feat: add ai_gateway_coderd_keys table and related RBAC by pawbana · Pull Request #25563 · coder/coder

pawbana · 2026-05-21T12:21:45Z

Adds table to store keys that AI Gateway standalone replicas will use for authenticating into Coderd.
Also adds RBAC and audit boilerplate.

github-actions · 2026-05-21T12:21:58Z

Docs preview

📖 View docs preview for docs/admin/security/audit-logs.md

pawbana · 2026-05-21T12:22:04Z

This stack of pull requests is managed by Graphite. Learn more about stacking.

pawbana · 2026-05-21T13:32:51Z

/coder-agents-review

coder-agents-review

Well-scoped boilerplate: table schema, RBAC, audit wiring, and nothing extra. The RBAC test is comprehensive (owner-only, all three actions, explicit denials for 12 other role subjects). Audit field tracking is deliberate (ActionSecret for hashed_secret, ActionIgnore for timestamps). Migration follows established patterns.

Severity count: 1 P2, 2 P3, 3 Nit, 1 Note.

The P2 is a schema gap: key_prefix has no UNIQUE constraint. Every other prefix-based lookup column in the codebase (oauth2_provider_app_secrets.secret_prefix, oauth2_provider_app_codes.secret_prefix) enforces uniqueness because the auth flow does WHERE prefix = $1 and expects exactly one row. The future handler will either assume uniqueness (bug if duplicates exist) or iterate candidates (timing side-channel). Free to fix now on an empty table.

The PR title says "aibridge_coderd_keys" but the table is ai_gateway_coderd_keys. Every code artifact uses the latter. git log --grep=ai_gateway_coderd_keys will miss this commit.

"Boring code gets silence, and most of this earned it." (Hisoka)

🤖 This review was automatically generated with Coder Agents.

pawbana · 2026-05-21T16:03:26Z

/coder-agents-review

coder-agents-review

6 of 8 findings addressed (3c2624b), 1 acknowledged. DEREM-1 (P4) is unaddressed: the table, model, RBAC object, and audit config still have zero runtime callers. No query file, no handlers, no dbauthz integration.

This is a scaffolding PR and the finding was posted as "expected for scaffolding, noting for completeness." A brief acknowledgment (e.g., "follow-up PRs add handlers") unblocks the next review round.

🤖 This review was automatically generated with Coder Agents.

pawbana · 2026-05-21T16:18:49Z

6 of 8 findings addressed (3c2624b), 1 acknowledged. DEREM-1 (P4) is unaddressed: the table, model, RBAC object, and audit config still have zero runtime callers. No query file, no handlers, no dbauthz integration.

This is a scaffolding PR and the finding was posted as "expected for scaffolding, noting for completeness." A brief acknowledgment (e.g., "follow-up PRs add handlers") unblocks the next review round.

🤖 This review was automatically generated with Coder Agents.

follow-up PRs add handlers, see WIP PRs #25564 and #25565

/coder-agents-review

coder-agents-review

All six R1 fixes verified clean by 9 reviewers. DEREM-1 deferred with linked follow-up PRs. Schema, RBAC, and audit wiring are consistent across all layers.

One new P3: the name column lacks a CHECK constraint, the same class of gap that DEREM-4 flagged on secret_prefix (and was fixed). An empty name produces an empty audit target string.

"This is the same class as DEREM-4 (empty-string acceptance on identifying column in this table). The fix for DEREM-4 hardened secret_prefix but left name unprotected." (Mafuuu)

🤖 This review was automatically generated with Coder Agents.

pawbana · 2026-05-21T17:04:35Z

/coder-agents-review

coder-agents-review

All 9 findings resolved across 4 rounds. 7 fixed by the author (DEREM-2 through -7, DEREM-9), 1 accepted (DEREM-8, no expires_at, follows provisioner_keys pattern), 1 deferred with linked follow-up PRs (DEREM-1, #25564 and #25565 add handlers).

The schema is tight: three unique indexes (name, secret_prefix, hashed_secret), two CHECK constraints (secret_prefix exact length, name slug regex), COMMENT ON TABLE/COLUMN, and a down migration that documents its intentional enum retention. RBAC is owner-only for create/read/delete. Audit boilerplate marks hashed_secret as ActionSecret. All fixes addressed root causes, not symptoms.

