feat: provider key policies and user provider settings (#23751)

coderd/database/migrations/000459_provider_key_policy.down.sql

@@ -0,0 +1,8 @@
+DROP TABLE IF EXISTS user_chat_provider_keys;
+
+ALTER TABLE chat_providers DROP CONSTRAINT IF EXISTS valid_credential_policy;
+
+ALTER TABLE chat_providers
+    DROP COLUMN IF EXISTS central_api_key_enabled,
+    DROP COLUMN IF EXISTS allow_user_api_key,
+    DROP COLUMN IF EXISTS allow_central_api_key_fallback;

coderd/database/migrations/000459_provider_key_policy.up.sql

@@ -0,0 +1,24 @@
+ALTER TABLE chat_providers
+    ADD COLUMN central_api_key_enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    ADD COLUMN allow_user_api_key BOOLEAN NOT NULL DEFAULT FALSE,
+    ADD COLUMN allow_central_api_key_fallback BOOLEAN NOT NULL DEFAULT FALSE;
+
+ALTER TABLE chat_providers
+    ADD CONSTRAINT valid_credential_policy CHECK (
+        (central_api_key_enabled OR allow_user_api_key) AND
+        (
+            NOT allow_central_api_key_fallback OR
+            (central_api_key_enabled AND allow_user_api_key)
+        )
+    );
+
+CREATE TABLE user_chat_provider_keys (
+    id               UUID        PRIMARY KEY DEFAULT gen_random_uuid(),
+    user_id          UUID        NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    chat_provider_id UUID        NOT NULL REFERENCES chat_providers(id) ON DELETE CASCADE,
+    api_key          TEXT        NOT NULL CHECK (api_key != ''),
+    api_key_key_id   TEXT        REFERENCES dbcrypt_keys(active_key_digest),
+    created_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at       TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    UNIQUE (user_id, chat_provider_id)
+);

coderd/database/migrations/testdata/fixtures/000459_provider_key_policy.up.sql

@@ -0,0 +1,16 @@
+INSERT INTO user_chat_provider_keys (
+    user_id,
+    chat_provider_id,
+    api_key,
+    created_at,
+    updated_at
+)
+SELECT
+    id,
+    '0a8b2f84-b5a8-4c44-8c9f-e58c44a534a7',
+    'fixture-test-key',
+    '2025-01-01 00:00:00+00',
+    '2025-01-01 00:00:00+00'
+FROM users
+ORDER BY created_at, id
+LIMIT 1;