Add custom authorizer, update noop search

* feat(unified): add bm25 index scoring model

We want try BM25 scoring model since they have global scoring which we can probably re-use for fan-in/fan-out logic

https://github.com/blevesearch/bleve/blob/32d98823c4b7482c62cc6c847508ed7659c23c37/docs/scoring.md#global-scoring

* fix(plugins): update plugin test data

pkg/registry/apis/iam/authorizer.go

@@ -8,6 +8,7 @@ import (
 	"k8s.io/apiserver/pkg/authorization/authorizer"
 
 	iamv0 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
 	iamauthorizer "github.com/grafana/grafana/pkg/registry/apis/iam/authorizer"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
@@ -40,6 +41,22 @@ func newIAMAuthorizer(
 		return authorizer.DecisionAllow, "", nil
 	})
 
+	serviceIdentityAuthorizer := authorizer.AuthorizerFunc(func(
+		ctx context.Context, attr authorizer.Attributes,
+	) (authorized authorizer.Decision, reason string, err error) {
+		if identity.IsServiceIdentity(ctx) {
+			// A Grafana sub-system should have full access. We trust them to make wise decisions.
+			return authorizer.DecisionAllow, "", nil
+		}
+
+		req, err := identity.GetRequester(ctx)
+		if err == nil && req != nil && req.GetIsGrafanaAdmin() {
+			return authorizer.DecisionAllow, "", nil
+		}
+
+		return authorizer.DecisionDeny, "", nil
+	})
+
 	// Identity specific resources
 	legacyAuthorizer := gfauthorizer.NewResourceAuthorizer(legacyAccessClient)
 	resourceAuthorizer["display"] = legacyAuthorizer
@@ -57,6 +74,8 @@ func newIAMAuthorizer(
 	resourceAuthorizer[iamv0.TeamBindingResourceInfo.GetName()] = allowAuthorizer
 	resourceAuthorizer["searchUsers"] = serviceAuthorizer
 	resourceAuthorizer["searchTeams"] = serviceAuthorizer
+	// TODO: Implement fine-grained authorization for external group mapping search on the search level
+	resourceAuthorizer["searchExternalGroupMappings"] = serviceIdentityAuthorizer
 
 	return &iamAuthorizer{resourceAuthorizer: resourceAuthorizer}
 }

pkg/registry/apis/iam/authorizer/team_binding_authorizer.go

@@ -97,8 +97,8 @@ func (r *TeamBindingAuthorizer) beforeWrite(ctx context.Context, obj runtime.Obj
 	teamName := concreteObj.Spec.TeamRef.Name
 	checkReq := types.CheckRequest{
 		Namespace: authInfo.GetNamespace(),
-		Group:     iamv0.GROUP,
-		Resource:  iamv0.TeamResourceInfo.GetName(),
+		Group:     iamv0.TeamResourceInfo.GroupResource().Group,
+		Resource:  iamv0.TeamResourceInfo.GroupResource().Resource,
 		Verb:      utils.VerbSetPermissions,
 		Name:      teamName,
 	}

pkg/registry/apis/iam/externalgroupmapping/models.go

@@ -1,6 +1,10 @@
 package externalgroupmapping
 
-import "k8s.io/apiserver/pkg/registry/rest"
+import (
+	"github.com/grafana/grafana/pkg/services/apiserver/builder"
+	"k8s.io/apiserver/pkg/registry/rest"
+	"k8s.io/kube-openapi/pkg/common"
+)
 
 type TeamGroupsHandler interface {
 	rest.Storage
@@ -8,3 +12,7 @@ type TeamGroupsHandler interface {
 	rest.StorageMetadata
 	rest.Connecter
 }
+
+type SearchHandler interface {
+	GetAPIRoutes(defs map[string]common.OpenAPIDefinition) *builder.APIRoutes
+}

pkg/registry/apis/iam/externalgroupmapping/search_noop.go

@@ -0,0 +1,167 @@
+package externalgroupmapping
+
+import (
+	"fmt"
+	"net/http"
+
+	iamv0 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+	"github.com/grafana/grafana/pkg/services/apiserver/builder"
+	"github.com/grafana/grafana/pkg/util/errhttp"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/kube-openapi/pkg/common"
+	"k8s.io/kube-openapi/pkg/spec3"
+	"k8s.io/kube-openapi/pkg/validation/spec"
+)
+
+var _ SearchHandler = (*NoopSearchREST)(nil)
+
+type NoopSearchREST struct{}
+
+func ProvideNoopSearchREST() *NoopSearchREST {
+	return &NoopSearchREST{}
+}
+
+func (n *NoopSearchREST) GetAPIRoutes(defs map[string]common.OpenAPIDefinition) *builder.APIRoutes {
+	searchResults := defs["github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ExternalGroupMappingList"].Schema
+	return &builder.APIRoutes{
+		Namespace: []builder.APIRouteHandler{
+			{
+				Path: "searchExternalGroupMappings",
+				Spec: &spec3.PathProps{
+					Post: &spec3.Operation{
+						OperationProps: spec3.OperationProps{
+							Description: "External Group Mapping search",
+							Tags:        []string{"Search"},
+							OperationId: "searchExternalGroupMappings",
+							RequestBody: &spec3.RequestBody{
+								RequestBodyProps: spec3.RequestBodyProps{
+									Content: map[string]*spec3.MediaType{
+										"application/json": {
+											MediaTypeProps: spec3.MediaTypeProps{
+												Schema: &spec.Schema{
+													SchemaProps: spec.SchemaProps{
+														Type: []string{"object"},
+														Properties: map[string]spec.Schema{
+															"externalGroups": {
+																SchemaProps: spec.SchemaProps{
+																	Type: []string{"array"},
+																	Items: &spec.SchemaOrArray{
+																		Schema: &spec.Schema{
+																			SchemaProps: spec.SchemaProps{
+																				Type: []string{"string"},
+																			},
+																		},
+																	},
+																},
+															},
+														},
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+							Parameters: []*spec3.Parameter{
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "namespace",
+										In:          "path",
+										Required:    true,
+										Example:     "default",
+										Description: "workspace",
+										Schema:      spec.StringProperty(),
+									},
+								},
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "teamName",
+										In:          "query",
+										Required:    false,
+										Description: "Team name",
+										Schema:      spec.StringProperty(),
+									},
+								},
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "limit",
+										In:          "query",
+										Description: "number of results to return",
+										Example:     30,
+										Required:    false,
+										Schema:      spec.Int64Property(),
+									},
+								},
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "page",
+										In:          "query",
+										Description: "page number (starting from 1)",
+										Example:     1,
+										Required:    false,
+										Schema:      spec.Int64Property(),
+									},
+								},
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "offset",
+										In:          "query",
+										Description: "number of results to skip",
+										Example:     0,
+										Required:    false,
+										Schema:      spec.Int64Property(),
+									},
+								},
+								{
+									ParameterProps: spec3.ParameterProps{
+										Name:        "sort",
+										In:          "query",
+										Description: "sortable field",
+										Example:     "",
+										Examples: map[string]*spec3.Example{
+											"externalGroup": {
+												ExampleProps: spec3.ExampleProps{
+													Summary: "externalGroup ascending",
+													Value:   "externalGroup",
+												},
+											},
+											"-externalGroup": {
+												ExampleProps: spec3.ExampleProps{
+													Summary: "externalGroup descending",
+													Value:   "-externalGroup",
+												},
+											},
+										},
+										Required: false,
+										Schema:   spec.StringProperty(),
+									},
+								},
+							},
+							Responses: &spec3.Responses{
+								ResponsesProps: spec3.ResponsesProps{
+									Default: &spec3.Response{
+										ResponseProps: spec3.ResponseProps{
+											Description: "Default OK response",
+											Content: map[string]*spec3.MediaType{
+												"application/json": {
+													MediaTypeProps: spec3.MediaTypeProps{
+														Schema: &searchResults,
+													},
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					},
+				},
+				Handler: n.doSearch,
+			},
+		},
+	}
+}
+
+func (n *NoopSearchREST) doSearch(w http.ResponseWriter, r *http.Request) {
+	errhttp.Write(r.Context(), errors.NewForbidden(iamv0.ExternalGroupMappingResourceInfo.GroupResource(), "", fmt.Errorf("functionality not available")), w)
+}

pkg/registry/apis/iam/models.go

@@ -82,11 +82,12 @@ type IdentityAccessManagementAPIBuilder struct {
 	reg    prometheus.Registerer
 	logger log.Logger
 
-	dual              dualwrite.Service
-	unified           resource.ResourceClient
-	userSearchClient  resourcepb.ResourceIndexClient
-	userSearchHandler *user.SearchHandler
-	teamSearch        *TeamSearchHandler
+	dual                              dualwrite.Service
+	unified                           resource.ResourceClient
+	userSearchClient                  resourcepb.ResourceIndexClient
+	userSearchHandler                 *user.SearchHandler
+	teamSearch                        *TeamSearchHandler
+	externalGroupMappingSearchHandler externalgroupmapping.SearchHandler
 
 	teamGroupsHandler externalgroupmapping.TeamGroupsHandler
 

pkg/registry/apis/iam/register.go

@@ -79,6 +79,7 @@ func RegisterAPIService(
 	roleBindingsStorage RoleBindingStorageBackend,
 	externalGroupMappingStorageBackend ExternalGroupMappingStorageBackend,
 	teamGroupsHandlerImpl externalgroupmapping.TeamGroupsHandler,
+	externalGroupMappingSearchHandler externalgroupmapping.SearchHandler,
 	dual dualwrite.Service,
 	unified resource.ResourceClient,
 	orgService org.Service,
@@ -101,31 +102,32 @@ func RegisterAPIService(
 	)
 
