Vikrant Gupta bb47550c01 feat(authz): enable FGA for auth domains (#12588) ...

#### Description

- Auth domain routes (`/api/v2/auth_domains`) now use `CheckResources` +
`ResourceDef` instead of the coarse `AdminAccess` gate — per-resource
FGA checks on enterprise, admin role gate on community.
- Create and update also check `attach` on the roles the request's
`roleMapping` will grant at SSO login (mapped roles + default role,
`signoz-viewer` when unset, `role:*` when `useRoleAttribute` is on);
update additionally checks `detach` on the roles the stored mapping was
granting, since a `PUT` replaces the mapping.
- Migration `117_add_auth_domain_tuples` backfills the admin
`auth-domain` tuples for existing organizations and re-syncs the stored
managed-role transaction groups; new organizations get both from the
registry at bootstrap.
- Regenerated OpenAPI spec: the auth-domain operations advertise
`auth-domain:*` and `role:attach`/`role:detach` scopes instead of
`ADMIN`.
- Added `callbackauthn/05_authz.py` covering managed-role gating,
custom-role wildcard/instance grants, and the role-mapping attach/detach
checks.

#### Issues closed by this PR

Closes SigNoz/platform-pod#2649

2026-08-19 19:16:14 +00:00

..

086_migrate_ci_dashboards

refactor: cloud integration dashboards migration to DB (#11382)

2026-05-23 03:05:06 +00:00

088_migrate_ii_dashboards

feat: installed integration dashboards migration to DB (#11415)

2026-05-26 05:42:34 +00:00

116_migrate_lambda_dashboards/aws/lambda

refactor: adding FunctionName variable in Lambda dashboard (#12599)

2026-08-18 19:39:25 +00:00

sqlmigrationtest

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

000_add_data_migrations.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

001_add_organization.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

002_add_preferences.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

003_add_dashboards.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

004_add_saved_views.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

005_add_agents.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

006_add_pipelines.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

007_add_integrations.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

008_add_licenses.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

009_add_pats.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

011_modify_datetime.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

012_modify_org_domain.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

013_update_organization.go

chore: enable forbidigo and noerrors in depguard (#9047)

2025-09-09 15:44:27 +05:30

014_add_alertmanager.go

chore(alertmanager): support custom receiver configs (#11473)

2026-06-06 17:34:35 +00:00

015_update_dashboards_savedviews.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

016_pat_org_domains.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

017_update_pipelines.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

018_drop_licenses_sites.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

019_update_invites.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

020_pat_update.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

021_update_alertmanager.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

022_update_preferences.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

023_update_apdex_ttl.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

024_update_reset_password.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

025_add_virtual_fields.go

chore: add virtual fields table (#7586)

2025-04-11 07:36:31 +05:30

026_update_integrations.go

chore(linter): add more linters and deprecate zap (#8034)

2025-05-25 11:40:39 +05:30

027_update_rules.go

refactor(planned-maintenance): remove time bounds from recurrence (#11500)

2026-06-12 20:48:08 +00:00

028_update_organizations.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

029_drop_groups.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

030_create_quick_filters.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

031_update_quick_filters.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

032_auth_refactor.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

033_api_keys.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

034_update_license.go

feat(license): build license service (#7969)

2025-05-24 19:14:29 +05:30

035_update_api_monitoring_filters.go

fix: updated the service name in exceptions filter (#8069)

2025-05-27 17:42:08 +00:00

036_add_key_organization.go

feat(sharder): add simple and noop sharder (#8107)

2025-05-31 16:04:13 +05:30

037_add_trace_funnels.go

refactor: split typeable infrastructure into pkg/types/coretypes (#11105)

2026-05-05 19:13:09 +05:30

038_update_dashboard.go

chore(dashboard): make dashboard schema production ready (#8092)

2025-06-02 22:41:38 +05:30

039_drop_feature_set.go

chore(feature): drop the feature status table (#8124)

2025-06-03 17:05:42 +05:30

040_drop_deprecated_tables.go

chore(sqlmigration): drop the rule history and data migrations table (#8181)

2025-06-09 15:46:22 +05:30

041_update_agents.go

fix: delete existing agents in migration (#8289)

2025-06-18 18:06:36 +05:30

042_update_users.go

feat(sqlschema): add sqlschema (#8384)

2025-07-08 00:21:26 +05:30

043_update_user_invite.go

feat(sqlschema): add sqlschema (#8384)

2025-07-08 00:21:26 +05:30

044_update_org_domain.go

feat(sqlschema): add sqlschema (#8384)

2025-07-08 00:21:26 +05:30

045_add_factor_indexes.go

feat(sqlschema): add sqlschema (#8384)

2025-07-08 00:21:26 +05:30

046_update_dashboard_alert_and_saved_view_v5.go

feat(instrumentation): add OTel exception semantic convention log handler (#10665)

2026-03-22 04:06:31 +00:00

047_add_meter_quickfilters.go

feat(telemetrymeter): add support for telemetry meter (#8667)

