Function auditAIProviderKeyChanges

coderd/ai_providers.go:640–671

auditAIProviderKeyChanges emits one audit entry per added or removed key, attributed to the actor on the HTTP request. Per-key entries keep key rotation visible in the audit log because the parent AIProvider audit diff is empty for key-only PATCHes (keys live in a separate table). APIKey is replace

(ctx context.Context, r *http.Request, auditor audit.Auditor, log slog.Logger, changes aiProviderKeyChanges)

// the audit pipeline so plaintext keys never land in the diff or any
// audit backend, independent of the api_key column's audit policy.
func auditAIProviderKeyChanges(ctx context.Context, r *http.Request, auditor audit.Auditor, log slog.Logger, changes aiProviderKeyChanges) {
	if len(changes.Added) == 0 && len(changes.Removed) == 0 {
		return
	}
	key, ok := httpmw.APIKeyOptional(r)
	if !ok {
		return
	}
	requestID, _ := httpmw.RequestIDOptional(r)
	emit := func(action database.AuditAction, before, after database.AIProviderKey) {
		before.APIKey = aibridgeutils.MaskSecret(before.APIKey)
		after.APIKey = aibridgeutils.MaskSecret(after.APIKey)
		audit.BackgroundAudit(ctx, &audit.BackgroundAuditParams[database.AIProviderKey]{
			Audit:     auditor,
			Log:       log,
			UserID:    key.UserID,
			RequestID: requestID,
			Status:    http.StatusOK,
			IP:        r.RemoteAddr,
			UserAgent: r.UserAgent(),
			Action:    action,
			Old:       before,
			New:       after,
		})
	}
	for _, k := range changes.Removed {
		emit(database.AuditActionDelete, k, database.AIProviderKey{})
	}
	for _, k := range changes.Added {
		emit(database.AuditActionCreate, database.AIProviderKey{}, k)
	}
}

// applyAIProviderKeyOps reconciles a provider's keys against the
// supplied mutation list inside a transaction: kept-by-ID rows stay,