Update migrations

Signed-off-by: dusan <borovcanindusan1@gmail.com>

.github/workflows/api-tests.yaml

@@ -15,10 +15,14 @@ on:
       - "clients/api/http/**"
       - "domains/api/http/**"
       - "groups/api/http/**"
+      - "journal/api/**"
       - "users/api/**"
       - "bootstrap/api/**"
       - "certs/api/http/**"
       - "readers/api/http/**"
+      - "re/**"
+      - "alarms/**"
+      - "reports/**"
       - "apidocs/openapi/**"
   pull_request:
     branches:
@@ -31,10 +35,14 @@ on:
       - "clients/api/http/**"
       - "domains/api/http/**"
       - "groups/api/http/**"
+      - "journal/api/**"
       - "users/api/**"
       - "bootstrap/api/**"
       - "certs/api/http/**"
       - "readers/api/http/**"
+      - "re/**"
+      - "alarms/**"
+      - "reports/**"
       - "apidocs/openapi/**"
 
 concurrency:
@@ -51,9 +59,13 @@ env:
   CLIENTS_URL: http://localhost
   CHANNELS_URL: http://localhost
   GROUPS_URL: http://localhost
+  JOURNAL_URL: http://localhost:9021
   BOOTSTRAP_URL: http://localhost:9013
   CERTS_URL: http://localhost:9019
   READERS_URL: http://localhost:9011
+  RE_URL: http://localhost:9008
+  ALARMS_URL: http://localhost:8050
+  REPORTS_URL: http://localhost:9017
 
 jobs:
   api-test:
@@ -65,7 +77,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache-dependency-path: "go.sum"
@@ -78,6 +90,10 @@ jobs:
             workflow:
               - ".github/workflows/api-tests.yaml"
 
+            journal:
+              - "apidocs/openapi/journal.yaml"
+              - "journal/api/**"
+
             domains:
               - "apidocs/openapi/domains.yaml"
               - "internal/atom/**"
@@ -115,6 +131,24 @@ jobs:
               - "apidocs/openapi/readers.yaml"
               - "readers/api/http/**"
 
+            re:
+              - "apidocs/openapi/rules.yaml"
+              - "re/**"
+              - "cmd/re/**"
+              - "internal/atom/**"
+
+            alarms:
+              - "apidocs/openapi/alarms.yaml"
+              - "alarms/**"
+              - "cmd/alarms/**"
+              - "internal/atom/**"
+
+            reports:
+              - "apidocs/openapi/reports.yaml"
+              - "reports/**"
+              - "cmd/reports/**"
+              - "internal/atom/**"
+
       - name: Build images
         run: make all -j $(nproc) && make dockers_dev -j $(nproc)
 
@@ -159,8 +193,6 @@ jobs:
           base-url: ${{ env.USERS_URL }}
           checks: all
           args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --exclude-operation-id=requestPasswordReset --phases=examples'
-          coverage-artifact-name: schema-coverage-users
-          coverage-pr-comment: false
 
       - name: Run Groups API tests
         if: (steps.changes.outputs.groups == 'true' || steps.changes.outputs.workflow == 'true') && hashFiles('groups/api/http/**') != ''
@@ -170,8 +202,6 @@ jobs:
           base-url: ${{ env.GROUPS_URL }}
           checks: all
           args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
-          coverage-artifact-name: schema-coverage-groups
-          coverage-pr-comment: false
 
       - name: Run Clients API tests
         if: (steps.changes.outputs.clients == 'true' || steps.changes.outputs.workflow == 'true') && hashFiles('clients/api/http/**') != ''
@@ -181,8 +211,6 @@ jobs:
           base-url: ${{ env.CLIENTS_URL }}
           checks: all
           args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
-          coverage-artifact-name: schema-coverage-clients
-          coverage-pr-comment: false
 
       - name: Run Channels API tests
         if: (steps.changes.outputs.channels == 'true' || steps.changes.outputs.workflow == 'true') && hashFiles('channels/api/http/**') != ''
@@ -192,8 +220,6 @@ jobs:
           base-url: ${{ env.CHANNELS_URL }}
           checks: all
           args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
-          coverage-artifact-name: schema-coverage-channels
-          coverage-pr-comment: false
 
       - name: Run Domains API tests
         if: (steps.changes.outputs.domains == 'true' || steps.changes.outputs.workflow == 'true') && hashFiles('domains/api/http/**') != ''
@@ -203,8 +229,15 @@ jobs:
           base-url: ${{ env.DOMAIN_URL }}
           checks: all
           args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
-          coverage-artifact-name: schema-coverage-domains
-          coverage-pr-comment: false
+
+      - name: Run Journal API tests
+        if: steps.changes.outputs.journal == 'true' || steps.changes.outputs.workflow == 'true'
+        uses: schemathesis/action@v3.0.0
+        with:
+          schema: apidocs/openapi/journal.yaml
+          base-url: ${{ env.JOURNAL_URL }}
+          checks: all
+          args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
 
       - name: Run Bootstrap API tests
         if: (steps.changes.outputs.bootstrap == 'true' || steps.changes.outputs.workflow == 'true') && hashFiles('bootstrap/api/**') != ''
@@ -214,8 +247,6 @@ jobs:
           base-url: ${{ env.BOOTSTRAP_URL }}
           checks: all
           args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
-          coverage-artifact-name: schema-coverage-bootstrap
-          coverage-pr-comment: false
 
       - name: Run Certs API tests
         if: (steps.changes.outputs.certs == 'true' || steps.changes.outputs.workflow == 'true') && hashFiles('docker/addons/certs/docker-compose.yaml') != ''
@@ -225,8 +256,6 @@ jobs:
           base-url: ${{ env.CERTS_URL }}
           checks: all
           args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
-          coverage-artifact-name: schema-coverage-certs
-          coverage-pr-comment: false
 
       - name: Run Readers API tests
         if: steps.changes.outputs.readers == 'true' || steps.changes.outputs.workflow == 'true'
@@ -236,8 +265,33 @@ jobs:
           base-url: ${{ env.READERS_URL }}
           checks: all
           args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
-          coverage-artifact-name: schema-coverage-readers
-          coverage-pr-comment: false
+
+      - name: Run Rules Engine API tests
+        if: steps.changes.outputs.re == 'true' || steps.changes.outputs.workflow == 'true'
+        uses: schemathesis/action@v3.0.0
+        with:
+          schema: apidocs/openapi/rules.yaml
+          base-url: ${{ env.RE_URL }}
+          checks: all
+          args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
+
+      - name: Run Alarms API tests
+        if: steps.changes.outputs.alarms == 'true' || steps.changes.outputs.workflow == 'true'
+        uses: schemathesis/action@v3.0.0
+        with:
+          schema: apidocs/openapi/alarms.yaml
+          base-url: ${{ env.ALARMS_URL }}
+          checks: all
+          args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
+
+      - name: Run Reports API tests
+        if: steps.changes.outputs.reports == 'true' || steps.changes.outputs.workflow == 'true'
+        uses: schemathesis/action@v3.0.0
+        with:
+          schema: apidocs/openapi/reports.yaml
+          base-url: ${{ env.REPORTS_URL }}
+          checks: all
+          args: '--header "Authorization: Bearer ${{ env.USER_TOKEN }}" --suppress-health-check=filter_too_much --exclude-checks=positive_data_acceptance --phases=examples'
 
       - name: Stop containers
         if: always()

.github/workflows/build.yaml

@@ -39,7 +39,7 @@ jobs:
           fetch-tags: true
 
       - name: Setup Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache-dependency-path: "go.sum"

.github/workflows/check-generated-files.yaml

@@ -12,15 +12,15 @@ jobs:
   check-generated-files:
     runs-on: ubuntu-latest
     env:
-      PROTOC_VERSION: "35.1"
+      PROTOC_VERSION: "33.0"
       PROTOC_GEN_GO_VERSION: "v1.36.11"
-      PROTOC_GEN_GO_GRPC_VERSION: "v1.6.2"
+      PROTOC_GEN_GO_GRPC_VERSION: "v1.6.0"
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
 
       - name: Install Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache-dependency-path: "go.sum"
@@ -68,6 +68,7 @@ jobs:
               - "pkg/groups/groups.go"
               - "users/emailer.go"
               - "users/hasher.go"
+              - "journal/journal.go"
               - "consumers/notifier.go"
 
       - name: Install Protoc

.github/workflows/lint-and-build.yaml

@@ -15,13 +15,13 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache-dependency-path: "go.sum"
 
       - name: Run linters
-        uses: golangci/golangci-lint-action@v9.3.0
+        uses: golangci/golangci-lint-action@v9.2.1
         with:
           version: v2.10.1
           args: --config ./tools/config/.golangci.yaml
@@ -35,7 +35,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache-dependency-path: "go.sum"
@@ -53,7 +53,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache-dependency-path: "go.sum"

.github/workflows/tests.yaml

@@ -30,7 +30,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache-dependency-path: "go.sum"
@@ -105,22 +105,14 @@ jobs:
             internal:
               - "internal/**"
 
+            journal:
+              - "journal/**"
+              - "cmd/journal/**"
+              - "pkg/events/**"
+
             logger:
               - "logger/**"
 
-            pkg-atom:
-              - "pkg/atom/**"
-
-            pkg-email:
-              - "pkg/email/**"
-              - "pkg/emailer/**"
-
-            pkg-readersclient:
-              - "pkg/readersclient/**"
-
-            pkg-testsutil:
-              - "pkg/testsutil/**"
-
             pkg-errors:
               - "pkg/errors/**"
 
@@ -144,7 +136,11 @@ jobs:
               - "channels/**"
               - "domains/**"
               - "groups/**"
+              - "journal/**"
               - "api/http/**"
+              - "re/**"
+              - "alarms/**"
+              - "reports/**"
 
             pkg-transformers:
               - "pkg/transformers/**"
@@ -161,6 +157,12 @@ jobs:
               - "pkg/uuid/**"
               - "pkg/events/**"
 
+            notifications:
+              - "notifications/**"
+              - "cmd/notifications/**"
+              - "consumers/notifier.go"
+              - "pkg/events/**"
+
             api:
               - "api/**"
 
@@ -176,14 +178,27 @@ jobs:
               - "cmd/postgres-reader/**"
               - "cmd/timescale-reader/**"
 
+            re:
+              - "re/**"
+              - "cmd/re/**"
+              - "re/api/**"
+
+            alarms:
+              - "alarms/**"
+              - "cmd/alarms/**"
+
+            reports:
+              - "reports/**"
+              - "cmd/reports/**"
+
       - name: Set matrix for changed modules
         id: set-matrix
         run: |
           modules=()
 
-          if [[ "${{ steps.changes.outputs.workflow }}" == "true" || "${{ steps.changes.outputs.pkg-errors }}" == "true" || "${{ steps.changes.outputs.pkg-testsutil }}" == "true" ]]; then
-            # If workflow, shared errors, or test utilities changed, test everything
-            modules=("auth" "channels" "cli" "clients" "domains" "groups" "internal" "logger" "pkg-atom" "pkg-email" "pkg-errors" "pkg-events" "pkg-grpcclient" "pkg-messaging" "pkg-readersclient" "pkg-sdk" "pkg-testsutil" "pkg-transformers" "pkg-ulid" "pkg-uuid" "users" "api" "consumers" "readers")
+          if [[ "${{ steps.changes.outputs.workflow }}" == "true" || "${{ steps.changes.outputs.pkg-errors }}" == "true" ]]; then
+            # If workflow or pkg/errors changed, test everything
+            modules=("auth" "channels" "cli" "clients" "domains" "groups" "internal" "journal" "logger" "pkg-errors" "pkg-events" "pkg-grpcclient" "pkg-messaging" "pkg-sdk" "pkg-transformers" "pkg-ulid" "pkg-uuid" "users" "notifications" "api" "consumers" "readers" "re" "alarms" "reports")
           else
             # Add only changed modules
             [[ "${{ steps.changes.outputs.auth }}" == "true" ]] && modules+=("auth")
@@ -193,22 +208,24 @@ jobs:
             [[ "${{ steps.changes.outputs.domains }}" == "true" ]] && modules+=("domains")
             [[ "${{ steps.changes.outputs.groups }}" == "true" ]] && modules+=("groups")
             [[ "${{ steps.changes.outputs.internal }}" == "true" ]] && modules+=("internal")
+            [[ "${{ steps.changes.outputs.journal }}" == "true" ]] && modules+=("journal")
             [[ "${{ steps.changes.outputs.logger }}" == "true" ]] && modules+=("logger")
-            [[ "${{ steps.changes.outputs.pkg-atom }}" == "true" ]] && modules+=("pkg-atom")
-            [[ "${{ steps.changes.outputs.pkg-email }}" == "true" ]] && modules+=("pkg-email")
             [[ "${{ steps.changes.outputs.pkg-errors }}" == "true" ]] && modules+=("pkg-errors")
             [[ "${{ steps.changes.outputs.pkg-events }}" == "true" ]] && modules+=("pkg-events")
             [[ "${{ steps.changes.outputs.pkg-grpcclient }}" == "true" ]] && modules+=("pkg-grpcclient")
             [[ "${{ steps.changes.outputs.pkg-messaging }}" == "true" ]] && modules+=("pkg-messaging")
-            [[ "${{ steps.changes.outputs.pkg-readersclient }}" == "true" ]] && modules+=("pkg-readersclient")
             [[ "${{ steps.changes.outputs.pkg-sdk }}" == "true" ]] && modules+=("pkg-sdk")
             [[ "${{ steps.changes.outputs.pkg-transformers }}" == "true" ]] && modules+=("pkg-transformers")
             [[ "${{ steps.changes.outputs.pkg-ulid }}" == "true" ]] && modules+=("pkg-ulid")
             [[ "${{ steps.changes.outputs.pkg-uuid }}" == "true" ]] && modules+=("pkg-uuid")
             [[ "${{ steps.changes.outputs.users }}" == "true" ]] && modules+=("users")
+            [[ "${{ steps.changes.outputs.notifications }}" == "true" ]] && modules+=("notifications")
             [[ "${{ steps.changes.outputs.api }}" == "true" ]] && modules+=("api")
             [[ "${{ steps.changes.outputs.consumers }}" == "true" ]] && modules+=("consumers")
             [[ "${{ steps.changes.outputs.readers }}" == "true" ]] && modules+=("readers")
+            [[ "${{ steps.changes.outputs.re }}" == "true" ]] && modules+=("re")
+            [[ "${{ steps.changes.outputs.alarms }}" == "true" ]] && modules+=("alarms")
+            [[ "${{ steps.changes.outputs.reports }}" == "true" ]] && modules+=("reports")
           fi
 
           # Convert to JSON array
@@ -232,7 +249,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Setup Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@v6
         with:
           go-version-file: go.mod
           cache-dependency-path: "go.sum"
@@ -246,15 +263,11 @@ jobs:
         run: |
           # Map module names to directories
           case "${{ matrix.module }}" in
-            pkg-atom) dir="pkg/atom" ;;
-            pkg-email) dir="pkg/email" ;;
             pkg-errors) dir="pkg/errors" ;;
             pkg-events) dir="pkg/events" ;;
             pkg-grpcclient) dir="pkg/grpcclient" ;;
             pkg-messaging) dir="pkg/messaging" ;;
-            pkg-readersclient) dir="pkg/readersclient" ;;
             pkg-sdk) dir="pkg/sdk" ;;
-            pkg-testsutil) dir="pkg/testsutil" ;;
             pkg-transformers) dir="pkg/transformers" ;;
             pkg-ulid) dir="pkg/ulid" ;;
             pkg-uuid) dir="pkg/uuid" ;;

Makefile

@@ -4,8 +4,8 @@
 override MG_DOCKER_IMAGE_NAME_PREFIX := ghcr.io/absmach/magistrala
 MG_DOCKER_VOLUME_NAME_PREFIX ?= magistrala
 BUILD_DIR ?= build
-SERVICES = atom-bootstrap certs postgres-writer postgres-reader timescale-writer timescale-reader fluxmq
-TEST_API_SERVICES = certs clients users channels groups domains
+SERVICES = atom-bootstrap notifications certs re postgres-writer postgres-reader timescale-writer timescale-reader alarms reports journal fluxmq
+TEST_API_SERVICES = journal certs clients users channels groups domains
 TEST_API = $(addprefix test_api_,$(TEST_API_SERVICES))
 DOCKERS = $(addprefix docker_,$(SERVICES))
 DOCKERS_DEV = $(addprefix docker_dev_,$(SERVICES))
@@ -24,7 +24,7 @@ DOCKER_PROJECT ?= $(shell echo $(subst $(space),,$(USER_REPO)) | sed -E 's/[^a-z
 DOCKER_COMPOSE_COMMANDS_SUPPORTED := up down config restart
 DEFAULT_DOCKER_COMPOSE_COMMAND  := up
 ATOM_TOKENS_ENV ?= docker/.env.tokens
-REQUIRED_ATOM_TOKEN_ENVS := MG_ATOM_TOKEN_FLUXMQ_AUTH MG_ATOM_TOKEN_FLUXMQ_NODE1 MG_ATOM_TOKEN_FLUXMQ_NODE2 MG_ATOM_TOKEN_FLUXMQ_NODE3 MG_ATOM_TOKEN_TIMESCALE_READER MG_ATOM_TOKEN_RE MG_ATOM_TOKEN_ALARMS MG_ATOM_TOKEN_REPORTS MG_ATOM_TOKEN_POSTGRES_READER
+REQUIRED_ATOM_TOKEN_ENVS := MG_ATOM_TOKEN_FLUXMQ_AUTH MG_ATOM_TOKEN_FLUXMQ_NODE1 MG_ATOM_TOKEN_FLUXMQ_NODE2 MG_ATOM_TOKEN_FLUXMQ_NODE3 MG_ATOM_TOKEN_JOURNAL MG_ATOM_TOKEN_NOTIFICATIONS MG_ATOM_TOKEN_TIMESCALE_READER MG_ATOM_TOKEN_RE MG_ATOM_TOKEN_ALARMS MG_ATOM_TOKEN_REPORTS MG_ATOM_TOKEN_POSTGRES_READER
 PROVISION_ATOM_TOKENS ?= false
 PROVISION_ATOM_TOKEN_GOALS := provision-atom-tokens
 DOCKER_BASE_ENV_FILES := --env-file docker/.env
@@ -197,14 +197,7 @@ FILTERED_SERVICES = $(filter-out $(RUN_ADDON_ARGS), $(SERVICES))
 
 all: $(SERVICES)
 
-.PHONY: all help $(SERVICES) dockers dockers_dev latest release provision_atom_tokens provision-atom-tokens migrate_atom run_latest run_latest_ci run_tls run_stable run_addons grpc_mtls_certs check_mtls check_certs check_fluxmq_service_certs check_re_trace_key test_api mocks
-
-help:
-	@printf 'Usage:\n  make <target> [VARIABLE=value ...]\n\nAvailable targets:\n'
-	@$(MAKE) -qpRr : 2>/dev/null | \
-		awk -F: '/^[[:alnum:]_][^$$#\/\t=]*:([^=]|$$)/ { split($$1, targets, /[[:space:]]+/); for (i in targets) if (targets[i] != "") print targets[i] }' | \
-		LC_ALL=C sort -u | \
-		awk '$$0 != "Makefile" { printf "  make %s\n", $$0 }'
+.PHONY: all $(SERVICES) dockers dockers_dev latest release provision_atom_tokens provision-atom-tokens run_latest run_latest_ci run_tls run_stable run_addons grpc_mtls_certs check_mtls check_certs test_api mocks
 
 clean:
 	rm -rf ${BUILD_DIR}
@@ -265,6 +258,7 @@ test_api_domains: TEST_API_URL := http://localhost:9000
 test_api_channels: TEST_API_URL := http://localhost:9000
 test_api_groups: TEST_API_URL := http://localhost:9000
 test_api_certs: TEST_API_URL := http://localhost:9019
+test_api_journal: TEST_API_URL := http://localhost:9021
 
 $(TEST_API):
 	$(call test_api_service,$(@),$(TEST_API_URL))
@@ -330,16 +324,6 @@ provision_atom_tokens:
 provision-atom-tokens:
 	@:
 
-# Migrate an old Magistrala (v0.30.0 / pre-Atom) deployment into Atom. Runs an
-# isolated, collision-free stack, seeds the Atom schema into the run_latest Atom
-# volume and loads the data. Default is a dry-run; pass args="--apply" to load,
-# args="--verify" to reconcile afterwards.
-#   make migrate_atom                 # dry-run
-#   make migrate_atom args="--apply"  # perform the migration
-#   make migrate_atom args="--apply --fresh-atom"  # rebuild Atom schema first
-migrate_atom:
-	DOCKER_PROJECT="$(DOCKER_PROJECT)" tools/atom-migration/migrate.sh $(args)
-
 check_tls:
 ifeq ($(GRPC_TLS),true)
 	@echo "gRPC TLS is enabled"
@@ -356,41 +340,7 @@ else
 	$(eval GRPC_MTLS :=)
 endif
 
-# Internal services reach FluxMQ on the mTLS local listener, and Compose mounts
-# both sides of those connections. Certificates and principal secrets are
-# generated rather than committed, so make them before anything binds them.
-check_fluxmq_service_certs:
-ifeq ("$(wildcard docker/ssl/certs/re-fluxmq-client.crt)","")
-	$(MAKE) -C docker/ssl fluxmq_service_certs
-endif
-ifeq ("$(wildcard docker/ssl/certs/timescale-writer-fluxmq-client.crt)","")
-	$(MAKE) -C docker/ssl timescale_writer_fluxmq_client_cert
-endif
-ifeq ("$(wildcard docker/ssl/certs/postgres-writer-fluxmq-client.crt)","")
-	$(MAKE) -C docker/ssl postgres_writer_fluxmq_client_cert
-endif
-ifeq ("$(wildcard docker/ssl/certs/fluxmq-auth-fluxmq-client.crt)","")
-	$(MAKE) -C docker/ssl fluxmq_auth_fluxmq_client_cert
-endif
-ifeq ("$(wildcard docker/fluxmq/secrets/re-current)","")
-	$(MAKE) -C docker/ssl fluxmq_service_secret
-endif
-ifeq ("$(wildcard docker/fluxmq/secrets/timescale-writer-current)","")
-	$(MAKE) -C docker/ssl timescale_writer_fluxmq_service_secret
-endif
-ifeq ("$(wildcard docker/fluxmq/secrets/postgres-writer-current)","")
-	$(MAKE) -C docker/ssl postgres_writer_fluxmq_service_secret
-endif
-ifeq ("$(wildcard docker/fluxmq/secrets/fluxmq-auth-current)","")
-	$(MAKE) -C docker/ssl fluxmq_auth_fluxmq_service_secret
-endif
-
-check_re_trace_key:
-ifeq ("$(wildcard docker/re/secrets/trace.key)","")
-	$(MAKE) -C docker/ssl re_trace_key
-endif
-
-check_certs: check_mtls check_tls check_fluxmq_service_certs check_re_trace_key
+check_certs: check_mtls check_tls
 ifeq ($(GRPC_MTLS_CERT_FILES_EXISTS),0)
 ifeq ($(filter true,$(GRPC_MTLS) $(GRPC_TLS)),true)
 ifeq ($(filter $(DEFAULT_DOCKER_COMPOSE_COMMAND),$(DOCKER_COMPOSE_COMMAND)),$(DEFAULT_DOCKER_COMPOSE_COMMAND))
@@ -409,7 +359,7 @@ run_latest_ci: check_certs
 	$(SED_INPLACE) 's/^MG_RELEASE_TAG=.*/MG_RELEASE_TAG=latest/' docker/.env
 	$(DOCKER_PLATFORM) docker compose -f docker/docker-compose.yaml -f docker/docker-compose-ci.yaml $(DOCKER_ENV_FILES) -p $(DOCKER_PROJECT) $(DOCKER_COMPOSE_COMMAND) $(args)
 
-run_tls: check_certs
+run_tls:
 	@test -n "$(host)" || (echo "Usage: make run_tls host=example.com [email=admin@example.com] [letsencrypt=false] [staging=true] [force=true]" && exit 2)
 	@if [ "$(or $(letsencrypt),true)" != "false" ] && [ -z "$(email)" ]; then echo "Usage: make run_tls host=example.com email=admin@example.com [letsencrypt=false] [staging=true] [force=true]"; exit 2; fi
 	MG_PUBLIC_HOST="$(host)" \

README.md

@@ -116,14 +116,14 @@ Magistrala provides a complete set of building blocks for IoT systems — from d
 
 ### ⚙️ Processing & Automation
 
-- Rules engine for message processing and routing (Enterprise Edition)
-- Alarms and triggers for reacting to events (Enterprise Edition)
+- Rules engine for message processing and routing
+- Alarms and triggers for reacting to events
 - Scheduled actions for time-based workflows
 - Event-driven architecture as the foundation
 
 ### 📊 Observability
 
-- Audit logs for tracking system activity (Enterprise Edition)
+- Audit logs for tracking system activity
 - Metrics and tracing via Prometheus and OpenTelemetry
 - Built-in visibility into system behavior and data flows
 
@@ -156,17 +156,15 @@ Atom is the source of truth for:
 
 Magistrala services such as rules, alarms, and reports remain Magistrala services, but they use Atom for identity and authorization.
 
-Current Docker deployments use the Atom image configured by `ATOM_IMAGE` in `docker/.env`. For compatibility with the current Magistrala integration, the generated `MG_ATOM_TOKEN_*` service credentials are unscoped Atom access tokens. Scoped Atom access tokens should not be used for these service env vars until Magistrala stops using owner-wide Atom listing APIs such as `authorizedObjectIds` in service policy paths.
-
 ### Core Entity Mapping
 
-| Magistrala concept | Atom concept                 | Meaning                                                            |
-| ------------------ | ---------------------------- | ------------------------------------------------------------------ |
-| Domain             | Tenant                       | Isolation boundary for one organization, project, or environment   |
-| User               | Entity with kind `human`     | A person who logs in and uses the UI/API                           |
-| Client             | Entity with kind `device`    | A device or application that sends/receives data                   |
-| Channel            | Resource with kind `channel` | A messaging/data path that clients can publish or subscribe to     |
-| Group              | Group                        | A collection of users, clients, channels, or other grouped objects |
+| Magistrala concept | Atom concept | Meaning |
+|--------------------|--------------|---------|
+| Domain | Tenant | Isolation boundary for one organization, project, or environment |
+| User | Entity with kind `human` | A person who logs in and uses the UI/API |
+| Client | Entity with kind `device` | A device or application that sends/receives data |
+| Channel | Resource with kind `channel` | A messaging/data path that clients can publish or subscribe to |
+| Group | Group | A collection of users, clients, channels, or other grouped objects |
 
 In simple terms:
 
@@ -182,12 +180,12 @@ MG Group   = Atom Group
 
 Atom access control has these basic parts:
 
-| Atom word        | Simple meaning                | Example                                                   |
-| ---------------- | ----------------------------- | --------------------------------------------------------- |
-| Action           | One permission verb           | `read`, `write`, `delete`, `role.manage`, `policy.manage` |
-| Permission Block | Where actions apply           | all channels in domain `d1` can `read`, `publish`         |
-| Role             | A bundle of permission blocks | `tenant-admin` bundles domain, role, and member access    |
-| Role Assignment  | Who gets a role               | give `user1` the `tenant-admin` role                      |
+| Atom word | Simple meaning | Example |
+|-----------|----------------|---------|
+| Action | One permission verb | `read`, `write`, `delete`, `role.manage`, `policy.manage` |
+| Permission Block | Where actions apply | all channels in domain `d1` can `read`, `publish` |
+| Role | A bundle of permission blocks | `tenant-admin` bundles domain, role, and member access |
+| Role Assignment | Who gets a role | give `user1` the `tenant-admin` role |
 
 Read an assignment like this:
 
@@ -221,15 +219,15 @@ MG UI shows actions such as:
 
 These are mapped to Atom actions:
 
-| MG action                    | Atom action     |
-| ---------------------------- | --------------- |
-| view/read                    | `read`          |
-| create/update/edit/connect   | `write`         |
-| delete/remove                | `delete`        |
-| manage roles                 | `role.manage`   |
+| MG action | Atom action |
+|-----------|-----------------|
+| view/read | `read` |
+| create/update/edit/connect | `write` |
+| delete/remove | `delete` |
+| manage roles | `role.manage` |
 | add/remove members or access | `policy.manage` |
-| channel publish              | `publish`       |
-| channel subscribe            | `subscribe`     |
+| channel publish | `publish` |
+| channel subscribe | `subscribe` |
 
 So when MG UI checks:
 
@@ -280,122 +278,9 @@ Then user2 can read only that channel, not the whole domain.
 ```bash
 git clone https://github.com/absmach/magistrala.git
 cd magistrala
-make provision_atom_tokens
 make run_latest
 ```
 
-A fresh clone carries no generated secrets. Two sets have to exist before the
-stack can start — certificates and keys the internal services authenticate
-with, and the Atom service tokens each service presents to Atom. `make
-run_latest` produces the first set itself but expects the second to be there
-already, which is why the token step comes first above.
-
-### Certificates, broker secret and trace key
-
-Generated by `make run_latest`, or on demand:
-
-```bash
-make check_certs
-```
-
-This creates whatever is missing and leaves anything already present alone:
-
-| Path                                                        | What it is                                                                |
-| ----------------------------------------------------------- | ------------------------------------------------------------------------- |
-| `docker/ssl/certs/fluxmq-service-server.{crt,key}`          | Server certificate for FluxMQ's mTLS service listener                     |
-| `docker/ssl/certs/re-fluxmq-client.{crt,key}`               | Client certificate whose URI SAN identifies the Rules Engine              |
-| `docker/ssl/certs/timescale-writer-fluxmq-client.{crt,key}` | Client certificate whose URI SAN identifies the Timescale writer          |
-| `docker/ssl/certs/postgres-writer-fluxmq-client.{crt,key}`  | Client certificate whose URI SAN identifies the Postgres writer           |
-| `docker/ssl/certs/fluxmq-auth-fluxmq-client.{crt,key}`      | Client certificate whose URI SAN identifies the publish proxy            |
-| `docker/fluxmq/secrets/re-current`                          | Rules Engine principal secret, from `MG_RE_BROKER_SECRET`                 |
-| `docker/fluxmq/secrets/timescale-writer-current`            | Timescale writer secret, from `MG_TIMESCALE_WRITER_BROKER_SECRET`         |
-| `docker/fluxmq/secrets/postgres-writer-current`             | Postgres writer secret, from `MG_POSTGRES_WRITER_BROKER_SECRET`           |
-| `docker/fluxmq/secrets/fluxmq-auth-current`                 | Publish proxy secret, from `MG_FLUXMQ_BROKER_SECRET`                     |
-| `docker/re/secrets/trace.key`                               | HMAC key the Rules Engine signs its loop-detection traces with            |
-
-Internal services reach the broker as *local principals* rather than as ordinary
-clients: each presents a client certificate whose URI SAN names it, plus a SASL
-secret, and the broker grants it only what it needs — the Rules Engine consumes
-`m`, republishes under it, and feeds the `writers` and `alarms` streams; the
-writers only subscribe to `writers`; the publish proxy that serves the UI's
-HTTP publish endpoint only publishes under `m.`. The principals are declared in
-`docker/fluxmq/node{1,2,3}.yaml`, and adding a service means adding an entry
-there alongside its certificate and secret.
-
-Being a local principal is also what preserves a message's origin. The broker
-stamps its own transport protocol and identity on anything published over a
-connection it does not trust, so a message relayed to the writers over the plain
-AMQP listener would be stored as `protocol: amqp` with the relaying service as
-its publisher. A `service`-role principal on the mTLS listener may state the
-origin instead, and the protocol the device actually published with survives to
-the database.
-
-The certificates are issued by the development CA committed at
-`docker/ssl/certs/ca.crt`, so no extra setup is needed for a local run. The
-generated material is gitignored.
-
-The server certificate is issued for `fluxmq` and `fluxmq-node{1,2,3}`, which
-covers both this Compose stack and a single-node deployment. Point any
-`MG_*_BROKER_URL` at a host outside that set and the service fails its TLS
-verification with `certificate is valid for ...`; add the name to
-`FLUXMQ_SERVICE_SERVER_CERT_CONFIG` in `docker/ssl/Makefile` and reissue:
-
-```bash
-rm -f docker/ssl/certs/fluxmq-service-server.* \
-  docker/ssl/certs/re-fluxmq-client.* \
-  docker/ssl/certs/timescale-writer-fluxmq-client.* \
-  docker/ssl/certs/postgres-writer-fluxmq-client.*
-make -C docker/ssl fluxmq_service_certs
-```
-
-`make check_certs` skips certificates that already exist, so stale certificates
-have to be removed rather than merely re-running the target.
-
-Each local-principal secret must stay equal to the corresponding value in
-`docker/.env`; a mismatch fails that service's broker authentication. After
-changing one, re-run its target:
-
-| Variable                            | Target                                    |
-| ----------------------------------- | ----------------------------------------- |
-| `MG_RE_BROKER_SECRET`               | `fluxmq_service_secret`                   |
-| `MG_TIMESCALE_WRITER_BROKER_SECRET` | `timescale_writer_fluxmq_service_secret`  |
-| `MG_POSTGRES_WRITER_BROKER_SECRET`  | `postgres_writer_fluxmq_service_secret`   |
-| `MG_FLUXMQ_BROKER_SECRET`           | `fluxmq_auth_fluxmq_service_secret`       |
-
-`trace.key` is created once and preserved on later runs — replacing it while
-messages are in flight would invalidate the rule traces they already carry, so
-delete it only deliberately. Every Rules Engine replica must read the same key.
-
-Start the stack through `make run_latest` rather than calling `docker compose
-up` directly. Compose creates a missing bind-mount source as an empty
-*directory*, so bringing up `re` or `fluxmq` before these files exist leaves the
-containers failing against a directory where they expect a key.
-
-### Atom service tokens
-
-Not generated automatically, because provisioning them starts Atom and runs a
-bootstrap job against it:
-
-```bash
-make provision_atom_tokens
-```
-
-This brings up Atom, runs `atom-bootstrap`, and writes the gitignored
-`docker/.env.tokens` with one service token per consumer —
-`MG_ATOM_TOKEN_FLUXMQ_AUTH`, `MG_ATOM_TOKEN_FLUXMQ_NODE{1,2,3}`,
-`MG_ATOM_TOKEN_RE`, `MG_ATOM_TOKEN_ALARMS`, `MG_ATOM_TOKEN_REPORTS`,
-`MG_ATOM_TOKEN_TIMESCALE_READER`, and `MG_ATOM_TOKEN_POSTGRES_READER`.
-
-`make run_latest` refuses to start when that file is absent or short of any of
-those variables, and names what is missing. To fold the step into the run:
-
-```bash
-make run_latest PROVISION_ATOM_TOKENS=true
-```
-
-Re-run `provision_atom_tokens` after anything that resets Atom's database; the
-old tokens do not survive it.
-
 ---
 
 ## Usage

alarms/README.md

@@ -0,0 +1,192 @@
+# Alarms
+
+The Alarms service stores, manages and exposes alarms raised by rules and device activity. It consumes alarm events from the message broker, persists them to PostgreSQL, and provides an HTTP API for listing, viewing, updating, and deleting alarms with full authn/authz, metrics, and tracing support.
+
+## Configuration
+
+The service is configured using the following environment variables (values shown are from [docker/.env](https://github.com/absmach/magistrala/blob/main/docker/.env) as consumed by [docker/docker-compose.yaml](https://github.com/absmach/magistrala/blob/main/docker/docker-compose.yaml)):
+
+| Variable | Description | Default |
+| --- | --- | --- |
+| `MG_ALARMS_LOG_LEVEL` | Log level for the service | `debug` |
+| `MG_ALARMS_HTTP_HOST` | HTTP host to bind | `alarms` |
+| `MG_ALARMS_HTTP_PORT` | HTTP port to bind | `8050` |
+| `MG_ALARMS_HTTP_SERVER_CERT` | Path to PEM-encoded HTTPS server certificate | "" |
+| `MG_ALARMS_HTTP_SERVER_KEY` | Path to PEM-encoded HTTPS server key | "" |
+| `MG_ALARMS_DB_HOST` | PostgreSQL host | `alarms-db` |
+| `MG_ALARMS_DB_PORT` | PostgreSQL port | `5432` |
+| `MG_ALARMS_DB_USER` | PostgreSQL user | `magistrala` |
+| `MG_ALARMS_DB_PASS` | PostgreSQL password | `magistrala` |
+| `MG_ALARMS_DB_NAME` | PostgreSQL database name | `alarms` |
+| `MG_ALARMS_DB_SSL_MODE` | PostgreSQL SSL mode | `disable` |
+| `MG_ALARMS_DB_SSL_CERT` | PostgreSQL SSL client cert | "" |
+| `MG_ALARMS_DB_SSL_KEY` | PostgreSQL SSL client key | "" |
+| `MG_ALARMS_DB_SSL_ROOT_CERT` | PostgreSQL SSL root cert | "" |
+| `MG_ALARMS_INSTANCE_ID` | Instance ID for tracing/health | "" |
+| `MG_MESSAGE_BROKER_URL` | Message broker URL for alarm ingestion | `nats://nats:4222` |
+| `MG_JAEGER_URL` | Jaeger collector endpoint | `http://jaeger:4318/v1/traces` |
+| `MG_JAEGER_TRACE_RATIO` | Trace sampling ratio | `1.0` |
+| `ATOM_URL` | Atom HTTP endpoint | `http://atom:8080` |
+| `ATOM_JWKS_URL` | Atom JWKS endpoint for JWT verification | `http://atom:8080/.well-known/jwks.json` |
+| `ATOM_ADMIN_USERNAME` | Atom admin login for service projections | `atom-admin` |
+| `ATOM_ADMIN_SECRET` | Atom admin secret for service projections | `change-me` |
+| `ATOM_TIMEOUT` | Atom request timeout | `5s` |
+| `MG_ALLOW_UNVERIFIED_USER` | Allow unverified users to access | `true` |
+
+## Features
+
+- **Alarm ingestion**: Consumes alarms from the message broker and persists them to PostgreSQL.
+- **Stateful updates**: Updates assignee, acknowledgment, resolution, and metadata fields.
+- **Filtering and paging**: Lists alarms by domain, rule, channel, client, subtopic, status, severity, and time range.
+- **Observability**: `/metrics` Prometheus endpoint and Jaeger tracing support.
+- **Auth and authorization**: Authn/authz enforced through Atom JWT verification and PDP checks.
+
+## Architecture
+
+### Runtime flow
+
+1. The message broker publishes alarm events under the `alarms.>` subject.
+2. The Alarms consumer decodes the event payload, enriches it with message metadata, validates it, and calls `CreateAlarm`.
+3. The repository writes to PostgreSQL while deduplicating repeated active alarms with the same severity.
+4. The HTTP API exposes list/view/update/delete operations with authn/authz, metrics, and tracing middleware.
+
+### Components
+
+- **HTTP API**: `alarms/api` exposes REST endpoints and health/metrics handlers.
+- **Service layer**: `alarms/service.go` validates requests and coordinates repository operations.
+- **Repository**: `alarms/postgres/alarms.go` implements persistence and filtering.
+- **Consumer**: `alarms/consumer` processes broker messages and creates alarms.
+- **Message broker**: `alarms/brokers` uses NATS JetStream with stream `alarms` and subject `alarms.>`.
+- **Migrations**: `alarms/postgres/init.go` defines the alarms schema and indexes.
+
+### Alarms table
+
+Defined in `alarms/postgres/init.go`:
+
+| Column | Type | Description |
+| --- | --- | --- |
+| `id` | `VARCHAR(36)` | Alarm UUID (primary key) |
+| `rule_id` | `VARCHAR(36)` | Rule ID that triggered the alarm |
+| `domain_id` | `VARCHAR(36)` | Domain ID |
+| `channel_id` | `VARCHAR(36)` | Channel ID |
+| `subtopic` | `TEXT` | Subtopic associated with the alarm |
+| `client_id` | `VARCHAR(36)` | Client ID |
+| `measurement` | `TEXT` | Measurement name |
+| `value` | `TEXT` | Measured value |
+| `unit` | `TEXT` | Measurement unit |
+| `threshold` | `TEXT` | Threshold value |
+| `cause` | `TEXT` | Cause/description |
+| `status` | `SMALLINT` | 0 = active, 1 = cleared |
+| `severity` | `SMALLINT` | Severity (0-100) |
+| `assignee_id` | `VARCHAR(36)` | Assignee ID |
+| `created_at` | `TIMESTAMPTZ` | Creation timestamp |
+| `updated_at` | `TIMESTAMPTZ` | Last update timestamp |
+| `updated_by` | `VARCHAR(36)` | User who updated |
+| `assigned_at` | `TIMESTAMPTZ` | When assigned |
+| `assigned_by` | `VARCHAR(36)` | Who assigned |
+| `acknowledged_at` | `TIMESTAMPTZ` | When acknowledged |
+| `acknowledged_by` | `VARCHAR(36)` | Who acknowledged |
+| `resolved_at` | `TIMESTAMPTZ` | When resolved |
+| `resolved_by` | `VARCHAR(36)` | Who resolved |
+| `metadata` | `JSONB` | Custom metadata |
+
+Index: `idx_alarms_state (domain_id, rule_id, channel_id, subtopic, client_id, measurement, created_at DESC)`
+
+## Deployment
+
+### Build and run locally
+
+```bash
+make alarms
+
+MG_ALARMS_LOG_LEVEL=debug \
+MG_ALARMS_HTTP_PORT=8050 \
+MG_ALARMS_DB_HOST=localhost \
+MG_ALARMS_DB_PORT=5432 \
+MG_ALARMS_DB_USER=magistrala \
+MG_ALARMS_DB_PASS=magistrala \
+MG_ALARMS_DB_NAME=alarms \
+MG_MESSAGE_BROKER_URL=nats://localhost:4222 \
+MG_AUTH_GRPC_URL=localhost:7001 \
+MG_AUTH_GRPC_TIMEOUT=300s \
+MG_DOMAINS_GRPC_URL=localhost:7003 \
+MG_DOMAINS_GRPC_TIMEOUT=300s \
+./build/alarms
+```
+
+### Docker Compose
+
+The service is available as a Docker container. Refer to [docker/docker-compose.yaml](https://github.com/absmach/magistrala/blob/main/docker/docker-compose.yaml) for the `alarms` and `alarms-db` services and their environment variables. For a full local stack, make sure the auth, domains, and message broker services are also running.
+
+```bash
+docker compose -f docker/docker-compose.yaml up alarms alarms-db
+```
+
+### Health check
+
+```bash
+curl -X GET http://localhost:8050/health \
+  -H "accept: application/health+json"
+```
+
+## Testing
+
+```bash
+go test ./alarms/...
+```
+
+## Usage
+
+The Alarms service supports the following operations:
+
+| Operation | Method & Path | Description |
+| --- | --- | --- |
+| `listAlarms` | `GET /{domainID}/alarms` | List alarms with filters |
+| `viewAlarm` | `GET /{domainID}/alarms/{alarmID}` | Retrieve a single alarm |
+| `updateAlarm` | `PUT /{domainID}/alarms/{alarmID}` | Update alarm status/assignee/metadata |
+| `deleteAlarm` | `DELETE /{domainID}/alarms/{alarmID}` | Delete an alarm |
+| `health` | `GET /health` | Service health check |
+
+Alarm creation is driven by message broker events and is not exposed as an HTTP endpoint.
+
+### Example: List alarms
+
+```bash
+curl -X GET "http://localhost:8050/<domainID>/alarms?limit=10&offset=0&status=active&severity=50" \
+  -H "Authorization: Bearer <your_access_token>"
+```
+
+### Example: View an alarm
+
+```bash
+curl -X GET http://localhost:8050/<domainID>/alarms/<alarmID> \
+  -H "Authorization: Bearer <your_access_token>"
+```
+
+### Example: Update an alarm
+
+```bash
+curl -X PUT http://localhost:8050/<domainID>/alarms/<alarmID> \
+  -H "Authorization: Bearer <your_access_token>" \
+  -H "Content-Type: application/json" \
+  -d '{
+    "status": "cleared",
+    "assignee_id": "<userID>",
+    "severity": 40,
+    "metadata": { "note": "cleared after inspection" }
+  }'
+```
+
+### Example: Delete an alarm
+
+```bash
+curl -X DELETE http://localhost:8050/<domainID>/alarms/<alarmID> \
+  -H "Authorization: Bearer <your_access_token>"
+```
+
+### Example: Health check
+
+```bash
+curl -X GET http://localhost:8050/health \
+  -H "accept: application/health+json"
+```

