@acarmisc/backstage-plugin-litellm-backend 0.1.16 → 0.2.1

package/dist/provisioning.js

@@ -0,0 +1,339 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProvisioningError = void 0;
+exports.toLiteLLMUserId = toLiteLLMUserId;
+exports.readRoleConfigs = readRoleConfigs;
+exports.applyRoleOverrides = applyRoleOverrides;
+exports.readProvisioningDefaults = readProvisioningDefaults;
+exports.resolveUserId = resolveUserId;
+exports.resolveUserProfile = resolveUserProfile;
+exports.provisionUser = provisionUser;
+exports.getOrProvisionUser = getOrProvisionUser;
+exports.resolveUserRole = resolveUserRole;
+/**
+ * Converts a Backstage user entity ref to a LiteLLM user_id.
+ *
+ * When userIdDomain is configured, the entity name is suffixed with the domain
+ * so that LiteLLM user_ids match the organisation's email addresses:
+ *   "user:default/andrea.carmisciano" + "abstract.it"
+ *   → "andrea.carmisciano@abstract.it"
+ *
+ * Without a domain the bare entity name is returned unchanged, which works for
+ * deployments where LiteLLM users were created with plain usernames.
+ */
+function toLiteLLMUserId(userEntityRef, userIdDomain) {
+    const name = userEntityRef.split('/').pop() ?? userEntityRef;
+    // Defensive: if the entity name is already email-shaped (e.g. when the
+    // Keycloak provider imports usernames as full emails without our
+    // name-rewrite transformer running, or when a catalog change leaves
+    // an entity ref like "user:default/foo@bar.it"), do NOT append the
+    // userIdDomain — that produced "foo@bar.it@bar.it" in production.
+    if (name.includes('@'))
+        return name;
+    return userIdDomain ? `${name}@${userIdDomain}` : name;
+}
+/**
+ * Reads the provisioning block from config, applying safe defaults for every
+ * field so the feature works out-of-the-box without any YAML required.
+ *
+ * Safe defaults rationale:
+ *   maxBudget:      $10  — prevents runaway spend on a forgotten test account
+ *   budgetDuration: 30d  — monthly reset, aligns with typical billing cycles
+ *   models:         []   — empty means all proxy models are allowed;
+ *                          restrict here or at team level for tighter control
+ *   teams:          []   — no automatic team assignment; add IDs to enrol users
+ *   tpmLimit:       none — LiteLLM global / team limits still apply
+ *   rpmLimit:       none — same
+ *   metadata:       backstage source tag only
+ */
+function readRoleConfigs(config) {
+    const raw = config.getOptional('litellm.provisioning.roles');
+    if (!raw?.length)
+        return [];
+    return raw.map((r) => ({
+        group: r.group,
+        maxBudget: r.maxBudget,
+        budgetDuration: r.budgetDuration,
+        models: r.models,
+        teams: r.teams,
+        tpmLimit: r.tpmLimit,
+        rpmLimit: r.rpmLimit,
+        userRole: r.userRole,
+        metadata: r.metadata,
+    }));
+}
+/**
+ * Merges role config over defaults. Role fields override defaults only when explicitly set.
+ */
+function applyRoleOverrides(defaults, role) {
+    return {
+        maxBudget: role.maxBudget ?? defaults.maxBudget,
+        budgetDuration: role.budgetDuration ?? defaults.budgetDuration,
+        models: role.models ?? defaults.models,
+        teams: role.teams ?? defaults.teams,
+        tpmLimit: role.tpmLimit ?? defaults.tpmLimit,
+        rpmLimit: role.rpmLimit ?? defaults.rpmLimit,
+        userRole: role.userRole ?? defaults.userRole,
+        metadata: { ...defaults.metadata, ...(role.metadata ?? {}) },
+    };
+}
+function readProvisioningDefaults(config) {
+    const enabled = config.getOptionalBoolean('litellm.provisioning.enabled') ?? false;
+    const defaults = {
+        maxBudget: config.getOptionalNumber('litellm.provisioning.defaults.maxBudget') ?? 10,
+        budgetDuration: config.getOptionalString('litellm.provisioning.defaults.budgetDuration') ?? '30d',
+        models: config.getOptionalStringArray('litellm.provisioning.defaults.models') ??
+            [],
+        teams: config.getOptionalStringArray('litellm.provisioning.defaults.teams') ??
