := authtypes.NewRole(req.Name, req.Description, authtypes.RoleTypeCustom, valuer.MustNewUUID(claims.OrgID), req.TransactionGroups)
-	err = handler.authz.Create(ctx, valuer.MustNewUUID(claims.OrgID), role)
+	roleWithTransactionGroups := authtypes.NewRoleWithTransactionGroups(req.Name, req.Description, authtypes.RoleTypeCustom, valuer.MustNewUUID(claims.OrgID), req.TransactionGroups)
+	err = handler.authz.Create(ctx, valuer.MustNewUUID(claims.OrgID), roleWithTransactionGroups)
 	if err != nil {
 		render.Error(rw, err)
 		return
 	}
 
-	render.Success(rw, http.StatusCreated, types.Identifiable{ID: role.ID})
+	render.Success(rw, http.StatusCreated, types.Identifiable{ID: roleWithTransactionGroups.ID})
 }
 
 func (handler *handler) Get(rw http.ResponseWriter, r *http.Request) {
@@ -65,13 +65,13 @@ func (handler *handler) Get(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	role, err := handler.authz.Get(ctx, valuer.MustNewUUID(claims.OrgID), roleID)
+	roleWithTransactionGroups, err := handler.authz.GetWithTransactionGroups(ctx, valuer.MustNewUUID(claims.OrgID), roleID)
 	if err != nil {
 		render.Error(rw, err)
 		return
 	}
 
-	render.Success(rw, http.StatusOK, role)
+	render.Success(rw, http.StatusOK, roleWithTransactionGroups)
 }
 
 func (handler *handler) List(rw http.ResponseWriter, r *http.Request) {
@@ -88,7 +88,7 @@ func (handler *handler) List(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	render.Success(rw, http.StatusOK, authtypes.NewGettableRolesFromRoles(roles))
+	render.Success(rw, http.StatusOK, roles)
 }
 
 func (handler *handler) Update(rw http.ResponseWriter, r *http.Request) {
@@ -117,13 +117,14 @@ func (handler *handler) Update(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	err = role.Update(req.Description, req.TransactionGroups)
+	roleWithTransactionGroups := authtypes.MakeRoleWithTransactionGroups(role, nil)
+	err = roleWithTransactionGroups.Update(req.Description, req.TransactionGroups)
 	if err != nil {
 		render.Error(rw, err)
 		return
 	}
 
-	err = handler.authz.Update(ctx, valuer.MustNewUUID(claims.OrgID), role)
+	err = handler.authz.Update(ctx, valuer.MustNewUUID(claims.OrgID), roleWithTransactionGroups)
 	if err != nil {
 		render.Error(rw, err)
 		return

pkg/querybuilder/where_clause_visitor.go

@@ -729,11 +729,7 @@ func (v *filterExpressionVisitor) VisitFunctionCall(ctx *grammar.FunctionCallCon
 		return ErrorConditionLiteral
 	}
 
-	value, err := normalizeFunctionValue(operator, functionName, params[1:])
-	if err != nil {
-		v.errors = append(v.errors, err.Error())
-		return ErrorConditionLiteral
-	}
+	value := params[1:]
 
 	conds, ok := v.buildConditions(key, matchingFieldKeys(key, v.fieldKeys), operator, value)
 	if !ok {
@@ -749,44 +745,6 @@ func (v *filterExpressionVisitor) VisitFunctionCall(ctx *grammar.FunctionCallCon
 	return v.builder.Or(conds...)
 }
 
-// normalizeFunctionValue validates and normalizes the value argument(s) of a has-family
-// function call, returning them in the wrapper slice the condition builder unwraps.
-//
-//   - has/hasToken take exactly one scalar value. More than one argument, or an array
-//     argument, is rejected rather than silently dropping the extras.
-//   - hasAny/hasAll take a set of values, supplied either as a single array literal
-//     (hasAny(k, ['a','b'])) or as several scalar arguments (hasAny(k, 'a', 'b')); the
-//     latter are folded into one list so no argument is silently ignored.
-func normalizeFunctionValue(operator qbtypes.FilterOperator, functionName string, valueParams []any) (any, error) {
-	switch operator {
-	case qbtypes.FilterOperatorHas, qbtypes.FilterOperatorHasToken:
-		if len(valueParams) != 1 {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "function `%s` expects exactly one value argument", functionName)
-		}
-		if _, isArray := valueParams[0].([]any); isArray {
-			return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "function `%s` expects a single scalar value, not an array", functionName)
-		}
-		return valueParams, nil
-	case qbtypes.FilterOperatorHasAny, qbtypes.FilterOperatorHasAll:
-		// A single array literal is already the value set.
-		if len(valueParams) == 1 {
-			if _, isArray := valueParams[0].([]any); isArray {
-				return valueParams, nil
-			}
-		}
-		// Otherwise fold the positional scalar arguments into one list.
-		values := make([]any, 0, len(valueParams))
-		for _, p := range valueParams {
-			if _, isArray := p.([]any); isArray {
-				return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "function `%s` expects either a single array literal or scalar values, not a mix of the two", functionName)
-			}
-			values = append(values, p)
-		}
-		return []any{values}, nil
-	}
-	return valueParams, nil
-}
-
 // VisitFunctionParamList handles the parameter list for function calls.
 func (v *filterExpressionVisitor) VisitFunctionParamList(ctx *grammar.FunctionParamListContext) any {
 	params := ctx.AllFunctionParam()

pkg/signoz/provider.go

@@ -218,7 +218,6 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewMigrateSSORoleMappingNamesFactory(sqlstore),
 		sqlmigration.NewAddMetricReductionRulesFactory(sqlstore, sqlschema),
 		sqlmigration.NewRemoveOrganizationTuplesFactory(sqlstore),
-		sqlmigration.NewAddRoleTransactionGroupsFactory(sqlstore, sqlschema),
 	)
 }
 

pkg/sqlmigration/059_add_managed_roles.go

@@ -3,7 +3,6 @@ package sqlmigration
 import (
 	"context"
 	"database/sql"
-	"time"
 
 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/sqlschema"
@@ -19,30 +18,6 @@ type addManagedRoles struct {
 	sqlschema sqlschema.SQLSchema
 }
 
-type role struct {
-	bun.BaseModel `bun:"table:role"`
-
-	ID          valuer.UUID `bun:"id,pk,type:text"`
-	CreatedAt   time.Time   `bun:"created_at"`
-	UpdatedAt   time.Time   `bun:"updated_at"`
-	Name        string      `bun:"name,type:string"`
-	Description string      `bun:"description,type:string"`
-	Type        string      `bun:"type,type:string"`
-	OrgID       valuer.UUID `bun:"org_id,type:string"`
-}
-
-func newManagedRole(name, description string, orgID valuer.UUID) *role {
-	return &role{
-		ID:          valuer.GenerateUUID(),
-		CreatedAt:   time.Now(),
-		UpdatedAt:   time.Now(),
-		Name:        name,
-		Description: description,
-		Type:        authtypes.RoleTypeManaged.StringValue(),
-		OrgID:       orgID,
-	}
-}
-
 func NewAddManagedRolesFactory(sqlstore sqlstore.SQLStore, sqlschema sqlschema.SQLSchema) factory.ProviderFactory[SQLMigration, Config] {
 	return factory.NewProviderFactory(factory.MustNewName("add_managed_roles"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
 		return newAddManagedRoles(ctx, ps, c, sqlstore, sqlschema)
@@ -79,19 +54,28 @@ func (migration *addManagedRoles) Up(ctx context.Context, db *bun.DB) error {
 		return err
 	}
 
-	managedRoles := []*role{}
+	managedRoles := []*authtypes.Role{}
 	for _, orgIDStr := range orgIDs {
 		orgID, err := valuer.NewUUID(orgIDStr)
 		if err != nil {
 			return err
 		}
 
-		managedRoles = append(managedRoles,
-			newManagedRole(authtypes.SigNozAdminRoleName, authtypes.SigNozAdminRoleDescription, orgID),
-			newManagedRole(authtypes.SigNozEditorRoleName, authtypes.SigNozEditorRoleDescription, orgID),
-			newManagedRole(authtypes.SigNozViewerRoleName, authtypes.SigNozViewerRoleDescription, orgID),
-			newManagedRole(authtypes.SigNozAnonymousRoleName, authtypes.SigNozAnonymousRoleDescription, orgID),
-		)
+		// signoz admin
+		signozAdminRole := authtypes.NewRole(authtypes.SigNozAdminRoleName, authtypes.SigNozAdminRoleDescription, authtypes.RoleTypeManaged, orgID)
+		managedRoles = append(managedRoles, signozAdminRole)
+
+		// signoz editor
+		signozEditorRole := authtypes.NewRole(authtypes.SigNozEditorRoleName, authtypes.SigNozEditorRoleDescription, authtypes.RoleTypeManaged, orgID)
+		managedRoles = append(managedRoles, signozEditorRole)
+
+		// signoz viewer
+		signozViewerRole := authtypes.NewRole(authtypes.SigNozViewerRoleName, authtypes.SigNozViewerRoleDescription, authtypes.RoleTypeManaged, orgID)
+		managedRoles = append(managedRoles, signozViewerRole)
+
+		// signoz anonymous
+		signozAnonymousRole := authtypes.NewRole(authtypes.SigNozAnonymousRoleName, authtypes.SigNozAnonymousRoleDescription, authtypes.RoleTypeManaged, orgID)
+		managedRoles = append(managedRoles, signozAnonymousRole)
 	}
 
