feat: add ai_providers table, queries, dbauthz, audit, RBAC (#24892)

enterprise/audit/table.go

@@ -29,6 +29,8 @@ var AuditActionMap = map[string][]codersdk.AuditAction{
 	"License":         {codersdk.AuditActionCreate, codersdk.AuditActionDelete},
 	"Task":            {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
 	"AiSeatState":     {codersdk.AuditActionCreate},
+	"AIProvider":      {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
+	"AIProviderKey":   {codersdk.AuditActionCreate, codersdk.AuditActionDelete},
 	"Chat":            {codersdk.AuditActionCreate, codersdk.AuditActionWrite}, // chats get 'archived' by users, not deleted.
 	"UserSecret":      {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
 }
@@ -367,6 +369,27 @@ var auditableResourcesTypes = map[any]map[string]Action{
 		"last_used_at": ActionIgnore,
 		"updated_at":   ActionIgnore,
 	},
+	&database.AIProvider{}: {
+		"id":              ActionTrack,
+		"type":            ActionTrack,
+		"name":            ActionTrack,
+		"display_name":    ActionTrack,
+		"enabled":         ActionTrack,
+		"deleted":         ActionTrack,
+		"base_url":        ActionTrack,
+		"settings":        ActionSecret, // Encrypted JSON blob may contain provider secrets (e.g. Bedrock access key + secret).
+		"settings_key_id": ActionIgnore, // dbcrypt key reference, derivable.
+		"created_at":      ActionIgnore, // Implicit; not useful in a diff.
+		"updated_at":      ActionIgnore, // Changes; not useful in a diff.
+	},
+	&database.AIProviderKey{}: {
+		"id":             ActionTrack,
+		"provider_id":    ActionTrack,
+		"api_key":        ActionSecret, // Provider API key, never expose in audit diffs.
+		"api_key_key_id": ActionIgnore, // dbcrypt key reference, derivable.
+		"created_at":     ActionIgnore, // Implicit; not useful in a diff.
+		"updated_at":     ActionIgnore, // Changes; not useful in a diff.
+	},
 	&database.TaskTable{}: {
 		"id":                  ActionTrack,
 		"organization_id":     ActionIgnore, // Never changes.

enterprise/cli/aibridged.go

@@ -44,7 +44,7 @@ func newAIBridgeDaemon(coderAPI *coderd.API, providers []aibridge.Provider) (*ai
 	return srv, nil
 }
 
-// buildProviders constructs the list of aibridge providers from config.
+// buildProviders constructs the list of AI providers from config.
 // It merges legacy single-provider env vars and indexed provider configs:
 //  1. Legacy providers (from CODER_AIBRIDGE_OPENAI_KEY, etc.) are added first.
 //     If a legacy name conflicts with an indexed provider, startup fails with
@@ -171,9 +171,9 @@ func buildProviders(cfg codersdk.AIBridgeConfig) ([]aibridge.Provider, error) {
 }
 
 // bedrockConfigFromProvider converts Bedrock fields from an indexed
-// AIBridgeProviderConfig into an aibridge AWSBedrockConfig.
+// AIProviderConfig into an aibridge AWSBedrockConfig.
 // Returns nil if no Bedrock fields are set.
-func bedrockConfigFromProvider(p codersdk.AIBridgeProviderConfig) *aibridge.AWSBedrockConfig {
+func bedrockConfigFromProvider(p codersdk.AIProviderConfig) *aibridge.AWSBedrockConfig {
 	if p.BedrockRegion == "" && p.BedrockBaseURL == "" && len(p.BedrockAccessKeys) == 0 && len(p.BedrockAccessKeySecrets) == 0 {
 		return nil
 	}