 	builder := &IdentityAccessManagementAPIBuilder{
-		store:                       store,
-		userLegacyStore:             user.NewLegacyStore(store, accessClient, enableAuthnMutation, tracing),
-		saLegacyStore:               serviceaccount.NewLegacyStore(store, accessClient, enableAuthnMutation, tracing),
-		legacyTeamStore:             team.NewLegacyStore(store, accessClient, enableAuthnMutation, tracing),
-		teamBindingLegacyStore:      teambinding.NewLegacyBindingStore(store, enableAuthnMutation, tracing),
-		ssoLegacyStore:              sso.NewLegacyStore(ssoService, tracing),
-		coreRolesStorage:            coreRolesStorage,
-		roleApiInstaller:            roleApiInstaller,
-		resourcePermissionsStorage:  resourcepermission.ProvideStorageBackend(dbProvider),
-		roleBindingsStorage:         roleBindingsStorage,
-		externalGroupMappingStorage: externalGroupMappingStorageBackend,
-		teamGroupsHandler:           teamGroupsHandlerImpl,
-		sso:                         ssoService,
-		resourceParentProvider:      resourceParentProvider,
-		authorizer:                  authorizer,
-		legacyAccessClient:          legacyAccessClient,
-		accessClient:                accessClient,
-		zClient:                     zClient,
-		zTickets:                    make(chan bool, MaxConcurrentZanzanaWrites),
-		display:                     user.NewLegacyDisplayREST(store),
-		reg:                         reg,
-		logger:                      log.New("iam.apis"),
-		features:                    features,
-		dual:                        dual,
-		unified:                     unified,
+		store:                             store,
+		userLegacyStore:                   user.NewLegacyStore(store, accessClient, enableAuthnMutation, tracing),
+		saLegacyStore:                     serviceaccount.NewLegacyStore(store, accessClient, enableAuthnMutation, tracing),
+		legacyTeamStore:                   team.NewLegacyStore(store, accessClient, enableAuthnMutation, tracing),
+		teamBindingLegacyStore:            teambinding.NewLegacyBindingStore(store, enableAuthnMutation, tracing),
+		ssoLegacyStore:                    sso.NewLegacyStore(ssoService, tracing),
+		coreRolesStorage:                  coreRolesStorage,
+		roleApiInstaller:                  roleApiInstaller,
+		resourcePermissionsStorage:        resourcepermission.ProvideStorageBackend(dbProvider),
+		roleBindingsStorage:               roleBindingsStorage,
+		externalGroupMappingStorage:       externalGroupMappingStorageBackend,
+		teamGroupsHandler:                 teamGroupsHandlerImpl,
+		externalGroupMappingSearchHandler: externalGroupMappingSearchHandler,
+		sso:                               ssoService,
+		resourceParentProvider:            resourceParentProvider,
+		authorizer:                        authorizer,
+		legacyAccessClient:                legacyAccessClient,
+		accessClient:                      accessClient,
+		zClient:                           zClient,
+		zTickets:                          make(chan bool, MaxConcurrentZanzanaWrites),
+		display:                           user.NewLegacyDisplayREST(store),
+		reg:                               reg,
+		logger:                            log.New("iam.apis"),
+		features:                          features,
+		dual:                              dual,
+		unified:                           unified,
 		userSearchClient: resource.NewSearchClient(dualwrite.NewSearchAdapter(dual), iamv0.UserResourceInfo.GroupResource(),
 			unified, user.NewUserLegacySearchClient(orgService, tracing, cfg), features),
 		teamSearch: NewTeamSearchHandler(tracing, dual, team.NewLegacyTeamSearchClient(teamService), unified, features),
@@ -625,7 +627,7 @@ func (b *IdentityAccessManagementAPIBuilder) PostProcessOpenAPI(oas *spec3.OpenA
 func (b *IdentityAccessManagementAPIBuilder) GetAPIRoutes(gv schema.GroupVersion) *builder.APIRoutes {
 	defs := b.GetOpenAPIDefinitions()(func(path string) spec.Ref { return spec.Ref{} })
 
-	searchRoutes := make([]*builder.APIRoutes, 0, 2)
+	searchRoutes := make([]*builder.APIRoutes, 0, 3)
 	if b.userSearchHandler != nil {
 		searchRoutes = append(searchRoutes, b.userSearchHandler.GetAPIRoutes(defs))
 	}
@@ -634,6 +636,10 @@ func (b *IdentityAccessManagementAPIBuilder) GetAPIRoutes(gv schema.GroupVersion
 		searchRoutes = append(searchRoutes, b.teamSearch.GetAPIRoutes(defs))
 	}
 
+	if b.externalGroupMappingSearchHandler != nil {
+		searchRoutes = append(searchRoutes, b.externalGroupMappingSearchHandler.GetAPIRoutes(defs))
+	}
+
 	routes := []*builder.APIRoutes{b.display.GetAPIRoutes(defs)}
 	routes = append(routes, searchRoutes...)
 	return mergeAPIRoutes(routes...)

pkg/registry/apis/wireset.go

@@ -35,6 +35,9 @@ var WireSetExts = wire.NewSet(
 	externalgroupmapping.ProvideNoopTeamGroupsREST,
 	wire.Bind(new(externalgroupmapping.TeamGroupsHandler), new(*externalgroupmapping.NoopTeamGroupsREST)),
 
+	externalgroupmapping.ProvideNoopSearchREST,
+	wire.Bind(new(externalgroupmapping.SearchHandler), new(*externalgroupmapping.NoopSearchREST)),
+
 	// Auditing Options
 	auditing.ProvideNoopBackend,
 	auditing.ProvideNoopPolicyRuleProvider,

pkg/server/wire_gen.go

@@ -883,7 +883,8 @@ func Initialize(ctx context.Context, cfg *setting.Cfg, opts Options, apiOpts api
 	storageBackendImpl := noopstorage.ProvideStorageBackend()
 	roleApiInstaller := iam.ProvideNoopRoleApiInstaller()
 	noopTeamGroupsREST := externalgroupmapping.ProvideNoopTeamGroupsREST()
-	identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
+	noopSearchREST := externalgroupmapping.ProvideNoopSearchREST()
+	identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, noopSearchREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
 	if err != nil {
 		return nil, err
 	}
@@ -1551,7 +1552,8 @@ func InitializeForTest(ctx context.Context, t sqlutil.ITestDB, testingT interfac
 	storageBackendImpl := noopstorage.ProvideStorageBackend()
 	roleApiInstaller := iam.ProvideNoopRoleApiInstaller()
 	noopTeamGroupsREST := externalgroupmapping.ProvideNoopTeamGroupsREST()
-	identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
+	noopSearchREST := externalgroupmapping.ProvideNoopSearchREST()
+	identityAccessManagementAPIBuilder, err := iam.RegisterAPIService(cfg, featureToggles, apiserverService, ssosettingsimplService, sqlStore, accessControl, accessClient, zanzanaClient, registerer, storageBackendImpl, roleApiInstaller, tracingService, storageBackendImpl, storageBackendImpl, noopTeamGroupsREST, noopSearchREST, dualwriteService, resourceClient, orgService, userService, teamService, eventualRestConfigProvider)
 	if err != nil {
 		return nil, err
 	}

pkg/services/navtree/navtreeimpl/navtree.go

@@ -446,32 +446,9 @@ func (s *ServiceImpl) buildAlertNavLinks(c *contextmodel.ReqContext) *navtree.Na
 	}
 
 	if hasAccess(ac.EvalAny(ac.EvalPermission(ac.ActionAlertingRuleRead), ac.EvalPermission(ac.ActionAlertingRuleExternalRead))) {
-		//nolint:staticcheck // not yet migrated to OpenFeature
-		if s.features.IsEnabled(c.Req.Context(), featuremgmt.FlagAlertingNavigationV2) {
-			// New navigation: Alert rules parent (tabs managed on frontend)
-			alertChildNavs = append(alertChildNavs, &navtree.NavLink{
-				Text: "Alert rules", SubTitle: "Rules that determine whether an alert will fire", Id: "alert-rules", Url: s.cfg.AppSubURL + "/alerting/list", Icon: "list-ul",
-			})
-
-			// Add child nav items for permission checking (tabs will be rendered by frontend)
-			// Alert rules list tab
-			alertChildNavs = append(alertChildNavs, &navtree.NavLink{
-				Text: "Alert rules", Id: "alert-rules-list", Url: s.cfg.AppSubURL + "/alerting/list",
-			})
-
-			// Recently deleted tab (check additional feature flags)
-			//nolint:staticcheck // not yet migrated to OpenFeature
-			if c.GetOrgRole() == org.RoleAdmin && s.features.IsEnabled(c.Req.Context(), featuremgmt.FlagAlertRuleRestore) && s.features.IsEnabled(c.Req.Context(), featuremgmt.FlagAlertingRuleRecoverDeleted) {
-				alertChildNavs = append(alertChildNavs, &navtree.NavLink{
-					Text: "Recently deleted", Id: "alert-rules-recently-deleted", Url: s.cfg.AppSubURL + "/alerting/recently-deleted",
-				})
-			}
-		} else {
-			// Legacy navigation
-			alertChildNavs = append(alertChildNavs, &navtree.NavLink{
-				Text: "Alert rules", SubTitle: "Rules that determine whether an alert will fire", Id: "alert-list", Url: s.cfg.AppSubURL + "/alerting/list", Icon: "list-ul",
-			})
-		}
+		alertChildNavs = append(alertChildNavs, &navtree.NavLink{
+			Text: "Alert rules", SubTitle: "Rules that determine whether an alert will fire", Id: "alert-list", Url: s.cfg.AppSubURL + "/alerting/list", Icon: "list-ul",
+		})
 	}
 
 	contactPointsPerms := []ac.Evaluator{
@@ -531,16 +508,12 @@ func (s *ServiceImpl) buildAlertNavLinks(c *contextmodel.ReqContext) *navtree.Na
 	}
 	//nolint:staticcheck // not yet migrated to OpenFeature
 	if c.GetOrgRole() == org.RoleAdmin && s.features.IsEnabled(c.Req.Context(), featuremgmt.FlagAlertRuleRestore) && s.features.IsEnabled(c.Req.Context(), featuremgmt.FlagAlertingRuleRecoverDeleted) {
-		// Only show as standalone item in legacy navigation (V2 shows it as a tab under Alert rules)
-		//nolint:staticcheck // not yet migrated to OpenFeature
-		if !s.features.IsEnabled(c.Req.Context(), featuremgmt.FlagAlertingNavigationV2) {
-			alertChildNavs = append(alertChildNavs, &navtree.NavLink{
-				Text:     "Recently deleted",
-				SubTitle: "Any items listed here for more than 30 days will be automatically deleted.",
-				Id:       "alerts/recently-deleted",
-				Url:      s.cfg.AppSubURL + "/alerting/recently-deleted",
-			})
-		}
+		alertChildNavs = append(alertChildNavs, &navtree.NavLink{
+			Text:     "Recently deleted",
+			SubTitle: "Any items listed here for more than 30 days will be automatically deleted.",
+			Id:       "alerts/recently-deleted",
+			Url:      s.cfg.AppSubURL + "/alerting/recently-deleted",
+		})
 	}
 
