feat(ai-gateway): allow Custom LLM access by group

[chrarnoldus]

Summary

• add optional UUID-validated group_ids to Custom LLM definitions
• allow catalog and inference access when the user belongs to an allowed organization group
• preserve organization-wide access through organization_ids and update admin/policy UI copy

Validation

• pnpm --filter @kilocode/db typecheck
• pnpm --filter @kilocode/db lint
• pnpm --filter web typecheck
• pnpm --filter web lint
• pnpm --filter web test --runInBand src/lib/ai-gateway/custom-llm/access.test.ts src/routers/admin/custom-llm-router.test.ts src/routers/organizations/organization-settings-router.test.ts
• pnpm format:check
• git diff --check

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Incremental review of the help-text copy update in the group model access policy editor found no issues; group-based Custom LLM access remains consistently implemented across catalog and inference paths with fail-closed semantics and org-scoped membership checks.

Files Reviewed (12 files)

• apps/web/src/app/admin/custom-llms/CustomLlmsContent.tsx
• apps/web/src/components/organizations/groups/policies/model-access/ModelAccessPolicyEditor.tsx
• apps/web/src/lib/ai-gateway/custom-llm/access.test.ts
• apps/web/src/lib/ai-gateway/custom-llm/access.ts
• apps/web/src/lib/ai-gateway/custom-llm/listAvailableCustomLlms.ts
• apps/web/src/lib/ai-gateway/providers/get-provider.ts
• apps/web/src/lib/organizations/effective-model-access.server.test.ts
• apps/web/src/lib/organizations/organization-group-policy-context.server.ts
• apps/web/src/lib/organizations/organization-models.ts
• apps/web/src/routers/admin/custom-llm-router.test.ts
• apps/web/src/routers/organizations/organization-settings-router.test.ts
• packages/db/src/schema-types.ts

Previous Review Summary (commit c9c18b6)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit c9c18b6)

Status: No Issues Found | Recommendation: Merge

Executive Summary

Group-based Custom LLM access is implemented consistently across catalog and inference paths with fail-closed semantics, org-scoped membership checks, and backwards-compatible schema changes; reviewed with high confidence.

Files Reviewed (12 files)

• apps/web/src/app/admin/custom-llms/CustomLlmsContent.tsx
• apps/web/src/components/organizations/groups/policies/model-access/ModelAccessPolicyEditor.tsx
• apps/web/src/lib/ai-gateway/custom-llm/access.test.ts
• apps/web/src/lib/ai-gateway/custom-llm/access.ts
• apps/web/src/lib/ai-gateway/custom-llm/listAvailableCustomLlms.ts
• apps/web/src/lib/ai-gateway/providers/get-provider.ts
• apps/web/src/lib/organizations/effective-model-access.server.test.ts
• apps/web/src/lib/organizations/organization-group-policy-context.server.ts
• apps/web/src/lib/organizations/organization-models.ts
• apps/web/src/routers/admin/custom-llm-router.test.ts
• apps/web/src/routers/organizations/organization-settings-router.test.ts
• packages/db/src/schema-types.ts

---

_{Reviewed by kimi-k3 · Input: 21.5K · Output: 4.9K · Cached: 231.5K}

_{Review guidance: REVIEW.md from base branch main}