Files
coder/coderd/database/queries/chatmodelconfigs.sql
T
Ethan aefc761fcf feat!: enforce organization scope for chat models (#27959)
## Summary

Move chat model management and runtime availability to
organization-scoped API routes. The API now identifies the organization
in every model-management operation, applies chat model RBAC and ACLs
within that organization, and returns only models the caller can use
there.

Depends on #27958.

## Problem

Chat model configurations now belong to organizations, but the existing
experimental management and discovery APIs are deployment-shaped. Their
routes do not identify an organization, SDK methods do not accept an
organization ID, and item operations address a model configuration by ID
alone.

That contract cannot safely expose organization-owned model
configurations. It also does not provide the organization-specific
provider information, authorization behavior, ACL management, or
recovery guidance needed by the settings and chat clients later in the
stack.

## Fix

Add organization-scoped chat model endpoints under:

```text
/api/experimental/organizations/{organization}/chats/models
```

The new API provides:

- Organization-scoped model listing and creation.
- Model get, update, and delete operations scoped by both organization
and model ID.
- Model ACL read and update operations.
- Organization-scoped runtime availability and provider status.
- Redacted provider descriptors for model-management clients.
- Chat model RBAC and row ACL enforcement for writes, runtime discovery,
and Chatd model selection.
- Recovery guidance when a chat's organization has no usable local
model.

Historical chats can retain a model reference owned by another
organization, but runtime selection uses an authorized local default
when one is available. Foreign, inaccessible, disabled, and otherwise
unusable models are not exposed as usable selections for the
organization.

The existing collection and availability routes remain as
default-organization compatibility endpoints in this layer:

```text
GET  /api/experimental/chats/model-configs
POST /api/experimental/chats/model-configs
GET  /api/experimental/chats/models
```

These compatibility routes do not provide access to models in
non-default organizations. The previous unscoped item update and delete
routes are removed because item operations must include the owning
organization.

## Breaking change

This changes the experimental HTTP API and Go SDK contracts for chat
model management.

Clients must migrate model-management and availability requests to the
organization-scoped routes and provide an organization identifier. In
the Go SDK, the following methods now require an organization ID:

- `ChatModelAvailability`
- `ChatModels`
- `CreateChatModel`
- `UpdateChatModel`
- `DeleteChatModel`

`ChatModels` also changes its return value from `[]ChatModel` to
`OrganizationChatModelsResponse`, which includes the organization models
and the redacted provider descriptors required by management clients.
New item and ACL methods likewise require both the organization ID and
model ID.

The default-organization compatibility routes reduce the immediate
impact for collection and availability callers, but they do not preserve
the previous item API or SDK method signatures. Generated clients and
direct consumers of the experimental API must be updated before adopting
this change.

_This pull request description was generated by Coder Agents._
2026-08-24 11:20:25 +01:00

180 lines
3.9 KiB
SQL

-- name: GetChatModelConfigByID :one
SELECT
*
FROM
chat_model_configs
WHERE
id = @id::uuid
AND deleted = FALSE;
-- name: GetDefaultChatModelConfig :one
SELECT
*
FROM
chat_model_configs
WHERE
is_default = TRUE
AND deleted = FALSE
AND organization_id = @organization_id::uuid;
-- name: GetChatModelConfigs :many
SELECT
cmc.*
FROM
chat_model_configs cmc
LEFT JOIN
ai_providers ap ON ap.id = cmc.ai_provider_id
WHERE
cmc.deleted = FALSE
AND cmc.organization_id = @organization_id::uuid
-- Authorize Filter clause will be injected below in GetAuthorizedChatModelConfigs
-- @authorize_filter
ORDER BY
ap.type::text ASC,
cmc.model ASC,
cmc.updated_at DESC,
cmc.id DESC;
-- name: GetChatModelConfigsByOrganization :many
-- All live configs in one organization, unfiltered. Consumed ONLY by
-- ensureDefaultChatModelConfig's default-election read inside the write
-- transaction; authorization is the caller's update-in-org check that every
-- path reaching the election already requires. No @authorize_filter.
SELECT
*
FROM
chat_model_configs
WHERE
organization_id = @organization_id::uuid
AND deleted = FALSE
ORDER BY
model ASC,
updated_at DESC,
id DESC;
-- name: GetEnabledChatModelConfigsByOrganization :many
SELECT
sqlc.embed(cmc),
ap.type::text AS provider
FROM
chat_model_configs cmc
JOIN
ai_providers ap ON ap.id = cmc.ai_provider_id
WHERE
cmc.organization_id = @organization_id::uuid
AND cmc.enabled = TRUE
AND cmc.deleted = FALSE
AND ap.enabled = TRUE
AND ap.deleted = FALSE
ORDER BY
ap.type::text ASC,
cmc.model ASC,
cmc.updated_at DESC,
cmc.id DESC;
-- name: GetEnabledChatModelConfigByID :one
SELECT
cmc.*
FROM
chat_model_configs cmc
-- Providers can be disabled independently of their model configs.
-- Check both to ensure the selected config is actually usable.
JOIN
ai_providers ap ON ap.id = cmc.ai_provider_id
WHERE
cmc.id = @id::uuid
AND cmc.deleted = FALSE
AND cmc.enabled = TRUE
AND ap.enabled = TRUE
AND ap.deleted = FALSE;
-- name: InsertChatModelConfig :one
INSERT INTO chat_model_configs (
model,
display_name,
created_by,
updated_by,
enabled,
is_default,
context_limit,
compression_threshold,
options,
ai_provider_id,
organization_id,
group_acl,
user_acl
) VALUES (
@model::text,
@display_name::text,
sqlc.narg('created_by')::uuid,
sqlc.narg('updated_by')::uuid,
@enabled::boolean,
@is_default::boolean,
@context_limit::bigint,
@compression_threshold::integer,
@options::jsonb,
sqlc.narg('ai_provider_id')::uuid,
@organization_id::uuid,
@group_acl,
@user_acl
)
RETURNING
*;
-- name: UpdateChatModelConfig :one
UPDATE
chat_model_configs
SET
model = @model::text,
display_name = @display_name::text,
updated_by = sqlc.narg('updated_by')::uuid,
enabled = @enabled::boolean,
is_default = @is_default::boolean,
context_limit = @context_limit::bigint,
compression_threshold = @compression_threshold::integer,
options = @options::jsonb,
ai_provider_id = sqlc.narg('ai_provider_id')::uuid,
updated_at = NOW()
WHERE
id = @id::uuid
AND deleted = FALSE
RETURNING
*;
-- name: UpdateChatModelConfigACLByID :one
UPDATE
chat_model_configs
SET
group_acl = @group_acl,
user_acl = @user_acl,
updated_by = sqlc.narg('updated_by')::uuid,
updated_at = NOW()
WHERE
id = @id::uuid
AND deleted = FALSE
RETURNING
*;
-- name: UnsetDefaultChatModelConfigs :exec
UPDATE
chat_model_configs
SET
is_default = FALSE,
updated_at = NOW()
WHERE
is_default = TRUE
AND deleted = FALSE
AND organization_id = @organization_id::uuid;
-- name: DeleteChatModelConfigByID :one
UPDATE
chat_model_configs
SET
deleted = TRUE,
deleted_at = NOW(),
updated_at = NOW()
WHERE
id = @id::uuid
AND deleted = FALSE
RETURNING id;