Nikhil Mantri 0a78925ee7 feat(authz): route policy FGA (#13249) ...

#### Description

- Move `/api/v1/route_policies` routes from role gates to
`CheckResources` with resource defs, same shape as dashboards (#12408).
- Create and update check `notification-channel:attach` on the channels
the policy names. Update diffs against the stored policy: attach for
added, detach for removed.
- Channel names resolve to ids through a new alertmanager method,
`GetChannelIDsByNames`. Route policy create and update call it too, so
an unknown channel name is rejected by the module like
`validateChannels` does for rules. Before this a policy naming a missing
channel was stored and failed silently at notify time.
- `notification-channel` drops its explicit verb list so attach and
detach come from the metaresource default.
- Migration 140 backfills route-policy tuples plus channel attach and
detach for admin and editor, and resyncs transaction groups like 137.
- Integration tests cover viewer, editor, admin, and a custom role
without channel attach or detach.

#### Issues closed by this PR

Closes SigNoz/pulse-pod#288
Part of SigNoz/pulse-pod#355

#### Additional Information

First of five stacked PRs splitting #12927: route policies, downtime
schedules, rule views, rule state history, rules.

2026-10-29 12:45:31 +00:00

..

086_migrate_ci_dashboards

refactor: cloud integration dashboards migration to DB (#11382)

2026-05-23 03:05:06 +00:00

088_migrate_ii_dashboards

feat: installed integration dashboards migration to DB (#11415)

2026-05-26 05:42:34 +00:00

116_migrate_lambda_dashboards/aws/lambda

refactor: adding FunctionName variable in Lambda dashboard (#12599)

2026-08-18 19:39:25 +00:00

sqlmigrationtest

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

000_add_data_migrations.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

001_add_organization.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

002_add_preferences.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

003_add_dashboards.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

004_add_saved_views.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

005_add_agents.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

006_add_pipelines.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

007_add_integrations.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

008_add_licenses.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

009_add_pats.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

011_modify_datetime.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

012_modify_org_domain.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

013_update_organization.go

chore: enable forbidigo and noerrors in depguard (#9047)

2025-09-09 15:44:27 +05:30

014_add_alertmanager.go

chore: add internal name to data layer of notification channels (#12754)

2026-09-03 06:52:58 +00:00

015_update_dashboards_savedviews.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

016_pat_org_domains.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

017_update_pipelines.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

018_drop_licenses_sites.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

019_update_invites.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

020_pat_update.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

021_update_alertmanager.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

022_update_preferences.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

023_update_apdex_ttl.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

024_update_reset_password.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

025_add_virtual_fields.go

chore: add virtual fields table (#7586)

2025-04-11 07:36:31 +05:30

026_update_integrations.go

chore(linter): add more linters and deprecate zap (#8034)

2025-05-25 11:40:39 +05:30

027_update_rules.go

refactor(planned-maintenance): remove time bounds from recurrence (#11500)

2026-06-12 20:48:08 +00:00

028_update_organizations.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

029_drop_groups.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

030_create_quick_filters.go

fix: quick filters old migration cleanup (#12746)

2026-09-01 13:54:36 +00:00

031_update_quick_filters.go

fix: quick filters old migration cleanup (#12746)

2026-09-01 13:54:36 +00:00

032_auth_refactor.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

033_api_keys.go

chore(go-lint): enable go-lint (#8022)

2025-05-23 15:52:58 +05:30

034_update_license.go

feat(license): build license service (#7969)

2025-05-24 19:14:29 +05:30

035_update_api_monitoring_filters.go

fix: quick filters old migration cleanup (#12746)

2026-09-01 13:54:36 +00:00

036_add_key_organization.go

feat(sharder): add simple and noop sharder (#8107)

2025-05-31 16:04:13 +05:30

037_add_trace_funnels.go

refactor: split typeable infrastructure into pkg/types/coretypes (#11105)

2026-05-05 19:13:09 +05:30

038_update_dashboard.go

chore(dashboard): make dashboard schema production ready (#8092)

2025-06-02 22:41:38 +05:30

039_drop_feature_set.go

chore(feature): drop the feature status table (#8124)

2025-06-03 17:05:42 +05:30

040_drop_deprecated_tables.go

chore(sqlmigration): drop the rule history and data migrations table (#8181)

2025-06-09 15:46:22 +05:30

041_update_agents.go

fix: delete existing agents in migration (#8289)

2025-06-18 18:06:36 +05:30

042_update_users.go

feat(sqlschema): add sqlschema (#8384)

2025-07-08 00:21:26 +05:30

043_update_user_invite.go

feat(sqlschema): add sqlschema (#8384)