+            [],
+        tpmLimit: config.getOptionalNumber('litellm.provisioning.defaults.tpmLimit'),
+        rpmLimit: config.getOptionalNumber('litellm.provisioning.defaults.rpmLimit'),
+        userRole: config.getOptionalString('litellm.provisioning.defaults.userRole') ??
+            'internal_user',
+        metadata: config.getOptional('litellm.provisioning.defaults.metadata') ?? {},
+    };
+    return { enabled, defaults };
+}
+/**
+ * Extracts the authenticated Backstage user identity from the request token.
+ * Returns the userEntityRef (e.g. "user:default/john.doe") or undefined when
+ * the request carries no user credential (service-to-service calls).
+ */
+async function resolveUserId(req, auth) {
+    const rawToken = req.headers.authorization?.slice(7);
+    if (!rawToken)
+        return undefined;
+    try {
+        const credentials = await auth.authenticate(rawToken);
+        const principal = credentials.principal;
+        if (principal?.type === 'user') {
+            return principal.userEntityRef;
+        }
+    }
+    catch {
+        // invalid or service token — caller gets query-param fallback
+    }
+    return undefined;
+}
+/**
+ * Looks up the catalog User entity for the authenticated user and returns
+ * the profile block. Returns an empty object when the user has no catalog
+ * entity (e.g. dangerouslyAllowSignInWithoutUserInCatalog was used) — the
+ * caller falls back to deriving identity from userIdDomain.
+ */
+async function resolveUserProfile(userEntityRef, catalogClient, auth, logger) {
+    try {
+        const { token } = await auth.getPluginRequestToken({
+            onBehalfOf: await auth.getOwnServiceCredentials(),
+            targetPluginId: 'catalog',
+        });
+        const entity = await catalogClient.getEntityByRef(userEntityRef, { token });
+        const profile = entity?.spec?.profile ?? {};
+        return {
+            email: profile.email,
+            displayName: profile.displayName,
+        };
+    }
+    catch (err) {
+        logger.warn(`Could not fetch catalog profile for ${userEntityRef}: ${err.message}`);
+        return {};
+    }
+}
+/**
+ * Creates a LiteLLM user for the given Backstage identity using the configured
+ * defaults. Returns the UserInfo of the newly created account.
+ */
+async function provisionUser(client, userId, defaults, profile, backstageEntity, logger) {
+    const payload = {
+        user_id: userId,
+        ...(profile.email && { user_email: profile.email }),
+        ...(profile.displayName && { user_alias: profile.displayName }),
+        max_budget: defaults.maxBudget,
+        budget_duration: defaults.budgetDuration,
+        models: defaults.models,
+        teams: defaults.teams,
+        ...(defaults.tpmLimit !== undefined && { tpm_limit: defaults.tpmLimit }),
+        ...(defaults.rpmLimit !== undefined && { rpm_limit: defaults.rpmLimit }),
+        ...(defaults.userRole && { user_role: defaults.userRole }),
+        auto_create_key: false,
+        metadata: {
+            ...defaults.metadata,
+            provisioned_by: 'backstage',
+            provisioned_at: new Date().toISOString(),
+            backstage_entity: backstageEntity ?? userId,
+            ...(profile.email && { backstage_email: profile.email }),
+            ...(profile.displayName && {
+                backstage_display_name: profile.displayName,
+            }),
+        },
+    };
+    logger.info(`Provisioning new LiteLLM user for Backstage identity: ${userId}` +
+        (profile.email ? ` (email=${profile.email})` : ''));
+    try {
+        await client.createUser(payload);
+        // Defensive /user/update: LiteLLM's /user/new upsert path has been
+        // observed to drop user_role under concurrent inserts (the first
+        // call sets the field, a racing second call upserts and clears it).
+        // Re-asserting the role-bearing fields immediately after creation
+        // is cheap and makes the role guarantee robust.
+        if (defaults.userRole) {
+            try {
+                await client.updateUser({
+                    user_id: userId,
+                    user_role: defaults.userRole,
+                    ...(profile.email && { user_email: profile.email }),
+                    ...(profile.displayName && { user_alias: profile.displayName }),
+                });
+            }
+            catch (updateErr) {
+                logger.warn(`Defensive /user/update after provisioning ${userId} failed: ${updateErr.message}`);
+            }
+        }
+        // Fetch the freshly-created user record to return consistent UserInfo shape
+        return await client.getUserInfo(userId);
+    }
+    catch (err) {
+        logger.error(`Failed to provision LiteLLM user ${userId}: ${err.message}`);
+        throw err;
+    }
+}
+/**
+ * Module-scope single-flight cache keyed by LiteLLM user_id. Coalesces
+ * concurrent provisioning attempts for the same user so /user/new fires
+ * at most once per user across parallel requests. Without this, an
+ * authenticated page load that fires /keys, /teams and /usage in
+ * parallel triggers three concurrent /user/new calls; LiteLLM's
+ * upsert path then creates one default key per call (so the user lands
+ * with 3 unexpected keys) and may silently lose user_role.