2025-08-07 16:50:37 +05:30

048_update_ttl_setting.go

feat: added custom retention for logs api (#8513)

2025-09-01 07:30:57 +00:00

049_add_route_policy.go

refactor: split typeable infrastructure into pkg/types/coretypes (#11105)

2026-05-05 19:13:09 +05:30

050_add_auth_token.go

feat(tokenizer|sso): add tokenizer for session management and oidc sso support (#9183)

2025-10-16 18:00:38 +05:30

051_add_authz.go

feat(authz): openfga sql migration (#9580)

2025-11-14 00:43:02 +05:30

052_add_public_dashboards.go

feat(authz): publicly shareable dashboards (#9584)

2025-11-18 00:21:46 +05:30

053_add_role.go

fix(authz): sqlmigration for postgres (#9616)

2025-11-19 23:50:39 +05:30

054_update_authz.go

fix(authz): sqlmigration for postgres (#9616)

2025-11-19 23:50:39 +05:30

055_update_user_preference.go

fix(preference): rename columns for preference tables (#9912)

2026-01-02 16:44:20 +05:30

056_update_org_preference.go

fix(preference): rename columns for preference tables (#9912)

2026-01-02 16:44:20 +05:30

057_rename_org_domains.go

feat: rename org_domains table to auth_domain (#9910)

2026-01-03 16:40:06 +05:30

058_add_reset_password_token_expiry.go

feat: forgot password api and token expiry (#10073)

2026-01-27 15:31:15 +05:30

059_add_managed_roles.go

feat(authz): store role transaction groups as JSON document (#12028)

2026-07-13 11:42:42 +00:00

060_add_authz_index.go

feat(authz): migrate rbac to authz (#10134)

2026-02-03 19:54:07 +05:30

061_migrate_rbac_to_authz.go

refactor: split typeable infrastructure into pkg/types/coretypes (#11105)

2026-05-05 19:13:09 +05:30

062_migrate_public_dashboards.go

feat(authz): migrate rbac to authz (#10134)

2026-02-03 19:54:07 +05:30

063_add_public_dashboard_txn.go

refactor: merge roletypes into authtypes (#10614)

2026-03-17 15:43:58 +00:00

064_add_root_user.go

feat: add root user support (#10313)

2026-02-17 15:26:56 +05:30

065_add_user_email_org_id_index.go

feat: improve root user provisioning and restore users unique index (#10327)

2026-02-17 17:53:13 +05:30

066_migrate_rules_v4_to_v5_post_deprecation.go

feat(instrumentation): add OTel exception semantic convention log handler (#10665)

2026-03-22 04:06:31 +00:00

067_add_status_user.go

feat: deprecate user invite table and add user status lifecycle (#10445)

2026-03-09 18:16:04 +00:00

068_deprecate_user_invite.go

feat: deprecate user invite table and add user status lifecycle (#10445)

2026-03-09 18:16:04 +00:00

069_update_cloud_integration_index.go

chore(lint): enable godot and staticcheck (#10775)

2026-03-31 09:11:49 +00:00

070_update_planned_maintenance_rule.go

refactor: split typeable infrastructure into pkg/types/coretypes (#11105)

2026-05-05 19:13:09 +05:30

071_add_user_role.go

feat: introduce user_role table (#10664)

2026-03-23 13:36:20 +00:00

072_drop_user_role_column.go

feat: introduce user_role table (#10664)

2026-03-23 13:36:20 +00:00

073_add_service_account.go

feat(serviceaccount): integrate service account (#10681)

2026-04-01 07:20:59 +00:00

074_deprecate_api_key.go

feat(serviceaccount): integrate service account (#10681)

2026-04-01 07:20:59 +00:00

075_service_account_authz.go

feat(serviceaccount): integrate service account (#10681)

2026-04-01 07:20:59 +00:00

076_drop_user_deleted_at.go

chore(user): add partial index for email,org_id (#10828)

2026-04-03 20:27:04 +00:00

077_migrate_aws_all_regions.go

feat: adding missing AWS regions (#11039)

2026-04-21 19:28:01 +00:00

078_add_sa_managed_role_txn.go

feat(authz): add resource-level FGA for service accounts (#11065)

2026-05-08 20:33:02 +00:00

079_add_llm_pricing_rules.go

feat(llmpricing): implement store and module and integrate with opamp (#11089)

2026-05-12 07:51:02 +00:00

080_add_span_mapper.go

feat: module and store for span mapper (#11127)

2026-05-12 11:14:21 +00:00

081_migrate_metaresources_tuples.go

feat(authz): introduce detach relationship (#11298)

2026-05-14 11:06:17 +00:00

082_add_tags.go

feat: new module for tags (#11254)

2026-05-14 13:38:42 +00:00

083_add_role_crud_tuples.go

fix(authz): add role CRUD permissions (#11315)

2026-05-15 12:53:48 +00:00

084_add_integration_dashboard.go

feat(sqlmigration): add integration_dashboard table (#11343)

2026-05-19 15:24:27 +00:00

085_add_source_to_dashboard.go

chore: create source field in dashboards (#11367)

