add crud for adding providers and models to resources

server/routers/resource/addAiModelToResource.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, resources, resourceAiModels, aiModels } from "@server/db";
+import { db, resources, resourceAiModels } from "@server/db";
 import { eq, and } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
@@ -8,7 +8,10 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
-
+import {
+    assertPublicAllowlistApiEligible,
+    assertModelsBelongToPublicAllowlistProviders
+} from "@server/lib/aiInferenceResource";
 const addAiModelToResourceBodySchema = z.strictObject({
     modelId: z.int().positive()
 });
@@ -21,7 +24,7 @@ registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/ai-models/add",
     description:
-        "Add a single AI model to a resource's model restriction allow-list.",
+        "Add a single catalog model to an inference resource allowlist. Requires at least one attached AI provider in allowlist mode. The model must belong to a provider attached in allowlist mode.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: addAiModelToResourceParamsSchema,
@@ -95,33 +98,18 @@ export async function addAiModelToResource(
             );
         }
 
-        if (!resource.aiProviderId) {
-            return next(
-                createHttpError(
-                    HttpCode.BAD_REQUEST,
-                    "Resource has no AI provider linked"
-                )
-            );
+        const eligibleError = await assertPublicAllowlistApiEligible(resource);
+        if (eligibleError) {
+            return next(createHttpError(HttpCode.BAD_REQUEST, eligibleError));
         }
 
-        const [model] = await db
-            .select()
-            .from(aiModels)
-            .where(
-                and(
-                    eq(aiModels.modelId, modelId),
-                    eq(aiModels.providerId, resource.aiProviderId)
-                )
-            )
-            .limit(1);
-
-        if (!model) {
-            return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    "Model not found or does not belong to this resource's AI provider"
-                )
-            );
+        const modelError = await assertModelsBelongToPublicAllowlistProviders({
+            orgId: resource.orgId,
+            resourceId,
+            modelIds: [modelId]
+        });
+        if (modelError) {
+            return next(createHttpError(HttpCode.BAD_REQUEST, modelError));
         }
 
         const existingEntry = await db

server/routers/resource/addAiProviderToResource.ts

@@ -0,0 +1,152 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import {
+    isInferenceFieldsError,
+    listPublicResourceAiProviders,
+    modelAccessModeSchema,
+    resolveProviderAttachments,
+    setPublicResourceAiProviders
+} from "@server/lib/aiInferenceResource";
+
+const addAiProviderToResourceBodySchema = z.strictObject({
+    providerId: z.number().int().positive(),
+    modelAccessMode: modelAccessModeSchema.optional()
+});
+
+const addAiProviderToResourceParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/resource/{resourceId}/ai-providers/add",
+    description:
+        "Add or replace a single AI provider attachment on an inference resource.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: addAiProviderToResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: addAiProviderToResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function addAiProviderToResource(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = addAiProviderToResourceBodySchema.safeParse(
+            req.body
+        );
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { providerId, modelAccessMode } = parsedBody.data;
+
+        const parsedParams = addAiProviderToResourceParamsSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+            );
+        }
+
+        if (resource.mode !== "inference") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "AI providers can only be attached to inference-mode resources"
+                )
+            );
+        }
+
+        const existing = await listPublicResourceAiProviders(resourceId);
+        const nextAttachments = [
+            ...existing
+                .filter((a) => a.providerId !== providerId)
+                .map((a) => ({
+                    providerId: a.providerId,
+                    modelAccessMode: a.modelAccessMode
+                })),
+            { providerId, modelAccessMode }
+        ];
+
+        const attachments = await resolveProviderAttachments({
+            orgId: resource.orgId,
+            attachments: nextAttachments,
+            requireAtLeastOne: true
+        });
+        if (isInferenceFieldsError(attachments)) {
+            return next(createHttpError(HttpCode.BAD_REQUEST, attachments.error));
+        }
+
+        await setPublicResourceAiProviders(resourceId, attachments);
+
+        return response(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "AI provider added to resource successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/createResource.ts

