Method postChats

coderd/exp_chats.go:1015–1294

EXPERIMENTAL: this endpoint is experimental and is subject to change. @Summary Create chat @ID create-chat @Security CoderSessionToken @Tags Chats @Accept json @Produce json @Param request body codersdk.CreateChatRequest true "Create chat request" @Success 201 {object} codersdk.Chat @Router /api/ex

(rw http.ResponseWriter, r *http.Request)

// @Router /api/experimental/chats [post]
// @Description Experimental: this endpoint is subject to change.
func (api *API) postChats(rw http.ResponseWriter, r *http.Request) {
	ctx := r.Context()
	apiKey := httpmw.APIKey(r)

	// Cap the raw request body to prevent excessive memory use
	// from large dynamic tool schemas.
	r.Body = http.MaxBytesReader(rw, r.Body, int64(2*maxSystemPromptLenBytes))

	var req codersdk.CreateChatRequest
	if !httpapi.Read(ctx, rw, r, &req) {
		return
	}

	aReq, commitAudit := audit.InitRequest[database.Chat](rw, &audit.RequestParams{
		Audit:          *api.Auditor.Load(),
		Log:            api.Logger,
		Request:        r,
		Action:         database.AuditActionCreate,
		OrganizationID: req.OrganizationID,
	})
	defer commitAudit()

	// Validate organization membership.
	if req.OrganizationID == uuid.Nil {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
			Message: "organization_id is required.",
		})
		return
	}
	isMember, err := httpmw.UserAuthorization(ctx).HasOrganizationMembership(req.OrganizationID)
	if err != nil {
		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
			Message: "Failed to validate organization membership.",
			Detail:  xerrors.Errorf("check organization membership: %w", err).Error(),
		})
		return
	}
	if !isMember {
		httpapi.Write(ctx, rw, http.StatusForbidden, codersdk.Response{
			Message: "You are not a member of the specified organization.",
		})
		return
	}
	// NOTE: This authorize check is intentionally placed after request
	// parsing because we need req.OrganizationID to scope the RBAC check
	// to the correct org. The request body is bounded by MaxBytesReader
	// above, limiting the cost of parsing before rejection.
	if !api.Authorize(r, policy.ActionCreate, rbac.ResourceChat.WithOwner(apiKey.UserID.String()).InOrg(req.OrganizationID)) {
		httpapi.Forbidden(rw)
		return
	}

	// Validate per-chat system prompt length.
	const maxSystemPromptLen = 10000
	if len(req.SystemPrompt) > maxSystemPromptLen {
		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
			Message: "System prompt exceeds maximum length.",
			Detail:  fmt.Sprintf("System prompt must be at most %d characters, got %d.", maxSystemPromptLen, len(req.SystemPrompt)),