@acarmisc/backstage-plugin-litellm-backend 0.1.11 → 0.1.13

package/dist/plugin.js

@@ -14,8 +14,8 @@ exports.litellmPlugin = (0, backend_plugin_api_1.createBackendPlugin)({
                 auth: backend_plugin_api_1.coreServices.auth,
                 discovery: backend_plugin_api_1.coreServices.discovery,
             },
-            async init({ httpRouter, config, logger, auth }) {
-                const router = await (0, router_1.createRouter)({ config, logger, auth });
+            async init({ httpRouter, config, logger, auth, discovery }) {
+                const router = await (0, router_1.createRouter)({ config, logger, auth, discovery });
                 httpRouter.use(router);
             },
         });

package/dist/provisioning.d.ts

@@ -0,0 +1,72 @@
+import { Config } from '@backstage/config';
+import { AuthService } from '@backstage/backend-plugin-api';
+import { CatalogClient } from '@backstage/catalog-client';
+import { Request } from 'express';
+import { LiteLLMClient } from './client';
+import { UserInfo, ProvisioningDefaults, RoleConfig } from './types';
+/**
+ * Converts a Backstage user entity ref to a LiteLLM user_id.
+ *
+ * When userIdDomain is configured, the entity name is suffixed with the domain
+ * so that LiteLLM user_ids match the organisation's email addresses:
+ *   "user:default/andrea.carmisciano" + "abstract.it"
+ *   → "andrea.carmisciano@abstract.it"
+ *
+ * Without a domain the bare entity name is returned unchanged, which works for
+ * deployments where LiteLLM users were created with plain usernames.
+ */
+export declare function toLiteLLMUserId(userEntityRef: string, userIdDomain?: string): string;
+/**
+ * Reads the provisioning block from config, applying safe defaults for every
+ * field so the feature works out-of-the-box without any YAML required.
+ *
+ * Safe defaults rationale:
+ *   maxBudget:      $10  — prevents runaway spend on a forgotten test account
+ *   budgetDuration: 30d  — monthly reset, aligns with typical billing cycles
+ *   models:         []   — empty means all proxy models are allowed;
+ *                          restrict here or at team level for tighter control
+ *   teams:          []   — no automatic team assignment; add IDs to enrol users
+ *   tpmLimit:       none — LiteLLM global / team limits still apply
+ *   rpmLimit:       none — same
+ *   metadata:       backstage source tag only
+ */
+export declare function readRoleConfigs(config: Config): RoleConfig[];
+/**
+ * Merges role config over defaults. Role fields override defaults only when explicitly set.
+ */
+export declare function applyRoleOverrides(defaults: ProvisioningDefaults, role: RoleConfig): ProvisioningDefaults;
+export declare function readProvisioningDefaults(config: Config): {
+    enabled: boolean;
+    defaults: ProvisioningDefaults;
+};
+/**
+ * Extracts the authenticated Backstage user identity from the request token.
+ * Returns the userEntityRef (e.g. "user:default/john.doe") or undefined when
+ * the request carries no user credential (service-to-service calls).
+ */
+export declare function resolveUserId(req: Request, auth: AuthService): Promise<string | undefined>;
+/**
+ * Creates a LiteLLM user for the given Backstage identity using the configured
+ * defaults. Returns the UserInfo of the newly created account.
+ */
+export declare function provisionUser(client: LiteLLMClient, userId: string, defaults: ProvisioningDefaults, logger: any): Promise<UserInfo | null>;
+export declare class ProvisioningError extends Error {
+    status: number;
+    body: {
+        error: string;
+        hint: string;
+        provisioning: boolean;
+    };
+    constructor(message: string, hint: string, provisioning: boolean);
+}
+/**
+ * Ensures the LiteLLM user exists, returning its UserInfo.
+ * When the user is missing and provisioning is enabled, attempts to create it.
+ * When provisioning is disabled, throws a ProvisioningError with a clear message.
+ */
+export declare function getOrProvisionUser(client: LiteLLMClient, tokenEntityRef: string | undefined, userId: string | undefined, provisioningEnabled: boolean, provisioningDefaults: ProvisioningDefaults, roleConfigs: RoleConfig[], catalogClient: CatalogClient, auth: AuthService, logger: any): Promise<UserInfo>;
+/**
+ * Fetches the user's Backstage group memberships and returns the first matching
+ * role config (priority order), or undefined when no role matches.
+ */
+export declare function resolveUserRole(userEntityRef: string, roleConfigs: RoleConfig[], catalogClient: CatalogClient, auth: AuthService, logger: any): Promise<RoleConfig | undefined>;