2025-07-08 00:21:26 +05:30

044_update_org_domain.go

feat(sqlschema): add sqlschema (#8384)

2025-07-08 00:21:26 +05:30

045_add_factor_indexes.go

feat(sqlschema): add sqlschema (#8384)

2025-07-08 00:21:26 +05:30

046_update_dashboard_alert_and_saved_view_v5.go

feat(instrumentation): add OTel exception semantic convention log handler (#10665)

2026-03-22 04:06:31 +00:00

047_add_meter_quickfilters.go

feat(telemetrymeter): add support for telemetry meter (#8667)

2025-08-07 16:50:37 +05:30

048_update_ttl_setting.go

feat: added custom retention for logs api (#8513)

2025-09-01 07:30:57 +00:00

049_add_route_policy.go

fix: remove rules types package import from migration #049 (#12998)

2026-09-28 11:39:07 +00:00

050_add_auth_token.go

feat(tokenizer|sso): add tokenizer for session management and oidc sso support (#9183)

2025-10-16 18:00:38 +05:30

051_add_authz.go

feat(authz): openfga sql migration (#9580)

2025-11-14 00:43:02 +05:30

052_add_public_dashboards.go

feat(authz): publicly shareable dashboards (#9584)

2025-11-18 00:21:46 +05:30

053_add_role.go

fix(authz): sqlmigration for postgres (#9616)

2025-11-19 23:50:39 +05:30

054_update_authz.go

fix(authz): sqlmigration for postgres (#9616)

2025-11-19 23:50:39 +05:30

055_update_user_preference.go

fix(preference): rename columns for preference tables (#9912)

2026-01-02 16:44:20 +05:30

056_update_org_preference.go

fix(preference): rename columns for preference tables (#9912)

2026-01-02 16:44:20 +05:30

057_rename_org_domains.go

feat: rename org_domains table to auth_domain (#9910)

2026-01-03 16:40:06 +05:30

058_add_reset_password_token_expiry.go

feat: forgot password api and token expiry (#10073)

2026-01-27 15:31:15 +05:30

059_add_managed_roles.go

feat(authz): store role transaction groups as JSON document (#12028)

2026-07-13 11:42:42 +00:00

060_add_authz_index.go

feat(authz): migrate rbac to authz (#10134)

2026-02-03 19:54:07 +05:30

061_migrate_rbac_to_authz.go

refactor: split typeable infrastructure into pkg/types/coretypes (#11105)

2026-05-05 19:13:09 +05:30

062_migrate_public_dashboards.go

feat(authz): migrate rbac to authz (#10134)

2026-02-03 19:54:07 +05:30

063_add_public_dashboard_txn.go

refactor: merge roletypes into authtypes (#10614)

2026-03-17 15:43:58 +00:00

064_add_root_user.go

feat: add root user support (#10313)

2026-02-17 15:26:56 +05:30

065_add_user_email_org_id_index.go

feat: improve root user provisioning and restore users unique index (#10327)

2026-02-17 17:53:13 +05:30

066_migrate_rules_v4_to_v5_post_deprecation.go

feat(instrumentation): add OTel exception semantic convention log handler (#10665)

2026-03-22 04:06:31 +00:00

067_add_status_user.go

feat: deprecate user invite table and add user status lifecycle (#10445)

2026-03-09 18:16:04 +00:00

068_deprecate_user_invite.go

feat: deprecate user invite table and add user status lifecycle (#10445)

2026-03-09 18:16:04 +00:00

069_update_cloud_integration_index.go

chore(lint): enable godot and staticcheck (#10775)

2026-03-31 09:11:49 +00:00

070_update_planned_maintenance_rule.go

refactor: split typeable infrastructure into pkg/types/coretypes (#11105)

2026-05-05 19:13:09 +05:30

071_add_user_role.go

feat: introduce user_role table (#10664)

2026-03-23 13:36:20 +00:00

072_drop_user_role_column.go

feat: introduce user_role table (#10664)

2026-03-23 13:36:20 +00:00

073_add_service_account.go

feat(serviceaccount): integrate service account (#10681)

2026-04-01 07:20:59 +00:00

074_deprecate_api_key.go

feat(serviceaccount): integrate service account (#10681)

2026-04-01 07:20:59 +00:00

075_service_account_authz.go

feat(serviceaccount): integrate service account (#10681)

2026-04-01 07:20:59 +00:00

076_drop_user_deleted_at.go

chore(user): add partial index for email,org_id (#10828)

2026-04-03 20:27:04 +00:00

077_migrate_aws_all_regions.go

feat: adding missing AWS regions (#11039)

2026-04-21 19:28:01 +00:00

078_add_sa_managed_role_txn.go

feat(authz): add resource-level FGA for service accounts (#11065)