 	if c.GetOrgRole() == org.RoleAdmin {

pkg/setting/setting.go

@@ -600,6 +600,7 @@ type Cfg struct {
 	IndexRebuildInterval                       time.Duration
 	IndexCacheTTL                              time.Duration
 	IndexMinUpdateInterval                     time.Duration // Don't update index if it was updated less than this interval ago.
+	IndexScoringModel                          string        // Note: Temporary config to switch the index scoring model and will be removed soon.
 	MaxFileIndexAge                            time.Duration // Max age of file-based indexes. Index older than this will be rebuilt asynchronously.
 	MinFileIndexBuildVersion                   string        // Minimum version of Grafana that built the file-based index. If index was built with older Grafana, it will be rebuilt asynchronously.
 	EnableSharding                             bool

pkg/setting/setting_unified_storage.go

@@ -123,6 +123,10 @@ func (cfg *Cfg) setUnifiedStorageConfig() {
 	cfg.IndexRebuildInterval = section.Key("index_rebuild_interval").MustDuration(24 * time.Hour)
 	cfg.IndexCacheTTL = section.Key("index_cache_ttl").MustDuration(10 * time.Minute)
 	cfg.IndexMinUpdateInterval = section.Key("index_min_update_interval").MustDuration(0)
+	cfg.IndexScoringModel = section.Key("index_scoring_model").MustString("")
+	if cfg.IndexScoringModel != "" {
+		cfg.Logger.Info("Index scoring model set", "model", cfg.IndexScoringModel)
+	}
 	cfg.SprinklesApiServer = section.Key("sprinkles_api_server").String()
 	cfg.SprinklesApiServerPageLimit = section.Key("sprinkles_api_server_page_limit").MustInt(10000)
 	cfg.CACertPath = section.Key("ca_cert_path").String()

pkg/storage/unified/proto/search.proto

@@ -9,11 +9,13 @@ import "resource.proto";
 // Unlike the ResourceStore, this service can be exposed to clients directly
 // It should be implemented with efficient indexes and does not need read-after-write semantics
 service ResourceIndex {
+  // Query for documents
   rpc Search(ResourceSearchRequest) returns (ResourceSearchResponse);
 
   // Get the resource stats
   rpc GetStats(ResourceStatsRequest) returns (ResourceStatsResponse);
 
+  // Rebuild the search index
   rpc RebuildIndexes(RebuildIndexesRequest) returns (RebuildIndexesResponse);
 }
 
@@ -49,6 +51,20 @@ message ResourceStatsResponse {
   repeated Stats stats = 2;
 }
 
+// This controls what query and analyzers are applied to the specified field
+// See: https://blevesearch.com/docs/Analyzers/
+enum QueryFieldType {
+  // Picks a reasonable analyzer given the input.  Currently this always uses TEXT
+  // In the future, it may change to depend on the indexed field type
+  DEFAULT = 0;
+  // Use free text analyzer.  The query is broken into a normalized set of tokens
+  TEXT = 1;
+  // The query must exactly match the indexed token
+  KEYWORD = 2;
+  // Like a text query, but the position and offsets influence the score
+  PHRASE = 3; 
+}
+
 // Search within a single resource
 message ResourceSearchRequest {
   message Sort {
@@ -64,6 +80,18 @@ message ResourceSearchRequest {
     // date queries
   }
 
+  // Defines the field in the index to query
+  // Boost is optional, and allows weighting the field higher in the results
+  message QueryField {
+    // The field name in the index to query
+    string name = 1;
+
+    QueryFieldType type = 2;
+
+    // Boost value for this field
+    float boost = 3;
+  }
+
   // The key must include namespace + group + resource
   ListOptions options = 1;
 
@@ -99,6 +127,9 @@ message ResourceSearchRequest {
   int64 page = 11;
 
   int64 permission = 12;
+
+  // Optionally specify which fields are included in the query
+  repeated QueryField query_fields = 13;
 }
 
 message ResourceSearchResponse {

pkg/storage/unified/resource/document.go

@@ -290,7 +290,6 @@ const SEARCH_FIELD_NAMESPACE = "namespace"
 const SEARCH_FIELD_NAME = "name"
 const SEARCH_FIELD_RV = "rv"
 const SEARCH_FIELD_TITLE = "title"
-const SEARCH_FIELD_TITLE_NGRAM = "title_ngram"
 const SEARCH_FIELD_TITLE_PHRASE = "title_phrase" // filtering/sorting on title by full phrase
 const SEARCH_FIELD_DESCRIPTION = "description"
 const SEARCH_FIELD_TAGS = "tags"

pkg/storage/unified/resourcepb/search.pb.go

@@ -21,6 +21,65 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
+// This controls what query and analyzers are applied to the specified field
+// See: https://blevesearch.com/docs/Analyzers/
+type QueryFieldType int32
+
+const (
+	// Picks a reasonable analyzer given the input.  Currently this always uses TEXT
+	// In the future, it may change to depend on the indexed field type
+	QueryFieldType_DEFAULT QueryFieldType = 0
+	// Use free text analyzer.  The query is broken into a normalized set of tokens
+	QueryFieldType_TEXT QueryFieldType = 1
+	// The query must exactly match the indexed token
+	QueryFieldType_KEYWORD QueryFieldType = 2
+	// Like a text query, but the position and offsets influence the score
+	QueryFieldType_PHRASE QueryFieldType = 3
+)
+
+// Enum value maps for QueryFieldType.
+var (
+	QueryFieldType_name = map[int32]string{
+		0: "DEFAULT",
+		1: "TEXT",
+		2: "KEYWORD",
+		3: "PHRASE",
+	}
+	QueryFieldType_value = map[string]int32{
+		"DEFAULT": 0,
+		"TEXT":    1,
+		"KEYWORD": 2,
+		"PHRASE":  3,
+	}
+)
+
+func (x QueryFieldType) Enum() *QueryFieldType {
+	p := new(QueryFieldType)
+	*p = x
+	return p
+}
+
+func (x QueryFieldType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (QueryFieldType) Descriptor() protoreflect.EnumDescriptor {
+	return file_search_proto_enumTypes[0].Descriptor()
+}
+
+func (QueryFieldType) Type() protoreflect.EnumType {
+	return &file_search_proto_enumTypes[0]
+}
+
+func (x QueryFieldType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use QueryFieldType.Descriptor instead.
+func (QueryFieldType) EnumDescriptor() ([]byte, []int) {
+	return file_search_proto_rawDescGZIP(), []int{0}
+}
+
 // Get statistics across multiple resources
 // For these queries, we do not need authorization to see the actual values
 type ResourceStatsRequest struct {
@@ -165,10 +224,12 @@ type ResourceSearchRequest struct {
 	// the return fields (empty will return everything)
 	Fields []string `protobuf:"bytes,8,rep,name=fields,proto3" json:"fields,omitempty"`
 	// explain each result (added to the each row)
-	Explain       bool  `protobuf:"varint,9,opt,name=explain,proto3" json:"explain,omitempty"`
-	IsDeleted     bool  `protobuf:"varint,10,opt,name=is_deleted,json=isDeleted,proto3" json:"is_deleted,omitempty"`
-	Page          int64 `protobuf:"varint,11,opt,name=page,proto3" json:"page,omitempty"`
-	Permission    int64 `protobuf:"varint,12,opt,name=permission,proto3" json:"permission,omitempty"`
+	Explain    bool  `protobuf:"varint,9,opt,name=explain,proto3" json:"explain,omitempty"`
+	IsDeleted  bool  `protobuf:"varint,10,opt,name=is_deleted,json=isDeleted,proto3" json:"is_deleted,omitempty"`
+	Page       int64 `protobuf:"varint,11,opt,name=page,proto3" json:"page,omitempty"`
+	Permission int64 `protobuf:"varint,12,opt,name=permission,proto3" json:"permission,omitempty"`
+	// Optionally specify which fields are included in the query
+	QueryFields   []*ResourceSearchRequest_QueryField `protobuf:"bytes,13,rep,name=query_fields,json=queryFields,proto3" json:"query_fields,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -287,6 +348,13 @@ func (x *ResourceSearchRequest) GetPermission() int64 {
 	return 0
 }
 
+func (x *ResourceSearchRequest) GetQueryFields() []*ResourceSearchRequest_QueryField {
+	if x != nil {
+		return x.QueryFields
+	}
+	return nil
+}
+
 type ResourceSearchResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// Error details
@@ -670,6 +738,70 @@ func (x *ResourceSearchRequest_Facet) GetLimit() int64 {
 	return 0
 }
 