+ *
+ * Cache entries are removed once the promise settles, so subsequent
+ * requests for a re-deleted user can still trigger fresh provisioning.
+ */
+const provisioningInFlight = new Map();
+/**
+ * Strips any echoed Authorization bearer token from upstream LiteLLM error
+ * messages before they're shipped back to the browser. LiteLLM normally does
+ * not echo the master key, but defense in depth: never let a `Bearer …`
+ * substring travel out in a response body.
+ */
+function sanitizeUpstreamMessage(message) {
+    if (!message)
+        return 'unknown error';
+    return message
+        .replace(/Bearer\s+[A-Za-z0-9._\-+/=]+/g, 'Bearer [redacted]')
+        .replace(/sk-[A-Za-z0-9_\-]{8,}/g, 'sk-[redacted]')
+        .slice(0, 500);
+}
+class ProvisioningError extends Error {
+    constructor(message, hint, provisioning, status = 404) {
+        super(message);
+        this.status = status;
+        this.body = { error: message, hint, provisioning };
+    }
+}
+exports.ProvisioningError = ProvisioningError;
+/**
+ * Ensures the LiteLLM user exists, returning its UserInfo.
+ * When the user is missing and provisioning is enabled, attempts to create it.
+ * When provisioning is disabled, throws a ProvisioningError with a clear message.
+ */
+async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger) {
+    if (!userId) {
+        throw new ProvisioningError('User not found in LiteLLM', 'No user identity could be resolved from the request.', provisioningEnabled);
+    }
+    const existing = await client.getUserInfo(userId);
+    if (existing) {
+        return existing;
+    }
+    if (!provisioningEnabled) {
+        throw new ProvisioningError('User not found in LiteLLM', 'Enable litellm.provisioning.enabled in app-config.yaml or create the user manually', false);
+    }
+    // Single-flight: if another request for the same userId is already
+    // provisioning, await its result instead of starting a new /user/new.
+    // This collapses the /keys + /teams + /usage page-load thundering
+    // herd into a single LiteLLM round-trip.
+    const pending = provisioningInFlight.get(userId);
+    if (pending) {
+        logger.info(`LiteLLM provisioning already in flight for ${userId} — joining`);
+        return pending;
+    }
+    const provisionPromise = (async () => {
+        const catalogRef = tokenEntityRef ?? userId;
+        const [matchedRole, profile] = await Promise.all([
+            resolveUserRole(catalogRef, roleConfigs, catalogClient, auth, logger),
+            tokenEntityRef
+                ? resolveUserProfile(tokenEntityRef, catalogClient, auth, logger)
+                : Promise.resolve({}),
+        ]);
+        const effectiveDefaults = matchedRole
+            ? applyRoleOverrides(provisioningDefaults, matchedRole)
+            : provisioningDefaults;
+        if (matchedRole) {
+            logger.info(`User ${userId} matched role group ${matchedRole.group} — using role-specific provisioning`);
+        }
+        try {
+            const created = await provisionUser(client, userId, effectiveDefaults, profile, tokenEntityRef, logger);
+            if (!created) {
+                throw new ProvisioningError('User not found in LiteLLM', 'Provisioning attempted but returned no user — check LiteLLM logs', true);
+            }
+            return created;
+        }
+        catch (err) {
+            // The single-flight cache should prevent the parallel-409 race,
+            // but keep the recovery path: if /user/new still 409s (e.g.
+            // multi-replica deploys where the lock is per-process), treat
+            // it as "user exists" and re-fetch.
+            if (err.status === 409 || /already exists/i.test(err.message ?? '')) {
+                logger.info(`LiteLLM user ${userId} already exists during provisioning — re-fetching`);
+                const refetched = await client.getUserInfo(userId);
+                if (refetched) {
+                    return refetched;
+                }
+            }
+            if (err instanceof ProvisioningError) {
+                throw err;
+            }
+            // Map upstream LiteLLM status to a Backstage-safe gateway status.