alarms/alarms.go

@@ -0,0 +1,122 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package alarms
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/absmach/magistrala/pkg/authn"
+)
+
+const SeverityMax uint8 = 100
+
+var ErrInvalidSeverity = errors.New("invalid severity. Must be between 0 and 100")
+
+type Metadata map[string]any
+
+// Alarm represents an alarm instance.
+type Alarm struct {
+	ID             string    `json:"id"`
+	RuleID         string    `json:"rule_id"`
+	DomainID       string    `json:"domain_id"`
+	ChannelID      string    `json:"channel_id"`
+	ClientID       string    `json:"client_id"`
+	Subtopic       string    `json:"subtopic"`
+	Status         Status    `json:"status"`
+	Measurement    string    `json:"measurement"`
+	Value          string    `json:"value"`
+	Unit           string    `json:"unit"`
+	Threshold      string    `json:"threshold"`
+	Cause          string    `json:"cause"`
+	Severity       uint8     `json:"severity"`
+	AssigneeID     string    `json:"assignee_id"`
+	CreatedAt      time.Time `json:"created_at"`
+	UpdatedAt      time.Time `json:"updated_at"`
+	UpdatedBy      string    `json:"updated_by"`
+	AssignedAt     time.Time `json:"assigned_at,omitempty"`
+	AssignedBy     string    `json:"assigned_by,omitempty"`
+	AcknowledgedAt time.Time `json:"acknowledged_at,omitempty"`
+	AcknowledgedBy string    `json:"acknowledged_by,omitempty"`
+	ResolvedAt     time.Time `json:"resolved_at,omitempty"`
+	ResolvedBy     string    `json:"resolved_by,omitempty"`
+	Metadata       Metadata  `json:"metadata,omitempty"`
+}
+
+type AlarmsPage struct {
+	Offset uint64  `json:"offset"`
+	Limit  uint64  `json:"limit"`
+	Total  uint64  `json:"total"`
+	Alarms []Alarm `json:"alarms"`
+}
+
+type PageMetadata struct {
+	Offset         uint64    `json:"offset"          db:"offset"`
+	Limit          uint64    `json:"limit"           db:"limit"`
+	DomainID       string    `json:"domain_id"       db:"domain_id"`
+	RuleID         string    `json:"rule_id"         db:"rule_id"`
+	ChannelID      string    `json:"channel_id"      db:"channel_id"`
+	ClientID       string    `json:"client_id"       db:"client_id"`
+	Subtopic       string    `json:"subtopic"        db:"subtopic"`
+	Measurement    string    `json:"measurement"     db:"measurement"`
+	Dir            string    `json:"dir"             db:"dir"`
+	Order          string    `json:"order"           db:"order"`
+	Status         Status    `json:"status"          db:"status"`
+	CreatedFrom    time.Time `json:"created_from"    db:"created_from"`
+	CreatedTo      time.Time `json:"created_to"      db:"created_to"`
+	AssigneeID     string    `json:"assignee_id"     db:"assignee_id"`
+	Severity       uint8     `json:"severity"        db:"severity"`
+	UpdatedBy      string    `json:"updated_by"      db:"updated_by"`
+	AssignedBy     string    `json:"assigned_by"     db:"assigned_by"`
+	AcknowledgedBy string    `json:"acknowledged_by" db:"acknowledged_by"`
+	ResolvedBy     string    `json:"resolved_by"     db:"resolved_by"`
+	UserID         string    `json:"user_id"         db:"user_id"`
+}
+
+func (a Alarm) Validate() error {
+	if a.RuleID == "" {
+		return errors.New("rule_id is required")
+	}
+	if a.DomainID == "" {
+		return errors.New("domain_id is required")
+	}
+	if a.ChannelID == "" {
+		return errors.New("channel_id is required")
+	}
+	if a.ClientID == "" {
+		return errors.New("client_id is required")
+	}
+	if a.Measurement == "" {
+		return errors.New("measurement is required")
+	}
+	if a.Value == "" {
+		return errors.New("value is required")
+	}
+	if a.Cause == "" {
+		return errors.New("cause is required")
+	}
+	if a.Severity > SeverityMax {
+		return ErrInvalidSeverity
+	}
+
+	return nil
+}
+
+// Service specifies an API that must be fulfilled by the domain service.
+type Service interface {
+	CreateAlarm(ctx context.Context, alarm Alarm) (Alarm, error)
+	UpdateAlarm(ctx context.Context, session authn.Session, alarm Alarm) (Alarm, error)
+	ViewAlarm(ctx context.Context, session authn.Session, id string) (Alarm, error)
+	ListAlarms(ctx context.Context, session authn.Session, pm PageMetadata) (AlarmsPage, error)
+	DeleteAlarm(ctx context.Context, session authn.Session, id string) error
+}
+
+type Repository interface {
+	CreateAlarm(ctx context.Context, alarm Alarm) (Alarm, error)
+	UpdateAlarm(ctx context.Context, alarm Alarm) (Alarm, error)
+	ViewAlarm(ctx context.Context, alarmID, domainID string) (Alarm, error)
+	ListAllAlarms(ctx context.Context, pm PageMetadata) (AlarmsPage, error)
+	DeleteAlarm(ctx context.Context, id string) error
+}

alarms/alarms_test.go

@@ -0,0 +1,173 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package alarms_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/internal/testsutil"
+	"github.com/absmach/magistrala/pkg/errors"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateAlarms(t *testing.T) {
+	cases := []struct {
+		desc  string
+		alarm alarms.Alarm
+		err   error
+	}{
+		{
+			desc: "valid alarm",
+			alarm: alarms.Alarm{
+				RuleID:      testsutil.GenerateUUID(t),
+				DomainID:    testsutil.GenerateUUID(t),
+				ChannelID:   testsutil.GenerateUUID(t),
+				ClientID:    testsutil.GenerateUUID(t),
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+			},
+			err: nil,
+		},
+		{
+			desc: "missing rule_id",
+			alarm: alarms.Alarm{
+				DomainID:    testsutil.GenerateUUID(t),
+				ChannelID:   testsutil.GenerateUUID(t),
+				ClientID:    testsutil.GenerateUUID(t),
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+			},
+			err: errors.New("rule_id is required"),
+		},
+		{
+			desc: "missing domain_id",
+			alarm: alarms.Alarm{
+				RuleID:      testsutil.GenerateUUID(t),
+				ChannelID:   testsutil.GenerateUUID(t),
+				ClientID:    testsutil.GenerateUUID(t),
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+			},
+			err: errors.New("domain_id is required"),
+		},
+		{
+			desc: "missing channel_id",
+			alarm: alarms.Alarm{
+				RuleID:      testsutil.GenerateUUID(t),
+				DomainID:    testsutil.GenerateUUID(t),
+				ClientID:    testsutil.GenerateUUID(t),
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+			},
+			err: errors.New("channel_id is required"),
+		},
+		{
+			desc: "missing client_id",
+			alarm: alarms.Alarm{
+				RuleID:      testsutil.GenerateUUID(t),
+				DomainID:    testsutil.GenerateUUID(t),
+				ChannelID:   testsutil.GenerateUUID(t),
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+			},
+			err: errors.New("client_id is required"),
+		},
+		{
+			desc: "missing measurement",
+			alarm: alarms.Alarm{
+				RuleID:    testsutil.GenerateUUID(t),
+				DomainID:  testsutil.GenerateUUID(t),
+				ChannelID: testsutil.GenerateUUID(t),
+				ClientID:  testsutil.GenerateUUID(t),
+				Subtopic:  "subtopic",
+				Value:     "value",
+				Unit:      "unit",
+				Cause:     "cause",
+				Severity:  100,
+			},
+			err: errors.New("measurement is required"),
+		},
+		{
+			desc: "missing value",
+			alarm: alarms.Alarm{
+				RuleID:      testsutil.GenerateUUID(t),
+				DomainID:    testsutil.GenerateUUID(t),
+				ChannelID:   testsutil.GenerateUUID(t),
+				ClientID:    testsutil.GenerateUUID(t),
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+			},
+			err: errors.New("value is required"),
+		},
+		{
+			desc: "missing cause",
+			alarm: alarms.Alarm{
+				RuleID:      testsutil.GenerateUUID(t),
+				DomainID:    testsutil.GenerateUUID(t),
+				ChannelID:   testsutil.GenerateUUID(t),
+				ClientID:    testsutil.GenerateUUID(t),
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Severity:    100,
+			},
+			err: errors.New("cause is required"),
+		},
+		{
+			desc: "higher severity",
+			alarm: alarms.Alarm{
+				RuleID:      testsutil.GenerateUUID(t),
+				DomainID:    testsutil.GenerateUUID(t),
+				ChannelID:   testsutil.GenerateUUID(t),
+				ClientID:    testsutil.GenerateUUID(t),
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    alarms.SeverityMax + 1,
+			},
+			err: alarms.ErrInvalidSeverity,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			err := tc.alarm.Validate()
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			require.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+		})
+	}
+}

alarms/api/doc.go

@@ -0,0 +1,6 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+// Package api contains API-related concerns: endpoint definitions, middlewares
+// and all resource representations.
+package api

alarms/api/endpoint.go

@@ -0,0 +1,104 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package api
+
+import (
+	"context"
+
+	"github.com/absmach/magistrala/alarms"
+	apiutil "github.com/absmach/magistrala/api/http/util"
+	"github.com/absmach/magistrala/pkg/authn"
+	"github.com/absmach/magistrala/pkg/errors"
+	svcerr "github.com/absmach/magistrala/pkg/errors/service"
+	"github.com/go-kit/kit/endpoint"
+)
+
+func updateAlarmEndpoint(svc alarms.Service) endpoint.Endpoint {
+	return func(ctx context.Context, request any) (any, error) {
+		req := request.(updateAlarmReq)
+		if err := req.validate(); err != nil {
+			return alarmRes{}, errors.Wrap(apiutil.ErrValidation, err)
+		}
+
+		session, ok := ctx.Value(authn.SessionKey).(authn.Session)
+		if !ok {
+			return alarmRes{}, svcerr.ErrAuthorization
+		}
+
+		alarm, err := svc.UpdateAlarm(ctx, session, req.Alarm)
+		if err != nil {
+			return alarmRes{}, err
+		}
+
+		return alarmRes{
+			Alarm: alarm,
+		}, nil
+	}
+}
+
+func viewAlarmEndpoint(svc alarms.Service) endpoint.Endpoint {
+	return func(ctx context.Context, request any) (any, error) {
+		req := request.(alarmReq)
+		if err := req.validate(); err != nil {
+			return alarmRes{}, errors.Wrap(apiutil.ErrValidation, err)
+		}
+
+		session, ok := ctx.Value(authn.SessionKey).(authn.Session)
+		if !ok {
+			return alarmRes{}, svcerr.ErrAuthorization
+		}
+
+		alarm, err := svc.ViewAlarm(ctx, session, req.ID)
+		if err != nil {
+			return alarmRes{}, err
+		}
+
+		return alarmRes{
+			Alarm: alarm,
+		}, nil
+	}
+}
+
+func listAlarmsEndpoint(svc alarms.Service) endpoint.Endpoint {
+	return func(ctx context.Context, request any) (any, error) {
+		req := request.(listAlarmsReq)
+		if err := req.validate(); err != nil {
+			return alarmsPageRes{}, errors.Wrap(apiutil.ErrValidation, err)
+		}
+
+		session, ok := ctx.Value(authn.SessionKey).(authn.Session)
+		if !ok {
+			return alarmsPageRes{}, svcerr.ErrAuthorization
+		}
+
+		alarms, err := svc.ListAlarms(ctx, session, req.PageMetadata)
+		if err != nil {
+			return alarmsPageRes{}, err
+		}
+
+		return alarmsPageRes{
+			AlarmsPage: alarms,
+		}, nil
+	}
+}
+
+func deleteAlarmEndpoint(svc alarms.Service) endpoint.Endpoint {
+	return func(ctx context.Context, request any) (any, error) {
+		req := request.(alarmReq)
+		if err := req.validate(); err != nil {
+			return alarmRes{}, errors.Wrap(apiutil.ErrValidation, err)
+		}
+
+		session, ok := ctx.Value(authn.SessionKey).(authn.Session)
+		if !ok {
+			return alarmRes{}, svcerr.ErrAuthorization
+		}
+
+		if err := svc.DeleteAlarm(ctx, session, req.ID); err != nil {
+			return alarmRes{}, err
+		}
+
+		return alarmRes{deleted: true}, nil
+	}
+}

alarms/api/requests.go

@@ -0,0 +1,59 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package api
+
+import (
+	"errors"
+
+	"github.com/absmach/magistrala/alarms"
+	api "github.com/absmach/magistrala/api/http"
+	apiutil "github.com/absmach/magistrala/api/http/util"
+)
+
+type alarmReq struct {
+	alarms.Alarm `json:",inline"`
+}
+
+func (req alarmReq) validate() error {
+	if req.Alarm.ID == "" {
+		return errors.New("missing alarm id")
+	}
+
+	return nil
+}
+
+type updateAlarmReq struct {
+	alarms.Alarm `json:",inline"`
+}
+
+func (req updateAlarmReq) validate() error {
+	if req.Alarm.ID == "" {
+		return errors.New("missing alarm id")
+	}
+	if req.Alarm.AssigneeID == "" && req.Alarm.AcknowledgedBy == "" && req.Alarm.ResolvedBy == "" && len(req.Alarm.Metadata) == 0 {
+		return errors.New("at least one of assignee_id, acknowledged_by, resolved_by, or metadata must be set")
+	}
+
+	return nil
+}
+
+type listAlarmsReq struct {
+	alarms.PageMetadata
+}
+
+func (req listAlarmsReq) validate() error {
+	if req.Limit > api.MaxLimitSize || req.Limit < 1 {
+		return apiutil.ErrLimitSize
+	}
+
+	if req.Order != "" && req.Order != api.UpdatedAtOrder && req.Order != api.CreatedAtOrder {
+		return apiutil.ErrInvalidOrder
+	}
+
+	if req.Dir != api.AscDir && req.Dir != api.DescDir {
+		return apiutil.ErrInvalidDirection
+	}
+
+	return nil
+}

alarms/api/responses.go

@@ -0,0 +1,70 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package api
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/absmach/magistrala"
+	"github.com/absmach/magistrala/alarms"
+)
+
+var (
+	_ magistrala.Response = (*alarmRes)(nil)
+	_ magistrala.Response = (*alarmsPageRes)(nil)
+)
+
+type alarmRes struct {
+	alarms.Alarm `json:",inline"`
+	created      bool
+	deleted      bool
+}
+
+func (res alarmRes) Headers() map[string]string {
+	switch {
+	case res.created:
+		return map[string]string{
+			"Location": fmt.Sprintf("/%s/alarms/%s", res.DomainID, res.ID),
+		}
+	default:
+		return map[string]string{}
+	}
+}
+
+func (res alarmRes) Code() int {
+	switch {
+	case res.created:
+		return http.StatusCreated
+	case res.deleted:
+		return http.StatusNoContent
+	default:
+		return http.StatusOK
+	}
+}
+
+func (res alarmRes) Empty() bool {
+	switch {
+	case res.deleted:
+		return true
+	default:
+		return false
+	}
+}
+
+type alarmsPageRes struct {
+	alarms.AlarmsPage `json:",inline"`
+}
+
+func (res alarmsPageRes) Headers() map[string]string {
+	return map[string]string{}
+}
+
+func (res alarmsPageRes) Code() int {
+	return http.StatusOK
+}
+
+func (res alarmsPageRes) Empty() bool {
+	return false
+}

alarms/api/transport.go

@@ -0,0 +1,209 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package api
+
+import (
+	"context"
+	"encoding/json"
+	"log/slog"
+	"math"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/absmach/magistrala"
+	"github.com/absmach/magistrala/alarms"
+	api "github.com/absmach/magistrala/api/http"
+	apiutil "github.com/absmach/magistrala/api/http/util"
+	smqauthn "github.com/absmach/magistrala/pkg/authn"
+	"github.com/absmach/magistrala/pkg/errors"
+	"github.com/go-chi/chi/v5"
+	kithttp "github.com/go-kit/kit/transport/http"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp"
+)
+
+func MakeHandler(svc alarms.Service, logger *slog.Logger, idp magistrala.IDProvider, instanceID string, authn smqauthn.AuthNMiddleware) http.Handler {
+	opts := []kithttp.ServerOption{
+		kithttp.ServerErrorEncoder(apiutil.LoggingErrorEncoder(logger, api.EncodeError)),
+	}
+
+	mux := chi.NewRouter()
+
+	mux.Route("/{domainID}/alarms", func(r chi.Router) {
+		r.Group(func(r chi.Router) {
+			r.Use(authn.WithOptions(smqauthn.WithDomainCheck(true)).Middleware())
+			r.Use(api.RequestIDMiddleware(idp))
+
+			r.Get("/", otelhttp.NewHandler(kithttp.NewServer(
+				listAlarmsEndpoint(svc),
+				decodeListAlarmsReq,
+				api.EncodeResponse,
+				opts...,
+			), "list_alarms").ServeHTTP)
+			r.Route("/{alarmID}", func(r chi.Router) {
+				r.Get("/", otelhttp.NewHandler(kithttp.NewServer(
+					viewAlarmEndpoint(svc),
+					decodeAlarmReq,
+					api.EncodeResponse,
+					opts...,
+				), "get_alarm").ServeHTTP)
+				r.Put("/", otelhttp.NewHandler(kithttp.NewServer(
+					updateAlarmEndpoint(svc),
+					decodeUpdateAlarmReq,
+					api.EncodeResponse,
+					opts...,
+				), "update_alarm").ServeHTTP)
+				r.Delete("/", otelhttp.NewHandler(kithttp.NewServer(
+					deleteAlarmEndpoint(svc),
+					decodeAlarmReq,
+					api.EncodeResponse,
+					opts...,
+				), "delete_alarm").ServeHTTP)
+			})
+		})
+	})
+
+	mux.Get("/health", magistrala.Health("alarms", instanceID))
+	mux.Handle("/metrics", promhttp.Handler())
+
+	return mux
+}
+
+func decodeListAlarmsReq(_ context.Context, r *http.Request) (any, error) {
+	offset, err := apiutil.ReadNumQuery[uint64](r, api.OffsetKey, api.DefOffset)
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	limit, err := apiutil.ReadNumQuery[uint64](r, api.LimitKey, api.DefLimit)
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	domainID, err := apiutil.ReadStringQuery(r, "domain_id", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	channelID, err := apiutil.ReadStringQuery(r, "channel_id", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	clientID, err := apiutil.ReadStringQuery(r, "client_id", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	subtopic, err := apiutil.ReadStringQuery(r, "subtopic", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	ruleID, err := apiutil.ReadStringQuery(r, "rule_id", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	s, err := apiutil.ReadStringQuery(r, api.StatusKey, alarms.All)
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	status, err := alarms.ToStatus(s)
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	assigneeID, err := apiutil.ReadStringQuery(r, "assignee_id", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	serverity, err := apiutil.ReadNumQuery(r, "severity", uint64(math.MaxUint8))
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	updatedBy, err := apiutil.ReadStringQuery(r, "updated_by", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	assignedBy, err := apiutil.ReadStringQuery(r, "assigned_by", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	acknowledgedBy, err := apiutil.ReadStringQuery(r, "acknowledged_by", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	resolvedBy, err := apiutil.ReadStringQuery(r, "resolved_by", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	cfrom, err := apiutil.ReadStringQuery(r, "created_from", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	cto, err := apiutil.ReadStringQuery(r, "created_to", "")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	order, err := apiutil.ReadStringQuery(r, api.OrderKey, api.DefOrder)
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+	dir, err := apiutil.ReadStringQuery(r, api.DirKey, "desc")
+	if err != nil {
+		return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+	}
+
+	var createdFrom, createdTo time.Time
+	if cfrom != "" {
+		if createdFrom, err = time.Parse(time.RFC3339, cfrom); err != nil {
+			return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+		}
+	}
+	if cto != "" {
+		if createdTo, err = time.Parse(time.RFC3339, cto); err != nil {
+			return listAlarmsReq{}, errors.Wrap(apiutil.ErrValidation, err)
+		}
+	}
+
+	return listAlarmsReq{
+		PageMetadata: alarms.PageMetadata{
+			Offset:         offset,
+			Limit:          limit,
+			DomainID:       domainID,
+			ChannelID:      channelID,
+			ClientID:       clientID,
+			Subtopic:       subtopic,
+			RuleID:         ruleID,
+			Status:         status,
+			AssigneeID:     assigneeID,
+			ResolvedBy:     resolvedBy,
+			Severity:       uint8(serverity),
+			UpdatedBy:      updatedBy,
+			AcknowledgedBy: acknowledgedBy,
+			AssignedBy:     assignedBy,
+			CreatedFrom:    createdFrom,
+			CreatedTo:      createdTo,
+			Dir:            dir,
+			Order:          order,
+		},
+	}, nil
+}
+
+func decodeAlarmReq(_ context.Context, r *http.Request) (any, error) {
+	return alarmReq{
+		Alarm: alarms.Alarm{
+			ID: chi.URLParam(r, "alarmID"),
+		},
+	}, nil
+}
+
+func decodeUpdateAlarmReq(_ context.Context, r *http.Request) (any, error) {
+	if !strings.Contains(r.Header.Get("Content-Type"), api.ContentType) {
+		return updateAlarmReq{}, apiutil.ErrUnsupportedContentType
+	}
+
+	req := updateAlarmReq{}
+	if err := json.NewDecoder(r.Body).Decode(&req.Alarm); err != nil {
+		return updateAlarmReq{}, errors.Wrap(apiutil.ErrMalformedRequestBody, err)
+	}
+
+	req.Alarm.ID = chi.URLParam(r, "alarmID")
+
+	return req, nil
+}

alarms/atom.go

@@ -0,0 +1,97 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package alarms
+
+import (
+	"context"
+	"time"
+
+	"github.com/absmach/magistrala/internal/atom"
+	"github.com/absmach/magistrala/pkg/authn"
+)
+
+type atomService struct {
+	Service
+	projector atom.Projector
+}
+
+func WithAtom(svc Service, projector atom.Projector) Service {
+	if projector == nil {
+		return svc
+	}
+	return atomService{Service: svc, projector: projector}
+}
+
+func (svc atomService) CreateAlarm(ctx context.Context, alarm Alarm) (Alarm, error) {
+	created, err := svc.Service.CreateAlarm(ctx, alarm)
+	if err != nil {
+		return created, err
+	}
+	if created.ID == "" {
+		return created, nil
+	}
+	if err := svc.projector.UpsertResource(ctx, alarmProjection(created)); err != nil {
+		return created, nil
+	}
+	return created, nil
+}
+
+func (svc atomService) UpdateAlarm(ctx context.Context, session authn.Session, alarm Alarm) (Alarm, error) {
+	updated, err := svc.Service.UpdateAlarm(ctx, session, alarm)
+	if err != nil {
+		return updated, err
+	}
+	if err := svc.projector.UpsertResource(ctx, alarmProjection(updated)); err != nil {
+		return updated, nil
+	}
+	return updated, nil
+}
+
+func (svc atomService) DeleteAlarm(ctx context.Context, session authn.Session, id string) error {
+	if err := svc.Service.DeleteAlarm(ctx, session, id); err != nil {
+		return err
+	}
+	_ = svc.projector.DeleteResource(ctx, id)
+	return nil
+}
+
+func alarmProjection(a Alarm) atom.Resource {
+	res := atom.ResourceFromFields(atom.ObjectFields{
+		ID:        a.ID,
+		Kind:      atom.KindAlarm,
+		Name:      a.Cause,
+		TenantID:  a.DomainID,
+		OwnerID:   a.AssigneeID,
+		Status:    a.Status.String(),
+		Metadata:  map[string]any(a.Metadata),
+		UpdatedBy: a.UpdatedBy,
+		CreatedAt: a.CreatedAt,
+		UpdatedAt: a.UpdatedAt,
+	})
+	res.Attributes["rule_id"] = a.RuleID
+	res.Attributes["channel_id"] = a.ChannelID
+	res.Attributes["client_id"] = a.ClientID
+	res.Attributes["subtopic"] = a.Subtopic
+	res.Attributes["severity"] = a.Severity
+	res.Attributes["measurement"] = a.Measurement
+	res.Attributes["value"] = a.Value
+	res.Attributes["unit"] = a.Unit
+	res.Attributes["threshold"] = a.Threshold
+	res.Attributes["cause"] = a.Cause
+	res.Attributes["assignee_id"] = a.AssigneeID
+	res.Attributes["assigned_at"] = alarmTimeString(a.AssignedAt)
+	res.Attributes["assigned_by"] = a.AssignedBy
+	res.Attributes["acknowledged_at"] = alarmTimeString(a.AcknowledgedAt)
+	res.Attributes["acknowledged_by"] = a.AcknowledgedBy
+	res.Attributes["resolved_at"] = alarmTimeString(a.ResolvedAt)
+	res.Attributes["resolved_by"] = a.ResolvedBy
+	return res
+}
+
+func alarmTimeString(ts time.Time) string {
+	if ts.IsZero() {
+		return ""
+	}
+	return ts.Format(time.RFC3339Nano)
+}

alarms/atom_test.go

@@ -0,0 +1,83 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package alarms
+
+import (
+	"context"
+	"testing"
+
+	"github.com/absmach/magistrala/internal/atom"
+	"github.com/absmach/magistrala/pkg/authn"
+)
+
+func TestAtomServiceCreateAlarmProjectsCreatedAlarm(t *testing.T) {
+	projector := &alarmProjector{}
+	svc := WithAtom(alarmService{
+		create: Alarm{
+			ID:          "alarm-1",
+			RuleID:      "rule-1",
+			DomainID:    "domain-1",
+			ChannelID:   "channel-1",
+			ClientID:    "client-1",
+			Cause:       "high temperature",
+			Measurement: "temperature",
+			Value:       "92.4",
+			Unit:        "C",
+			Threshold:   "80",
+			Severity:    90,
+			Status:      ActiveStatus,
+		},
+	}, projector)
+
+	created, err := svc.CreateAlarm(context.Background(), Alarm{RuleID: "rule-1"})
+	if err != nil {
+		t.Fatalf("create alarm: %v", err)
+	}
+	if created.ID != "alarm-1" {
+		t.Fatalf("unexpected created alarm: %#v", created)
+	}
+	if projector.resource.ID != "alarm-1" || projector.resource.Kind != atom.KindAlarm {
+		t.Fatalf("unexpected projection: %#v", projector.resource)
+	}
+	if projector.resource.Attributes["rule_id"] != "rule-1" {
+		t.Fatalf("missing rule projection: %#v", projector.resource.Attributes)
+	}
+	if projector.resource.Attributes["value"] != "92.4" || projector.resource.Attributes["threshold"] != "80" {
+		t.Fatalf("missing alarm value projection: %#v", projector.resource.Attributes)
+	}
+}
+
+type alarmService struct {
+	create Alarm
+}
+
+func (svc alarmService) CreateAlarm(context.Context, Alarm) (Alarm, error) {
+	return svc.create, nil
+}
+
+func (svc alarmService) UpdateAlarm(context.Context, authn.Session, Alarm) (Alarm, error) {
+	return Alarm{}, nil
+}
+
+func (svc alarmService) ViewAlarm(context.Context, authn.Session, string) (Alarm, error) {
+	return Alarm{}, nil
+}
+
+func (svc alarmService) ListAlarms(context.Context, authn.Session, PageMetadata) (AlarmsPage, error) {
+	return AlarmsPage{}, nil
+}
+
+func (svc alarmService) DeleteAlarm(context.Context, authn.Session, string) error {
+	return nil
+}
+
+type alarmProjector struct {
+	atom.Projector
+	resource atom.Resource
+}
+
+func (p *alarmProjector) UpsertResource(_ context.Context, resource atom.Resource) error {
+	p.resource = resource
+	return nil
+}

alarms/brokers/brokers_fluxmq.go

@@ -0,0 +1,53 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build msg_fluxmq
+// +build msg_fluxmq
+
+package brokers
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/absmach/magistrala/pkg/messaging"
+	broker "github.com/absmach/magistrala/pkg/messaging/fluxmq"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+const (
+	AllTopic = "alarms/#"
+
+	prefix = "alarms"
+)
+
+var cfg = jetstream.StreamConfig{
+	Name:              "alarms",
+	Description:       "Magistrala stream alarms",
+	Subjects:          []string{"alarms/#"},
+	Retention:         jetstream.LimitsPolicy,
+	MaxMsgsPerSubject: 1e6,
+	MaxAge:            time.Hour * 24,
+	MaxMsgSize:        1024 * 1024,
+	Discard:           jetstream.DiscardOld,
+	Storage:           jetstream.FileStorage,
+}
+
+func NewPubSub(ctx context.Context, url string, logger *slog.Logger) (messaging.PubSub, error) {
+	pb, err := broker.NewPubSub(ctx, url, logger, broker.Prefix(prefix), broker.JSStreamConfig(cfg), broker.ConnectionName("alarms-msg-pubsub"))
+	if err != nil {
+		return nil, err
+	}
+
+	return pb, nil
+}
+
+func NewPublisher(ctx context.Context, url string) (messaging.Publisher, error) {
+	pb, err := broker.NewPublisher(ctx, url, broker.Prefix(prefix), broker.JSStreamConfig(cfg), broker.ConnectionName("alarms-msg-pub"))
+	if err != nil {
+		return nil, err
+	}
+
+	return pb, nil
+}

alarms/brokers/brokers_nats.go

@@ -0,0 +1,53 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build !msg_fluxmq && !msg_rabbitmq && !rabbitmq
+// +build !msg_fluxmq,!msg_rabbitmq,!rabbitmq
+
+package brokers
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/absmach/magistrala/pkg/messaging"
+	broker "github.com/absmach/magistrala/pkg/messaging/nats"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+const (
+	AllTopic = "alarms/#"
+
+	prefix = "alarms"
+)
+
+var cfg = jetstream.StreamConfig{
+	Name:              "alarms",
+	Description:       "Magistrala stream alarms",
+	Subjects:          []string{"alarms.>"},
+	Retention:         jetstream.LimitsPolicy,
+	MaxMsgsPerSubject: 1e6,
+	MaxAge:            time.Hour * 24,
+	MaxMsgSize:        1024 * 1024,
+	Discard:           jetstream.DiscardOld,
+	Storage:           jetstream.FileStorage,
+}
+
+func NewPubSub(ctx context.Context, url string, logger *slog.Logger) (messaging.PubSub, error) {
+	pb, err := broker.NewPubSub(ctx, url, logger, broker.Prefix(prefix), broker.JSStreamConfig(cfg))
+	if err != nil {
+		return nil, err
+	}
+
+	return pb, nil
+}
+
+func NewPublisher(ctx context.Context, url string) (messaging.Publisher, error) {
+	pb, err := broker.NewPublisher(ctx, url, broker.Prefix(prefix), broker.JSStreamConfig(cfg))
+	if err != nil {
+		return nil, err
+	}
+
+	return pb, nil
+}

alarms/consumer/consumer.go

@@ -0,0 +1,57 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package consumer
+
+import (
+	"bytes"
+	"context"
+	"encoding/gob"
+	"log/slog"
+	"time"
+
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/pkg/errors"
+	"github.com/absmach/magistrala/pkg/messaging"
+)
+
+var errFailedToDecode = errors.New("failed to decode alarm")
+
+type handler struct {
+	svc    alarms.Service
+	logger *slog.Logger
+}
+
+func NewHandler(svc alarms.Service, logger *slog.Logger) messaging.MessageHandler {
+	return &handler{svc: svc, logger: logger}
+}
+
+func (h handler) Handle(msg *messaging.Message) (err error) {
+	if msg == nil {
+		return errors.New("message is empty")
+	}
+	if msg.GetPayload() == nil {
+		return errors.New("message payload is empty")
+	}
+
+	var alarm alarms.Alarm
+	if err := gob.NewDecoder(bytes.NewReader(msg.GetPayload())).Decode(&alarm); err != nil {
+		return messaging.NewError(errors.Wrap(errFailedToDecode, err), messaging.Term)
+	}
+	alarm.DomainID = msg.GetDomain()
+	alarm.ChannelID = msg.GetChannel()
+	alarm.ClientID = msg.ClientIdentity()
+	alarm.Subtopic = msg.GetSubtopic()
+	alarm.CreatedAt = time.Unix(0, int64(msg.GetCreated()))
+
+	if err := alarm.Validate(); err != nil {
+		return err
+	}
+
+	_, err = h.svc.CreateAlarm(context.Background(), alarm)
+	return err
+}
+
+func (h handler) Cancel() error {
+	return nil
+}

alarms/doc.go

@@ -0,0 +1,6 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+// Package alarms contains domain concept definitions needed to support
+// Alarms service feature, i.e. create, read, update, and delete alarms.
+package alarms

alarms/middleware/authorization.go

@@ -0,0 +1,197 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package middleware
+
+import (
+	"context"
+
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/alarms/operations"
+	"github.com/absmach/magistrala/auth"
+	"github.com/absmach/magistrala/internal/atom"
+	"github.com/absmach/magistrala/pkg/authn"
+	smqauthz "github.com/absmach/magistrala/pkg/authz"
+	"github.com/absmach/magistrala/pkg/errors"
+	svcerr "github.com/absmach/magistrala/pkg/errors/service"
+	"github.com/absmach/magistrala/pkg/permissions"
+	"github.com/absmach/magistrala/pkg/policies"
+)
+
+var (
+	errDomainUpdateAlarms = errors.New("not authorized to update alarms in domain")
+	errDomainDeleteAlarms = errors.New("not authorized to delete alarms in domain")
+	errDomainViewAlarms   = errors.New("not authorized to view alarms in domain")
+)
+
+type authorizationMiddleware struct {
+	svc         alarms.Service
+	authz       smqauthz.Authorization
+	atomAuthz   atom.Authorizer
+	entitiesOps permissions.EntitiesOperations[permissions.Operation]
+}
+
+var _ alarms.Service = (*authorizationMiddleware)(nil)
+
+func NewAuthorizationMiddleware(svc alarms.Service, authz smqauthz.Authorization, entitiesOps permissions.EntitiesOperations[permissions.Operation]) (alarms.Service, error) {
+	if err := entitiesOps.Validate(); err != nil {
+		return nil, err
+	}
+
+	return &authorizationMiddleware{
+		svc:         svc,
+		authz:       authz,
+		entitiesOps: entitiesOps,
+	}, nil
+}
+
+func NewAtomAuthorizationMiddleware(svc alarms.Service, authz atom.Authorizer, entitiesOps permissions.EntitiesOperations[permissions.Operation]) (alarms.Service, error) {
+	if err := entitiesOps.Validate(); err != nil {
+		return nil, err
+	}
+
+	return &authorizationMiddleware{
+		svc:         svc,
+		atomAuthz:   authz,
+		entitiesOps: entitiesOps,
+	}, nil
+}
+
+func (am *authorizationMiddleware) CreateAlarm(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error) {
+	return am.svc.CreateAlarm(ctx, alarm)
+}
+
+func (am *authorizationMiddleware) UpdateAlarm(ctx context.Context, session authn.Session, alarm alarms.Alarm) (alarms.Alarm, error) {
+	if len(alarm.Metadata) > 0 {
+		if err := am.authorize(ctx, operations.OpUpdateAlarm, session, policies.DomainType, session.DomainID); err != nil {
+			return alarms.Alarm{}, errors.Wrap(errDomainUpdateAlarms, err)
+		}
+	}
+
+	if alarm.AssigneeID != "" {
+		if err := am.authorize(ctx, operations.OpAssignAlarm, session, policies.DomainType, session.DomainID); err != nil {
+			return alarms.Alarm{}, errors.Wrap(errDomainUpdateAlarms, err)
+		}
+		if am.atomAuthz == nil {
+			domainUserID := auth.EncodeDomainUserID(session.DomainID, alarm.AssigneeID)
+			if err := am.authz.Authorize(ctx, smqauthz.PolicyReq{
+				Domain:      session.DomainID,
+				SubjectType: policies.UserType,
+				SubjectKind: policies.UsersKind,
+				Subject:     domainUserID,
+				Permission:  policies.MembershipPermission,
+				ObjectType:  policies.DomainType,
+				Object:      session.DomainID,
+			}, nil); err != nil {
+				return alarms.Alarm{}, err
+			}
+		}
+	}
+
+	if alarm.AcknowledgedBy != "" {
+		if err := am.authorize(ctx, operations.OpAcknowledgeAlarm, session, policies.DomainType, session.DomainID); err != nil {
+			return alarms.Alarm{}, errors.Wrap(errDomainUpdateAlarms, err)
+		}
+	}
+
+	if alarm.ResolvedBy != "" {
+		if err := am.authorize(ctx, operations.OpResolveAlarm, session, policies.DomainType, session.DomainID); err != nil {
+			return alarms.Alarm{}, errors.Wrap(errDomainUpdateAlarms, err)
+		}
+	}
+
+	return am.svc.UpdateAlarm(ctx, session, alarm)
+}
+
+func (am *authorizationMiddleware) DeleteAlarm(ctx context.Context, session authn.Session, id string) error {
+	if err := am.authorize(ctx, operations.OpDeleteAlarm, session, policies.DomainType, session.DomainID); err != nil {
+		return errors.Wrap(errDomainDeleteAlarms, err)
+	}
+
+	return am.svc.DeleteAlarm(ctx, session, id)
+}
+
+func (am *authorizationMiddleware) ListAlarms(ctx context.Context, session authn.Session, pm alarms.PageMetadata) (alarms.AlarmsPage, error) {
+	if pm.DomainID == "" {
+		pm.DomainID = session.DomainID
+	}
+
+	switch err := am.checkSuperAdmin(ctx, session); {
+	case err == nil:
+		session.SuperAdmin = true
+	case errors.Contains(err, svcerr.ErrSuperAdminAction):
+		if err := am.authorize(ctx, operations.OpListAlarms, session, operations.EntityType, auth.AnyIDs); err != nil {
+			return alarms.AlarmsPage{}, errors.Wrap(errDomainViewAlarms, err)
+		}
+	default:
+		return alarms.AlarmsPage{}, err
+	}
+
+	return am.svc.ListAlarms(ctx, session, pm)
+}
+
+func (am *authorizationMiddleware) ViewAlarm(ctx context.Context, session authn.Session, id string) (alarms.Alarm, error) {
+	if err := am.authorize(ctx, operations.OpViewAlarm, session, policies.DomainType, session.DomainID); err != nil {
+		return alarms.Alarm{}, errors.Wrap(errDomainViewAlarms, err)
+	}
+
+	return am.svc.ViewAlarm(ctx, session, id)
+}
+
+func (am *authorizationMiddleware) authorize(ctx context.Context, op permissions.Operation, session authn.Session, objType, obj string) error {
+	perm, err := am.entitiesOps.GetPermission(operations.EntityType, op)
+	if err != nil {
+		return err
+	}
+	if am.atomAuthz != nil {
+		return atom.Authorize(ctx, am.atomAuthz, session, perm.String(), objType, obj, atom.KindAlarm)
+	}
+
+	pr := smqauthz.PolicyReq{
+		Domain:      session.DomainID,
+		SubjectType: policies.UserType,
+		SubjectKind: policies.UsersKind,
+		Subject:     session.DomainUserID,
+		Object:      obj,
+		ObjectType:  objType,
+		Permission:  perm.String(),
+	}
+
+	var pat *smqauthz.PATReq
+	if session.PatID != "" {
+		opName := am.entitiesOps.OperationName(operations.EntityType, op)
+		pat = &smqauthz.PATReq{
+			UserID:     session.UserID,
+			PatID:      session.PatID,
+			EntityID:   auth.AnyIDs,
+			EntityType: auth.RulesType.String(),
+			Operation:  opName,
+			Domain:     session.DomainID,
+		}
+	}
+
+	if err := am.authz.Authorize(ctx, pr, pat); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (am *authorizationMiddleware) checkSuperAdmin(ctx context.Context, session authn.Session) error {
+	if session.Role != authn.SuperAdminRole {
+		return svcerr.ErrSuperAdminAction
+	}
+	if am.atomAuthz != nil {
+		return atom.Authorize(ctx, am.atomAuthz, session, policies.AdminPermission, policies.PlatformType, policies.MagistralaObject, policies.PlatformType)
+	}
+	if err := am.authz.Authorize(ctx, smqauthz.PolicyReq{
+		SubjectType: policies.UserType,
+		Subject:     session.UserID,
+		Permission:  policies.AdminPermission,
+		ObjectType:  policies.PlatformType,
+		Object:      policies.MagistralaObject,
+	}, nil); err != nil {
+		return err
+	}
+	return nil
+}

alarms/middleware/authorization_test.go

@@ -0,0 +1,109 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package middleware
+
+import (
+	"context"
+	"testing"
+
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/alarms/mocks"
+	"github.com/absmach/magistrala/alarms/operations"
+	"github.com/absmach/magistrala/auth"
+	"github.com/absmach/magistrala/internal/atom"
+	"github.com/absmach/magistrala/pkg/authn"
+	pkgerrors "github.com/absmach/magistrala/pkg/errors"
+	"github.com/absmach/magistrala/pkg/permissions"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+	"github.com/stretchr/testify/require"
+)
+
+type recordingAtomAuthorizer struct {
+	allowed bool
+	reqs    []atom.AuthzRequest
+}
+
+func (a *recordingAtomAuthorizer) CheckAuthz(_ context.Context, req atom.AuthzRequest) (atom.AuthzResponse, error) {
+	a.reqs = append(a.reqs, req)
+	return atom.AuthzResponse{Allowed: a.allowed}, nil
+}
+
+func TestListAlarmsAuthorizesRegularUser(t *testing.T) {
+	svc := mocks.NewService(t)
+	pm := alarms.PageMetadata{Limit: 10}
+	expectedPM := pm
+	expectedPM.DomainID = "domain-1"
+	session := authn.Session{UserID: "user-1", DomainID: "domain-1", DomainUserID: "domain-1_user-1"}
+	authz := &recordingAtomAuthorizer{allowed: true}
+	wrapped, err := NewAtomAuthorizationMiddleware(svc, authz, testEntitiesOps(t))
+	require.NoError(t, err)
+
+	svc.On("ListAlarms", mock.Anything, session, expectedPM).Return(alarms.AlarmsPage{Limit: 10}, nil).Once()
+	page, err := wrapped.ListAlarms(context.Background(), session, pm)
+
+	require.NoError(t, err)
+	assert.Equal(t, uint64(10), page.Limit)
+	require.Len(t, authz.reqs, 1)
+	assert.Equal(t, atom.AuthzRequest{
+		SubjectID:  "user-1",
+		Action:     "list",
+		ResourceID: auth.AnyIDs,
+		ObjectKind: "resource",
+		ObjectID:   auth.AnyIDs,
+		Context: map[string]any{
+			"domain_id":          "domain-1",
+			"legacy_object_type": operations.EntityType,
+		},
+	}, authz.reqs[0])
+}
+
+func TestListAlarmsDeniedRegularUserDoesNotDelegate(t *testing.T) {
+	svc := mocks.NewService(t)
+	authz := &recordingAtomAuthorizer{allowed: false}
+	wrapped, err := NewAtomAuthorizationMiddleware(svc, authz, testEntitiesOps(t))
+	require.NoError(t, err)
+
+	_, err = wrapped.ListAlarms(context.Background(), authn.Session{UserID: "user-1", DomainID: "domain-1"}, alarms.PageMetadata{})
+
+	assert.True(t, pkgerrors.Contains(err, pkgerrors.ErrAuthorization))
+	require.Len(t, authz.reqs, 1)
+}
+
+func TestListAlarmsSuperAdminSkipsListAuthorization(t *testing.T) {
+	svc := mocks.NewService(t)
+	pm := alarms.PageMetadata{Limit: 10}
+	expectedPM := pm
+	expectedPM.DomainID = "domain-1"
+	session := authn.Session{UserID: "admin-1", DomainID: "domain-1", Role: authn.SuperAdminRole}
+	authz := &recordingAtomAuthorizer{allowed: true}
+	wrapped, err := NewAtomAuthorizationMiddleware(svc, authz, testEntitiesOps(t))
+	require.NoError(t, err)
+
+	svc.On("ListAlarms", mock.Anything, mock.MatchedBy(func(s authn.Session) bool {
+		return s.SuperAdmin
+	}), expectedPM).Return(alarms.AlarmsPage{Limit: 10}, nil).Once()
+	_, err = wrapped.ListAlarms(context.Background(), session, pm)
+
+	require.NoError(t, err)
+	require.Len(t, authz.reqs, 1)
+	assert.Equal(t, "manage", authz.reqs[0].Action)
+}
+
+func testEntitiesOps(t *testing.T) permissions.EntitiesOperations[permissions.Operation] {
+	t.Helper()
+	details := operations.OperationDetails()
+	perms := make(map[string]permissions.Permission, len(details))
+	for _, detail := range details {
+		if detail.PermissionRequired {
+			perms[detail.Name] = permissions.Permission(detail.Name)
+		}
+	}
+	entitiesOps, err := permissions.NewEntitiesOperations(
+		permissions.EntitiesPermission{operations.EntityType: perms},
+		permissions.EntitiesOperationDetails[permissions.Operation]{operations.EntityType: details},
+	)
+	require.NoError(t, err)
+	return entitiesOps
+}

alarms/middleware/doc.go

@@ -0,0 +1,6 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+// Package middleware provides middleware for the alarms service.
+// This is logging, metrics, and tracing middleware.
+package middleware