2026-05-08 20:33:02 +00:00

079_add_llm_pricing_rules.go

feat(llmpricing): implement store and module and integrate with opamp (#11089)

2026-05-12 07:51:02 +00:00

080_add_span_mapper.go

feat: module and store for span mapper (#11127)

2026-05-12 11:14:21 +00:00

081_migrate_metaresources_tuples.go

feat(authz): introduce detach relationship (#11298)

2026-05-14 11:06:17 +00:00

082_add_tags.go

feat: new module for tags (#11254)

2026-05-14 13:38:42 +00:00

083_add_role_crud_tuples.go

fix(authz): add role CRUD permissions (#11315)

2026-05-15 12:53:48 +00:00

084_add_integration_dashboard.go

feat(sqlmigration): add integration_dashboard table (#11343)

2026-05-19 15:24:27 +00:00

085_add_source_to_dashboard.go

chore: create source field in dashboards (#11367)

2026-05-20 12:37:25 +00:00

086_migrate_ci_dashboards.go

refactor: cloud integration dashboards migration to DB (#11382)

2026-05-23 03:05:06 +00:00

087_add_scope_to_planned_maintenance.go

feat(planned-downtime): scope maintenance windows to label expressions (#11186)

2026-05-25 13:40:06 +00:00

088_migrate_ii_dashboards.go

feat: installed integration dashboards migration to DB (#11415)

2026-05-26 05:42:34 +00:00

089_add_dashboard_name.go

chore: add name column in dashboards table for v2 dashboards (#11456)

2026-05-26 14:46:44 +00:00

090_fix_changelog_operation_type.go

feat(authz): upgrade OpenFGA from v1.11.2 to v1.14.1 (#11475)

2026-05-27 10:23:39 +00:00

091_ci_remove_cascade_delete.go

chore: remove cloud integration service cascade delete constraint (#11480)

2026-05-29 11:21:05 +00:00

092_add_user_dashboard_preference.go

feat: v2 list, delete, pin, unpin dashboards api (#11219)

2026-06-10 17:34:46 +00:00

093_recreate_user_dashboard_preference.go

fix: proper definition of user dashboard preferences (#11643)

2026-06-11 12:50:32 +00:00

094_migrate_recurrence_bounds.go

refactor(planned-maintenance): remove time bounds from recurrence (#11500)

2026-06-12 20:48:08 +00:00

095_add_dashboard_view.go

feat: introduce dashboard views for list dashboards page (#11465)

2026-06-17 08:33:07 +00:00

096_migrate_sso_role_mapping_names.go

feat(authdomain): support custom roles in SSO group mapping (#11858)

2026-06-26 14:26:43 +00:00

097_add_metric_reduction_rules.go

feat(metrics): add per-metric label-reduction rules (#11849)

2026-06-26 17:16:04 +00:00

098_remove_organization_tuples.go

fix(authz): drop the organization grant tuples (#11922)

2026-07-01 09:26:53 +00:00

099_add_role_transaction_groups.go

feat(authz): store role transaction groups as JSON document (#12028)

2026-07-13 11:42:42 +00:00

100_add_tag_unique_index.go

chore: add functional unique index for tags (#12029)

2026-07-14 11:08:59 +00:00

101_add_telemetry_tuples.go

fix(authz): changelog column type for postgres metastore (#12299)

2026-07-27 15:52:06 +00:00

102_add_tag_relation_rank.go

fix: add rank column to tag relations to keep note of tag ordering in dashboards (#12170)

2026-07-22 11:34:25 +00:00

103_migrate_dashboards_v1_to_v2.go

chore: add sql migration for dashboards (#12249)

2026-07-26 17:57:39 +00:00

104_fill_dashboard_meter_source.go

fix: add meter source where needed during dashboard migration (#12322)

2026-07-29 10:39:41 +00:00

105_update_role_transaction_groups.go

feat(authz): add frontend support for telemetry resources (#12292)

2026-07-30 07:18:31 +00:00

106_fill_dashboard_spec_collections.go

fix: enforce the required tag on dashboard spec fields (#12381)

2026-08-03 18:22:43 +00:00

107_scrub_email_channel_transport.go

fix(alertmanager): resolve email SMTP settings from env (#12281)

2026-08-04 08:53:34 +00:00

108_add_dashboard_tuples.go

feat: enable FGA for dashboards and their public config (#12408)

2026-08-06 07:19:21 +00:00

109_restructure_saved_view_spec.go

fix(sqlmigration): skip saved views with dangling org_id in migration 109 (#12469)

2026-08-08 07:03:40 +00:00

110_add_saved_view_tuples.go

refactor(savedview): restructure api and storage to spec based (#12342)

