coder · johnstcn · Apr 13, 2026 · Mar 30, 2026 · Mar 30, 2026 · Mar 30, 2026
diff --git a/.gitignore b/.gitignore
@@ -103,6 +103,6 @@ PLAN.md
 
 # Ignore any dev licenses
 license.txt
--e 
+
 # Agent planning documents (local working files).
 docs/plans/
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
@@ -1550,6 +1550,7 @@ func Chat(c database.Chat, diffStatus *database.ChatDiffStatus, files []database
 	}
 	chat := codersdk.Chat{
 		ID:                c.ID,
+		OrganizationID:    c.OrganizationID,
 		OwnerID:           c.OwnerID,
 		LastModelConfigID: c.LastModelConfigID,
 		Title:             c.Title,

diff --git a/coderd/database/db2sdk/db2sdk_test.go b/coderd/database/db2sdk/db2sdk_test.go
@@ -530,6 +530,7 @@ func TestChat_AllFieldsPopulated(t *testing.T) {
 	input := database.Chat{
 		ID:                uuid.New(),
 		OwnerID:           uuid.New(),
+		OrganizationID:    uuid.New(),
 		WorkspaceID:       uuid.NullUUID{UUID: uuid.New(), Valid: true},
 		BuildID:           uuid.NullUUID{UUID: uuid.New(), Valid: true},
 		AgentID:           uuid.NullUUID{UUID: uuid.New(), Valid: true},

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -4846,7 +4846,7 @@ func (q *querier) InsertAuditLog(ctx context.Context, arg database.InsertAuditLo
 }
 
 func (q *querier) InsertChat(ctx context.Context, arg database.InsertChatParams) (database.Chat, error) {
-	return insert(q.log, q.auth, rbac.ResourceChat.WithOwner(arg.OwnerID.String()), q.db.InsertChat)(ctx, arg)
+	return insert(q.log, q.auth, rbac.ResourceChat.WithOwner(arg.OwnerID.String()).InOrg(arg.OrganizationID), q.db.InsertChat)(ctx, arg)
 }
 
 func (q *querier) InsertChatFile(ctx context.Context, arg database.InsertChatFileParams) (database.InsertChatFileRow, error) {

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -783,7 +783,7 @@ func (s *MethodTestSuite) TestChats() {
 		})
 		chat := testutil.Fake(s.T(), faker, database.Chat{OwnerID: arg.OwnerID})
 		dbm.EXPECT().InsertChat(gomock.Any(), arg).Return(chat, nil).AnyTimes()
-		check.Args(arg).Asserts(rbac.ResourceChat.WithOwner(arg.OwnerID.String()), policy.ActionCreate).Returns(chat)
+		check.Args(arg).Asserts(rbac.ResourceChat.WithOwner(arg.OwnerID.String()).InOrg(arg.OrganizationID), policy.ActionCreate).Returns(chat)
 	}))
 	s.Run("InsertChatFile", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		arg := testutil.Fake(s.T(), faker, database.InsertChatFileParams{})

diff --git a/coderd/database/dbpurge/dbpurge_test.go b/coderd/database/dbpurge/dbpurge_test.go
@@ -1670,9 +1670,10 @@ func TestDeleteOldChatFiles(t *testing.T) {
 
 	// createChat inserts a chat and optionally archives it, then
 	// backdates updated_at to control the "archived since" window.
-	createChat := func(ctx context.Context, t *testing.T, db database.Store, rawDB *sql.DB, ownerID, modelConfigID uuid.UUID, archived bool, updatedAt time.Time) database.Chat {
+	createChat := func(ctx context.Context, t *testing.T, db database.Store, rawDB *sql.DB, ownerID, orgID, modelConfigID uuid.UUID, archived bool, updatedAt time.Time) database.Chat {
 		t.Helper()
 		chat, err := db.InsertChat(ctx, database.InsertChatParams{
+			OrganizationID:    orgID,
 			OwnerID:           ownerID,
 			LastModelConfigID: modelConfigID,
 			Title:             "test-chat",
@@ -1736,7 +1737,7 @@ func TestDeleteOldChatFiles(t *testing.T) {
 				require.NoError(t, err)
 
