[Makisuo]

What

POST /v2/alerts/rules/preview and POST /v2/alerts/rules/test run the rule's query and return the values it measured. Scoped API keys now also need read access to the telemetry that query reads:

Signal	Extra scopes
error_rate, p95_latency, p99_latency, apdex, throughput	traces:read
builder_query	the draft's source (traces:read, logs:read or metrics:read); any other source needs all three
raw_query	traces:read, logs:read and metrics:read
anomaly	none

Without them the request is refused with 403 before any query runs. Unscoped keys, OAuth tokens and dashboard sessions are unaffected. The raw SQL preview still also requires alerts:write.

The endpoint descriptions (and the generated iOS OpenAPI spec) document the new requirement.

Compatibility

A scoped key with only alerts:* scopes that calls preview or test now gets a 403. Adding the telemetry read scopes restores it.

Not in this PR

Creating or updating a rule with alerts:write and then reading its check history still returns observed values. Gating rule creation on telemetry scopes would break alerts-only keys used for config-as-code, so that is left for a separate decision.

Tests

• apps/api/src/routes/v2/alerts.http.test.ts: an alerts-only key is refused a structured preview without touching the warehouse; a raw SQL preview missing one family is refused; existing raw SQL preview tests now use keys that hold the telemetry scopes.

🤖 Generated with Claude Code

---

^{Open in [code]smith · Need help on this PR? Tag @codesmith-bot with what you need.}

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 10 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 16636703-07a6-4065-b43f-e2a11799c315

Commits

Reviewing files that changed from the base of the PR and between ba51637 and 4ca4b35.

Files selected for processing: 6

• apps/api/src/routes/v2/alert-rule-read-families.test.ts
• apps/api/src/routes/v2/alert-rule-read-families.ts
• apps/api/src/routes/v2/alert-rules.http.ts
• apps/api/src/routes/v2/alerts.http.test.ts
• apps/ios/Packages/MapleAPI/Sources/MapleAPI/openapi.json
• packages/domain/src/http/v2/alert-rules.ts

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[maple-review-bot]

1 inline note from Maple's review. The score and summary are in the review comment above.

[Makisuo]

Fixed F2 and F3 in 4ca4b35: uptime and SLO rules now need no telemetry scopes (they are refused before any query runs), and /v2/alerts/rules/test has its own HTTP refusal test (403, no warehouse call; with logs:read the same request gets past the gate).

[maple-review-bot]

Maple review

🟢 Confidence 10/10 · safe to merge. A scope tightening whose mapping is unit-tested per branch and pinned over HTTP; the managed-signal and MCP paths are ruled out by reading them.
_{no findings · tests covered · risk high}

Gates the two v2 alert routes that run a rule's query and return what it measured behind the telemetry read scopes that query needs. The signal-to-family mapping is unit-tested branch by branch, refusals are pinned over HTTP without touching the warehouse, and the earlier findings on managed signals and the test endpoint are fixed.

• ruleReadFamilies maps each rule signal to the telemetry its query reads
• requireRuleReadScopes refuses preview and test with 403 before any query runs
• uptime and slo_burn_rate need no telemetry scopes; raw_query needs all three
• Both endpoint descriptions document the added read scopes

Fixed since the last review

• ✅ F2 · uptime and slo_burn_rate demand telemetry reads they never make
• ✅ F3 · The test endpoint's new scope gate is untested

_{4ca4b35 · What was checked, coverage and telemetry details are on the Maple / review check. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}