package/dist/provisioning.js

@@ -0,0 +1,196 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProvisioningError = void 0;
+exports.toLiteLLMUserId = toLiteLLMUserId;
+exports.readRoleConfigs = readRoleConfigs;
+exports.applyRoleOverrides = applyRoleOverrides;
+exports.readProvisioningDefaults = readProvisioningDefaults;
+exports.resolveUserId = resolveUserId;
+exports.provisionUser = provisionUser;
+exports.getOrProvisionUser = getOrProvisionUser;
+exports.resolveUserRole = resolveUserRole;
+/**
+ * Converts a Backstage user entity ref to a LiteLLM user_id.
+ *
+ * When userIdDomain is configured, the entity name is suffixed with the domain
+ * so that LiteLLM user_ids match the organisation's email addresses:
+ *   "user:default/andrea.carmisciano" + "abstract.it"
+ *   → "andrea.carmisciano@abstract.it"
+ *
+ * Without a domain the bare entity name is returned unchanged, which works for
+ * deployments where LiteLLM users were created with plain usernames.
+ */
+function toLiteLLMUserId(userEntityRef, userIdDomain) {
+    const name = userEntityRef.split('/').pop() ?? userEntityRef;
+    return userIdDomain ? `${name}@${userIdDomain}` : name;
+}
+/**
+ * Reads the provisioning block from config, applying safe defaults for every
+ * field so the feature works out-of-the-box without any YAML required.
+ *
+ * Safe defaults rationale:
+ *   maxBudget:      $10  — prevents runaway spend on a forgotten test account
+ *   budgetDuration: 30d  — monthly reset, aligns with typical billing cycles
+ *   models:         []   — empty means all proxy models are allowed;
+ *                          restrict here or at team level for tighter control
+ *   teams:          []   — no automatic team assignment; add IDs to enrol users
+ *   tpmLimit:       none — LiteLLM global / team limits still apply
+ *   rpmLimit:       none — same
+ *   metadata:       backstage source tag only
+ */
+function readRoleConfigs(config) {
+    const raw = config.getOptional('litellm.provisioning.roles');
+    if (!raw?.length)
+        return [];
+    return raw.map((r) => ({
+        group: r.group,
+        maxBudget: r.maxBudget,
+        budgetDuration: r.budgetDuration,
+        models: r.models,
+        teams: r.teams,
+        tpmLimit: r.tpmLimit,
+        rpmLimit: r.rpmLimit,
+        metadata: r.metadata,
+    }));
+}
+/**
+ * Merges role config over defaults. Role fields override defaults only when explicitly set.
+ */
+function applyRoleOverrides(defaults, role) {
+    return {
+        maxBudget: role.maxBudget ?? defaults.maxBudget,
+        budgetDuration: role.budgetDuration ?? defaults.budgetDuration,
+        models: role.models ?? defaults.models,
+        teams: role.teams ?? defaults.teams,
+        tpmLimit: role.tpmLimit ?? defaults.tpmLimit,
+        rpmLimit: role.rpmLimit ?? defaults.rpmLimit,
+        metadata: { ...defaults.metadata, ...(role.metadata ?? {}) },
+    };
+}
+function readProvisioningDefaults(config) {
+    const enabled = config.getOptionalBoolean('litellm.provisioning.enabled') ?? false;
+    const defaults = {
+        maxBudget: config.getOptionalNumber('litellm.provisioning.defaults.maxBudget') ?? 10,
+        budgetDuration: config.getOptionalString('litellm.provisioning.defaults.budgetDuration') ?? '30d',
+        models: config.getOptionalStringArray('litellm.provisioning.defaults.models') ?? [],
+        teams: config.getOptionalStringArray('litellm.provisioning.defaults.teams') ?? [],
+        tpmLimit: config.getOptionalNumber('litellm.provisioning.defaults.tpmLimit'),
+        rpmLimit: config.getOptionalNumber('litellm.provisioning.defaults.rpmLimit'),
+        metadata: (config.getOptional('litellm.provisioning.defaults.metadata') ?? {}),
+    };
+    return { enabled, defaults };
+}
+/**
+ * Extracts the authenticated Backstage user identity from the request token.
+ * Returns the userEntityRef (e.g. "user:default/john.doe") or undefined when
+ * the request carries no user credential (service-to-service calls).
+ */
+async function resolveUserId(req, auth) {
+    const rawToken = req.headers.authorization?.slice(7);
+    if (!rawToken)
+        return undefined;
+    try {
+        const credentials = await auth.authenticate(rawToken);
+        const principal = credentials.principal;
