[#1004] Make LLM chat base URL allowlist configurable via application properties

[rnetuka]

Issue: #1004

Summary by Sourcery

Make the LLM chat base URL allowlist configurable via application properties instead of being hardcoded.

New Features:

• Introduce configurable LLM allowlist properties exposed through WanakuRouterConfig and application.properties.
• Expose the configured LLM allowlist via the existing /api/v1/chat/allowlist endpoint.

Enhancements:

• Update LlmChatResource to validate LLM base URLs against the configurable allowlist rather than a static in-code list.

Documentation:

• Document the new wanaku.router.llm.allowlist configuration property in the configurations guide.

[sourcery-ai]

Reviewer's Guide

Makes the LLM chat base URL allowlist configurable via application properties instead of hardcoded in the resource class, wiring it through WanakuRouterConfig and documenting the new property.

File-Level Changes

Change	Details	Files
Replace hardcoded LLM chat base URL allowlist with configuration-driven allowlist injected via WanakuRouterConfig.	Remove the in-class List-based allowlist constant from the LLM chat resource. Inject WanakuRouterConfig into the LLM chat resource and use its LLM allowlist for the /allowlist endpoint. Use the configured LLM allowlist when validating incoming chat base URLs before making HTTP calls.	apps/wanaku-router-backend/src/main/java/ai/wanaku/backend/api/v1/chat/LlmChatResource.java
Extend WanakuRouterConfig with LLM configuration section to expose an allowlist of base URLs.	Add llm() sub-config accessor to WanakuRouterConfig. Introduce nested LlmConfig interface with an allowlist() property returning a list of URLs.	apps/wanaku-router-backend/src/main/java/ai/wanaku/backend/WanakuRouterConfig.java
Define default LLM allowlist in application properties and document the new configuration option.	Add wanaku.router.llm.allowlist property with a comma-separated list of default LLM API URLs. Document the LLM allowlist behavior and the new configuration key in the configurations guide.	apps/wanaku-router-backend/src/main/resources/application.properties docs/configurations.md

Possibly linked issues

• Make LLM chat base URL allowlist configurable via application properties #1004: PR externalizes LLM allowlist into WanakuRouterConfig and application.properties, matching the issue’s configuration requirement.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue, and left some high level feedback:

• Consider normalizing and trimming entries from wanaku.router.llm.allowlist (e.g., spaces, trailing slashes) before using them in LlmChatResource to avoid subtle mismatches between configured values and incoming baseUrls.
• getBaseUrls() returns the underlying configuration list directly; if this list is mutable, you may want to return an unmodifiable copy to avoid accidental modification of config state from callers.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider normalizing and trimming entries from `wanaku.router.llm.allowlist` (e.g., spaces, trailing slashes) before using them in `LlmChatResource` to avoid subtle mismatches between configured values and incoming `baseUrl`s.
- `getBaseUrls()` returns the underlying configuration list directly; if this list is mutable, you may want to return an unmodifiable copy to avoid accidental modification of config state from callers.

## Individual Comments

### Comment 1
<location path="docs/configurations.md" line_range="184-186" />
<code_context>
+
+| Property                      | Description                                              |
+|-------------------------------|----------------------------------------------------------|
+| `wanaku.router.llm.allowlist` | A comma separated list of LLM API URLs that are allowed. |
+
 ### gRPC Transport
</code_context>
<issue_to_address>
**nitpick (typo):** Consider hyphenating "comma-separated" as a compound adjective.

Because it’s used as a compound adjective before “list,” this should read “comma-separated list of LLM API URLs that are allowed.”

```suggestion
| Property                      | Description                                               |
|-------------------------------|-----------------------------------------------------------|
| `wanaku.router.llm.allowlist` | A comma-separated list of LLM API URLs that are allowed. |
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

nitpick (typo): Consider hyphenating "comma-separated" as a compound adjective.

Because it’s used as a compound adjective before “list,” this should read “comma-separated list of LLM API URLs that are allowed.”

Suggested change

	| Property | Description |
	|-------------------------------|----------------------------------------------------------|
	| `wanaku.router.llm.allowlist` | A comma separated list of LLM API URLs that are allowed. |
	| Property | Description |
	|-------------------------------|-----------------------------------------------------------|
	| `wanaku.router.llm.allowlist` | A comma-separated list of LLM API URLs that are allowed. |

[orpiske]

Hey @rnetuka, thanks! I ended up doing this as part of #1125.