feat: remove legacy chat provider tables - #25416

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 54272617fd

The migration structure is solid: CHECK constraint before table drops, 410 stubs for removed endpoints, cache invalidation wired up, and the coderdtest helpers properly updated. The active tests (TestListChatModels, TestCreateChatModelConfig, etc.) were rewritten against AI provider APIs with a shared createAIProviderForTest helper.

Severity count: 2 P2, 8 P3, posted below.

The two P2s are both latent correctness/performance issues introduced by the key-resolution refactor. The type-keyed ProviderAPIKeys map silently overwrites credentials when two AI providers share a type (newly allowed since ai_providers has no UNIQUE on type). The N+1 query pattern per chat turn is a measurable regression from the old inline-key model.

Pattern worth noting: the removal is incomplete in three parallel ways. Five test functions are skipped but retain ~1100 lines of dead code (DEREM-3). The SDK client methods for removed APIs still compile (same root cause). A new compat shim (legacy_chat_provider_compat.go) was introduced to avoid migrating ~15 test files (DEREM-9). These are all mechanical conversions that could be completed in this PR or tracked in a ticket.

"Shall I show you what happens to audit logs when the API key doesn't match the provider the user selected? ♥" -- Hisoka

coderd/x/chatd/chatd.go:8077

P2 [DEREM-6] aiProviderConfig calls GetAIProviderKeysByProviderID per provider; every chat turn and model-list call now does N extra DB round-trips where the old code did zero. (Killua P2, Meruem P2, Mafuuu P2, Hisoka P3, Zoro P3)

Before this PR, ChatProvider rows carried the API key inline. EnabledProviders returned fully-populated rows. Conversion was zero extra queries. Now AIProvider rows have no key column; the cache returns provider rows but every consumer hits the DB N times to get keys.

The same pattern exists in configuredProviderFromAIProvider at exp_chats.go:6806. Both branches of resolveUserProviderAPIKeys (selected and non-selected) pay this cost, as does getUserChatProviderAvailability.

Fix: either cache keys alongside providers in chatConfigCache (they change on the same events), or batch-fetch all keys in one query with GetAIProviderKeys() and group by provider_id in Go. Both reduce N queries to 1.

🤖

coderd/database/queries/chatmodelconfigs.sql:136

P3 [DEREM-2] Dead query DeleteChatModelConfigsByProvider has zero runtime callers. Its only caller (deleteChatProvider) was deleted in this PR. The query definition, dbauthz wrapper, and all generated plumbing remain. (Netero)

Fix: remove the query from this file, remove the dbauthz test at dbauthz_test.go:453, and run make gen.

🤖

🤖 This review was automatically generated with Coder Agents.

Round 2 is blocked. All 11 findings from Round 1 are unresolved with no author response or code changes addressing them.

Unaddressed findings (2 P2, 8 P3, 1 Nit):

• DEREM-5 (P2): Type-keyed provider map silently overwrites credentials when two AI providers share a type
• DEREM-6 (P2): N+1 DB queries per chat turn for provider key lookups
• DEREM-1 (P3): Dead sentinel errChatProviderNotConfigured and two unreachable switch cases
• DEREM-2 (P3): Dead query DeleteChatModelConfigsByProvider has zero runtime callers
• DEREM-3 (P3): Five skipped test functions retain ~1100 lines of dead code + SDK methods not cleaned
• DEREM-4 (P3): Duplicate conversion logic with asymmetric enabled check
• DEREM-7 (P3): CHECK constraint validates existing rows without guard for orphaned configs
• DEREM-8 (P3): Fake error(nil) pattern in 16 test call sites
• DEREM-9 (P3): Legacy compat shim with no removal timeline or ticket
• DEREM-10 (P3): configuredProviderFromAIProvider returns bare errors without wrapping
• DEREM-11 (Nit): insertInternalChatProvider accepts 4 params it ignores

Further review is blocked until the author responds to or pushes fixes for the open findings. The two P2 findings (type-keyed credential collision and N+1 query regression) are the priority items.

🤖 This review was automatically generated with Coder Agents.

Round 3 is blocked (2nd consecutive). All 11 findings from Round 1 remain unresolved with no author response or code changes addressing them. New commits between rounds did not target any flagged items.

Priority items still open:

• DEREM-5 (P2): Type-keyed provider map silently overwrites credentials when two AI providers share a type
• DEREM-6 (P2): N+1 DB queries per chat turn for provider key lookups

Plus 8 P3s and 1 Nit (DEREM-1, 2, 3, 4, 7, 8, 9, 10, 11).

Further review remains blocked until the author responds to or pushes fixes for the open findings.

🤖 This review was automatically generated with Coder Agents.

Round 4 is blocked (3rd consecutive). All 11 findings from Round 1 remain unresolved with no author response or code changes addressing them. Commits between rounds are merge commits and docs changes; none target any finding.

Priority items (3 rounds without response):

• DEREM-5 (P2): Type-keyed provider map silently overwrites credentials when two AI providers share a type
• DEREM-6 (P2): N+1 DB queries per chat turn for provider key lookups

Plus 8 P3s and 1 Nit (DEREM-1, 2, 3, 4, 7, 8, 9, 10, 11).