alarms/middleware/logging.go

@@ -0,0 +1,155 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package middleware
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/pkg/authn"
+	"github.com/go-chi/chi/v5/middleware"
+)
+
+type loggingMiddleware struct {
+	logger  *slog.Logger
+	service alarms.Service
+}
+
+var _ alarms.Service = (*loggingMiddleware)(nil)
+
+func NewLoggingMiddleware(logger *slog.Logger, service alarms.Service) alarms.Service {
+	return &loggingMiddleware{
+		logger:  logger,
+		service: service,
+	}
+}
+
+func (lm *loggingMiddleware) CreateAlarm(ctx context.Context, alarm alarms.Alarm) (created alarms.Alarm, err error) {
+	defer func(begin time.Time) {
+		args := []any{
+			slog.String("duration", time.Since(begin).String()),
+			slog.String("request_id", middleware.GetReqID(ctx)),
+			slog.Group("alarm",
+				slog.String("rule_id", alarm.RuleID),
+				slog.String("domain_id", alarm.DomainID),
+				slog.String("channel_id", alarm.ChannelID),
+				slog.String("client_id", alarm.ClientID),
+				slog.String("subtopic", alarm.Subtopic),
+				slog.String("measurement", alarm.Measurement),
+				slog.String("value", alarm.Value),
+				slog.String("unit", alarm.Unit),
+				slog.Uint64("status", uint64(alarm.Status)),
+				slog.Uint64("severity", uint64(alarm.Severity)),
+				slog.String("threshold", alarm.Threshold),
+				slog.String("cause", alarm.Cause),
+			),
+		}
+		if err != nil {
+			args = append(args, slog.Any("error", err))
+			lm.logger.Warn("Create alarm failed", args...)
+			return
+		}
+		if created.ID != "" {
+			lm.logger.Info("Create alarm completed successfully", args...)
+		}
+	}(time.Now())
+
+	return lm.service.CreateAlarm(ctx, alarm)
+}
+
+func (lm *loggingMiddleware) UpdateAlarm(ctx context.Context, session authn.Session, alarm alarms.Alarm) (dba alarms.Alarm, err error) {
+	defer func(begin time.Time) {
+		args := []any{
+			slog.String("duration", time.Since(begin).String()),
+			slog.String("request_id", middleware.GetReqID(ctx)),
+			slog.Group("alarm",
+				slog.String("id", dba.ID),
+				slog.String("rule_id", dba.RuleID),
+				slog.String("domain_id", dba.DomainID),
+				slog.String("channel_id", dba.ChannelID),
+				slog.String("client_id", dba.ClientID),
+				slog.String("subtopic", dba.Subtopic),
+				slog.String("measurement", dba.Measurement),
+				slog.String("value", dba.Value),
+				slog.String("unit", dba.Unit),
+				slog.String("status", dba.Status.String()),
+				slog.Uint64("severity", uint64(dba.Severity)),
+				slog.String("threshold", dba.Threshold),
+				slog.String("cause", dba.Cause),
+			),
+		}
+		if err != nil {
+			args = append(args, slog.Any("error", err))
+			lm.logger.Warn("Update alarm failed", args...)
+			return
+		}
+		lm.logger.Info("Update alarm completed successfully", args...)
+	}(time.Now())
+
+	return lm.service.UpdateAlarm(ctx, session, alarm)
+}
+
+func (lm *loggingMiddleware) ViewAlarm(ctx context.Context, session authn.Session, id string) (dba alarms.Alarm, err error) {
+	defer func(begin time.Time) {
+		args := []any{
+			slog.String("duration", time.Since(begin).String()),
+			slog.String("request_id", middleware.GetReqID(ctx)),
+			slog.String("id", id),
+		}
+		if err != nil {
+			args = append(args, slog.Any("error", err))
+			lm.logger.Warn("View alarm failed", args...)
+			return
+		}
+		lm.logger.Info("View alarm completed successfully", args...)
+	}(time.Now())
+
+	return lm.service.ViewAlarm(ctx, session, id)
+}
+
+func (lm *loggingMiddleware) ListAlarms(ctx context.Context, session authn.Session, pm alarms.PageMetadata) (dbp alarms.AlarmsPage, err error) {
+	defer func(begin time.Time) {
+		args := []any{
+			slog.String("duration", time.Since(begin).String()),
+			slog.String("request_id", middleware.GetReqID(ctx)),
+			slog.Int("offset", int(pm.Offset)),
+			slog.Int("limit", int(pm.Limit)),
+			slog.String("rule_id", pm.RuleID),
+			slog.String("domain_id", pm.DomainID),
+			slog.String("channel_id", pm.ChannelID),
+			slog.String("client_id", pm.ClientID),
+			slog.String("subtopic", pm.Subtopic),
+			slog.String("status", pm.Status.String()),
+			slog.Uint64("severity", uint64(pm.Severity)),
+		}
+		if err != nil {
+			args = append(args, slog.Any("error", err))
+			lm.logger.Warn("List alarms failed", args...)
+			return
+		}
+		lm.logger.Info("List alarms completed successfully", args...)
+	}(time.Now())
+
+	return lm.service.ListAlarms(ctx, session, pm)
+}
+
+func (lm *loggingMiddleware) DeleteAlarm(ctx context.Context, session authn.Session, id string) (err error) {
+	defer func(begin time.Time) {
+		args := []any{
+			slog.String("duration", time.Since(begin).String()),
+			slog.String("request_id", middleware.GetReqID(ctx)),
+			slog.String("id", id),
+		}
+		if err != nil {
+			args = append(args, slog.Any("error", err))
+			lm.logger.Warn("Delete alarm failed", args...)
+			return
+		}
+		lm.logger.Info("Delete alarm completed successfully", args...)
+	}(time.Now())
+
+	return lm.service.DeleteAlarm(ctx, session, id)
+}

alarms/middleware/metrics.go

@@ -0,0 +1,74 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package middleware
+
+import (
+	"context"
+	"time"
+
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/pkg/authn"
+	"github.com/go-kit/kit/metrics"
+)
+
+type metricsMiddleware struct {
+	counter metrics.Counter
+	latency metrics.Histogram
+	service alarms.Service
+}
+
+var _ alarms.Service = (*metricsMiddleware)(nil)
+
+func NewMetricsMiddleware(counter metrics.Counter, latency metrics.Histogram, service alarms.Service) alarms.Service {
+	return &metricsMiddleware{
+		counter: counter,
+		latency: latency,
+		service: service,
+	}
+}
+
+func (mm *metricsMiddleware) CreateAlarm(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error) {
+	defer func(begin time.Time) {
+		mm.counter.With("method", "create_alarm").Add(1)
+		mm.latency.With("method", "create_alarm").Observe(time.Since(begin).Seconds())
+	}(time.Now())
+
+	return mm.service.CreateAlarm(ctx, alarm)
+}
+
+func (mm *metricsMiddleware) UpdateAlarm(ctx context.Context, session authn.Session, alarm alarms.Alarm) (alarms.Alarm, error) {
+	defer func(begin time.Time) {
+		mm.counter.With("method", "update_alarm").Add(1)
+		mm.latency.With("method", "update_alarm").Observe(time.Since(begin).Seconds())
+	}(time.Now())
+
+	return mm.service.UpdateAlarm(ctx, session, alarm)
+}
+
+func (mm *metricsMiddleware) ViewAlarm(ctx context.Context, session authn.Session, id string) (alarms.Alarm, error) {
+	defer func(begin time.Time) {
+		mm.counter.With("method", "get_alarm").Add(1)
+		mm.latency.With("method", "get_alarm").Observe(time.Since(begin).Seconds())
+	}(time.Now())
+
+	return mm.service.ViewAlarm(ctx, session, id)
+}
+
+func (mm *metricsMiddleware) ListAlarms(ctx context.Context, session authn.Session, pm alarms.PageMetadata) (alarms.AlarmsPage, error) {
+	defer func(begin time.Time) {
+		mm.counter.With("method", "list_alarms").Add(1)
+		mm.latency.With("method", "list_alarms").Observe(time.Since(begin).Seconds())
+	}(time.Now())
+
+	return mm.service.ListAlarms(ctx, session, pm)
+}
+
+func (mm *metricsMiddleware) DeleteAlarm(ctx context.Context, session authn.Session, id string) error {
+	defer func(begin time.Time) {
+		mm.counter.With("method", "delete_alarm").Add(1)
+		mm.latency.With("method", "delete_alarm").Observe(time.Since(begin).Seconds())
+	}(time.Now())
+
+	return mm.service.DeleteAlarm(ctx, session, id)
+}

alarms/middleware/tracing.go

@@ -0,0 +1,84 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package middleware
+
+import (
+	"context"
+
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/pkg/authn"
+	smqTracing "github.com/absmach/magistrala/pkg/tracing"
+	"go.opentelemetry.io/otel/attribute"
+	"go.opentelemetry.io/otel/trace"
+)
+
+type tracingMiddleware struct {
+	tracer trace.Tracer
+	svc    alarms.Service
+}
+
+var _ alarms.Service = (*tracingMiddleware)(nil)
+
+func NewTracingMiddleware(tracer trace.Tracer, svc alarms.Service) alarms.Service {
+	return &tracingMiddleware{
+		tracer: tracer,
+		svc:    svc,
+	}
+}
+
+func (tm *tracingMiddleware) CreateAlarm(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error) {
+	ctx, span := smqTracing.StartSpan(ctx, tm.tracer, "create_alarm", trace.WithAttributes(
+		attribute.String("rule_id", alarm.RuleID),
+		attribute.String("measurement", alarm.Measurement),
+		attribute.String("value", alarm.Value),
+		attribute.String("unit", alarm.Unit),
+		attribute.String("cause", alarm.Cause),
+		attribute.String("status", alarm.Status.String()),
+	))
+	defer span.End()
+
+	return tm.svc.CreateAlarm(ctx, alarm)
+}
+
+func (tm *tracingMiddleware) UpdateAlarm(ctx context.Context, session authn.Session, alarm alarms.Alarm) (alarms.Alarm, error) {
+	ctx, span := smqTracing.StartSpan(ctx, tm.tracer, "update_alarm", trace.WithAttributes(
+		attribute.String("rule_id", alarm.RuleID),
+		attribute.String("measurement", alarm.Measurement),
+		attribute.String("value", alarm.Value),
+		attribute.String("unit", alarm.Unit),
+		attribute.String("cause", alarm.Cause),
+		attribute.String("status", alarm.Status.String()),
+	))
+	defer span.End()
+
+	return tm.svc.UpdateAlarm(ctx, session, alarm)
+}
+
+func (tm *tracingMiddleware) ViewAlarm(ctx context.Context, session authn.Session, id string) (alarms.Alarm, error) {
+	ctx, span := smqTracing.StartSpan(ctx, tm.tracer, "get_alarm", trace.WithAttributes(
+		attribute.String("id", id),
+	))
+	defer span.End()
+
+	return tm.svc.ViewAlarm(ctx, session, id)
+}
+
+func (tm *tracingMiddleware) ListAlarms(ctx context.Context, session authn.Session, pm alarms.PageMetadata) (alarms.AlarmsPage, error) {
+	ctx, span := smqTracing.StartSpan(ctx, tm.tracer, "list_alarms", trace.WithAttributes(
+		attribute.Int("offset", int(pm.Offset)),
+		attribute.Int("limit", int(pm.Limit)),
+	))
+	defer span.End()
+
+	return tm.svc.ListAlarms(ctx, session, pm)
+}
+
+func (tm *tracingMiddleware) DeleteAlarm(ctx context.Context, session authn.Session, id string) error {
+	ctx, span := smqTracing.StartSpan(ctx, tm.tracer, "delete_alarm", trace.WithAttributes(
+		attribute.String("id", id),
+	))
+	defer span.End()
+
+	return tm.svc.DeleteAlarm(ctx, session, id)
+}

alarms/mocks/repository.go

@@ -0,0 +1,370 @@
+// Copyright (c) Abstract Machines
+
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package mocks
+
+import (
+	"context"
+
+	"github.com/absmach/magistrala/alarms"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewRepository creates a new instance of Repository. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewRepository(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Repository {
+	mock := &Repository{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// Repository is an autogenerated mock type for the Repository type
+type Repository struct {
+	mock.Mock
+}
+
+type Repository_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *Repository) EXPECT() *Repository_Expecter {
+	return &Repository_Expecter{mock: &_m.Mock}
+}
+
+// CreateAlarm provides a mock function for the type Repository
+func (_mock *Repository) CreateAlarm(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error) {
+	ret := _mock.Called(ctx, alarm)
+
+	if len(ret) == 0 {
+		panic("no return value specified for CreateAlarm")
+	}
+
+	var r0 alarms.Alarm
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, alarms.Alarm) (alarms.Alarm, error)); ok {
+		return returnFunc(ctx, alarm)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, alarms.Alarm) alarms.Alarm); ok {
+		r0 = returnFunc(ctx, alarm)
+	} else {
+		r0 = ret.Get(0).(alarms.Alarm)
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, alarms.Alarm) error); ok {
+		r1 = returnFunc(ctx, alarm)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// Repository_CreateAlarm_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CreateAlarm'
+type Repository_CreateAlarm_Call struct {
+	*mock.Call
+}
+
+// CreateAlarm is a helper method to define mock.On call
+//   - ctx context.Context
+//   - alarm alarms.Alarm
+func (_e *Repository_Expecter) CreateAlarm(ctx interface{}, alarm interface{}) *Repository_CreateAlarm_Call {
+	return &Repository_CreateAlarm_Call{Call: _e.mock.On("CreateAlarm", ctx, alarm)}
+}
+
+func (_c *Repository_CreateAlarm_Call) Run(run func(ctx context.Context, alarm alarms.Alarm)) *Repository_CreateAlarm_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 alarms.Alarm
+		if args[1] != nil {
+			arg1 = args[1].(alarms.Alarm)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *Repository_CreateAlarm_Call) Return(alarm1 alarms.Alarm, err error) *Repository_CreateAlarm_Call {
+	_c.Call.Return(alarm1, err)
+	return _c
+}
+
+func (_c *Repository_CreateAlarm_Call) RunAndReturn(run func(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error)) *Repository_CreateAlarm_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// DeleteAlarm provides a mock function for the type Repository
+func (_mock *Repository) DeleteAlarm(ctx context.Context, id string) error {
+	ret := _mock.Called(ctx, id)
+
+	if len(ret) == 0 {
+		panic("no return value specified for DeleteAlarm")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string) error); ok {
+		r0 = returnFunc(ctx, id)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// Repository_DeleteAlarm_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DeleteAlarm'
+type Repository_DeleteAlarm_Call struct {
+	*mock.Call
+}
+
+// DeleteAlarm is a helper method to define mock.On call
+//   - ctx context.Context
+//   - id string
+func (_e *Repository_Expecter) DeleteAlarm(ctx interface{}, id interface{}) *Repository_DeleteAlarm_Call {
+	return &Repository_DeleteAlarm_Call{Call: _e.mock.On("DeleteAlarm", ctx, id)}
+}
+
+func (_c *Repository_DeleteAlarm_Call) Run(run func(ctx context.Context, id string)) *Repository_DeleteAlarm_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *Repository_DeleteAlarm_Call) Return(err error) *Repository_DeleteAlarm_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *Repository_DeleteAlarm_Call) RunAndReturn(run func(ctx context.Context, id string) error) *Repository_DeleteAlarm_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ListAllAlarms provides a mock function for the type Repository
+func (_mock *Repository) ListAllAlarms(ctx context.Context, pm alarms.PageMetadata) (alarms.AlarmsPage, error) {
+	ret := _mock.Called(ctx, pm)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ListAllAlarms")
+	}
+
+	var r0 alarms.AlarmsPage
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, alarms.PageMetadata) (alarms.AlarmsPage, error)); ok {
+		return returnFunc(ctx, pm)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, alarms.PageMetadata) alarms.AlarmsPage); ok {
+		r0 = returnFunc(ctx, pm)
+	} else {
+		r0 = ret.Get(0).(alarms.AlarmsPage)
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, alarms.PageMetadata) error); ok {
+		r1 = returnFunc(ctx, pm)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// Repository_ListAllAlarms_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListAllAlarms'
+type Repository_ListAllAlarms_Call struct {
+	*mock.Call
+}
+
+// ListAllAlarms is a helper method to define mock.On call
+//   - ctx context.Context
+//   - pm alarms.PageMetadata
+func (_e *Repository_Expecter) ListAllAlarms(ctx interface{}, pm interface{}) *Repository_ListAllAlarms_Call {
+	return &Repository_ListAllAlarms_Call{Call: _e.mock.On("ListAllAlarms", ctx, pm)}
+}
+
+func (_c *Repository_ListAllAlarms_Call) Run(run func(ctx context.Context, pm alarms.PageMetadata)) *Repository_ListAllAlarms_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 alarms.PageMetadata
+		if args[1] != nil {
+			arg1 = args[1].(alarms.PageMetadata)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *Repository_ListAllAlarms_Call) Return(alarmsPage alarms.AlarmsPage, err error) *Repository_ListAllAlarms_Call {
+	_c.Call.Return(alarmsPage, err)
+	return _c
+}
+
+func (_c *Repository_ListAllAlarms_Call) RunAndReturn(run func(ctx context.Context, pm alarms.PageMetadata) (alarms.AlarmsPage, error)) *Repository_ListAllAlarms_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// UpdateAlarm provides a mock function for the type Repository
+func (_mock *Repository) UpdateAlarm(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error) {
+	ret := _mock.Called(ctx, alarm)
+
+	if len(ret) == 0 {
+		panic("no return value specified for UpdateAlarm")
+	}
+
+	var r0 alarms.Alarm
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, alarms.Alarm) (alarms.Alarm, error)); ok {
+		return returnFunc(ctx, alarm)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, alarms.Alarm) alarms.Alarm); ok {
+		r0 = returnFunc(ctx, alarm)
+	} else {
+		r0 = ret.Get(0).(alarms.Alarm)
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, alarms.Alarm) error); ok {
+		r1 = returnFunc(ctx, alarm)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// Repository_UpdateAlarm_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'UpdateAlarm'
+type Repository_UpdateAlarm_Call struct {
+	*mock.Call
+}
+
+// UpdateAlarm is a helper method to define mock.On call
+//   - ctx context.Context
+//   - alarm alarms.Alarm
+func (_e *Repository_Expecter) UpdateAlarm(ctx interface{}, alarm interface{}) *Repository_UpdateAlarm_Call {
+	return &Repository_UpdateAlarm_Call{Call: _e.mock.On("UpdateAlarm", ctx, alarm)}
+}
+
+func (_c *Repository_UpdateAlarm_Call) Run(run func(ctx context.Context, alarm alarms.Alarm)) *Repository_UpdateAlarm_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 alarms.Alarm
+		if args[1] != nil {
+			arg1 = args[1].(alarms.Alarm)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *Repository_UpdateAlarm_Call) Return(alarm1 alarms.Alarm, err error) *Repository_UpdateAlarm_Call {
+	_c.Call.Return(alarm1, err)
+	return _c
+}
+
+func (_c *Repository_UpdateAlarm_Call) RunAndReturn(run func(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error)) *Repository_UpdateAlarm_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ViewAlarm provides a mock function for the type Repository
+func (_mock *Repository) ViewAlarm(ctx context.Context, alarmID string, domainID string) (alarms.Alarm, error) {
+	ret := _mock.Called(ctx, alarmID, domainID)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ViewAlarm")
+	}
+
+	var r0 alarms.Alarm
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string) (alarms.Alarm, error)); ok {
+		return returnFunc(ctx, alarmID, domainID)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, string, string) alarms.Alarm); ok {
+		r0 = returnFunc(ctx, alarmID, domainID)
+	} else {
+		r0 = ret.Get(0).(alarms.Alarm)
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, string, string) error); ok {
+		r1 = returnFunc(ctx, alarmID, domainID)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// Repository_ViewAlarm_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ViewAlarm'
+type Repository_ViewAlarm_Call struct {
+	*mock.Call
+}
+
+// ViewAlarm is a helper method to define mock.On call
+//   - ctx context.Context
+//   - alarmID string
+//   - domainID string
+func (_e *Repository_Expecter) ViewAlarm(ctx interface{}, alarmID interface{}, domainID interface{}) *Repository_ViewAlarm_Call {
+	return &Repository_ViewAlarm_Call{Call: _e.mock.On("ViewAlarm", ctx, alarmID, domainID)}
+}
+
+func (_c *Repository_ViewAlarm_Call) Run(run func(ctx context.Context, alarmID string, domainID string)) *Repository_ViewAlarm_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 string
+		if args[1] != nil {
+			arg1 = args[1].(string)
+		}
+		var arg2 string
+		if args[2] != nil {
+			arg2 = args[2].(string)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *Repository_ViewAlarm_Call) Return(alarm alarms.Alarm, err error) *Repository_ViewAlarm_Call {
+	_c.Call.Return(alarm, err)
+	return _c
+}
+
+func (_c *Repository_ViewAlarm_Call) RunAndReturn(run func(ctx context.Context, alarmID string, domainID string) (alarms.Alarm, error)) *Repository_ViewAlarm_Call {
+	_c.Call.Return(run)
+	return _c
+}

alarms/mocks/service.go

@@ -0,0 +1,389 @@
+// Copyright (c) Abstract Machines
+
+// SPDX-License-Identifier: Apache-2.0
+
+// Code generated by mockery; DO NOT EDIT.
+// github.com/vektra/mockery
+// template: testify
+
+package mocks
+
+import (
+	"context"
+
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/pkg/authn"
+	mock "github.com/stretchr/testify/mock"
+)
+
+// NewService creates a new instance of Service. It also registers a testing interface on the mock and a cleanup function to assert the mocks expectations.
+// The first argument is typically a *testing.T value.
+func NewService(t interface {
+	mock.TestingT
+	Cleanup(func())
+}) *Service {
+	mock := &Service{}
+	mock.Mock.Test(t)
+
+	t.Cleanup(func() { mock.AssertExpectations(t) })
+
+	return mock
+}
+
+// Service is an autogenerated mock type for the Service type
+type Service struct {
+	mock.Mock
+}
+
+type Service_Expecter struct {
+	mock *mock.Mock
+}
+
+func (_m *Service) EXPECT() *Service_Expecter {
+	return &Service_Expecter{mock: &_m.Mock}
+}
+
+// CreateAlarm provides a mock function for the type Service
+func (_mock *Service) CreateAlarm(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error) {
+	ret := _mock.Called(ctx, alarm)
+
+	if len(ret) == 0 {
+		panic("no return value specified for CreateAlarm")
+	}
+
+	var r0 alarms.Alarm
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, alarms.Alarm) (alarms.Alarm, error)); ok {
+		return returnFunc(ctx, alarm)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, alarms.Alarm) alarms.Alarm); ok {
+		r0 = returnFunc(ctx, alarm)
+	} else {
+		r0 = ret.Get(0).(alarms.Alarm)
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, alarms.Alarm) error); ok {
+		r1 = returnFunc(ctx, alarm)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// Service_CreateAlarm_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'CreateAlarm'
+type Service_CreateAlarm_Call struct {
+	*mock.Call
+}
+
+// CreateAlarm is a helper method to define mock.On call
+//   - ctx context.Context
+//   - alarm alarms.Alarm
+func (_e *Service_Expecter) CreateAlarm(ctx interface{}, alarm interface{}) *Service_CreateAlarm_Call {
+	return &Service_CreateAlarm_Call{Call: _e.mock.On("CreateAlarm", ctx, alarm)}
+}
+
+func (_c *Service_CreateAlarm_Call) Run(run func(ctx context.Context, alarm alarms.Alarm)) *Service_CreateAlarm_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 alarms.Alarm
+		if args[1] != nil {
+			arg1 = args[1].(alarms.Alarm)
+		}
+		run(
+			arg0,
+			arg1,
+		)
+	})
+	return _c
+}
+
+func (_c *Service_CreateAlarm_Call) Return(alarm1 alarms.Alarm, err error) *Service_CreateAlarm_Call {
+	_c.Call.Return(alarm1, err)
+	return _c
+}
+
+func (_c *Service_CreateAlarm_Call) RunAndReturn(run func(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error)) *Service_CreateAlarm_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// DeleteAlarm provides a mock function for the type Service
+func (_mock *Service) DeleteAlarm(ctx context.Context, session authn.Session, id string) error {
+	ret := _mock.Called(ctx, session, id)
+
+	if len(ret) == 0 {
+		panic("no return value specified for DeleteAlarm")
+	}
+
+	var r0 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, authn.Session, string) error); ok {
+		r0 = returnFunc(ctx, session, id)
+	} else {
+		r0 = ret.Error(0)
+	}
+	return r0
+}
+
+// Service_DeleteAlarm_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'DeleteAlarm'
+type Service_DeleteAlarm_Call struct {
+	*mock.Call
+}
+
+// DeleteAlarm is a helper method to define mock.On call
+//   - ctx context.Context
+//   - session authn.Session
+//   - id string
+func (_e *Service_Expecter) DeleteAlarm(ctx interface{}, session interface{}, id interface{}) *Service_DeleteAlarm_Call {
+	return &Service_DeleteAlarm_Call{Call: _e.mock.On("DeleteAlarm", ctx, session, id)}
+}
+
+func (_c *Service_DeleteAlarm_Call) Run(run func(ctx context.Context, session authn.Session, id string)) *Service_DeleteAlarm_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 authn.Session
+		if args[1] != nil {
+			arg1 = args[1].(authn.Session)
+		}
+		var arg2 string
+		if args[2] != nil {
+			arg2 = args[2].(string)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *Service_DeleteAlarm_Call) Return(err error) *Service_DeleteAlarm_Call {
+	_c.Call.Return(err)
+	return _c
+}
+
+func (_c *Service_DeleteAlarm_Call) RunAndReturn(run func(ctx context.Context, session authn.Session, id string) error) *Service_DeleteAlarm_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ListAlarms provides a mock function for the type Service
+func (_mock *Service) ListAlarms(ctx context.Context, session authn.Session, pm alarms.PageMetadata) (alarms.AlarmsPage, error) {
+	ret := _mock.Called(ctx, session, pm)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ListAlarms")
+	}
+
+	var r0 alarms.AlarmsPage
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, authn.Session, alarms.PageMetadata) (alarms.AlarmsPage, error)); ok {
+		return returnFunc(ctx, session, pm)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, authn.Session, alarms.PageMetadata) alarms.AlarmsPage); ok {
+		r0 = returnFunc(ctx, session, pm)
+	} else {
+		r0 = ret.Get(0).(alarms.AlarmsPage)
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, authn.Session, alarms.PageMetadata) error); ok {
+		r1 = returnFunc(ctx, session, pm)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// Service_ListAlarms_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ListAlarms'
+type Service_ListAlarms_Call struct {
+	*mock.Call
+}
+
+// ListAlarms is a helper method to define mock.On call
+//   - ctx context.Context
+//   - session authn.Session
+//   - pm alarms.PageMetadata
+func (_e *Service_Expecter) ListAlarms(ctx interface{}, session interface{}, pm interface{}) *Service_ListAlarms_Call {
+	return &Service_ListAlarms_Call{Call: _e.mock.On("ListAlarms", ctx, session, pm)}
+}
+
+func (_c *Service_ListAlarms_Call) Run(run func(ctx context.Context, session authn.Session, pm alarms.PageMetadata)) *Service_ListAlarms_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 authn.Session
+		if args[1] != nil {
+			arg1 = args[1].(authn.Session)
+		}
+		var arg2 alarms.PageMetadata
+		if args[2] != nil {
+			arg2 = args[2].(alarms.PageMetadata)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *Service_ListAlarms_Call) Return(alarmsPage alarms.AlarmsPage, err error) *Service_ListAlarms_Call {
+	_c.Call.Return(alarmsPage, err)
+	return _c
+}
+
+func (_c *Service_ListAlarms_Call) RunAndReturn(run func(ctx context.Context, session authn.Session, pm alarms.PageMetadata) (alarms.AlarmsPage, error)) *Service_ListAlarms_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// UpdateAlarm provides a mock function for the type Service
+func (_mock *Service) UpdateAlarm(ctx context.Context, session authn.Session, alarm alarms.Alarm) (alarms.Alarm, error) {
+	ret := _mock.Called(ctx, session, alarm)
+
+	if len(ret) == 0 {
+		panic("no return value specified for UpdateAlarm")
+	}
+
+	var r0 alarms.Alarm
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, authn.Session, alarms.Alarm) (alarms.Alarm, error)); ok {
+		return returnFunc(ctx, session, alarm)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, authn.Session, alarms.Alarm) alarms.Alarm); ok {
+		r0 = returnFunc(ctx, session, alarm)
+	} else {
+		r0 = ret.Get(0).(alarms.Alarm)
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, authn.Session, alarms.Alarm) error); ok {
+		r1 = returnFunc(ctx, session, alarm)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// Service_UpdateAlarm_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'UpdateAlarm'
+type Service_UpdateAlarm_Call struct {
+	*mock.Call
+}
+
+// UpdateAlarm is a helper method to define mock.On call
+//   - ctx context.Context
+//   - session authn.Session
+//   - alarm alarms.Alarm
+func (_e *Service_Expecter) UpdateAlarm(ctx interface{}, session interface{}, alarm interface{}) *Service_UpdateAlarm_Call {
+	return &Service_UpdateAlarm_Call{Call: _e.mock.On("UpdateAlarm", ctx, session, alarm)}
+}
+
+func (_c *Service_UpdateAlarm_Call) Run(run func(ctx context.Context, session authn.Session, alarm alarms.Alarm)) *Service_UpdateAlarm_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 authn.Session
+		if args[1] != nil {
+			arg1 = args[1].(authn.Session)
+		}
+		var arg2 alarms.Alarm
+		if args[2] != nil {
+			arg2 = args[2].(alarms.Alarm)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *Service_UpdateAlarm_Call) Return(alarm1 alarms.Alarm, err error) *Service_UpdateAlarm_Call {
+	_c.Call.Return(alarm1, err)
+	return _c
+}
+
+func (_c *Service_UpdateAlarm_Call) RunAndReturn(run func(ctx context.Context, session authn.Session, alarm alarms.Alarm) (alarms.Alarm, error)) *Service_UpdateAlarm_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// ViewAlarm provides a mock function for the type Service
+func (_mock *Service) ViewAlarm(ctx context.Context, session authn.Session, id string) (alarms.Alarm, error) {
+	ret := _mock.Called(ctx, session, id)
+
+	if len(ret) == 0 {
+		panic("no return value specified for ViewAlarm")
+	}
+
+	var r0 alarms.Alarm
+	var r1 error
+	if returnFunc, ok := ret.Get(0).(func(context.Context, authn.Session, string) (alarms.Alarm, error)); ok {
+		return returnFunc(ctx, session, id)
+	}
+	if returnFunc, ok := ret.Get(0).(func(context.Context, authn.Session, string) alarms.Alarm); ok {
+		r0 = returnFunc(ctx, session, id)
+	} else {
+		r0 = ret.Get(0).(alarms.Alarm)
+	}
+	if returnFunc, ok := ret.Get(1).(func(context.Context, authn.Session, string) error); ok {
+		r1 = returnFunc(ctx, session, id)
+	} else {
+		r1 = ret.Error(1)
+	}
+	return r0, r1
+}
+
+// Service_ViewAlarm_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'ViewAlarm'
+type Service_ViewAlarm_Call struct {
+	*mock.Call
+}
+
+// ViewAlarm is a helper method to define mock.On call
+//   - ctx context.Context
+//   - session authn.Session
+//   - id string
+func (_e *Service_Expecter) ViewAlarm(ctx interface{}, session interface{}, id interface{}) *Service_ViewAlarm_Call {
+	return &Service_ViewAlarm_Call{Call: _e.mock.On("ViewAlarm", ctx, session, id)}
+}
+
+func (_c *Service_ViewAlarm_Call) Run(run func(ctx context.Context, session authn.Session, id string)) *Service_ViewAlarm_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		var arg0 context.Context
+		if args[0] != nil {
+			arg0 = args[0].(context.Context)
+		}
+		var arg1 authn.Session
+		if args[1] != nil {
+			arg1 = args[1].(authn.Session)
+		}
+		var arg2 string
+		if args[2] != nil {
+			arg2 = args[2].(string)
+		}
+		run(
+			arg0,
+			arg1,
+			arg2,
+		)
+	})
+	return _c
+}
+
+func (_c *Service_ViewAlarm_Call) Return(alarm alarms.Alarm, err error) *Service_ViewAlarm_Call {
+	_c.Call.Return(alarm, err)
+	return _c
+}
+
+func (_c *Service_ViewAlarm_Call) RunAndReturn(run func(ctx context.Context, session authn.Session, id string) (alarms.Alarm, error)) *Service_ViewAlarm_Call {
+	_c.Call.Return(run)
+	return _c
+}

alarms/operations/operations.go

@@ -0,0 +1,52 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package operations
+
+import "github.com/absmach/magistrala/pkg/permissions"
+
+const EntityType = "alarm"
+
+// Alarm Operations.
+const (
+	OpViewAlarm permissions.Operation = iota
+	OpDeleteAlarm
+	OpListAlarms
+	OpAssignAlarm
+	OpAcknowledgeAlarm
+	OpResolveAlarm
+	OpUpdateAlarm
+)
+
+func OperationDetails() map[permissions.Operation]permissions.OperationDetails {
+	return map[permissions.Operation]permissions.OperationDetails{
+		OpViewAlarm: {
+			Name:               "view",
+			PermissionRequired: true,
+		},
+		OpDeleteAlarm: {
+			Name:               "delete",
+			PermissionRequired: true,
+		},
+		OpListAlarms: {
+			Name:               "list",
+			PermissionRequired: true,
+		},
+		OpAssignAlarm: {
+			Name:               "alarm_assign",
+			PermissionRequired: true,
+		},
+		OpAcknowledgeAlarm: {
+			Name:               "alarm_acknowledge",
+			PermissionRequired: true,
+		},
+		OpResolveAlarm: {
+			Name:               "alarm_resolve",
+			PermissionRequired: true,
+		},
+		OpUpdateAlarm: {
+			Name:               "update",
+			PermissionRequired: true,
+		},
+	}
+}

alarms/postgres/alarms.go

@@ -0,0 +1,507 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package postgres
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"fmt"
+	"math"
+	"strings"
+	"time"
+
+	"github.com/absmach/magistrala/alarms"
+	api "github.com/absmach/magistrala/api/http"
+	"github.com/absmach/magistrala/pkg/errors"
+	repoerr "github.com/absmach/magistrala/pkg/errors/repository"
+	"github.com/absmach/magistrala/pkg/postgres"
+	"github.com/jmoiron/sqlx"
+)
+
+const alarmColumns = `alarms.id, alarms.rule_id, alarms.domain_id, alarms.channel_id, alarms.client_id, alarms.subtopic, alarms.measurement, alarms.value, alarms.unit,
+alarms.threshold, alarms.cause, alarms.status, alarms.severity, alarms.assignee_id, alarms.created_at, alarms.updated_at, alarms.updated_by, alarms.assigned_at,
+alarms.assigned_by, alarms.acknowledged_at, alarms.acknowledged_by, alarms.resolved_at, alarms.resolved_by, alarms.metadata`
+
+type repository struct {
+	db *sqlx.DB
+}
+
+var _ alarms.Repository = (*repository)(nil)
+
+func NewAlarmsRepo(db *sqlx.DB) alarms.Repository {
+	return &repository{db: db}
+}
+
+func (r *repository) CreateAlarm(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error) {
+	query := `
+	WITH existing AS (
+		SELECT status, severity
+		FROM alarms
+		WHERE domain_id = :domain_id
+			AND rule_id = :rule_id
+			AND channel_id = :channel_id
+			AND client_id = :client_id
+			AND subtopic = :subtopic
+			AND measurement = :measurement
+			AND created_at <= :created_at
+		ORDER BY created_at DESC
+		LIMIT 1
+	)
+	INSERT INTO alarms (
+		id, rule_id, domain_id, channel_id, client_id, subtopic, measurement,
+		value, unit, threshold, cause, status, severity, assignee_id,
+		created_at, updated_at, updated_by, assigned_at, assigned_by,
+		acknowledged_at, acknowledged_by, resolved_at, resolved_by, metadata
+	)
+	SELECT
+		:id, :rule_id, :domain_id, :channel_id, :client_id, :subtopic, :measurement,
+		:value, :unit, :threshold, :cause, :status, :severity, :assignee_id,
+		:created_at, :updated_at, :updated_by, :assigned_at, :assigned_by,
+		:acknowledged_at, :acknowledged_by, :resolved_at, :resolved_by, :metadata
+	WHERE (
+		EXISTS (
+			SELECT 1 FROM existing
+			WHERE existing.status IS DISTINCT FROM :status
+			OR (:status = 0 AND existing.status = 0 AND existing.severity IS DISTINCT FROM :severity)
+		)
+		OR (
+			NOT EXISTS (SELECT 1 FROM existing) AND :status = 0
+		)
+	)
+	RETURNING
+		id, rule_id, domain_id, channel_id, client_id, subtopic, measurement,
+		value, unit, threshold, cause, status, severity, created_at,
+		assignee_id, updated_at, updated_by, assigned_at, assigned_by,
+		acknowledged_at, acknowledged_by, resolved_at, resolved_by, metadata
+	;
+	`
+	dba, err := toDBAlarm(alarm)
+	if err != nil {
+		return alarms.Alarm{}, errors.Wrap(repoerr.ErrCreateEntity, err)
+	}
+	row, err := r.db.NamedQueryContext(ctx, query, dba)
+	if err != nil {
+		return alarms.Alarm{}, postgres.HandleError(repoerr.ErrCreateEntity, err)
+	}
+	defer row.Close()
+
+	if !row.Next() {
+		return alarms.Alarm{}, repoerr.ErrNotFound
+	}
+
+	dba = dbAlarm{}
+	if err := row.StructScan(&dba); err != nil {
+		return alarms.Alarm{}, errors.Wrap(repoerr.ErrCreateEntity, err)
+	}
+
+	return toAlarm(dba)
+}
+
+func (r *repository) UpdateAlarm(ctx context.Context, alarm alarms.Alarm) (alarms.Alarm, error) {
+	var query []string
+	var upq string
+	if alarm.Status != 0 {
+		query = append(query, "status = :status,")
+	}
+	if alarm.AssigneeID != "" {
+		query = append(query, "assignee_id = :assignee_id,")
+	}
+	if !alarm.AssignedAt.IsZero() {
+		query = append(query, "assigned_at = :assigned_at,")
+	}
+	if alarm.AssignedBy != "" {
+		query = append(query, "assigned_by = :assigned_by,")
+	}
+	if alarm.AcknowledgedBy != "" {
+		query = append(query, "acknowledged_by = :acknowledged_by,")
+	}
+	if !alarm.AcknowledgedAt.IsZero() {
+		query = append(query, "acknowledged_at = :acknowledged_at,")
+	}
+	if alarm.ResolvedBy != "" {
+		query = append(query, "resolved_by = :resolved_by,")
+	}
+	if !alarm.ResolvedAt.IsZero() {
+		query = append(query, "resolved_at = :resolved_at,")
+	}
+	if alarm.Metadata != nil {
+		query = append(query, "metadata = :metadata,")
+	}
+	if len(query) > 0 {
+		upq = strings.Join(query, " ")
+	}
+
+	q := fmt.Sprintf(`UPDATE alarms SET %s updated_by = :updated_by, updated_at = :updated_at WHERE id = :id
+		RETURNING id, rule_id, domain_id, channel_id, client_id, subtopic, measurement, value, unit, threshold,
+		cause, status, severity, assignee_id, assigned_at, assigned_by, acknowledged_at, acknowledged_by,
+		resolved_by, resolved_at, metadata, created_at, updated_by, updated_at;`, upq)
+
+	dba, err := toDBAlarm(alarm)
+	if err != nil {
+		return alarms.Alarm{}, errors.Wrap(repoerr.ErrUpdateEntity, err)
+	}
+	row, err := r.db.NamedQueryContext(ctx, q, dba)
+	if err != nil {
+		return alarms.Alarm{}, postgres.HandleError(repoerr.ErrUpdateEntity, err)
+	}
+	defer row.Close()
+
+	if !row.Next() {
+		return alarms.Alarm{}, repoerr.ErrNotFound
+	}
+
+	dba = dbAlarm{}
+	if err := row.StructScan(&dba); err != nil {
+		return alarms.Alarm{}, errors.Wrap(repoerr.ErrUpdateEntity, err)
+	}
+
+	return toAlarm(dba)
+}
+
+func (r *repository) ViewAlarm(ctx context.Context, alarmID, domainID string) (alarms.Alarm, error) {
+	query := `SELECT * FROM alarms WHERE id = :id AND domain_id = :domain_id;`
+	row, err := r.db.NamedQueryContext(ctx, query, map[string]any{
+		"id": alarmID, "domain_id": domainID,
+	})
+	if err != nil {
+		return alarms.Alarm{}, postgres.HandleError(repoerr.ErrViewEntity, err)
+	}
+	defer row.Close()
+
+	if !row.Next() {
+		return alarms.Alarm{}, repoerr.ErrNotFound
+	}
+
+	dba := dbAlarm{}
+	if err := row.StructScan(&dba); err != nil {
+		return alarms.Alarm{}, errors.Wrap(repoerr.ErrViewEntity, err)
+	}
+
+	alarm, err := toAlarm(dba)
+	if err != nil {
+		return alarms.Alarm{}, errors.Wrap(repoerr.ErrViewEntity, err)
+	}
+
+	return alarm, nil
+}
+
+func (r *repository) ListAllAlarms(ctx context.Context, pm alarms.PageMetadata) (alarms.AlarmsPage, error) {
+	query, err := pageQuery(pm)
+	if err != nil {
+		return alarms.AlarmsPage{}, errors.Wrap(repoerr.ErrViewEntity, err)
+	}
+
+	comQuery := fmt.Sprintf(`SELECT %s FROM alarms %s`, alarmColumns, query)
+
+	return r.alarmsPage(ctx, comQuery, pm)
+}
+
+func (r *repository) alarmsPage(ctx context.Context, comQuery string, pm alarms.PageMetadata) (alarms.AlarmsPage, error) {
+	dir := api.DescDir
+	if pm.Dir == api.AscDir {
+		dir = api.AscDir
+	}
+
+	var orderClause string
+	switch pm.Order {
+	case api.CreatedAtOrder:
+		orderClause = fmt.Sprintf("ORDER BY created_at %s, id %s", dir, dir)
+	default:
+		orderClause = fmt.Sprintf("ORDER BY COALESCE(updated_at, created_at) %s, id %s", dir, dir)
+	}
+
+	q := fmt.Sprintf(`SELECT * FROM (%s) AS sub_query %s LIMIT :limit OFFSET :offset;`, comQuery, orderClause)
+	cq := fmt.Sprintf(`SELECT COUNT(*) AS total_count FROM (%s) AS sub_query;`, comQuery)
+
+	rows, err := r.db.NamedQueryContext(ctx, q, pm)
+	if err != nil {
+		return alarms.AlarmsPage{}, errors.Wrap(repoerr.ErrViewEntity, err)
+	}
+	defer rows.Close()
+
+	var items []alarms.Alarm
+	for rows.Next() {
+		dba := dbAlarm{}
+		if err := rows.StructScan(&dba); err != nil {
+			return alarms.AlarmsPage{}, errors.Wrap(repoerr.ErrViewEntity, err)
+		}
+
+		a, err := toAlarm(dba)
+		if err != nil {
+			return alarms.AlarmsPage{}, err
+		}
+
+		items = append(items, a)
+	}
+
+	total, err := postgres.Total(ctx, r.db, cq, pm)
+	if err != nil {
+		return alarms.AlarmsPage{}, errors.Wrap(repoerr.ErrViewEntity, err)
+	}
+
+	return alarms.AlarmsPage{
+		Total:  total,
+		Offset: pm.Offset,
+		Limit:  pm.Limit,
+		Alarms: items,
+	}, nil
+}
+
+func (r *repository) DeleteAlarm(ctx context.Context, id string) error {
+	query := `DELETE FROM alarms WHERE id = :id;`
+	result, err := r.db.NamedExecContext(ctx, query, map[string]any{"id": id})
+	if err != nil {
+		return errors.Wrap(repoerr.ErrRemoveEntity, err)
+	}
+
+	rowsAffected, err := result.RowsAffected()
+	if err != nil {
+		return errors.Wrap(repoerr.ErrRemoveEntity, err)
+	}
+
+	if rowsAffected == 0 {
+		return repoerr.ErrNotFound
+	}
+
+	return nil
+}
+
+type dbAlarm struct {
+	ID             string        `db:"id"`
+	RuleID         string        `db:"rule_id"`
+	DomainID       string        `db:"domain_id"`
+	ChannelID      string        `db:"channel_id"`
+	ClientID       string        `db:"client_id"`
+	Subtopic       string        `db:"subtopic"`
+	Measurement    string        `db:"measurement"`
+	Value          string        `db:"value"`
+	Unit           string        `db:"unit"`
+	Cause          string        `db:"cause"`
+	Threshold      string        `db:"threshold"`
+	Status         alarms.Status `db:"status"`
+	Severity       uint8         `db:"severity"`
+	AssigneeID     string        `db:"assignee_id"`
+	CreatedAt      time.Time     `db:"created_at"`
+	UpdatedAt      sql.NullTime  `db:"updated_at,omitempty"`
+	UpdatedBy      *string       `db:"updated_by,omitempty"`
+	AssignedAt     sql.NullTime  `db:"assigned_at,omitempty"`
+	AssignedBy     *string       `db:"assigned_by,omitempty"`
+	AcknowledgedAt sql.NullTime  `db:"acknowledged_at,omitempty"`
+	AcknowledgedBy *string       `db:"acknowledged_by,omitempty"`
+	ResolvedAt     sql.NullTime  `db:"resolved_at,omitempty"`
+	ResolvedBy     *string       `db:"resolved_by,omitempty"`
+	Metadata       []byte        `db:"metadata,omitempty"`
+}
+
+func toDBAlarm(a alarms.Alarm) (dbAlarm, error) {
+	if a.CreatedAt.IsZero() {
+		a.CreatedAt = time.Now()
+	}
+	var updatedBy *string
+	if a.UpdatedBy != "" {
+		updatedBy = &a.UpdatedBy
+	}
+	var updatedAt sql.NullTime
+	if a.UpdatedAt != (time.Time{}) {
+		updatedAt = sql.NullTime{Time: a.UpdatedAt, Valid: true}
+	}
+
+	var acknowledgedBy *string
+	if a.AcknowledgedBy != "" {
+		acknowledgedBy = &a.AcknowledgedBy
+	}
+	var acknowledgedAt sql.NullTime
+	if a.AcknowledgedAt != (time.Time{}) {
+		acknowledgedAt = sql.NullTime{Time: a.AcknowledgedAt, Valid: true}
+	}
+
+	var resolvedBy *string
+	if a.ResolvedBy != "" {
+		resolvedBy = &a.ResolvedBy
+	}
+	var resolvedAt sql.NullTime
+	if a.ResolvedAt != (time.Time{}) {
+		resolvedAt = sql.NullTime{Time: a.ResolvedAt, Valid: true}
+	}
+
+	var assignedBy *string
+	if a.AssignedBy != "" {
+		assignedBy = &a.AssignedBy
+	}
+	var assignedAt sql.NullTime
+	if a.AssignedAt != (time.Time{}) {
+		assignedAt = sql.NullTime{Time: a.AssignedAt, Valid: true}
+	}
+
+	metadata := []byte("{}")
+	if len(a.Metadata) > 0 {
+		b, err := json.Marshal(a.Metadata)
+		if err != nil {
+			return dbAlarm{}, errors.Wrap(repoerr.ErrMalformedEntity, err)
+		}
+		metadata = b
+	}
+
+	return dbAlarm{
+		ID:             a.ID,
+		RuleID:         a.RuleID,
+		DomainID:       a.DomainID,
+		ChannelID:      a.ChannelID,
+		ClientID:       a.ClientID,
+		Subtopic:       a.Subtopic,
+		Measurement:    a.Measurement,
+		Value:          a.Value,
+		Unit:           a.Unit,
+		Cause:          a.Cause,
+		Threshold:      a.Threshold,
+		Status:         a.Status,
+		Severity:       a.Severity,
+		AssigneeID:     a.AssigneeID,
+		CreatedAt:      a.CreatedAt,
+		UpdatedAt:      updatedAt,
+		UpdatedBy:      updatedBy,
+		AssignedAt:     assignedAt,
+		AssignedBy:     assignedBy,
+		AcknowledgedAt: acknowledgedAt,
+		AcknowledgedBy: acknowledgedBy,
+		ResolvedAt:     resolvedAt,
+		ResolvedBy:     resolvedBy,
+		Metadata:       metadata,
+	}, nil
+}
+
+func toAlarm(dbr dbAlarm) (alarms.Alarm, error) {
+	var updatedBy string
+	if dbr.UpdatedBy != nil {
+		updatedBy = *dbr.UpdatedBy
+	}
+	var updatedAt time.Time
+	if dbr.UpdatedAt.Valid {
+		updatedAt = dbr.UpdatedAt.Time
+	}
+
+	var assignedBy string
+	if dbr.AssignedBy != nil {
+		assignedBy = *dbr.AssignedBy
+	}
+	var assignedAt time.Time
+	if dbr.AssignedAt.Valid {
+		assignedAt = dbr.AssignedAt.Time
+	}
+
+	var acknowledgedBy string
+	if dbr.AcknowledgedBy != nil {
+		acknowledgedBy = *dbr.AcknowledgedBy
+	}
+	var acknowledgedAt time.Time
+	if dbr.AcknowledgedAt.Valid {
+		acknowledgedAt = dbr.AcknowledgedAt.Time
+	}
+
+	var resolvedBy string
+	if dbr.ResolvedBy != nil {
+		resolvedBy = *dbr.ResolvedBy
+	}
+	var resolvedAt time.Time
+	if dbr.ResolvedAt.Valid {
+		resolvedAt = dbr.ResolvedAt.Time
+	}
+
+	var metadata map[string]any
+	if len(dbr.Metadata) > 0 {
+		err := json.Unmarshal(dbr.Metadata, &metadata)
+		if err != nil {
+			return alarms.Alarm{}, errors.Wrap(repoerr.ErrMalformedEntity, err)
+		}
+	}
+
+	return alarms.Alarm{
+		ID:             dbr.ID,
+		RuleID:         dbr.RuleID,
+		DomainID:       dbr.DomainID,
+		ChannelID:      dbr.ChannelID,
+		ClientID:       dbr.ClientID,
+		Subtopic:       dbr.Subtopic,
+		Measurement:    dbr.Measurement,
+		Value:          dbr.Value,
+		Unit:           dbr.Unit,
+		Threshold:      dbr.Threshold,
+		Cause:          dbr.Cause,
+		Status:         dbr.Status,
+		Severity:       dbr.Severity,
+		AssigneeID:     dbr.AssigneeID,
+		CreatedAt:      dbr.CreatedAt,
+		UpdatedAt:      updatedAt,
+		UpdatedBy:      updatedBy,
+		AssignedAt:     assignedAt,
+		AssignedBy:     assignedBy,
+		AcknowledgedAt: acknowledgedAt,
+		AcknowledgedBy: acknowledgedBy,
+		ResolvedAt:     resolvedAt,
+		ResolvedBy:     resolvedBy,
+		Metadata:       metadata,
+	}, nil
+}
+
+func pageQuery(pm alarms.PageMetadata) (string, error) {
+	query := pageQueryConditions(pm)
+
+	var emq string
+	if len(query) > 0 {
+		emq = fmt.Sprintf("WHERE %s", strings.Join(query, " AND "))
+	}
+
+	return emq, nil
+}
+
+func pageQueryConditions(pm alarms.PageMetadata) []string {
+	var query []string
+	if pm.DomainID != "" {
+		query = append(query, "alarms.domain_id = :domain_id")
+	}
+	if pm.RuleID != "" {
+		query = append(query, "alarms.rule_id = :rule_id")
+	}
+	if pm.ChannelID != "" {
+		query = append(query, "alarms.channel_id = :channel_id")
+	}
+	if pm.Subtopic != "" {
+		query = append(query, "alarms.subtopic = :subtopic")
+	}
+	if pm.ClientID != "" {
+		query = append(query, "alarms.client_id = :client_id")
+	}
+	if pm.Measurement != "" {
+		query = append(query, "alarms.measurement = :measurement")
+	}
+	if pm.Status != alarms.AllStatus {
+		query = append(query, "alarms.status = :status")
+	}
+	if pm.Severity != math.MaxUint8 {
+		query = append(query, "alarms.severity = :severity")
+	}
+	if pm.AssigneeID != "" {
+		query = append(query, "alarms.assignee_id = :assignee_id")
+	}
+	if pm.UpdatedBy != "" {
+		query = append(query, "alarms.updated_by = :updated_by")
+	}
+	if pm.ResolvedBy != "" {
+		query = append(query, "alarms.resolved_by = :resolved_by")
+	}
+	if pm.AcknowledgedBy != "" {
+		query = append(query, "alarms.acknowledged_by = :acknowledged_by")
+	}
+	if pm.AssignedBy != "" {
+		query = append(query, "alarms.assigned_by = :assigned_by")
+	}
+	if !pm.CreatedFrom.IsZero() {
+		query = append(query, "alarms.created_at >= :created_from")
+	}
+	if !pm.CreatedTo.IsZero() {
+		query = append(query, "alarms.created_at <= :created_to")
+	}
+	return query
+}