+// Defines the field in the index to query
+// Boost is optional, and allows weighting the field higher in the results
+type ResourceSearchRequest_QueryField struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The field name in the index to query
+	Name string         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Type QueryFieldType `protobuf:"varint,2,opt,name=type,proto3,enum=resource.QueryFieldType" json:"type,omitempty"`
+	// Boost value for this field
+	Boost         float32 `protobuf:"fixed32,3,opt,name=boost,proto3" json:"boost,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ResourceSearchRequest_QueryField) Reset() {
+	*x = ResourceSearchRequest_QueryField{}
+	mi := &file_search_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ResourceSearchRequest_QueryField) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResourceSearchRequest_QueryField) ProtoMessage() {}
+
+func (x *ResourceSearchRequest_QueryField) ProtoReflect() protoreflect.Message {
+	mi := &file_search_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResourceSearchRequest_QueryField.ProtoReflect.Descriptor instead.
+func (*ResourceSearchRequest_QueryField) Descriptor() ([]byte, []int) {
+	return file_search_proto_rawDescGZIP(), []int{2, 2}
+}
+
+func (x *ResourceSearchRequest_QueryField) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *ResourceSearchRequest_QueryField) GetType() QueryFieldType {
+	if x != nil {
+		return x.Type
+	}
+	return QueryFieldType_DEFAULT
+}
+
+func (x *ResourceSearchRequest_QueryField) GetBoost() float32 {
+	if x != nil {
+		return x.Boost
+	}
+	return 0
+}
+
 type ResourceSearchResponse_Facet struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	Field string                 `protobuf:"bytes,1,opt,name=field,proto3" json:"field,omitempty"`
@@ -685,7 +817,7 @@ type ResourceSearchResponse_Facet struct {
 
 func (x *ResourceSearchResponse_Facet) Reset() {
 	*x = ResourceSearchResponse_Facet{}
-	mi := &file_search_proto_msgTypes[10]
+	mi := &file_search_proto_msgTypes[11]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -697,7 +829,7 @@ func (x *ResourceSearchResponse_Facet) String() string {
 func (*ResourceSearchResponse_Facet) ProtoMessage() {}
 
 func (x *ResourceSearchResponse_Facet) ProtoReflect() protoreflect.Message {
-	mi := &file_search_proto_msgTypes[10]
+	mi := &file_search_proto_msgTypes[11]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -751,7 +883,7 @@ type ResourceSearchResponse_TermFacet struct {
 
 func (x *ResourceSearchResponse_TermFacet) Reset() {
 	*x = ResourceSearchResponse_TermFacet{}
-	mi := &file_search_proto_msgTypes[11]
+	mi := &file_search_proto_msgTypes[12]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -763,7 +895,7 @@ func (x *ResourceSearchResponse_TermFacet) String() string {
 func (*ResourceSearchResponse_TermFacet) ProtoMessage() {}
 
 func (x *ResourceSearchResponse_TermFacet) ProtoReflect() protoreflect.Message {
-	mi := &file_search_proto_msgTypes[11]
+	mi := &file_search_proto_msgTypes[12]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -818,7 +950,7 @@ var file_search_proto_rawDesc = string([]byte{
 	0x1a, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
 	0x09, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x63,
 	0x6f, 0x75, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x63, 0x6f, 0x75, 0x6e,
-	0x74, 0x22, 0x8e, 0x05, 0x0a, 0x15, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65,
+	0x74, 0x22, 0xc3, 0x06, 0x0a, 0x15, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65,
 	0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2f, 0x0a, 0x07, 0x6f,
 	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x72,
 	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x70, 0x74, 0x69,
@@ -846,93 +978,109 @@ var file_search_proto_rawDesc = string([]byte{
 	0x65, 0x6c, 0x65, 0x74, 0x65, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x67, 0x65, 0x18, 0x0b,
 	0x20, 0x01, 0x28, 0x03, 0x52, 0x04, 0x70, 0x61, 0x67, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x65,
 	0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a,
-	0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x1a, 0x30, 0x0a, 0x04, 0x53, 0x6f,
-	0x72, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x65, 0x73, 0x63,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x64, 0x65, 0x73, 0x63, 0x1a, 0x33, 0x0a, 0x05,
-	0x46, 0x61, 0x63, 0x65, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x6c,
-	0x69, 0x6d, 0x69, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x6c, 0x69, 0x6d, 0x69,
-	0x74, 0x1a, 0x5f, 0x0a, 0x0a, 0x46, 0x61, 0x63, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x12, 0x3b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x25, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f,
+	0x70, 0x65, 0x72, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x4d, 0x0a, 0x0c, 0x71, 0x75,
+	0x65, 0x72, 0x79, 0x5f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x2a, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f,
 	0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x2e, 0x46, 0x61, 0x63, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
-	0x38, 0x01, 0x22, 0xea, 0x04, 0x0a, 0x16, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53,
-	0x65, 0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x2b, 0x0a,
-	0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x72,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x73,
-	0x75, 0x6c, 0x74, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x27, 0x0a, 0x03, 0x6b, 0x65,
-	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
-	0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4b, 0x65, 0x79, 0x52, 0x03,
-	0x6b, 0x65, 0x79, 0x12, 0x31, 0x0a, 0x07, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x73, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x07, 0x72,
-	0x65, 0x73, 0x75, 0x6c, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f,
-	0x68, 0x69, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x74, 0x6f, 0x74, 0x61,
-	0x6c, 0x48, 0x69, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x71, 0x75, 0x65, 0x72, 0x79, 0x5f, 0x63,
-	0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x01, 0x52, 0x09, 0x71, 0x75, 0x65, 0x72, 0x79,
-	0x43, 0x6f, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x61, 0x78, 0x5f, 0x73, 0x63, 0x6f, 0x72,
-	0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x01, 0x52, 0x08, 0x6d, 0x61, 0x78, 0x53, 0x63, 0x6f, 0x72,
-	0x65, 0x12, 0x41, 0x0a, 0x05, 0x66, 0x61, 0x63, 0x65, 0x74, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x2b, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f,
+	0x74, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x52, 0x0b, 0x71, 0x75,
+	0x65, 0x72, 0x79, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x1a, 0x30, 0x0a, 0x04, 0x53, 0x6f, 0x72,
+	0x74, 0x12, 0x14, 0x0a, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x65, 0x73, 0x63, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x04, 0x64, 0x65, 0x73, 0x63, 0x1a, 0x33, 0x0a, 0x05, 0x46,
+	0x61, 0x63, 0x65, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x69,
+	0x6d, 0x69, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74,
+	0x1a, 0x64, 0x0a, 0x0a, 0x51, 0x75, 0x65, 0x72, 0x79, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x2c, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x18, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x51, 0x75, 0x65, 0x72,
+	0x79, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x62, 0x6f, 0x6f, 0x73, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x02, 0x52,
+	0x05, 0x62, 0x6f, 0x6f, 0x73, 0x74, 0x1a, 0x5f, 0x0a, 0x0a, 0x46, 0x61, 0x63, 0x65, 0x74, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x3b, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x46, 0x61, 0x63, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xea, 0x04, 0x0a, 0x16, 0x52, 0x65, 0x73, 0x6f,
 	0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x2e, 0x46, 0x61, 0x63, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x05, 0x66,
-	0x61, 0x63, 0x65, 0x74, 0x1a, 0x8f, 0x01, 0x0a, 0x05, 0x46, 0x61, 0x63, 0x65, 0x74, 0x12, 0x14,
-	0x0a, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x66,
-	0x69, 0x65, 0x6c, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x03, 0x52, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x69,
-	0x73, 0x73, 0x69, 0x6e, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x07, 0x6d, 0x69, 0x73,
-	0x73, 0x69, 0x6e, 0x67, 0x12, 0x40, 0x0a, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x18, 0x04, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x54, 0x65, 0x72, 0x6d, 0x46, 0x61, 0x63, 0x65, 0x74, 0x52,
-	0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x1a, 0x35, 0x0a, 0x09, 0x54, 0x65, 0x72, 0x6d, 0x46, 0x61,
-	0x63, 0x65, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x65, 0x72, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x74, 0x65, 0x72, 0x6d, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x1a, 0x60, 0x0a,
-	0x0a, 0x46, 0x61, 0x63, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x3c, 0x0a,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x72,
+	0x73, 0x65, 0x12, 0x2b, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x15, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x45, 0x72, 0x72,
+	0x6f, 0x72, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12,
+	0x27, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x72,
 	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x46,
-	0x61, 0x63, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22,
-	0x60, 0x0a, 0x15, 0x52, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65,
-	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65,
-	0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d,
-	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x29, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x02,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4b, 0x65, 0x79, 0x52, 0x04, 0x6b, 0x65, 0x79,
-	0x73, 0x22, 0x83, 0x01, 0x0a, 0x16, 0x52, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x49, 0x6e, 0x64,
-	0x65, 0x78, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x22, 0x0a, 0x0c,
-	0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x03, 0x52, 0x0c, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x43, 0x6f, 0x75, 0x6e, 0x74,
-	0x12, 0x18, 0x0a, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x12, 0x2b, 0x0a, 0x05, 0x65, 0x72,
-	0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x72, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74,
-	0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x32, 0xfe, 0x01, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x12, 0x4b, 0x0a, 0x06, 0x53, 0x65, 0x61,
-	0x72, 0x63, 0x68, 0x12, 0x1f, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52,
-	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e,
-	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4b, 0x0a, 0x08, 0x47, 0x65, 0x74, 0x53, 0x74, 0x61,
-	0x74, 0x73, 0x12, 0x1e, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x53, 0x0a, 0x0e, 0x52, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x49, 0x6e,
-	0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x1f, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
-	0x2e, 0x52, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x2e, 0x52, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72, 0x61, 0x66, 0x61, 0x6e, 0x61, 0x2f, 0x67,
-	0x72, 0x61, 0x66, 0x61, 0x6e, 0x61, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61,
-	0x67, 0x65, 0x2f, 0x75, 0x6e, 0x69, 0x66, 0x69, 0x65, 0x64, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x4b, 0x65, 0x79, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x31, 0x0a, 0x07, 0x72, 0x65, 0x73, 0x75,
+	0x6c, 0x74, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54, 0x61, 0x62,
+	0x6c, 0x65, 0x52, 0x07, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x74,
+	0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x68, 0x69, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x09, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x48, 0x69, 0x74, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x71, 0x75,
+	0x65, 0x72, 0x79, 0x5f, 0x63, 0x6f, 0x73, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x01, 0x52, 0x09,
+	0x71, 0x75, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x73, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x61, 0x78,
+	0x5f, 0x73, 0x63, 0x6f, 0x72, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x01, 0x52, 0x08, 0x6d, 0x61,
+	0x78, 0x53, 0x63, 0x6f, 0x72, 0x65, 0x12, 0x41, 0x0a, 0x05, 0x66, 0x61, 0x63, 0x65, 0x74, 0x18,
+	0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x46, 0x61, 0x63, 0x65, 0x74, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x52, 0x05, 0x66, 0x61, 0x63, 0x65, 0x74, 0x1a, 0x8f, 0x01, 0x0a, 0x05, 0x46, 0x61,
+	0x63, 0x65, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x74,
+	0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x12,
+	0x18, 0x0a, 0x07, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6e, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x07, 0x6d, 0x69, 0x73, 0x73, 0x69, 0x6e, 0x67, 0x12, 0x40, 0x0a, 0x05, 0x74, 0x65, 0x72,
+	0x6d, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x61, 0x72,
+	0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x54, 0x65, 0x72, 0x6d, 0x46,
+	0x61, 0x63, 0x65, 0x74, 0x52, 0x05, 0x74, 0x65, 0x72, 0x6d, 0x73, 0x1a, 0x35, 0x0a, 0x09, 0x54,
+	0x65, 0x72, 0x6d, 0x46, 0x61, 0x63, 0x65, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x65, 0x72, 0x6d,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x65, 0x72, 0x6d, 0x12, 0x14, 0x0a, 0x05,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x63, 0x6f, 0x75,
+	0x6e, 0x74, 0x1a, 0x60, 0x0a, 0x0a, 0x46, 0x61, 0x63, 0x65, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x3c, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x26, 0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x2e, 0x46, 0x61, 0x63, 0x65, 0x74, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x3a, 0x02, 0x38, 0x01, 0x22, 0x60, 0x0a, 0x15, 0x52, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x49,
+	0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x1c, 0x0a,
+	0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x29, 0x0a, 0x04, 0x6b,
+	0x65, 0x79, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4b, 0x65, 0x79,
+	0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x22, 0x83, 0x01, 0x0a, 0x16, 0x52, 0x65, 0x62, 0x75, 0x69,
+	0x6c, 0x64, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x22, 0x0a, 0x0c, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x43, 0x6f, 0x75, 0x6e,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64,
+	0x43, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x64, 0x65, 0x74, 0x61, 0x69, 0x6c, 0x73, 0x12,
+	0x2b, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15,
+	0x2e, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x52,
+	0x65, 0x73, 0x75, 0x6c, 0x74, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x2a, 0x40, 0x0a, 0x0e,
+	0x51, 0x75, 0x65, 0x72, 0x79, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b,
+	0x0a, 0x07, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x54,
+	0x45, 0x58, 0x54, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x4b, 0x45, 0x59, 0x57, 0x4f, 0x52, 0x44,
+	0x10, 0x02, 0x12, 0x0a, 0x0a, 0x06, 0x50, 0x48, 0x52, 0x41, 0x53, 0x45, 0x10, 0x03, 0x32, 0xfe,
+	0x01, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x49, 0x6e, 0x64, 0x65, 0x78,
+	0x12, 0x4b, 0x0a, 0x06, 0x53, 0x65, 0x61, 0x72, 0x63, 0x68, 0x12, 0x1f, 0x2e, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x65,
+	0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53,
+	0x65, 0x61, 0x72, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4b, 0x0a,
+	0x08, 0x47, 0x65, 0x74, 0x53, 0x74, 0x61, 0x74, 0x73, 0x12, 0x1e, 0x2e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61,
+	0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x53, 0x74, 0x61,
+	0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x53, 0x0a, 0x0e, 0x52, 0x65,
+	0x62, 0x75, 0x69, 0x6c, 0x64, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x12, 0x1f, 0x2e, 0x72,
+	0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x49,
+	0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x64,
+	0x49, 0x6e, 0x64, 0x65, 0x78, 0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42,
+	0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x72,
+	0x61, 0x66, 0x61, 0x6e, 0x61, 0x2f, 0x67, 0x72, 0x61, 0x66, 0x61, 0x6e, 0x61, 0x2f, 0x70, 0x6b,
+	0x67, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x75, 0x6e, 0x69, 0x66, 0x69, 0x65,
+	0x64, 0x2f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 })
 