+            // 401/403/5xx from LiteLLM mean the gateway (this plugin) cannot
+            // talk to LiteLLM — they MUST NOT propagate as 401/403 to the
+            // browser, otherwise Backstage's fetch middleware treats the
+            // user's Backstage session as expired and forces a re-login.
+            // Only safe client-semantic codes pass through.
+            const upstreamStatus = err.status;
+            const passThrough = [400, 404, 409, 422].includes(upstreamStatus)
+                ? upstreamStatus
+                : 502;
+            throw new ProvisioningError('LiteLLM auto-provisioning failed', `LiteLLM upstream ${upstreamStatus ?? 'error'}: ${sanitizeUpstreamMessage(err.message)}`, true, passThrough);
+        }
+    })();
+    provisioningInFlight.set(userId, provisionPromise);
+    try {
+        return await provisionPromise;
+    }
+    finally {
+        provisioningInFlight.delete(userId);
+    }
+}
+/**
+ * Fetches the user's Backstage group memberships and returns the first matching
+ * role config (priority order), or undefined when no role matches.
+ */
+async function resolveUserRole(userEntityRef, roleConfigs, catalogClient, auth, logger) {
+    if (!roleConfigs.length)
+        return undefined;
+    try {
+        const { token } = await auth.getPluginRequestToken({
+            onBehalfOf: await auth.getOwnServiceCredentials(),
+            targetPluginId: 'catalog',
+        });
+        const entity = await catalogClient.getEntityByRef(userEntityRef, { token });
+        const groups = (entity?.relations ?? [])
+            .filter(r => r.type === 'memberOf')
+            .map(r => r.targetRef);
+        return roleConfigs.find(rc => groups.includes(rc.group));
+    }
+    catch (err) {
+        logger.warn(`Could not resolve Backstage groups for ${userEntityRef}: ${err.message}`);
+        return undefined;
+    }
+}

package/dist/router.d.ts

@@ -0,0 +1,12 @@
+import { Router } from 'express';
+import { Config } from '@backstage/config';
+import { AuthService, DiscoveryService } from '@backstage/backend-plugin-api';
+import { ProvisioningError } from './provisioning';
+export { ProvisioningError };
+export interface RouterOptions {
+    config: Config;
+    logger: any;
+    auth: AuthService;
+    discovery: DiscoveryService;
+}
+export declare function createRouter(options: RouterOptions): Promise<Router>;

package/dist/router.js

@@ -0,0 +1,274 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProvisioningError = void 0;
+exports.createRouter = createRouter;
+const express_1 = __importStar(require("express"));
+const catalog_client_1 = require("@backstage/catalog-client");
+const client_1 = require("./client");
+const provisioning_1 = require("./provisioning");
+Object.defineProperty(exports, "ProvisioningError", { enumerable: true, get: function () { return provisioning_1.ProvisioningError; } });
+async function createRouter(options) {
+    const { config, logger, auth, discovery } = options;
+    const baseUrl = config.getString('litellm.baseUrl');
+    const masterKey = config.getString('litellm.masterKey');
+    const userIdDomain = config.getOptionalString('litellm.userIdDomain');
+    const client = new client_1.LiteLLMClient({ baseUrl, masterKey });
+    const { enabled: provisioningEnabled, defaults: provisioningDefaults } = (0, provisioning_1.readProvisioningDefaults)(config);
+    const roleConfigs = (0, provisioning_1.readRoleConfigs)(config);
+    const catalogClient = new catalog_client_1.CatalogClient({ discoveryApi: discovery });
+    if (provisioningEnabled) {
+        logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length
+            ? provisioningDefaults.models.join(',')
+            : 'all'}, teams=[${provisioningDefaults.teams.join(',')}]`);
+    }
+    const router = (0, express_1.Router)();
+    // JSON body parser. Without this, every POST/PUT endpoint sees an empty
+    // req.body. Backstage's httpRouter does not apply a body parser at the
+    // plugin-router level, so each plugin must attach its own.