+        if (principal?.type === 'user') {
+            return principal.userEntityRef;
+        }
+    }
+    catch {
+        // invalid or service token — caller gets query-param fallback
+    }
+    return undefined;
+}
+/**
+ * Creates a LiteLLM user for the given Backstage identity using the configured
+ * defaults. Returns the UserInfo of the newly created account.
+ */
+async function provisionUser(client, userId, defaults, logger) {
+    const payload = {
+        user_id: userId,
+        max_budget: defaults.maxBudget,
+        budget_duration: defaults.budgetDuration,
+        models: defaults.models,
+        teams: defaults.teams,
+        ...(defaults.tpmLimit !== undefined && { tpm_limit: defaults.tpmLimit }),
+        ...(defaults.rpmLimit !== undefined && { rpm_limit: defaults.rpmLimit }),
+        metadata: {
+            ...defaults.metadata,
+            provisioned_by: 'backstage',
+            provisioned_at: new Date().toISOString(),
+            backstage_entity: userId,
+        },
+    };
+    logger.info(`Provisioning new LiteLLM user for Backstage identity: ${userId}`);
+    try {
+        await client.createUser(payload);
+        // Fetch the freshly-created user record to return consistent UserInfo shape
+        return await client.getUserInfo(userId);
+    }
+    catch (err) {
+        logger.error(`Failed to provision LiteLLM user ${userId}: ${err.message}`);
+        return null;
+    }
+}
+class ProvisioningError extends Error {
+    constructor(message, hint, provisioning) {
+        super(message);
+        this.status = 404;
+        this.body = { error: message, hint, provisioning };
+    }
+}
+exports.ProvisioningError = ProvisioningError;
+/**
+ * Ensures the LiteLLM user exists, returning its UserInfo.
+ * When the user is missing and provisioning is enabled, attempts to create it.
+ * When provisioning is disabled, throws a ProvisioningError with a clear message.
+ */
+async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger) {
+    if (!userId) {
+        throw new ProvisioningError('User not found in LiteLLM', 'No user identity could be resolved from the request.', provisioningEnabled);
+    }
+    let userInfo = await client.getUserInfo(userId);
+    if (!userInfo) {
+        if (provisioningEnabled) {
+            const catalogRef = tokenEntityRef ?? userId;
+            const matchedRole = await resolveUserRole(catalogRef, roleConfigs, catalogClient, auth, logger);
+            const effectiveDefaults = matchedRole
+                ? applyRoleOverrides(provisioningDefaults, matchedRole)
+                : provisioningDefaults;
+            if (matchedRole) {
+                logger.info(`User ${userId} matched role group ${matchedRole.group} — using role-specific provisioning`);
+            }
+            userInfo = await provisionUser(client, userId, effectiveDefaults, logger);
+        }
+        if (!userInfo) {
+            if (provisioningEnabled) {
+                throw new ProvisioningError('User not found in LiteLLM', 'Provisioning attempted but failed — check LiteLLM logs', true);
+            }
+            throw new ProvisioningError('User not found in LiteLLM', 'Enable litellm.provisioning.enabled in app-config.yaml or create the user manually', false);
+        }
+    }
+    return userInfo;
+}
+/**
+ * Fetches the user's Backstage group memberships and returns the first matching
+ * role config (priority order), or undefined when no role matches.
+ */
+async function resolveUserRole(userEntityRef, roleConfigs, catalogClient, auth, logger) {
+    if (!roleConfigs.length)
+        return undefined;
+    try {
+        const { token } = await auth.getPluginRequestToken({
+            onBehalfOf: await auth.getOwnServiceCredentials(),
+            targetPluginId: 'catalog',
+        });
+        const entity = await catalogClient.getEntityByRef(userEntityRef, { token });
+        const groups = (entity?.relations ?? [])
+            .filter(r => r.type === 'memberOf')
+            .map(r => r.targetRef);
+        return roleConfigs.find(rc => groups.includes(rc.group));
+    }
+    catch (err) {
+        logger.warn(`Could not resolve Backstage groups for ${userEntityRef}: ${err.message}`);
+        return undefined;
+    }
+}

