Oct 21, 2025 · Oct 21, 2025 · Oct 21, 2025
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
 return q.db.CleanTailnetTunnels(ctx)
 }

 func (q *querier) CountAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams) (int64, error) {
 prep, err := prepareSQLFilter(ctx, q.auth, policy.ActionRead, rbac.ResourceAibridgeInterception.Type)
 if err != nil {
 return 0, xerrors.Errorf("(dev error) prepare sql filter: %w", err)
 }
 return q.db.CountAuthorizedAIBridgeInterceptions(ctx, arg, prep)
 }

 func (q *querier) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) {
 // Shortcut if the user is an owner. The SQL filter is noticeable,
 // and this is an easy win for owners. Which is the common case.
 // database.Store interface, so dbauthz needs to implement it.
 return q.ListAIBridgeInterceptions(ctx, arg)
 }

 func (q *querier) CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams, _ rbac.PreparedAuthorized) (int64, error) {
 // TODO: Delete this function, all CountAIBridgeInterceptions should be authorized. For now just call CountAIBridgeInterceptions on the authz querier.
 // This cannot be deleted for now because it's included in the
 // database.Store interface, so dbauthz needs to implement it.
 return q.CountAIBridgeInterceptions(ctx, arg)
 }
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
 check.Args(params, emptyPreparedAuthorized{}).Asserts()
 }))

 s.Run("CountAIBridgeInterceptions", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 params := database.CountAIBridgeInterceptionsParams{}
 db.EXPECT().CountAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return(int64(0), nil).AnyTimes()
 // No asserts here because SQLFilter.
 check.Args(params).Asserts()
 }))

 s.Run("CountAuthorizedAIBridgeInterceptions", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 params := database.CountAIBridgeInterceptionsParams{}
 db.EXPECT().CountAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return(int64(0), nil).AnyTimes()
 // No asserts here because SQLFilter.
 check.Args(params, emptyPreparedAuthorized{}).Asserts()
 }))

 s.Run("ListAIBridgeTokenUsagesByInterceptionIDs", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 ids := []uuid.UUID{{1}}
 db.EXPECT().ListAIBridgeTokenUsagesByInterceptionIDs(gomock.Any(), ids).Return([]database.AIBridgeTokenUsage{}, nil).AnyTimes()
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go

 type aibridgeQuerier interface {
 ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]AIBridgeInterception, error)
 CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg CountAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) (int64, error)
 }

 func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]AIBridgeInterception, error) {
 arg.Provider,
 arg.Model,
 arg.AfterID,
 arg.Offset,
 arg.Limit,
 )
 if err != nil {
 return items, nil
 }

 func (q *sqlQuerier) CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg CountAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) (int64, error) {
 authorizedFilter, err := prepared.CompileToSQL(ctx, regosql.ConvertConfig{
 VariableConverter: regosql.AIBridgeInterceptionConverter(),
 })
 if err != nil {
 return 0, xerrors.Errorf("compile authorized filter: %w", err)
 }
 filtered, err := insertAuthorizedFilter(countAIBridgeInterceptions, fmt.Sprintf(" AND %s", authorizedFilter))
 if err != nil {
 return 0, xerrors.Errorf("insert authorized filter: %w", err)
 }

 query := fmt.Sprintf("-- name: CountAuthorizedAIBridgeInterceptions :one\n%s", filtered)
 rows, err := q.db.QueryContext(ctx, query,
 arg.StartedAfter,
 arg.StartedBefore,
 arg.InitiatorID,
 arg.Provider,
 arg.Model,
 )
 if err != nil {
 return 0, err
 }
 defer rows.Close()
 var count int64
 for rows.Next() {
 if err := rows.Scan(&count); err != nil {
 return 0, err
 }
 }
 if err := rows.Close(); err != nil {
 return 0, err
 }
 if err := rows.Err(); err != nil {
 return 0, err
 }
 return count, nil
 }

 func insertAuthorizedFilter(query string, replaceWith string) (string, error) {
 if !strings.Contains(query, authorizedQueryPlaceholder) {
 return "", xerrors.Errorf("query does not contain authorized replace string, this is not an authorized query")
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
diff --git a/coderd/database/queries/aibridge.sql b/coderd/database/queries/aibridge.sql
 created_at ASC,
 id ASC;

