Skip to content

feat: add synthetic gateway keys#27170

Draft
ibetitsmike wants to merge 1 commit into
mainfrom
mike/chat-synthetic-keys/synthetic-keys
Draft

feat: add synthetic gateway keys#27170
ibetitsmike wants to merge 1 commit into
mainfrom
mike/chat-synthetic-keys/synthetic-keys

Conversation

@ibetitsmike

@ibetitsmike ibetitsmike commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Mux is working on behalf of Mike.

Summary

Add a per-user synthetic API key for chatd AI Gateway attribution. Chatd resolves the key from the chat owner, renews it before expiry, discards the generated bearer token, and preserves the previous key during renewal so in-flight requests remain valid.

Migration 000543 deliberately removes the foreign keys from the legacy message and queue api_key_id columns while chatd continues stamping them for rolling compatibility. Stale IDs are tolerated because routing uses chats.owner_id. Individual key deletion, delete-all, and password reset remove the key and mapping without changing chat history or queue versions, and the next lookup remints the key.

This is the first PR in a three-PR rollout and must be fully deployed before #27171.

Refs https://linear.app/codercom/issue/CODAGT-561/maintain-synthetic-api-key-per-user-per-chat

@ibetitsmike Graphite App

ibetitsmike commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

This was referenced Jul 10, 2026
Draft
Draft
@ibetitsmike

ibetitsmike commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator Author

@codex review

@ibetitsmike

ibetitsmike commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator Author

Mux is working on behalf of Mike.

Dogfood UAT passed for the full three-PR stack.

PR1 coverage:

  • Completed a real Agents UI chat through the configured Anthropic-compatible provider.
  • Verified the owner mapping, 30-day key expiry, owner login type, and AI Gateway interception attribution.
  • Verified create, send, queue, promotion, edit, compaction, and manual-title compatibility writes.
  • Deleted an ordinary session key during an active generation. The chat completed without a fence failure, wedge, lost response, or deletion-time history mutation.
  • Forced renewal inside the 24-hour margin and verified the old key remained valid.
  • Deleted the mapped synthetic key and verified cascade cleanup plus remint on the next turn.
  • Verified a suspended user session is rejected with HTTP 401.

The same preserved database was then migrated through #27171 and #27172 successfully. A full OAuth2 authorization-code refresh was not run manually, but the equivalent active-generation key deletion was exercised deterministically.

@ibetitsmike ibetitsmike changed the title feat(coderd/x/chatd): add synthetic gateway keys feat: add synthetic gateway keys Jul 10, 2026
@linear-code

linear-code Bot commented Jul 10, 2026

Copy link
Copy Markdown

CODAGT-561

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Jul 10, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: dbede83294

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread coderd/x/chatd/chatd.go
@ibetitsmike ibetitsmike force-pushed the mike/chat-synthetic-keys/synthetic-keys branch from dbede83 to edea7df Compare July 10, 2026 18:21
@ibetitsmike

ibetitsmike commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Jul 10, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: edea7df60f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@ibetitsmike ibetitsmike force-pushed the mike/chat-synthetic-keys/synthetic-keys branch from edea7df to ab1009d Compare July 10, 2026 19:01
@ibetitsmike ibetitsmike force-pushed the mike/chat-synthetic-keys/synthetic-keys branch from ab1009d to 500b588 Compare July 10, 2026 19:37
@ibetitsmike

ibetitsmike commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Jul 10, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 500b588185

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@ibetitsmike

ibetitsmike commented Jul 10, 2026

Copy link
Copy Markdown
Collaborator Author

Mux is working on behalf of Mike.

Final-stack targeted dogfood passed after the FK-decoupling fix.

  • PR1 head 500b588185: both legacy API-key FKs were absent. Deleting the mapped synthetic key during an active generation left history_version, queue_version, and generation_attempt unchanged at deletion time. The generation completed normally, compatibility text IDs remained, and the next turn reminted a new synthetic key.
  • PR2 head 21f726957a: the preserved PR1 chat loaded, a new FINAL-PR2 chat completed, legacy columns remained nullable and unwritten, and the FKs remained absent.
  • PR3 head 2de350aa78: preserved PR1 and PR2 chats loaded, a new FINAL-PR3 chat completed, and the legacy columns and FKs were absent.

This supplements the earlier full UI/API/database UAT and validates the final rewritten stack heads.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@Emyrk Emyrk Awaiting requested review from Emyrk Emyrk will be requested when the pull request is marked ready for review Emyrk is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

@ibetitsmike ibetitsmike

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ibetitsmike