@@ -38,6 +38,13 @@ import {
 } from "@server/db/names";
 import { usageService } from "@server/lib/billing/usageService";
 import { LimitId } from "@server/lib/billing";
+import {
+    isInferenceFieldsError,
+    resolveProviderAttachments,
+    resourceAiProviderAttachmentSchema,
+    setPublicResourceAiProviders,
+    type ResourceAiProviderAttachment
+} from "@server/lib/aiInferenceResource";
 
 const createResourceParamsSchema = z.strictObject({
     orgId: z.string()
@@ -98,13 +105,11 @@ const createHttpResourceSchema = z
         authDaemonPort: z.int().positive().optional(),
         authDaemonMode: z.enum(["site", "remote", "native"]).optional(),
         // Inference settings
-        aiProviderId: z
-            .number()
-            .int()
-            .positive()
+        aiProviders: z
+            .array(resourceAiProviderAttachmentSchema)
             .optional()
             .describe(
-                "For inference-mode resources: the AI provider this resource proxies chat completions to."
+                "For inference-mode resources: AI providers to attach. Each entry may set modelAccessMode (passthrough, catalog, or allowlist); defaults to passthrough. At most one passthrough provider is allowed."
             )
     })
     .refine(
@@ -377,11 +382,35 @@ async function createHttpResource(
         authDaemonPort,
         authDaemonMode,
         pamMode,
-        aiProviderId
+        aiProviders: aiProviderInputs
     } = parsedBody.data;
     const subdomain = parsedBody.data.subdomain;
     const stickySession = parsedBody.data.stickySession;
 
+    const effectiveMode = mode ?? "http";
+
+    let providerAttachments: ResourceAiProviderAttachment[] = [];
+    if (effectiveMode === "inference") {
+        const resolved = await resolveProviderAttachments({
+            orgId,
+            attachments: aiProviderInputs ?? [],
+            requireAtLeastOne: true
+        });
+        if (isInferenceFieldsError(resolved)) {
+            return next(
+                createHttpError(HttpCode.BAD_REQUEST, resolved.error)
+            );
+        }
+        providerAttachments = resolved;
+    } else if (aiProviderInputs && aiProviderInputs.length > 0) {
+        return next(
+            createHttpError(
+                HttpCode.BAD_REQUEST,
+                "AI providers can only be attached to inference-mode resources"
+            )
+        );
+    }
+
     // Wildcard subdomains are a paid feature
     if (subdomain && subdomain.includes("*")) {
         const isLicensed = await isLicensedOrSubscribed(
@@ -422,7 +451,7 @@ async function createHttpResource(
     }
 
     if (
-        ["ssh", "rdp", "vnc"].includes(mode!) &&
+        ["ssh", "rdp", "vnc"].includes(effectiveMode) &&
         !isLicensedOrSubscribed(
             orgId!,
             tierMatrix[TierFeature.AdvancedPublicResources]
@@ -555,7 +584,7 @@ async function createHttpResource(
                 orgId,
                 name,
                 subdomain: finalSubdomain,
-                mode: mode,
+                mode: effectiveMode,
                 pamMode: pamMode,
                 authDaemonMode: authDaemonMode,
                 authDaemonPort: authDaemonPort,
@@ -564,11 +593,18 @@ async function createHttpResource(
                 postAuthPath: postAuthPath,
                 wildcard,
                 health: "unknown",
-                defaultResourcePolicyId: defaultPolicy.resourcePolicyId,
-                aiProviderId: aiProviderId ?? null
+                defaultResourcePolicyId: defaultPolicy.resourcePolicyId
             })
             .returning();
 