 	if len(managedRoles) > 0 {

pkg/sqlmigration/099_add_role_transaction_groups.go

@@ -1,191 +0,0 @@
-package sqlmigration
-
-import (
-	"context"
-	"database/sql"
-	"encoding/json"
-
-	"github.com/SigNoz/signoz/pkg/factory"
-	"github.com/SigNoz/signoz/pkg/sqlschema"
-	"github.com/SigNoz/signoz/pkg/sqlstore"
-	"github.com/SigNoz/signoz/pkg/types/authtypes"
-	"github.com/SigNoz/signoz/pkg/types/coretypes"
-	openfgav1 "github.com/openfga/api/proto/openfga/v1"
-	"github.com/uptrace/bun"
-	"github.com/uptrace/bun/dialect"
-	"github.com/uptrace/bun/migrate"
-)
-
-type addRoleTransactionGroups struct {
-	sqlstore  sqlstore.SQLStore
-	sqlschema sqlschema.SQLSchema
-}
-
-type roles struct {
-	bun.BaseModel `bun:"table:role"`
-
-	ID    string `bun:"id,pk"`
-	Name  string `bun:"name"`
-	OrgID string `bun:"org_id"`
-}
-
-func NewAddRoleTransactionGroupsFactory(sqlstore sqlstore.SQLStore, sqlschema sqlschema.SQLSchema) factory.ProviderFactory[SQLMigration, Config] {
-	return factory.NewProviderFactory(
-		factory.MustNewName("add_role_transaction_groups"),
-		func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
-			return &addRoleTransactionGroups{
-				sqlstore:  sqlstore,
-				sqlschema: sqlschema,
-			}, nil
-		},
-	)
-}
-
-func (migration *addRoleTransactionGroups) Register(migrations *migrate.Migrations) error {
-	return migrations.Register(migration.Up, migration.Down)
-}
-
-func (migration *addRoleTransactionGroups) Up(ctx context.Context, db *bun.DB) error {
-	tx, err := db.BeginTx(ctx, nil)
-	if err != nil {
-		return err
-	}
-
-	defer func() {
-		_ = tx.Rollback()
-	}()
-
-	table, uniqueConstraints, err := migration.sqlschema.GetTable(ctx, "role")
-	if err != nil {
-		return err
-	}
-
-	column := &sqlschema.Column{
-		Name:     sqlschema.ColumnName("transaction_groups"),
-		DataType: sqlschema.DataTypeText,
-		Nullable: true,
-	}
-
-	sqls := migration.sqlschema.Operator().AddColumn(table, uniqueConstraints, column, nil)
-	for _, sql := range sqls {
-		if _, err := tx.ExecContext(ctx, string(sql)); err != nil {
-			return err
-		}
-	}
-
-	var storeID string
-	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
-	if err != nil {
-		return err
-	}
-
-	var orgIDs []string
-	err = tx.NewSelect().
-		Table("organizations").
-		Column("id").
-		Scan(ctx, &orgIDs)
-	if err != nil && err != sql.ErrNoRows {
-		return err
-	}
-
-	managedRoleGroups := make(map[string]string, len(coretypes.ManagedRoleToTransactions))
-	for roleName, transactions := range coretypes.ManagedRoleToTransactions {
-		data, err := json.Marshal(authtypes.NewTransactionGroupsFromTransactions(transactions))
-		if err != nil {
-			return err
-		}
-		managedRoleGroups[roleName] = string(data)
-	}
-
-	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
-	for _, orgID := range orgIDs {
-		customRoles := make([]*roles, 0)
-		err = tx.NewSelect().
-			Model(&customRoles).
-			Column("id", "name").
-			Where("org_id = ?", orgID).
-			Where("type = ?", authtypes.RoleTypeCustom.StringValue()).
-			Where("transaction_groups IS NULL").
-			Scan(ctx)
-		if err != nil {
-			return err
-		}
-
-		for _, role := range customRoles {
-			tuples, err := migration.readRoleTuples(ctx, tx, isPG, storeID, orgID, role.Name)
-			if err != nil {
-				return err
-			}
-
-			groups := authtypes.MustNewTransactionGroupsFromTuples(tuples)
-			data, err := json.Marshal(groups)
-			if err != nil {
-				return err
-			}
-
-			if _, err := tx.NewUpdate().
-				Model(new(roles)).
-				Set("transaction_groups = ?", string(data)).
-				Where("id = ?", role.ID).
-				Exec(ctx); err != nil {
-				return err
-			}
-		}
-
-		for roleName, data := range managedRoleGroups {
-			if _, err := tx.NewUpdate().
-				Model(new(roles)).
-				Set("transaction_groups = ?", data).
-				Where("org_id = ?", orgID).
-				Where("type = ?", authtypes.RoleTypeManaged.StringValue()).
-				Where("name = ?", roleName).
-				Exec(ctx); err != nil {
-				return err
-			}
-		}
-	}
-
-	return tx.Commit()
-}
-
-func (migration *addRoleTransactionGroups) readRoleTuples(ctx context.Context, tx bun.Tx, isPG bool, storeID, orgID, roleName string) ([]*openfgav1.TupleKey, error) {
-	roleSubject := "organization/" + orgID + "/role/" + roleName
-
-	var tupleRows *sql.Rows
-	var err error
-	if isPG {
-		tupleRows, err = tx.QueryContext(ctx, `
-			SELECT object_type, object_id, relation FROM tuple
-			WHERE store = ? AND _user = ?`,
-			storeID, "role:"+roleSubject+"#assignee",
-		)
-	} else {
-		tupleRows, err = tx.QueryContext(ctx, `
-			SELECT object_type, object_id, relation FROM tuple
-			WHERE store = ? AND user_object_type = ? AND user_object_id = ? AND user_relation = ?`,
-			storeID, "role", roleSubject, "assignee",
-		)
-	}
-	if err != nil {
-		return nil, err
-	}
-	defer tupleRows.Close()
-
-	tuples := make([]*openfgav1.TupleKey, 0)
-	for tupleRows.Next() {
-		var objectType, objectID, relation string
-		if err := tupleRows.Scan(&objectType, &objectID, &relation); err != nil {
-			return nil, err
-		}
-		tuples = append(tuples, &openfgav1.TupleKey{Object: objectType + ":" + objectID, Relation: relation})
-	}
-	if err := tupleRows.Err(); err != nil {
-		return nil, err
-	}
-
-	return tuples, nil
-}
-
-func (migration *addRoleTransactionGroups) Down(context.Context, *bun.DB) error {
-	return nil
-}

pkg/telemetrylogs/condition_builder.go

@@ -40,10 +40,12 @@ func isBodyJSONSearch(key *telemetrytypes.TelemetryFieldKey, columns []*schema.C
 	return false
 }
 
-// conditionForArrayFunction builds has/hasAny/hasAll over a body JSON path — via the JSON
-// access plan (flag on) or legacy typed extraction (flag off).
+// conditionForArrayFunction builds `has/hasAny/hasAll(<arrayFieldExpr>, value)` over a
+// body JSON array field. The field expression uses the JSON accessor (flag on) or
+// legacy string extraction (flag off); value[0] is the needle.
 func (c *conditionBuilder) conditionForArrayFunction(
 	ctx context.Context,
+	startNs, endNs uint64,
 	key *telemetrytypes.TelemetryFieldKey,
 	operator qbtypes.FilterOperator,
 	value any,
@@ -60,48 +62,24 @@ func (c *conditionBuilder) conditionForArrayFunction(
 		needle = args[0]
 	}
 
+	var fieldExpr string
 	if c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(valuer.UUID{})) {
-		// JSON access plan: data-type collision handling, nested array paths.
-		valueType, needle := InferDataType(needle, operator, key)
-		return NewJSONConditionBuilder(key, valueType).buildArrayFunctionCondition(operator, needle, sb)
+		fe, err := c.fm.FieldFor(ctx, startNs, endNs, key)
+		if err != nil {
+			return "", err
+		}
+		fieldExpr = fe
+	} else {
+		// legacy string-body path; value drives array-type inference (e.g. `[*]` paths)
+		fieldExpr, _ = GetBodyJSONKey(ctx, key, qbtypes.FilterOperatorUnknown, value)
 	}
 
-	// legacy string-body path: type-matched array extraction, OR-ed with a scalar comparison
-	// for a scalar body value (coalesced to false so NOT has() matches missing-key rows).
-	elemType := legacyElemType(needle)
-	arrayExpr := getBodyJSONArrayKey(key, elemType)
-	scalarExpr, scalarGuard, hasScalar := getBodyJSONScalarKey(key, elemType)
-	if list, ok := needle.([]any); ok {
-		vals := make([]any, len(list))
-		for i, v := range list {
-			vals[i] = legacyCoerceNeedle(v, elemType)
-		}
-		arrayCond := fmt.Sprintf("%s(%s, %s)", operator.FunctionName(), arrayExpr, sb.Var(vals))
-		if !hasScalar {
-			return arrayCond, nil
-		}
-		var membership string
-		if operator == qbtypes.FilterOperatorHasAll {
-			eqs := make([]string, len(vals))
-			for i, v := range vals {
-				eqs[i] = sb.E(scalarExpr, v)
-			}
-			membership = sb.And(eqs...)
-		} else {
-			membership = sb.In(scalarExpr, vals...)
-		}
-		return fmt.Sprintf("(%s OR ifNull(%s, false))", arrayCond, sb.And(membership, scalarGuard)), nil
-	}
-	typedNeedle := legacyCoerceNeedle(needle, elemType)
-	arrayCond := fmt.Sprintf("%s(%s, %s)", operator.FunctionName(), arrayExpr, sb.Var(typedNeedle))
-	if !hasScalar {
-		return arrayCond, nil
-	}
-	return fmt.Sprintf("(%s OR ifNull(%s, false))", arrayCond, sb.And(sb.E(scalarExpr, typedNeedle), scalarGuard)), nil
+	return fmt.Sprintf("%s(%s, %s)", operator.FunctionName(), fieldExpr, sb.Var(needle)), nil
 }
 
-// conditionForHasToken builds a hasToken full-text search over the body column, resolving the
-// column from the key name + use_json_body flag.
+// conditionForHasToken builds `hasToken(LOWER(<bodyColumn>), LOWER(<needle>))`, a
+// full-text token search over the body column. It resolves the column from the key
+// name + use_json_body flag, validates the field/value, and tags errors with the doc URL.
 func (c *conditionBuilder) conditionForHasToken(
 	ctx context.Context,
 	key *telemetrytypes.TelemetryFieldKey,
@@ -114,37 +92,28 @@ func (c *conditionBuilder) conditionForHasToken(
 		needle = args[0]
 	}
 