 -- name: CountAIBridgeInterceptions :one
 SELECT
 COUNT(*)
 FROM
 aibridge_interceptions
 WHERE
 -- Filter by time frame
 CASE
 WHEN @started_after::timestamptz != '0001-01-01 00:00:00+00'::timestamptz THEN aibridge_interceptions.started_at >= @started_after::timestamptz
 ELSE true
 END
 AND CASE
 WHEN @started_before::timestamptz != '0001-01-01 00:00:00+00'::timestamptz THEN aibridge_interceptions.started_at <= @started_before::timestamptz
 ELSE true
 END
 -- Filter initiator_id
 AND CASE
 WHEN @initiator_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN aibridge_interceptions.initiator_id = @initiator_id::uuid
 ELSE true
 END
 -- Filter provider
 AND CASE
 WHEN @provider::text != '' THEN aibridge_interceptions.provider = @provider::text
 ELSE true
 END
 -- Filter model
 AND CASE
 WHEN @model::text != '' THEN aibridge_interceptions.model = @model::text
 ELSE true
 END
 -- Authorize Filter clause will be injected below in ListAuthorizedAIBridgeInterceptions
 -- @authorize_filter
 ;

 -- name: ListAIBridgeInterceptions :many
 SELECT
 *
 aibridge_interceptions.started_at DESC,
 aibridge_interceptions.id DESC
 LIMIT COALESCE(NULLIF(@limit_::integer, 0), 100)
 OFFSET @offset_
 ;

 -- name: ListAIBridgeTokenUsagesByInterceptionIDs :many
diff --git a/coderd/searchquery/search.go b/coderd/searchquery/search.go
 AfterID: page.AfterID,
 // #nosec G115 - Safe conversion for pagination limit which is expected to be within int32 range
 Limit: int32(page.Limit),
 // #nosec G115 - Safe conversion for pagination offset which is expected to be within int32 range
 Offset: int32(page.Offset),
 }

 if query == "" {

 values, errors := searchTerms(query, func(term string, values url.Values) error {
 // Default to the initiating user
 values.Add("user", term)
 values.Add("initiator", term)
 return nil
 })
 if len(errors) > 0 {
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1436,6 +1436,14 @@ func (q *querier) CleanTailnetTunnels(ctx context.Context) error {
		return q.db.CleanTailnetTunnels(ctx)
		}

		func (q *querier) CountAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams) (int64, error) {
		prep, err := prepareSQLFilter(ctx, q.auth, policy.ActionRead, rbac.ResourceAibridgeInterception.Type)
		if err != nil {
		return 0, xerrors.Errorf("(dev error) prepare sql filter: %w", err)
		}
		return q.db.CountAuthorizedAIBridgeInterceptions(ctx, arg, prep)
		}

		func (q *querier) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) {
		// Shortcut if the user is an owner. The SQL filter is noticeable,
		// and this is an easy win for owners. Which is the common case.
Expand DownExpand Up		@@ -5868,3 +5876,10 @@ func (q *querier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg d
		// database.Store interface, so dbauthz needs to implement it.
		return q.ListAIBridgeInterceptions(ctx, arg)
		}

		func (q *querier) CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams, _ rbac.PreparedAuthorized) (int64, error) {
		// TODO: Delete this function, all CountAIBridgeInterceptions should be authorized. For now just call CountAIBridgeInterceptions on the authz querier.
		// This cannot be deleted for now because it's included in the
		// database.Store interface, so dbauthz needs to implement it.
		return q.CountAIBridgeInterceptions(ctx, arg)
		}
Original file line number	Diff line number	Diff line change
Expand Up		@@ -4549,6 +4549,20 @@ func (s *MethodTestSuite) TestAIBridge() {
		check.Args(params, emptyPreparedAuthorized{}).Asserts()
		}))

		s.Run("CountAIBridgeInterceptions", s.Mocked(func(db dbmock.MockStore, faker gofakeit.Faker, check *expects) {
		params := database.CountAIBridgeInterceptionsParams{}
		db.EXPECT().CountAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return(int64(0), nil).AnyTimes()
		// No asserts here because SQLFilter.
		check.Args(params).Asserts()
		}))

		s.Run("CountAuthorizedAIBridgeInterceptions", s.Mocked(func(db dbmock.MockStore, faker gofakeit.Faker, check *expects) {
		params := database.CountAIBridgeInterceptionsParams{}
		db.EXPECT().CountAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return(int64(0), nil).AnyTimes()
		// No asserts here because SQLFilter.
		check.Args(params, emptyPreparedAuthorized{}).Asserts()
		}))

		s.Run("ListAIBridgeTokenUsagesByInterceptionIDs", s.Mocked(func(db dbmock.MockStore, faker gofakeit.Faker, check *expects) {
		ids := []uuid.UUID{{1}}
		db.EXPECT().ListAIBridgeTokenUsagesByInterceptionIDs(gomock.Any(), ids).Return([]database.AIBridgeTokenUsage{}, nil).AnyTimes()
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -764,6 +764,7 @@ func (q *sqlQuerier) CountAuthorizedConnectionLogs(ctx context.Context, arg Coun

