fix: ai cost control cap configurable AI spend limit (#27640)

## Problem

A configured AI spend limit was only validated as `gte=0`, with no upper
bound. The group spend query multiplies the per-member limit by the
number of attributed members, so a large enough limit overflows `bigint`
and fails the whole query, returning an error for every group in the
request rather than just the misconfigured one.

## Changes

- Add `MaxAISpendLimitMicros`, $1,000,000 per member per budget period.
- Reject group budgets and per-user overrides above the maximum with a
400 naming the limit.
- Bound both budget forms in the UI so they show the valid range before
submitting.

Follow-up
https://github.com/coder/coder/pull/27589#discussion_r3668956350
Depends on https://github.com/coder/coder/pull/27589

> [!NOTE]
> Initially generated by Claude Opus 5, modified and reviewed by
@ssncferreira
This commit is contained in:
Susana Ferreira
2026-07-29 14:00:13 +01:00
committed by GitHub
parent 4987afada7
commit e71249a821
12 changed files with 218 additions and 30 deletions
+4 -4
View File
@@ -14302,9 +14302,9 @@ If the schedule is empty, the user will be updated to use the default schedule.|
### Properties
| Name | Type | Required | Restrictions | Description |
|----------------------|---------|----------|--------------|-------------|
| `spend_limit_micros` | integer | false | | |
| Name | Type | Required | Restrictions | Description |
|----------------------|---------|----------|--------------|-----------------------------------------------------------|
| `spend_limit_micros` | integer | false | | Spend limit micros must not exceed MaxAISpendLimitMicros. |
## codersdk.UpsertUserAIBudgetOverrideRequest
@@ -14320,7 +14320,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
| Name | Type | Required | Restrictions | Description |
|----------------------|---------|----------|--------------|---------------------------------------------------------------------------------------------------|
| `group_id` | string | true | | Group ID is the group the user's spend is attributed to. The user must be a member of this group. |
| `spend_limit_micros` | integer | false | | |
| `spend_limit_micros` | integer | false | | Spend limit micros must not exceed MaxAISpendLimitMicros. |
## codersdk.UpsertWorkspaceAgentPortShareRequest