fix(ai-gateway): enforce exclusive provider filters

apps/web/src/app/api/openrouter/[...path]/route.ts

@@ -56,6 +56,7 @@ import {
   forbiddenFreeModelResponse,
   storeAndPreviousResponseIdIsNotSupported,
   apiKindNotSupportedResponse,
+  checkExclusiveModelProviderAllowed,
 } from '@/lib/ai-gateway/llm-proxy-helpers';
 import { ProxyErrorType } from '@/lib/proxy-error-types';
 import { getBalanceAndOrgSettings } from '@/lib/organizations/organization-usage';
@@ -591,21 +592,6 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     }
   }
 
-  // Request-level data-collection opt-out: a caller can set
-  // `provider.data_collection: 'deny'` or `provider.zdr: true` on any
-  // request to opt that single request out of training/data-retention.
-  // Direct experiment upstreams ignore those OpenRouter/Vercel flags
-  // (we never reach OpenRouter), but we still capture the prompt to R2
-  // for partner evaluation — which violates the caller's stated
-  // intent. Refuse here regardless of org settings, anon/BYOK status,
-  // or the org-level check below.
-  if (
-    (await hasBestEffortGuessDataCollectionRequirement(effectiveModelIdLowerCased)) &&
-    isDataCollectionExplicitlyDisallowed(requestBodyParsed.body.provider)
-  ) {
-    return dataCollectionRequiredResponse();
-  }
-
   if (!effectiveProviderContext.provider.supportedChatApis.includes(requestBodyParsed.kind)) {
     return apiKindNotSupportedResponse(
       requestBodyParsed.kind,
@@ -830,6 +816,19 @@ export async function POST(request: NextRequest): Promise<NextResponseType<unkno
     }
   }
 
+  if (
+    (await hasBestEffortGuessDataCollectionRequirement(effectiveModelIdLowerCased)) &&
+    isDataCollectionExplicitlyDisallowed(requestBodyParsed.body.provider)
+  ) {
+    return dataCollectionRequiredResponse();
+  }
+
+  const providerNotAllowedError = checkExclusiveModelProviderAllowed(
+    effectiveModelIdLowerCased,
+    requestBodyParsed.body.provider
+  );
+  if (providerNotAllowedError) return providerNotAllowedError;
+
   if (effectiveProviderContext.experiment) {
     usageContext.modelExperimentVariantVersionId =
       effectiveProviderContext.experiment.variantVersionId;

apps/web/src/lib/ai-gateway/llm-proxy-helpers.ts

@@ -47,6 +47,7 @@ import { computeOpenRouterCostFields } from '@/lib/ai-gateway/processUsage.share
 import { persistExperimentAttribution } from '@/lib/ai-gateway/experiments/persist';
 export { proxyErrorTypeSchema, ProxyErrorType } from '@/lib/proxy-error-types';
 import { ProxyErrorType } from '@/lib/proxy-error-types';
+import { getInferenceProvider } from '@/lib/ai-gateway/providers/kilo-exclusive-model';
 
 // FIM suffix markers for tracking purposes - used to wrap suffix in a fake system prompt format
 // This allows FIM requests to be tracked consistently with chat requests
@@ -146,6 +147,31 @@ export function dataCollectionRequiredResponse() {
   );
 }
 
+export function checkExclusiveModelProviderAllowed(
+  model: string,
+  provider: OpenRouterProviderConfig | undefined
+) {
+  if (!provider) return null;
+  const exclusiveModel = findKiloExclusiveModel(model);
+  if (!exclusiveModel) return null;
+  const inferenceProvider = getInferenceProvider(exclusiveModel)?.slug;
+  if (!inferenceProvider) return null;
+  if (
+    (!provider.only || provider.only.includes(inferenceProvider)) &&
+    (!provider.ignore || !provider.ignore.includes(inferenceProvider))
+  )
+    return null;
+  const error = `No eligible provider can serve the selected model. Please enable provider: ${inferenceProvider}`;
+  return NextResponse.json(
+    {
+      error: error,
+      error_type: ProxyErrorType.provider_not_allowed,
+      message: error,
+    },
+    { status: 403 }
+  );
+}
+
 export function apiKindNotSupportedResponse(
   apiKind: GatewayChatApiKind,
   supportedApiKinds: ReadonlyArray<GatewayChatApiKind>