alarms/postgres/alarms_test.go

@@ -0,0 +1,481 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package postgres_test
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/0x6flab/namegenerator"
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/alarms/postgres"
+	"github.com/absmach/magistrala/pkg/errors"
+	repoerr "github.com/absmach/magistrala/pkg/errors/repository"
+	"github.com/absmach/magistrala/pkg/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+var (
+	namegen    = namegenerator.NewGenerator()
+	idProvider = uuid.New()
+)
+
+func TestCreateAlarm(t *testing.T) {
+	t.Cleanup(func() {
+		_, err := db.Exec("DELETE FROM alarms")
+		require.Nil(t, err, fmt.Sprintf("clean alarms unexpected error: %s", err))
+	})
+
+	repo := postgres.NewAlarmsRepo(db)
+
+	alarm := alarms.Alarm{
+		ID:          generateUUID(t),
+		RuleID:      generateUUID(t),
+		DomainID:    generateUUID(t),
+		ChannelID:   generateUUID(t),
+		ClientID:    generateUUID(t),
+		Subtopic:    namegen.Generate(),
+		Measurement: namegen.Generate(),
+		Value:       namegen.Generate(),
+		Unit:        namegen.Generate(),
+		Threshold:   namegen.Generate(),
+		Cause:       namegen.Generate(),
+		Status:      0,
+		AssigneeID:  generateUUID(t),
+		CreatedAt:   time.Now().UTC(),
+		Metadata: map[string]any{
+			"key": "value",
+		},
+	}
+
+	cases := []struct {
+		desc  string
+		alarm alarms.Alarm
+		err   error
+	}{
+		{
+			desc:  "valid alarm",
+			alarm: alarm,
+			err:   nil,
+		},
+		{
+			desc:  "duplicate alarm",
+			alarm: alarm,
+			err:   repoerr.ErrNotFound,
+		},
+		{
+			desc: "missing rule id",
+			alarm: alarms.Alarm{
+				ID:          generateUUID(t),
+				DomainID:    generateUUID(t),
+				ChannelID:   generateUUID(t),
+				ClientID:    generateUUID(t),
+				Subtopic:    namegen.Generate(),
+				Measurement: namegen.Generate(),
+				Value:       namegen.Generate(),
+				Unit:        namegen.Generate(),
+				Threshold:   namegen.Generate(),
+				Cause:       namegen.Generate(),
+				Status:      0,
+				AssigneeID:  generateUUID(t),
+				CreatedAt:   time.Now().UTC(),
+
+				Metadata: map[string]any{
+					"key": "value",
+				},
+			},
+			err: repoerr.ErrCreateEntity,
+		},
+		{
+			desc: "invalid alarm",
+			alarm: alarms.Alarm{
+				ID:          generateUUID(t),
+				DomainID:    generateUUID(t),
+				ChannelID:   generateUUID(t),
+				ClientID:    generateUUID(t),
+				Subtopic:    namegen.Generate(),
+				Measurement: namegen.Generate(),
+				Value:       namegen.Generate(),
+				Unit:        namegen.Generate(),
+				Threshold:   namegen.Generate(),
+				Cause:       namegen.Generate(),
+				Status:      0,
+				AssigneeID:  generateUUID(t),
+				CreatedAt:   time.Now().UTC(),
+
+				Metadata: map[string]any{
+					"key": make(chan int),
+				},
+			},
+			err: repoerr.ErrCreateEntity,
+		},
+		{
+			desc:  "empty alarm",
+			alarm: alarms.Alarm{},
+			err:   repoerr.ErrCreateEntity,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			alarm, err := repo.CreateAlarm(context.Background(), tc.alarm)
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			assert.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+			assert.NotEmpty(t, alarm.ID)
+			assert.Equal(t, tc.alarm.RuleID, alarm.RuleID)
+			assert.Equal(t, tc.alarm.Measurement, alarm.Measurement)
+			assert.Equal(t, tc.alarm.Value, alarm.Value)
+			assert.Equal(t, tc.alarm.Unit, alarm.Unit)
+			assert.Equal(t, tc.alarm.Cause, alarm.Cause)
+			assert.Equal(t, tc.alarm.Status, alarm.Status)
+			assert.Equal(t, tc.alarm.DomainID, alarm.DomainID)
+			assert.Equal(t, tc.alarm.AssigneeID, alarm.AssigneeID)
+			assert.Equal(t, tc.alarm.Metadata, alarm.Metadata)
+		})
+	}
+}
+
+func TestUpdateAlarm(t *testing.T) {
+	t.Cleanup(func() {
+		_, err := db.Exec("DELETE FROM alarms")
+		require.Nil(t, err, fmt.Sprintf("clean alarms unexpected error: %s", err))
+	})
+
+	repo := postgres.NewAlarmsRepo(db)
+
+	alarm := alarms.Alarm{
+		ID:          generateUUID(t),
+		RuleID:      generateUUID(t),
+		DomainID:    generateUUID(t),
+		ChannelID:   generateUUID(t),
+		ClientID:    generateUUID(t),
+		Measurement: namegen.Generate(),
+		Value:       namegen.Generate(),
+		Unit:        namegen.Generate(),
+		Threshold:   namegen.Generate(),
+		Cause:       namegen.Generate(),
+		Status:      0,
+		AssigneeID:  generateUUID(t),
+		CreatedAt:   time.Now().UTC(),
+		Metadata: map[string]any{
+			"key": "value",
+		},
+	}
+	alarm, err := repo.CreateAlarm(context.Background(), alarm)
+	require.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+
+	cases := []struct {
+		desc  string
+		alarm alarms.Alarm
+		err   error
+	}{
+		{
+			desc: "valid alarm",
+			alarm: alarms.Alarm{
+				ID:             alarm.ID,
+				Status:         alarms.ClearedStatus,
+				DomainID:       alarm.DomainID,
+				AssigneeID:     generateUUID(t),
+				AssignedBy:     generateUUID(t),
+				AssignedAt:     time.Now().UTC(),
+				AcknowledgedBy: generateUUID(t),
+				AcknowledgedAt: time.Now().UTC(),
+				CreatedAt:      alarm.CreatedAt,
+				UpdatedAt:      time.Now().UTC(),
+				UpdatedBy:      generateUUID(t),
+				ResolvedAt:     time.Now().UTC(),
+				ResolvedBy:     generateUUID(t),
+				Metadata: map[string]any{
+					"key": "value",
+				},
+			},
+			err: nil,
+		},
+		{
+			desc: "non existing alarm",
+			alarm: alarms.Alarm{
+				ID: generateUUID(t),
+			},
+			err: repoerr.ErrNotFound,
+		},
+		{
+			desc: "invalid alarm",
+			alarm: alarms.Alarm{
+				ID:         alarm.ID,
+				RuleID:     generateUUID(t),
+				Status:     0,
+				DomainID:   generateUUID(t),
+				AssigneeID: strings.Repeat("a", 40),
+				CreatedAt:  time.Now().UTC(),
+				Metadata: map[string]any{
+					"key": "value",
+				},
+			},
+			err: repoerr.ErrMalformedEntity,
+		},
+		{
+			desc:  "empty alarm",
+			alarm: alarms.Alarm{},
+			err:   repoerr.ErrNotFound,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			alarm, err := repo.UpdateAlarm(context.Background(), tc.alarm)
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			assert.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+			assert.NotEmpty(t, alarm.ID)
+			assert.Equal(t, tc.alarm.Status, alarm.Status)
+			assert.Equal(t, tc.alarm.DomainID, alarm.DomainID)
+			assert.Equal(t, tc.alarm.AssigneeID, alarm.AssigneeID)
+			assert.Equal(t, tc.alarm.UpdatedBy, alarm.UpdatedBy)
+			assert.Equal(t, tc.alarm.ResolvedBy, alarm.ResolvedBy)
+			assert.Equal(t, tc.alarm.AcknowledgedBy, alarm.AcknowledgedBy)
+			assert.Equal(t, tc.alarm.Metadata, alarm.Metadata)
+		})
+	}
+}
+
+func TestViewAlarm(t *testing.T) {
+	t.Cleanup(func() {
+		_, err := db.Exec("DELETE FROM alarms")
+		require.Nil(t, err, fmt.Sprintf("clean alarms unexpected error: %s", err))
+	})
+
+	repo := postgres.NewAlarmsRepo(db)
+
+	alarm := alarms.Alarm{
+		ID:          generateUUID(t),
+		RuleID:      generateUUID(t),
+		DomainID:    generateUUID(t),
+		ChannelID:   generateUUID(t),
+		ClientID:    generateUUID(t),
+		Measurement: namegen.Generate(),
+		Value:       namegen.Generate(),
+		Unit:        namegen.Generate(),
+		Threshold:   namegen.Generate(),
+		Cause:       namegen.Generate(),
+		Status:      0,
+		AssigneeID:  generateUUID(t),
+		CreatedAt:   time.Now().UTC(),
+		Metadata: map[string]any{
+			"key": "value",
+		},
+	}
+	alarm, err := repo.CreateAlarm(context.Background(), alarm)
+	require.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+
+	cases := []struct {
+		desc     string
+		id       string
+		domainID string
+		err      error
+	}{
+		{
+			desc:     "valid alarm",
+			id:       alarm.ID,
+			domainID: alarm.DomainID,
+			err:      nil,
+		},
+		{
+			desc:     "non existing alarm id",
+			id:       generateUUID(t),
+			domainID: alarm.DomainID,
+			err:      repoerr.ErrNotFound,
+		},
+		{
+			desc:     "non existing domain id",
+			id:       alarm.ID,
+			domainID: generateUUID(t),
+			err:      repoerr.ErrNotFound,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			alarm, err := repo.ViewAlarm(context.Background(), tc.id, tc.domainID)
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			assert.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+			assert.NotEmpty(t, alarm.ID)
+			assert.Equal(t, tc.id, alarm.ID)
+		})
+	}
+}
+
+func TestListAlarms(t *testing.T) {
+	t.Cleanup(func() {
+		_, err := db.Exec("DELETE FROM alarms")
+		require.Nil(t, err, fmt.Sprintf("clean alarms unexpected error: %s", err))
+	})
+	repo := postgres.NewAlarmsRepo(db)
+	items := make([]alarms.Alarm, 1000)
+	for i := range 1000 {
+		items[i] = alarms.Alarm{
+			ID:          generateUUID(t),
+			RuleID:      generateUUID(t),
+			DomainID:    generateUUID(t),
+			ChannelID:   generateUUID(t),
+			ClientID:    generateUUID(t),
+			Measurement: namegen.Generate(),
+			Value:       namegen.Generate(),
+			Unit:        namegen.Generate(),
+			Threshold:   namegen.Generate(),
+			Cause:       namegen.Generate(),
+			Status:      0,
+			AssigneeID:  generateUUID(t),
+			CreatedAt:   time.Now().UTC(),
+			Metadata: map[string]any{
+				"key": "value",
+			},
+		}
+		alarm, err := repo.CreateAlarm(context.Background(), items[i])
+		require.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+		items[i].ID = alarm.ID
+	}
+
+	cases := []struct {
+		desc     string
+		pm       alarms.PageMetadata
+		response []alarms.Alarm
+		err      error
+	}{
+		{
+			desc: "valid page",
+			pm: alarms.PageMetadata{
+				Offset: 0,
+				Limit:  10,
+			},
+			response: items[:10],
+			err:      nil,
+		},
+		{
+			desc: "offset and limit",
+			pm: alarms.PageMetadata{
+				Offset: 10,
+				Limit:  50,
+			},
+			response: items[10:60],
+			err:      nil,
+		},
+		{
+			desc:     "empty page",
+			pm:       alarms.PageMetadata{},
+			response: []alarms.Alarm{},
+			err:      nil,
+		},
+		{
+			desc: "invalid page",
+			pm: alarms.PageMetadata{
+				Offset: 1000,
+				Limit:  10,
+			},
+			response: []alarms.Alarm{},
+			err:      nil,
+		},
+		{
+			desc: "invalid assignee id",
+			pm: alarms.PageMetadata{
+				Offset:     0,
+				Limit:      10,
+				AssigneeID: generateUUID(t),
+			},
+			response: []alarms.Alarm{},
+			err:      nil,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			alarms, err := repo.ListAllAlarms(context.Background(), tc.pm)
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			assert.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+			assert.Equal(t, len(tc.response), len(alarms.Alarms))
+		})
+	}
+}
+
+func TestDeleteAlarm(t *testing.T) {
+	t.Cleanup(func() {
+		_, err := db.Exec("DELETE FROM alarms")
+		require.Nil(t, err, fmt.Sprintf("clean alarms unexpected error: %s", err))
+	})
+
+	repo := postgres.NewAlarmsRepo(db)
+
+	alarm := alarms.Alarm{
+		ID:          generateUUID(t),
+		RuleID:      generateUUID(t),
+		DomainID:    generateUUID(t),
+		ChannelID:   generateUUID(t),
+		ClientID:    generateUUID(t),
+		Measurement: namegen.Generate(),
+		Value:       namegen.Generate(),
+		Unit:        namegen.Generate(),
+		Threshold:   namegen.Generate(),
+		Cause:       namegen.Generate(),
+		Status:      0,
+		AssigneeID:  generateUUID(t),
+		CreatedAt:   time.Now().UTC(),
+		Metadata: map[string]any{
+			"key": "value",
+		},
+	}
+	alarm, err := repo.CreateAlarm(context.Background(), alarm)
+	require.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+
+	cases := []struct {
+		desc string
+		id   string
+		err  error
+	}{
+		{
+			desc: "valid alarm",
+			id:   alarm.ID,
+			err:  nil,
+		},
+		{
+			desc: "non existing alarm",
+			id:   generateUUID(t),
+			err:  repoerr.ErrNotFound,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			err := repo.DeleteAlarm(context.Background(), tc.id)
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			assert.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+		})
+	}
+}
+
+func generateUUID(t *testing.T) string {
+	ulid, err := idProvider.ID()
+	require.Nil(t, err, fmt.Sprintf("unexpected error: %s", err))
+	return ulid
+}

alarms/postgres/init.go

@@ -0,0 +1,55 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package postgres
+
+import (
+	_ "github.com/jackc/pgx/v5/stdlib" // required for SQL access
+	migrate "github.com/rubenv/sql-migrate"
+)
+
+// Migration of Alarms service.
+func Migration() (*migrate.MemoryMigrationSource, error) {
+	alarmsMigration := &migrate.MemoryMigrationSource{
+		Migrations: []*migrate.Migration{
+			{
+				Id: "alarms_01",
+				// VARCHAR(36) for columns with IDs as UUIDS have a maximum of 36 characters
+				Up: []string{
+					`CREATE TABLE IF NOT EXISTS alarms (
+						id         	    VARCHAR(36) PRIMARY KEY,
+						rule_id		    VARCHAR(36) NOT NULL CHECK (length(rule_id) > 0),
+						domain_id	    VARCHAR(36) NOT NULL,
+						channel_id	    VARCHAR(36) NOT NULL,
+						subtopic        TEXT NOT NULL,
+						client_id	    VARCHAR(36) NOT NULL,
+						measurement	    TEXT NOT NULL,
+						value		    TEXT NOT NULL,
+						unit		    TEXT NOT NULL,
+						threshold	    TEXT NOT NULL,
+						cause	    	TEXT NOT NULL,
+						status          SMALLINT NOT NULL DEFAULT 0 CHECK (status >= 0),
+						severity        SMALLINT NOT NULL DEFAULT 0 CHECK (severity >= 0),
+						assignee_id	    VARCHAR(36),
+						created_at	    TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+						updated_at	    TIMESTAMPTZ NULL,
+						updated_by	    VARCHAR(36) NULL,
+						assigned_at	    TIMESTAMPTZ NULL,
+						assigned_by	    VARCHAR(36) NULL,
+						acknowledged_at	TIMESTAMPTZ NULL,
+						acknowledged_by	VARCHAR(36) NULL,
+						resolved_at	    TIMESTAMPTZ NULL,
+						resolved_by	    VARCHAR(36) NULL,
+						metadata	    JSONB
+					);`,
+					"CREATE INDEX IF NOT EXISTS idx_alarms_state ON alarms (domain_id, rule_id, channel_id, subtopic, client_id, measurement, created_at DESC);",
+				},
+				Down: []string{
+					`DROP TABLE IF EXISTS alarms`,
+				},
+			},
+		},
+	}
+
+	return alarmsMigration, nil
+}

alarms/postgres/setup_test.go

@@ -0,0 +1,97 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package postgres_test
+
+import (
+	"database/sql"
+	"fmt"
+	"log"
+	"os"
+	"testing"
+	"time"
+
+	apostgres "github.com/absmach/magistrala/alarms/postgres"
+	"github.com/absmach/magistrala/pkg/postgres"
+	"github.com/jmoiron/sqlx"
+	dockertest "github.com/ory/dockertest/v3"
+	"github.com/ory/dockertest/v3/docker"
+	"go.opentelemetry.io/otel"
+)
+
+var (
+	db       *sqlx.DB
+	database postgres.Database
+	tracer   = otel.Tracer("repo_tests")
+)
+
+func TestMain(m *testing.M) {
+	pool, err := dockertest.NewPool("")
+	if err != nil {
+		log.Fatalf("Could not connect to docker: %s", err)
+	}
+
+	container, err := pool.RunWithOptions(&dockertest.RunOptions{
+		Repository: "postgres",
+		Tag:        "16.2-alpine",
+		Env: []string{
+			"POSTGRES_USER=test",
+			"POSTGRES_PASSWORD=test",
+			"POSTGRES_DB=test",
+			"listen_addresses = '*'",
+		},
+	}, func(config *docker.HostConfig) {
+		config.AutoRemove = true
+		config.RestartPolicy = docker.RestartPolicy{Name: "no"}
+	})
+	if err != nil {
+		log.Fatalf("Could not start container: %s", err)
+	}
+
+	port := container.GetPort("5432/tcp")
+
+	// exponential backoff-retry, because the application in the container might not be ready to accept connections yet
+	pool.MaxWait = 120 * time.Second
+	if err := pool.Retry(func() error {
+		url := fmt.Sprintf("host=localhost port=%s user=test dbname=test password=test sslmode=disable", port)
+		db, err := sql.Open("pgx", url)
+		if err != nil {
+			return err
+		}
+		return db.Ping()
+	}); err != nil {
+		log.Fatalf("Could not connect to docker: %s", err)
+	}
+
+	dbConfig := postgres.Config{
+		Host:        "localhost",
+		Port:        port,
+		User:        "test",
+		Pass:        "test",
+		Name:        "test",
+		SSLMode:     "disable",
+		SSLCert:     "",
+		SSLKey:      "",
+		SSLRootCert: "",
+	}
+
+	migration, err := apostgres.Migration()
+	if err != nil {
+		log.Fatalf("Could not get migration: %s", err)
+	}
+	if db, err = postgres.Setup(dbConfig, *migration); err != nil {
+		log.Fatalf("Could not setup test DB connection: %s", err)
+	}
+
+	database = postgres.NewDatabase(db, dbConfig, tracer)
+
+	code := m.Run()
+
+	// Defers will not be run when using os.Exit
+	db.Close()
+	if err := pool.Purge(container); err != nil {
+		log.Fatalf("Could not purge container: %s", err)
+	}
+
+	os.Exit(code)
+}

alarms/service.go

@@ -0,0 +1,72 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package alarms
+
+import (
+	"context"
+	"time"
+
+	"github.com/absmach/magistrala"
+	"github.com/absmach/magistrala/pkg/authn"
+	repoerr "github.com/absmach/magistrala/pkg/errors/repository"
+)
+
+type service struct {
+	idp  magistrala.IDProvider
+	repo Repository
+}
+
+var _ Service = (*service)(nil)
+
+func NewService(idp magistrala.IDProvider, repo Repository) Service {
+	return &service{
+		idp:  idp,
+		repo: repo,
+	}
+}
+
+func (s *service) CreateAlarm(ctx context.Context, alarm Alarm) (Alarm, error) {
+	id, err := s.idp.ID()
+	if err != nil {
+		return Alarm{}, err
+	}
+	alarm.ID = id
+	if alarm.CreatedAt.IsZero() {
+		alarm.CreatedAt = time.Now()
+	}
+
+	if err := alarm.Validate(); err != nil {
+		return Alarm{}, err
+	}
+
+	created, err := s.repo.CreateAlarm(ctx, alarm)
+	if err != nil && err != repoerr.ErrNotFound {
+		return Alarm{}, err
+	}
+	if err == repoerr.ErrNotFound {
+		return Alarm{}, nil
+	}
+
+	return created, nil
+}
+
+func (s *service) ViewAlarm(ctx context.Context, session authn.Session, alarmID string) (Alarm, error) {
+	return s.repo.ViewAlarm(ctx, alarmID, session.DomainID)
+}
+
+func (s *service) ListAlarms(ctx context.Context, session authn.Session, pm PageMetadata) (AlarmsPage, error) {
+	pm.DomainID = session.DomainID
+	return s.repo.ListAllAlarms(ctx, pm)
+}
+
+func (s *service) DeleteAlarm(ctx context.Context, session authn.Session, alarmID string) error {
+	return s.repo.DeleteAlarm(ctx, alarmID)
+}
+
+func (s *service) UpdateAlarm(ctx context.Context, session authn.Session, alarm Alarm) (Alarm, error) {
+	alarm.UpdatedAt = time.Now()
+	alarm.UpdatedBy = session.UserID
+
+	return s.repo.UpdateAlarm(ctx, alarm)
+}

alarms/service_test.go

@@ -0,0 +1,254 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package alarms_test
+
+import (
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"github.com/absmach/magistrala/alarms"
+	"github.com/absmach/magistrala/alarms/mocks"
+	"github.com/absmach/magistrala/pkg/authn"
+	"github.com/absmach/magistrala/pkg/errors"
+	repoerr "github.com/absmach/magistrala/pkg/errors/repository"
+	"github.com/absmach/magistrala/pkg/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
+)
+
+var idp = uuid.New()
+
+func newService(t *testing.T, repo *mocks.Repository) alarms.Service {
+	return alarms.NewService(idp, repo)
+}
+
+func TestCreateAlarm(t *testing.T) {
+	repo := new(mocks.Repository)
+	svc := newService(t, repo)
+	ts := time.Now()
+	cases := []struct {
+		desc  string
+		alarm alarms.Alarm
+		err   error
+	}{
+		{
+			desc: "valid alarm",
+			alarm: alarms.Alarm{
+				RuleID:      "rule-id",
+				DomainID:    "domain-id",
+				ChannelID:   "channel-id",
+				ClientID:    "client-id",
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+				CreatedAt:   ts,
+			},
+			err: nil,
+		},
+		{
+			desc: "missing rule_id",
+			alarm: alarms.Alarm{
+				DomainID:    "domain-id",
+				ChannelID:   "channel-id",
+				ClientID:    "client-id",
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+				CreatedAt:   ts,
+			},
+			err: errors.New("rule_id is required"),
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			repoCall := repo.On("CreateAlarm", context.Background(), mock.Anything).Return(tc.alarm, tc.err)
+			_, err := svc.CreateAlarm(context.Background(), tc.alarm)
+			assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+			repoCall.Unset()
+		})
+	}
+}
+
+func TestViewAlarm(t *testing.T) {
+	repo := new(mocks.Repository)
+	svc := newService(t, repo)
+
+	cases := []struct {
+		desc     string
+		id       string
+		domainID string
+		err      error
+	}{
+		{
+			desc:     "valid alarm",
+			id:       "alarm-id",
+			domainID: "domain-id",
+			err:      nil,
+		},
+		{
+			desc:     "non existing alarm id",
+			id:       "alarm-id",
+			domainID: "domain-id",
+			err:      repoerr.ErrNotFound,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			s := authn.Session{DomainID: tc.domainID}
+			repoCall := repo.On("ViewAlarm", context.Background(), tc.id, tc.domainID).Return(alarms.Alarm{}, tc.err)
+			_, err := svc.ViewAlarm(context.Background(), s, tc.id)
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			repoCall.Unset()
+		})
+	}
+}
+
+func TestUpdateAlarm(t *testing.T) {
+	repo := new(mocks.Repository)
+	svc := newService(t, repo)
+
+	cases := []struct {
+		desc  string
+		alarm alarms.Alarm
+		err   error
+	}{
+		{
+			desc: "valid alarm",
+			alarm: alarms.Alarm{
+				RuleID:      "rule-id",
+				DomainID:    "domain-id",
+				ChannelID:   "channel-id",
+				ClientID:    "client-id",
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+			},
+			err: nil,
+		},
+		{
+			desc: "non existing alarm",
+			alarm: alarms.Alarm{
+				RuleID:      "rule-id",
+				DomainID:    "domain-id",
+				ChannelID:   "channel-id",
+				ClientID:    "client-id",
+				Subtopic:    "subtopic",
+				Measurement: "measurement",
+				Value:       "value",
+				Unit:        "unit",
+				Cause:       "cause",
+				Severity:    100,
+			},
+			err: repoerr.ErrNotFound,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			s := authn.Session{DomainID: tc.alarm.DomainID}
+			repoCall := repo.On("UpdateAlarm", context.Background(), mock.Anything).Return(tc.alarm, tc.err)
+			_, err := svc.UpdateAlarm(context.Background(), s, tc.alarm)
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			repoCall.Unset()
+		})
+	}
+}
+
+func TestListAlarms(t *testing.T) {
+	repo := new(mocks.Repository)
+	svc := newService(t, repo)
+
+	cases := []struct {
+		desc string
+		pm   alarms.PageMetadata
+		page alarms.AlarmsPage
+		err  error
+	}{
+		{
+			desc: "valid page",
+			pm: alarms.PageMetadata{
+				Offset: 0,
+				Limit:  10,
+			},
+			page: alarms.AlarmsPage{
+				Offset: 0,
+				Limit:  10,
+				Total:  10,
+				Alarms: []alarms.Alarm{},
+			},
+			err: nil,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			s := authn.Session{DomainID: tc.pm.DomainID}
+			repoCall := repo.On("ListAllAlarms", context.Background(), tc.pm).Return(tc.page, tc.err)
+			_, err := svc.ListAlarms(context.Background(), s, tc.pm)
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			repoCall.Unset()
+		})
+	}
+}
+
+func TestDeleteAlarm(t *testing.T) {
+	repo := new(mocks.Repository)
+	svc := newService(t, repo)
+
+	cases := []struct {
+		desc string
+		id   string
+		err  error
+	}{
+		{
+			desc: "valid alarm",
+			id:   "alarm-id",
+			err:  nil,
+		},
+		{
+			desc: "non existing alarm",
+			id:   "alarm-id",
+			err:  repoerr.ErrNotFound,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			s := authn.Session{DomainID: tc.id}
+			repoCall := repo.On("DeleteAlarm", context.Background(), tc.id).Return(tc.err)
+			err := svc.DeleteAlarm(context.Background(), s, tc.id)
+			if tc.err != nil {
+				assert.True(t, errors.Contains(err, tc.err), fmt.Sprintf("%s: expected %s got %s\n", tc.desc, tc.err, err))
+
+				return
+			}
+			repoCall.Unset()
+		})
+	}
+}

alarms/status.go

@@ -0,0 +1,70 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package alarms
+
+import (
+	"encoding/json"
+	"strings"
+
+	svcerr "github.com/absmach/magistrala/pkg/errors/service"
+)
+
+type Status uint8
+
+const (
+	ActiveStatus Status = iota
+	ClearedStatus
+
+	// AllStatus is used for querying purposes to list alarms irrespective
+	// of their status. It is never stored in the database as the actual
+	// Alarm status and should always be the largest value in this enumeration.
+	AllStatus
+)
+
+const (
+	Active  = "active"
+	Cleared = "cleared"
+	Unknown = "unknown"
+	All     = "all"
+)
+
+// String converts alarm status to string literal.
+func (s Status) String() string {
+	switch s {
+	case ActiveStatus:
+		return Active
+	case ClearedStatus:
+		return Cleared
+	default:
+		return Unknown
+	}
+}
+
+// ToStatus converts string value to a valid Alarm status.
+func ToStatus(status string) (Status, error) {
+	switch strings.ToLower(status) {
+	case Active:
+		return ActiveStatus, nil
+	case Cleared:
+		return ClearedStatus, nil
+	case All:
+		return AllStatus, nil
+	default:
+		return Status(0), svcerr.ErrInvalidStatus
+	}
+}
+
+// Custom Marshaller for Alarm.
+func (s Status) MarshalJSON() ([]byte, error) {
+	return json.Marshal(s.String())
+}
+
+// Custom Unmarshaler for Alarm.
+func (s *Status) UnmarshalJSON(data []byte) error {
+	str := strings.Trim(string(data), "\"")
+	val, err := ToStatus(str)
+	*s = val
+
+	return err
+}

api/grpc/auth/v1/auth.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: auth/v1/auth.proto
 
 package v1

api/grpc/auth/v1/auth_grpc.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             v7.35.1
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.0
 // source: auth/v1/auth.proto
 
 package v1

api/grpc/certs/v1/certs.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: certs/v1/certs.proto
 
 package v1

api/grpc/certs/v1/certs_grpc.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             v7.35.1
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.0
 // source: certs/v1/certs.proto
 
 package v1

api/grpc/channels/v1/channels.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: channels/v1/channels.proto
 
 package v1

api/grpc/channels/v1/channels_grpc.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             v7.35.1
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.0
 // source: channels/v1/channels.proto
 
 package v1

api/grpc/clients/v1/clients.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: clients/v1/clients.proto
 
 package v1

api/grpc/clients/v1/clients_grpc.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             v7.35.1
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.0
 // source: clients/v1/clients.proto
 
 package v1

api/grpc/common/v1/common.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: common/v1/common.proto
 
 package v1

api/grpc/domains/v1/domains.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: domains/v1/domains.proto
 
 package v1

api/grpc/domains/v1/domains_grpc.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             v7.35.1
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.0
 // source: domains/v1/domains.proto
 
 package v1

api/grpc/groups/v1/groups.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: groups/v1/groups.proto
 
 package v1

api/grpc/groups/v1/groups_grpc.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             v7.35.1
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.0
 // source: groups/v1/groups.proto
 
 package v1

api/grpc/readers/v1/readers.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: readers/v1/readers.proto
 
 package v1
@@ -104,7 +104,6 @@ type PageMetadata struct {
 	Format        string                 `protobuf:"bytes,17,opt,name=format,proto3" json:"format,omitempty"`
 	Order         string                 `protobuf:"bytes,18,opt,name=order,proto3" json:"order,omitempty"`
 	Dir           string                 `protobuf:"bytes,19,opt,name=dir,proto3" json:"dir,omitempty"`
-	Publishers    []string               `protobuf:"bytes,20,rep,name=publishers,proto3" json:"publishers,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -272,13 +271,6 @@ func (x *PageMetadata) GetDir() string {
 	return ""
 }
 