+	// TODO(Tushar): thread orgID here to evaluate correctly
+	bodyJSONEnabled := c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(valuer.UUID{}))
+
+	columnName := LogsV2BodyColumn
+	if bodyJSONEnabled {
+		if key.Name != LogsV2BodyColumn && key.Name != bodyMessageField {
+			return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
+				"function `hasToken` only supports body/body.message field as first parameter").WithUrl(hasTokenFunctionDocURL)
+		}
+		columnName = bodyMessageField
+	} else if key.Name != LogsV2BodyColumn {
+		return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
+			"function `hasToken` only supports body field as first parameter").WithUrl(hasTokenFunctionDocURL)
+	}
+
 	// hasToken matches string tokens only.
 	if _, ok := needle.(string); !ok {
 		return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
 			"function `hasToken` expects value parameter to be a string").WithUrl(hasTokenFunctionDocURL)
 	}
 
-	// TODO(Tushar): thread orgID here to evaluate correctly
-	bodyJSONEnabled := c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(valuer.UUID{}))
-
-	if !bodyJSONEnabled {
-		// legacy: token search over the plain body string column only.
-		if key.Name != LogsV2BodyColumn {
-			return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
-				"function `hasToken` only supports body field as first parameter").WithUrl(hasTokenFunctionDocURL)
-		}
-		return fmt.Sprintf("hasToken(LOWER(%s), LOWER(%s))", LogsV2BodyColumn, sb.Var(needle)), nil
-	}
-
-	// JSON mode: a bare body/body.message key searches the body.message column; any other body
-	// field is a token search over its JSON string field, incl. strings nested in arrays.
-	// `body.message` resolves to a body-context key named `message`, so match that too — else it
-	// falls through and emits dynamicElement over the already-typed String column, which errors.
-	if key.Name == LogsV2BodyColumn || key.Name == bodyMessageField ||
-		(key.FieldContext == telemetrytypes.FieldContextBody && key.Name == messageSubField) {
-		return fmt.Sprintf("hasToken(LOWER(%s), LOWER(%s))", bodyMessageField, sb.Var(needle)), nil
-	}
-	if key.FieldContext == telemetrytypes.FieldContextBody {
-		return NewJSONConditionBuilder(key, telemetrytypes.FieldDataTypeString).buildTokenFunctionCondition(needle, sb)
-	}
-	return "", errors.NewInvalidInputf(errors.CodeInvalidInput,
-		"function `hasToken` only supports the body field or a body JSON string field as first parameter").WithUrl(hasTokenFunctionDocURL)
+	return fmt.Sprintf("hasToken(LOWER(%s), LOWER(%s))", columnName, sb.Var(needle)), nil
 }
 
 func (c *conditionBuilder) conditionFor(
@@ -155,7 +124,8 @@ func (c *conditionBuilder) conditionFor(
 	value any,
 	sb *sqlbuilder.SelectBuilder,
 ) (string, error) {
-	// hasToken resolves from the key name + flag alone (no column resolution), so handle it first.
+	// hasToken is a token search over the body column resolved purely from the key
+	// name + flag, independent of column resolution, so handle it before anything else.
 	if operator == qbtypes.FilterOperatorHasToken {
 		return c.conditionForHasToken(ctx, key, value, sb)
 	}
@@ -165,9 +135,10 @@ func (c *conditionBuilder) conditionFor(
 		return "", err
 	}
 
-	// has/hasAny/hasAll take the body-JSON path, not the normal operator paths.
+	// has/hasAny/hasAll build `has(<arrayFieldExpr>, value)` over body JSON arrays
+	// rather than going through the normal operator paths, so handle them up front.
 	if operator.IsArrayFunctionOperator() {
-		return c.conditionForArrayFunction(ctx, key, operator, value, columns, sb)
+		return c.conditionForArrayFunction(ctx, startNs, endNs, key, operator, value, columns, sb)
 	}
 
 	// TODO(Piyush): Update this to support multiple JSON columns based on evolutions
@@ -431,6 +402,23 @@ func (c *conditionBuilder) ConditionFor(
 		}
 	}
 
+	// has/hasAny/hasAll need an array field: in JSON-body mode drop non-array matches so a
+	// scalar errors clearly instead of failing at ClickHouse runtime (legacy mode skips this).
+	if operator.IsArrayFunctionOperator() &&
+		c.fl.BooleanOrEmpty(ctx, flagger.FeatureUseJSONBody, featuretypes.NewFlaggerEvaluationContext(valuer.UUID{})) {
+		arrayKeys := make([]*telemetrytypes.TelemetryFieldKey, 0, len(keys))
+		for _, k := range keys {
+			if k.FieldDataType.IsArray() {
+				arrayKeys = append(arrayKeys, k)
+			}
+		}
+		if len(arrayKeys) == 0 {
+			return nil, warnings, errors.NewInvalidInputf(errors.CodeInvalidInput,
+				"function `%s` expects key parameter to be an array field; no array fields found", operator.FunctionName())
+		}
+		keys = arrayKeys
+	}
+
 	conds := make([]string, 0, len(keys))
 	for _, k := range keys {
 		cond, err := c.conditionForKey(ctx, startNs, endNs, k, operator, value, sb)

pkg/telemetrylogs/filter_expr_logs_body_json_test.go

@@ -44,66 +44,34 @@ func TestFilterExprLogsBodyJSON(t *testing.T) {
 			category:              "json",
 			query:                 "has(body.requestor_list[*], 'index_service')",
 			shouldPass:            true,
-			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."requestor_list"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."requestor_list"') = ? AND JSONType(body, 'requestor_list') NOT IN ('Array', 'Object', 'Null')), false))`,
-			expectedArgs:          []any{"index_service", "index_service"},
+			expectedQuery:         `WHERE has(JSONExtract(JSON_QUERY(body, '$."requestor_list"[*]'), 'Array(String)'), ?)`,
+			expectedArgs:          []any{"index_service"},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "has(body.int_numbers[*], 2)",
 			shouldPass:            true,
-			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."int_numbers"[*]'), 'Array(Nullable(Float64))'), ?) OR ifNull((JSONExtract(JSON_VALUE(body, '$."int_numbers"'), 'Nullable(Float64)') = ? AND JSONType(body, 'int_numbers') NOT IN ('Array', 'Object', 'Null')), false))`,
-			expectedArgs:          []any{float64(2), float64(2)},
+			expectedQuery:         `WHERE has(JSONExtract(JSON_QUERY(body, '$."int_numbers"[*]'), 'Array(Float64)'), ?)`,
+			expectedArgs:          []any{float64(2)},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "has(body.bool[*], true)",
 			shouldPass:            true,
-			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."bool"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."bool"') = ? AND JSONType(body, 'bool') NOT IN ('Array', 'Object', 'Null')), false))`,
-			expectedArgs:          []any{"true", "true"},
+			expectedQuery:         `WHERE has(JSONExtract(JSON_QUERY(body, '$."bool"[*]'), 'Array(Bool)'), ?)`,
+			expectedArgs:          []any{true},
 			expectedErrorContains: "",
 		},
 		{
 			category:              "json",
 			query:                 "NOT has(body.nested_num[*].float_nums[*], 2.2)",
 			shouldPass:            true,
-			expectedQuery:         `WHERE NOT (has(JSONExtract(JSON_QUERY(body, '$."nested_num"[*]."float_nums"[*]'), 'Array(Nullable(Float64))'), ?))`,
+			expectedQuery:         `WHERE NOT (has(JSONExtract(JSON_QUERY(body, '$."nested_num"[*]."float_nums"[*]'), 'Array(Float64)'), ?))`,
 			expectedArgs:          []any{float64(2.2)},
 			expectedErrorContains: "",
 		},
-		{
-			category:              "json",
-			query:                 "has(body.tags, 'production')",
-			shouldPass:            true,
-			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."tags"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."tags"') = ? AND JSONType(body, 'tags') NOT IN ('Array', 'Object', 'Null')), false))`,
-			expectedArgs:          []any{"production", "production"},
-			expectedErrorContains: "",
-		},
-		{
-			category:              "json",
-			query:                 "hasAny(body.tags, ['critical', 'test'])",
-			shouldPass:            true,
-			expectedQuery:         `WHERE (hasAny(JSONExtract(JSON_QUERY(body, '$."tags"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$."tags"') IN (?, ?) AND JSONType(body, 'tags') NOT IN ('Array', 'Object', 'Null')), false))`,
-			expectedArgs:          []any{[]any{"critical", "test"}, "critical", "test"},
-			expectedErrorContains: "",
-		},
-		{
-			category:              "json",
-			query:                 "hasAll(body.tags, ['production', 'web'])",
-			shouldPass:            true,
-			expectedQuery:         `WHERE (hasAll(JSONExtract(JSON_QUERY(body, '$."tags"[*]'), 'Array(Nullable(String))'), ?) OR ifNull(((JSON_VALUE(body, '$."tags"') = ? AND JSON_VALUE(body, '$."tags"') = ?) AND JSONType(body, 'tags') NOT IN ('Array', 'Object', 'Null')), false))`,
-			expectedArgs:          []any{[]any{"production", "web"}, "production", "web"},
-			expectedErrorContains: "",
-		},
-		{
-			category:              "json",
-			query:                 "has(body.ids, \"200\")",
-			shouldPass:            true,
-			expectedQuery:         `WHERE (has(JSONExtract(JSON_QUERY(body, '$."ids"[*]'), 'Array(Nullable(Int64))'), ?) OR ifNull((JSONExtract(JSON_VALUE(body, '$."ids"'), 'Nullable(Int64)') = ? AND JSONType(body, 'ids') NOT IN ('Array', 'Object', 'Null')), false))`,
-			expectedArgs:          []any{int64(200), int64(200)},
-			expectedErrorContains: "",
-		},
 		{
 			category:              "json",
 			query:                 "body.message = hello",

pkg/telemetrylogs/filter_expr_logs_test.go

@@ -1561,25 +1561,6 @@ func TestFilterExprLogs(t *testing.T) {
 			expectedArgs:          []any{"download"},
 			expectedErrorContains: "function `hasToken` expects value parameter to be a string",
 		},
-		// extra / mis-shaped value arguments are rejected, not silently dropped.
-		{
-			category:              "hasExtraArgs",
-			query:                 "has(body.tags[*], \"a\", \"b\")",
-			shouldPass:            false,
-			expectedErrorContains: "function `has` expects exactly one value argument",
-		},
-		{
-			category:              "hasArrayArg",
-			query:                 "has(body.tags[*], [\"a\", \"b\"])",
-			shouldPass:            false,
-			expectedErrorContains: "function `has` expects a single scalar value, not an array",
-		},
-		{
-			category:              "hasTokenExtraArgs",
-			query:                 "hasToken(body, \"a\", \"b\")",
-			shouldPass:            false,
-			expectedErrorContains: "function `hasToken` expects exactly one value argument",
-		},
 