+        if (providerAttachments.length > 0) {
+            await setPublicResourceAiProviders(
+                newResource[0].resourceId,
+                providerAttachments,
+                trx
+            );
+        }
+
         await trx.insert(roleResources).values({
             roleId: adminRole[0].roleId,
             resourceId: newResource[0].resourceId

server/routers/resource/index.ts

@@ -39,3 +39,7 @@ export * from "./listResourceAiModels";
 export * from "./setResourceAiModels";
 export * from "./addAiModelToResource";
 export * from "./removeAiModelFromResource";
+export * from "./listResourceAiProviders";
+export * from "./setResourceAiProviders";
+export * from "./addAiProviderToResource";
+export * from "./removeAiProviderFromResource";

server/routers/resource/listResourceAiModels.ts

@@ -34,7 +34,7 @@ registry.registerPath({
     method: "get",
     path: "/resource/{resourceId}/ai-models",
     description:
-        "List the AI models a resource is restricted to. An empty list means the resource is not restricted and every enabled model on its linked AI provider is allowed.",
+        "List catalog models on this resource's allowlist. Only enforced when modelAccessMode=allowlist; an empty allowlist denies all models.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: listResourceAiModelsParamsSchema

server/routers/resource/listResourceAiProviders.ts

@@ -0,0 +1,94 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import { listPublicResourceAiProviders } from "@server/lib/aiInferenceResource";
+
+const listResourceAiProvidersParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+export type ListResourceAiProvidersResponse = {
+    providers: Awaited<ReturnType<typeof listPublicResourceAiProviders>>;
+};
+
+registry.registerPath({
+    method: "get",
+    path: "/resource/{resourceId}/ai-providers",
+    description: "List AI providers attached to an inference resource.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: listResourceAiProvidersParamsSchema
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function listResourceAiProviders(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedParams = listResourceAiProvidersParamsSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+            );
+        }
+
+        const providers = await listPublicResourceAiProviders(resourceId);
+
+        return response<ListResourceAiProvidersResponse>(res, {
+            data: { providers },
+            success: true,
+            error: false,
+            message: "Resource AI providers retrieved successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/removeAiModelFromResource.ts

@@ -8,6 +8,7 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
+import { assertPublicAllowlistApiEligible } from "@server/lib/aiInferenceResource";
 
 const removeAiModelFromResourceBodySchema = z.strictObject({
     modelId: z.int().positive()
@@ -21,7 +22,7 @@ registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/ai-models/remove",
     description:
-        "Remove a single AI model from a resource's model restriction allow-list.",
+        "Remove a single catalog model from an inference resource allowlist. Requires at least one attached AI provider in allowlist mode.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: removeAiModelFromResourceParamsSchema,
@@ -97,6 +98,11 @@ export async function removeAiModelFromResource(
             );
         }
 
+        const eligibleError = await assertPublicAllowlistApiEligible(resource);
+        if (eligibleError) {
+            return next(createHttpError(HttpCode.BAD_REQUEST, eligibleError));
+        }
+
         const existingEntry = await db
             .select()
             .from(resourceAiModels)

server/routers/resource/removeAiProviderFromResource.ts

@@ -0,0 +1,165 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import {
+    isInferenceFieldsError,
+    listPublicResourceAiProviders,
+    resolveProviderAttachments,
+    setPublicResourceAiProviders
+} from "@server/lib/aiInferenceResource";
+
+const removeAiProviderFromResourceBodySchema = z.strictObject({
+    providerId: z.number().int().positive()
+});
+
+const removeAiProviderFromResourceParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/resource/{resourceId}/ai-providers/remove",
+    description:
+        "Remove an AI provider attachment from an inference resource. At least one provider must remain.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: removeAiProviderFromResourceParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: removeAiProviderFromResourceBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function removeAiProviderFromResource(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = removeAiProviderFromResourceBodySchema.safeParse(
+            req.body
+        );
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { providerId } = parsedBody.data;
+
+        const parsedParams =
+            removeAiProviderFromResourceParamsSchema.safeParse(req.params);
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+            );
+        }
+
+        if (resource.mode !== "inference") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "AI providers can only be attached to inference-mode resources"
+                )
+            );
+        }
+
+        const existing = await listPublicResourceAiProviders(resourceId);
+        const found = existing.find((a) => a.providerId === providerId);
+        if (!found) {
+            return next(
+                createHttpError(
+                    HttpCode.NOT_FOUND,
+                    "AI provider is not attached to this resource"
+                )
+            );
+        }
+
+        const remaining = existing
+            .filter((a) => a.providerId !== providerId)
+            .map((a) => ({
+                providerId: a.providerId,
+                modelAccessMode: a.modelAccessMode
+            }));
+
+        if (remaining.length === 0) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "At least one AI provider is required for inference-mode resources"
+                )
+            );
+        }
+
+        const attachments = await resolveProviderAttachments({
+            orgId: resource.orgId,
+            attachments: remaining,
+            requireAtLeastOne: true
+        });
+        if (isInferenceFieldsError(attachments)) {
+            return next(createHttpError(HttpCode.BAD_REQUEST, attachments.error));
+        }
+
+        await setPublicResourceAiProviders(resourceId, attachments);
+
+        return response(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "AI provider removed from resource successfully",
+            status: HttpCode.OK
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/setResourceAiModels.ts