-func (x *PageMetadata) GetPublishers() []string {
-	if x != nil {
-		return x.Publishers
-	}
-	return nil
-}
-
 type ReadMessagesRes struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	Total         uint64                 `protobuf:"varint,1,opt,name=total,proto3" json:"total,omitempty"`
@@ -730,7 +722,7 @@ var File_readers_v1_readers_proto protoreflect.FileDescriptor
 const file_readers_v1_readers_proto_rawDesc = "" +
 	"\n" +
 	"\x18readers/v1/readers.proto\x12\n" +
-	"readers.v1\"\xac\x04\n" +
+	"readers.v1\"\x8c\x04\n" +
 	"\fPageMetadata\x12\x14\n" +
 	"\x05limit\x18\x01 \x01(\x04R\x05limit\x12\x16\n" +
 	"\x06offset\x18\x02 \x01(\x04R\x06offset\x12\x1a\n" +
@@ -755,10 +747,7 @@ const file_readers_v1_readers_proto_rawDesc = "" +
 	"comparator\x12\x16\n" +
 	"\x06format\x18\x11 \x01(\tR\x06format\x12\x14\n" +
 	"\x05order\x18\x12 \x01(\tR\x05order\x12\x10\n" +
-	"\x03dir\x18\x13 \x01(\tR\x03dir\x12\x1e\n" +
-	"\n" +
-	"publishers\x18\x14 \x03(\tR\n" +
-	"publishers\"\x97\x01\n" +
+	"\x03dir\x18\x13 \x01(\tR\x03dir\"\x97\x01\n" +
 	"\x0fReadMessagesRes\x12\x14\n" +
 	"\x05total\x18\x01 \x01(\x04R\x05total\x12=\n" +
 	"\rpage_metadata\x18\x02 \x01(\v2\x18.readers.v1.PageMetadataR\fpageMetadata\x12/\n" +

api/grpc/readers/v1/readers_grpc.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             v7.35.1
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.0
 // source: readers/v1/readers.proto
 
 package v1

api/grpc/token/v1/token.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: token/v1/token.proto
 
 package v1

api/grpc/token/v1/token_grpc.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             v7.35.1
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.0
 // source: token/v1/token.proto
 
 package v1

api/grpc/users/v1/users.pb.go

@@ -4,7 +4,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.35.1
+// 	protoc        v6.33.0
 // source: users/v1/users.proto
 
 package v1

api/grpc/users/v1/users_grpc.pb.go

@@ -3,8 +3,8 @@
 
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.6.2
-// - protoc             v7.35.1
+// - protoc-gen-go-grpc v1.6.0
+// - protoc             v6.33.0
 // source: users/v1/users.proto
 
 package v1

api/http/common_test.go

@@ -13,9 +13,9 @@ import (
 	"github.com/absmach/magistrala"
 	api "github.com/absmach/magistrala/api/http"
 	apiutil "github.com/absmach/magistrala/api/http/util"
+	"github.com/absmach/magistrala/internal/testsutil"
 	"github.com/absmach/magistrala/pkg/errors"
 	svcerr "github.com/absmach/magistrala/pkg/errors/service"
-	"github.com/absmach/magistrala/pkg/testsutil"
 	"github.com/stretchr/testify/assert"
 )
 

apidocs/openapi/journal.yaml

@@ -0,0 +1,426 @@
+# Copyright (c) Abstract Machines
+# SPDX-License-Identifier: Apache-2.0
+
+openapi: 3.0.3
+info:
+  title: Magistrala Journal Log Service
+  description: |
+    This is the Journal Log Server based on the OpenAPI 3.0 specification.  It is the HTTP API for viewing journal log history. You can now help us improve the API whether it's by making changes to the definition itself or to the code.
+    Some useful links:
+    - [The Magistrala repository](https://github.com/absmach/magistrala)
+  contact:
+    email: info@mainflux.com
+  license:
+    name: Apache 2.0
+    url: https://github.com/absmach/magistrala/blob/main/LICENSE
+  version: 0.18.0
+
+servers:
+  - url: http://localhost:9021
+  - url: https://localhost:9021
+
+tags:
+  - name: journal-log
+    description: Everything about your Journal Log
+    externalDocs:
+      description: Find out more about Journal Log
+      url: http://docs.mainflux.io/
+
+paths:
+  /journal/user/{userID}:
+    get:
+      tags:
+        - journal-log
+      summary: List user journal log
+      description: |
+        Retrieves a list of journal. Due to performance concerns, data
+        is retrieved in subsets. The API must ensure that the entire
+        dataset is consumed either by making subsequent requests, or by
+        increasing the subset size of the initial request.
+      parameters:
+        - $ref: "#/components/parameters/user_id"
+        - $ref: "#/components/parameters/offset"
+        - $ref: "#/components/parameters/limit"
+        - $ref: "#/components/parameters/operation"
+        - $ref: "#/components/parameters/with_attributes"
+        - $ref: "#/components/parameters/with_metadata"
+        - $ref: "#/components/parameters/from"
+        - $ref: "#/components/parameters/to"
+        - $ref: "#/components/parameters/dir"
+      security:
+        - bearerAuth: []
+      responses:
+        "200":
+          $ref: "#/components/responses/JournalsPageRes"
+        "400":
+          description: Failed due to malformed query parameters.
+        "401":
+          description: Missing or invalid access token provided.
+        "403":
+          description: Failed to perform authorization over the entity.
+        "404":
+          description: A non-existent entity request.
+        "422":
+          description: Database can't process request.
+        "500":
+          $ref: "#/components/responses/ServiceError"
+
+  /{domainID}/journal/client/{clientID}/telemetry:
+    get:
+      tags:
+        - journal-log
+      summary: View client telemetry
+      description: |
+        Retrieves telemetry data for a specific client within a domain.
+        This includes connection status, messages sent/received, and other metrics.
+      parameters:
+        - $ref: "#/components/parameters/domain_id"
+        - $ref: "#/components/parameters/client_id"
+      security:
+        - bearerAuth: []
+      responses:
+        "200":
+          description: Client telemetry data retrieved successfully
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/Telemetry"
+        "400":
+          description: Failed due to malformed request parameters.
+        "401":
+          description: Missing or invalid access token provided.
+        "403":
+          description: Failed to perform authorization over the entity.
+        "404":
+          description: Client not found.
+        "422":
+          description: Database can't process request.
+        "500":
+          $ref: "#/components/responses/ServiceError"
+
+  /{domainID}/journal/{entityType}/{id}:
+    get:
+      tags:
+        - journal-log
+      summary: List entity journal log
+      description: |
+        Retrieves a list of journal. Due to performance concerns, data
+        is retrieved in subsets. The API must ensure that the entire
+        dataset is consumed either by making subsequent requests, or by
+        increasing the subset size of the initial request.
+      parameters:
+        - $ref: "#/components/parameters/domain_id"
+        - $ref: "#/components/parameters/entity_type"
+        - $ref: "#/components/parameters/id"
+        - $ref: "#/components/parameters/offset"
+        - $ref: "#/components/parameters/limit"
+        - $ref: "#/components/parameters/operation"
+        - $ref: "#/components/parameters/with_attributes"
+        - $ref: "#/components/parameters/with_metadata"
+        - $ref: "#/components/parameters/from"
+        - $ref: "#/components/parameters/to"
+        - $ref: "#/components/parameters/dir"
+      security:
+        - bearerAuth: []
+      responses:
+        "200":
+          $ref: "#/components/responses/JournalsPageRes"
+        "400":
+          description: Failed due to malformed query parameters.
+        "401":
+          description: Missing or invalid access token provided.
+        "403":
+          description: Failed to perform authorization over the entity.
+        "404":
+          description: A non-existent entity request.
+        "422":
+          description: Database can't process request.
+        "500":
+          $ref: "#/components/responses/ServiceError"
+
+  /health:
+    get:
+      summary: Retrieves service health check info.
+      tags:
+        - health
+      security: []
+      responses:
+        "200":
+          $ref: "#/components/responses/HealthRes"
+        "500":
+          $ref: "#/components/responses/ServiceError"
+
+components:
+  schemas:
+    Telemetry:
+      type: object
+      properties:
+        client_id:
+          type: string
+          format: uuid
+          description: Unique identifier of the client
+          example: "bb7edb32-2eac-4aad-aebe-ed96fe073879"
+        domain_id:
+          type: string
+          format: uuid
+          description: Unique identifier of the domain
+          example: "29d425c8-542b-4614-8a4d-a5951945d720"
+        subscriptions:
+          type: integer
+          format: int64
+          description: Number of active subscriptions for the client
+          example: 5
+        inbound_messages:
+          type: integer
+          format: int64
+          description: Number of messages received by the client
+          example: 1234567
+        outbound_messages:
+          type: integer
+          format: int64
+          description: Number of messages sent by the client
+          example: 987654
+        first_seen:
+          type: string
+          format: date-time
+          description: Timestamp when the client was first seen
+          example: "2024-01-11T10:00:00.000Z"
+        last_seen:
+          type: string
+          format: date-time
+          description: Timestamp when the client was last seen
+          example: "2024-01-11T12:05:07.449053Z"
+
+    Journal:
+      type: object
+      properties:
+        operation:
+          type: string
+          example: user.create
+          description: Journal operation.
+        occurred_at:
+          type: string
+          format: date-time
+          example: "2024-01-11T12:05:07.449053Z"
+          description: Time when the journal occurred.
+        attributes:
+          type: object
+          description: Journal attributes.
+          example:
+            {
+              "created_at": "2024-06-12T11:34:32.991591Z",
+              "id": "29d425c8-542b-4614-8a4d-a5951945d720",
+              "identity": "Gawne-Havlicek@email.com",
+              "name": "Newgard-Frisina",
+              "status": "enabled",
+              "updated_at": "2024-06-12T11:34:33.116795Z",
+              "updated_by": "ad228f20-4741-47c5-bef7-d871b541c019",
+            }
+        metadata:
+          type: object
+          description: Journal payload.
+          example: { "Update": "Calvo-Felkins" }
+      xml:
+        name: journal
+
+    JournalPage:
+      type: object
+      properties:
+        journals:
+          type: array
+          minItems: 0
+          uniqueItems: true
+          items:
+            $ref: "#/components/schemas/Journal"
+        total:
+          type: integer
+          example: 1
+          description: Total number of items.
+        offset:
+          type: integer
+          description: Number of items to skip during retrieval.
+        limit:
+          type: integer
+          example: 10
+          description: Maximum number of items to return in one page.
+      required:
+        - journals
+        - total
+        - offset
+
+    Error:
+      type: object
+      properties:
+        error:
+          type: string
+          description: Error message
+      example: { "error": "malformed entity specification" }
+
+  parameters:
+    domain_id:
+      name: domainID
+      description: Unique identifier for a domain.
+      in: path
+      schema:
+        type: string
+        format: uuid
+      required: true
+      example: bb7edb32-2eac-4aad-aebe-ed96fe073879
+
+    client_id:
+      name: clientID
+      description: Unique identifier for a client
+      in: path
+      schema:
+        type: string
+        format: uuid
+      required: true
+      example: bb7edb32-2eac-4aad-aebe-ed96fe073879
+
+    entity_type:
+      name: entityType
+      description: Type of entity, e.g. group, client, channel.
+      in: path
+      schema:
+        type: string
+        enum:
+          - group
+          - client
+          - channel
+      required: true
+      example: group
+
+    user_id:
+      name: userID
+      description: Unique identifier for a user.
+      in: path
+      schema:
+        type: string
+        format: uuid
+      required: true
+      example: bb7edb32-2eac-4aad-aebe-ed96fe073879
+
+    id:
+      name: id
+      description: Unique identifier for an entity, e.g. group, channel or client. Used together with entity_type.
+      in: path
+      schema:
+        type: string
+        format: uuid
+      required: true
+      example: bb7edb32-2eac-4aad-aebe-ed96fe073879
+
+    offset:
+      name: offset
+      description: Number of items to skip during retrieval.
+      in: query
+      schema:
+        type: integer
+        default: 0
+        minimum: 0
+      required: false
+      example: 0
+
+    limit:
+      name: limit
+      description: Size of the subset to retrieve.
+      in: query
+      schema:
+        type: integer
+        default: 10
+        maximum: 100
+        minimum: 1
+      required: false
+      example: 10
+
+    operation:
+      name: operation
+      description: Journal operation.
+      in: query
+      schema:
+        type: string
+      required: false
+      example: user.create
+
+    with_attributes:
+      name: with_attributes
+      description: Include journal attributes.
+      in: query
+      schema:
+        type: boolean
+      required: false
+      example: true
+
+    with_metadata:
+      name: with_metadata
+      description: Include journal metadata.
+      in: query
+      schema:
+        type: boolean
+      required: false
+      example: true
+
+    from:
+      name: from
+      description: Start date in unix time.
+      in: query
+      schema:
+        type: integer
+        format: int64
+      required: false
+      example: 1966777289
+
+    to:
+      name: to
+      description: End date in unix time.
+      in: query
+      schema:
+        type: integer
+        format: int64
+      required: false
+      example: 1966777289
+
+    dir:
+      name: dir
+      description: Sort direction.
+      in: query
+      schema:
+        type: string
+        enum:
+          - asc
+          - desc
+      required: false
+      example: desc
+
+  responses:
+    JournalsPageRes:
+      description: Data retrieved.
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/JournalPage"
+
+    HealthRes:
+      description: Service Health Check.
+      content:
+        application/health+json:
+          schema:
+            $ref: "./schemas/health_info.yaml"
+
+    ServiceError:
+      description: Unexpected server-side error occurred.
+      content:
+        application/json:
+          schema:
+            $ref: "#/components/schemas/Error"
+
+  securitySchemes:
+    bearerAuth:
+      type: http
+      scheme: bearer
+      bearerFormat: JWT
+      description: |
+        * User access: "Authorization: Bearer <user_access_token>"
+
+security:
+  - bearerAuth: []

auth/cache/tokens_test.go

@@ -12,8 +12,8 @@ import (
 
 	"github.com/absmach/magistrala/auth"
 	"github.com/absmach/magistrala/auth/cache"
+	"github.com/absmach/magistrala/internal/testsutil"
 	"github.com/absmach/magistrala/pkg/errors"
-	"github.com/absmach/magistrala/pkg/testsutil"
 	"github.com/redis/go-redis/v9"
 	"github.com/stretchr/testify/assert"
 )

auth/service_test.go

@@ -13,12 +13,12 @@ import (
 
 	"github.com/absmach/magistrala/auth"
 	"github.com/absmach/magistrala/auth/mocks"
+	"github.com/absmach/magistrala/internal/testsutil"
 	"github.com/absmach/magistrala/pkg/errors"
 	repoerr "github.com/absmach/magistrala/pkg/errors/repository"
 	svcerr "github.com/absmach/magistrala/pkg/errors/service"
 	"github.com/absmach/magistrala/pkg/policies"
 	policymocks "github.com/absmach/magistrala/pkg/policies/mocks"
-	"github.com/absmach/magistrala/pkg/testsutil"
 	"github.com/absmach/magistrala/pkg/uuid"
 	"github.com/lestrrat-go/jwx/v2/jwa"
 	"github.com/lestrrat-go/jwx/v2/jwt"

cli/config.go

@@ -25,6 +25,7 @@ const (
 	defChannelsURL     string = defURL + ":9005"
 	defGroupsURL       string = defURL + ":9004"
 	defHTTPURL         string = defURL + ":8008"
+	defJournalURL      string = defURL + ":9021"
 	defTLSVerification bool   = false
 	defOffset          string = "0"
 	defLimit           string = "10"
@@ -40,6 +41,7 @@ type remotes struct {
 	GroupsURL       string `toml:"groups_url"`
 	HTTPAdapterURL  string `toml:"http_adapter_url"`
 	CertsURL        string `toml:"certs_url"`
+	JournalURL      string `toml:"journal_url"`
 	HostURL         string `toml:"host_url"`
 	TLSVerification bool   `toml:"tls_verification"`
 }
@@ -108,6 +110,7 @@ func ParseConfig(sdkConf smqsdk.Config) (smqsdk.Config, error) {
 				ChannelsURL:     defChannelsURL,
 				GroupsURL:       defGroupsURL,
 				HTTPAdapterURL:  defHTTPURL,
+				JournalURL:      defJournalURL,
 				HostURL:         defURL,
 				TLSVerification: defTLSVerification,
 			},
@@ -191,6 +194,10 @@ func ParseConfig(sdkConf smqsdk.Config) (smqsdk.Config, error) {
 		sdkConf.CertsURL = config.Remotes.CertsURL
 	}
 
+	if sdkConf.JournalURL == "" && config.Remotes.JournalURL != "" {
+		sdkConf.JournalURL = config.Remotes.JournalURL
+	}
+
 	if sdkConf.HostURL == "" && config.Remotes.HostURL != "" {
 		sdkConf.HostURL = config.Remotes.HostURL
 	}

cli/journal.go

@@ -0,0 +1,56 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package cli
+
+import (
+	smqsdk "github.com/absmach/magistrala/pkg/sdk"
+	"github.com/spf13/cobra"
+)
+
+var cmdJournal = cobra.Command{
+	Use:   "get <entity_type> <entity_id> <domain_id> <user_auth_token>",
+	Short: "Get journal",
+	Long: "Get journal\n" +
+		"Usage:\n" +
+		"\tmagistrala-cli journal get user <user_id> <user_auth_token> - lists user journal logs\n" +
+		"\tmagistrala-cli journal get <entity_type> <entity_id> <domain_id> <user_auth_token> - lists entity journal logs\n" +
+		"\tmagistrala-cli journal get <entity_type> <entity_id> <domain_id> <user_auth_token> --offset <offset> --limit <limit> - lists user journal logs with provided offset and limit\n",
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) < 3 || len(args) > 4 {
+			logUsageCmd(*cmd, cmd.Use)
+			return
+		}
+		pageMetadata := smqsdk.PageMetadata{
+			Offset: Offset,
+			Limit:  Limit,
+		}
+
+		entityType, entityID, token := args[0], args[1], args[2]
+		domainID := ""
+		if len(args) == 4 {
+			entityType, entityID, domainID, token = args[0], args[1], args[2], args[3]
+		}
+
+		journal, err := sdk.Journal(cmd.Context(), entityType, entityID, domainID, pageMetadata, token)
+		if err != nil {
+			logErrorCmd(*cmd, err)
+			return
+		}
+
+		logJSONCmd(*cmd, journal)
+	},
+}
+
+// NewJournalCmd returns journal log command.
+func NewJournalCmd() *cobra.Command {
+	cmd := cobra.Command{
+		Use:   "journal get",
+		Short: "journal log",
+		Long:  `journal to read journal log`,
+	}
+
+	cmd.AddCommand(&cmdJournal)
+
+	return &cmd
+}

cmd/alarms/main.go

@@ -0,0 +1,205 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net/url"
+	"os"
+
+	"github.com/absmach/magistrala/alarms"
+	httpAPI "github.com/absmach/magistrala/alarms/api"
+	"github.com/absmach/magistrala/alarms/brokers"
+	"github.com/absmach/magistrala/alarms/consumer"
+	"github.com/absmach/magistrala/alarms/middleware"
+	"github.com/absmach/magistrala/alarms/operations"
+	alarmsRepo "github.com/absmach/magistrala/alarms/postgres"
+	"github.com/absmach/magistrala/internal/atom"
+	mglog "github.com/absmach/magistrala/logger"
+	smqauthn "github.com/absmach/magistrala/pkg/authn"
+	atomauthn "github.com/absmach/magistrala/pkg/authn/atom"
+	"github.com/absmach/magistrala/pkg/jaeger"
+	"github.com/absmach/magistrala/pkg/messaging"
+	brokerstracing "github.com/absmach/magistrala/pkg/messaging/brokers/tracing"
+	"github.com/absmach/magistrala/pkg/permissions"
+	"github.com/absmach/magistrala/pkg/postgres"
+	"github.com/absmach/magistrala/pkg/prometheus"
+	"github.com/absmach/magistrala/pkg/server"
+	httpserver "github.com/absmach/magistrala/pkg/server/http"
+	"github.com/absmach/magistrala/pkg/uuid"
+	"github.com/caarlos0/env/v11"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	svcName        = "alarms"
+	envPrefixDB    = "MG_ALARMS_DB_"
+	envPrefixHTTP  = "MG_ALARMS_HTTP_"
+	defDB          = "alarms"
+	defSvcHTTPPort = "8050"
+	alarmEntity    = "alarm"
+)
+
+type config struct {
+	LogLevel        string  `env:"MG_ALARMS_LOG_LEVEL"    envDefault:"info"`
+	BrokerURL       string  `env:"MG_MESSAGE_BROKER_URL" envDefault:"nats://localhost:4222"`
+	InstanceID      string  `env:"MG_ALARMS_INSTANCE_ID"  envDefault:""`
+	JaegerURL       url.URL `env:"MG_JAEGER_URL"         envDefault:"http://localhost:4318/v1/traces"`
+	TraceRatio      float64 `env:"MG_JAEGER_TRACE_RATIO" envDefault:"1.0"`
+	PermissionsFile string  `env:"MG_PERMISSIONS_FILE"             envDefault:"permission.yaml"`
+}
+
+func main() {
+	ctx, cancel := context.WithCancel(context.Background())
+	g, ctx := errgroup.WithContext(ctx)
+
+	cfg := config{}
+	if err := env.Parse(&cfg); err != nil {
+		log.Fatalf("failed to load %s configuration : %s", svcName, err.Error())
+	}
+
+	logger, err := mglog.New(os.Stdout, cfg.LogLevel)
+	if err != nil {
+		log.Fatalf("failed to init logger: %s", err.Error())
+	}
+
+	var exitCode int
+	defer mglog.ExitWithError(&exitCode)
+
+	tp, err := jaeger.NewProvider(ctx, svcName, cfg.JaegerURL, cfg.InstanceID, cfg.TraceRatio)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to init Jaeger: %s", err))
+		exitCode = 1
+		return
+	}
+	defer func() {
+		if err := tp.Shutdown(ctx); err != nil {
+			logger.Error(fmt.Sprintf("error shutting down tracer provider: %v", err))
+		}
+	}()
+	tracer := tp.Tracer(svcName)
+
+	dbConfig := postgres.Config{Name: defDB}
+	if err := env.ParseWithOptions(&dbConfig, env.Options{Prefix: envPrefixDB}); err != nil {
+		logger.Error(err.Error())
+	}
+
+	migrations, err := alarmsRepo.Migration()
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to load migrations: %s", err))
+		exitCode = 1
+		return
+	}
+
+	db, err := postgres.Setup(dbConfig, *migrations)
+	if err != nil {
+		logger.Error(err.Error())
+		exitCode = 1
+		return
+	}
+	defer db.Close()
+
+	repo := alarmsRepo.NewAlarmsRepo(db)
+
+	atomCfg := atom.LoadConfig()
+	if atomCfg.URL == "" {
+		logger.Error("ATOM_URL is required")
+		exitCode = 1
+		return
+	}
+	logger.Info("AuthN configured to use Atom bearer tokens")
+	logger.Info("AuthZ configured to use Atom PDP")
+	am := smqauthn.NewAuthNMiddleware(atomauthn.NewAuthentication())
+
+	idp := uuid.New()
+
+	svc := alarms.NewService(idp, repo)
+	svc = alarms.WithAtom(svc, atom.NewClient(atomCfg))
+
+	permConfig, err := permissions.ParsePermissionsFile(cfg.PermissionsFile)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to parse permissions file: %s", err))
+		exitCode = 1
+		return
+	}
+
+	alarmOps, _, err := permConfig.GetEntityPermissions(alarmEntity)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to get alarm permissions: %s", err))
+		exitCode = 1
+		return
+	}
+
+	entitiesOps, err := permissions.NewEntitiesOperations(
+		permissions.EntitiesPermission{
+			operations.EntityType: alarmOps,
+		},
+		permissions.EntitiesOperationDetails[permissions.Operation]{
+			operations.EntityType: operations.OperationDetails(),
+		},
+	)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create entity operations: %s", err))
+		exitCode = 1
+		return
+	}
+
+	svc, err = middleware.NewAtomAuthorizationMiddleware(svc, atom.NewClient(atomCfg), entitiesOps)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create authorization middleware: %s", err))
+		exitCode = 1
+		return
+	}
+
+	svc = middleware.NewLoggingMiddleware(logger, svc)
+	counter, latency := prometheus.MakeMetrics("alarms", "api")
+	svc = middleware.NewMetricsMiddleware(counter, latency, svc)
+	svc = middleware.NewTracingMiddleware(tracer, svc)
+
+	httpServerConfig := server.Config{Port: defSvcHTTPPort}
+	if err := env.ParseWithOptions(&httpServerConfig, env.Options{Prefix: envPrefixHTTP}); err != nil {
+		logger.Error(fmt.Sprintf("failed to load %s HTTP server configuration : %s", svcName, err))
+		exitCode = 1
+		return
+	}
+	hs := httpserver.NewServer(ctx, cancel, svcName, httpServerConfig, httpAPI.MakeHandler(svc, logger, idp, cfg.InstanceID, am), logger)
+
+	pubSub, err := brokers.NewPubSub(ctx, cfg.BrokerURL, logger)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to connect to message broker: %s", err))
+		exitCode = 1
+		return
+	}
+	defer pubSub.Close()
+	pubSub = brokerstracing.NewPubSub(httpServerConfig, tracer, pubSub)
+
+	consumer := consumer.NewHandler(svc, logger)
+
+	subCfg := messaging.SubscriberConfig{
+		ID:             svcName,
+		Topic:          brokers.AllTopic,
+		DeliveryPolicy: messaging.DeliverAllPolicy,
+		Handler:        consumer,
+	}
+	if err := pubSub.Subscribe(ctx, subCfg); err != nil {
+		logger.Error(fmt.Sprintf("failed to subscribe to message broker: %s", err))
+		exitCode = 1
+
+		return
+	}
+
+	g.Go(func() error {
+		return hs.Start()
+	})
+
+	g.Go(func() error {
+		return server.StopSignalHandler(ctx, cancel, logger, svcName, hs)
+	})
+
+	if err := g.Wait(); err != nil {
+		logger.Error(fmt.Sprintf("billing service terminated: %s", err))
+	}
+}

cmd/atom-bootstrap/main.go

@@ -14,7 +14,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/absmach/magistrala/pkg/atom"
+	"github.com/absmach/magistrala/internal/atom"
 )
 
 const (
@@ -75,7 +75,7 @@ func runProvisionTokens(client *atom.Client, args []string) {
 	fs := flag.NewFlagSet("provision-tokens", flag.ExitOnError)
 	output := fs.String("output", envString("MG_ATOM_TOKENS_OUTPUT", "docker/.env.tokens"), "path to write generated token env file")
 	rotate := fs.String("rotate", "", "rotate one token by name/env var, or all")
-	entityID := fs.String("entity-id", envString("ATOM_SERVICE_ENTITY_ID", atom.DefaultServiceEntityID), "Atom service entity ID to receive access tokens")
+	entityID := fs.String("entity-id", envString("ATOM_SERVICE_ENTITY_ID", atom.DefaultServiceEntityID), "Atom service entity ID to receive API keys")
 	if err := fs.Parse(args); err != nil {
 		log.Fatal(err)
 	}

cmd/auth/main.go

@@ -26,9 +26,9 @@ import (
 	apostgres "github.com/absmach/magistrala/auth/postgres"
 	"github.com/absmach/magistrala/auth/tokenizer/asymmetric"
 	"github.com/absmach/magistrala/auth/tokenizer/symmetric"
+	"github.com/absmach/magistrala/internal/atom"
 	redisclient "github.com/absmach/magistrala/internal/clients/redis"
 	mglog "github.com/absmach/magistrala/logger"
-	"github.com/absmach/magistrala/pkg/atom"
 	"github.com/absmach/magistrala/pkg/jaeger"
 	"github.com/absmach/magistrala/pkg/policies"
 	pgclient "github.com/absmach/magistrala/pkg/postgres"

cmd/certs/main.go

@@ -20,8 +20,8 @@ import (
 	"github.com/absmach/magistrala/certs/middleware"
 	"github.com/absmach/magistrala/certs/pki"
 	"github.com/absmach/magistrala/certs/postgres"
+	"github.com/absmach/magistrala/internal/atom"
 	mglog "github.com/absmach/magistrala/logger"
-	"github.com/absmach/magistrala/pkg/atom"
 	smqauthn "github.com/absmach/magistrala/pkg/authn"
 	atomauthn "github.com/absmach/magistrala/pkg/authn/atom"
 	smqauthz "github.com/absmach/magistrala/pkg/authz"

cmd/fluxmq/main.go

@@ -9,6 +9,7 @@ package main
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"net/http"
@@ -22,8 +23,8 @@ import (
 	"github.com/absmach/fluxmq/pkg/proto/auth/v1/authv1connect"
 	fluxmqgrpc "github.com/absmach/magistrala/fluxmq/api/grpc"
 	fluxmqhttp "github.com/absmach/magistrala/fluxmq/api/http"
+	"github.com/absmach/magistrala/internal/atom"
 	mglog "github.com/absmach/magistrala/logger"
-	"github.com/absmach/magistrala/pkg/atom"
 	atomauthn "github.com/absmach/magistrala/pkg/authn/atom"
 	jaegerclient "github.com/absmach/magistrala/pkg/jaeger"
 	"github.com/absmach/magistrala/pkg/messaging"
@@ -51,16 +52,40 @@ type config struct {
 	JaegerURL  url.URL `env:"MG_JAEGER_URL"           envDefault:"http://localhost:4318/v1/traces"`
 	TraceRatio float64 `env:"MG_JAEGER_TRACE_RATIO"   envDefault:"1.0"`
 	InstanceID string  `env:"MG_FLUXMQ_INSTANCE_ID"   envDefault:""`
-	// The publish proxy states the origin of the message it relays: the
-	// protocol the user published with and the client it was published as.
-	// A broker stamps its own transport and identity on a publication from a
-	// connection it does not trust, which would store every message from this
-	// service as having arrived over AMQP. These point the publisher at the
-	// listener that accepts a relayed origin instead.
-	MsgBrokerURL     string `env:"MG_FLUXMQ_BROKER_URL"         envDefault:""`
-	BrokerClientCert string `env:"MG_FLUXMQ_BROKER_CLIENT_CERT" envDefault:""`
-	BrokerClientKey  string `env:"MG_FLUXMQ_BROKER_CLIENT_KEY"  envDefault:""`
-	BrokerCACerts    string `env:"MG_FLUXMQ_BROKER_CA_CERTS"    envDefault:""`
+}
+
+type fanoutPublisher struct {
+	publishers []messaging.Publisher
+}
+
+func (fp fanoutPublisher) Publish(ctx context.Context, topic string, msg *messaging.Message) error {
+	for _, publisher := range fp.publishers {
+		if err := publisher.Publish(ctx, topic, msg); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (fp fanoutPublisher) Close() error {
+	errs := make([]error, 0, len(fp.publishers))
+	for _, publisher := range fp.publishers {
+		errs = append(errs, publisher.Close())
+	}
+	return errors.Join(errs...)
+}
+
+type writerBridgeHandler struct {
+	ctx       context.Context
+	publisher messaging.Publisher
+}
+
+func (h writerBridgeHandler) Handle(msg *messaging.Message) error {
+	return h.publisher.Publish(h.ctx, messaging.EncodeMessageTopic(msg), msg)
+}
+
+func (h writerBridgeHandler) Cancel() error {
+	return nil
 }
 
 func main() {
@@ -147,7 +172,6 @@ func main() {
 		connect.WithInterceptors(otelInterceptor),
 	)
 	mux.Handle(path, handler)
-	mux.Handle("/hooks", fluxmqhttp.MakeHooksHandler(parser))
 	mux.HandleFunc("/health", func(w http.ResponseWriter, _ *http.Request) {
 		w.WriteHeader(http.StatusOK)
 		w.Write([]byte(`{"status":"ok"}`)) //nolint:errcheck // HTTP response write; client disconnect is non-fatal.
@@ -164,21 +188,11 @@ func main() {
 		MaxHeaderBytes:    grpcServerConfig.MaxHeaderBytes,
 	}
 
-	// The mTLS client identity is optional: brokers that expose an
-	// unauthenticated listener need none. A partial configuration still fails,
-	// since half an identity is not a usable one.
-	publisherOpts := []messaging.Option{
+	messagePublisher, err := fluxmqbroker.NewUndeclaredPublisher(
+		ctx,
+		cfg.BrokerURL,
 		fluxmqbroker.ConnectionName("fluxmq-ui-message-publish-proxy"),
-	}
-	msgBrokerURL := cfg.BrokerURL
-	if cfg.MsgBrokerURL != "" {
-		msgBrokerURL = cfg.MsgBrokerURL
-	}
-	if cfg.BrokerClientCert != "" || cfg.BrokerClientKey != "" || cfg.BrokerCACerts != "" {
-		publisherOpts = append(publisherOpts, fluxmqbroker.InternalMetadata(cfg.BrokerClientCert, cfg.BrokerClientKey, cfg.BrokerCACerts))
-	}
-
-	messagePublisher, err := fluxmqbroker.NewUndeclaredPublisher(ctx, msgBrokerURL, publisherOpts...)
+	)
 	if err != nil {
 		logger.Error(fmt.Sprintf("failed to create publish proxy message publisher: %s", err))
 		exitCode = 1
@@ -186,6 +200,45 @@ func main() {
 	}
 	defer messagePublisher.Close()
 
+	writerPublisher, err := fluxmqbroker.NewUndeclaredPublisher(
+		ctx,
+		cfg.BrokerURL,
+		fluxmqbroker.Prefix("writers"),
+		fluxmqbroker.ConnectionName("fluxmq-ui-publish-proxy"),
+	)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create publish proxy writer publisher: %s", err))
+		exitCode = 1
+		return
+	}
+	defer writerPublisher.Close()
+	publisher := fanoutPublisher{publishers: []messaging.Publisher{messagePublisher, writerPublisher}}
+
+	writerBridge, err := fluxmqbroker.NewPubSub(
+		ctx,
+		cfg.BrokerURL,
+		logger,
+		fluxmqbroker.DirectTopicOnly(),
+		fluxmqbroker.ConnectionName("fluxmq-mqtt-writer-bridge"),
+	)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create MQTT writer bridge subscriber: %s", err))
+		exitCode = 1
+		return
+	}
+	defer writerBridge.Close()
+	if err := writerBridge.Subscribe(ctx, messaging.SubscriberConfig{
+		ID:             cfg.InstanceID + "-mqtt-writer-bridge",
+		Topic:          "m/#",
+		Handler:        writerBridgeHandler{ctx: ctx, publisher: writerPublisher},
+		DeliveryPolicy: messaging.DeliverNewPolicy,
+	}); err != nil {
+		logger.Error(fmt.Sprintf("failed to subscribe MQTT writer bridge: %s", err))
+		exitCode = 1
+		return
+	}
+	logger.Info("FluxMQ MQTT writer bridge subscribed", "topic", "m/#")
+
 	httpServerConfig := server.Config{Port: "9026"}
 	if err := env.ParseWithOptions(&httpServerConfig, env.Options{Prefix: envPrefixHTTP}); err != nil {
 		logger.Error(fmt.Sprintf("failed to load publish proxy HTTP server configuration: %s", err))
@@ -197,7 +250,7 @@ func main() {
 		cancel,
 		"fluxmq-publish",
 		httpServerConfig,
-		fluxmqhttp.MakePublishHandler(authn, atomAuthz, messagePublisher),
+		fluxmqhttp.MakePublishHandler(authn, atomAuthz, publisher),
 		logger,
 	)
 

cmd/journal/main.go

@@ -0,0 +1,179 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+// Package main contains journal main function to start the journal service.
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"log/slog"
+	"net/url"
+	"os"
+
+	chclient "github.com/absmach/callhome/pkg/client"
+	"github.com/absmach/magistrala"
+	"github.com/absmach/magistrala/internal/atom"
+	"github.com/absmach/magistrala/journal"
+	httpapi "github.com/absmach/magistrala/journal/api"
+	"github.com/absmach/magistrala/journal/events"
+	"github.com/absmach/magistrala/journal/middleware"
+	journalpg "github.com/absmach/magistrala/journal/postgres"
+	mglog "github.com/absmach/magistrala/logger"
+	smqauthn "github.com/absmach/magistrala/pkg/authn"
+	atomauthn "github.com/absmach/magistrala/pkg/authn/atom"
+	smqauthz "github.com/absmach/magistrala/pkg/authz"
+	"github.com/absmach/magistrala/pkg/events/store"
+	jaegerclient "github.com/absmach/magistrala/pkg/jaeger"
+	"github.com/absmach/magistrala/pkg/postgres"
+	pgclient "github.com/absmach/magistrala/pkg/postgres"
+	"github.com/absmach/magistrala/pkg/prometheus"
+	"github.com/absmach/magistrala/pkg/server"
+	"github.com/absmach/magistrala/pkg/server/http"
+	"github.com/absmach/magistrala/pkg/uuid"
+	"github.com/caarlos0/env/v11"
+	"github.com/jmoiron/sqlx"
+	"go.opentelemetry.io/otel/trace"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	svcName        = "journal"
+	envPrefixDB    = "MG_JOURNAL_DB_"
+	envPrefixHTTP  = "MG_JOURNAL_HTTP_"
+	defDB          = "journal"
+	defSvcHTTPPort = "9021"
+)
+
+type config struct {
+	LogLevel      string  `env:"MG_JOURNAL_LOG_LEVEL"   envDefault:"info"`
+	ESURL         string  `env:"MG_ES_URL"              envDefault:"amqp://guest:guest@localhost:5682/"`
+	JaegerURL     url.URL `env:"MG_JAEGER_URL"          envDefault:"http://localhost:4318/v1/traces"`
+	SendTelemetry bool    `env:"MG_SEND_TELEMETRY"      envDefault:"true"`
+	InstanceID    string  `env:"MG_JOURNAL_INSTANCE_ID" envDefault:""`
+	TraceRatio    float64 `env:"MG_JAEGER_TRACE_RATIO"  envDefault:"1.0"`
+}
+
+func main() {
+	ctx, cancel := context.WithCancel(context.Background())
+	g, ctx := errgroup.WithContext(ctx)
+
+	cfg := config{}
+	if err := env.Parse(&cfg); err != nil {
+		log.Fatalf("failed to load %s configuration : %s", svcName, err)
+	}
+
+	logger, err := mglog.New(os.Stdout, cfg.LogLevel)
+	if err != nil {
+		log.Fatalf("failed to init logger: %s", err)
+	}
+
+	var exitCode int
+	defer mglog.ExitWithError(&exitCode)
+
+	if cfg.InstanceID == "" {
+		if cfg.InstanceID, err = uuid.New().ID(); err != nil {
+			logger.Error(fmt.Sprintf("failed to generate instanceID: %s", err))
+			exitCode = 1
+			return
+		}
+	}
+
+	dbConfig := pgclient.Config{Name: defDB}
+	if err := env.ParseWithOptions(&dbConfig, env.Options{Prefix: envPrefixDB}); err != nil {
+		logger.Error(err.Error())
+		exitCode = 1
+		return
+	}
+	db, err := pgclient.Setup(dbConfig, *journalpg.Migration())
+	if err != nil {
+		logger.Error(err.Error())
+		exitCode = 1
+		return
+	}
+	defer db.Close()
+
+	atomCfg := atom.LoadConfig()
+	if atomCfg.URL == "" {
+		logger.Error("ATOM_URL is required")
+		exitCode = 1
+		return
+	}
+	atomClient := atom.NewClient(atomCfg)
+	authn := atomauthn.NewAuthentication()
+	authnMiddleware := smqauthn.NewAuthNMiddleware(authn)
+	authz := atom.NewAuthorizationCompat(atomClient)
+	logger.Info("AuthN/AuthZ configured to use Atom")
+
+	tp, err := jaegerclient.NewProvider(ctx, svcName, cfg.JaegerURL, cfg.InstanceID, cfg.TraceRatio)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to init Jaeger: %s", err))
+		exitCode = 1
+		return
+	}
+	defer func() {
+		if err := tp.Shutdown(ctx); err != nil {
+			logger.Error(fmt.Sprintf("error shutting down tracer provider: %s", err))
+		}
+	}()
+	tracer := tp.Tracer(svcName)
+
+	svc := newService(db, dbConfig, authz, logger, tracer)
+
+	subscriber, err := store.NewSubscriber(ctx, cfg.ESURL, "journal-es-sub", logger)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create subscriber: %s", err))
+		exitCode = 1
+		return
+	}
+
+	logger.Info("Subscribed to Event Store")
+
+	if err := events.Start(ctx, svcName, subscriber, svc); err != nil {
+		logger.Error("failed to start %s service: %s", svcName, err)
+		exitCode = 1
+		return
+	}
+
+	httpServerConfig := server.Config{Port: defSvcHTTPPort}
+	if err := env.ParseWithOptions(&httpServerConfig, env.Options{Prefix: envPrefixHTTP}); err != nil {
+		logger.Error(fmt.Sprintf("failed to load %s HTTP server configuration : %s", svcName, err.Error()))
+		exitCode = 1
+		return
+	}
+
+	hs := http.NewServer(ctx, cancel, svcName, httpServerConfig, httpapi.MakeHandler(svc, authnMiddleware, logger, svcName, cfg.InstanceID), logger)
+
+	if cfg.SendTelemetry {
+		chc := chclient.New(svcName, magistrala.Version, logger, cancel)
+		go chc.CallHome(ctx)
+	}
+
+	g.Go(func() error {
+		return hs.Start()
+	})
+
+	g.Go(func() error {
+		return server.StopSignalHandler(ctx, cancel, logger, svcName, hs)
+	})
+
+	if err := g.Wait(); err != nil {
+		logger.Error(fmt.Sprintf("%s service terminated: %s", svcName, err))
+	}
+}
+
+func newService(db *sqlx.DB, dbConfig pgclient.Config, authz smqauthz.Authorization, logger *slog.Logger, tracer trace.Tracer) journal.Service {
+	database := postgres.NewDatabase(db, dbConfig, tracer)
+	repo := journalpg.NewRepository(database)
+	idp := uuid.New()
+
+	svc := journal.NewService(idp, repo)
+	svc = middleware.NewAuthorization(svc, authz)
+	svc = middleware.NewLogging(svc, logger)
+	counter, latency := prometheus.MakeMetrics("journal", "journal_writer")
+	svc = middleware.NewMetrics(svc, counter, latency)
+	svc = middleware.NewTracing(svc, tracer)
+
+	return svc
+}

cmd/notifications/main.go

@@ -0,0 +1,153 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+// Package main contains notifications main function to start the notifications service.
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net/url"
+	"os"
+
+	chclient "github.com/absmach/callhome/pkg/client"
+	"github.com/absmach/magistrala"
+	"github.com/absmach/magistrala/internal/atom"
+	mglog "github.com/absmach/magistrala/logger"
+	"github.com/absmach/magistrala/notifications/emailer"
+	"github.com/absmach/magistrala/notifications/events"
+	"github.com/absmach/magistrala/notifications/middleware"
+	"github.com/absmach/magistrala/pkg/events/store"
+	jaegerclient "github.com/absmach/magistrala/pkg/jaeger"
+	"github.com/absmach/magistrala/pkg/prometheus"
+	"github.com/absmach/magistrala/pkg/server"
+	"github.com/absmach/magistrala/pkg/uuid"
+	"github.com/caarlos0/env/v11"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	svcName      = "notifications"
+	defEmailPort = "25"
+)
+
+type config struct {
+	LogLevel           string  `env:"MG_NOTIFICATIONS_LOG_LEVEL"              envDefault:"info"`
+	ESURL              string  `env:"MG_ES_URL"                               envDefault:"amqp://guest:guest@localhost:5682/"`
+	JaegerURL          url.URL `env:"MG_JAEGER_URL"                           envDefault:"http://localhost:4318/v1/traces"`
+	SendTelemetry      bool    `env:"MG_SEND_TELEMETRY"                       envDefault:"true"`
+	InstanceID         string  `env:"MG_NOTIFICATIONS_INSTANCE_ID"            envDefault:""`
+	DomainAltName      string  `env:"MG_NOTIFICATIONS_DOMAIN_ALT_NAME"        envDefault:"domain"`
+	TraceRatio         float64 `env:"MG_JAEGER_TRACE_RATIO"                   envDefault:"1.0"`
+	EmailHost          string  `env:"MG_EMAIL_HOST"                           envDefault:"localhost"`
+	EmailPort          string  `env:"MG_EMAIL_PORT"                           envDefault:"25"`
+	EmailUsername      string  `env:"MG_EMAIL_USERNAME"                       envDefault:""`
+	EmailPassword      string  `env:"MG_EMAIL_PASSWORD"                       envDefault:""`
+	EmailFromAddress   string  `env:"MG_EMAIL_FROM_ADDRESS"                   envDefault:"noreply@magistrala.com"`
+	EmailFromName      string  `env:"MG_EMAIL_FROM_NAME"                      envDefault:"Magistrala Notifications"`
+	InvitationTemplate string  `env:"MG_EMAIL_INVITATION_TEMPLATE"            envDefault:"docker/templates/invitation-sent-email.tmpl"`
+	AcceptanceTemplate string  `env:"MG_EMAIL_ACCEPTANCE_TEMPLATE"            envDefault:"docker/templates/invitation-accepted-email.tmpl"`
+	RejectionTemplate  string  `env:"MG_EMAIL_REJECTION_TEMPLATE"             envDefault:"docker/templates/invitation-rejected-email.tmpl"`
+}
+
+func main() {
+	ctx, cancel := context.WithCancel(context.Background())
+	g, ctx := errgroup.WithContext(ctx)
+
+	cfg := config{}
+	if err := env.Parse(&cfg); err != nil {
+		log.Fatalf("failed to load %s configuration : %s", svcName, err)
+	}
+
+	logger, err := mglog.New(os.Stdout, cfg.LogLevel)
+	if err != nil {
+		log.Fatalf("failed to init logger: %s", err)
+	}
+
+	var exitCode int
+	defer mglog.ExitWithError(&exitCode)
+
+	if cfg.InstanceID == "" {
+		if cfg.InstanceID, err = uuid.New().ID(); err != nil {
+			logger.Error(fmt.Sprintf("failed to generate instanceID: %s", err))
+			exitCode = 1
+			return
+		}
+	}
+
+	tp, err := jaegerclient.NewProvider(ctx, svcName, cfg.JaegerURL, cfg.InstanceID, cfg.TraceRatio)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to init Jaeger: %s", err))
+		exitCode = 1
+		return
+	}
+	defer func() {
+		if err := tp.Shutdown(ctx); err != nil {
+			logger.Error(fmt.Sprintf("error shutting down tracer provider: %s", err))
+		}
+	}()
+
+	atomCfg := atom.LoadConfig()
+	if atomCfg.URL == "" {
+		logger.Error("ATOM_URL is required")
+		exitCode = 1
+		return
+	}
+	usersResolver := emailer.NewAtomUserResolver(atom.NewClient(atomCfg))
+	logger.Info("Notifications user lookup configured to use Atom")
+
+	emailerCfg := emailer.Config{
+		FromAddress:        cfg.EmailFromAddress,
+		FromName:           cfg.EmailFromName,
+		DomainAltName:      cfg.DomainAltName,
+		InvitationTemplate: cfg.InvitationTemplate,
+		AcceptanceTemplate: cfg.AcceptanceTemplate,
+		RejectionTemplate:  cfg.RejectionTemplate,
+		EmailHost:          cfg.EmailHost,
+		EmailPort:          cfg.EmailPort,
+		EmailUsername:      cfg.EmailUsername,
+		EmailPassword:      cfg.EmailPassword,
+	}
+
+	notifier, err := emailer.New(usersResolver, emailerCfg)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create emailer: %s", err))
+		exitCode = 1
+		return
+	}
+
+	// Wrap notifier with middleware
+	notifier = middleware.NewLogging(notifier, logger)
+	counter, latency := prometheus.MakeMetrics(svcName, "notifier")
+	notifier = middleware.NewMetrics(notifier, counter, latency)
+	notifier = middleware.NewTracing(notifier, tp.Tracer(svcName))
+
+	subscriber, err := store.NewSubscriber(ctx, cfg.ESURL, "notifications-es-sub", logger)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create subscriber: %s", err))
+		exitCode = 1
+		return
+	}
+
+	logger.Info("Subscribed to Event Store")
+
+	if err := events.Start(ctx, svcName, subscriber, notifier); err != nil {
+		logger.Error(fmt.Sprintf("failed to start %s service: %s", svcName, err))
+		exitCode = 1
+		return
+	}
+
+	if cfg.SendTelemetry {
+		chc := chclient.New(svcName, magistrala.Version, logger, cancel)
+		go chc.CallHome(ctx)
+	}
+
+	g.Go(func() error {
+		return server.StopSignalHandler(ctx, cancel, logger, svcName)
+	})
+
+	if err := g.Wait(); err != nil {
+		logger.Error(fmt.Sprintf("%s service terminated: %s", svcName, err))
+	}
+}

cmd/postgres-reader/main.go

@@ -14,8 +14,8 @@ import (
 	chclient "github.com/absmach/callhome/pkg/client"
 	"github.com/absmach/magistrala"
 	grpcReadersV1 "github.com/absmach/magistrala/api/grpc/readers/v1"
+	"github.com/absmach/magistrala/internal/atom"
 	mglog "github.com/absmach/magistrala/logger"
-	"github.com/absmach/magistrala/pkg/atom"
 	atomauthn "github.com/absmach/magistrala/pkg/authn/atom"
 	pgclient "github.com/absmach/magistrala/pkg/postgres"
 	"github.com/absmach/magistrala/pkg/prometheus"

cmd/postgres-writer/main.go

@@ -17,12 +17,11 @@ import (
 	"github.com/absmach/magistrala/consumers"
 	consumertracing "github.com/absmach/magistrala/consumers/tracing"
 	httpapi "github.com/absmach/magistrala/consumers/writers/api"
+	"github.com/absmach/magistrala/consumers/writers/brokers"
 	writerpg "github.com/absmach/magistrala/consumers/writers/postgres"
 	mglog "github.com/absmach/magistrala/logger"
 	jaegerclient "github.com/absmach/magistrala/pkg/jaeger"
-	"github.com/absmach/magistrala/pkg/messaging"
 	brokerstracing "github.com/absmach/magistrala/pkg/messaging/brokers/tracing"
-	"github.com/absmach/magistrala/pkg/messaging/writers"
 	pgclient "github.com/absmach/magistrala/pkg/postgres"
 	"github.com/absmach/magistrala/pkg/prometheus"
 	"github.com/absmach/magistrala/pkg/server"
@@ -42,16 +41,13 @@ const (
 )
 
 type config struct {
-	LogLevel         string  `env:"MG_POSTGRES_WRITER_LOG_LEVEL"          envDefault:"info"`
-	ConfigPath       string  `env:"MG_POSTGRES_WRITER_CONFIG_PATH"        envDefault:"/config.toml"`
-	BrokerURL        string  `env:"MG_MESSAGE_BROKER_URL"                 envDefault:"nats://localhost:4222"`
-	BrokerClientCert string  `env:"MG_POSTGRES_WRITER_BROKER_CLIENT_CERT" envDefault:""`
-	BrokerClientKey  string  `env:"MG_POSTGRES_WRITER_BROKER_CLIENT_KEY"  envDefault:""`
-	BrokerCACerts    string  `env:"MG_POSTGRES_WRITER_BROKER_CA_CERTS"    envDefault:""`
-	JaegerURL        url.URL `env:"MG_JAEGER_URL"                         envDefault:"http://localhost:4318/v1/traces"`
-	SendTelemetry    bool    `env:"MG_SEND_TELEMETRY"                     envDefault:"true"`
-	InstanceID       string  `env:"MG_POSTGRES_WRITER_INSTANCE_ID"        envDefault:""`
-	TraceRatio       float64 `env:"MG_JAEGER_TRACE_RATIO"                 envDefault:"1.0"`
+	LogLevel      string  `env:"MG_POSTGRES_WRITER_LOG_LEVEL"     envDefault:"info"`
+	ConfigPath    string  `env:"MG_POSTGRES_WRITER_CONFIG_PATH"   envDefault:"/config.toml"`
+	BrokerURL     string  `env:"MG_MESSAGE_BROKER_URL"            envDefault:"nats://localhost:4222"`
+	JaegerURL     url.URL `env:"MG_JAEGER_URL"                    envDefault:"http://localhost:4318/v1/traces"`
+	SendTelemetry bool    `env:"MG_SEND_TELEMETRY"                envDefault:"true"`
+	InstanceID    string  `env:"MG_POSTGRES_WRITER_INSTANCE_ID"   envDefault:""`
+	TraceRatio    float64 `env:"MG_JAEGER_TRACE_RATIO"            envDefault:"1.0"`
 }
 
 func main() {
@@ -111,16 +107,7 @@ func main() {
 	}()
 	tracer := tp.Tracer(svcName)
 