 var (
@@ -947,53 +1095,58 @@ func file_search_proto_rawDescGZIP() []byte {
 	return file_search_proto_rawDescData
 }
 
-var file_search_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
+var file_search_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_search_proto_msgTypes = make([]protoimpl.MessageInfo, 14)
 var file_search_proto_goTypes = []any{
-	(*ResourceStatsRequest)(nil),             // 0: resource.ResourceStatsRequest
-	(*ResourceStatsResponse)(nil),            // 1: resource.ResourceStatsResponse
-	(*ResourceSearchRequest)(nil),            // 2: resource.ResourceSearchRequest
-	(*ResourceSearchResponse)(nil),           // 3: resource.ResourceSearchResponse
-	(*RebuildIndexesRequest)(nil),            // 4: resource.RebuildIndexesRequest
-	(*RebuildIndexesResponse)(nil),           // 5: resource.RebuildIndexesResponse
-	(*ResourceStatsResponse_Stats)(nil),      // 6: resource.ResourceStatsResponse.Stats
-	(*ResourceSearchRequest_Sort)(nil),       // 7: resource.ResourceSearchRequest.Sort
-	(*ResourceSearchRequest_Facet)(nil),      // 8: resource.ResourceSearchRequest.Facet
-	nil,                                      // 9: resource.ResourceSearchRequest.FacetEntry
-	(*ResourceSearchResponse_Facet)(nil),     // 10: resource.ResourceSearchResponse.Facet
-	(*ResourceSearchResponse_TermFacet)(nil), // 11: resource.ResourceSearchResponse.TermFacet
-	nil,                                      // 12: resource.ResourceSearchResponse.FacetEntry
-	(*ErrorResult)(nil),                      // 13: resource.ErrorResult
-	(*ListOptions)(nil),                      // 14: resource.ListOptions
-	(*ResourceKey)(nil),                      // 15: resource.ResourceKey
-	(*ResourceTable)(nil),                    // 16: resource.ResourceTable
+	(QueryFieldType)(0),                      // 0: resource.QueryFieldType
+	(*ResourceStatsRequest)(nil),             // 1: resource.ResourceStatsRequest
+	(*ResourceStatsResponse)(nil),            // 2: resource.ResourceStatsResponse
+	(*ResourceSearchRequest)(nil),            // 3: resource.ResourceSearchRequest
+	(*ResourceSearchResponse)(nil),           // 4: resource.ResourceSearchResponse
+	(*RebuildIndexesRequest)(nil),            // 5: resource.RebuildIndexesRequest
+	(*RebuildIndexesResponse)(nil),           // 6: resource.RebuildIndexesResponse
+	(*ResourceStatsResponse_Stats)(nil),      // 7: resource.ResourceStatsResponse.Stats
+	(*ResourceSearchRequest_Sort)(nil),       // 8: resource.ResourceSearchRequest.Sort
+	(*ResourceSearchRequest_Facet)(nil),      // 9: resource.ResourceSearchRequest.Facet
+	(*ResourceSearchRequest_QueryField)(nil), // 10: resource.ResourceSearchRequest.QueryField
+	nil,                                      // 11: resource.ResourceSearchRequest.FacetEntry
+	(*ResourceSearchResponse_Facet)(nil),     // 12: resource.ResourceSearchResponse.Facet
+	(*ResourceSearchResponse_TermFacet)(nil), // 13: resource.ResourceSearchResponse.TermFacet
+	nil,                                      // 14: resource.ResourceSearchResponse.FacetEntry
+	(*ErrorResult)(nil),                      // 15: resource.ErrorResult
+	(*ListOptions)(nil),                      // 16: resource.ListOptions
+	(*ResourceKey)(nil),                      // 17: resource.ResourceKey
+	(*ResourceTable)(nil),                    // 18: resource.ResourceTable
 }
 var file_search_proto_depIdxs = []int32{
-	13, // 0: resource.ResourceStatsResponse.error:type_name -> resource.ErrorResult
-	6,  // 1: resource.ResourceStatsResponse.stats:type_name -> resource.ResourceStatsResponse.Stats
-	14, // 2: resource.ResourceSearchRequest.options:type_name -> resource.ListOptions
-	15, // 3: resource.ResourceSearchRequest.federated:type_name -> resource.ResourceKey
-	7,  // 4: resource.ResourceSearchRequest.sortBy:type_name -> resource.ResourceSearchRequest.Sort
-	9,  // 5: resource.ResourceSearchRequest.facet:type_name -> resource.ResourceSearchRequest.FacetEntry
-	13, // 6: resource.ResourceSearchResponse.error:type_name -> resource.ErrorResult
-	15, // 7: resource.ResourceSearchResponse.key:type_name -> resource.ResourceKey
-	16, // 8: resource.ResourceSearchResponse.results:type_name -> resource.ResourceTable
-	12, // 9: resource.ResourceSearchResponse.facet:type_name -> resource.ResourceSearchResponse.FacetEntry
-	15, // 10: resource.RebuildIndexesRequest.keys:type_name -> resource.ResourceKey
-	13, // 11: resource.RebuildIndexesResponse.error:type_name -> resource.ErrorResult
-	8,  // 12: resource.ResourceSearchRequest.FacetEntry.value:type_name -> resource.ResourceSearchRequest.Facet
-	11, // 13: resource.ResourceSearchResponse.Facet.terms:type_name -> resource.ResourceSearchResponse.TermFacet
-	10, // 14: resource.ResourceSearchResponse.FacetEntry.value:type_name -> resource.ResourceSearchResponse.Facet
-	2,  // 15: resource.ResourceIndex.Search:input_type -> resource.ResourceSearchRequest
-	0,  // 16: resource.ResourceIndex.GetStats:input_type -> resource.ResourceStatsRequest
-	4,  // 17: resource.ResourceIndex.RebuildIndexes:input_type -> resource.RebuildIndexesRequest
-	3,  // 18: resource.ResourceIndex.Search:output_type -> resource.ResourceSearchResponse
-	1,  // 19: resource.ResourceIndex.GetStats:output_type -> resource.ResourceStatsResponse
-	5,  // 20: resource.ResourceIndex.RebuildIndexes:output_type -> resource.RebuildIndexesResponse
-	18, // [18:21] is the sub-list for method output_type
-	15, // [15:18] is the sub-list for method input_type
-	15, // [15:15] is the sub-list for extension type_name
-	15, // [15:15] is the sub-list for extension extendee
-	0,  // [0:15] is the sub-list for field type_name
+	15, // 0: resource.ResourceStatsResponse.error:type_name -> resource.ErrorResult
+	7,  // 1: resource.ResourceStatsResponse.stats:type_name -> resource.ResourceStatsResponse.Stats
+	16, // 2: resource.ResourceSearchRequest.options:type_name -> resource.ListOptions
+	17, // 3: resource.ResourceSearchRequest.federated:type_name -> resource.ResourceKey
+	8,  // 4: resource.ResourceSearchRequest.sortBy:type_name -> resource.ResourceSearchRequest.Sort
+	11, // 5: resource.ResourceSearchRequest.facet:type_name -> resource.ResourceSearchRequest.FacetEntry
+	10, // 6: resource.ResourceSearchRequest.query_fields:type_name -> resource.ResourceSearchRequest.QueryField
+	15, // 7: resource.ResourceSearchResponse.error:type_name -> resource.ErrorResult
+	17, // 8: resource.ResourceSearchResponse.key:type_name -> resource.ResourceKey
+	18, // 9: resource.ResourceSearchResponse.results:type_name -> resource.ResourceTable
+	14, // 10: resource.ResourceSearchResponse.facet:type_name -> resource.ResourceSearchResponse.FacetEntry
+	17, // 11: resource.RebuildIndexesRequest.keys:type_name -> resource.ResourceKey
+	15, // 12: resource.RebuildIndexesResponse.error:type_name -> resource.ErrorResult
+	0,  // 13: resource.ResourceSearchRequest.QueryField.type:type_name -> resource.QueryFieldType
+	9,  // 14: resource.ResourceSearchRequest.FacetEntry.value:type_name -> resource.ResourceSearchRequest.Facet
+	13, // 15: resource.ResourceSearchResponse.Facet.terms:type_name -> resource.ResourceSearchResponse.TermFacet
+	12, // 16: resource.ResourceSearchResponse.FacetEntry.value:type_name -> resource.ResourceSearchResponse.Facet
+	3,  // 17: resource.ResourceIndex.Search:input_type -> resource.ResourceSearchRequest
+	1,  // 18: resource.ResourceIndex.GetStats:input_type -> resource.ResourceStatsRequest
+	5,  // 19: resource.ResourceIndex.RebuildIndexes:input_type -> resource.RebuildIndexesRequest
+	4,  // 20: resource.ResourceIndex.Search:output_type -> resource.ResourceSearchResponse
+	2,  // 21: resource.ResourceIndex.GetStats:output_type -> resource.ResourceStatsResponse
+	6,  // 22: resource.ResourceIndex.RebuildIndexes:output_type -> resource.RebuildIndexesResponse
+	20, // [20:23] is the sub-list for method output_type
+	17, // [17:20] is the sub-list for method input_type
+	17, // [17:17] is the sub-list for extension type_name
+	17, // [17:17] is the sub-list for extension extendee
+	0,  // [0:17] is the sub-list for field type_name
 }
 