@@ -1,13 +1,17 @@
 import { Request, Response, NextFunction } from "express";
 import { z } from "zod";
-import { db, resources, resourceAiModels, aiModels } from "@server/db";
-import { eq, and, inArray } from "drizzle-orm";
+import { db, resources, resourceAiModels } from "@server/db";
+import { eq } from "drizzle-orm";
 import response from "@server/lib/response";
 import HttpCode from "@server/types/HttpCode";
 import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
+import {
+    assertPublicAllowlistApiEligible,
+    assertModelsBelongToPublicAllowlistProviders
+} from "@server/lib/aiInferenceResource";
 
 const setResourceAiModelsBodySchema = z.strictObject({
     modelIds: z.array(z.int().positive())
@@ -21,7 +25,7 @@ registry.registerPath({
     method: "post",
     path: "/resource/{resourceId}/ai-models",
     description:
-        "Set the AI models a resource is restricted to. This replaces all existing restrictions. Pass an empty array to remove the restriction (allow every enabled model on the linked provider).",
+        "Replace the allowlist of catalog models for an inference resource. Requires at least one attached AI provider in allowlist mode. Models must belong to a provider attached in allowlist mode. An empty array denies all models.",
     tags: [OpenAPITags.PublicResource],
     request: {
         params: setResourceAiModelsParamsSchema,
@@ -95,34 +99,18 @@ export async function setResourceAiModels(
             );
         }
 
-        if (modelIds.length > 0) {
-            if (!resource.aiProviderId) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "Resource has no AI provider linked"
-                    )
-                );
-            }
+        const eligibleError = await assertPublicAllowlistApiEligible(resource);
+        if (eligibleError) {
+            return next(createHttpError(HttpCode.BAD_REQUEST, eligibleError));
+        }
 
-            const validModels = await db
-                .select({ modelId: aiModels.modelId })
-                .from(aiModels)
-                .where(
-                    and(
-                        inArray(aiModels.modelId, modelIds),
-                        eq(aiModels.providerId, resource.aiProviderId)
-                    )
-                );
-
-            if (validModels.length !== new Set(modelIds).size) {
-                return next(
-                    createHttpError(
-                        HttpCode.BAD_REQUEST,
-                        "One or more model IDs do not exist or do not belong to this resource's AI provider"
-                    )
-                );
-            }
+        const modelError = await assertModelsBelongToPublicAllowlistProviders({
+            orgId: resource.orgId,
+            resourceId,
+            modelIds
+        });
+        if (modelError) {
+            return next(createHttpError(HttpCode.BAD_REQUEST, modelError));
         }
 