 		// Basic materialized key
 		{

pkg/telemetrylogs/json_condition_builder.go

@@ -96,18 +96,6 @@ func applyNotCondition(operator qbtypes.FilterOperator) (bool, qbtypes.FilterOpe
 	return false, operator
 }
 
-// branchArrayExpr returns the ClickHouse array expression for a given array-type branch
-// at this hop. The JSON branch reads Array(JSON(...)) directly; the Dynamic branch filters
-// the Array(Dynamic) down to its JSON elements and maps them to JSON.
-func (c *jsonConditionBuilder) branchArrayExpr(node *telemetrytypes.JSONAccessNode, branch telemetrytypes.JSONAccessBranchType) string {
-	fieldPath := node.FieldPath()
-	if branch == telemetrytypes.BranchDynamic {
-		dynBaseExpr := fmt.Sprintf("dynamicElement(%s, 'Array(Dynamic)')", fieldPath)
-		return fmt.Sprintf("arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), %s))", dynBaseExpr)
-	}
-	return fmt.Sprintf("dynamicElement(%s, 'Array(JSON(max_dynamic_types=%d, max_dynamic_paths=%d))')", fieldPath, node.MaxDynamicTypes, node.MaxDynamicPaths)
-}
-
 // buildAccessNodeBranches builds conditions for each branch of the access node.
 func (c *jsonConditionBuilder) buildAccessNodeBranches(current *telemetrytypes.JSONAccessNode, operator qbtypes.FilterOperator, value any, sb *sqlbuilder.SelectBuilder) (string, error) {
 	if current == nil {
@@ -115,15 +103,31 @@ func (c *jsonConditionBuilder) buildAccessNodeBranches(current *telemetrytypes.J
 	}
 
 	currAlias := current.Alias()
-	// At this hop, compute the child condition per array branch (JSON before Dynamic) and
-	// wrap each in arrayExists over the corresponding array expression.
+	fieldPath := current.FieldPath()
+	// Determine availability of Array(JSON) and Array(Dynamic) at this hop
+	hasArrayJSON := current.Branches[telemetrytypes.BranchJSON] != nil
+	hasArrayDynamic := current.Branches[telemetrytypes.BranchDynamic] != nil
+
+	// Then, at this hop, compute child per branch and wrap
 	branches := make([]string, 0, 2)
-	for _, branch := range current.BranchesInOrder() {
-		childGroup, err := c.recurseArrayHops(current.Branches[branch], operator, value, sb)
+	if hasArrayJSON {
+		jsonArrayExpr := fmt.Sprintf("dynamicElement(%s, 'Array(JSON(max_dynamic_types=%d, max_dynamic_paths=%d))')", fieldPath, current.MaxDynamicTypes, current.MaxDynamicPaths)
+		childGroupJSON, err := c.recurseArrayHops(current.Branches[telemetrytypes.BranchJSON], operator, value, sb)
 		if err != nil {
 			return "", err
 		}
-		branches = append(branches, fmt.Sprintf("arrayExists(%s-> %s, %s)", currAlias, childGroup, c.branchArrayExpr(current, branch)))
+		branches = append(branches, fmt.Sprintf("arrayExists(%s-> %s, %s)", currAlias, childGroupJSON, jsonArrayExpr))
+	}
+	if hasArrayDynamic {
+		dynBaseExpr := fmt.Sprintf("dynamicElement(%s, 'Array(Dynamic)')", fieldPath)
+		dynFilteredExpr := fmt.Sprintf("arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), %s))", dynBaseExpr)
+
+		// Create the Query for Dynamic array
+		childGroupDyn, err := c.recurseArrayHops(current.Branches[telemetrytypes.BranchDynamic], operator, value, sb)
+		if err != nil {
+			return "", err
+		}
+		branches = append(branches, fmt.Sprintf("arrayExists(%s-> %s, %s)", currAlias, childGroupDyn, dynFilteredExpr))
 	}
 
 	if len(branches) == 1 {
@@ -305,174 +309,6 @@ func (c *jsonConditionBuilder) buildArrayMembershipCondition(node *telemetrytype
 	return fmt.Sprintf("arrayExists(%s -> %s, %s)", key, op, arrayExpr), nil
 }
 
-// buildArrayFunctionCondition builds a has/hasAny/hasAll condition over a body JSON path,
-// with contains-all semantics uniform across every leaf shape:
-//   - has(v)         = the path HAS v
-//   - hasAny([v...]) = the path has ANY listed value  (OR of has)
-//   - hasAll([v...]) = the path has ALL listed values (AND of has)
-//
-// "the path has v" is an existential match resolved per leaf shape: for an array-typed leaf
-// (top-level `body.tags`, or nested `body.education[].scores`) it is native membership; for a
-// scalar leaf — whether reached through an array hop (`body.items[].sku`) or a plain scalar
-// path (`body.level`) — it is `<elem> = v`, wrapped in arrayExists over any array hops. So
-// `hasAll(body.education[].name, ['a','b'])` = "some element is a AND some element is b", and
-// for a plain scalar hasAll collapses to has (a one-element set can hold at most one value).
-//
-// Element comparisons reuse DataTypeCollisionHandledFieldName so a numeric literal against an
-// Int64 array (or a numeric literal against a String array) no longer silently misses.
-func (c *jsonConditionBuilder) buildArrayFunctionCondition(operator qbtypes.FilterOperator, value any, sb *sqlbuilder.SelectBuilder) (string, error) {
-	if len(c.key.JSONPlan) == 0 {
-		return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "function `%s` could not resolve a JSON access plan for field `%s`", operator.FunctionName(), c.key.Name)
-	}
-
-	switch operator {
-	case qbtypes.FilterOperatorHas, qbtypes.FilterOperatorHasAny:
-		return c.buildOredRootChains(func(node *telemetrytypes.JSONAccessNode) (string, error) {
-			return c.arrayFunctionLeaf(node, operator, value, sb)
-		}, sb)
-	case qbtypes.FilterOperatorHasAll:
-		// contains-all: AND of a per-value "has" so the AND sits outside the array hops.
-		values := toAnyList(value)
-		conditions := make([]string, 0, len(values))
-		for _, v := range values {
-			v := v
-			cond, err := c.buildOredRootChains(func(node *telemetrytypes.JSONAccessNode) (string, error) {
-				return c.arrayFunctionLeaf(node, qbtypes.FilterOperatorHas, v, sb)
-			}, sb)
-			if err != nil {
-				return "", err
-			}
-			conditions = append(conditions, cond)
-		}
-		if len(conditions) == 1 {
-			return conditions[0], nil
-		}
-		return sb.And(conditions...), nil
-	}
-	return "", qbtypes.ErrUnsupportedOperator
-}
-
-// buildOredRootChains applies leafFn down every JSONPlan root (base + promoted), wrapping each
-// in its arrayExists chain, and ORs the per-root results.
-func (c *jsonConditionBuilder) buildOredRootChains(leafFn func(*telemetrytypes.JSONAccessNode) (string, error), sb *sqlbuilder.SelectBuilder) (string, error) {
-	conditions := make([]string, 0, len(c.key.JSONPlan))
-	for _, root := range c.key.JSONPlan {
-		cond, err := c.buildArrayExistsChain(root, leafFn, sb)
-		if err != nil {
-			return "", err
-		}
-		conditions = append(conditions, cond)
-	}
-	if len(conditions) == 1 {
-		return conditions[0], nil
-	}
-	return sb.Or(conditions...), nil
-}
-
-// buildArrayExistsChain wraps the terminal condition (produced by leafFn) in an arrayExists
-// over every array hop between the root and the terminal. For a terminal root (a top-level
-// array leaf) it simply returns leafFn(root).
-func (c *jsonConditionBuilder) buildArrayExistsChain(node *telemetrytypes.JSONAccessNode, leafFn func(*telemetrytypes.JSONAccessNode) (string, error), sb *sqlbuilder.SelectBuilder) (string, error) {
-	if node == nil {
-		return "", errors.NewInternalf(CodeArrayNavigationFailed, "navigation failed, current node is nil")
-	}
-	if node.IsTerminal {
-		return leafFn(node)
-	}
-
-	branches := make([]string, 0, 2)
-	for _, branch := range node.BranchesInOrder() {
-		childCond, err := c.buildArrayExistsChain(node.Branches[branch], leafFn, sb)
-		if err != nil {
-			return "", err
-		}
-		branches = append(branches, fmt.Sprintf("arrayExists(%s-> %s, %s)", node.Alias(), childCond, c.branchArrayExpr(node, branch)))
-	}
-	if len(branches) == 1 {
-		return branches[0], nil
-	}
-	return sb.Or(branches...), nil
-}
-
-// arrayFunctionLeaf builds the existential comparison for has/hasAny at a terminal node (hasAll
-// composes from has in buildArrayFunctionCondition). For an array leaf it delegates to native
-// membership; for a scalar leaf it compares the element directly.
-func (c *jsonConditionBuilder) arrayFunctionLeaf(node *telemetrytypes.JSONAccessNode, operator qbtypes.FilterOperator, value any, sb *sqlbuilder.SelectBuilder) (string, error) {
-	if node.TerminalConfig.ElemType.IsArray {
-		return c.arrayLeafMembership(node, operator, value, sb)
-	}
-
-	switch operator {
-	case qbtypes.FilterOperatorHas:
-		return c.arrayFuncScalarLeaf(node, qbtypes.FilterOperatorEqual, value, sb)
-	case qbtypes.FilterOperatorHasAny:
-		return c.arrayFuncScalarLeaf(node, qbtypes.FilterOperatorIn, toAnyList(value), sb)
-	}
-	return "", qbtypes.ErrUnsupportedOperator
-}
-
-// arrayLeafMembership builds native membership for an array-typed leaf, reusing
-// buildArrayMembershipCondition (which handles data-type collisions on each element).
-func (c *jsonConditionBuilder) arrayLeafMembership(node *telemetrytypes.JSONAccessNode, operator qbtypes.FilterOperator, value any, sb *sqlbuilder.SelectBuilder) (string, error) {
-	switch operator {
-	case qbtypes.FilterOperatorHas:
-		return c.buildArrayMembershipCondition(node, qbtypes.FilterOperatorEqual, value, sb)
-	case qbtypes.FilterOperatorHasAny:
-		return c.buildArrayMembershipCondition(node, qbtypes.FilterOperatorIn, toAnyList(value), sb)
-	}
-	return "", qbtypes.ErrUnsupportedOperator
-}
-
-// arrayFuncScalarLeaf builds `<elemExpr> <op> value` for a scalar leaf reached through an
-// array hop, applying data-type collision handling like the standard primitive path.
-// Coalesced to false so a missing key is a non-match, not NULL (NOT has() must match it).
-func (c *jsonConditionBuilder) arrayFuncScalarLeaf(node *telemetrytypes.JSONAccessNode, operator qbtypes.FilterOperator, value any, sb *sqlbuilder.SelectBuilder) (string, error) {
-	fieldExpr := fmt.Sprintf("dynamicElement(%s, '%s')", node.FieldPath(), node.TerminalConfig.ElemType.StringValue())
-	fieldExpr, value = querybuilder.DataTypeCollisionHandledFieldName(node.TerminalConfig.Key, value, fieldExpr, operator)
-	cond, err := c.applyOperator(sb, fieldExpr, operator, value)
-	if err != nil {
-		return "", err
-	}
-	return fmt.Sprintf("ifNull(%s, false)", cond), nil
-}
-
-// buildTokenFunctionCondition builds a hasToken search over a body JSON string field:
-// hasToken(LOWER(<elem>), LOWER(?)) wrapped in arrayExists over any array hops between the
-// root and the terminal. The field must resolve to a String leaf or a String array.
-func (c *jsonConditionBuilder) buildTokenFunctionCondition(needle any, sb *sqlbuilder.SelectBuilder) (string, error) {
-	if len(c.key.JSONPlan) == 0 {
-		return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "function `hasToken` could not resolve a JSON access plan for field `%s`", c.key.Name)
-	}
-
-	return c.buildOredRootChains(func(node *telemetrytypes.JSONAccessNode) (string, error) {
-		return c.tokenLeaf(node, needle, sb)
-	}, sb)
-}
-
-// tokenLeaf builds the hasToken match at a terminal node: a direct match for a String leaf
-// (coalesced to false, as in arrayFuncScalarLeaf), or an arrayExists over the elements for a
-// String array leaf. hasToken is string-only, so any other element type is rejected.
-func (c *jsonConditionBuilder) tokenLeaf(node *telemetrytypes.JSONAccessNode, needle any, sb *sqlbuilder.SelectBuilder) (string, error) {
-	switch node.TerminalConfig.ElemType {
-	case telemetrytypes.String:
-		fieldExpr := fmt.Sprintf("dynamicElement(%s, 'String')", node.FieldPath())
-		return fmt.Sprintf("ifNull(hasToken(LOWER(%s), LOWER(%s)), false)", fieldExpr, sb.Var(needle)), nil
-	case telemetrytypes.ArrayString:
-		arrayExpr := fmt.Sprintf("dynamicElement(%s, '%s')", node.FieldPath(), node.TerminalConfig.ElemType.StringValue())
-		return fmt.Sprintf("arrayExists(x -> hasToken(LOWER(x), LOWER(%s)), %s)", sb.Var(needle), arrayExpr), nil
-	default:
-		return "", errors.NewInvalidInputf(errors.CodeInvalidInput, "function `hasToken` only supports string fields; field `%s` is `%s`", c.key.Name, node.TerminalConfig.Key.FieldDataType.StringValue())
-	}
-}
-
-// toAnyList normalizes a has-family value into a slice; a scalar becomes a one-element list.
-func toAnyList(value any) []any {
-	if list, ok := value.([]any); ok {
-		return list
-	}
-	return []any{value}
-}
-
 func (c *jsonConditionBuilder) applyOperator(sb *sqlbuilder.SelectBuilder, fieldExpr string, operator qbtypes.FilterOperator, value any) (string, error) {
 	switch operator {
 	case qbtypes.FilterOperatorEqual:

pkg/telemetrylogs/json_stmt_builder_test.go

@@ -602,7 +602,7 @@ func TestJSONStmtBuilder_ArrayPaths(t *testing.T) {
 			name:   "Simple has filter",
 			filter: "has(body.education[].parameters, 1.65)",
 			expected: TestExpected{
-				WhereClause: "(arrayExists(`body_v2.education`-> arrayExists(x -> toFloat64(x) = ?, dynamicElement(`body_v2.education`.`parameters`, 'Array(Nullable(Float64))')), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')) OR arrayExists(`body_v2.education`-> arrayExists(x -> accurateCastOrNull(x, 'Float64') = ?, arrayFilter(x->(dynamicType(x) IN ('String', 'Int64', 'Float64', 'Bool')), dynamicElement(`body_v2.education`.`parameters`, 'Array(Dynamic)'))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))",
+				WhereClause: "(has(arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->dynamicElement(`body_v2.education`.`parameters`, 'Array(Nullable(Float64))'), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))), ?) OR has(arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->dynamicElement(`body_v2.education`.`parameters`, 'Array(Dynamic)'), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))), ?))",
 				Args:        []any{1.65, 1.65, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 				Warnings: []string{
 					"Key `education[].parameters` is ambiguous, found 2 different combinations of field context / data type: [name=education[].parameters,context=body,datatype=[]float64 name=education[].parameters,context=body,datatype=[]dynamic].",
@@ -613,8 +613,8 @@ func TestJSONStmtBuilder_ArrayPaths(t *testing.T) {
 			name:   "Flat path hasAll filter",
 			filter: "hasAll(body.user.permissions, ['read', 'write'])",
 			expected: TestExpected{
-				WhereClause: "(arrayExists(x -> x = ?, dynamicElement(body_v2.`user.permissions`, 'Array(Nullable(String))')) AND arrayExists(x -> x = ?, dynamicElement(body_v2.`user.permissions`, 'Array(Nullable(String))')))",
-				Args:        []any{"read", "write", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				WhereClause: "hasAll(dynamicElement(body_v2.`user.permissions`, 'Array(Nullable(String))'), ?)",
+				Args:        []any{[]any{"read", "write"}, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
 