 func init() { file_search_proto_init() }
@@ -1007,13 +1160,14 @@ func file_search_proto_init() {
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_search_proto_rawDesc), len(file_search_proto_rawDesc)),
-			NumEnums:      0,
-			NumMessages:   13,
+			NumEnums:      1,
+			NumMessages:   14,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
 		GoTypes:           file_search_proto_goTypes,
 		DependencyIndexes: file_search_proto_depIdxs,
+		EnumInfos:         file_search_proto_enumTypes,
 		MessageInfos:      file_search_proto_msgTypes,
 	}.Build()
 	File_search_proto = out.File

pkg/storage/unified/resourcepb/search_grpc.pb.go

@@ -31,9 +31,11 @@ const (
 // Unlike the ResourceStore, this service can be exposed to clients directly
 // It should be implemented with efficient indexes and does not need read-after-write semantics
 type ResourceIndexClient interface {
+	// Query for documents
 	Search(ctx context.Context, in *ResourceSearchRequest, opts ...grpc.CallOption) (*ResourceSearchResponse, error)
 	// Get the resource stats
 	GetStats(ctx context.Context, in *ResourceStatsRequest, opts ...grpc.CallOption) (*ResourceStatsResponse, error)
+	// Rebuild the search index
 	RebuildIndexes(ctx context.Context, in *RebuildIndexesRequest, opts ...grpc.CallOption) (*RebuildIndexesResponse, error)
 }
 
@@ -82,9 +84,11 @@ func (c *resourceIndexClient) RebuildIndexes(ctx context.Context, in *RebuildInd
 // Unlike the ResourceStore, this service can be exposed to clients directly
 // It should be implemented with efficient indexes and does not need read-after-write semantics
 type ResourceIndexServer interface {
+	// Query for documents
 	Search(context.Context, *ResourceSearchRequest) (*ResourceSearchResponse, error)
 	// Get the resource stats
 	GetStats(context.Context, *ResourceStatsRequest) (*ResourceStatsResponse, error)
+	// Rebuild the search index
 	RebuildIndexes(context.Context, *RebuildIndexesRequest) (*RebuildIndexesResponse, error)
 }
 

pkg/storage/unified/search/bleve.go

@@ -81,6 +81,11 @@ type BleveOptions struct {
 	// Indexes that are not owned by current instance are eligible for cleanup.
 	// If nil, all indexes are owned by the current instance.
 	OwnsIndex func(key resource.NamespacedResource) (bool, error)
+
+	// ScoringModel defines the scoring model used for the bleve indexes
+	// Default: index.TFIDFScoring
+	// Supported values: index.TFIDFScoring and index.BM25Scoring
+	ScoringModel string
 }
 
 type bleveBackend struct {
@@ -368,7 +373,7 @@ func (b *bleveBackend) BuildIndex(
 		attribute.String("reason", indexBuildReason),
 	)
 
-	mapper, err := GetBleveMappings(fields)
+	mapper, err := GetBleveMappings(b.opts.ScoringModel, fields)
 	if err != nil {
 		return nil, err
 	}
@@ -1177,6 +1182,7 @@ func (b *bleveIndex) getIndex(
 	return b.index, nil
 }
 
+// nolint:gocyclo
 func (b *bleveIndex) toBleveSearchRequest(ctx context.Context, req *resourcepb.ResourceSearchRequest, access authlib.AccessClient) (*bleve.SearchRequest, *resourcepb.ErrorResult) {
 	ctx, span := tracer.Start(ctx, "search.bleveIndex.toBleveSearchRequest")
 	defer span.End()
@@ -1235,42 +1241,62 @@ func (b *bleveIndex) toBleveSearchRequest(ctx context.Context, req *resourcepb.R
 		}
 	}
 
-	if len(req.Query) > 1 && strings.Contains(req.Query, "*") {
-		// wildcard query is expensive - should be used with caution
-		wildcard := bleve.NewWildcardQuery(req.Query)
-		queries = append(queries, wildcard)
-	}
+	if len(req.Query) > 1 {
+		if strings.Contains(req.Query, "*") {
+			// wildcard query is expensive - should be used with caution
+			wildcard := bleve.NewWildcardQuery(req.Query)
+			queries = append(queries, wildcard)
+		} else {
+			// When using a
+			searchrequest.Fields = append(searchrequest.Fields, resource.SEARCH_FIELD_SCORE)
+			disjoin := bleve.NewDisjunctionQuery()
+			queries = append(queries, disjoin)
 
-	if req.Query != "" && !strings.Contains(req.Query, "*") {
-		// Add a text query
-		searchrequest.Fields = append(searchrequest.Fields, resource.SEARCH_FIELD_SCORE)
+			queryFields := req.QueryFields
+			if len(queryFields) == 0 {
+				queryFields = []*resourcepb.ResourceSearchRequest_QueryField{
+					{
+						Name:  resource.SEARCH_FIELD_TITLE,
+						Type:  resourcepb.QueryFieldType_KEYWORD,
+						Boost: 10, // exact match -- includes ngrams! If they lived on their own field, we could score them differently
+					}, {
+						Name:  resource.SEARCH_FIELD_TITLE,
+						Type:  resourcepb.QueryFieldType_TEXT,
+						Boost: 2, // standard analyzer (with ngrams!)
+					}, {
+						Name:  resource.SEARCH_FIELD_TITLE_PHRASE,
+						Type:  resourcepb.QueryFieldType_TEXT,
+						Boost: 5, // standard analyzer
+					},
+				}
+			}
 
-		// There are multiple ways to match the query string to documents. The following queries are ordered by priority:
+			for _, field := range queryFields {
+				switch field.Type {
+				case resourcepb.QueryFieldType_TEXT, resourcepb.QueryFieldType_DEFAULT:
+					q := bleve.NewMatchQuery(removeSmallTerms(req.Query)) // removeSmallTerms should be part of the analyzer
+					q.SetBoost(float64(field.Boost))
+					q.SetField(field.Name)
+					q.Analyzer = standard.Name               // analyze the text
+					q.Operator = query.MatchQueryOperatorAnd // all terms must match
+					disjoin.AddQuery(q)
 
-		// Query 1: Match the exact query string
-		queryExact := bleve.NewMatchQuery(req.Query)
-		queryExact.SetBoost(10.0)
-		queryExact.SetField(resource.SEARCH_FIELD_TITLE)
-		queryExact.Analyzer = keyword.Name                // don't analyze the query input - treat it as a single token
-		queryExact.Operator = query.MatchQueryOperatorAnd // This doesn't make a difference for keyword analyzer, we add it just to be explicit.
-		searchQuery := bleve.NewDisjunctionQuery(queryExact)
+				case resourcepb.QueryFieldType_KEYWORD:
+					q := bleve.NewMatchQuery(req.Query)
+					q.SetBoost(float64(field.Boost))
+					q.SetField(field.Name)
+					q.Analyzer = keyword.Name // don't analyze the query input - treat it as a single token
+					disjoin.AddQuery(q)
 
-		// Query 2: Phrase query with standard analyzer
-		queryPhrase := bleve.NewMatchPhraseQuery(req.Query)
-		queryPhrase.SetBoost(5.0)
-		queryPhrase.SetField(resource.SEARCH_FIELD_TITLE)
-		queryPhrase.Analyzer = standard.Name
-		searchQuery.AddQuery(queryPhrase)
-
-		// Query 3: Match query with standard analyzer
-		queryAnalyzed := bleve.NewMatchQuery(removeSmallTerms(req.Query))
-		queryAnalyzed.SetField(resource.SEARCH_FIELD_TITLE)
-		queryAnalyzed.SetBoost(2.0)
-		queryAnalyzed.Analyzer = standard.Name
-		queryAnalyzed.Operator = query.MatchQueryOperatorAnd // Make sure all terms from the query are matched
-		searchQuery.AddQuery(queryAnalyzed)
-
-		queries = append(queries, searchQuery)
+				case resourcepb.QueryFieldType_PHRASE:
+					q := bleve.NewMatchPhraseQuery(req.Query)
+					q.SetBoost(float64(field.Boost))
+					q.SetField(field.Name)
+					q.Analyzer = standard.Name
+					disjoin.AddQuery(q)
+				}
+			}
+		}
 	}
 
 	switch len(queries) {

pkg/storage/unified/search/bleve_integration_test.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"testing"
 
+	index "github.com/blevesearch/bleve_index_api"
 	"github.com/stretchr/testify/require"
 
