feat: add ai_providers table, queries, dbauthz, audit, RBAC (#24892)

coderd/database/queries/ai_provider_keys.sql

@@ -0,0 +1,75 @@
+-- name: GetAIProviderKeyByID :one
+SELECT
+    *
+FROM
+    ai_provider_keys
+WHERE
+    id = @id::uuid;
+
+-- name: GetAIProviderKeysByProviderID :many
+-- Returns all keys for a provider, ordered by created_at ASC so the
+-- oldest key is returned first. AI Bridge currently uses the oldest
+-- key per provider; multiple keys are stored to support future
+-- failover and rotation flows.
+SELECT
+    *
+FROM
+    ai_provider_keys
+WHERE
+    provider_id = @provider_id::uuid
+ORDER BY
+    created_at ASC,
+    id ASC;
+
+-- name: GetAIProviderKeys :many
+-- Returns every AI provider key row, including those belonging to a
+-- soft-deleted provider, so the dbcrypt key rotation utility can
+-- re-encrypt their api_key and clear references to retired keys.
+SELECT
+    *
+FROM
+    ai_provider_keys
+ORDER BY
+    provider_id ASC,
+    created_at ASC,
+    id ASC;
+
+-- name: InsertAIProviderKey :one
+INSERT INTO ai_provider_keys (
+    id,
+    provider_id,
+    api_key,
+    api_key_key_id,
+    created_at,
+    updated_at
+) VALUES (
+    @id::uuid,
+    @provider_id::uuid,
+    @api_key::text,
+    sqlc.narg('api_key_key_id')::text,
+    @created_at::timestamptz,
+    @updated_at::timestamptz
+)
+RETURNING
+    *;
+
+-- name: DeleteAIProviderKey :exec
+DELETE FROM
+    ai_provider_keys
+WHERE
+    id = @id::uuid;
+
+-- name: UpdateEncryptedAIProviderKey :one
+-- Updates only the encrypted columns (api_key, api_key_key_id) and
+-- the updated_at timestamp on a row. Used by the dbcrypt key
+-- rotation utility to re-encrypt or decrypt rows in place.
+UPDATE
+    ai_provider_keys
+SET
+    api_key = @api_key::text,
+    api_key_key_id = sqlc.narg('api_key_key_id')::text,
+    updated_at = NOW()
+WHERE
+    id = @id::uuid
+RETURNING
+    *;

coderd/database/queries/ai_providers.sql

@@ -0,0 +1,92 @@
+-- name: GetAIProviderByID :one
+SELECT
+    *
+FROM
+    ai_providers
+WHERE
+    id = @id::uuid AND deleted = FALSE;
+
+-- name: GetAIProviderByName :one
+SELECT
+    *
+FROM
+    ai_providers
+WHERE
+    name = @name::text AND deleted = FALSE;
+
+-- name: GetAIProviders :many
+-- Returns AI provider rows. Soft-deleted and disabled rows are excluded
+-- unless include_deleted or include_disabled is set.
+SELECT
+    *
+FROM
+    ai_providers
+WHERE
+    (@include_deleted::boolean OR NOT deleted)
+    AND (@include_disabled::boolean OR enabled)
+ORDER BY
+    name ASC;
+
+-- name: InsertAIProvider :one
+INSERT INTO ai_providers (
+    id,
+    type,
+    name,
+    display_name,
+    enabled,
+    base_url,
+    settings,
+    settings_key_id
+) VALUES (
+    @id::uuid,
+    @type::ai_provider_type,
+    @name::text,
+    sqlc.narg('display_name')::text,
+    @enabled::boolean,
+    @base_url::text,
+    sqlc.narg('settings')::text,
+    sqlc.narg('settings_key_id')::text
+)
+RETURNING
+    *;
+
+-- name: UpdateAIProvider :one
+UPDATE
+    ai_providers
+SET
+    display_name = sqlc.narg('display_name')::text,
+    enabled = @enabled::boolean,
+    base_url = @base_url::text,
+    settings = sqlc.narg('settings')::text,
+    settings_key_id = sqlc.narg('settings_key_id')::text,
+    updated_at = NOW()
+WHERE
+    id = @id::uuid AND deleted = FALSE
+RETURNING
+    *;
+
+-- name: DeleteAIProviderByID :exec
+UPDATE
+    ai_providers
+SET
+    deleted = TRUE,
+    enabled = FALSE,
+    updated_at = NOW()
+WHERE
+    id = @id::uuid AND deleted = FALSE;
+
+-- name: UpdateEncryptedAIProviderSettings :one
+-- Updates only the encrypted columns (settings, settings_key_id) and
+-- the updated_at timestamp on a row, regardless of its deleted flag.
+-- Used by the dbcrypt key rotation utility to re-encrypt or decrypt
+-- rows in place.
+UPDATE
+    ai_providers
+SET
+    settings = sqlc.narg('settings')::text,
+    settings_key_id = sqlc.narg('settings_key_id')::text,
+    updated_at = NOW()
+WHERE
+    id = @id::uuid
+RETURNING
+    *;