@@ -739,8 +739,8 @@ func TestJSONStmtBuilder_ArrayPaths(t *testing.T) {
 			name:   "Nested path hasAny filter",
 			filter: "hasAny(education[].awards[].participated[].members, ['Piyush', 'Tushar'])",
 			expected: TestExpected{
-				WhereClause: "arrayExists(`body_v2.education`-> (arrayExists(`body_v2.education[].awards`-> (arrayExists(`body_v2.education[].awards[].participated`-> arrayExists(x -> x IN (?, ?), dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))')), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=4, max_dynamic_paths=0))')) OR arrayExists(`body_v2.education[].awards[].participated`-> arrayExists(x -> x IN (?, ?), dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))')), arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')) OR arrayExists(`body_v2.education[].awards`-> (arrayExists(`body_v2.education[].awards[].participated`-> arrayExists(x -> x IN (?, ?), dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))')), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=256))')) OR arrayExists(`body_v2.education[].awards[].participated`-> arrayExists(x -> x IN (?, ?), dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))')), arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))",
-				Args:        []any{"Piyush", "Tushar", "Piyush", "Tushar", "Piyush", "Tushar", "Piyush", "Tushar", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				WhereClause: "hasAny(arrayFlatten(arrayConcat(arrayMap(`body_v2.education`->arrayConcat(arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=4, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), arrayMap(`body_v2.education[].awards`->arrayConcat(arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=256))')), arrayMap(`body_v2.education[].awards[].participated`->dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))'), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), arrayMap(x->assumeNotNull(dynamicElement(x, 'JSON')), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))), ?)",
+				Args:        []any{[]any{"Piyush", "Tushar"}, "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
 		{
@@ -755,8 +755,8 @@ func TestJSONStmtBuilder_ArrayPaths(t *testing.T) {
 			name:   "dynamic_array_element_compare_HAS_STRING",
 			filter: "has(interests[].entities[].product_codes, '2002')",
 			expected: TestExpected{
-				WhereClause: "arrayExists(`body_v2.interests`-> arrayExists(`body_v2.interests[].entities`-> arrayExists(x -> accurateCastOrNull(x, 'Float64') = ?, arrayFilter(x->(dynamicType(x) IN ('String', 'Int64', 'Float64', 'Bool')), dynamicElement(`body_v2.interests[].entities`.`product_codes`, 'Array(Dynamic)'))), dynamicElement(`body_v2.interests`.`entities`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), dynamicElement(body_v2.`interests`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))",
-				Args:        []any{int64(2002), "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				WhereClause: "has(arrayFlatten(arrayConcat(arrayMap(`body_v2.interests`->arrayMap(`body_v2.interests[].entities`->dynamicElement(`body_v2.interests[].entities`.`product_codes`, 'Array(Dynamic)'), dynamicElement(`body_v2.interests`.`entities`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), dynamicElement(body_v2.`interests`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))), ?)",
+				Args:        []any{"2002", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
 		{
@@ -771,146 +771,10 @@ func TestJSONStmtBuilder_ArrayPaths(t *testing.T) {
 			name:   "dynamic_array_element_compare_HAS_INT",
 			filter: "has(interests[].entities[].product_codes, 1001)",
 			expected: TestExpected{
-				WhereClause: "arrayExists(`body_v2.interests`-> arrayExists(`body_v2.interests[].entities`-> arrayExists(x -> accurateCastOrNull(x, 'Float64') = ?, arrayFilter(x->(dynamicType(x) IN ('String', 'Int64', 'Float64', 'Bool')), dynamicElement(`body_v2.interests[].entities`.`product_codes`, 'Array(Dynamic)'))), dynamicElement(`body_v2.interests`.`entities`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), dynamicElement(body_v2.`interests`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))",
+				WhereClause: "has(arrayFlatten(arrayConcat(arrayMap(`body_v2.interests`->arrayMap(`body_v2.interests[].entities`->dynamicElement(`body_v2.interests[].entities`.`product_codes`, 'Array(Dynamic)'), dynamicElement(`body_v2.interests`.`entities`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')), dynamicElement(body_v2.`interests`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))), ?)",
 				Args:        []any{float64(1001), "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 		},
-
-		// ── scalar leaf reached through an array ───
-		{
-			name:   "Nested primitive leaf has",
-			filter: "has(body.education[].name, 'IIT')",
-			expected: TestExpected{
-				WhereClause: "arrayExists(`body_v2.education`-> ifNull(dynamicElement(`body_v2.education`.`name`, 'String') = ?, false), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))",
-				Args:        []any{"IIT", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		{
-			name:   "Nested primitive leaf hasAny",
-			filter: "hasAny(body.education[].name, ['IIT', 'MIT'])",
-			expected: TestExpected{
-				WhereClause: "arrayExists(`body_v2.education`-> ifNull(dynamicElement(`body_v2.education`.`name`, 'String') IN (?, ?), false), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))",
-				Args:        []any{"IIT", "MIT", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		{
-			// contains-all: single-value hasAll over a nested leaf collapses to has.
-			name:   "Nested primitive leaf hasAll single collapses to has",
-			filter: "hasAll(body.education[].name, 'IIT')",
-			expected: TestExpected{
-				WhereClause: "arrayExists(`body_v2.education`-> ifNull(dynamicElement(`body_v2.education`.`name`, 'String') = ?, false), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))",
-				Args:        []any{"IIT", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		{
-			// contains-all: "some element is IIT AND some element is MIT" (AND of per-value has).
-			name:   "Nested primitive leaf hasAll multi (contains-all)",
-			filter: "hasAll(body.education[].name, ['IIT', 'MIT'])",
-			expected: TestExpected{
-				WhereClause: "(arrayExists(`body_v2.education`-> ifNull(dynamicElement(`body_v2.education`.`name`, 'String') = ?, false), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')) AND arrayExists(`body_v2.education`-> ifNull(dynamicElement(`body_v2.education`.`name`, 'String') = ?, false), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))')))",
-				Args:        []any{"IIT", "MIT", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		// ── numeric literal against an Int64 array is collision-handled ───
-		{
-			name:   "Nested Int64 array has collision",
-			filter: "has(body.education[].scores, 90)",
-			expected: TestExpected{
-				WhereClause: "arrayExists(`body_v2.education`-> arrayExists(x -> toFloat64(x) = ?, dynamicElement(`body_v2.education`.`scores`, 'Array(Nullable(Int64))')), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))",
-				Args:        []any{float64(90), "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		// ── hasAny folds multiple scalar arguments into one value set ─────
-		{
-			name:   "hasAny folds multiple scalar args",
-			filter: "hasAny(body.user.permissions, 'read', 'write')",
-			expected: TestExpected{
-				WhereClause: "arrayExists(x -> x IN (?, ?), dynamicElement(body_v2.`user.permissions`, 'Array(Nullable(String))'))",
-				Args:        []any{"read", "write", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		// ── hasToken over JSON string fields (nested leaf, top-level array, nested array) ──
-		{
-			name:   "hasToken nested string leaf",
-			filter: "hasToken(body.education[].name, 'harvard')",
-			expected: TestExpected{
-				WhereClause: "arrayExists(`body_v2.education`-> ifNull(hasToken(LOWER(dynamicElement(`body_v2.education`.`name`, 'String')), LOWER(?)), false), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))",
-				Args:        []any{"harvard", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		{
-			name:   "hasToken top-level string array",
-			filter: "hasToken(body.user.permissions, 'admin')",
-			expected: TestExpected{
-				WhereClause: "arrayExists(x -> hasToken(LOWER(x), LOWER(?)), dynamicElement(body_v2.`user.permissions`, 'Array(Nullable(String))'))",
-				Args:        []any{"admin", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		{
-			name:   "hasToken nested string array",
-			filter: "hasToken(body.education[].awards[].participated[].members, 'piyush')",
-			expected: TestExpected{
-				WhereClause: "arrayExists(`body_v2.education`-> (arrayExists(`body_v2.education[].awards`-> (arrayExists(`body_v2.education[].awards[].participated`-> arrayExists(x -> hasToken(LOWER(x), LOWER(?)), dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))')), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=4, max_dynamic_paths=0))')) OR arrayExists(`body_v2.education[].awards[].participated`-> arrayExists(x -> hasToken(LOWER(x), LOWER(?)), dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))')), arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), dynamicElement(`body_v2.education`.`awards`, 'Array(JSON(max_dynamic_types=8, max_dynamic_paths=0))')) OR arrayExists(`body_v2.education[].awards`-> (arrayExists(`body_v2.education[].awards[].participated`-> arrayExists(x -> hasToken(LOWER(x), LOWER(?)), dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))')), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=256))')) OR arrayExists(`body_v2.education[].awards[].participated`-> arrayExists(x -> hasToken(LOWER(x), LOWER(?)), dynamicElement(`body_v2.education[].awards[].participated`.`members`, 'Array(Nullable(String))')), arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education[].awards`.`participated`, 'Array(Dynamic)'))))), arrayMap(x->dynamicElement(x, 'JSON'), arrayFilter(x->(dynamicType(x) = 'JSON'), dynamicElement(`body_v2.education`.`awards`, 'Array(Dynamic)'))))), dynamicElement(body_v2.`education`, 'Array(JSON(max_dynamic_types=16, max_dynamic_paths=0))'))",
-				Args:        []any{"piyush", "piyush", "piyush", "piyush", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-
-		// ── hasToken over the message field: bare body and explicit body.message are
-		// equivalent, both target the body.message column directly (no dynamicElement) ──
-		{
-			name:   "hasToken bare body",
-			filter: "hasToken(body, 'production')",
-			expected: TestExpected{
-				WhereClause: "hasToken(LOWER(body.message), LOWER(?))",
-				Args:        []any{"production", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-				Warnings:    []string{bodySearchDefaultWarning},
-			},
-		},
-		{
-			name:   "hasToken explicit body.message",
-			filter: "hasToken(body.message, 'production')",
-			expected: TestExpected{
-				WhereClause: "hasToken(LOWER(body.message), LOWER(?))",
-				Args:        []any{"production", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-
-		// ── scalar (non-array) leaf: treated as a single-element set ─────────────
-		{
-			name:   "Scalar leaf has",
-			filter: "has(body.user.name, 'alice')",
-			expected: TestExpected{
-				WhereClause: "ifNull(dynamicElement(body_v2.`user.name`, 'String') = ?, false)",
-				Args:        []any{"alice", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		{
-			name:   "Scalar leaf hasAny",
-			filter: "hasAny(body.user.name, ['alice', 'bob'])",
-			expected: TestExpected{
-				WhereClause: "ifNull(dynamicElement(body_v2.`user.name`, 'String') IN (?, ?), false)",
-				Args:        []any{"alice", "bob", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		{
-			// contains-all: single-value hasAll over a plain scalar collapses to has.
-			name:   "Scalar leaf hasAll single collapses to has",
-			filter: "hasAll(body.user.name, 'alice')",
-			expected: TestExpected{
-				WhereClause: "ifNull(dynamicElement(body_v2.`user.name`, 'String') = ?, false)",
-				Args:        []any{"alice", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
-		{
-			// contains-all over a one-element set: the scalar must equal every value, so
-			// distinct values never match.
-			name:   "Scalar leaf hasAll multi (contains-all)",
-			filter: "hasAll(body.user.name, ['alice', 'bob'])",
-			expected: TestExpected{
-				WhereClause: "(ifNull(dynamicElement(body_v2.`user.name`, 'String') = ?, false) AND ifNull(dynamicElement(body_v2.`user.name`, 'String') = ?, false))",
-				Args:        []any{"alice", "bob", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
-			},
-		},
 	}
 