 				// Create an old archived chat and an orphaned old file.
-				oldChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
+				oldChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
 				oldFileID := createChatFile(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, now.Add(-31*24*time.Hour))
 
 				done := awaitDoTick(ctx, t, clk)
@@ -1766,7 +1767,7 @@ func TestDeleteOldChatFiles(t *testing.T) {
 				require.NoError(t, err)
 
 				// Old archived chat (31 days) — should be deleted.
-				oldChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
+				oldChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
 				// Insert a message so we can verify CASCADE.
 				_, err = db.InsertChatMessages(ctx, database.InsertChatMessagesParams{
 					ChatID:              oldChat.ID,
@@ -1791,10 +1792,10 @@ func TestDeleteOldChatFiles(t *testing.T) {
 				require.NoError(t, err)
 
 				// Recently archived chat (10 days) — should be retained.
-				recentChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, true, now.Add(-10*24*time.Hour))
+				recentChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, true, now.Add(-10*24*time.Hour))
 
 				// Active chat — should be retained.
-				activeChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, false, now)
+				activeChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, false, now)
 
 				done := awaitDoTick(ctx, t, clk)
 				closer := dbpurge.New(ctx, logger, db, &codersdk.DeploymentValues{}, clk, prometheus.NewRegistry())
@@ -1839,7 +1840,7 @@ func TestDeleteOldChatFiles(t *testing.T) {
 
 				// File B: 31 days old, in an active chat -> should be retained.
 				fileB := createChatFile(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, now.Add(-31*24*time.Hour))
-				activeChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, false, now)
+				activeChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, false, now)
 				_, err = db.LinkChatFiles(ctx, database.LinkChatFilesParams{
 					ChatID:       activeChat.ID,
 					MaxFileLinks: 100,
@@ -1887,7 +1888,7 @@ func TestDeleteOldChatFiles(t *testing.T) {
 
 				// File D: 31 days old, in a chat archived 31 days ago -> should be deleted.
 				fileD := createChatFile(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, now.Add(-31*24*time.Hour))
-				oldArchivedChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
+				oldArchivedChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
 				_, err = db.LinkChatFiles(ctx, database.LinkChatFilesParams{
 					ChatID:       oldArchivedChat.ID,
 					MaxFileLinks: 100,
@@ -1901,7 +1902,7 @@ func TestDeleteOldChatFiles(t *testing.T) {
 
 				// File E: 31 days old, in a chat archived 10 days ago -> should be retained.
 				fileE := createChatFile(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, now.Add(-31*24*time.Hour))
-				recentArchivedChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, true, now.Add(-10*24*time.Hour))
+				recentArchivedChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, true, now.Add(-10*24*time.Hour))
 				_, err = db.LinkChatFiles(ctx, database.LinkChatFilesParams{
 					ChatID:       recentArchivedChat.ID,
 					MaxFileLinks: 100,
@@ -1914,7 +1915,7 @@ func TestDeleteOldChatFiles(t *testing.T) {
 
 				// File F: 31 days old, in BOTH an active chat AND an old archived chat -> should be retained.
 				fileF := createChatFile(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, now.Add(-31*24*time.Hour))
-				anotherOldArchivedChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
+				anotherOldArchivedChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
 				_, err = db.LinkChatFiles(ctx, database.LinkChatFilesParams{
 					ChatID:       anotherOldArchivedChat.ID,
 					MaxFileLinks: 100,
@@ -1925,7 +1926,7 @@ func TestDeleteOldChatFiles(t *testing.T) {
 					now.Add(-31*24*time.Hour), anotherOldArchivedChat.ID)
 				require.NoError(t, err)
 
-				activeChatForF := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, false, now)
+				activeChatForF := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, false, now)
 				_, err = db.LinkChatFiles(ctx, database.LinkChatFilesParams{
 					ChatID:       activeChatForF.ID,
 					MaxFileLinks: 100,
@@ -1964,7 +1965,7 @@ func TestDeleteOldChatFiles(t *testing.T) {
 				fileB := createChatFile(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, now)
 				fileC := createChatFile(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, now)
 