package/dist/router.d.ts

@@ -1,9 +1,12 @@
 import { Router } from 'express';
 import { Config } from '@backstage/config';
-import { AuthService } from '@backstage/backend-plugin-api';
+import { AuthService, DiscoveryService } from '@backstage/backend-plugin-api';
+import { ProvisioningError } from './provisioning';
+export { ProvisioningError };
 export interface RouterOptions {
     config: Config;
     logger: any;
     auth: AuthService;
+    discovery: DiscoveryService;
 }
 export declare function createRouter(options: RouterOptions): Promise<Router>;

package/dist/router.js

@@ -1,93 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProvisioningError = void 0;
 exports.createRouter = createRouter;
 const express_1 = require("express");
+const catalog_client_1 = require("@backstage/catalog-client");
 const client_1 = require("./client");
-/**
- * Reads the provisioning block from config, applying safe defaults for every
- * field so the feature works out-of-the-box without any YAML required.
- *
- * Safe defaults rationale:
- *   maxBudget:      $10  — prevents runaway spend on a forgotten test account
- *   budgetDuration: 30d  — monthly reset, aligns with typical billing cycles
- *   models:         []   — empty means all proxy models are allowed;
- *                          restrict here or at team level for tighter control
- *   teams:          []   — no automatic team assignment; add IDs to enrol users
- *   tpmLimit:       none — LiteLLM global / team limits still apply
- *   rpmLimit:       none — same
- *   metadata:       backstage source tag only
- */
-function readProvisioningDefaults(config) {
-    const enabled = config.getOptionalBoolean('litellm.provisioning.enabled') ?? false;
-    const defaults = {
-        maxBudget: config.getOptionalNumber('litellm.provisioning.defaults.maxBudget') ?? 10,
-        budgetDuration: config.getOptionalString('litellm.provisioning.defaults.budgetDuration') ?? '30d',
-        models: config.getOptionalStringArray('litellm.provisioning.defaults.models') ?? [],
-        teams: config.getOptionalStringArray('litellm.provisioning.defaults.teams') ?? [],
-        tpmLimit: config.getOptionalNumber('litellm.provisioning.defaults.tpmLimit'),
-        rpmLimit: config.getOptionalNumber('litellm.provisioning.defaults.rpmLimit'),
-        metadata: (config.getOptional('litellm.provisioning.defaults.metadata') ?? {}),
-    };
-    return { enabled, defaults };
-}
-/**
- * Extracts the authenticated Backstage user identity from the request token.
- * Returns the userEntityRef (e.g. "user:default/john.doe") or undefined when
- * the request carries no user credential (service-to-service calls).
- */
-async function resolveUserId(req, auth) {
-    const rawToken = req.headers.authorization?.slice(7);
-    if (!rawToken)
-        return undefined;
-    try {
-        const credentials = await auth.authenticate(rawToken);
-        const principal = credentials.principal;
-        if (principal?.type === 'user') {
-            return principal.userEntityRef;
-        }
-    }
-    catch {
-        // invalid or service token — caller gets query-param fallback
-    }
-    return undefined;
-}
-/**
- * Creates a LiteLLM user for the given Backstage identity using the configured
- * defaults. Returns the UserInfo of the newly created account.
- */
-async function provisionUser(client, userId, defaults, logger) {
-    const payload = {
-        user_id: userId,
-        max_budget: defaults.maxBudget,
-        budget_duration: defaults.budgetDuration,
-        models: defaults.models,
-        teams: defaults.teams,
-        ...(defaults.tpmLimit !== undefined && { tpm_limit: defaults.tpmLimit }),
-        ...(defaults.rpmLimit !== undefined && { rpm_limit: defaults.rpmLimit }),
-        metadata: {
-            ...defaults.metadata,
-            provisioned_by: 'backstage',
-            provisioned_at: new Date().toISOString(),
-            backstage_entity: userId,
-        },
-    };
-    logger.info(`Provisioning new LiteLLM user for Backstage identity: ${userId}`);
-    try {
-        await client.createUser(payload);
-        // Fetch the freshly-created user record to return consistent UserInfo shape
-        return await client.getUserInfo(userId);
-    }
-    catch (err) {
-        logger.error(`Failed to provision LiteLLM user ${userId}: ${err.message}`);
-        return null;
-    }
-}
+const provisioning_1 = require("./provisioning");
+Object.defineProperty(exports, "ProvisioningError", { enumerable: true, get: function () { return provisioning_1.ProvisioningError; } });
 async function createRouter(options) {
-    const { config, logger, auth } = options;
+    const { config, logger, auth, discovery } = options;
     const baseUrl = config.getString('litellm.baseUrl');
     const masterKey = config.getString('litellm.masterKey');
+    const userIdDomain = config.getOptionalString('litellm.userIdDomain');
     const client = new client_1.LiteLLMClient({ baseUrl, masterKey });
-    const { enabled: provisioningEnabled, defaults: provisioningDefaults } = readProvisioningDefaults(config);
+    const { enabled: provisioningEnabled, defaults: provisioningDefaults } = (0, provisioning_1.readProvisioningDefaults)(config);
+    const roleConfigs = (0, provisioning_1.readRoleConfigs)(config);
+    const catalogClient = new catalog_client_1.CatalogClient({ discoveryApi: discovery });
     if (provisioningEnabled) {
         logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length ? provisioningDefaults.models.join(',') : 'all'}, teams=[${provisioningDefaults.teams.join(',')}]`);
     }
@@ -97,58 +25,80 @@ async function createRouter(options) {