 	for _, c := range cases {

pkg/telemetrylogs/json_string.go

@@ -130,121 +130,3 @@ func GetBodyJSONKey(_ context.Context, key *telemetrytypes.TelemetryFieldKey, op
 func GetBodyJSONKeyForExists(_ context.Context, key *telemetrytypes.TelemetryFieldKey, _ qbtypes.FilterOperator, _ any) string {
 	return fmt.Sprintf("JSON_EXISTS(body, '$.%s')", getBodyJSONPath(key))
 }
-
-// legacyElemType infers the has-family element type from the needle (legacy has no schema). It
-// scans EVERY value so the chosen array type and all coerced needles agree — else ClickHouse
-// raises "no supertype ... String" (code 386). Int64 stays distinct from Float64 so a quoted
-// integer is exact past 2^53 (unquoted literals already arrive as float64, parsed upstream).
-func legacyElemType(needle any) telemetrytypes.FieldDataType {
-	list, ok := needle.([]any)
-	if !ok {
-		list = []any{needle}
-	}
-	if len(list) == 0 {
-		return telemetrytypes.FieldDataTypeString
-	}
-	allInt, allNumeric := true, true
-	for _, v := range list {
-		switch t := v.(type) {
-		case float32, float64:
-			allInt = false
-		case int, int8, int16, int32, int64, uint, uint8, uint16, uint32, uint64:
-			// integer Go types stay int-exact
-		case string:
-			if _, err := strconv.ParseInt(t, 10, 64); err != nil {
-				allInt = false
-			}
-			if _, err := strconv.ParseFloat(t, 64); err != nil {
-				allNumeric = false
-			}
-		default:
-			// booleans (and anything else) -> String; a bool renders to 'true'/'false', so a
-			// bool needle only matches genuine JSON booleans, not truthy numbers/strings.
-			allInt, allNumeric = false, false
-		}
-	}
-	switch {
-	case allInt:
-		return telemetrytypes.FieldDataTypeInt64
-	case allNumeric:
-		return telemetrytypes.FieldDataTypeFloat64
-	default:
-		return telemetrytypes.FieldDataTypeString
-	}
-}
-
-// legacyCoerceNeedle coerces a needle to elem type dt so its bound-arg type matches the
-// extracted column (legacyElemType guarantees it's coercible).
-func legacyCoerceNeedle(v any, dt telemetrytypes.FieldDataType) any {
-	switch dt {
-	case telemetrytypes.FieldDataTypeInt64:
-		if s, ok := v.(string); ok {
-			if i, err := strconv.ParseInt(s, 10, 64); err == nil {
-				return i
-			}
-		}
-		return v
-	case telemetrytypes.FieldDataTypeFloat64:
-		if s, ok := v.(string); ok {
-			f, _ := strconv.ParseFloat(s, 64)
-			return f
-		}
-		return v
-	default:
-		return bodyArrayNeedleString(v)
-	}
-}
-
-// getBodyJSONArrayKey extracts the leaf as Array(Nullable(<dt>)) — Nullable so a value of a
-// different JSON type maps to NULL instead of corrupting (e.g. a non-numeric string → 0).
-func getBodyJSONArrayKey(key *telemetrytypes.TelemetryFieldKey, dt telemetrytypes.FieldDataType) string {
-	arrKey := *key
-	if !strings.HasSuffix(arrKey.Name, "[*]") && !strings.HasSuffix(arrKey.Name, "[]") {
-		arrKey.Name += "[*]"
-	}
-	return fmt.Sprintf("JSONExtract(JSON_QUERY(body, '$.%s'), 'Array(Nullable(%s))')", getBodyJSONPath(&arrKey), dt.CHDataType())
-}
-
-// getBodyJSONScalarKey builds the single-element-set fallback for a scalar body value: the leaf
-// extracted as a scalar of type dt, plus a guard restricting it to a genuinely scalar body. The
-// guard is required because JSON_VALUE returns '' for an array/object/missing value, which would
-// otherwise zero-value match (has(x,0) / has(x,false) / has(x,'') on any array). ok=false when
-// the path still traverses an array ([*]/[]).
-func getBodyJSONScalarKey(key *telemetrytypes.TelemetryFieldKey, dt telemetrytypes.FieldDataType) (expr string, guard string, ok bool) {
-	name := strings.TrimSuffix(strings.TrimSuffix(key.Name, "[*]"), "[]")
-	if strings.Contains(name, "[") {
-		return "", "", false
-	}
-	scalarKey := *key
-	scalarKey.Name = name
-	path := getBodyJSONPath(&scalarKey)
-	if dt == telemetrytypes.FieldDataTypeString {
-		expr = fmt.Sprintf("JSON_VALUE(body, '$.%s')", path)
-	} else {
-		// Nullable so a scalar of a different type (e.g. a bool/string where a number is
-		// searched) extracts to NULL rather than the type's default (0/false), which would
-		// otherwise zero-value match has(x, 0).
-		expr = fmt.Sprintf("JSONExtract(JSON_VALUE(body, '$.%s'), 'Nullable(%s)')", path, dt.CHDataType())
-	}
-	keys := strings.Split(name, ".")
-	for i, k := range keys {
-		keys[i] = "'" + k + "'"
-	}
-	guard = fmt.Sprintf("JSONType(body, %s) NOT IN ('Array', 'Object', 'Null')", strings.Join(keys, ", "))
-	return expr, guard, true
-}
-
-func bodyArrayNeedleString(v any) string {
-	switch t := v.(type) {
-	case string:
-		return t
-	case bool:
-		return strconv.FormatBool(t)
-	case float64:
-		return strconv.FormatFloat(t, 'f', -1, 64)
-	case float32:
-		return strconv.FormatFloat(float64(t), 'f', -1, 64)
-	default:
-		return fmt.Sprintf("%v", t)
-	}
-}

pkg/telemetrylogs/stmt_builder_test.go

@@ -495,8 +495,8 @@ func TestStatementBuilderListQueryResourceTests(t *testing.T) {
 				Limit: 10,
 			},
 			expected: qbtypes.Statement{
-				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE (has(JSONExtract(JSON_QUERY(body, '$.\"user_names\"[*]'), 'Array(Nullable(String))'), ?) OR ifNull((JSON_VALUE(body, '$.\"user_names\"') = ? AND JSONType(body, 'user_names') NOT IN ('Array', 'Object', 'Null')), false)) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
-				Args:  []any{"john_doe", "john_doe", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
+				Query: "SELECT timestamp, id, trace_id, span_id, trace_flags, severity_text, severity_number, scope_name, scope_version, body, attributes_string, attributes_number, attributes_bool, resources_string, scope_string FROM signoz_logs.distributed_logs_v2 WHERE has(JSONExtract(JSON_QUERY(body, '$.\"user_names\"[*]'), 'Array(String)'), ?) AND timestamp >= ? AND ts_bucket_start >= ? AND timestamp < ? AND ts_bucket_start <= ? LIMIT ?",
+				Args:  []any{"john_doe", "1747947419000000000", uint64(1747945619), "1747983448000000000", uint64(1747983448), 10},
 			},
 			expectedErr: nil,
 		},

pkg/types/authtypes/role.go

@@ -66,20 +66,15 @@ type Role struct {
 
 	types.Identifiable
 	types.TimeAuditable
-	Name              string            `bun:"name,type:string" json:"name" required:"true"`
-	Description       string            `bun:"description,type:string"  json:"description" required:"true"`
-	Type              valuer.String     `bun:"type,type:string" json:"type" required:"true"`
-	OrgID             valuer.UUID       `bun:"org_id,type:string" json:"orgId" required:"true"`
-	TransactionGroups TransactionGroups `bun:"transaction_groups,nullzero,type:text" json:"transactionGroups" required:"true" nullable:"false"`
+	Name        string        `bun:"name,type:string" json:"name" required:"true"`
+	Description string        `bun:"description,type:string"  json:"description" required:"true"`
+	Type        valuer.String `bun:"type,type:string" json:"type" required:"true"`
+	OrgID       valuer.UUID   `bun:"org_id,type:string" json:"orgId" required:"true"`
 }
 
-type GettableRole struct {
-	types.Identifiable
-	types.TimeAuditable
-	Name        string        `json:"name" required:"true"`
-	Description string        `json:"description" required:"true"`
-	Type        valuer.String `json:"type" required:"true"`
-	OrgID       valuer.UUID   `json:"orgId" required:"true"`
+type RoleWithTransactionGroups struct {
+	*Role
+	TransactionGroups TransactionGroups `json:"transactionGroups" required:"true" nullable:"false"`
 }
 
 type PostableRole struct {
@@ -93,7 +88,7 @@ type UpdatableRole struct {
 	TransactionGroups TransactionGroups `json:"transactionGroups" required:"true" nullable:"false"`
 }
 
-func NewRole(name, description string, roleType valuer.String, orgID valuer.UUID, transactionGroups TransactionGroups) *Role {
+func NewRole(name, description string, roleType valuer.String, orgID valuer.UUID) *Role {
 	return &Role{
 		Identifiable: types.Identifiable{
 			ID: valuer.GenerateUUID(),
@@ -102,37 +97,37 @@ func NewRole(name, description string, roleType valuer.String, orgID valuer.UUID
 			CreatedAt: time.Now(),
 			UpdatedAt: time.Now(),
 		},
-		Name:              name,
-		Description:       description,
-		Type:              roleType,
-		OrgID:             orgID,
+		Name:        name,
+		Description: description,
+		Type:        roleType,
+		OrgID:       orgID,
+	}
+}
+
+func NewRoleWithTransactionGroups(name, description string, roleType valuer.String, orgID valuer.UUID, transactionGroups TransactionGroups) *RoleWithTransactionGroups {
+	role := NewRole(name, description, roleType, orgID)
+
+	return &RoleWithTransactionGroups{
+		Role:              role,
 		TransactionGroups: transactionGroups,
 	}
 }
 
-func NewGettableRolesFromRoles(roles []*Role) []*GettableRole {
-	gettableRoles := make([]*GettableRole, len(roles))
-	for index, role := range roles {
-		gettableRoles[index] = &GettableRole{
-			Identifiable:  role.Identifiable,
-			TimeAuditable: role.TimeAuditable,
-			Name:          role.Name,
-			Description:   role.Description,
-			Type:          role.Type,
-			OrgID:         role.OrgID,
-		}
+func MakeRoleWithTransactionGroups(role *Role, transactionGroups TransactionGroups) *RoleWithTransactionGroups {
+	return &RoleWithTransactionGroups{
+		Role:              role,
+		TransactionGroups: transactionGroups,
 	}
-
-	return gettableRoles
 }
 
 func NewManagedRoles(orgID valuer.UUID) []*Role {
 	return []*Role{
-		NewRole(SigNozAdminRoleName, SigNozAdminRoleDescription, RoleTypeManaged, orgID, NewTransactionGroupsFromTransactions(coretypes.ManagedRoleToTransactions[SigNozAdminRoleName])),
-		NewRole(SigNozEditorRoleName, SigNozEditorRoleDescription, RoleTypeManaged, orgID, NewTransactionGroupsFromTransactions(coretypes.ManagedRoleToTransactions[SigNozEditorRoleName])),
-		NewRole(SigNozViewerRoleName, SigNozViewerRoleDescription, RoleTypeManaged, orgID, NewTransactionGroupsFromTransactions(coretypes.ManagedRoleToTransactions[SigNozViewerRoleName])),
-		NewRole(SigNozAnonymousRoleName, SigNozAnonymousRoleDescription, RoleTypeManaged, orgID, NewTransactionGroupsFromTransactions(coretypes.ManagedRoleToTransactions[SigNozAnonymousRoleName])),
+		NewRole(SigNozAdminRoleName, SigNozAdminRoleDescription, RoleTypeManaged, orgID),
+		NewRole(SigNozEditorRoleName, SigNozEditorRoleDescription, RoleTypeManaged, orgID),
+		NewRole(SigNozViewerRoleName, SigNozViewerRoleDescription, RoleTypeManaged, orgID),
+		NewRole(SigNozAnonymousRoleName, SigNozAnonymousRoleDescription, RoleTypeManaged, orgID),
 	}
+
 }
 
 func NewStatsFromRoles(roles []*Role) map[string]any {
@@ -149,7 +144,7 @@ func NewStatsFromRoles(roles []*Role) map[string]any {
 	return stats
 }
 
