GeezerVison

Copy link

Copy Markdown

Contributor

SasSwart added this pull request to stack #31264 October 26, 2026 12:00

SasSwart force-pushed the sas/aigov-716-org-prices branch from bd1d0bb to 6bc1f5a Compare October 28, 2026 08:35

SasSwart force-pushed the sas/aigov-716-org-prices branch from 6bc1f5a to 26f644d Compare October 28, 2026 08:52

SasSwart requested a review from ssncferreira October 28, 2026 08:58

SasSwart marked this pull request as ready for review October 28, 2026 08:58

SasSwart force-pushed the sas/aigov-716-org-prices branch 2 times, most recently from 4a2e92c to 58b33a3 Compare October 28, 2026 13:25

SasSwart force-pushed the sas/aigov-716-org-prices branch from 58b33a3 to ca4dd58 Compare October 29, 2026 10:14

mtojek approved these changes Oct 29, 2026

View reviewed changes

SasSwart force-pushed the sas/aigov-716-org-prices branch from ca4dd58 to 235e6f1 Compare October 30, 2026 11:20

27 checks passed

SasSwart deleted the sas/aigov-716-org-prices branch October 30, 2026 11:35

…1/2) (#31120)

`IsAuthorized` resolves the workspace organization, but uses it only to
reject requests; nothing downstream reads it. The budget check and cost
each resolve the group site-wide, so a user working in an org B
workspace can be billed in org A, and no interception records its
organization.

Resolve the request organization once, in `IsAuthorized`. A workspace
session token resolves to the workspace's organization (source
`workspace`). Any other request, including chatd requests until
AIGOV-713, resolves to the organization of the user's site-wide
effective group (source `effective_group`). Return the source in
`IsAuthorizedResponse`.

Have aibridged pass the organization to `IsBudgetExceeded`, which
resolves the budget inside it, and stamp the organization and source on
`RecordInterception`. Resolve cost's effective group inside the
organization stored on the interception. When there is no organization,
behave site-wide as before.

Move `resolveOrganization` and the workspace checks into
`orgresolver.go`, and leave a slot for the chat organization
(AIGOV-713). Bump the aibridged API to v1.6, adding
`IsAuthorizedResponse.organization_source` and
`IsBudgetExceededRequest.organization_id`.

aibridged checks only the shape of the organization (both fields or
neither, and a valid non-nil UUID), not the source value. That lets a
newer coderd add a source without breaking older gateways.

Behaviour changes to review:

- Spend follows the workspace's organization. A user whose budgets are
all in org A has no limit in an org B workspace if B has none.
- A database error while resolving the organization now returns 403 from
`IsAuthorized`, instead of 500 from `IsBudgetExceeded`.
- Requests without a workspace make up to three extra budget queries in
`IsAuthorized`.
- The user spend status endpoint (`GET /api/v2/users/{user}/ai/spend`)
stays site-wide, so it can disagree with where a request was charged.

The org-aware price lookup follows in #31121.

Part of AIGOV-716. Stacked on #31119.

---

*This PR was generated by Coder Agents on behalf of @SasSwart.*