"I tried to build a case against this and could not." (Pariston)

🤖 This review was automatically generated with Coder Agents.

ssncferreira

Overall LGTM 👍 just a few questions/nits.

ssncferreira · 2026-05-25T10:35:18Z

 		return typed.Name
 	case database.AIProviderKey:
 		return typed.ID.String()
+	case database.AiGatewayCoderdKey:


nit: to match other types like AIProviderKey

Suggested change

case database.AiGatewayCoderdKey:

case database.AIGatewayCoderdKey:

ssncferreira · 2026-05-25T10:51:12Z

+    name text NOT NULL,
+    secret_prefix varchar(11) NOT NULL,
+    hashed_secret bytea NOT NULL,
+    last_used_at timestamptz NULL,


Would it make sense to add a created_by column with the user that created the key? Since this is deployment scoped, it might be useful.

I can see it bringing some value but also I see this potentially causing some PII issues.
Key creation / deletion is audit logged so this information should be available (just not for everyone).

ssncferreira · 2026-05-25T10:56:23Z

+    id uuid PRIMARY KEY,
+    created_at timestamptz NOT NULL,
+    name text NOT NULL,
+    secret_prefix varchar(11) NOT NULL,


Do we have any safeguards at the application level in case the secret length is less than 11? Because in that case, we could be storing the full secret at the database.
Actually, do we need a secret_prefix? 🤔 Isn't the (id, name) enough for identifying a key?

Yes, name could be enough but secret prefix provides way to make sure that given secret is used in standalone deployment anyway, or in general check which key is used by which deployment.
In hindsight maybe name is redundant here. It provides human readable description but maybe it is overcomplicating key management process more then it improves it.

ssncferreira · 2026-05-25T10:58:26Z

+	ResourceTypeAISeat             ResourceType = "ai_seat"
+	ResourceTypeAIProvider         ResourceType = "ai_provider"
+	ResourceTypeAIProviderKey      ResourceType = "ai_provider_key"
+	ResourceTypeAIGatewayCoderdKey ResourceType = "ai_gateway_coderd_key"


nit: remove coderd to be easier to read and consistent with provider key?

Suggested change

ResourceTypeAIGatewayCoderdKey ResourceType = "ai_gateway_coderd_key"

ResourceTypeAIGatewayKey ResourceType = "ai_gateway_key"

Naming is not the best but I don't have good idea.

Problem is that Keyis very overloaded word in AI Gateway context. When I read KeyI first think about provider keys or BYOK.
Maybe this is far fetched since provider keys have descriptive name ResourceTypeAIProviderKey.
Specifying Coderdat least notes that this is related to Coderd. Still it doesn't explain well what it is used for. JustAuthKeywould also be confusing. Auth to what?
AIGatewayCoderdAuthKey seems too long? Or maybe not and would be better?
Credentials have similar issue as Key and doens't match naming used by provisioners.

Emyrk

Gateway keys are deployment wide, correct?

pawbana · 2026-05-27T16:29:09Z

Gateway keys are deployment wide, correct?

Yes. There may be organization scoped keys in the future but no plans right now.

ssncferreira

LGTM

…g CONSTRAINT

github-actions Bot assigned pawbana May 21, 2026

This was referenced May 21, 2026

feat: add DB queries for ai_gateway_coderd_keys #25564

Merged

feat: add AI Gateway coderd key CRUD endpoints #25565

Open

pawbana force-pushed the pb/gateway-multi-replica-key-auth-db branch 2 times, most recently from 3248cc3 to 056ea4d Compare May 21, 2026 13:30

coder-agents-review Bot suggested changes May 21, 2026

View reviewed changes

pawbana changed the title ~~feat: add aibridge_coderd_keys table and related RBAC~~ feat: add ai_gateway_coderd_keys table and related RBAC May 21, 2026

pawbana force-pushed the pb/gateway-multi-replica-key-auth-db branch 2 times, most recently from ea066e6 to 3c2624b Compare May 21, 2026 15:57

coder-agents-review Bot reviewed May 21, 2026

View reviewed changes

Comment thread coderd/database/migrations/000506_ai_gateway_coderd_keys.up.sql Outdated

pawbana force-pushed the pb/gateway-multi-replica-key-auth-db branch from 3c2624b to ca08383 Compare May 21, 2026 16:47