 	"github.com/grafana/grafana/pkg/storage/unified/resource"
@@ -19,6 +20,7 @@ func TestBleveSearchBackend(t *testing.T) {
 		backend, err := NewBleveBackend(BleveOptions{
 			Root:          tempDir,
 			FileThreshold: 5,
+			ScoringModel:  index.BM25Scoring,
 		}, nil)
 		require.NoError(t, err)
 		require.NotNil(t, backend)
@@ -52,3 +54,32 @@ func TestSearchBackendBenchmark(t *testing.T) {
 
 	unitest.BenchmarkSearchBackend(t, backend, opts)
 }
+
+func BenchmarkScoringModels(b *testing.B) {
+	models := []string{index.TFIDFScoring, index.BM25Scoring}
+
+	for _, model := range models {
+		b.Run(model, func(b *testing.B) {
+			tempDir := b.TempDir()
+
+			backend, err := NewBleveBackend(BleveOptions{
+				Root:         tempDir,
+				ScoringModel: model,
+			}, nil)
+			require.NoError(b, err)
+			require.NotNil(b, backend)
+
+			b.Cleanup(backend.Stop)
+
+			opts := &unitest.BenchmarkOptions{
+				NumResources:     1000,
+				Concurrency:      4,
+				NumNamespaces:    10,
+				NumGroups:        10,
+				NumResourceTypes: 10,
+			}
+
+			unitest.BenchmarkSearchBackend(b, backend, opts)
+		})
+	}
+}

pkg/storage/unified/search/bleve_mappings.go

@@ -5,13 +5,15 @@ import (
 	"github.com/blevesearch/bleve/v2/analysis/analyzer/keyword"
 	"github.com/blevesearch/bleve/v2/analysis/analyzer/standard"
 	"github.com/blevesearch/bleve/v2/mapping"
-
 	"github.com/grafana/grafana/pkg/storage/unified/resource"
 	"github.com/grafana/grafana/pkg/storage/unified/resourcepb"
 )
 
-func GetBleveMappings(fields resource.SearchableDocumentFields) (mapping.IndexMapping, error) {
+func GetBleveMappings(scoringModel string, fields resource.SearchableDocumentFields) (mapping.IndexMapping, error) {
 	mapper := bleve.NewIndexMapping()
+	if scoringModel != "" {
+		mapper.ScoringModel = scoringModel
+	}
 
 	err := RegisterCustomAnalyzers(mapper)
 	if err != nil {

pkg/storage/unified/search/bleve_mappings_test.go

@@ -13,7 +13,7 @@ import (
 )
 
 func TestDocumentMapping(t *testing.T) {
-	mappings, err := search.GetBleveMappings(nil)
+	mappings, err := search.GetBleveMappings("", nil)
 	require.NoError(t, err)
 	data := resource.IndexableDocument{
 		Title:       "title",

pkg/storage/unified/search/bleve_search_test.go

@@ -7,6 +7,7 @@ import (
 	"testing"
 
 	"github.com/blevesearch/bleve/v2"
+	index "github.com/blevesearch/bleve_index_api"
 	"github.com/stretchr/testify/require"
 
 	"github.com/grafana/grafana/pkg/apimachinery/identity"
@@ -258,6 +259,7 @@ func newTestDashboardsIndex(t testing.TB, threshold int64, size int64, writer re
 	backend, err := search.NewBleveBackend(search.BleveOptions{
 		Root:          t.TempDir(),
 		FileThreshold: threshold, // use in-memory for tests
+		ScoringModel:  index.BM25Scoring,
 	}, nil)
 	require.NoError(t, err)
 

pkg/storage/unified/search/bleve_test.go

@@ -14,6 +14,7 @@ import (
 	"time"
 
 	"github.com/blevesearch/bleve/v2"
+	index "github.com/blevesearch/bleve_index_api"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/prometheus/client_golang/prometheus/testutil"
 	"github.com/stretchr/testify/assert"
@@ -50,6 +51,7 @@ func TestBleveBackend(t *testing.T) {
 	backend, err := NewBleveBackend(BleveOptions{
 		Root:          tmpdir,
 		FileThreshold: 5, // with more than 5 items we create a file on disk
+		ScoringModel:  index.BM25Scoring,
 	}, nil)
 	require.NoError(t, err)
 	t.Cleanup(backend.Stop)
@@ -773,6 +775,7 @@ func setupBleveBackend(t *testing.T, options ...setupOption) (*bleveBackend, pro
 		IndexCacheTTL: defaultIndexCacheTTL,
 		Logger:        log.NewNopLogger(),
 		BuildVersion:  buildVersion,
+		ScoringModel:  index.BM25Scoring,
 	}
 	for _, opt := range options {
 		opt(&opts)

pkg/storage/unified/search/options.go

@@ -46,6 +46,7 @@ func NewSearchOptions(
 			BuildVersion:           cfg.BuildVersion,
 			OwnsIndex:              ownsIndexFn,
 			IndexMinUpdateInterval: cfg.IndexMinUpdateInterval,
+			ScoringModel:           cfg.IndexScoringModel,
 		}, indexMetrics)
 
 		if err != nil {

pkg/storage/unified/sql/test/integration_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 	"time"
 
+	index "github.com/blevesearch/bleve_index_api"
 	"github.com/go-jose/go-jose/v4/jwt"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/require"
@@ -129,21 +130,28 @@ func TestIntegrationSearchAndStorage(t *testing.T) {
 
 	ctx := context.Background()
 
-	// Create a new bleve backend
-	search, err := search.NewBleveBackend(search.BleveOptions{
-		FileThreshold: 0,
-		Root:          t.TempDir(),
-	}, nil)
-	require.NoError(t, err)
-	require.NotNil(t, search)
-	t.Cleanup(search.Stop)
+	scoringModels := []string{index.TFIDFScoring, index.BM25Scoring}
 
-	// Create a new resource backend
-	storage, _ := newTestBackend(t, false, 0)
-	require.NotNil(t, storage)
+	for _, model := range scoringModels {
+		t.Run(model, func(t *testing.T) {
+			// Create a new bleve backend
+			search, err := search.NewBleveBackend(search.BleveOptions{
+				FileThreshold: 0,
+				Root:          t.TempDir(),
+				ScoringModel:  model,
+			}, nil)
+			require.NoError(t, err)
+			require.NotNil(t, search)
+			t.Cleanup(search.Stop)
 
-	// Run the shared storage and search tests
-	unitest.RunTestSearchAndStorage(t, ctx, storage, search)
+			// Create a new resource backend
+			storage, _ := newTestBackend(t, false, 0)
+			require.NotNil(t, storage)
+
+			// Run the shared storage and search tests
+			unitest.RunTestSearchAndStorage(t, ctx, storage, search)
+		})
+	}
 }
 
 func TestClientServer(t *testing.T) {

pkg/tests/api/plugins/data/expectedListResp.json

@@ -209,7 +209,7 @@
           "path": "public/plugins/grafana-azure-monitor-datasource/img/azure_monitor_cpu.png"
         }
       ],
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": [
         "azure",
@@ -589,7 +589,7 @@
     "hasUpdate": false,
     "defaultNavUrl": "/plugins/datagrid/",
     "category": "",
-    "state": "beta",
+    "state": "deprecated",
     "signature": "internal",
     "signatureType": "",
     "signatureOrg": "",
@@ -880,7 +880,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -934,7 +934,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": [
         "grafana",
@@ -1000,7 +1000,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -1217,7 +1217,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -1325,7 +1325,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -1375,7 +1375,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -1425,7 +1425,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -1575,7 +1575,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -1629,7 +1629,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": [
         "grafana",
@@ -1734,7 +1734,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -2042,7 +2042,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -2092,7 +2092,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },
@@ -2445,7 +2445,7 @@
       },
       "build": {},
       "screenshots": null,
-      "version": "12.3.0-pre",
+      "version": "12.4.0-pre",
       "updated": "",
       "keywords": null
     },

pkg/tests/apis/dashboard/search_test.go

@@ -97,7 +97,7 @@ func TestIntegrationSearchDevDashboards(t *testing.T) {
 	require.Equal(t, 16, fileCount, "file count from %s", devenv)
 
 	// Helper to call search
-	callSearch := func(user apis.User, params string) dashboardV0.SearchResults {
+	callSearch := func(user apis.User, params map[string]string) dashboardV0.SearchResults {
 		require.NotNil(t, user)
 		ns := user.Identity.GetNamespace()
 		cfg := dynamic.ConfigFor(user.NewRestConfig())
@@ -107,17 +107,12 @@ func TestIntegrationSearchDevDashboards(t *testing.T) {
 
 		var statusCode int
 		req := restClient.Get().AbsPath("apis", "dashboard.grafana.app", "v0alpha1", "namespaces", ns, "search").
+			//Param("explain", "true") // helpful to understand which field made things match
 			Param("limit", "1000").
 			Param("type", "dashboard") // Only search dashboards
 