         await db.transaction(async (trx) => {

server/routers/resource/setResourceAiProviders.ts

@@ -0,0 +1,137 @@
+import { Request, Response, NextFunction } from "express";
+import { z } from "zod";
+import { db, resources } from "@server/db";
+import { eq } from "drizzle-orm";
+import response from "@server/lib/response";
+import HttpCode from "@server/types/HttpCode";
+import createHttpError from "http-errors";
+import logger from "@server/logger";
+import { fromError } from "zod-validation-error";
+import { OpenAPITags, registry } from "@server/openApi";
+import {
+    isInferenceFieldsError,
+    resolveProviderAttachments,
+    resourceAiProviderAttachmentSchema,
+    setPublicResourceAiProviders
+} from "@server/lib/aiInferenceResource";
+
+const setResourceAiProvidersBodySchema = z.strictObject({
+    providers: z.array(resourceAiProviderAttachmentSchema)
+});
+
+const setResourceAiProvidersParamsSchema = z.strictObject({
+    resourceId: z.coerce.number().int().positive()
+});
+
+registry.registerPath({
+    method: "post",
+    path: "/resource/{resourceId}/ai-providers",
+    description:
+        "Replace the AI providers attached to an inference resource. At least one provider is required. At most one may use passthrough mode.",
+    tags: [OpenAPITags.PublicResource],
+    request: {
+        params: setResourceAiProvidersParamsSchema,
+        body: {
+            content: {
+                "application/json": {
+                    schema: setResourceAiProvidersBodySchema
+                }
+            }
+        }
+    },
+    responses: {
+        200: {
+            description: "Successful response",
+            content: {
+                "application/json": {
+                    schema: z.object({
+                        data: z.record(z.string(), z.any()).nullable(),
+                        success: z.boolean(),
+                        error: z.boolean(),
+                        message: z.string(),
+                        status: z.number()
+                    })
+                }
+            }
+        }
+    }
+});
+
+export async function setResourceAiProviders(
+    req: Request,
+    res: Response,
+    next: NextFunction
+): Promise<any> {
+    try {
+        const parsedBody = setResourceAiProvidersBodySchema.safeParse(req.body);
+        if (!parsedBody.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedBody.error).toString()
+                )
+            );
+        }
+
+        const { providers } = parsedBody.data;
+
+        const parsedParams = setResourceAiProvidersParamsSchema.safeParse(
+            req.params
+        );
+        if (!parsedParams.success) {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    fromError(parsedParams.error).toString()
+                )
+            );
+        }
+
+        const { resourceId } = parsedParams.data;
+
+        const [resource] = await db
+            .select()
+            .from(resources)
+            .where(eq(resources.resourceId, resourceId))
+            .limit(1);
+
+        if (!resource) {
+            return next(
+                createHttpError(HttpCode.NOT_FOUND, "Resource not found")
+            );
+        }
+
+        if (resource.mode !== "inference") {
+            return next(
+                createHttpError(
+                    HttpCode.BAD_REQUEST,
+                    "AI providers can only be attached to inference-mode resources"
+                )
+            );
+        }
+
+        const attachments = await resolveProviderAttachments({
+            orgId: resource.orgId,
+            attachments: providers,
+            requireAtLeastOne: true
+        });
+        if (isInferenceFieldsError(attachments)) {
+            return next(createHttpError(HttpCode.BAD_REQUEST, attachments.error));
+        }
+
+        await setPublicResourceAiProviders(resourceId, attachments);
+
+        return response(res, {
+            data: {},
+            success: true,
+            error: false,
+            message: "AI providers set for resource successfully",
+            status: HttpCode.CREATED
+        });
+    } catch (error) {
+        logger.error(error);
+        return next(
+            createHttpError(HttpCode.INTERNAL_SERVER_ERROR, "An error occurred")
+        );
+    }
+}

server/routers/resource/updateResource.ts

@@ -120,15 +120,6 @@ const updateHttpResourceBodySchema = z
             .optional()
             .describe(
                 "ID of the resource policy to apply to this resource. Set to null to remove the resource policy and fall back to the inline policy settings."
-            ),
-        aiProviderId: z
-            .number()
-            .int()
-            .positive()
-            .nullable()
-            .optional()
-            .describe(
-                "For inference-mode resources: the AI provider this resource proxies chat completions to. Set to null to unlink."
             )
     })
     .refine((data) => Object.keys(data).length > 0, {
@@ -354,8 +345,10 @@ export async function updateResource(
             );
         }
 
-        if (["http", "ssh", "rdp", "vnc"].includes(resource.mode)) {
-            // HANDLE UPDATING HTTP RESOURCES
+        if (
+            ["http", "ssh", "rdp", "vnc", "inference"].includes(resource.mode)
+        ) {
+            // HANDLE UPDATING HTTP / BROWSER / INFERENCE RESOURCES
             return await updateHttpResource(
                 {
                     req,