-	// The mTLS client identity is optional: brokers that expose an unauthenticated
-	// listener need none. Passing the option with empty paths would fail the
-	// connection outright, so only ask for it once one of them is configured. A
-	// partial configuration still fails, since half an identity is not a usable one.
-	var brokerOpts []messaging.Option
-	if cfg.BrokerClientCert != "" || cfg.BrokerClientKey != "" || cfg.BrokerCACerts != "" {
-		brokerOpts = append(brokerOpts, writers.InternalMetadata(cfg.BrokerClientCert, cfg.BrokerClientKey, cfg.BrokerCACerts))
-	}
-
-	pubSub, err := writers.NewPubSub(ctx, cfg.BrokerURL, logger, brokerOpts...)
+	pubSub, err := brokers.NewPubSub(ctx, cfg.BrokerURL, logger)
 	if err != nil {
 		logger.Error(fmt.Sprintf("failed to connect to message broker: %s", err))
 		exitCode = 1
@@ -132,7 +119,7 @@ func main() {
 	repo := newService(db, logger)
 	repo = consumertracing.NewBlocking(tracer, repo, httpServerConfig)
 
-	if err = consumers.Start(ctx, svcName, pubSub, repo, cfg.ConfigPath, writers.AllTopic, logger); err != nil {
+	if err = consumers.Start(ctx, svcName, pubSub, repo, cfg.ConfigPath, brokers.AllTopic, logger); err != nil {
 		logger.Error(fmt.Sprintf("failed to create Postgres writer: %s", err))
 		exitCode = 1
 		return

cmd/re/main.go

@@ -0,0 +1,348 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+// Package main contains rule engine main function to start the service.
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"log/slog"
+	"net/url"
+	"os"
+	"time"
+
+	chclient "github.com/absmach/callhome/pkg/client"
+	"github.com/absmach/magistrala"
+	abrokers "github.com/absmach/magistrala/alarms/brokers"
+	grpcReadersV1 "github.com/absmach/magistrala/api/grpc/readers/v1"
+	"github.com/absmach/magistrala/consumers/writers/brokers"
+	"github.com/absmach/magistrala/internal/atom"
+	"github.com/absmach/magistrala/internal/email"
+	mglog "github.com/absmach/magistrala/logger"
+	smqauthn "github.com/absmach/magistrala/pkg/authn"
+	atomauthn "github.com/absmach/magistrala/pkg/authn/atom"
+	"github.com/absmach/magistrala/pkg/callout"
+	"github.com/absmach/magistrala/pkg/emailer"
+	"github.com/absmach/magistrala/pkg/grpcclient"
+	jaegerclient "github.com/absmach/magistrala/pkg/jaeger"
+	pkglog "github.com/absmach/magistrala/pkg/logger"
+	"github.com/absmach/magistrala/pkg/messaging"
+	smqbrokers "github.com/absmach/magistrala/pkg/messaging/brokers"
+	brokerstracing "github.com/absmach/magistrala/pkg/messaging/brokers/tracing"
+	"github.com/absmach/magistrala/pkg/permissions"
+	pgclient "github.com/absmach/magistrala/pkg/postgres"
+	"github.com/absmach/magistrala/pkg/prometheus"
+	"github.com/absmach/magistrala/pkg/server"
+	httpserver "github.com/absmach/magistrala/pkg/server/http"
+	"github.com/absmach/magistrala/pkg/ticker"
+	"github.com/absmach/magistrala/pkg/uuid"
+	"github.com/absmach/magistrala/re"
+	httpapi "github.com/absmach/magistrala/re/api"
+	"github.com/absmach/magistrala/re/events"
+	"github.com/absmach/magistrala/re/middleware"
+	"github.com/absmach/magistrala/re/operations"
+	repg "github.com/absmach/magistrala/re/postgres"
+	grpcClient "github.com/absmach/magistrala/readers/api/grpc"
+	"github.com/caarlos0/env/v11"
+	"github.com/go-chi/chi/v5"
+	"go.opentelemetry.io/otel/trace"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	svcName          = "rules_engine"
+	envPrefixDB      = "MG_RE_DB_"
+	envPrefixHTTP    = "MG_RE_HTTP_"
+	envPrefixCallout = "MG_RE_CALLOUT_"
+	defDB            = "r"
+	defSvcHTTPPort   = "9008"
+	envPrefixGrpc    = "MG_TIMESCALE_READER_GRPC_"
+)
+
+// We use a buffered channel to prevent blocking, as logging is an expensive operation.
+// A larger buffer size would also work, but we’d likely need another instance of RE in that case.
+// A smaller size would probably work too, but there's no need to be that frugal with resources.
+const channBuffer = 256
+
+type config struct {
+	LogLevel         string        `env:"MG_RE_LOG_LEVEL"             envDefault:"info"`
+	InstanceID       string        `env:"MG_RE_INSTANCE_ID"           envDefault:""`
+	JaegerURL        url.URL       `env:"MG_JAEGER_URL"              envDefault:"http://localhost:4318/v1/traces"`
+	SendTelemetry    bool          `env:"MG_SEND_TELEMETRY"          envDefault:"true"`
+	ESURL            string        `env:"MG_ES_URL"                  envDefault:"nats://localhost:4222"`
+	ESConsumerName   string        `env:"MG_RE_EVENT_CONSUMER"        envDefault:"rules_engine"`
+	CacheURL         string        `env:"MG_RE_CACHE_URL"             envDefault:"redis://localhost:6379/0"`
+	CacheKeyDuration time.Duration `env:"MG_RE_CACHE_KEY_DURATION"    envDefault:"10m"`
+	TraceRatio       float64       `env:"MG_JAEGER_TRACE_RATIO"      envDefault:"1.0"`
+	BrokerURL        string        `env:"MG_MESSAGE_BROKER_URL"      envDefault:"nats://localhost:4222"`
+	PermissionsFile  string        `env:"MG_PERMISSIONS_FILE"        envDefault:"permission.yaml"`
+}
+
+func main() {
+	ctx, cancel := context.WithCancel(context.Background())
+	g, ctx := errgroup.WithContext(ctx)
+
+	cfg := config{}
+	if err := env.Parse(&cfg); err != nil {
+		log.Fatalf("failed to load %s configuration : %s", svcName, err)
+	}
+
+	var logger *slog.Logger
+	logger, err := mglog.New(os.Stdout, cfg.LogLevel)
+	if err != nil {
+		log.Fatalf("failed to init logger: %s", err.Error())
+	}
+
+	var exitCode int
+	defer mglog.ExitWithError(&exitCode)
+
+	if cfg.InstanceID == "" {
+		if cfg.InstanceID, err = uuid.New().ID(); err != nil {
+			logger.Error(fmt.Sprintf("failed to generate instanceID: %s", err))
+			exitCode = 1
+			return
+		}
+	}
+
+	ec := email.Config{}
+	if err := env.Parse(&ec); err != nil {
+		logger.Error(fmt.Sprintf("failed to load email configuration : %s", err))
+		exitCode = 1
+
+		return
+	}
+
+	callCfg := callout.Config{}
+	if err := env.ParseWithOptions(&callCfg, env.Options{Prefix: envPrefixCallout}); err != nil {
+		logger.Error(fmt.Sprintf("failed to parse callout config : %s", err))
+		exitCode = 1
+		return
+	}
+
+	dbConfig := pgclient.Config{Name: defDB}
+	if err := env.ParseWithOptions(&dbConfig, env.Options{Prefix: envPrefixDB}); err != nil {
+		logger.Error(err.Error())
+		exitCode = 1
+
+		return
+	}
+	migration, err := repg.Migration()
+	if err != nil {
+		logger.Error(err.Error())
+		exitCode = 1
+
+		return
+	}
+	db, err := pgclient.Setup(dbConfig, *migration)
+	if err != nil {
+		logger.Error(err.Error())
+		exitCode = 1
+
+		return
+	}
+	defer db.Close()
+
+	tp, err := jaegerclient.NewProvider(ctx, svcName, cfg.JaegerURL, cfg.InstanceID, cfg.TraceRatio)
+	if err != nil {
+		logger.Error(fmt.Sprintf("Failed to init Jaeger: %s", err))
+		exitCode = 1
+
+		return
+	}
+	defer func() {
+		if err := tp.Shutdown(ctx); err != nil {
+			logger.Error(fmt.Sprintf("Error shutting down tracer provider: %v", err))
+		}
+	}()
+	tracer := tp.Tracer(svcName)
+
+	httpServerConfig := server.Config{Port: defSvcHTTPPort}
+	if err := env.ParseWithOptions(&httpServerConfig, env.Options{Prefix: envPrefixHTTP}); err != nil {
+		logger.Error(fmt.Sprintf("failed to load %s HTTP server configuration : %s", svcName, err))
+		exitCode = 1
+
+		return
+	}
+
+	callout, err := callout.New(callCfg)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create new callout: %s", err))
+		exitCode = 1
+		return
+	}
+
+	msgSub, err := smqbrokers.NewPubSub(ctx, cfg.BrokerURL, logger, smqbrokers.ConnectionName("re-msg-pubsub"))
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to connect to message broker for mg pubSub: %s", err))
+		exitCode = 1
+
+		return
+	}
+	defer msgSub.Close()
+	msgSub = brokerstracing.NewPubSub(httpServerConfig, tracer, msgSub)
+
+	writersPub, err := brokers.NewPublisher(ctx, cfg.BrokerURL)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to connect to message broker for writers publisher: %s", err))
+		exitCode = 1
+
+		return
+	}
+	defer writersPub.Close()
+	writersPub = brokerstracing.NewPublisher(httpServerConfig, tracer, writersPub)
+
+	alarmsPub, err := abrokers.NewPublisher(ctx, cfg.BrokerURL)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to connect to message broker for alarms publisher: %s", err))
+		exitCode = 1
+
+		return
+	}
+	defer alarmsPub.Close()
+	alarmsPub = brokerstracing.NewPublisher(httpServerConfig, tracer, alarmsPub)
+
+	atomCfg := atom.LoadConfig()
+	if atomCfg.URL == "" {
+		logger.Error("ATOM_URL is required")
+		exitCode = 1
+		return
+	}
+	authnSvc := atomauthn.NewAuthentication()
+	logger.Info("AuthN configured to use Atom bearer tokens")
+	am := smqauthn.NewAuthNMiddleware(authnSvc)
+	runInfo := make(chan pkglog.RunInfo, channBuffer)
+
+	logger.Info("AuthZ configured to use Atom PDP")
+
+	database := pgclient.NewDatabase(db, dbConfig, tracer)
+	regrpcCfg := grpcclient.Config{}
+	if err := env.ParseWithOptions(&regrpcCfg, env.Options{Prefix: envPrefixGrpc}); err != nil {
+		logger.Error(fmt.Sprintf("failed to load clients gRPC client configuration : %s", err))
+		exitCode = 1
+		return
+	}
+
+	client, err := grpcclient.NewHandler(regrpcCfg)
+	if err != nil {
+		exitCode = 1
+		return
+	}
+	defer client.Close()
+
+	readersClient := grpcClient.NewReadersClient(client.Connection(), regrpcCfg.Timeout)
+	logger.Info("Readers gRPC client successfully connected to readers gRPC server " + client.Secure())
+
+	svc, err := newService(ctx, cfg, database, runInfo, msgSub, writersPub, alarmsPub, ec, logger, readersClient, callout, tracer)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create services: %s", err))
+		exitCode = 1
+
+		return
+	}
+	subCfg := messaging.SubscriberConfig{
+		ID:             svcName,
+		Topic:          smqbrokers.SubjectAllMessages,
+		DeliveryPolicy: messaging.DeliverAllPolicy,
+		Handler:        svc,
+	}
+	if err := msgSub.Subscribe(ctx, subCfg); err != nil {
+		logger.Error(fmt.Sprintf("failed to subscribe to internal message broker: %s", err))
+		exitCode = 1
+
+		return
+	}
+
+	go func() {
+		for info := range runInfo {
+			logger.LogAttrs(context.Background(), info.Level, info.Message, info.Details...)
+		}
+	}()
+
+	mux := chi.NewRouter()
+
+	httpSvc := httpserver.NewServer(ctx, cancel, svcName, httpServerConfig, httpapi.MakeHandler(svc, am, mux, logger, cfg.InstanceID), logger)
+
+	if cfg.SendTelemetry {
+		chc := chclient.New(svcName, magistrala.Version, logger, cancel)
+		go chc.CallHome(ctx)
+	}
+
+	g.Go(func() error {
+		return svc.StartScheduler(ctx)
+	})
+
+	g.Go(func() error {
+		return httpSvc.Start()
+	})
+
+	g.Go(func() error {
+		return server.StopSignalHandler(ctx, cancel, logger, svcName, httpSvc)
+	})
+
+	if err := g.Wait(); err != nil {
+		logger.Error(fmt.Sprintf("%s service terminated: %s", svcName, err))
+	}
+}
+
+func newService(ctx context.Context, cfg config, db pgclient.Database, runInfo chan pkglog.RunInfo, rePubSub messaging.PubSub, writersPub, alarmsPub messaging.Publisher, ec email.Config, logger *slog.Logger, readersClient grpcReadersV1.ReadersServiceClient, callout callout.Callout, tracer trace.Tracer) (re.Service, error) {
+	repo := repg.NewRepository(db)
+	idp := uuid.New()
+
+	emailerClient, err := emailer.New(&ec)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to configure e-mailing util: %s", err.Error()))
+	}
+
+	atomCfg := atom.LoadConfig()
+
+	var csvc re.Service
+	csvc, err = re.NewService(repo, runInfo, idp, rePubSub, writersPub, alarmsPub, ticker.NewTicker(time.Second*30), emailerClient, readersClient)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create RE service: %w", err)
+	}
+	csvc = re.WithAtom(csvc, atom.NewClient(atomCfg))
+
+	csvc, err = events.NewEventStoreMiddleware(ctx, csvc, cfg.ESURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to init re event store middleware: %w", err)
+	}
+
+	permConfig, err := permissions.ParsePermissionsFile(cfg.PermissionsFile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse permissions file: %w", err)
+	}
+
+	ruleOps, _, err := permConfig.GetEntityPermissions(operations.EntityType)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get rule permissions: %w", err)
+	}
+
+	entitiesOps, err := permissions.NewEntitiesOperations(
+		permissions.EntitiesPermission{
+			operations.EntityType: ruleOps,
+		},
+		permissions.EntitiesOperationDetails[permissions.Operation]{
+			operations.EntityType: operations.OperationDetails(),
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create entities operations: %w", err)
+	}
+
+	csvc, err = middleware.AtomAuthorizationMiddleware(csvc, atom.NewClient(atomCfg), entitiesOps)
+	if err != nil {
+		return nil, err
+	}
+	csvc, err = middleware.NewCallout(csvc, callout, entitiesOps)
+	if err != nil {
+		return nil, err
+	}
+	csvc = middleware.LoggingMiddleware(csvc, logger)
+	counter, latency := prometheus.MakeMetrics("re", "api")
+	csvc = middleware.NewMetricsMiddleware(counter, latency, csvc)
+	csvc = middleware.NewTracingMiddleware(tracer, csvc)
+
+	return csvc, nil
+}

cmd/reports/main.go

@@ -0,0 +1,331 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+// Package main contains reports main function to start the service.
+package main
+
+import (
+	"context"
+	"embed"
+	"fmt"
+	"log"
+	"log/slog"
+	"net/url"
+	"os"
+	"time"
+
+	chclient "github.com/absmach/callhome/pkg/client"
+	"github.com/absmach/magistrala"
+	grpcReadersV1 "github.com/absmach/magistrala/api/grpc/readers/v1"
+	"github.com/absmach/magistrala/internal/atom"
+	"github.com/absmach/magistrala/internal/email"
+	mglog "github.com/absmach/magistrala/logger"
+	smqauthn "github.com/absmach/magistrala/pkg/authn"
+	atomauthn "github.com/absmach/magistrala/pkg/authn/atom"
+	"github.com/absmach/magistrala/pkg/callout"
+	"github.com/absmach/magistrala/pkg/emailer"
+	"github.com/absmach/magistrala/pkg/grpcclient"
+	jaegerclient "github.com/absmach/magistrala/pkg/jaeger"
+	pkglog "github.com/absmach/magistrala/pkg/logger"
+	"github.com/absmach/magistrala/pkg/permissions"
+	pgclient "github.com/absmach/magistrala/pkg/postgres"
+	"github.com/absmach/magistrala/pkg/prometheus"
+	"github.com/absmach/magistrala/pkg/server"
+	httpserver "github.com/absmach/magistrala/pkg/server/http"
+	"github.com/absmach/magistrala/pkg/ticker"
+	"github.com/absmach/magistrala/pkg/uuid"
+	grpcClient "github.com/absmach/magistrala/readers/api/grpc"
+	"github.com/absmach/magistrala/reports"
+	httpapi "github.com/absmach/magistrala/reports/api"
+	reportsevents "github.com/absmach/magistrala/reports/events"
+	"github.com/absmach/magistrala/reports/middleware"
+	"github.com/absmach/magistrala/reports/operations"
+	repg "github.com/absmach/magistrala/reports/postgres"
+	"github.com/caarlos0/env/v11"
+	"github.com/go-chi/chi/v5"
+	"go.opentelemetry.io/otel/trace"
+	"golang.org/x/sync/errgroup"
+)
+
+const (
+	svcName          = "reports"
+	envPrefixDB      = "MG_REPORTS_DB_"
+	envPrefixHTTP    = "MG_REPORTS_HTTP_"
+	envPrefixCallout = "MG_REPORTS_CALLOUT_"
+	defDB            = "repo"
+	defSvcHTTPPort   = "9017"
+	envPrefixGrpc    = "MG_TIMESCALE_READER_GRPC_"
+	templatePath     = "template/reports_default_template.html"
+	reportEntity     = "report"
+)
+
+// We use a buffered channel to prevent blocking, as logging is an expensive operation.
+const channBuffer = 256
+
+//go:embed template/reports_default_template.html
+var templateFS embed.FS
+
+type config struct {
+	LogLevel            string  `env:"MG_REPORTS_LOG_LEVEL"           envDefault:"info"`
+	InstanceID          string  `env:"MG_REPORTS_INSTANCE_ID"         envDefault:""`
+	JaegerURL           url.URL `env:"MG_JAEGER_URL"                 envDefault:"http://localhost:4318/v1/traces"`
+	SendTelemetry       bool    `env:"MG_SEND_TELEMETRY"             envDefault:"true"`
+	ESURL               string  `env:"MG_ES_URL"                     envDefault:"nats://localhost:4222"`
+	ESConsumerName      string  `env:"MG_REPORTS_EVENT_CONSUMER"      envDefault:"reports"`
+	TraceRatio          float64 `env:"MG_JAEGER_TRACE_RATIO"         envDefault:"1.0"`
+	BrokerURL           string  `env:"MG_MESSAGE_BROKER_URL"         envDefault:"nats://localhost:4222"`
+	DefaultTemplatePath string  `env:"MG_REPORTS_DEFAULT_TEMPLATE"    envDefault:""`
+	ConverterURL        string  `env:"MG_PDF_CONVERTER_URL"           envDefault:"http://localhost:4000/pdf"`
+	PermissionsFile     string  `env:"MG_PERMISSIONS_FILE"           envDefault:"permission.yaml"`
+}
+
+func main() {
+	ctx, cancel := context.WithCancel(context.Background())
+	g, ctx := errgroup.WithContext(ctx)
+
+	cfg := config{}
+	if err := env.Parse(&cfg); err != nil {
+		log.Fatalf("failed to load %s configuration : %s", svcName, err)
+	}
+
+	var logger *slog.Logger
+	logger, err := mglog.New(os.Stdout, cfg.LogLevel)
+	if err != nil {
+		log.Fatalf("failed to init logger: %s", err.Error())
+	}
+
+	var exitCode int
+	defer mglog.ExitWithError(&exitCode)
+
+	if cfg.InstanceID == "" {
+		if cfg.InstanceID, err = uuid.New().ID(); err != nil {
+			logger.Error(fmt.Sprintf("failed to generate instanceID: %s", err))
+			exitCode = 1
+			return
+		}
+	}
+
+	var templateData []byte
+
+	switch cfg.DefaultTemplatePath {
+	case "":
+		templateData, err = templateFS.ReadFile(templatePath)
+	default:
+		templateData, err = os.ReadFile(templatePath)
+	}
+
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to read report template: %s", err))
+		exitCode = 1
+		return
+	}
+
+	template := reports.ReportTemplate(string(templateData))
+
+	if err := template.Validate(); err != nil {
+		logger.Error(fmt.Sprintf("failed to validate report template: %s", err))
+		exitCode = 1
+		return
+	}
+	logger.Info("Report template validated successfully")
+
+	ec := email.Config{}
+	if err := env.Parse(&ec); err != nil {
+		logger.Error(fmt.Sprintf("failed to load email configuration : %s", err))
+		exitCode = 1
+
+		return
+	}
+
+	callCfg := callout.Config{}
+	if err := env.ParseWithOptions(&callCfg, env.Options{Prefix: envPrefixCallout}); err != nil {
+		logger.Error(fmt.Sprintf("failed to parse callout config : %s", err))
+		exitCode = 1
+		return
+	}
+
+	dbConfig := pgclient.Config{Name: defDB}
+	if err := env.ParseWithOptions(&dbConfig, env.Options{Prefix: envPrefixDB}); err != nil {
+		logger.Error(err.Error())
+		exitCode = 1
+
+		return
+	}
+
+	migration, err := repg.Migration()
+	if err != nil {
+		logger.Error(err.Error())
+		exitCode = 1
+
+		return
+	}
+
+	db, err := pgclient.Setup(dbConfig, *migration)
+	if err != nil {
+		logger.Error(err.Error())
+		exitCode = 1
+
+		return
+	}
+	defer db.Close()
+
+	tp, err := jaegerclient.NewProvider(ctx, svcName, cfg.JaegerURL, cfg.InstanceID, cfg.TraceRatio)
+	if err != nil {
+		logger.Error(fmt.Sprintf("Failed to init Jaeger: %s", err))
+		exitCode = 1
+
+		return
+	}
+	defer func() {
+		if err := tp.Shutdown(ctx); err != nil {
+			logger.Error(fmt.Sprintf("Error shutting down tracer provider: %v", err))
+		}
+	}()
+	tracer := tp.Tracer(svcName)
+
+	httpServerConfig := server.Config{Port: defSvcHTTPPort}
+	if err := env.ParseWithOptions(&httpServerConfig, env.Options{Prefix: envPrefixHTTP}); err != nil {
+		logger.Error(fmt.Sprintf("failed to load %s HTTP server configuration : %s", svcName, err))
+		exitCode = 1
+
+		return
+	}
+
+	callout, err := callout.New(callCfg)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create new callout: %s", err))
+		exitCode = 1
+		return
+	}
+
+	atomCfg := atom.LoadConfig()
+	if atomCfg.URL == "" {
+		logger.Error("ATOM_URL is required")
+		exitCode = 1
+		return
+	}
+	authnSvc := atomauthn.NewAuthentication()
+	logger.Info("AuthN configured to use Atom bearer tokens")
+	am := smqauthn.NewAuthNMiddleware(authnSvc)
+
+	logger.Info("AuthZ configured to use Atom PDP")
+	database := pgclient.NewDatabase(db, dbConfig, tracer)
+	regrpcCfg := grpcclient.Config{}
+	if err := env.ParseWithOptions(&regrpcCfg, env.Options{Prefix: envPrefixGrpc}); err != nil {
+		logger.Error(fmt.Sprintf("failed to load clients gRPC client configuration : %s", err))
+		exitCode = 1
+		return
+	}
+
+	client, err := grpcclient.NewHandler(regrpcCfg)
+	if err != nil {
+		exitCode = 1
+		return
+	}
+	defer client.Close()
+
+	readersClient := grpcClient.NewReadersClient(client.Connection(), regrpcCfg.Timeout)
+	logger.Info("Readers gRPC client successfully connected to readers gRPC server " + client.Secure())
+
+	runInfo := make(chan pkglog.RunInfo, channBuffer)
+
+	svc, err := newService(ctx, cfg, database, runInfo, ec, logger, readersClient, template, callout, tracer)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to create services: %s", err))
+		exitCode = 1
+
+		return
+	}
+
+	go func() {
+		for info := range runInfo {
+			logger.LogAttrs(context.Background(), info.Level, info.Message, info.Details...)
+		}
+	}()
+
+	mux := chi.NewRouter()
+
+	httpSvc := httpserver.NewServer(ctx, cancel, svcName, httpServerConfig, httpapi.MakeHandler(svc, am, mux, logger, cfg.InstanceID), logger)
+
+	if cfg.SendTelemetry {
+		chc := chclient.New(svcName, magistrala.Version, logger, cancel)
+		go chc.CallHome(ctx)
+	}
+
+	g.Go(func() error {
+		return svc.StartScheduler(ctx)
+	})
+
+	g.Go(func() error {
+		return httpSvc.Start()
+	})
+
+	g.Go(func() error {
+		return server.StopSignalHandler(ctx, cancel, logger, svcName, httpSvc)
+	})
+
+	if err := g.Wait(); err != nil {
+		logger.Error(fmt.Sprintf("%s service terminated: %s", svcName, err))
+	}
+}
+
+func newService(ctx context.Context, cfg config, db pgclient.Database, runInfo chan pkglog.RunInfo, ec email.Config, logger *slog.Logger, readersClient grpcReadersV1.ReadersServiceClient, template reports.ReportTemplate, callout callout.Callout, tracer trace.Tracer) (reports.Service, error) {
+	repo := repg.NewRepository(db)
+	idp := uuid.New()
+
+	emailClient, err := emailer.New(&ec)
+	if err != nil {
+		logger.Error(fmt.Sprintf("failed to configure e-mailing util: %s", err.Error()))
+	}
+
+	atomCfg := atom.LoadConfig()
+
+	var csvc reports.Service
+	csvc, err = reports.NewService(repo, runInfo, idp, ticker.NewTicker(time.Second*30), emailClient, readersClient, template, cfg.ConverterURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create reports service: %w", err)
+	}
+	csvc = reports.WithAtom(csvc, atom.NewClient(atomCfg))
+
+	csvc, err = reportsevents.NewEventStoreMiddleware(ctx, csvc, cfg.ESURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to init reports event store middleware: %w", err)
+	}
+
+	permConfig, err := permissions.ParsePermissionsFile(cfg.PermissionsFile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to parse permissions file: %w", err)
+	}
+
+	reportOps, _, err := permConfig.GetEntityPermissions(reportEntity)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get report permissions: %w", err)
+	}
+
+	entitiesOps, err := permissions.NewEntitiesOperations(
+		permissions.EntitiesPermission{
+			operations.EntityType: reportOps,
+		},
+		permissions.EntitiesOperationDetails[permissions.Operation]{
+			operations.EntityType: operations.OperationDetails(),
+		},
+	)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create entities operations: %w", err)
+	}
+
+	csvc, err = middleware.AtomAuthorizationMiddleware(csvc, atom.NewClient(atomCfg), entitiesOps)
+	if err != nil {
+		return nil, err
+	}
+	csvc, err = middleware.NewCallout(csvc, callout, entitiesOps)
+	if err != nil {
+		return nil, err
+	}
+	csvc = middleware.LoggingMiddleware(csvc, logger)
+	counter, latency := prometheus.MakeMetrics("reports", "api")
+	csvc = middleware.NewMetricsMiddleware(counter, latency, csvc)
+	csvc = middleware.NewTracingMiddleware(tracer, csvc)
+
+	return csvc, nil
+}

cmd/reports/template/reports_default_template.html

@@ -0,0 +1,479 @@
+<!-- Copyright (c) Abstract Machines -->
+<!-- SPDX-License-Identifier: Apache-2.0 -->
+
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>{{.Title}}</title>
+    <style>
+        :root {
+            --primary-color: rgb(41, 128, 185);
+            --secondary-color: rgb(26, 82, 118);
+            --subtle-color: rgb(189, 195, 199);
+            --table-header-bg: rgb(236, 240, 241);
+            --alternate-row: rgb(245, 247, 249);
+            --text-primary: rgb(44, 62, 80);
+            --text-secondary: rgb(127, 140, 141);
+            --white: #ffffff;
+        }
+
+        * {
+            margin: 0;
+            padding: 0;
+            box-sizing: border-box;
+        }
+
+        body {
+            font-family: Arial, sans-serif;
+            background-color: var(--white);
+            color: var(--text-primary);
+            line-height: 1.4;
+        }
+
+        .page {
+            width: 210mm;
+            height: 297mm;
+            padding: 15mm 10mm;
+            margin: 0 auto;
+            background: var(--white);
+            box-shadow: 0 0 10px rgba(0,0,0,0.1);
+            position: relative;
+            page-break-after: always;
+            display: flex;
+            flex-direction: column;
+        }
+
+        .page:last-child {
+            page-break-after: auto;
+        }
+
+        .header {
+            flex-shrink: 0;
+            margin-bottom: 8mm;
+        }
+
+        .header-top-bar {
+            height: 8px;
+            background-color: var(--primary-color);
+            margin: 0 0 8px 0;
+        }
+
+        .header-content {
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            margin-bottom: 8px;
+        }
+
+        .header-title {
+            font-size: 20px;
+            font-weight: bold;
+            color: var(--primary-color);
+            text-align: center;
+            flex-grow: 1;
+        }
+
+        .header-date {
+            font-size: 10px;
+            font-style: italic;
+            color: var(--text-secondary);
+            text-align: right;
+            width: 100px;
+        }
+
+        .header-separator {
+            height: 2px;
+            background-color: var(--subtle-color);
+            margin: 5px 0;
+            position: relative;
+        }
+
+        .header-separator::after {
+            content: '';
+            position: absolute;
+            top: 3px;
+            left: 0;
+            right: 0;
+            height: 1px;
+            background-color: var(--subtle-color);
+        }
+
+        .content-area {
+            flex-grow: 1;
+            display: flex;
+            flex-direction: column;
+            overflow: hidden;
+        }
+
+        .metrics-section {
+            flex-shrink: 0;
+            margin-bottom: 10px;
+        }
+
+        .metrics-section.continuation {
+            display: none;
+        }
+
+        .metrics-title {
+            font-size: 16px;
+            font-weight: bold;
+            color: var(--secondary-color);
+            margin-bottom: 8px;
+        }
+
+        .metrics-info {
+            background-color: var(--alternate-row);
+            padding: 10px;
+            border-radius: 4px;
+            margin-bottom: 8px;
+        }
+
+        .metric-row {
+            display: flex;
+            margin-bottom: 6px;
+        }
+
+        .metric-row:last-child {
+            margin-bottom: 0;
+        }
+
+        .metric-label {
+            font-weight: bold;
+            color: var(--text-primary);
+            width: 120px;
+            font-size: 11px;
+        }
+
+        .metric-value {
+            font-style: italic;
+            color: var(--text-primary);
+            font-size: 11px;
+            flex-grow: 1;
+        }
+
+        .record-count {
+            text-align: right;
+            font-size: 10px;
+            font-style: italic;
+            color: var(--text-secondary);
+            margin-bottom: 8px;
+            flex-shrink: 0;
+        }
+
+        .table-container {
+            flex-grow: 1;
+            overflow: hidden;
+        }
+
+        .data-table {
+            width: 100%;
+            border-collapse: collapse;
+        }
+
+        .table-header-bar {
+            height: 4px;
+            background-color: var(--primary-color);
+        }
+
+        .data-table th {
+            background-color: var(--table-header-bg);
+            color: var(--secondary-color);
+            font-weight: bold;
+            font-size: 11px;
+            padding: 8px;
+            text-align: center;
+            border-bottom: 2px solid var(--subtle-color);
+        }
+
+        .data-table td {
+            padding: 6px 8px;
+            font-size: 10px;
+            text-align: center;
+            border-bottom: 1px solid #eee;
+        }
+
+        .data-table tr:nth-child(even) {
+            background-color: var(--alternate-row);
+        }
+
+        .data-table tr:hover {
+            background-color: rgba(41, 128, 185, 0.05);
+        }
+
+        .col-time {
+            width: 25%;
+            color: var(--text-primary);
+        }
+
+        .col-value {
+            width: 17%;
+            color: var(--text-primary);
+            font-weight: normal;
+        }
+
+        .col-unit {
+            width: 17%;
+            color: var(--text-secondary);
+            font-style: italic;
+        }
+
+        .col-protocol {
+            width: 17%;
+            color: var(--text-primary);
+        }
+
+        .col-subtopic {
+            width: 24%;
+            color: var(--secondary-color);
+        }
+
+        .footer {
+            flex-shrink: 0;
+            border-top: 2px solid var(--subtle-color);
+            padding-top: 6px;
+            margin-top: 8mm;
+        }
+
+        .footer-separator {
+            height: 1px;
+            background-color: var(--subtle-color);
+            margin-bottom: 4px;
+            position: relative;
+        }
+
+        .footer-separator::after {
+            content: '';
+            position: absolute;
+            top: 1px;
+            left: 0;
+            right: 0;
+            height: 1px;
+            background-color: var(--subtle-color);
+        }
+
+        .footer-content {
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+        }
+
+        .footer-generated {
+            font-size: 8px;
+            font-style: italic;
+            color: var(--text-secondary);
+        }
+
+        .footer-page {
+            font-size: 9px;
+            font-weight: bold;
+            color: var(--text-primary);
+        }
+
+        @media print {
+            @page {
+                size: A4;
+                margin: 0;
+            }
+
+            html, body {
+                width: 210mm;
+                height: 297mm;
+                margin: 0;
+                padding: 0;
+            }
+
+            .page {
+                margin: 0;
+                box-shadow: none;
+            }
+        }
+    </style>
+</head>
+<body>
+    {{if gt (len .Reports) 0}}
+    {{$firstPageRows := 24}}
+    {{$continuationPageRows := 32}}
+    {{$totalPages := 0}}
+    
+    {{/* Calculate total pages across all reports */}}
+    {{range $report := .Reports}}
+        {{$totalMessages := len .Messages}}
+        {{$reportPages := 1}}
+        {{if gt $totalMessages $firstPageRows}}
+            {{$remaining := sub $totalMessages $firstPageRows}}
+            {{$additionalPages := div $remaining $continuationPageRows}}
+            {{if gt (mod $remaining $continuationPageRows) 0}}
+                {{$additionalPages = add $additionalPages 1}}
+            {{end}}
+            {{$reportPages = add 1 $additionalPages}}
+        {{end}}
+        {{$totalPages = add $totalPages $reportPages}}
+    {{end}}
+    
+    {{$globalPage := 0}}
+    
+    {{range $reportIndex, $report := .Reports}}
+    {{$totalMessages := len .Messages}}
+    {{$pageCount := 1}}
+    {{if gt $totalMessages $firstPageRows}}
+        {{$remaining := sub $totalMessages $firstPageRows}}
+        {{$additionalPages := div $remaining $continuationPageRows}}
+        {{if gt (mod $remaining $continuationPageRows) 0}}
+            {{$additionalPages = add $additionalPages 1}}
+        {{end}}
+        {{$pageCount = add 1 $additionalPages}}
+    {{end}}
+    
+    {{range $pageNum := iterate $pageCount}}
+    {{$globalPage = add $globalPage 1}}
+    {{$isFirstPage := eq $pageNum 0}}
+    {{$startRow := getStartRow $pageNum $firstPageRows $continuationPageRows}}
+    {{$endRow := getEndRow $pageNum $firstPageRows $continuationPageRows $totalMessages}}
+    
+    <div class="page">
+        <div class="header">
+            <div class="header-top-bar"></div>
+            <div class="header-content">
+                <div style="width: 100px;"></div>
+                <div class="header-title">{{$.Title}}</div>
+                <div class="header-date">{{$.GeneratedDate}}{{if $.Timezone}} ({{$.Timezone}}){{end}}</div>
+            </div>
+            <div class="header-separator"></div>
+        </div>
+
+        <div class="content-area">
+            {{if $isFirstPage}}
+            <div class="metrics-section">
+                <div class="metrics-title">Metrics</div>
+                <div class="metrics-info">
+                    <div class="metric-row">
+                        <div class="metric-label">Name:</div>
+                        <div class="metric-value">{{$report.Metric.Name}}</div>
+                    </div>
+                    {{if $report.Metric.ClientID}}
+                    <div class="metric-row">
+                        <div class="metric-label">Device ID:</div>
+                        <div class="metric-value">{{$report.Metric.ClientID}}</div>
+                    </div>
+                    {{end}}
+                    <div class="metric-row">
+                        <div class="metric-label">Channel ID:</div>
+                        <div class="metric-value">{{$report.Metric.ChannelID}}</div>
+                    </div>
+                </div>
+            </div>
+
+            <div class="record-count">
+                Total Records: {{$totalMessages}}
+            </div>
+            {{else}}
+            <div class="metrics-section continuation">
+                <div class="metrics-title">Metrics (continued)</div>
+            </div>
+            {{end}}
+
+            <div class="table-container">
+                <div class="table-header-bar"></div>
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th class="col-time">Time</th>
+                            <th class="col-value">Value</th>
+                            <th class="col-unit">Unit</th>
+                            <th class="col-protocol">Protocol</th>
+                            <th class="col-subtopic">Subtopic</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        {{range $msgIndex, $msg := $report.Messages}}
+                        {{if and (ge $msgIndex $startRow) (lt $msgIndex $endRow)}}
+                        <tr>
+                            <td class="col-time">{{formatTime $msg.Time}}</td>
+                            <td class="col-value">{{formatValue $msg}}</td>
+                            <td class="col-unit">{{$msg.Unit}}</td>
+                            <td class="col-protocol">{{$msg.Protocol}}</td>
+                            <td class="col-subtopic">{{$msg.Subtopic}}</td>
+                        </tr>
+                        {{end}}
+                        {{end}}
+                    </tbody>
+                </table>
+            </div>
+        </div>
+
+        <div class="footer">
+            <div class="footer-separator"></div>
+            <div class="footer-content">
+                <div class="footer-generated">Generated: {{$.GeneratedTime}}{{if $.Timezone}} ({{$.Timezone}}){{end}}</div>
+                <div class="footer-page">Page {{$globalPage}} of {{$totalPages}}</div>
+            </div>
+        </div>
+    </div>
+    {{end}}
+    {{end}}
+    {{else}}
+    <div class="page">
+        <div class="header">
+            <div class="header-top-bar"></div>
+            <div class="header-content">
+                <div style="width: 100px;"></div>
+                <div class="header-title">{{.Title}}</div>
+                <div class="header-date">{{.GeneratedDate}}{{if .Timezone}} ({{.Timezone}}){{end}}</div>
+            </div>
+            <div class="header-separator"></div>
+        </div>
+
+        <div class="content-area">
+            <div class="metrics-section">
+                <div class="metrics-title">Metrics</div>
+                <div class="metrics-info">
+                    <div class="metric-row">
+                        <div class="metric-label">Name:</div>
+                        <div class="metric-value">No Report</div>
+                    </div>
+                    <div class="metric-row">
+                        <div class="metric-label">Channel ID:</div>
+                        <div class="metric-value">N/A</div>
+                    </div>
+                </div>
+            </div>
+
+            <div class="record-count">
+                Total Records: 0
+            </div>
+
+            <div class="table-container">
+                <div class="table-header-bar"></div>
+                <table class="data-table">
+                    <thead>
+                        <tr>
+                            <th class="col-time">Time</th>
+                            <th class="col-value">Value</th>
+                            <th class="col-unit">Unit</th>
+                            <th class="col-protocol">Protocol</th>
+                            <th class="col-subtopic">Subtopic</th>
+                        </tr>
+                    </thead>
+                    <tbody>
+                        <tr>
+                            <td colspan="5" style="text-align: center; font-style: italic; color: #888;">No data available</td>
+                        </tr>
+                    </tbody>
+                </table>
+            </div>
+        </div>
+
+        <div class="footer">
+            <div class="footer-separator"></div>
+            <div class="footer-content">
+                <div class="footer-generated">Generated: {{.GeneratedTime}}{{if .Timezone}} ({{.Timezone}}){{end}}</div>
+                <div class="footer-page">Page 1 of 1</div>
+            </div>
+        </div>
+    </div>
+    {{end}}
+
+</body>
+</html>

cmd/timescale-reader/main.go

@@ -14,8 +14,8 @@ import (
 	chclient "github.com/absmach/callhome/pkg/client"
 	"github.com/absmach/magistrala"
 	grpcReadersV1 "github.com/absmach/magistrala/api/grpc/readers/v1"
+	"github.com/absmach/magistrala/internal/atom"
 	mglog "github.com/absmach/magistrala/logger"
-	"github.com/absmach/magistrala/pkg/atom"
 	atomauthn "github.com/absmach/magistrala/pkg/authn/atom"
 	pgclient "github.com/absmach/magistrala/pkg/postgres"
 	"github.com/absmach/magistrala/pkg/prometheus"

cmd/timescale-writer/main.go

@@ -17,12 +17,11 @@ import (
 	"github.com/absmach/magistrala/consumers"
 	consumertracing "github.com/absmach/magistrala/consumers/tracing"
 	httpapi "github.com/absmach/magistrala/consumers/writers/api"
+	"github.com/absmach/magistrala/consumers/writers/brokers"
 	"github.com/absmach/magistrala/consumers/writers/timescale"
 	mglog "github.com/absmach/magistrala/logger"
 	jaegerclient "github.com/absmach/magistrala/pkg/jaeger"
-	"github.com/absmach/magistrala/pkg/messaging"
 	brokerstracing "github.com/absmach/magistrala/pkg/messaging/brokers/tracing"
-	"github.com/absmach/magistrala/pkg/messaging/writers"
 	pgclient "github.com/absmach/magistrala/pkg/postgres"
 	"github.com/absmach/magistrala/pkg/prometheus"
 	"github.com/absmach/magistrala/pkg/server"
@@ -42,16 +41,13 @@ const (
 )
 
 type config struct {
-	LogLevel         string  `env:"MG_TIMESCALE_WRITER_LOG_LEVEL"          envDefault:"info"`
-	ConfigPath       string  `env:"MG_TIMESCALE_WRITER_CONFIG_PATH"        envDefault:"/config.toml"`
-	BrokerURL        string  `env:"MG_MESSAGE_BROKER_URL"                  envDefault:"nats://localhost:4222"`
-	BrokerClientCert string  `env:"MG_TIMESCALE_WRITER_BROKER_CLIENT_CERT" envDefault:""`
-	BrokerClientKey  string  `env:"MG_TIMESCALE_WRITER_BROKER_CLIENT_KEY"  envDefault:""`
-	BrokerCACerts    string  `env:"MG_TIMESCALE_WRITER_BROKER_CA_CERTS"    envDefault:""`
-	JaegerURL        url.URL `env:"MG_JAEGER_URL"                          envDefault:"http://localhost:4318/v1/traces"`
-	SendTelemetry    bool    `env:"MG_SEND_TELEMETRY"                      envDefault:"true"`
-	InstanceID       string  `env:"MG_TIMESCALE_WRITER_INSTANCE_ID"        envDefault:""`
-	TraceRatio       float64 `env:"MG_JAEGER_TRACE_RATIO"                  envDefault:"1.0"`
+	LogLevel      string  `env:"MG_TIMESCALE_WRITER_LOG_LEVEL"     envDefault:"info"`
+	ConfigPath    string  `env:"MG_TIMESCALE_WRITER_CONFIG_PATH"   envDefault:"/config.toml"`
+	BrokerURL     string  `env:"MG_MESSAGE_BROKER_URL"            envDefault:"nats://localhost:4222"`
+	JaegerURL     url.URL `env:"MG_JAEGER_URL"                    envDefault:"http://localhost:4318/v1/traces"`
+	SendTelemetry bool    `env:"MG_SEND_TELEMETRY"                envDefault:"true"`
+	InstanceID    string  `env:"MG_TIMESCALE_WRITER_INSTANCE_ID"   envDefault:""`
+	TraceRatio    float64 `env:"MG_JAEGER_TRACE_RATIO"            envDefault:"1.0"`
 }
 
 func main() {
@@ -116,16 +112,7 @@ func main() {
 	repo := newService(db, logger)
 	repo = consumertracing.NewBlocking(tracer, repo, httpServerConfig)
 
-	// The mTLS client identity is optional: brokers that expose an unauthenticated
-	// listener need none. Passing the option with empty paths would fail the
-	// connection outright, so only ask for it once one of them is configured. A
-	// partial configuration still fails, since half an identity is not a usable one.
-	var brokerOpts []messaging.Option
-	if cfg.BrokerClientCert != "" || cfg.BrokerClientKey != "" || cfg.BrokerCACerts != "" {
-		brokerOpts = append(brokerOpts, writers.InternalMetadata(cfg.BrokerClientCert, cfg.BrokerClientKey, cfg.BrokerCACerts))
-	}
-
-	pubSub, err := writers.NewPubSub(ctx, cfg.BrokerURL, logger, brokerOpts...)
+	pubSub, err := brokers.NewPubSub(ctx, cfg.BrokerURL, logger)
 	if err != nil {
 		logger.Error(fmt.Sprintf("failed to connect to message broker: %s", err))
 		exitCode = 1
@@ -134,7 +121,7 @@ func main() {
 	defer pubSub.Close()
 	pubSub = brokerstracing.NewPubSub(httpServerConfig, tracer, pubSub)
 
-	if err = consumers.Start(ctx, svcName, pubSub, repo, cfg.ConfigPath, writers.AllTopic, logger); err != nil {
+	if err = consumers.Start(ctx, svcName, pubSub, repo, cfg.ConfigPath, brokers.AllTopic, logger); err != nil {
 		logger.Error(fmt.Sprintf("failed to create Timescale writer: %s", err))
 		exitCode = 1
 		return

config.toml

@@ -17,5 +17,6 @@ user_token = ""
   groups_url = "http://localhost:9004"
   host_url = "http://localhost"
   http_adapter_url = "http://localhost:8008"
+  journal_url = "http://localhost:9021"
   tls_verification = false
   users_url = "http://localhost:9002"

consumers/notifiers/README.md

@@ -8,7 +8,7 @@ The service is configured using environment variables. Values shown are from [do
 
 ### SMTP notifier (email)
 
-Used by `consumers/notifiers/smtp` via `pkg/email`.
+Used by `consumers/notifiers/smtp` via `internal/email`.
 
 | Variable                | Description                                    | Default            |
 | ----------------------- | ---------------------------------------------- | ------------------ |
@@ -93,7 +93,7 @@ Defined in `consumers/notifiers/smpp/README.md`.
 - **Service layer**: `consumers/notifiers/service.go` handles authn, ID creation, and notification dispatch.
 - **Repository**: `consumers/notifiers/postgres` persists subscriptions and supports filtering.
 - **Notifier implementations**: `consumers/notifiers/smtp` (email) and `consumers/notifiers/smpp` (SMS).
-- **Email agent**: `pkg/email` manages SMTP connectivity and template rendering.
+- **Email agent**: `internal/email` manages SMTP connectivity and template rendering.
 