2026-08-07 13:37:56 +00:00

111_fix_saved_view_selected_fields.go

fix(savedview): handle old invalid data in specs (#12477)

2026-08-11 11:01:00 +00:00

112_backfill_saved_view_request_type.go

fix(savedview): handle old invalid data in specs (#12477)

2026-08-11 11:01:00 +00:00

113_restructure_auth_domain_config.go

fix(authtypes): restructure auth domain payload into a kind/spec envelope (#12472)

2026-08-13 16:39:27 +00:00

114_fix_saved_view_select_fields.go

fix(saved-views): recover legacy-shaped selectedFields entries (#12549)

2026-08-14 14:24:40 +00:00

115_delete_orphan_user_roles.go

fix(user): clear role assignments when a user is deleted (#12554)

2026-08-17 19:11:43 +00:00

116_migrate_lambda_dashboards.go

refactor: adding FunctionName variable in Lambda dashboard (#12599)

2026-08-18 19:39:25 +00:00

117_add_auth_domain_tuples.go

feat(authz): enable FGA for auth domains (#12588)

2026-08-19 19:16:14 +00:00

118_add_deployment_host_tuples.go

feat(authz): enable FGA for deployment hosts (#12699)

2026-08-27 13:22:27 +00:00

119_add_system_dashboard.go

feat: system dashboards (#12620)

2026-09-01 10:17:10 +00:00

120_add_license_tuples.go

feat(licensing): add v4 license endpoints with resource authz (#12731)

2026-09-02 18:49:35 +00:00

121_add_channel_display_name.go

chore: add internal name to data layer of notification channels (#12754)

2026-09-03 06:52:58 +00:00

122_migrate_quick_filters.go

fix: add quick filters v2 api to support TelemetryFieldKey (#12698)

2026-09-03 07:49:31 +00:00

123_add_quick_filter_tuples.go

fix: add quick filters v2 api to support TelemetryFieldKey (#12698)

2026-09-03 07:49:31 +00:00

124_add_ingestion_tuples.go

feat(authz): enable FGA for ingestion keys and limits (#12626)

2026-09-03 09:34:15 +00:00

125_add_subscription_tuples.go

feat(subscription): add subscription endpoints with resource authz (#12767)

2026-09-04 10:15:17 +00:00

126_normalize_quick_filter_fields.go

feat(telemetrymetadata): fields keys and values for the quick filters migration (#12794)

2026-09-08 22:11:27 +00:00

127_add_span_mapper_origin.go

feat: support for default attribute mapping (#12809)

2026-09-19 11:22:46 +00:00

128_add_cloud_integration_tuples.go

feat(authz): enable FGA for cloud integration (#12895)

2026-09-21 14:20:11 +00:00

129_add_notification_channel_tuples.go

fix: backfill notification channel tuples (#12960)

2026-09-23 09:48:11 +00:00

130_add_ai_observability_quick_filters.go

fix: add ai-o11y quick filter migration (#12964)

2026-09-23 11:15:42 +00:00

131_add_channel_config.go

chore: store v2 config for notification channels in db (#12984)

2026-09-30 11:30:33 +00:00

132_add_user_tuples.go

feat(authz): enable FGA for users and reset password tokens (#13020)

2026-10-01 11:26:18 +00:00

133_add_rule_view.go

feat(ruler): add saved views CRUD APIs for the alerts list page (#12814)

2026-10-06 09:35:15 +00:00

134_add_field_tuples.go

feat(promote): authorize promoted paths per signal (#13029)

2026-10-12 05:48:03 +00:00

135_keep_relevant_llm_pricing_rules.go

chore: delete unwanted models from pricing db (#13079)

2026-10-13 12:13:17 +00:00

136_backfill_telegram_channel_spec.go

feat(alerts): Support telegram channel for alerts (#13074)

2026-10-20 11:00:20 +00:00

137_add_metrics_field_tuples.go

feat(authz): enable FGA for metrics explorer routes (#13150)

2026-10-21 11:40:56 +00:00

138_add_gcp_connection_method.go

feat: adding gcp cloud integration agent mode changes (#13103)

2026-10-26 09:39:25 +00:00

139_delete_orphan_sa_roles.go

fix(serviceaccount): delete role mappings when a service account is deleted (#13266)

2026-10-26 16:36:54 +00:00

140_add_route_policy_tuples.go

feat(authz): route policy FGA (#13249)

2026-10-29 12:45:31 +00:00

config.go

fix: publish signoz as package (#7378)

2025-03-20 15:31:41 +00:00

sqlmigration.go

chore: enable forbidigo and noerrors in depguard (#9047)

2025-09-09 15:44:27 +05:30