2026-05-20 12:37:25 +00:00

086_migrate_ci_dashboards.go

refactor: cloud integration dashboards migration to DB (#11382)

2026-05-23 03:05:06 +00:00

087_add_scope_to_planned_maintenance.go

feat(planned-downtime): scope maintenance windows to label expressions (#11186)

2026-05-25 13:40:06 +00:00

088_migrate_ii_dashboards.go

feat: installed integration dashboards migration to DB (#11415)

2026-05-26 05:42:34 +00:00

089_add_dashboard_name.go

chore: add name column in dashboards table for v2 dashboards (#11456)

2026-05-26 14:46:44 +00:00

090_fix_changelog_operation_type.go

feat(authz): upgrade OpenFGA from v1.11.2 to v1.14.1 (#11475)

2026-05-27 10:23:39 +00:00

091_ci_remove_cascade_delete.go

chore: remove cloud integration service cascade delete constraint (#11480)

2026-05-29 11:21:05 +00:00

092_add_user_dashboard_preference.go

feat: v2 list, delete, pin, unpin dashboards api (#11219)

2026-06-10 17:34:46 +00:00

093_recreate_user_dashboard_preference.go

fix: proper definition of user dashboard preferences (#11643)

2026-06-11 12:50:32 +00:00

094_migrate_recurrence_bounds.go

refactor(planned-maintenance): remove time bounds from recurrence (#11500)

2026-06-12 20:48:08 +00:00

095_add_dashboard_view.go

feat: introduce dashboard views for list dashboards page (#11465)

2026-06-17 08:33:07 +00:00

096_migrate_sso_role_mapping_names.go

feat(authdomain): support custom roles in SSO group mapping (#11858)

2026-06-26 14:26:43 +00:00

097_add_metric_reduction_rules.go

feat(metrics): add per-metric label-reduction rules (#11849)

2026-06-26 17:16:04 +00:00

098_remove_organization_tuples.go

fix(authz): drop the organization grant tuples (#11922)

2026-07-01 09:26:53 +00:00

099_add_role_transaction_groups.go

feat(authz): store role transaction groups as JSON document (#12028)

2026-07-13 11:42:42 +00:00

100_add_tag_unique_index.go

chore: add functional unique index for tags (#12029)

2026-07-14 11:08:59 +00:00

101_add_telemetry_tuples.go

fix(authz): changelog column type for postgres metastore (#12299)

2026-07-27 15:52:06 +00:00

102_add_tag_relation_rank.go

fix: add rank column to tag relations to keep note of tag ordering in dashboards (#12170)

2026-07-22 11:34:25 +00:00

103_migrate_dashboards_v1_to_v2.go

chore: add sql migration for dashboards (#12249)

2026-07-26 17:57:39 +00:00

104_fill_dashboard_meter_source.go

fix: add meter source where needed during dashboard migration (#12322)

2026-07-29 10:39:41 +00:00

105_update_role_transaction_groups.go

feat(authz): add frontend support for telemetry resources (#12292)

2026-07-30 07:18:31 +00:00

106_fill_dashboard_spec_collections.go

fix: enforce the required tag on dashboard spec fields (#12381)

2026-08-03 18:22:43 +00:00

107_scrub_email_channel_transport.go

fix(alertmanager): resolve email SMTP settings from env (#12281)

2026-08-04 08:53:34 +00:00

108_add_dashboard_tuples.go

feat: enable FGA for dashboards and their public config (#12408)

2026-08-06 07:19:21 +00:00

109_restructure_saved_view_spec.go

fix(sqlmigration): skip saved views with dangling org_id in migration 109 (#12469)

2026-08-08 07:03:40 +00:00

110_add_saved_view_tuples.go

refactor(savedview): restructure api and storage to spec based (#12342)

2026-08-07 13:37:56 +00:00

111_fix_saved_view_selected_fields.go

fix(savedview): handle old invalid data in specs (#12477)

2026-08-11 11:01:00 +00:00

112_backfill_saved_view_request_type.go

fix(savedview): handle old invalid data in specs (#12477)

2026-08-11 11:01:00 +00:00

113_restructure_auth_domain_config.go

fix(authtypes): restructure auth domain payload into a kind/spec envelope (#12472)

2026-08-13 16:39:27 +00:00

114_fix_saved_view_select_fields.go

fix(saved-views): recover legacy-shaped selectedFields entries (#12549)

2026-08-14 14:24:40 +00:00

115_delete_orphan_user_roles.go

fix(user): clear role assignments when a user is deleted (#12554)

2026-08-17 19:11:43 +00:00

116_migrate_lambda_dashboards.go

refactor: adding FunctionName variable in Lambda dashboard (#12599)

2026-08-18 19:39:25 +00:00

117_add_auth_domain_tuples.go

feat(authz): enable FGA for auth domains (#12588)

2026-08-19 19:16:14 +00:00

config.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

sqlmigration.go

chore: enable forbidigo and noerrors in depguard (#9047)

2025-09-09 15:44:27 +05:30