-		for kv := range strings.SplitSeq(params, "&") {
-			if kv == "" {
-				continue
-			}
-			parts := strings.SplitN(kv, "=", 2)
-			if len(parts) == 2 {
-				req = req.Param(parts[0], parts[1])
-			}
+		for k, v := range params {
+			req = req.Param(k, v)
 		}
 		res := req.Do(ctx).StatusCode(&statusCode)
 		require.NoError(t, res.Error())
@@ -140,22 +135,47 @@ func TestIntegrationSearchDevDashboards(t *testing.T) {
 	testCases := []struct {
 		name   string
 		user   apis.User
-		params string
+		params map[string]string
 	}{
 		{
-			name:   "all",
-			user:   helper.Org1.Admin,
-			params: "", // only dashboards
+			name: "all",
+			user: helper.Org1.Admin,
 		},
 		{
-			name:   "simple-query",
-			user:   helper.Org1.Admin,
-			params: "query=stacking",
+			name: "query-single-word",
+			user: helper.Org1.Admin,
+			params: map[string]string{
+				"query": "stacking",
+			},
 		},
 		{
-			name:   "with-text-panel",
-			user:   helper.Org1.Admin,
-			params: "field=panel_types&panelType=text",
+			name: "query-multiple-words",
+			user: helper.Org1.Admin,
+			params: map[string]string{
+				"query": "graph softMin", // must match ALL terms
+			},
+		},
+		{
+			name: "with-text-panel",
+			user: helper.Org1.Admin,
+			params: map[string]string{
+				"field":     "panel_types", // return panel types
+				"panelType": "text",
+			},
+		},
+		{
+			name: "title-ngram-prefix",
+			user: helper.Org1.Admin,
+			params: map[string]string{
+				"query": "zer", // should match "Zero Decimals Y Ticks"
+			},
+		},
+		{
+			name: "title-ngram-middle-word",
+			user: helper.Org1.Admin,
+			params: map[string]string{
+				"query": "decim", // should match "Zero Decimals Y Ticks"
+			},
 		},
 	}
 	for i, tc := range testCases {

pkg/tests/apis/dashboard/testdata/searchV0/t01-query-single-word.json

@@ -10,7 +10,7 @@
         "panel-tests",
         "graph-ng"
       ],
-      "score": 0.658
+      "score": 0.284
     },
     {
       "resource": "dashboards",
@@ -21,8 +21,8 @@
         "panel-tests",
         "graph-ng"
       ],
-      "score": 0.625
+      "score": 0.269
     }
   ],
-  "maxScore": 0.658
+  "maxScore": 0.284
 }

pkg/tests/apis/dashboard/testdata/searchV0/t02-query-multiple-words.json

@@ -0,0 +1,17 @@
+{
+  "totalHits": 1,
+  "hits": [
+    {
+      "resource": "dashboards",
+      "name": "timeseries-soft-limits",
+      "title": "Panel Tests - Graph NG - softMin/softMax",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ],
+      "score": 0.024
+    }
+  ],
+  "maxScore": 0.024
+}

pkg/tests/apis/dashboard/testdata/searchV0/t04-title-ngram-prefix.json

@@ -0,0 +1,17 @@
+{
+  "totalHits": 1,
+  "hits": [
+    {
+      "resource": "dashboards",
+      "name": "timeseries-y-ticks-zero-decimals",
+      "title": "Zero Decimals Y Ticks",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ],
+      "score": 0.35
+    }
+  ],
+  "maxScore": 0.35
+}

pkg/tests/apis/dashboard/testdata/searchV0/t05-title-ngram-middle-word.json

@@ -0,0 +1,17 @@
+{
+  "totalHits": 1,
+  "hits": [
+    {
+      "resource": "dashboards",
+      "name": "timeseries-y-ticks-zero-decimals",
+      "title": "Zero Decimals Y Ticks",
+      "tags": [
+        "gdev",
+        "panel-tests",
+        "graph-ng"
+      ],
+      "score": 0.35
+    }
+  ],
+  "maxScore": 0.35
+}

pkg/tests/apis/openapi_snapshots/iam.grafana.app-v0alpha1.json

@@ -912,6 +912,139 @@
         }
       ]
     },
+    "/apis/iam.grafana.app/v0alpha1/namespaces/{namespace}/searchExternalGroupMappings": {
+      "post": {
+        "tags": [
+          "Search"
+        ],
+        "description": "External Group Mapping search",
+        "operationId": "searchExternalGroupMappings",
+        "parameters": [
+          {
+            "name": "namespace",
+            "in": "path",
+            "description": "workspace",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "example": "default"
+          },
+          {
+            "name": "teamName",
+            "in": "query",
+            "description": "Team name",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "description": "number of results to return",
+            "schema": {
+              "type": "integer",
+              "format": "int64"
+            },
+            "example": 30
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "description": "page number (starting from 1)",
+            "schema": {
+              "type": "integer",
+              "format": "int64"
+            },
+            "example": 1
+          },
+          {
+            "name": "offset",
+            "in": "query",
+            "description": "number of results to skip",
+            "schema": {
+              "type": "integer",
+              "format": "int64"
+            },
+            "example": 0
+          },
+          {
+            "name": "sort",
+            "in": "query",
+            "description": "sortable field",
+            "schema": {
+              "type": "string"
+            },
+            "examples": {
+              "": {
+                "summary": "default sorting",
+                "value": "externalGroup"
+              },
+              "-externalGroup": {
+                "summary": "externalGroup descending",
+                "value": "-externalGroup"
+              },
+              "externalGroup": {
+                "summary": "externalGroup ascending",
+                "value": "externalGroup"
+              }
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "externalGroups": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    }
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "default": {
+            "description": "Default OK response",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "metadata",
+                    "items"
+                  ],
+                  "properties": {
+                    "apiVersion": {
+                      "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
+                      "type": "string"
+                    },
+                    "items": {
+                      "type": "array",
+                      "items": {
+                        "default": {}
+                      }
+                    },
+                    "kind": {
+                      "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
+                      "type": "string"
+                    },
+                    "metadata": {
+                      "default": {}
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+      }
+    },
     "/apis/iam.grafana.app/v0alpha1/namespaces/{namespace}/searchTeams": {
       "get": {
         "tags": [

public/app/features/alerting/unified/navigation/useAlertRulesNav.ts

@@ -1,69 +0,0 @@
-import { useLocation } from 'react-router-dom-v5-compat';
-
-import { NavModelItem } from '@grafana/data';
-import { t } from '@grafana/i18n';
-import { config } from '@grafana/runtime';
-import { useSelector } from 'app/types/store';
-
-export function useAlertRulesNav() {
-  const location = useLocation();
-  const navIndex = useSelector((state) => state.navIndex);
-
-  // Check if V2 navigation is enabled
-  const useV2Nav = config.featureToggles.alertingNavigationV2;
-
-  if (!useV2Nav) {
-    // Legacy navigation: return simple navId
-    return {
-      navId: 'alert-list',
-      pageNav: undefined,
-    };
-  }
-
-  // V2 Navigation: Create tabs structure
-  const alertRulesNav = navIndex['alert-rules'];
-
-  if (!alertRulesNav) {
-    // Fallback to legacy if nav item doesn't exist
-    return {
-      navId: 'alert-list',
-      pageNav: undefined,
-    };
-  }
-
-  // All available tabs
-  const allTabs = [
-    {
-      id: 'alert-rules-list',
-      text: t('alerting.navigation.alert-rules', 'Alert rules'),
-      url: '/alerting/list',
-      active: location.pathname === '/alerting/list',
-      icon: 'list-ul',
-      parentItem: alertRulesNav,
-    },
-    {
-      id: 'alert-rules-recently-deleted',
-      text: t('alerting.navigation.recently-deleted', 'Recently deleted'),
-      url: '/alerting/recently-deleted',
-      active: location.pathname === '/alerting/recently-deleted',
-      icon: 'history',
-      parentItem: alertRulesNav,
-    },
-  ].filter((tab) => {
-    // Filter based on permissions - if nav item doesn't exist, user doesn't have permission
-    const navItem = navIndex[tab.id];
-    return navItem !== undefined;
-  });
-
-  // Create pageNav that represents the Alert rules page with tabs as children
-  const pageNav: NavModelItem = {
-    ...alertRulesNav,
-    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions
-    children: allTabs as NavModelItem[],
-  };
-
-  return {
-    navId: 'alert-rules',
-    pageNav,
-  };
-}

public/app/features/alerting/unified/rule-list/RuleList.v1.tsx

@@ -20,7 +20,6 @@ import { shouldUsePrometheusRulesPrimary } from '../featureToggles';
 import { useCombinedRuleNamespaces } from '../hooks/useCombinedRuleNamespaces';
 import { useFilteredRules, useRulesFilter } from '../hooks/useFilteredRules';
 import { useUnifiedAlertingSelector } from '../hooks/useUnifiedAlertingSelector';
-import { useAlertRulesNav } from '../navigation/useAlertRulesNav';
 import { fetchAllPromAndRulerRulesAction, fetchAllPromRulesAction, fetchRulerRulesAction } from '../state/actions';
 import { RULE_LIST_POLL_INTERVAL_MS } from '../utils/constants';
 import { GRAFANA_RULES_SOURCE_NAME, getAllRulesSourceNames } from '../utils/datasource';
@@ -39,7 +38,6 @@ const LIMIT_ALERTS = INSTANCES_DISPLAY_LIMIT + 1;
 const prometheusRulesPrimary = shouldUsePrometheusRulesPrimary();
 
 const RuleListV1 = () => {
-  const { navId, pageNav } = useAlertRulesNav();
   const dispatch = useDispatch();
   const rulesDataSourceNames = useMemo(getAllRulesSourceNames, []);
   const [expandAll, setExpandAll] = useState(false);
@@ -121,8 +119,7 @@ const RuleListV1 = () => {
     // We don't want to show the Loading... indicator for the whole page.
     // We show separate indicators for Grafana-managed and Cloud rules
     <AlertingPageWrapper
-      navId={navId}
-      pageNav={pageNav}
+      navId="alert-list"
       isLoading={false}
       renderTitle={(title) => <RuleListPageTitle title={title} />}
       actions={<RuleListActionButtons hasAlertRulesCreated={hasAlertRulesCreated} />}

public/app/features/alerting/unified/rule-list/RuleList.v2.tsx

@@ -13,7 +13,6 @@ import { useListViewMode } from '../components/rules/Filter/RulesViewModeSelecto
 import { AIAlertRuleButtonComponent } from '../enterprise-components/AI/AIGenAlertRuleButton/addAIAlertRuleButton';
 import { AlertingAction, useAlertingAbility } from '../hooks/useAbilities';
 import { useRulesFilter } from '../hooks/useFilteredRules';
-import { useAlertRulesNav } from '../navigation/useAlertRulesNav';
 import { getRulesDataSources } from '../utils/datasource';
 
 import { FilterView } from './FilterView';
@@ -124,12 +123,10 @@ export function RuleListActions() {
 
 export default function RuleListPage() {
   const { isApplying } = useApplyDefaultSearch();
-  const { navId, pageNav } = useAlertRulesNav();
 
   return (
     <AlertingPageWrapper
-      navId={navId}
-      pageNav={pageNav}
+      navId="alert-list"
       renderTitle={(title) => <RuleListPageTitle title={title} />}
       isLoading={isApplying}
       actions={<RuleListActions />}

public/locales/en-US/grafana.json

@@ -1929,10 +1929,6 @@
       "select-group": "Select group",
       "select-namespace": "Select namespace"
     },
-    "navigation": {
-      "alert-rules": "Alert rules",
-      "recently-deleted": "Recently deleted"
-    },
     "need-help-info": {
       "need-help": "Need help?"
     },