		type aibridgeQuerier interface {
		ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]AIBridgeInterception, error)
		CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg CountAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) (int64, error)
		}

		func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]AIBridgeInterception, error) {
Expand All		@@ -786,6 +787,7 @@ func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, ar
		arg.Provider,
		arg.Model,
		arg.AfterID,
		arg.Offset,
		arg.Limit,
		)
		if err != nil {
Expand DownExpand Up		@@ -816,6 +818,45 @@ func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, ar
		return items, nil
		}

		func (q *sqlQuerier) CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg CountAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) (int64, error) {
		authorizedFilter, err := prepared.CompileToSQL(ctx, regosql.ConvertConfig{
		VariableConverter: regosql.AIBridgeInterceptionConverter(),
		})
		if err != nil {
		return 0, xerrors.Errorf("compile authorized filter: %w", err)
		}
		filtered, err := insertAuthorizedFilter(countAIBridgeInterceptions, fmt.Sprintf(" AND %s", authorizedFilter))
		if err != nil {
		return 0, xerrors.Errorf("insert authorized filter: %w", err)
		}

		query := fmt.Sprintf("-- name: CountAuthorizedAIBridgeInterceptions :one\n%s", filtered)
		rows, err := q.db.QueryContext(ctx, query,
		arg.StartedAfter,
		arg.StartedBefore,
		arg.InitiatorID,
		arg.Provider,
		arg.Model,
		)
		if err != nil {
		return 0, err
		}
		defer rows.Close()
		var count int64
		for rows.Next() {
		if err := rows.Scan(&count); err != nil {
		return 0, err
		}
		}
		if err := rows.Close(); err != nil {
		return 0, err
		}
		if err := rows.Err(); err != nil {
		return 0, err
		}
		return count, nil
		}

		func insertAuthorizedFilter(query string, replaceWith string) (string, error) {
		if !strings.Contains(query, authorizedQueryPlaceholder) {
		return "", xerrors.Errorf("query does not contain authorized replace string, this is not an authorized query")
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -75,6 +75,40 @@ ORDER BY
		created_at ASC,
		id ASC;

		-- name: CountAIBridgeInterceptions :one
		SELECT
		COUNT(*)
		FROM
		aibridge_interceptions
		WHERE
		-- Filter by time frame
		CASE
		WHEN @started_after::timestamptz != '0001-01-01 00:00:00+00'::timestamptz THEN aibridge_interceptions.started_at >= @started_after::timestamptz
		ELSE true
		END
		AND CASE
		WHEN @started_before::timestamptz != '0001-01-01 00:00:00+00'::timestamptz THEN aibridge_interceptions.started_at <= @started_before::timestamptz
		ELSE true
		END
		-- Filter initiator_id
		AND CASE
		WHEN @initiator_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN aibridge_interceptions.initiator_id = @initiator_id::uuid
		ELSE true
		END
		-- Filter provider
		AND CASE
		WHEN @provider::text != '' THEN aibridge_interceptions.provider = @provider::text
		ELSE true
		END
		-- Filter model
		AND CASE
		WHEN @model::text != '' THEN aibridge_interceptions.model = @model::text
		ELSE true
		END
		-- Authorize Filter clause will be injected below in ListAuthorizedAIBridgeInterceptions
		-- @authorize_filter
		;

		-- name: ListAIBridgeInterceptions :many
		SELECT
		*
Expand DownExpand Up		@@ -127,6 +161,7 @@ ORDER BY
		aibridge_interceptions.started_at DESC,
		aibridge_interceptions.id DESC
		LIMIT COALESCE(NULLIF(@limit_::integer, 0), 100)
		OFFSET @offset_
		;

		-- name: ListAIBridgeTokenUsagesByInterceptionIDs :many
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -355,6 +355,8 @@ func AIBridgeInterceptions(ctx context.Context, db database.Store, query string,
		AfterID: page.AfterID,
		// #nosec G115 - Safe conversion for pagination limit which is expected to be within int32 range
		Limit: int32(page.Limit),
		// #nosec G115 - Safe conversion for pagination offset which is expected to be within int32 range
		Offset: int32(page.Offset),
		}

		if query == "" {
Expand All		@@ -363,7 +365,7 @@ func AIBridgeInterceptions(ctx context.Context, db database.Store, query string,

		values, errors := searchTerms(query, func(term string, values url.Values) error {
		// Default to the initiating user
		values.Add("user", term)
		values.Add("initiator", term)
		return nil
		})
		if len(errors) > 0 {
Expand Down