enterprise/cli/aibridged_internal_test.go

@@ -42,7 +42,7 @@ func TestBuildProviders(t *testing.T) {
 	t.Run("IndexedOnly", func(t *testing.T) {
 		t.Parallel()
 		cfg := codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{
 					Type:    aibridge.ProviderAnthropic,
 					Name:    "anthropic-zdr",
@@ -71,7 +71,7 @@ func TestBuildProviders(t *testing.T) {
 	t.Run("LegacyOpenAIConflictsWithIndexed", func(t *testing.T) {
 		t.Parallel()
 		cfg := codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{Type: aibridge.ProviderOpenAI, Name: aibridge.ProviderOpenAI, Keys: []string{"sk-indexed"}},
 			},
 		}
@@ -85,7 +85,7 @@ func TestBuildProviders(t *testing.T) {
 	t.Run("LegacyAnthropicConflictsWithIndexed", func(t *testing.T) {
 		t.Parallel()
 		cfg := codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{Type: aibridge.ProviderAnthropic, Name: aibridge.ProviderAnthropic, Keys: []string{"sk-indexed"}},
 			},
 		}
@@ -99,7 +99,7 @@ func TestBuildProviders(t *testing.T) {
 	t.Run("MixedLegacyAndIndexed", func(t *testing.T) {
 		t.Parallel()
 		cfg := codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{Type: aibridge.ProviderAnthropic, Name: "anthropic-zdr", Keys: []string{"sk-zdr"}},
 			},
 		}
@@ -151,7 +151,7 @@ func TestBuildProviders(t *testing.T) {
 	t.Run("UnknownType", func(t *testing.T) {
 		t.Parallel()
 		cfg := codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{Type: "gemini", Name: "gemini-pro"},
 			},
 		}
@@ -166,7 +166,7 @@ func TestBuildProviders(t *testing.T) {
 		// Copilot providers can target any of the three GitHub
 		// Copilot API hosts via an explicit BASE_URL.
 		cfg := codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{Type: aibridge.ProviderCopilot, Name: aibridge.ProviderCopilot, DumpDir: "/tmp/copilot-dump"},
 				{Type: aibridge.ProviderCopilot, Name: agplaibridge.ProviderCopilotBusiness, BaseURL: "https://" + agplaibridge.HostCopilotBusiness},
 				{Type: aibridge.ProviderCopilot, Name: agplaibridge.ProviderCopilotEnterprise, BaseURL: "https://" + agplaibridge.HostCopilotEnterprise},
@@ -190,7 +190,7 @@ func TestBuildProviders(t *testing.T) {
 		// ChatGPT is an OpenAI-compatible provider with a custom
 		// base URL. Admins configure it as an indexed openai provider.
 		cfg := codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{Type: aibridge.ProviderOpenAI, Name: agplaibridge.ProviderChatGPT, BaseURL: agplaibridge.BaseURLChatGPT},
 			},
 		}
@@ -219,7 +219,7 @@ func TestDomainsFromProviders(t *testing.T) {
 		t.Parallel()
 
 		providers, err := buildProviders(codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{Type: aibridge.ProviderOpenAI, Name: "openai", Keys: []string{"k"}},
 				{Type: aibridge.ProviderAnthropic, Name: "anthropic", Keys: []string{"k"}},
 				{Type: aibridge.ProviderOpenAI, Name: "custom", Keys: []string{"k"}, BaseURL: "https://custom-llm.example.com:8443/api"},
@@ -243,7 +243,7 @@ func TestDomainsFromProviders(t *testing.T) {
 		t.Parallel()
 
 		providers, err := buildProviders(codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{Type: aibridge.ProviderOpenAI, Name: "first", Keys: []string{"k"}, BaseURL: "https://api.example.com/v1"},
 				{Type: aibridge.ProviderOpenAI, Name: "second", Keys: []string{"k"}, BaseURL: "https://api.example.com/v2"},
 			},
@@ -268,7 +268,7 @@ func TestDomainsFromProviders(t *testing.T) {
 		t.Parallel()
 
 		providers, err := buildProviders(codersdk.AIBridgeConfig{
-			Providers: []codersdk.AIBridgeProviderConfig{
+			Providers: []codersdk.AIProviderConfig{
 				{Type: aibridge.ProviderOpenAI, Name: "provider", Keys: []string{"k"}, BaseURL: "https://API.Example.COM/v1"},
 			},
 		})

enterprise/cli/server.go

@@ -168,7 +168,7 @@ func (r *RootCmd) Server(_ func()) *serpent.Command {
 		if bridgeEnabled || proxyEnabled {
 			providers, err := buildProviders(options.DeploymentValues.AI.BridgeConfig)
 			if err != nil {
-				return nil, nil, xerrors.Errorf("build aibridge providers: %w", err)
+				return nil, nil, xerrors.Errorf("build AI providers: %w", err)
 			}
 
 			// In-memory aibridge daemon.