-func (role *Role) Update(description string, transactionGroups TransactionGroups) error {
+func (role *RoleWithTransactionGroups) Update(description string, transactionGroups TransactionGroups) error {
 	err := role.ErrIfManaged()
 	if err != nil {
 		return err

pkg/types/authtypes/transaction.go

@@ -1,7 +1,6 @@
 package authtypes
 
 import (
-	"database/sql/driver"
 	"encoding/json"
 
 	"github.com/SigNoz/signoz/pkg/errors"
@@ -71,28 +70,6 @@ func NewTransactionGroups(data []byte) (TransactionGroups, error) {
 	return groups, nil
 }
 
-func NewTransactionGroupsFromTransactions(transactions []coretypes.Transaction) TransactionGroups {
-	objectsByVerb := make(map[string][]*coretypes.Object)
-	for _, transaction := range transactions {
-		object := transaction.Object
-		objectsByVerb[transaction.Verb.StringValue()] = append(objectsByVerb[transaction.Verb.StringValue()], &object)
-	}
-
-	groups := make(TransactionGroups, 0)
-	for _, verb := range coretypes.Verbs {
-		objects := objectsByVerb[verb.StringValue()]
-		if len(objects) == 0 {
-			continue
-		}
-
-		for _, objectGroup := range coretypes.NewObjectGroupsFromObjects(objects) {
-			groups = append(groups, &TransactionGroup{Relation: Relation{Verb: verb}, ObjectGroup: *objectGroup})
-		}
-	}
-
-	return groups
-}
-
 func NewGettableTransaction(results []*TransactionWithAuthorization) []*GettableTransaction {
 	gettableTransactions := make([]*GettableTransaction, len(results))
 	for i, result := range results {
@@ -110,40 +87,6 @@ func (groups TransactionGroups) Diff(desired TransactionGroups) (additions, dele
 	return desired.subtract(groups), groups.subtract(desired)
 }
 
-func (groups TransactionGroups) Value() (driver.Value, error) {
-	data, err := json.Marshal(groups)
-	if err != nil {
-		return nil, err
-	}
-
-	return string(data), nil
-}
-
-func (groups *TransactionGroups) Scan(value any) error {
-	if value == nil {
-		*groups = make(TransactionGroups, 0)
-		return nil
-	}
-
-	var data []byte
-	switch typed := value.(type) {
-	case string:
-		data = []byte(typed)
-	case []byte:
-		data = typed
-	default:
-		return errors.Newf(errors.TypeInternal, errors.CodeInternal, "unsupported type %T for transaction groups", value)
-	}
-
-	parsed, err := NewTransactionGroups(data)
-	if err != nil {
-		return errors.Wrap(err, errors.TypeInternal, errors.CodeInternal, "failed to scan transactionGroups")
-	}
-
-	*groups = parsed
-	return nil
-}
-
 func (transaction *Transaction) UnmarshalJSON(data []byte) error {
 	var shadow = struct {
 		Relation Relation

pkg/types/authtypes/tuple.go

@@ -68,7 +68,7 @@ func NewTuplesFromTransactionGroups(name string, orgID valuer.UUID, transactionG
 	return tuples, nil
 }
 
-func MustNewTransactionGroupsFromTuples(tuples []*openfgav1.TupleKey) TransactionGroups {
+func MustNewTransactionGroupsFromTuples(tuples []*openfgav1.TupleKey) []*TransactionGroup {
 	objectsByRelation := make(map[string][]*coretypes.Object)
 
 	for _, tuple := range tuples {
@@ -81,7 +81,7 @@ func MustNewTransactionGroupsFromTuples(tuples []*openfgav1.TupleKey) Transactio
 		objectsByRelation[verb.StringValue()] = append(objectsByRelation[verb.StringValue()], object)
 	}
 
-	transactionGroups := make(TransactionGroups, 0)
+	transactionGroups := make([]*TransactionGroup, 0)
 	for _, verb := range coretypes.Verbs {
 		objects := objectsByRelation[verb.StringValue()]
 		if len(objects) == 0 {

tests/integration/tests/querierlogs/06_json_body.py

@@ -563,6 +563,214 @@ def test_logs_json_body_nested_keys(
     assert all(code == 200 for code in status_codes)
 
 
+def test_logs_json_body_array_membership(
+    signoz: types.SigNoz,
+    create_user_admin: None,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    insert_logs: Callable[[list[Logs]], None],
+) -> None:
+    """
+    Setup:
+    Insert logs with JSON bodies containing arrays
+
+    Tests:
+    1. Search by has(body.tags[*], "value") - string array
+    2. Search by has(body.ids[*], 123) - numeric array
+    3. Search by has(body.flags[*], true) - boolean array
+    """
+    now = datetime.now(tz=UTC)
+
+    log1_body = json.dumps(
+        {
+            "tags": ["production", "api", "critical"],
+            "ids": [100, 200, 300],
+            "flags": [True, False, True],
+            "users": [
+                {"name": "alice", "role": "admin"},
+                {"name": "bob", "role": "user"},
+            ],
+        }
+    )
+
+    log2_body = json.dumps(
+        {
+            "tags": ["staging", "api", "test"],
+            "ids": [200, 400, 500],
+            "flags": [False, False, True],
+            "users": [
+                {"name": "charlie", "role": "user"},
+                {"name": "david", "role": "admin"},
+            ],
+        }
+    )
+
+    log3_body = json.dumps(
+        {
+            "tags": ["production", "web", "important"],
+            "ids": [100, 600, 700],
+            "flags": [True, True, False],
+            "users": [
+                {"name": "alice", "role": "admin"},
+                {"name": "eve", "role": "user"},
+            ],
+        }
+    )
+
+    insert_logs(
+        [
+            Logs(
+                timestamp=now - timedelta(seconds=3),
+                resources={"service.name": "app-service"},
+                attributes={},
+                body=log1_body,
+                severity_text="INFO",
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=2),
+                resources={"service.name": "app-service"},
+                attributes={},
+                body=log2_body,
+                severity_text="INFO",
+            ),
+            Logs(
+                timestamp=now - timedelta(seconds=1),
+                resources={"service.name": "app-service"},
+                attributes={},
+                body=log3_body,
+                severity_text="INFO",
+            ),
+        ]
+    )
+
+    token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # Test 1: Search by has(body.tags[*], "production")
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": int((now - timedelta(seconds=10)).timestamp() * 1000),
+            "end": int(now.timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "disabled": False,
+                            "limit": 100,
+                            "offset": 0,
+                            "filter": {"expression": 'has(body.tags[*], "production")'},
+                            "order": [
+                                {"key": {"name": "timestamp"}, "direction": "desc"},
+                            ],
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+    rows = results[0]["rows"]
+    assert len(rows) == 2  # log1 and log3 have "production" in tags
+    tags_list = [json.loads(row["data"]["body"])["tags"] for row in rows]
+    assert all("production" in tags for tags in tags_list)
+
+    # Test 2: Search by has(body.ids[*], 200)
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": int((now - timedelta(seconds=10)).timestamp() * 1000),
+            "end": int(now.timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "disabled": False,
+                            "limit": 100,
+                            "offset": 0,
+                            "filter": {"expression": "has(body.ids[*], 200)"},
+                            "order": [
+                                {"key": {"name": "timestamp"}, "direction": "desc"},
+                            ],
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+    rows = results[0]["rows"]
+    assert len(rows) == 2  # log1 and log2 have 200 in ids
+    ids_list = [json.loads(row["data"]["body"])["ids"] for row in rows]
+    assert all(200 in ids for ids in ids_list)
+
+    # Test 3: Search by has(body.flags[*], true)
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v5/query_range"),
+        timeout=2,
+        headers={"authorization": f"Bearer {token}"},
+        json={
+            "schemaVersion": "v1",
+            "start": int((now - timedelta(seconds=10)).timestamp() * 1000),
+            "end": int(now.timestamp() * 1000),
+            "requestType": "raw",
+            "compositeQuery": {
+                "queries": [
+                    {
+                        "type": "builder_query",
+                        "spec": {
+                            "name": "A",
+                            "signal": "logs",
+                            "disabled": False,
+                            "limit": 100,
+                            "offset": 0,
+                            "filter": {"expression": "has(body.flags[*], true)"},
+                            "order": [
+                                {"key": {"name": "timestamp"}, "direction": "desc"},
+                            ],
+                            "aggregations": [{"expression": "count()"}],
+                        },
+                    }
+                ]
+            },
+            "formatOptions": {"formatTableResultForUI": False, "fillGaps": False},
+        },
+    )
+
+    assert response.status_code == HTTPStatus.OK
+    assert response.json()["status"] == "success"
+    results = response.json()["data"]["data"]["results"]
+    assert len(results) == 1
+    rows = results[0]["rows"]
+    assert len(rows) == 3  # All logs have true in flags
+    flags_list = [json.loads(row["data"]["body"])["flags"] for row in rows]
+    assert all(True in flags for flags in flags_list)
+
+
 def test_logs_json_body_listing(
     signoz: types.SigNoz,
     create_user_admin: None,  # pylint: disable=unused-argument