coder-agents-review Bot approved these changes May 21, 2026

View reviewed changes

pawbana requested a review from ssncferreira May 21, 2026 17:38

pawbana marked this pull request as ready for review May 21, 2026 17:38

pawbana requested a review from Emyrk as a code owner May 21, 2026 17:38

pawbana force-pushed the pb/gateway-multi-replica-key-auth-db branch 4 times, most recently from 79e7499 to 35bc8d3 Compare May 22, 2026 22:17

ssncferreira approved these changes May 25, 2026

View reviewed changes

pawbana mentioned this pull request May 26, 2026

feat: add CLI commands to manage AI Gateway keys #25689

Draft

Emyrk reviewed May 27, 2026

View reviewed changes

pawbana force-pushed the pb/gateway-multi-replica-key-auth-db branch 3 times, most recently from a73fcbc to 8239275 Compare May 28, 2026 20:20

pawbana mentioned this pull request May 28, 2026

feat(site): add AI Gateway keys management page #25817

Draft

pawbana force-pushed the pb/gateway-multi-replica-key-auth-db branch 4 times, most recently from 13dd6ae to 1bfe3cc Compare June 1, 2026 14:47

ssncferreira approved these changes Jun 1, 2026

View reviewed changes

pawbana force-pushed the pb/gateway-multi-replica-key-auth-db branch 2 times, most recently from 37daa9f to 318ebc9 Compare June 1, 2026 18:48

pawbana added 12 commits June 2, 2026 07:04

feat: add aibridge_coderd_keys table and related RBAC

b88905b

agentic review fixes

fde455b

add fixture

a35a479

agent review 2: add name constraint

a8a3008

add length(hashed_secret) > 0 check + define secret_prefix check usin…

b0f6f85

…g CONSTRAINT

move length check into ai_gateway_coderd_keys_name_check

210c764

migration num fix

f83d48f

migration number fix 2

dd5cbf9

migration fix 3

6cdc793

rename ai_gateway_coderd_keys table to ai_gateway_keys

1752dc8

fix migration 4?

b87fe90

removde coderd infix from comment

06ad9f0

pawbana force-pushed the pb/gateway-multi-replica-key-auth-db branch from 318ebc9 to 06ad9f0 Compare June 2, 2026 07:06

pawbana merged commit f22d4e2 into main Jun 2, 2026
29 of 31 checks passed

pawbana deleted the pb/gateway-multi-replica-key-auth-db branch June 2, 2026 07:28

github-actions Bot locked and limited conversation to collaborators Jun 2, 2026

	case database.AiGatewayCoderdKey:
	case database.AIGatewayCoderdKey:

	ResourceTypeAIGatewayCoderdKey ResourceType = "ai_gateway_coderd_key"
	ResourceTypeAIGatewayKey ResourceType = "ai_gateway_key"

Conversation

pawbana commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 21, 2026

Docs preview

Uh oh!

pawbana commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pawbana commented May 21, 2026

Uh oh!

coder-agents-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

pawbana commented May 21, 2026

Uh oh!

coder-agents-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

pawbana commented May 21, 2026

Uh oh!

coder-agents-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pawbana commented May 21, 2026

Uh oh!

coder-agents-review Bot left a comment

Choose a reason for hiding this comment

Uh oh!

ssncferreira left a comment

Choose a reason for hiding this comment

Uh oh!

ssncferreira May 25, 2026

Choose a reason for hiding this comment

Uh oh!

ssncferreira May 25, 2026

Choose a reason for hiding this comment

Uh oh!

pawbana May 26, 2026

Choose a reason for hiding this comment

Uh oh!

ssncferreira May 25, 2026

Choose a reason for hiding this comment

Uh oh!

pawbana May 26, 2026

Choose a reason for hiding this comment

Uh oh!

ssncferreira May 25, 2026

Choose a reason for hiding this comment

Uh oh!

pawbana May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Emyrk left a comment

Choose a reason for hiding this comment

Uh oh!

pawbana commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ssncferreira left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

pawbana commented May 21, 2026 •

edited

Loading

pawbana commented May 21, 2026 •

edited

Loading

pawbana May 26, 2026 •

edited

Loading

pawbana commented May 27, 2026 •

edited

Loading