 ### Subscriptions table
 

consumers/notifiers/api/endpoint_test.go

@@ -17,9 +17,9 @@ import (
 	"github.com/absmach/magistrala/consumers/notifiers"
 	"github.com/absmach/magistrala/consumers/notifiers/api"
 	"github.com/absmach/magistrala/consumers/notifiers/mocks"
+	"github.com/absmach/magistrala/internal/testsutil"
 	mglog "github.com/absmach/magistrala/logger"
 	svcerr "github.com/absmach/magistrala/pkg/errors/service"
-	"github.com/absmach/magistrala/pkg/testsutil"
 	"github.com/absmach/magistrala/pkg/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"

consumers/notifiers/service_test.go

@@ -12,12 +12,12 @@ import (
 	smqmocks "github.com/absmach/magistrala/consumers/mocks"
 	"github.com/absmach/magistrala/consumers/notifiers"
 	"github.com/absmach/magistrala/consumers/notifiers/mocks"
+	"github.com/absmach/magistrala/internal/testsutil"
 	smqauthn "github.com/absmach/magistrala/pkg/authn"
 	authnmocks "github.com/absmach/magistrala/pkg/authn/mocks"
 	"github.com/absmach/magistrala/pkg/errors"
 	svcerr "github.com/absmach/magistrala/pkg/errors/service"
 	"github.com/absmach/magistrala/pkg/messaging"
-	"github.com/absmach/magistrala/pkg/testsutil"
 	"github.com/absmach/magistrala/pkg/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"

consumers/notifiers/smtp/notifier.go

@@ -7,7 +7,7 @@ import (
 	"fmt"
 
 	"github.com/absmach/magistrala/consumers"
-	"github.com/absmach/magistrala/pkg/email"
+	"github.com/absmach/magistrala/internal/email"
 	"github.com/absmach/magistrala/pkg/messaging"
 )
 

consumers/writers/README.md

@@ -104,7 +104,7 @@ time_fields = [
 ]
 ```
 
-The topic filter uses slash-delimited MQTT-style syntax (`+`, `#`) in the config file for both backends. Writers do not expose broker mode, delivery policy, or consumer-group settings in this file. They always consume through the stream-backed broker adapter in `pkg/messaging/writers`:
+The topic filter uses slash-delimited MQTT-style syntax (`+`, `#`) in the config file for both backends. Writers do not expose broker mode, delivery policy, or consumer-group settings in this file. They always consume through the stream-backed broker adapter in `consumers/writers/brokers`:
 
 - NATS builds use JetStream streams with durable consumers.
 - FluxMQ builds publish to and consume from the `writers` stream queue while preserving the same `writers/#` config syntax.
@@ -129,7 +129,7 @@ The topic filter uses slash-delimited MQTT-style syntax (`+`, `#`) in the config
 
 ### Components
 
-- **Message broker adapter**: `pkg/messaging/writers` (NATS JetStream or FluxMQ stream queues).
+- **Message broker adapter**: `consumers/writers/brokers` (NATS JetStream or FluxMQ stream queues).
 - **Writer services**: `consumers/writers/postgres` and `consumers/writers/timescale`.
 - **HTTP API**: `consumers/writers/api` exposes `/health` and `/metrics`.
 - **Migrations**: `consumers/writers/*/init.go` defines the schema and indexes.

consumers/writers/brokers/brokers_fluxmq.go

@@ -0,0 +1,53 @@
+// Copyright (c) Abstract Machines
+// SPDX-License-Identifier: Apache-2.0
+
+//go:build msg_fluxmq
+// +build msg_fluxmq
+
+package brokers
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"github.com/absmach/magistrala/pkg/messaging"
+	broker "github.com/absmach/magistrala/pkg/messaging/fluxmq"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+const (
+	AllTopic = "writers/#"
+
+	prefix = "writers"
+)
+
+var cfg = jetstream.StreamConfig{
+	Name:              "writers",
+	Description:       "Magistrala Rules Engine stream for handling internal messages",
+	Subjects:          []string{"writers/#"},
+	Retention:         jetstream.LimitsPolicy,
+	MaxMsgsPerSubject: 1e6,
+	MaxAge:            time.Hour * 24,
+	MaxMsgSize:        1024 * 1024,
+	Discard:           jetstream.DiscardOld,
+	Storage:           jetstream.FileStorage,
+}
+
+func NewPubSub(ctx context.Context, url string, logger *slog.Logger) (messaging.PubSub, error) {
+	pb, err := broker.NewPubSub(ctx, url, logger, broker.Prefix(prefix), broker.JSStreamConfig(cfg), broker.ConnectionName("writers-msg-pubsub"))
+	if err != nil {
+		return nil, err
+	}
+
+	return pb, nil
+}
+
+func NewPublisher(ctx context.Context, url string) (messaging.Publisher, error) {
+	pb, err := broker.NewPublisher(ctx, url, broker.Prefix(prefix), broker.JSStreamConfig(cfg), broker.ConnectionName("writers-msg-pub"))
+	if err != nil {
+		return nil, err
+	}
+
+	return pb, nil
+}

consumers/writers/brokers/brokers_nats.go

@@ -4,7 +4,7 @@
 //go:build !msg_fluxmq && !msg_rabbitmq && !rabbitmq
 // +build !msg_fluxmq,!msg_rabbitmq,!rabbitmq
 
-package writers
+package brokers
 
 import (
 	"context"
@@ -34,20 +34,8 @@ var cfg = jetstream.StreamConfig{
 	Storage:           jetstream.FileStorage,
 }
 
-// InternalMetadata is a no-op for the NATS backend. It exists for compile-time
-// compatibility with the FluxMQ variant; NATS carries metadata in the protobuf
-// message.
-func InternalMetadata(_, _, _ string) messaging.Option {
-	return func(_ any) error { return nil }
-}
-
-func NewPubSub(ctx context.Context, url string, logger *slog.Logger, opts ...messaging.Option) (messaging.PubSub, error) {
-	brokerOpts := []messaging.Option{
-		broker.Prefix(prefix),
-		broker.JSStreamConfig(cfg),
-	}
-	brokerOpts = append(brokerOpts, opts...)
-	pb, err := broker.NewPubSub(ctx, url, logger, brokerOpts...)
+func NewPubSub(ctx context.Context, url string, logger *slog.Logger) (messaging.PubSub, error) {
+	pb, err := broker.NewPubSub(ctx, url, logger, broker.Prefix(prefix), broker.JSStreamConfig(cfg))
 	if err != nil {
 		return nil, err
 	}
@@ -55,13 +43,8 @@ func NewPubSub(ctx context.Context, url string, logger *slog.Logger, opts ...mes
 	return pb, nil
 }
 
-func NewPublisher(ctx context.Context, url string, opts ...messaging.Option) (messaging.Publisher, error) {
-	brokerOpts := []messaging.Option{
-		broker.Prefix(prefix),
-		broker.JSStreamConfig(cfg),
-	}
-	brokerOpts = append(brokerOpts, opts...)
-	pb, err := broker.NewPublisher(ctx, url, brokerOpts...)
+func NewPublisher(ctx context.Context, url string) (messaging.Publisher, error) {
+	pb, err := broker.NewPublisher(ctx, url, broker.Prefix(prefix), broker.JSStreamConfig(cfg))
 	if err != nil {
 		return nil, err
 	}

docker/.env

@@ -141,7 +141,6 @@ MG_AUTH_GRPC_CLIENT_KEY=${GRPC_MTLS:+./ssl/certs/auth-grpc-client.key}
 MG_AUTH_GRPC_CLIENT_CA_CERTS=${GRPC_MTLS:+./ssl/certs/ca.crt}
 
 ### Atom Integration
-ATOM_IMAGE=ghcr.io/absmach/atom:latest
 ATOM_URL=http://atom:8080
 ATOM_PUBLIC_URL=http://nginx:80
 ATOM_JWKS_URL=http://atom:8080/.well-known/jwks.json
@@ -280,6 +279,13 @@ MG_EMAIL_PASSWORD=password
 MG_EMAIL_FROM_ADDRESS=from@example.com
 MG_EMAIL_FROM_NAME=Example
 MG_EMAIL_TEMPLATE=
+MG_EMAIL_INVITATION_TEMPLATE=invitation-sent-email.tmpl
+MG_EMAIL_ACCEPTANCE_TEMPLATE=invitation-accepted-email.tmpl
+MG_EMAIL_REJECTION_TEMPLATE=invitation-rejected-email.tmpl
+
+### Notifications
+MG_NOTIFICATIONS_LOG_LEVEL=debug
+MG_NOTIFICATIONS_INSTANCE_ID=
 
 ### Google OAuth2
 MG_GOOGLE_CLIENT_ID=
@@ -388,16 +394,6 @@ MG_FLUXMQ_INSTANCE_ID=
 MG_FLUXMQ_CACHE_NUM_COUNTERS=200000
 MG_FLUXMQ_CACHE_MAX_COST=1048576
 MG_FLUXMQ_CACHE_BUFFER_ITEMS=64
-# The publish proxy relays a user's message, so it publishes on the mTLS service
-# listener rather than the plain one: only there may it state the origin
-# protocol and publisher instead of having the broker stamp its own. The
-# certificate identifies the local principal and its SASL secret must match
-# docker/fluxmq/secrets/fluxmq-auth-current.
-MG_FLUXMQ_BROKER_SECRET=fluxmq-auth-fluxmq-local-principal-secret-change-me
-MG_FLUXMQ_BROKER_URL=amqps://fluxmq-auth:${MG_FLUXMQ_BROKER_SECRET}@fluxmq-node1:5685/
-MG_FLUXMQ_BROKER_CLIENT_CERT=/etc/ssl/certs/fluxmq-auth-fluxmq-client.crt
-MG_FLUXMQ_BROKER_CLIENT_KEY=/etc/ssl/private/fluxmq-auth-fluxmq-client.key
-MG_FLUXMQ_BROKER_CA_CERTS=/etc/ssl/certs/ca.crt
 
 ### CoAP
 MG_COAP_PORT=5683
@@ -441,6 +437,23 @@ MG_TIMESCALE_SSL_CERT=
 MG_TIMESCALE_SSL_KEY=
 MG_TIMESCALE_SSL_ROOT_CERT=
 
+### Journal
+MG_JOURNAL_LOG_LEVEL=info
+MG_JOURNAL_HTTP_HOST=journal
+MG_JOURNAL_HTTP_PORT=9021
+MG_JOURNAL_HTTP_SERVER_CERT=
+MG_JOURNAL_HTTP_SERVER_KEY=
+MG_JOURNAL_DB_HOST=journal-db
+MG_JOURNAL_DB_PORT=5432
+MG_JOURNAL_DB_USER=magistrala
+MG_JOURNAL_DB_PASS=magistrala
+MG_JOURNAL_DB_NAME=journal
+MG_JOURNAL_DB_SSL_MODE=disable
+MG_JOURNAL_DB_SSL_CERT=
+MG_JOURNAL_DB_SSL_KEY=
+MG_JOURNAL_DB_SSL_ROOT_CERT=
+MG_JOURNAL_INSTANCE_ID=
+
 ### GRAFANA and PROMETHEUS
 MG_PROMETHEUS_PORT=9090
 MG_GRAFANA_PORT=3001
@@ -512,14 +525,6 @@ MG_POSTGRES_WRITER_HTTP_PORT=9007
 MG_POSTGRES_WRITER_HTTP_SERVER_CERT=
 MG_POSTGRES_WRITER_HTTP_SERVER_KEY=
 MG_POSTGRES_WRITER_INSTANCE_ID=
-# The writer is a passive consumer on FluxMQ's mTLS local listener. Its client
-# certificate identifies the local principal and its SASL secret must match
-# docker/fluxmq/secrets/postgres-writer-current.
-MG_POSTGRES_WRITER_BROKER_SECRET=postgres-writer-fluxmq-local-principal-secret-change-me
-MG_POSTGRES_WRITER_BROKER_URL=amqps://postgres-writer:${MG_POSTGRES_WRITER_BROKER_SECRET}@fluxmq-node1:5685/
-MG_POSTGRES_WRITER_BROKER_CLIENT_CERT=/etc/ssl/certs/postgres-writer-fluxmq-client.crt
-MG_POSTGRES_WRITER_BROKER_CLIENT_KEY=/etc/ssl/private/postgres-writer-fluxmq-client.key
-MG_POSTGRES_WRITER_BROKER_CA_CERTS=/etc/ssl/certs/ca.crt
 
 ### Postgres Reader
 MG_POSTGRES_READER_LOG_LEVEL=debug
@@ -547,14 +552,6 @@ MG_TIMESCALE_WRITER_HTTP_PORT=9012
 MG_TIMESCALE_WRITER_HTTP_SERVER_CERT=
 MG_TIMESCALE_WRITER_HTTP_SERVER_KEY=
 MG_TIMESCALE_WRITER_INSTANCE_ID=
-# The writer is a passive consumer on FluxMQ's mTLS local listener. Its client
-# certificate identifies the local principal and its SASL secret must match
-# docker/fluxmq/secrets/timescale-writer-current.
-MG_TIMESCALE_WRITER_BROKER_SECRET=timescale-writer-fluxmq-local-principal-secret-change-me
-MG_TIMESCALE_WRITER_BROKER_URL=amqps://timescale-writer:${MG_TIMESCALE_WRITER_BROKER_SECRET}@fluxmq-node1:5685/
-MG_TIMESCALE_WRITER_BROKER_CLIENT_CERT=/etc/ssl/certs/timescale-writer-fluxmq-client.crt
-MG_TIMESCALE_WRITER_BROKER_CLIENT_KEY=/etc/ssl/private/timescale-writer-fluxmq-client.key
-MG_TIMESCALE_WRITER_BROKER_CA_CERTS=/etc/ssl/certs/ca.crt
 
 ### Timescale Reader
 MG_TIMESCALE_READER_LOG_LEVEL=debug
@@ -595,29 +592,6 @@ MG_RE_DB_SSL_CERT=
 MG_RE_DB_SSL_KEY=
 MG_RE_DB_SSL_ROOT_CERT=
 MG_RE_INSTANCE_ID=
-MG_RE_MAX_RULE_HOPS=32
-MG_RE_TRACE_KEY=
-MG_RE_TRACE_KEY_FILE=/run/secrets/magistrala-re-trace-key
-# Rule loop detection needs the broker to carry the "_flux." message metadata
-# that holds the rule execution trace. On FluxMQ only the mTLS local listener
-# does, so the Rules Engine must reach the broker there. A plain FluxMQ
-# connection cannot provide loop protection and is rejected at startup.
-#
-# The certificates, broker secret, and persistent trace key come from the
-# corresponding targets in docker/ssl, all of which run as part of check_certs.
-# MG_RE_BROKER_SECRET is the SASL secret the Rules Engine presents alongside
-# its certificate; it is the single source for
-# docker/fluxmq/secrets/re-current and must be at least 32 characters.
-# MG_RE_TRACE_KEY_FILE names the mounted trace key. MG_RE_TRACE_KEY remains an
-# inline alternative; set exactly one, and use at least 32 bytes.
-#
-# The URL names one node directly because mTLS cannot pass through the nginx
-# AMQP proxy as configured.
-MG_RE_BROKER_SECRET=re-fluxmq-local-principal-secret-change-me
-MG_RE_BROKER_URL=amqps://rules-engine:${MG_RE_BROKER_SECRET}@fluxmq-node1:5685/
-MG_RE_BROKER_CLIENT_CERT=/etc/ssl/certs/re-fluxmq-client.crt
-MG_RE_BROKER_CLIENT_KEY=/etc/ssl/private/re-fluxmq-client.key
-MG_RE_BROKER_CA_CERTS=/etc/ssl/certs/ca.crt
 MG_RE_EMAIL_TEMPLATE=re.tmpl
 MG_RE_CALLOUT_URLS=""
 MG_RE_CALLOUT_METHOD="POST"
@@ -696,6 +670,8 @@ MG_UI_BACKEND_INSTANCE_ID=
 MG_UI_BACKEND_URL=http://ui-backend:9097
 MG_UI_VERIFICATION_TLS=false
 MG_UI_CONTENT_TYPE=application/senml+json
+# Set to yes to accept the EULA for the UI services. To view the EULA visit: https://github.com/absmach/eula
+MG_UI_DOCKER_ACCEPT_EULA=yes
 OTEL_SERVICE_NAME=ui-mg
 OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4318
 
@@ -734,6 +710,7 @@ MG_BOOTSTRAP_URL=http://bootstrap:9013
 MG_HTTP_ADAPTER_URL=http://nginx:80/http
 MG_PUBLISH_PROXY_URL=http://nginx:80
 MG_READER_URL=http://timescale-reader:9011
+MG_JOURNAL_URL=http://journal:9021
 
 ### UI Configuration
 MG_UI_TYPE=mg
@@ -762,7 +739,3 @@ MG_UI_CLI_WS_URL=ws://localhost:80/mqtt
 MG_UI_CLI_COAP_HOST=0.0.0.0
 MG_UI_CLI_COAP_PORT=5684
 MG_UI_CLI_HTTP_URL=http://localhost:80/http
-
-# Atom
-ATOM_LOG_LEVEL=info
-ATOM_LOG_FORMAT=text

docker/README.md

@@ -17,11 +17,7 @@ make provision_atom_tokens
 make run_latest
 ```
 
-`make provision_atom_tokens` starts Atom, creates per-service unscoped Atom access tokens, and writes them to the generated `docker/.env.tokens` file. That file is local-only and must not be committed.
-
-The Atom runtime image is selected with `ATOM_IMAGE` in `docker/.env`. To test Magistrala against a local Atom checkout, build that checkout with a local tag and set `ATOM_IMAGE` to that tag before running Compose.
-
-The generated `MG_ATOM_TOKEN_*` values are intentionally unscoped service credentials for the current integration. Do not replace them with scoped Atom access tokens yet: Atom rejects scoped tokens on owner-wide listing APIs such as `authorizedObjectIds`, and some Magistrala policy-listing paths still use that API.
+`make provision_atom_tokens` starts Atom, creates per-service Atom API keys, and writes them to the generated `docker/.env.tokens` file. That file is local-only and must not be committed.
 
 If you use `docker compose` directly instead of the Makefile, pass both env files:
 