     });
     router.get('/user/info', async (req, res) => {
         try {
-            const tokenUserId = await resolveUserId(req, auth);
-            const userId = tokenUserId ?? req.query.user_id;
-            let userInfo = await client.getUserInfo(userId);
-            if (!userInfo) {
-                if (provisioningEnabled && userId) {
-                    userInfo = await provisionUser(client, userId, provisioningDefaults, logger);
-                }
-                if (!userInfo) {
-                    res.status(404).json({
-                        error: 'User not found in LiteLLM',
-                        provisioning: provisioningEnabled,
-                        hint: provisioningEnabled
-                            ? 'Provisioning attempted but failed — check LiteLLM logs'
-                            : 'Enable litellm.provisioning.enabled in app-config.yaml or create the user manually',
-                    });
-                    return;
-                }
-            }
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const userId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : req.query.user_id;
+            const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
             res.json(userInfo);
         }
         catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
             logger.error('Failed to fetch user info', error);
             res.status(500).json({ error: error.message });
         }
     });
     router.get('/keys', async (req, res) => {
         try {
-            const tokenUserId = await resolveUserId(req, auth);
-            const userId = tokenUserId ?? req.query.user_id;
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const userId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : req.query.user_id;
+            await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
             const keys = await client.listKeys(userId);
             res.json(keys);
         }
         catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
             logger.error('Failed to list keys', error);
             res.status(500).json({ error: error.message });
         }
     });
     router.post('/keys/generate', async (req, res) => {
         try {
-            const tokenUserId = await resolveUserId(req, auth);
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const resolvedUserId = tokenEntityRef ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain) : undefined;
+            if (resolvedUserId) {
+                await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, resolvedUserId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            }
             const request = {
                 ...req.body,
-                ...(tokenUserId && { user_id: tokenUserId }),
+                ...(resolvedUserId && { user_id: resolvedUserId }),
             };
             const result = await client.generateKey(request);
             res.json(result);
         }
         catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
             logger.error('Failed to generate key', error);
             res.status(500).json({ error: error.message });
         }
     });
+    router.post('/keys/:keyId/update', async (req, res) => {
+        try {
+            const { keyId } = req.params;
+            if (!keyId) {
+                res.status(400).json({ error: 'keyId is required' });
+                return;
+            }
+            const request = { ...req.body, key: keyId };
+            const result = await client.updateKey(request);
+            res.json(result);
+        }
+        catch (error) {
+            logger.error('Failed to update key', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
     router.delete('/keys/:keyId', async (req, res) => {
         try {
             const { keyId } = req.params;
@@ -176,9 +126,11 @@ async function createRouter(options) {
     });
     router.get('/teams', async (req, res) => {
         try {
-            const tokenUserId = await resolveUserId(req, auth);
-            const userId = tokenUserId ?? req.query.user_id;
-            const userInfo = await client.getUserInfo(userId);
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const userId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : req.query.user_id;
+            const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
             if (!userInfo?.teams?.length) {
                 res.json([]);
                 return;
@@ -190,6 +142,10 @@ async function createRouter(options) {
             res.json(teams.filter(Boolean));
         }
         catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
             logger.error('Failed to fetch teams', error);
             res.status(500).json({ error: error.message });
         }
@@ -217,12 +173,21 @@ async function createRouter(options) {
                 res.status(400).json({ error: 'start_date and end_date are required' });
                 return;
             }
-            const tokenUserId = await resolveUserId(req, auth);
-            const userId = tokenUserId ?? req.query.user_id;
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const userId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : req.query.user_id;
+            if (userId) {
+                await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            }
             const usage = await client.getUsage(start_date, end_date, userId, group_by);
             res.json(usage);
         }
         catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
             logger.error('Failed to fetch usage', error);
             res.status(500).json({ error: error.message });
         }