-				chat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, false, now)
+				chat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, false, now)
 				_, err := db.LinkChatFiles(ctx, database.LinkChatFilesParams{
 					ChatID:       chat.ID,
 					MaxFileLinks: 100,
@@ -2009,14 +2010,16 @@ func TestDeleteOldChatFiles(t *testing.T) {
 				// Test parent+child cascade: deleting files should
 				// clean up links for both parent and child chats
 				// independently via FK cascade.
-				parentChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, false, now)
+				parentChat := createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, false, now)
 				childChat, err := db.InsertChat(ctx, database.InsertChatParams{
+					OrganizationID:    deps.org.ID,
 					OwnerID:           deps.user.ID,
 					LastModelConfigID: deps.modelConfig.ID,
 					Title:             "child-chat",
 					Status:            database.ChatStatusWaiting,
 				})
 				require.NoError(t, err)
+
 				// Set root_chat_id to link child to parent.
 				_, err = rawDB.ExecContext(ctx, "UPDATE chats SET root_chat_id = $1 WHERE id = $2", parentChat.ID, childChat.ID)
 				require.NoError(t, err)
@@ -2104,7 +2107,7 @@ func TestDeleteOldChatFiles(t *testing.T) {
 
 				// Create 3 deletable old archived chats.
 				for range 3 {
-					createChat(ctx, t, db, rawDB, deps.user.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
+					createChat(ctx, t, db, rawDB, deps.user.ID, deps.org.ID, deps.modelConfig.ID, true, now.Add(-31*24*time.Hour))
 				}
 
 				// Delete with limit 2 — should delete 2, leave 1.

diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/foreign_key_constraint.go b/coderd/database/foreign_key_constraint.go
diff --git a/coderd/database/migrations/000467_chat_organization_id.down.sql b/coderd/database/migrations/000467_chat_organization_id.down.sql
@@ -0,0 +1 @@
+ALTER TABLE chats DROP COLUMN organization_id;
diff --git a/coderd/database/migrations/000467_chat_organization_id.up.sql b/coderd/database/migrations/000467_chat_organization_id.up.sql
@@ -0,0 +1,20 @@
+-- Step 1: Add nullable column with FK.
+ALTER TABLE chats
+    ADD COLUMN organization_id UUID REFERENCES organizations(id) ON DELETE CASCADE;
+
+-- Step 2: Backfill from workspace org (primary path). Fall back to
+-- user's oldest org membership, then default org for rows where
+-- workspace_id was NULLed out by ON DELETE SET NULL or never set.
+UPDATE chats c
+SET organization_id = COALESCE(
+    (SELECT w.organization_id FROM workspaces w WHERE w.id = c.workspace_id),
+    (SELECT om.organization_id FROM organization_members om
+     WHERE om.user_id = c.owner_id ORDER BY om.created_at ASC LIMIT 1),
+    (SELECT id FROM organizations WHERE is_default = true LIMIT 1)
+);
+
+-- Step 3: Enforce NOT NULL going forward.
+ALTER TABLE chats ALTER COLUMN organization_id SET NOT NULL;
+
+-- Step 4: Index for efficient lookups by organization.
+CREATE INDEX idx_chats_organization_id ON chats (organization_id);
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
@@ -176,7 +176,7 @@ func (t Task) RBACObject() rbac.Object {
 }
 
 func (c Chat) RBACObject() rbac.Object {
-	return rbac.ResourceChat.WithID(c.ID).WithOwner(c.OwnerID.String())
+	return rbac.ResourceChat.WithID(c.ID).WithOwner(c.OwnerID.String()).InOrg(c.OrganizationID)
 }
 
 func (r GetChatsRow) RBACObject() rbac.Object {

diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
@@ -799,6 +799,7 @@ func (q *sqlQuerier) GetAuthorizedChats(ctx context.Context, arg GetChatsParams,
 			&i.Chat.LastReadMessageID,
 			&i.Chat.LastInjectedContext,
 			&i.Chat.DynamicTools,
+			&i.Chat.OrganizationID,
 			&i.HasUnread); err != nil {
 			return nil, err
 		}

diff --git a/coderd/database/models.go b/coderd/database/models.go