feat: add ai_gateway_keys table and related RBAC (#25563)

Adds table to store keys that AI Gateway standalone replicas will use
to authenticate into Coderd.
Also adds RBAC and audit boilerplate.
This commit is contained in:
Paweł Banaszewski
2026-06-02 09:28:43 +02:00
committed by GitHub
parent 49c2142d2d
commit f22d4e2cbb
26 changed files with 264 additions and 38 deletions
+4
View File
@@ -6,6 +6,10 @@ const (
APIKeyScopeAll APIKeyScope = "all"
// Deprecated: use codersdk.APIKeyScopeCoderApplicationConnect instead.
APIKeyScopeApplicationConnect APIKeyScope = "application_connect"
APIKeyScopeAiGatewayKeyAll APIKeyScope = "ai_gateway_key:*"
APIKeyScopeAiGatewayKeyCreate APIKeyScope = "ai_gateway_key:create"
APIKeyScopeAiGatewayKeyDelete APIKeyScope = "ai_gateway_key:delete"
APIKeyScopeAiGatewayKeyRead APIKeyScope = "ai_gateway_key:read"
APIKeyScopeAiModelPriceAll APIKeyScope = "ai_model_price:*"
APIKeyScopeAiModelPriceRead APIKeyScope = "ai_model_price:read"
APIKeyScopeAiModelPriceUpdate APIKeyScope = "ai_model_price:update"
+3
View File
@@ -48,6 +48,7 @@ const (
ResourceTypeAISeat ResourceType = "ai_seat"
ResourceTypeAIProvider ResourceType = "ai_provider"
ResourceTypeAIProviderKey ResourceType = "ai_provider_key"
ResourceTypeAIGatewayKey ResourceType = "ai_gateway_key"
ResourceTypeGroupAIBudget ResourceType = "group_ai_budget"
ResourceTypeChat ResourceType = "chat"
ResourceTypeUserSecret ResourceType = "user_secret"
@@ -116,6 +117,8 @@ func (r ResourceType) FriendlyString() string {
return "ai provider"
case ResourceTypeAIProviderKey:
return "ai provider key"
case ResourceTypeAIGatewayKey:
return "ai gateway key"
case ResourceTypeGroupAIBudget:
return "group ai budget"
case ResourceTypeChat:
+2
View File
@@ -5,6 +5,7 @@ type RBACResource string
const (
ResourceWildcard RBACResource = "*"
ResourceAIGatewayKey RBACResource = "ai_gateway_key"
ResourceAiModelPrice RBACResource = "ai_model_price"
ResourceAIProvider RBACResource = "ai_provider"
ResourceAiSeat RBACResource = "ai_seat"
@@ -82,6 +83,7 @@ const (
// said resource type.
var RBACResourceActions = map[RBACResource][]RBACAction{
ResourceWildcard: {},
ResourceAIGatewayKey: {ActionCreate, ActionDelete, ActionRead},
ResourceAiModelPrice: {ActionRead, ActionUpdate},
ResourceAIProvider: {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
ResourceAiSeat: {ActionCreate, ActionRead},