package/dist/types.d.ts

@@ -44,24 +44,60 @@ export interface ModelInfo {
     input_cost_per_token?: number;
     output_cost_per_token?: number;
 }
+export interface UsageModelBreakdown {
+    total_spend: number;
+    total_tokens: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+}
+export interface UsageKeyBreakdown {
+    key_alias?: string;
+    team_id?: string | null;
+    models: string[];
+    total_spend: number;
+    total_tokens: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+}
+export interface UsageDailyPoint {
+    date: string;
+    spend: number;
+    total_tokens: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+}
+export interface UsageDailyModelPoint {
+    date: string;
+    model: string;
+    spend: number;
+    prompt_tokens: number;
+    completion_tokens: number;
+    total_tokens: number;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+}
 export interface UsageMetrics {
     total_spend: number;
     total_tokens: number;
     prompt_tokens: number;
     completion_tokens: number;
-    usage_by_model: Record<string, {
-        total_spend: number;
-        total_tokens: number;
-        prompt_tokens: number;
-        completion_tokens: number;
-    }>;
-    daily_usage: Array<{
-        date: string;
-        spend: number;
-        total_tokens: number;
-        prompt_tokens: number;
-        completion_tokens: number;
-    }>;
+    api_requests: number;
+    successful_requests: number;
+    failed_requests: number;
+    usage_by_model: Record<string, UsageModelBreakdown>;
+    usage_by_key: Record<string, UsageKeyBreakdown>;
+    daily_usage: UsageDailyPoint[];
+    daily_by_model: UsageDailyModelPoint[];
 }
 export interface GenerateKeyRequest {
     alias?: string;
@@ -71,6 +107,18 @@ export interface GenerateKeyRequest {
     tpm_limit?: number;
     rpm_limit?: number;
     user_id?: string;
+    team_id?: string;
+    key_type?: string;
+}
+export interface UpdateKeyRequest {
+    key: string;
+    key_alias?: string;
+    models?: string[];
+    max_budget?: number;
+    tpm_limit?: number;
+    rpm_limit?: number;
+    team_id?: string;
+    duration?: string;
 }
 export interface GenerateKeyResponse {
     key: string;
@@ -97,6 +145,16 @@ export interface ProvisioningDefaults {
     rpmLimit?: number;
     metadata: Record<string, string>;
 }
+export interface RoleConfig {
+    group: string;
+    maxBudget?: number;
+    budgetDuration?: string;
+    models?: string[];
+    teams?: string[];
+    tpmLimit?: number;
+    rpmLimit?: number;
+    metadata?: Record<string, string>;
+}
 export interface CreateUserRequest {
     user_id: string;
     user_email?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",