To unblock: respond to the findings (fix, contest, or acknowledge) or push changes addressing them. Re-triggering /coder-agents-review without addressing findings will continue to produce blocked rounds.

🤖 This review was automatically generated with Coder Agents.

Round 5 is blocked. Thank you for the response on DEREM-5 and DEREM-6; those are now classified as contested and will be evaluated by the panel in the next unblocked round.

However, 9 findings (DEREM-1, 2, 3, 4, 7, 8, 9, 10, 11) remain silent. The blanket statement "treating as follow-up cleanup or already covered by downstack fixes" does not constitute per-finding engagement. For each finding, the review needs one of:

1. Fix: push a code change addressing it
2. Contest: explain why the current code is correct or acceptable (as done for DEREM-5 and DEREM-6)
3. Acknowledge: state "accepted, will not fix" with a reason
4. Defer: link a tracking ticket for follow-up

The 9 silent findings:

• DEREM-1 (P3): Dead sentinel errChatProviderNotConfigured and two unreachable switch cases
• DEREM-2 (P3): Dead query DeleteChatModelConfigsByProvider
• DEREM-3 (P3): Five skipped tests retain ~1100 lines of dead code + dead SDK methods
• DEREM-4 (P3): Duplicate conversion logic with asymmetric enabled check
• DEREM-7 (P3): CHECK constraint validates without guard for orphaned configs
• DEREM-8 (P3): Fake error(nil) pattern in 16 test call sites
• DEREM-9 (P3): Legacy compat shim with no removal timeline
• DEREM-10 (P3): Bare error return without wrapping
• DEREM-11 (Nit): Unused parameters in test helper

🤖 This review was automatically generated with Coder Agents.

Round 6 is blocked (5th consecutive). No new author engagement since Round 5. The 9 P3/Nit findings (DEREM-1, 2, 3, 4, 7, 8, 9, 10, 11) still need per-finding responses: fix, contest, acknowledge, or defer with a ticket.

DEREM-5 and DEREM-6 remain contested and will be evaluated by the panel once unblocked.

🤖 This review was automatically generated with Coder Agents.

Round 7 is blocked. Progress on the P2s: DEREM-5 is now addressed (selected provider appended last to prevent same-type overwrite, commit ab0dfc2b0). DEREM-6 remains contested.

The 9 P3/Nit findings (DEREM-1, 2, 3, 4, 7, 8, 9, 10, 11) still have no per-finding engagement. To unblock, each needs one of: fix, contest, acknowledge, or defer with ticket.

🤖 This review was automatically generated with Coder Agents.

Round 8 is blocked. No new author engagement since Round 7. DEREM-5 was fixed; DEREM-6 remains contested (pending panel). The 9 P3/Nit findings (DEREM-1, 2, 3, 4, 7, 8, 9, 10, 11) still need per-finding responses.

🤖 This review was automatically generated with Coder Agents.

Round 9 is blocked (8th consecutive). No new author engagement. DEREM-5 fixed, DEREM-6 contested (pending panel). The 9 P3/Nit findings (DEREM-1, 2, 3, 4, 7, 8, 9, 10, 11) still need per-finding responses. This is the final automated reminder; the findings and required actions have been listed in rounds 5, 6, 7, and 8.

🤖 This review was automatically generated with Coder Agents.

Round 10 is blocked (9th consecutive). No new author engagement. DEREM-5 fixed, DEREM-6 contested (pending panel). 9 P3/Nit findings remain silent.

🤖 This review was automatically generated with Coder Agents.

Round 11 is blocked, but nearly unblocked. Thank you for the per-finding responses.

Classified: DEREM-1, 3, 8, 9, 10, 11 acknowledged. DEREM-4, 7 contested (joining DEREM-6). DEREM-5 fixed.

One remaining silent finding blocks the review:

• DEREM-2 (P3): Dead query DeleteChatModelConfigsByProvider has zero runtime callers. It was omitted from your itemized response. A one-line acknowledgment (e.g. "cleanup debt, same as DEREM-1") will unblock and allow the panel to evaluate the three contested findings (DEREM-4, 6, 7).

🤖 This review was automatically generated with Coder Agents.

Round 12 is blocked on a single omission: DEREM-2 (P3, dead query DeleteChatModelConfigsByProvider). It was the only finding not listed in the per-finding response. A one-line acknowledgment (same class as DEREM-1: harmless cleanup debt) will unblock the panel review of the three contested findings (DEREM-4, 6, 7).

🤖 This review was automatically generated with Coder Agents.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e84ae0a51

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 05978c83f9

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f722ea1538

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9e533aa249

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 390a1a5587

Round 23 re-approval. Gon and Leorio included per v0.4.9 once-per-PR floor (first appearance). No P0-P2 findings from any of the 6 reviewers.

Gon and Leorio found naming consistency issues (stale "ChatProvider" naming in sentinels, function names, and constants that now reference AI providers). These are the same class as DEREM-1 (acknowledged as cleanup debt). Netero found a dead query DeleteChatModelConfigsByAIProviderID with zero runtime callers, same class as DEREM-2 (acknowledged).

All 20 prior findings remain resolved. The restructured PR (rewritten description, SDK method removal, test helper updates) is clean.

🤖 This review was automatically generated with Coder Agents.