@@ -180,7 +176,7 @@ For a trusted production certificate, set `staging=false`:
 make run_tls host=example.com email=admin@example.com staging=false
 ```
 
-The target updates `docker/.env`, starts the Compose stack with the fallback certificate, runs certbot, switches Nginx to the issued certificate, and recreates Nginx. It also configures public UI URLs to `https://${MG_PUBLIC_HOST}`.
+The target updates `docker/.env`, starts the Compose stack with the fallback certificate, runs certbot, switches Nginx to the issued certificate, and recreates Nginx. It also sets `MG_UI_DOCKER_ACCEPT_EULA=yes` for the UI container and configures public UI URLs to `https://${MG_PUBLIC_HOST}`.
 
 To configure the same instance without Let's Encrypt, use:
 

docker/addons/bootstrap/docker-compose.yaml

@@ -15,7 +15,7 @@ volumes:
 
 services:
   bootstrap-db:
-    image: postgres:16.14-alpine3.24
+    image: postgres:16.2-alpine
     container_name: magistrala-bootstrap-db
     restart: on-failure
     environment:

docker/addons/postgres-writer/docker-compose.yaml

@@ -17,7 +17,7 @@ volumes:
 
 services:
   postgres:
-    image: postgres:16.14-alpine3.24
+    image: postgres:16.2-alpine
     container_name: magistrala-postgres
     restart: on-failure
     environment:
@@ -35,10 +35,7 @@ services:
     image: ghcr.io/absmach/magistrala/postgres-writer:${MG_RELEASE_TAG}
     container_name: magistrala-postgres-writer
     depends_on:
-      postgres:
-        condition: service_started
-      fluxmq-node1:
-        condition: service_healthy
+      - postgres
     restart: on-failure
     environment:
       MG_POSTGRES_WRITER_LOG_LEVEL: ${MG_POSTGRES_WRITER_LOG_LEVEL}
@@ -56,10 +53,7 @@ services:
       MG_POSTGRES_SSL_CERT: ${MG_POSTGRES_SSL_CERT}
       MG_POSTGRES_SSL_KEY: ${MG_POSTGRES_SSL_KEY}
       MG_POSTGRES_SSL_ROOT_CERT: ${MG_POSTGRES_SSL_ROOT_CERT}
-      MG_MESSAGE_BROKER_URL: ${MG_POSTGRES_WRITER_BROKER_URL}
-      MG_POSTGRES_WRITER_BROKER_CLIENT_CERT: ${MG_POSTGRES_WRITER_BROKER_CLIENT_CERT}
-      MG_POSTGRES_WRITER_BROKER_CLIENT_KEY: ${MG_POSTGRES_WRITER_BROKER_CLIENT_KEY}
-      MG_POSTGRES_WRITER_BROKER_CA_CERTS: ${MG_POSTGRES_WRITER_BROKER_CA_CERTS}
+      MG_MESSAGE_BROKER_URL: ${MG_MESSAGE_BROKER_URL}
       MG_JAEGER_URL: ${MG_JAEGER_URL}
       MG_JAEGER_TRACE_RATIO: ${MG_JAEGER_TRACE_RATIO}
       MG_SEND_TELEMETRY: ${MG_SEND_TELEMETRY}
@@ -69,11 +63,4 @@ services:
     networks:
       - magistrala-base-net
     volumes:
-      # Relative paths in an addon file resolve against the project directory,
-      # which is the base compose file's directory rather than this one.
-      - ./addons/postgres-writer/config.toml:${MG_POSTGRES_WRITER_CONFIG_PATH}
-      # The URI SAN in this client certificate identifies the Postgres writer
-      # to the FluxMQ local listener; the broker ACL only permits `writers`.
-      - ./ssl/certs/postgres-writer-fluxmq-client.crt:${MG_POSTGRES_WRITER_BROKER_CLIENT_CERT}:ro
-      - ./ssl/certs/postgres-writer-fluxmq-client.key:${MG_POSTGRES_WRITER_BROKER_CLIENT_KEY}:ro
-      - ./ssl/certs/ca.crt:${MG_POSTGRES_WRITER_BROKER_CA_CERTS}:ro
+      - ./config.toml:/config.toml

docker/addons/prometheus/docker-compose.yaml

@@ -18,7 +18,7 @@ volumes:
 
 services:
   promethues:
-    image: prom/prometheus:v3.13.1
+    image: prom/prometheus:v2.49.1
     container_name: magistrala-prometheus
     restart: on-failure
     ports:
@@ -32,7 +32,7 @@ services:
       - magistrala-prometheus-volume:/prometheus
 
   grafana:
-    image: grafana/grafana:13.1.1
+    image: grafana/grafana:10.2.3
     container_name: magistrala-grafana
     depends_on:
       - promethues

docker/docker-compose.yaml

@@ -14,6 +14,7 @@ networks:
 volumes:
   magistrala-pat-db-volume:
   magistrala-ui-backend-db-volume:
+  magistrala-journal-volume:
   magistrala-re-db-volume:
   magistrala-alarms-db-volume:
   magistrala-reports-db-volume:
@@ -45,7 +46,7 @@ services:
       retries: 5
 
   atom:
-    image: ${ATOM_IMAGE:-ghcr.io/absmach/atom:latest}
+    image: ghcr.io/absmach/atom:latest
     container_name: magistrala-atom
     restart: on-failure
     depends_on:
@@ -127,8 +128,65 @@ services:
     networks:
       - magistrala-base-net
 
+  journal-db:
+    image: postgres:16.2-alpine
+    container_name: magistrala-journal-db
+    restart: on-failure
+    command: postgres -c "max_connections=${MG_POSTGRES_MAX_CONNECTIONS}"
+    environment:
+      POSTGRES_USER: ${MG_JOURNAL_DB_USER}
+      POSTGRES_PASSWORD: ${MG_JOURNAL_DB_PASS}
+      POSTGRES_DB: ${MG_JOURNAL_DB_NAME}
+      MG_POSTGRES_MAX_CONNECTIONS: ${MG_POSTGRES_MAX_CONNECTIONS}
+    networks:
+      - magistrala-base-net
+    volumes:
+      - magistrala-journal-volume:/var/lib/postgresql/data
+
+  journal:
+    image: ghcr.io/absmach/magistrala/journal:${MG_RELEASE_TAG}
+    container_name: magistrala-journal
+    depends_on:
+      journal-db:
+        condition: service_started
+      atom-bootstrap:
+        condition: service_completed_successfully
+      nginx:
+        condition: service_started
+    restart: on-failure
+    environment:
+      MG_JOURNAL_LOG_LEVEL: ${MG_JOURNAL_LOG_LEVEL}
+      MG_JOURNAL_HTTP_HOST: ${MG_JOURNAL_HTTP_HOST}
+      MG_JOURNAL_HTTP_PORT: ${MG_JOURNAL_HTTP_PORT}
+      MG_JOURNAL_HTTP_SERVER_CERT: ${MG_JOURNAL_HTTP_SERVER_CERT}
+      MG_JOURNAL_HTTP_SERVER_KEY: ${MG_JOURNAL_HTTP_SERVER_KEY}
+      MG_JOURNAL_DB_HOST: ${MG_JOURNAL_DB_HOST}
+      MG_JOURNAL_DB_PORT: ${MG_JOURNAL_DB_PORT}
+      MG_JOURNAL_DB_USER: ${MG_JOURNAL_DB_USER}
+      MG_JOURNAL_DB_PASS: ${MG_JOURNAL_DB_PASS}
+      MG_JOURNAL_DB_NAME: ${MG_JOURNAL_DB_NAME}
+      MG_JOURNAL_DB_SSL_MODE: ${MG_JOURNAL_DB_SSL_MODE}
+      MG_JOURNAL_DB_SSL_CERT: ${MG_JOURNAL_DB_SSL_CERT}
+      MG_JOURNAL_DB_SSL_KEY: ${MG_JOURNAL_DB_SSL_KEY}
+      MG_JOURNAL_DB_SSL_ROOT_CERT: ${MG_JOURNAL_DB_SSL_ROOT_CERT}
+      ATOM_URL: ${ATOM_URL}
+      ATOM_SERVICE_TOKEN: ${MG_ATOM_TOKEN_JOURNAL}
+      ATOM_JWKS_URL: ${ATOM_JWKS_URL}
+      ATOM_JWT_ISSUER: ${ATOM_JWT_ISSUER}
+      ATOM_JWT_AUDIENCE: ${ATOM_JWT_AUDIENCE}
+      ATOM_TIMEOUT: ${ATOM_TIMEOUT}
+      MG_ES_URL: ${MG_ES_URL}
+      MG_JAEGER_URL: ${MG_JAEGER_URL}
+      MG_JAEGER_TRACE_RATIO: ${MG_JAEGER_TRACE_RATIO}
+      MG_SEND_TELEMETRY: ${MG_SEND_TELEMETRY}
+      MG_JOURNAL_INSTANCE_ID: ${MG_JOURNAL_INSTANCE_ID}
+      MG_ALLOW_UNVERIFIED_USER: ${MG_ALLOW_UNVERIFIED_USER}
+    ports:
+      - ${MG_JOURNAL_HTTP_PORT}:${MG_JOURNAL_HTTP_PORT}
+    networks:
+      - magistrala-base-net
   nginx:
-    image: docker.io/nginx:1.31.3-alpine3.24
+    image: docker.io/nginx:1.29.2-alpine3.22
     container_name: magistrala-nginx
     restart: on-failure
     volumes:
@@ -170,7 +228,7 @@ services:
         hard: 65536
 
   certbot:
-    image: docker.io/certbot/certbot:v5.7.0
+    image: docker.io/certbot/certbot:v2.11.0
     container_name: magistrala-certbot
     profiles:
       - letsencrypt
@@ -226,8 +284,46 @@ services:
           sleep 12h & wait $$!
         done
 
+  notifications:
+    image: ghcr.io/absmach/magistrala/notifications:${MG_RELEASE_TAG}
+    container_name: magistrala-notifications
+    depends_on:
+      atom-bootstrap:
+        condition: service_completed_successfully
+      nginx:
+        condition: service_started
+    restart: on-failure
+    environment:
+      MG_NOTIFICATIONS_LOG_LEVEL: ${MG_NOTIFICATIONS_LOG_LEVEL}
+      MG_NOTIFICATIONS_INSTANCE_ID: ${MG_NOTIFICATIONS_INSTANCE_ID}
+      MG_ES_URL: ${MG_ES_URL}
+      MG_JAEGER_URL: ${MG_JAEGER_URL}
+      MG_JAEGER_TRACE_RATIO: ${MG_JAEGER_TRACE_RATIO}
+      MG_SEND_TELEMETRY: ${MG_SEND_TELEMETRY}
+      MG_EMAIL_HOST: ${MG_EMAIL_HOST}
+      MG_EMAIL_PORT: ${MG_EMAIL_PORT}
+      MG_EMAIL_USERNAME: ${MG_EMAIL_USERNAME}
+      MG_EMAIL_PASSWORD: ${MG_EMAIL_PASSWORD}
+      MG_EMAIL_FROM_ADDRESS: ${MG_EMAIL_FROM_ADDRESS}
+      MG_EMAIL_FROM_NAME: ${MG_EMAIL_FROM_NAME}
+      MG_EMAIL_INVITATION_TEMPLATE: ${MG_EMAIL_INVITATION_TEMPLATE}
+      MG_EMAIL_ACCEPTANCE_TEMPLATE: ${MG_EMAIL_ACCEPTANCE_TEMPLATE}
+      MG_EMAIL_REJECTION_TEMPLATE: ${MG_EMAIL_REJECTION_TEMPLATE}
+      ATOM_URL: ${ATOM_URL}
+      ATOM_SERVICE_TOKEN: ${MG_ATOM_TOKEN_NOTIFICATIONS}
+      ATOM_JWKS_URL: ${ATOM_JWKS_URL}
+      ATOM_JWT_ISSUER: ${ATOM_JWT_ISSUER}
+      ATOM_JWT_AUDIENCE: ${ATOM_JWT_AUDIENCE}
+      ATOM_TIMEOUT: ${ATOM_TIMEOUT}
+    networks:
+      - magistrala-base-net
+    volumes:
+      - ./templates/${MG_EMAIL_INVITATION_TEMPLATE}:/${MG_EMAIL_INVITATION_TEMPLATE}
+      - ./templates/${MG_EMAIL_ACCEPTANCE_TEMPLATE}:/${MG_EMAIL_ACCEPTANCE_TEMPLATE}
+      - ./templates/${MG_EMAIL_REJECTION_TEMPLATE}:/${MG_EMAIL_REJECTION_TEMPLATE}
+
   jaeger:
-    image: docker.io/jaegertracing/all-in-one:1.76.0
+    image: docker.io/jaegertracing/all-in-one:1.74.0
     container_name: magistrala-jaeger
     environment:
       COLLECTOR_OTLP_ENABLED: ${MG_JAEGER_COLLECTOR_OTLP_ENABLED}
@@ -255,15 +351,6 @@ services:
         ipv4_address: 172.30.0.201
     volumes:
       - ./fluxmq/node1.yaml:/etc/fluxmq/config.yaml:ro
-      # Server certificate and CA for the mTLS service listener, plus each
-      # local principal's SASL secret.
-      - ./ssl/certs/fluxmq-service-server.crt:/etc/fluxmq/certs/fluxmq-service-server.crt:ro
-      - ./ssl/certs/fluxmq-service-server.key:/etc/fluxmq/certs/fluxmq-service-server.key:ro
-      - ./ssl/certs/ca.crt:/etc/fluxmq/certs/ca.crt:ro
-      - ./fluxmq/secrets/re-current:/etc/fluxmq/secrets/re-current:ro
-      - ./fluxmq/secrets/timescale-writer-current:/etc/fluxmq/secrets/timescale-writer-current:ro
-      - ./fluxmq/secrets/postgres-writer-current:/etc/fluxmq/secrets/postgres-writer-current:ro
-      - ./fluxmq/secrets/fluxmq-auth-current:/etc/fluxmq/secrets/fluxmq-auth-current:ro
       - magistrala-fluxmq-node1-volume:/tmp/fluxmq
 
   fluxmq-node2:
@@ -284,15 +371,6 @@ services:
         ipv4_address: 172.30.0.202
     volumes:
       - ./fluxmq/node2.yaml:/etc/fluxmq/config.yaml:ro
-      # Server certificate and CA for the mTLS service listener, plus each
-      # local principal's SASL secret.
-      - ./ssl/certs/fluxmq-service-server.crt:/etc/fluxmq/certs/fluxmq-service-server.crt:ro
-      - ./ssl/certs/fluxmq-service-server.key:/etc/fluxmq/certs/fluxmq-service-server.key:ro
-      - ./ssl/certs/ca.crt:/etc/fluxmq/certs/ca.crt:ro
-      - ./fluxmq/secrets/re-current:/etc/fluxmq/secrets/re-current:ro
-      - ./fluxmq/secrets/timescale-writer-current:/etc/fluxmq/secrets/timescale-writer-current:ro
-      - ./fluxmq/secrets/postgres-writer-current:/etc/fluxmq/secrets/postgres-writer-current:ro
-      - ./fluxmq/secrets/fluxmq-auth-current:/etc/fluxmq/secrets/fluxmq-auth-current:ro
       - magistrala-fluxmq-node2-volume:/tmp/fluxmq
 
   fluxmq-node3:
@@ -313,15 +391,6 @@ services:
         ipv4_address: 172.30.0.203
     volumes:
       - ./fluxmq/node3.yaml:/etc/fluxmq/config.yaml:ro
-      # Server certificate and CA for the mTLS service listener, plus each
-      # local principal's SASL secret.
-      - ./ssl/certs/fluxmq-service-server.crt:/etc/fluxmq/certs/fluxmq-service-server.crt:ro
-      - ./ssl/certs/fluxmq-service-server.key:/etc/fluxmq/certs/fluxmq-service-server.key:ro
-      - ./ssl/certs/ca.crt:/etc/fluxmq/certs/ca.crt:ro
-      - ./fluxmq/secrets/re-current:/etc/fluxmq/secrets/re-current:ro
-      - ./fluxmq/secrets/timescale-writer-current:/etc/fluxmq/secrets/timescale-writer-current:ro
-      - ./fluxmq/secrets/postgres-writer-current:/etc/fluxmq/secrets/postgres-writer-current:ro
-      - ./fluxmq/secrets/fluxmq-auth-current:/etc/fluxmq/secrets/fluxmq-auth-current:ro
       - magistrala-fluxmq-node3-volume:/tmp/fluxmq
 
   fluxmq-auth:
@@ -355,17 +424,6 @@ services:
       ATOM_TIMEOUT: ${ATOM_TIMEOUT}
       MG_JAEGER_URL: ${MG_JAEGER_URL}
       MG_JAEGER_TRACE_RATIO: ${MG_JAEGER_TRACE_RATIO}
-      MG_FLUXMQ_BROKER_URL: ${MG_FLUXMQ_BROKER_URL}
-      MG_FLUXMQ_BROKER_CLIENT_CERT: ${MG_FLUXMQ_BROKER_CLIENT_CERT}
-      MG_FLUXMQ_BROKER_CLIENT_KEY: ${MG_FLUXMQ_BROKER_CLIENT_KEY}
-      MG_FLUXMQ_BROKER_CA_CERTS: ${MG_FLUXMQ_BROKER_CA_CERTS}
-    volumes:
-      # The URI SAN in this client certificate identifies the publish proxy to
-      # the FluxMQ local listener; the broker ACL only permits publishing to the
-      # message topic namespace.
-      - ./ssl/certs/fluxmq-auth-fluxmq-client.crt:${MG_FLUXMQ_BROKER_CLIENT_CERT}:ro
-      - ./ssl/certs/fluxmq-auth-fluxmq-client.key:${MG_FLUXMQ_BROKER_CLIENT_KEY}:ro
-      - ./ssl/certs/ca.crt:${MG_FLUXMQ_BROKER_CA_CERTS}:ro
     networks:
       - magistrala-base-net
 
@@ -391,6 +449,7 @@ services:
       MG_PUBLISH_PROXY_URL: ${MG_PUBLISH_PROXY_URL}
       MG_READER_URL: ${MG_READER_URL}
       MG_BACKEND_URL: ${MG_UI_BACKEND_URL}
+      MG_JOURNAL_URL: ${MG_JOURNAL_URL}
       MG_ALARMS_URL: ${MG_ALARMS_URL}
       MG_RE_URL: ${MG_RE_URL}
       MG_REPORTS_URL: ${MG_REPORTS_URL}
@@ -408,6 +467,7 @@ services:
       NEXT_LOG_LEVEL: "debug"
       MG_HOST_URL: ${MG_HOST_URL}
       MG_UI_IMAGE_URL: ${MG_UI_IMAGE_URL}
+      MG_UI_DOCKER_ACCEPT_EULA: ${MG_UI_DOCKER_ACCEPT_EULA}
       MG_SUPPORT_EMAIL: ${MG_SUPPORT_EMAIL}
       MG_SUPPORT_EMAIL_PASS: ${MG_SUPPORT_EMAIL_PASS}
       MG_UI_CLI_MQTT_HOST: ${MG_UI_CLI_MQTT_HOST}
@@ -461,6 +521,7 @@ services:
       MG_UI_VERIFICATION_TLS: ${MG_UI_VERIFICATION_TLS}
       MG_UI_CONTENT_TYPE: ${MG_UI_CONTENT_TYPE}
       MG_READER_URL: ${MG_READER_URL}
+      MG_UI_DOCKER_ACCEPT_EULA: ${MG_UI_DOCKER_ACCEPT_EULA}
       MG_CHANNELS_GRPC_URL: ${MG_CHANNELS_GRPC_URL}
       MG_CHANNELS_GRPC_TIMEOUT: ${MG_CHANNELS_GRPC_TIMEOUT}
       MG_CHANNELS_GRPC_CLIENT_CERT: ${MG_CHANNELS_GRPC_CLIENT_CERT:+/channels-grpc-client.crt}
@@ -540,12 +601,11 @@ services:
           create_host_path: true
 
   ui-backend-db:
-    image: docker.io/postgres:18.4-alpine3.24
+    image: docker.io/postgres:18.0-alpine3.22
     container_name: magistrala-ui-backend-db
     restart: on-failure
     command: postgres -c "max_connections=${MG_POSTGRES_MAX_CONNECTIONS}"
     environment:
-      PGDATA: /var/lib/postgresql/data
       POSTGRES_USER: ${MG_UI_BACKEND_DB_USER}
       POSTGRES_PASSWORD: ${MG_UI_BACKEND_DB_PASS}
       POSTGRES_DB: ${MG_UI_BACKEND_DB_NAME}
@@ -563,7 +623,7 @@ services:
       retries: 60
 
   seaweedfs-s3:
-    image: chrislusf/seaweedfs:4.40
+    image: chrislusf/seaweedfs:4.16
     container_name: magistrala-seaweedfs-s3
     command: server -s3 -s3.config=/etc/seaweedfs/s3.json -dir=/data
     ports:
@@ -577,12 +637,8 @@ services:
     networks:
       - magistrala-base-net
 
-  # Creates the image bucket with the broker's own image rather than pulling a
-  # second one. An aws-cli here cost a 130 MB image for a single call, and it
-  # was the only untagged reference in this file, so what it resolved to
-  # depended on the day it was pulled.
   seaweedfs-init:
-    image: chrislusf/seaweedfs:4.40
+    image: amazon/aws-cli
     container_name: magistrala-seaweedfs-init
     entrypoint: /bin/sh
     depends_on:
@@ -590,49 +646,29 @@ services:
     command:
       - -c
       - |
-        set -eu
-        # weed shell blocks indefinitely against an unreachable master, so the
-        # wait is a port check and every weed call is bounded; left to itself it
-        # would hang this container rather than fail it.
-        #
-        # 60 ticks is ~2 minutes while the store is merely slow to boot, and
-        # ~3 minutes to give up when it never appears, since a failing lookup
-        # costs about a second on top of the sleep.
-        tick=0;
-        while ! nc -z seaweedfs-s3 9333 2>/dev/null; do
-          tick=$$((tick + 1));
-          if [ $$tick -ge 60 ]; then
-            echo "[INIT] SeaweedFS master did not come up" >&2;
-            exit 1;
-          fi;
-          sleep 2;
-        done;
-        printf 's3.bucket.create -name %s\n' "$${BUCKET}" > /tmp/create.cmd;
-        printf 's3.bucket.list\n' > /tmp/list.cmd;
-        try=0;
-        while [ $$try -lt 3 ]; do
-          try=$$((try + 1));
-          timeout 20 weed shell -master seaweedfs-s3:9333 < /tmp/create.cmd > /tmp/create.out 2>&1 || true;
-          timeout 20 weed shell -master seaweedfs-s3:9333 < /tmp/list.cmd > /tmp/list.out 2>/dev/null || true;
-          # s3.bucket.create reports success even for an existing bucket, and
-          # weed shell exits 0 whatever the command did, so the listing is the
-          # only trustworthy signal that the bucket is really there.
-          if awk -v b="$${BUCKET}" '{sub(/^[ \t]+/,""); split($$0,f,/[ \t]/); if (f[1]==b) found=1} END{exit !found}' /tmp/list.out; then
-            echo "[INIT] Bucket $${BUCKET} present.";
-            exit 0;
-          fi;
-          sleep 3;
-        done;
-        echo "[INIT] Bucket $${BUCKET} was not created after $$try attempts" >&2;
-        cat /tmp/create.out >&2;
-        exit 1
+        echo "[INIT] Waiting 20s for SeaweedFS S3 to be ready...";
+        sleep 20;
+        OUT=$(aws --endpoint-url http://seaweedfs-s3:8333 s3api create-bucket --bucket $${BUCKET} 2>&1);
+        EXIT=$$?;
+        if [ $$EXIT -eq 0 ]; then
+          echo "[INIT] Bucket $${BUCKET} created successfully.";
+        elif echo "$$OUT" | grep -q 'BucketAlreadyOwnedByYou\|BucketAlreadyExists'; then
+          echo "[INIT] Bucket $${BUCKET} already exists, skipping.";
+        else
+          echo "[INIT] Failed to create bucket $${BUCKET}: $$OUT" >&2;
+          exit 1;
+        fi
     networks:
       - magistrala-base-net
     environment:
       BUCKET: ${MG_BACKEND_OBJECT_STORAGE_BUCKET}
+      AWS_ACCESS_KEY_ID: ${MG_BACKEND_OBJECT_STORAGE_ACCESS_KEY}
+      AWS_SECRET_ACCESS_KEY: ${MG_BACKEND_OBJECT_STORAGE_SECRET_KEY}
+      AWS_DEFAULT_REGION: ${MG_BACKEND_OBJECT_STORAGE_REGION}
+      AWS_EC2_METADATA_DISABLED: "true"
 
   timescale:
-    image: timescale/timescaledb:2.29.0-pg16-oss
+    image: timescale/timescaledb:2.19.3-pg16-oss
     container_name: magistrala-timescale
     restart: on-failure
     environment:
@@ -645,18 +681,13 @@ services:
       - magistrala-base-net
     volumes:
       - magistrala-timescale-writer-volume:/var/lib/postgresql/data
-    healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
-      interval: 5s
-      timeout: 3s
-      retries: 60
 
   timescale-reader:
     image: ghcr.io/absmach/magistrala/timescale-reader:${MG_RELEASE_TAG}
     container_name: magistrala-timescale-reader
     depends_on:
       timescale:
-        condition: service_healthy
+        condition: service_started
       atom-bootstrap:
         condition: service_completed_successfully
     restart: on-failure
@@ -735,10 +766,7 @@ services:
     image: ghcr.io/absmach/magistrala/timescale-writer:${MG_RELEASE_TAG}
     container_name: magistrala-timescale-writer
     depends_on:
-      timescale:
-        condition: service_healthy
-      fluxmq-node1:
-        condition: service_healthy
+      - timescale
     restart: on-failure
     environment:
       MG_TIMESCALE_WRITER_LOG_LEVEL: ${MG_TIMESCALE_WRITER_LOG_LEVEL}
@@ -756,10 +784,7 @@ services:
       MG_TIMESCALE_SSL_CERT: ${MG_TIMESCALE_SSL_CERT}
       MG_TIMESCALE_SSL_KEY: ${MG_TIMESCALE_SSL_KEY}
       MG_TIMESCALE_SSL_ROOT_CERT: ${MG_TIMESCALE_SSL_ROOT_CERT}
-      MG_MESSAGE_BROKER_URL: ${MG_TIMESCALE_WRITER_BROKER_URL}
-      MG_TIMESCALE_WRITER_BROKER_CLIENT_CERT: ${MG_TIMESCALE_WRITER_BROKER_CLIENT_CERT}
-      MG_TIMESCALE_WRITER_BROKER_CLIENT_KEY: ${MG_TIMESCALE_WRITER_BROKER_CLIENT_KEY}
-      MG_TIMESCALE_WRITER_BROKER_CA_CERTS: ${MG_TIMESCALE_WRITER_BROKER_CA_CERTS}
+      MG_MESSAGE_BROKER_URL: ${MG_MESSAGE_BROKER_URL}
       MG_JAEGER_URL: ${MG_JAEGER_URL}
       MG_JAEGER_TRACE_RATIO: ${MG_JAEGER_TRACE_RATIO}
       MG_SEND_TELEMETRY: ${MG_SEND_TELEMETRY}
@@ -770,18 +795,12 @@ services:
       - magistrala-base-net
     volumes:
       - ./addons/timescale-writer/config.toml:${MG_TIMESCALE_WRITER_CONFIG_PATH}
-      # The URI SAN in this client certificate identifies the Timescale writer
-      # to the FluxMQ local listener; the broker ACL only permits `writers`.
-      - ./ssl/certs/timescale-writer-fluxmq-client.crt:${MG_TIMESCALE_WRITER_BROKER_CLIENT_CERT}:ro
-      - ./ssl/certs/timescale-writer-fluxmq-client.key:${MG_TIMESCALE_WRITER_BROKER_CLIENT_KEY}:ro
-      - ./ssl/certs/ca.crt:${MG_TIMESCALE_WRITER_BROKER_CA_CERTS}:ro
   re-db:
-    image: docker.io/postgres:18.4-alpine3.24
+    image: docker.io/postgres:18.0-alpine3.22
     container_name: magistrala-re-db
     restart: on-failure
     command: postgres -c "max_connections=${MG_POSTGRES_MAX_CONNECTIONS}"
     environment:
-      PGDATA: /var/lib/postgresql/data
       POSTGRES_USER: ${MG_RE_DB_USER}
       POSTGRES_PASSWORD: ${MG_RE_DB_PASS}
       POSTGRES_DB: ${MG_RE_DB_NAME}
@@ -839,13 +858,6 @@ services:
       MG_SEND_TELEMETRY: ${MG_SEND_TELEMETRY}
       MG_PERMISSIONS_FILE: ${MG_PERMISSIONS_FILE}
       MG_RE_INSTANCE_ID: ${MG_RE_INSTANCE_ID}
-      MG_RE_MAX_RULE_HOPS: ${MG_RE_MAX_RULE_HOPS}
-      MG_RE_TRACE_KEY: ${MG_RE_TRACE_KEY}
-      MG_RE_TRACE_KEY_FILE: ${MG_RE_TRACE_KEY_FILE}
-      MG_RE_BROKER_URL: ${MG_RE_BROKER_URL}
-      MG_RE_BROKER_CLIENT_CERT: ${MG_RE_BROKER_CLIENT_CERT}
-      MG_RE_BROKER_CLIENT_KEY: ${MG_RE_BROKER_CLIENT_KEY}
-      MG_RE_BROKER_CA_CERTS: ${MG_RE_BROKER_CA_CERTS}
       MG_EMAIL_HOST: ${MG_EMAIL_HOST}
       MG_EMAIL_PORT: ${MG_EMAIL_PORT}
       MG_EMAIL_USERNAME: ${MG_EMAIL_USERNAME}
@@ -866,20 +878,13 @@ services:
     volumes:
       - ./permission.yaml:${MG_PERMISSIONS_FILE}
       - ./templates/${MG_RE_EMAIL_TEMPLATE}:/email.tmpl
-      # Client certificate for the FluxMQ service listener. Its URI SAN is what
-      # the broker matches against the rules-engine local principal.
-      - ./ssl/certs/re-fluxmq-client.crt:${MG_RE_BROKER_CLIENT_CERT}:ro
-      - ./ssl/certs/re-fluxmq-client.key:${MG_RE_BROKER_CLIENT_KEY}:ro
-      - ./ssl/certs/ca.crt:${MG_RE_BROKER_CA_CERTS}:ro
-      - ./re/secrets/trace.key:/run/secrets/magistrala-re-trace-key:ro
 
   alarms-db:
-    image: docker.io/postgres:18.4-alpine3.24
+    image: docker.io/postgres:18.0-alpine3.22
     container_name: magistrala-alarms-db
     restart: on-failure
     command: postgres -c "max_connections=${MG_POSTGRES_MAX_CONNECTIONS}"
     environment:
-      PGDATA: /var/lib/postgresql/data
       POSTGRES_USER: ${MG_ALARMS_DB_USER}
       POSTGRES_PASSWORD: ${MG_ALARMS_DB_PASS}
       POSTGRES_DB: ${MG_ALARMS_DB_NAME}
@@ -938,12 +943,11 @@ services:
       - ./permission.yaml:${MG_PERMISSIONS_FILE}
 
   reports-db:
-    image: docker.io/postgres:18.4-alpine3.24
+    image: docker.io/postgres:18.0-alpine3.22
     container_name: magistrala-reports-db
     restart: on-failure
     command: postgres -c "max_connections=${MG_POSTGRES_MAX_CONNECTIONS}"
     environment:
-      PGDATA: /var/lib/postgresql/data
       POSTGRES_USER: ${MG_REPORTS_DB_USER}
       POSTGRES_PASSWORD: ${MG_REPORTS_DB_PASS}
       POSTGRES_DB: ${MG_REPORTS_DB_NAME}
@@ -1025,12 +1029,8 @@ services:
       - ./templates/${MG_REPORTS_EMAIL_TEMPLATE}:/email.tmpl
 
   pdf-generator:
-    image: gotenberg/gotenberg:8.34.0
+    image: gotenberg/gotenberg:8.25.1
     container_name: magistrala-pdf
-    restart: on-failure
-    # Gotenberg leaks memory over time (upstream issues #987, #1169); the cap
-    # keeps the OOM kill inside this container instead of stalling the host.
-    mem_limit: 512m
     ports:
       - "4000:3000"
     networks:

docker/fluxmq/.gitignore

@@ -1,5 +0,0 @@
-# Copyright (c) Abstract Machines
-# SPDX-License-Identifier: Apache-2.0
-
-# Derived from MG_RE_BROKER_SECRET by "make fluxmq_service_secret" in docker/ssl.
-secrets/

docker/fluxmq/config_test.go

@@ -1,69 +0,0 @@
-// Copyright (c) Abstract Machines
-// SPDX-License-Identifier: Apache-2.0
-
-package fluxmq_test
-
-import (
-	"os"
-	"slices"
-	"testing"
-
-	"github.com/absmach/fluxmq/topics"
-	"gopkg.in/yaml.v3"
-)
-
-type brokerConfig struct {
-	Queues []struct {
-		Name   string   `yaml:"name"`
-		Topics []string `yaml:"topics"`
-	} `yaml:"queues"`
-}
-
-func TestQueueBindingsDoNotOverlap(t *testing.T) {
-	testCases := []struct {
-		topic string
-		want  []string
-	}{
-		{topic: "$queue/mqtt/client", want: []string{"mqtt"}},
-		{topic: "$queue/events/domain/client", want: []string{"events"}},
-		{topic: "$queue/writers/domain/channel", want: []string{"writers"}},
-		{topic: "$queue/alarms/domain/channel", want: []string{"alarms"}},
-		// A queue addressed with no trailing path still has to land in its own
-		// stream: pkg/events/fluxmq addresses exactly "$queue/events" when the
-		// stream name resolves to an empty path, and a binding that stopped
-		// matching its own parent level would drop those publications with no
-		// error, since an unmatched topic capture is not a failure.
-		{topic: "$queue/events", want: []string{"events"}},
-		// Channel messages reach stream "m" through its own "m/#" binding, so
-		// nothing addresses the queue directly. Were that to change, the
-		// publication would match no queue at all rather than fall through to
-		// the reserved one.
-		{topic: "$queue/m/domain/channel", want: nil},
-	}
-
-	for _, configFile := range []string{"node1.yaml", "node2.yaml", "node3.yaml"} {
-		data, err := os.ReadFile(configFile)
-		if err != nil {
-			t.Fatalf("read %s: %v", configFile, err)
-		}
-		var cfg brokerConfig
-		if err := yaml.Unmarshal(data, &cfg); err != nil {
-			t.Fatalf("parse %s: %v", configFile, err)
-		}
-
-		for _, tc := range testCases {
-			var got []string
-			for _, queue := range cfg.Queues {
-				for _, pattern := range queue.Topics {
-					if topics.TopicMatch(pattern, tc.topic) {
-						got = append(got, queue.Name)
-						break
-					}
-				}
-			}
-			if !slices.Equal(got, tc.want) {
-				t.Errorf("%s: queues matching %q = %v, want %v", configFile, tc.topic, got, tc.want)
-			}
-		}
-	}
-}

docker/fluxmq/node1.yaml

@@ -37,20 +37,6 @@ server:
   amqp091:
     plain:
       addr: "0.0.0.0:5682"
-    # The local listener is how a first-party service reaches the broker. It
-    # requires mTLS: FluxMQ matches the URI SAN of the presented certificate
-    # against a principal under auth.local_principals, and only a connection
-    # admitted here may exchange "_flux." message metadata. The Rules Engine
-    # needs that metadata to carry its rule execution trace, so it connects
-    # here rather than on the plain listener.
-    local:
-      addr: "0.0.0.0:5685"
-      max_connections: 32
-      cert_file: "/etc/fluxmq/certs/fluxmq-service-server.crt"
-      key_file: "/etc/fluxmq/certs/fluxmq-service-server.key"
-      ca_file: "/etc/fluxmq/certs/ca.crt"
-      client_auth: "require"
-      min_version: "TLS1.2"
   health_addr: "0.0.0.0:8081"
   health_enabled: true
   shutdown_timeout: 30s
@@ -108,13 +94,8 @@ queue_manager:
 
 queues:
   - name: "mqtt"
-    # "mqtt" is this reserved queue's name, not an MQTT-only transport filter;
-    # every protocol adapter uses the same topic-based queue routing. A local-
-    # principal prefix grant is captured by every matching queue, so keep this
-    # binding inside the mqtt namespace rather than also persisting service
-    # streams such as writers and alarms here.
     topics:
-      - "$queue/mqtt/#"
+      - "$queue/#"
     reserved: true
   - name: "events"
     topics:
@@ -146,93 +127,12 @@ queues:
       max_length_bytes: 1073741824
 
 auth:
-  # Principals admitted on the service listener. The certificate_uri_san must
-  # match the URI SAN issued by docker/ssl/Makefile (fluxmq_service_certs), and
-  # each secret file must hold the value configured by its service.
-  local_principals:
-    - name: "rules-engine"
-      certificate_uri_san: "spiffe://absmach/magistrala/rules-engine"
-      # A service may consume and may relay the origin of messages it did not
-      # author, both of which the Rules Engine needs when it republishes a
-      # device message. The capability is the principal's, not the listener's.
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/re-current"
-      permissions:
-        # Rule outputs are republished to m.<domain>.c.<channel>.<subtopic>,
-        # whose tenant and channel identifiers cannot be enumerated here, so the
-        # grant is the topic namespace rather than a list of exact keys. Being a
-        # prefix it is also an ordinary topic publish, which the cluster
-        # forwards; an exact target would be durable on one node and could not
-        # run alongside cluster.enabled.
-        publish:
-          - routing_key_prefix: "m."
-          # The rule output streams. These grants have to live here: a
-          # publication from a connection the broker does not trust has the
-          # broker's own transport protocol and identity stamped on it, so a
-          # saved message would read as "amqp" rather than the protocol the
-          # device published with, and an alarm would name the engine's broker
-          # connection rather than the client. Same prefix reasoning as above --
-          # each queue's own "$queue/<name>/#" binding is what captures it.
-          - routing_key_prefix: "$queue/writers/"
-          - routing_key_prefix: "$queue/alarms/"
-        # The message stream the Rules Engine consumes.
-        subscribe:
-          - "m"
-    - name: "timescale-writer"
-      certificate_uri_san: "spiffe://absmach/magistrala/timescale-writer"
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/timescale-writer-current"
-      permissions:
-        # The writer is a passive consumer of the broker-provisioned stream. It
-        # neither publishes messages nor manages queues.
-        subscribe:
-          - "writers"
-    - name: "postgres-writer"
-      certificate_uri_san: "spiffe://absmach/magistrala/postgres-writer"
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/postgres-writer-current"
-      permissions:
-        # The writer is a passive consumer of the broker-provisioned stream. It
-        # neither publishes messages nor manages queues.
-        subscribe:
-          - "writers"
-    - name: "fluxmq-auth"
-      certificate_uri_san: "spiffe://absmach/magistrala/fluxmq-auth"
-      # The publish proxy relays messages a user published over HTTP. Stating
-      # their origin protocol and publisher is what the "service" role grants;
-      # on an untrusted connection the broker would stamp its own instead and
-      # every such message would be stored as having arrived over AMQP.
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/fluxmq-auth-current"
-      permissions:
-        # Messages are published to m.<domain>.c.<channel>.<subtopic>, whose
-        # tenant and channel identifiers cannot be enumerated here. It runs no
-        # consumer, so it is granted no subscribe.
-        publish:
-          - routing_key_prefix: "m."
-  external:
-    url: "http://fluxmq-auth:7016"
-    transport: "grpc"
-    timeout: 15s
-    protocols:
-      mqtt: true
-      http: true
-      coap: true
-      amqp: true
-      amqp091: false
-
-hooks:
   url: "http://fluxmq-auth:7016"
-  transport: "http"
-  timeout: 500ms
-  fail_mode: "deny"
+  transport: "grpc"
+  timeout: 15s
   protocols:
     mqtt: true
     http: true
     coap: true
     amqp: true
-    amqp091: true
-  events:
-    auth_on_publish: true
-    auth_on_subscribe: true
-    auth_on_unsubscribe: true
+    amqp091: false

docker/fluxmq/node2.yaml

@@ -34,20 +34,6 @@ server:
   amqp091:
     plain:
       addr: "0.0.0.0:5682"
-    # The local listener is how a first-party service reaches the broker. It
-    # requires mTLS: FluxMQ matches the URI SAN of the presented certificate
-    # against a principal under auth.local_principals, and only a connection
-    # admitted here may exchange "_flux." message metadata. The Rules Engine
-    # needs that metadata to carry its rule execution trace, so it connects
-    # here rather than on the plain listener.
-    local:
-      addr: "0.0.0.0:5685"
-      max_connections: 32
-      cert_file: "/etc/fluxmq/certs/fluxmq-service-server.crt"
-      key_file: "/etc/fluxmq/certs/fluxmq-service-server.key"
-      ca_file: "/etc/fluxmq/certs/ca.crt"
-      client_auth: "require"
-      min_version: "TLS1.2"
   health_addr: "0.0.0.0:8081"
   health_enabled: true
   shutdown_timeout: 30s
@@ -105,13 +91,8 @@ queue_manager:
 
 queues:
   - name: "mqtt"
-    # "mqtt" is this reserved queue's name, not an MQTT-only transport filter;
-    # every protocol adapter uses the same topic-based queue routing. A local-
-    # principal prefix grant is captured by every matching queue, so keep this
-    # binding inside the mqtt namespace rather than also persisting service
-    # streams such as writers and alarms here.
     topics:
-      - "$queue/mqtt/#"
+      - "$queue/#"
     reserved: true
   - name: "events"
     topics:
@@ -143,93 +124,12 @@ queues:
       max_length_bytes: 1073741824
 
 auth:
-  # Principals admitted on the service listener. The certificate_uri_san must
-  # match the URI SAN issued by docker/ssl/Makefile (fluxmq_service_certs), and
-  # each secret file must hold the value configured by its service.
-  local_principals:
-    - name: "rules-engine"
-      certificate_uri_san: "spiffe://absmach/magistrala/rules-engine"
-      # A service may consume and may relay the origin of messages it did not
-      # author, both of which the Rules Engine needs when it republishes a
-      # device message. The capability is the principal's, not the listener's.
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/re-current"
-      permissions:
-        # Rule outputs are republished to m.<domain>.c.<channel>.<subtopic>,
-        # whose tenant and channel identifiers cannot be enumerated here, so the
-        # grant is the topic namespace rather than a list of exact keys. Being a
-        # prefix it is also an ordinary topic publish, which the cluster
-        # forwards; an exact target would be durable on one node and could not
-        # run alongside cluster.enabled.
-        publish:
-          - routing_key_prefix: "m."
-          # The rule output streams. These grants have to live here: a
-          # publication from a connection the broker does not trust has the
-          # broker's own transport protocol and identity stamped on it, so a
-          # saved message would read as "amqp" rather than the protocol the
-          # device published with, and an alarm would name the engine's broker
-          # connection rather than the client. Same prefix reasoning as above --
-          # each queue's own "$queue/<name>/#" binding is what captures it.
-          - routing_key_prefix: "$queue/writers/"
-          - routing_key_prefix: "$queue/alarms/"
-        # The message stream the Rules Engine consumes.
-        subscribe:
-          - "m"
-    - name: "timescale-writer"
-      certificate_uri_san: "spiffe://absmach/magistrala/timescale-writer"
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/timescale-writer-current"
-      permissions:
-        # The writer is a passive consumer of the broker-provisioned stream. It
-        # neither publishes messages nor manages queues.
-        subscribe:
-          - "writers"
-    - name: "postgres-writer"
-      certificate_uri_san: "spiffe://absmach/magistrala/postgres-writer"
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/postgres-writer-current"
-      permissions:
-        # The writer is a passive consumer of the broker-provisioned stream. It
-        # neither publishes messages nor manages queues.
-        subscribe:
-          - "writers"
-    - name: "fluxmq-auth"
-      certificate_uri_san: "spiffe://absmach/magistrala/fluxmq-auth"
-      # The publish proxy relays messages a user published over HTTP. Stating
-      # their origin protocol and publisher is what the "service" role grants;
-      # on an untrusted connection the broker would stamp its own instead and
-      # every such message would be stored as having arrived over AMQP.
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/fluxmq-auth-current"
-      permissions:
-        # Messages are published to m.<domain>.c.<channel>.<subtopic>, whose
-        # tenant and channel identifiers cannot be enumerated here. It runs no
-        # consumer, so it is granted no subscribe.
-        publish:
-          - routing_key_prefix: "m."
-  external:
-    url: "http://fluxmq-auth:7016"
-    transport: "grpc"
-    timeout: 15s
-    protocols:
-      mqtt: true
-      http: true
-      coap: true
-      amqp: true
-      amqp091: false
-
-hooks:
   url: "http://fluxmq-auth:7016"
-  transport: "http"
-  timeout: 500ms
-  fail_mode: "deny"
+  transport: "grpc"
+  timeout: 15s
   protocols:
     mqtt: true
     http: true
     coap: true
     amqp: true
-    amqp091: true
-  events:
-    auth_on_publish: true
-    auth_on_subscribe: true
-    auth_on_unsubscribe: true
+    amqp091: false

docker/fluxmq/node3.yaml

@@ -34,20 +34,6 @@ server:
   amqp091:
     plain:
       addr: "0.0.0.0:5682"
-    # The local listener is how a first-party service reaches the broker. It
-    # requires mTLS: FluxMQ matches the URI SAN of the presented certificate
-    # against a principal under auth.local_principals, and only a connection
-    # admitted here may exchange "_flux." message metadata. The Rules Engine
-    # needs that metadata to carry its rule execution trace, so it connects
-    # here rather than on the plain listener.
-    local:
-      addr: "0.0.0.0:5685"
-      max_connections: 32
-      cert_file: "/etc/fluxmq/certs/fluxmq-service-server.crt"
-      key_file: "/etc/fluxmq/certs/fluxmq-service-server.key"
-      ca_file: "/etc/fluxmq/certs/ca.crt"
-      client_auth: "require"
-      min_version: "TLS1.2"
   health_addr: "0.0.0.0:8081"
   health_enabled: true
   shutdown_timeout: 30s
@@ -105,13 +91,8 @@ queue_manager:
 
 queues:
   - name: "mqtt"
-    # "mqtt" is this reserved queue's name, not an MQTT-only transport filter;
-    # every protocol adapter uses the same topic-based queue routing. A local-
-    # principal prefix grant is captured by every matching queue, so keep this
-    # binding inside the mqtt namespace rather than also persisting service
-    # streams such as writers and alarms here.
     topics:
-      - "$queue/mqtt/#"
+      - "$queue/#"
     reserved: true
   - name: "events"
     topics:
@@ -143,93 +124,12 @@ queues:
       max_length_bytes: 1073741824
 
 auth:
-  # Principals admitted on the service listener. The certificate_uri_san must
-  # match the URI SAN issued by docker/ssl/Makefile (fluxmq_service_certs), and
-  # each secret file must hold the value configured by its service.
-  local_principals:
-    - name: "rules-engine"
-      certificate_uri_san: "spiffe://absmach/magistrala/rules-engine"
-      # A service may consume and may relay the origin of messages it did not
-      # author, both of which the Rules Engine needs when it republishes a
-      # device message. The capability is the principal's, not the listener's.
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/re-current"
-      permissions:
-        # Rule outputs are republished to m.<domain>.c.<channel>.<subtopic>,
-        # whose tenant and channel identifiers cannot be enumerated here, so the
-        # grant is the topic namespace rather than a list of exact keys. Being a
-        # prefix it is also an ordinary topic publish, which the cluster
-        # forwards; an exact target would be durable on one node and could not
-        # run alongside cluster.enabled.
-        publish:
-          - routing_key_prefix: "m."
-          # The rule output streams. These grants have to live here: a
-          # publication from a connection the broker does not trust has the
-          # broker's own transport protocol and identity stamped on it, so a
-          # saved message would read as "amqp" rather than the protocol the
-          # device published with, and an alarm would name the engine's broker
-          # connection rather than the client. Same prefix reasoning as above --
-          # each queue's own "$queue/<name>/#" binding is what captures it.
-          - routing_key_prefix: "$queue/writers/"
-          - routing_key_prefix: "$queue/alarms/"
-        # The message stream the Rules Engine consumes.
-        subscribe:
-          - "m"
-    - name: "timescale-writer"
-      certificate_uri_san: "spiffe://absmach/magistrala/timescale-writer"
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/timescale-writer-current"
-      permissions:
-        # The writer is a passive consumer of the broker-provisioned stream. It
-        # neither publishes messages nor manages queues.
-        subscribe:
-          - "writers"
-    - name: "postgres-writer"
-      certificate_uri_san: "spiffe://absmach/magistrala/postgres-writer"
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/postgres-writer-current"
-      permissions:
-        # The writer is a passive consumer of the broker-provisioned stream. It
-        # neither publishes messages nor manages queues.
-        subscribe:
-          - "writers"
-    - name: "fluxmq-auth"
-      certificate_uri_san: "spiffe://absmach/magistrala/fluxmq-auth"
-      # The publish proxy relays messages a user published over HTTP. Stating
-      # their origin protocol and publisher is what the "service" role grants;
-      # on an untrusted connection the broker would stamp its own instead and
-      # every such message would be stored as having arrived over AMQP.
-      role: "service"
-      current_secret_file: "/etc/fluxmq/secrets/fluxmq-auth-current"
-      permissions:
-        # Messages are published to m.<domain>.c.<channel>.<subtopic>, whose
-        # tenant and channel identifiers cannot be enumerated here. It runs no
-        # consumer, so it is granted no subscribe.
-        publish:
-          - routing_key_prefix: "m."
-  external:
-    url: "http://fluxmq-auth:7016"
-    transport: "grpc"
-    timeout: 15s
-    protocols:
-      mqtt: true
-      http: true
-      coap: true
-      amqp: true
-      amqp091: false
-
-hooks:
   url: "http://fluxmq-auth:7016"
-  transport: "http"
-  timeout: 500ms
-  fail_mode: "deny"
+  transport: "grpc"
+  timeout: 15s
   protocols:
     mqtt: true
     http: true
     coap: true
     amqp: true
-    amqp091: true
-  events:
-    auth_on_publish: true
-    auth_on_subscribe: true
-    auth_on_unsubscribe: true
+    amqp091: false

docker/re/.gitignore

@@ -1,5 +0,0 @@
-# Copyright (c) Abstract Machines
-# SPDX-License-Identifier: Apache-2.0
-
-# Persistent Rules Engine HMAC keys generated by docker/ssl/Makefile.
-secrets/

docker/setup-tls.sh

@@ -6,7 +6,6 @@ set -eu
 
 ROOT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
 ENV_FILE="$ROOT_DIR/docker/.env"
-TOKENS_ENV_FILE="$ROOT_DIR/docker/.env.tokens"
 COMPOSE_FILE="$ROOT_DIR/docker/docker-compose.yaml"
 
 HOST=${MG_PUBLIC_HOST:-}
@@ -125,11 +124,7 @@ comment_env_any() {
 }
 
 compose() {
-	if [ -f "$TOKENS_ENV_FILE" ]; then
-		docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" --env-file "$TOKENS_ENV_FILE" -p "$PROJECT" "$@"
-	else
-		docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" -p "$PROJECT" "$@"
-	fi
+	docker compose -f "$COMPOSE_FILE" --env-file "$ENV_FILE" -p "$PROJECT" "$@"
 }
 
 write_ui_proxy() {
@@ -213,6 +208,7 @@ set_env MG_LETSENCRYPT_FORCE_RENEWAL "$FORCE_RENEWAL"
 set_env MG_NGINX_SERVER_NAME "$HOST"
 comment_env_any MG_NGINX_SERVER_CERT
 comment_env_any MG_NGINX_SERVER_KEY
+set_env MG_UI_DOCKER_ACCEPT_EULA yes
 
 set_env MG_OAUTH_UI_REDIRECT_URL "https://$HOST/api/auth/token"
 set_env MG_OAUTH_UI_ERROR_URL "https://$HOST/login"
@@ -233,19 +229,19 @@ write_ui_proxy
 
 if [ "$LETSENCRYPT_ENABLED" = "false" ]; then
 	echo "Starting Magistrala with the fallback Nginx certificate"
-	compose up -d
-	COMPOSE_PROFILES=letsencrypt compose stop certbot >/dev/null 2>&1 || true
+	MG_UI_DOCKER_ACCEPT_EULA=yes compose up -d
+	MG_UI_DOCKER_ACCEPT_EULA=yes COMPOSE_PROFILES=letsencrypt compose stop certbot >/dev/null 2>&1 || true
 	echo "Let's Encrypt disabled. Nginx cert/key paths are commented in docker/.env."
 	echo "Fallback TLS setup complete: https://$HOST/"
 	exit 0
 fi
 
 echo "Starting Magistrala with the fallback Nginx certificate"
-compose up -d
+MG_UI_DOCKER_ACCEPT_EULA=yes compose up -d
 wait_for_nginx_http
 
 echo "Requesting Let's Encrypt certificate for $HOST"
-COMPOSE_PROFILES=letsencrypt compose up -d --force-recreate certbot
+MG_UI_DOCKER_ACCEPT_EULA=yes COMPOSE_PROFILES=letsencrypt compose up -d --force-recreate certbot
 
 cert_ready() {
 	compose logs certbot 2>&1 | \
@@ -270,6 +266,6 @@ set_env MG_NGINX_SERVER_CERT "$cert_path"
 set_env MG_NGINX_SERVER_KEY "$key_path"
 set_env MG_LETSENCRYPT_FORCE_RENEWAL false
 
-compose up -d --force-recreate nginx
+MG_UI_DOCKER_ACCEPT_EULA=yes compose up -d --force-recreate nginx
 
 echo "TLS setup complete: https://$HOST/"

docker/ssl/.gitignore

@@ -1,21 +1,10 @@
 # Copyright (c) Abstract Machines
 # SPDX-License-Identifier: Apache-2.0
 
-# Everything under certs/ is generated by this directory's Makefile, except the
-# development CA and the default server certificate that ship with the
-# repository.
-#
-# This is a denylist by intent: listing generated certificates by name meant
-# each new one had to remember to add itself here, and forgetting silently left
-# a private key committable. Ignore first, then re-include what is deliberately
-# tracked.
-certs/*
-!certs/ca.crt
-!certs/ca.key
-!certs/magistrala-server.crt
-!certs/magistrala-server.key
-
-# Paths outside certs/.
+*grpc-server*
+*grpc-client*
+*srl
+*conf
 client.crt
 client.key
 certbot-www/

docker/ssl/Makefile

@@ -43,23 +43,6 @@ CHANNELS_GRPC_CLIENT_CRT_FILE_NAME=channels-grpc-client
 COAP_DTLS_SERVER_CONF_FILE_NAME=coap-server.conf
 COAP_DTLS_SERVER_CN=coap
 COAP_DTLS_SERVER_CRT_FILE_NAME=coap-server
-# FluxMQ service listener. The broker identifies a first-party service by the
-# URI SAN of the certificate it presents, matching it against a principal
-# declared in the broker's own configuration, so the SAN below must stay in
-# step with docker/fluxmq/node*.yaml.
-FLUXMQ_SERVICE_SERVER_CRT_FILE_NAME=fluxmq-service-server
-RE_FLUXMQ_CLIENT_CN=rules-engine
-RE_FLUXMQ_CLIENT_CRT_FILE_NAME=re-fluxmq-client
-RE_FLUXMQ_CLIENT_URI_SAN=spiffe://absmach/magistrala/rules-engine
-TIMESCALE_WRITER_FLUXMQ_CLIENT_CN=timescale-writer
-TIMESCALE_WRITER_FLUXMQ_CLIENT_CRT_FILE_NAME=timescale-writer-fluxmq-client
-TIMESCALE_WRITER_FLUXMQ_CLIENT_URI_SAN=spiffe://absmach/magistrala/timescale-writer
-POSTGRES_WRITER_FLUXMQ_CLIENT_CN=postgres-writer
-POSTGRES_WRITER_FLUXMQ_CLIENT_CRT_FILE_NAME=postgres-writer-fluxmq-client
-POSTGRES_WRITER_FLUXMQ_CLIENT_URI_SAN=spiffe://absmach/magistrala/postgres-writer
-FLUXMQ_AUTH_FLUXMQ_CLIENT_CN=fluxmq-auth
-FLUXMQ_AUTH_FLUXMQ_CLIENT_CRT_FILE_NAME=fluxmq-auth-fluxmq-client
-FLUXMQ_AUTH_FLUXMQ_CLIENT_URI_SAN=spiffe://absmach/magistrala/fluxmq-auth
 
 define GRPC_CERT_CONFIG
 [req]
@@ -82,57 +65,6 @@ subjectAltName = @alt_names
 DNS.1 = <<SERVICE_NAME>>
 endef
 
-define FLUXMQ_SERVICE_SERVER_CERT_CONFIG
-[req]
-req_extensions = v3_req
-distinguished_name = dn
-prompt = no
-
-[dn]
-CN = mg.svc
-C  = RS
-ST = RS
-L  = BELGRADE
-O  = SUPERMQ
-OU = SUPERMQ
-
-[v3_req]
-extendedKeyUsage = serverAuth
-subjectAltName = @alt_names
-
-# The Rules Engine verifies this certificate against the host in
-# MG_RE_BROKER_URL, so every name a deployment may dial the service listener by
-# has to appear here: the per-node names this Compose stack uses, and the plain
-# "fluxmq" of a single-node deployment.
-[alt_names]
-DNS.1 = fluxmq
-DNS.2 = fluxmq-node1
-DNS.3 = fluxmq-node2
-DNS.4 = fluxmq-node3
-endef
-
-define URI_SAN_CERT_CONFIG
-[req]
-req_extensions = v3_req
-distinguished_name = dn
-prompt = no
-
-[dn]
-CN = <<SERVICE_NAME>>
-C  = RS
-ST = RS
-L  = BELGRADE
-O  = SUPERMQ
-OU = SUPERMQ
-
-[v3_req]
-extendedKeyUsage = clientAuth
-subjectAltName = @alt_names
-
-[alt_names]
-URI.1 = <<URI_SAN>>
-endef
-
 define ANNOUNCE_BODY
 Version $(VERSION) of $(PACKAGE_NAME) has been released.
 
@@ -140,7 +72,7 @@ It can be downloaded from $(DOWNLOAD_URL).
 
 etc, etc.
 endef
-all: clean_certs ca server_cert auth_grpc_certs domains_grpc_certs groups_grpc_certs clients_grpc_certs channels_grpc_certs coap_dtls_certs fluxmq_service_certs fluxmq_service_secret timescale_writer_fluxmq_service_secret postgres_writer_fluxmq_service_secret fluxmq_auth_fluxmq_service_secret re_trace_key
+all: clean_certs ca server_cert auth_grpc_certs domains_grpc_certs groups_grpc_certs clients_grpc_certs channels_grpc_certs coap_dtls_certs
 
 # CA name and key is "ca".
 ca:
@@ -207,120 +139,6 @@ define gen_grpc_cert_pair
 	$(call gen_grpc_cert,$(3),$(4))
 endef
 
-# Usage: $(call gen_fluxmq_server_cert,cert_file_name)
-define gen_fluxmq_server_cert
-	$(file > $(CRT_LOCATION)/$(1).conf,$(FLUXMQ_SERVICE_SERVER_CERT_CONFIG))
-
-	openssl req -new -sha256 -newkey rsa:4096 -nodes \
-		-keyout $(CRT_LOCATION)/$(1).key \
-		-out $(CRT_LOCATION)/$(1).csr \
-		-config $(CRT_LOCATION)/$(1).conf \
-		-extensions v3_req
-
-	openssl x509 -req -sha256 \
-		-in $(CRT_LOCATION)/$(1).csr \
-		-CA $(CRT_LOCATION)/ca.crt \
-		-CAkey $(CRT_LOCATION)/ca.key \
-		-CAcreateserial \
-		-out $(CRT_LOCATION)/$(1).crt \
-		-days 365 \
-		-extfile $(CRT_LOCATION)/$(1).conf \
-		-extensions v3_req
-
-	rm -rf $(CRT_LOCATION)/$(1).csr $(CRT_LOCATION)/$(1).conf
-endef
-
-# Usage: $(call gen_uri_san_cert,cert_file_name,common_name,uri_san)
-define gen_uri_san_cert
-	$(file > $(CRT_LOCATION)/$(1).conf,$(subst <<URI_SAN>>,$(3),$(subst <<SERVICE_NAME>>,$(2),$(URI_SAN_CERT_CONFIG))))
-
-	openssl req -new -sha256 -newkey rsa:4096 -nodes \
-		-keyout $(CRT_LOCATION)/$(1).key \
-		-out $(CRT_LOCATION)/$(1).csr \
-		-config $(CRT_LOCATION)/$(1).conf \
-		-extensions v3_req
-
-	openssl x509 -req -sha256 \
-		-in $(CRT_LOCATION)/$(1).csr \
-		-CA $(CRT_LOCATION)/ca.crt \
-		-CAkey $(CRT_LOCATION)/ca.key \
-		-CAcreateserial \
-		-out $(CRT_LOCATION)/$(1).crt \
-		-days 365 \
-		-extfile $(CRT_LOCATION)/$(1).conf \
-		-extensions v3_req
-
-	rm -rf $(CRT_LOCATION)/$(1).csr $(CRT_LOCATION)/$(1).conf
-endef
-
-# Certificates for the FluxMQ service listener: a server certificate for the
-# broker and a client certificate carrying each local principal's URI SAN. The
-# listener requires mTLS, so both sides are issued by the same CA.
-fluxmq_service_certs:
-	$(call gen_fluxmq_server_cert,$(FLUXMQ_SERVICE_SERVER_CRT_FILE_NAME))
-	$(call gen_uri_san_cert,$(RE_FLUXMQ_CLIENT_CRT_FILE_NAME),$(RE_FLUXMQ_CLIENT_CN),$(RE_FLUXMQ_CLIENT_URI_SAN))
-	$(call gen_uri_san_cert,$(TIMESCALE_WRITER_FLUXMQ_CLIENT_CRT_FILE_NAME),$(TIMESCALE_WRITER_FLUXMQ_CLIENT_CN),$(TIMESCALE_WRITER_FLUXMQ_CLIENT_URI_SAN))
-	$(call gen_uri_san_cert,$(POSTGRES_WRITER_FLUXMQ_CLIENT_CRT_FILE_NAME),$(POSTGRES_WRITER_FLUXMQ_CLIENT_CN),$(POSTGRES_WRITER_FLUXMQ_CLIENT_URI_SAN))
-	$(call gen_uri_san_cert,$(FLUXMQ_AUTH_FLUXMQ_CLIENT_CRT_FILE_NAME),$(FLUXMQ_AUTH_FLUXMQ_CLIENT_CN),$(FLUXMQ_AUTH_FLUXMQ_CLIENT_URI_SAN))
-
-# Generate a single principal's certificate when adding it to an existing
-# deployment, without rotating the broker certificate or the other principals.
-timescale_writer_fluxmq_client_cert:
-	$(call gen_uri_san_cert,$(TIMESCALE_WRITER_FLUXMQ_CLIENT_CRT_FILE_NAME),$(TIMESCALE_WRITER_FLUXMQ_CLIENT_CN),$(TIMESCALE_WRITER_FLUXMQ_CLIENT_URI_SAN))
-
-postgres_writer_fluxmq_client_cert:
-	$(call gen_uri_san_cert,$(POSTGRES_WRITER_FLUXMQ_CLIENT_CRT_FILE_NAME),$(POSTGRES_WRITER_FLUXMQ_CLIENT_CN),$(POSTGRES_WRITER_FLUXMQ_CLIENT_URI_SAN))
-
-fluxmq_auth_fluxmq_client_cert:
-	$(call gen_uri_san_cert,$(FLUXMQ_AUTH_FLUXMQ_CLIENT_CRT_FILE_NAME),$(FLUXMQ_AUTH_FLUXMQ_CLIENT_CN),$(FLUXMQ_AUTH_FLUXMQ_CLIENT_URI_SAN))
-
-# The SASL secret a local principal presents alongside its certificate. FluxMQ
-# reads it from a file and the service sends it in its broker URL, so both sides
-# must see the same value: .env is the single source and these targets derive
-# the file from it. FluxMQ requires at least 32 bytes.
-#
-# Usage: $(call gen_fluxmq_service_secret,env_variable_name,secret_file_name)
-define gen_fluxmq_service_secret
-	@mkdir -p ../fluxmq/secrets
-	@secret="$${$(1)}"; \
-	if [ -z "$$secret" ]; then \
-		secret=$$(grep -E "^$(1)=" ../.env | cut -d= -f2-); \
-	fi; \
-	if [ -z "$$secret" ]; then \
-		echo "$(1) is not set in docker/.env"; exit 1; \
-	fi; \
-	if [ $${#secret} -lt 32 ]; then \
-		echo "$(1) must be at least 32 characters"; exit 1; \
-	fi; \
-	printf '%s' "$$secret" > ../fluxmq/secrets/$(2); \
-	chmod 600 ../fluxmq/secrets/$(2); \
-	echo "wrote docker/fluxmq/secrets/$(2)"
-endef
-
-fluxmq_service_secret:
-	$(call gen_fluxmq_service_secret,MG_RE_BROKER_SECRET,re-current)
-
-timescale_writer_fluxmq_service_secret:
-	$(call gen_fluxmq_service_secret,MG_TIMESCALE_WRITER_BROKER_SECRET,timescale-writer-current)
-
-postgres_writer_fluxmq_service_secret:
-	$(call gen_fluxmq_service_secret,MG_POSTGRES_WRITER_BROKER_SECRET,postgres-writer-current)
-
-fluxmq_auth_fluxmq_service_secret:
-	$(call gen_fluxmq_service_secret,MG_FLUXMQ_BROKER_SECRET,fluxmq-auth-current)
-
-# Persistent HMAC key shared by Rules Engine replicas. Do not replace an
-# existing key: doing so while old messages are in flight would invalidate
-# their loop traces. The containing directory is excluded from git.
-re_trace_key:
-	@mkdir -p ../re/secrets
-	@if [ ! -s ../re/secrets/trace.key ]; then \
-		umask 077; openssl rand -hex 32 > ../re/secrets/trace.key; \
-		echo "wrote docker/re/secrets/trace.key"; \
-	else \
-		echo "preserving docker/re/secrets/trace.key"; \
-	fi
-
 auth_grpc_certs:
 	$(call gen_grpc_cert_pair,$(AUTH_GRPC_SERVER_CRT_FILE_NAME),$(AUTH_GRPC_SERVER_CN),$(AUTH_GRPC_CLIENT_CRT_FILE_NAME),$(AUTH_GRPC_CLIENT_CN))
 

docker/templates/invitation-accepted-email.tmpl

@@ -0,0 +1,100 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <title>{{.Subject}}</title>
+    <style>
+        body {
+            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
+            line-height: 1.6;
+            color: #333;
+            background-color: #f5f7fa;
+            margin: 0;
+            padding: 0;
+        }
+        .container {
+            max-width: 600px;
+            margin: 30px auto;
+            background-color: #ffffff;
+            border-radius: 8px;
+            box-shadow: 0 2px 10px rgba(0, 0, 0, 0.1);
+            overflow: hidden;
+        }
+        .header {
+            background: linear-gradient(135deg, #27ae60 0%, #2ecc71 100%);
+            padding: 30px 40px;
+            text-align: center;
+        }
+        .header h1 {
+            color: #ffffff;
+            margin: 0;
+            font-size: 24px;
+            font-weight: 600;
+        }
+        .content {
+            padding: 40px;
+        }
+        .content p {
+            margin: 0 0 15px 0;
+            font-size: 15px;
+        }
+        .success-details {
+            background-color: #eafaf1;
+            border-left: 4px solid #27ae60;
+            padding: 20px;
+            margin: 25px 0;
+            border-radius: 4px;
+        }
+        .success-details p {
+            margin: 0;
+            font-size: 16px;
+            line-height: 1.8;
+        }
+        .icon-success {
+            text-align: center;
+            margin: 20px 0;
+            font-size: 48px;
+        }
+        .footer {
+            background-color: #f8f9fb;
+            padding: 25px 40px;
+            text-align: center;
+            font-size: 13px;
+            color: #666;
+        }
+        .footer-divider {
+            border: none;
+            border-top: 1px solid #e0e3e8;
+            margin: 30px 0 20px 0;
+        }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="header">
+            <h1>Invitation Accepted</h1>
+        </div>
+
+        <div class="content">
+            <div class="icon-success">✓</div>
+
+            <p>Dear <strong>{{.User}}</strong>,</p>
+
+            <div class="success-details">
+                <p>{{.Content}}</p>
+            </div>
+
+            <p>You can now collaborate with them in the domain.</p>
+
+            <hr class="footer-divider">
+
+            <p>Best regards,<br><strong>{{.Footer}}</strong></p>
+        </div>
+
+        <div class="footer">
+            <p>This is an automated email. Please do not reply directly to this message.</p>
+            <p style="margin-top: 10px; color: #999;">Powered by Magistrala</p>
+        </div>
+    </div>
+</body>
+</html>