+    router.use(express_1.default.json());
+    router.get('/health', (_req, res) => {
+        res.json({ status: 'ok', provisioning: provisioningEnabled });
+    });
+    router.get('/user/info', async (req, res) => {
+        try {
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const userId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : req.query.user_id;
+            const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            res.json(userInfo);
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            logger.error('Failed to fetch user info', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.get('/keys', async (req, res) => {
+        try {
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const userId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : req.query.user_id;
+            await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            const keys = await client.listKeys(userId);
+            res.json(keys);
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            logger.error('Failed to list keys', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.post('/keys/generate', async (req, res) => {
+        try {
+            // Only alias + max_budget are required. An empty models array is
+            // intentional — in LiteLLM `models: []` means "all models the user
+            // can access" which is the desired default. Forcing a selection
+            // up front is too restrictive for the common case.
+            const body = (req.body ?? {});
+            const missing = [];
+            if (!body.alias?.trim())
+                missing.push('alias');
+            if (typeof body.max_budget !== 'number' || body.max_budget <= 0) {
+                missing.push('max_budget (positive number)');
+            }
+            if (missing.length) {
+                res.status(400).json({
+                    error: 'Missing required fields',
+                    hint: `Required: ${missing.join(', ')}`,
+                });
+                return;
+            }
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const resolvedUserId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : undefined;
+            if (resolvedUserId) {
+                await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, resolvedUserId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            }
+            // Stamp ownership into LiteLLM key metadata. LiteLLM's native
+            // `created_by` column is only populated when the caller authenticates
+            // via JWT/SSO; we always call with the master key, so that column
+            // stays null. Enriching `metadata` makes the owner identity visible
+            // in LiteLLM's UI and queryable via API.
+            const profile = tokenEntityRef
+                ? await (0, provisioning_1.resolveUserProfile)(tokenEntityRef, catalogClient, auth, logger)
+                : {};
+            const enrichedMetadata = {
+                ...(body.metadata ?? {}),
+                created_by_backstage_user: tokenEntityRef ?? 'unknown',
+                ...(profile.email && { created_by_email: profile.email }),
+                ...(profile.displayName && {
+                    created_by_display_name: profile.displayName,
+                }),
+                created_via: 'backstage',
+                created_at_iso: new Date().toISOString(),
+            };
+            const request = {
+                ...body,
+                metadata: enrichedMetadata,
+                ...(resolvedUserId && { user_id: resolvedUserId }),
+            };
+            const result = await client.generateKey(request);
+            res.json(result);
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            logger.error('Failed to generate key', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.post('/keys/:keyId/update', async (req, res) => {
+        try {
+            const { keyId } = req.params;
+            if (!keyId) {
+                res.status(400).json({ error: 'keyId is required' });
+                return;
+            }
+            const request = { ...req.body, key: keyId };
+            const result = await client.updateKey(request);
+            res.json(result);
+        }
+        catch (error) {
+            logger.error('Failed to update key', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.delete('/keys/:keyId', async (req, res) => {
+        try {
+            const { keyId } = req.params;
+            if (!keyId) {
+                res.status(400).json({ error: 'keyId is required' });
+                return;
+            }
+            await client.deleteKeys({ keys: [keyId] });
+            res.json({ success: true });
+        }
+        catch (error) {
+            logger.error('Failed to delete key', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.get('/models', async (_req, res) => {
+        try {
+            const models = await client.listModels();
+            res.json(models);
+        }
+        catch (error) {
+            logger.error('Failed to list models', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.get('/teams', async (req, res) => {
+        try {
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const userId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : req.query.user_id;
+            const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            if (!userInfo?.teams?.length) {
+                res.json([]);
+                return;
+            }
+            const teams = await Promise.all(userInfo.teams.map(teamId => client.getTeamInfo(teamId).catch(err => {
+                logger.warn(`Failed to fetch team ${teamId}: ${err.message}`);
+                return null;
+            })));
+            res.json(teams.filter(Boolean));
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            logger.error('Failed to fetch teams', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.get('/teams/:teamId/usage', async (req, res) => {
+        try {
+            const { teamId } = req.params;
+            const { start_date, end_date } = req.query;
+            if (!start_date || !end_date) {
+                res.status(400).json({ error: 'start_date and end_date are required' });
+                return;
+            }
+            const usage = await client.getTeamUsage(teamId, start_date, end_date);
+            res.json(usage);
+        }
+        catch (error) {
+            logger.error('Failed to fetch team usage', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.get('/usage', async (req, res) => {
+        try {
+            const { start_date, end_date, group_by } = req.query;
+            if (!start_date || !end_date) {
+                res.status(400).json({ error: 'start_date and end_date are required' });
+                return;
+            }
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const userId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : req.query.user_id;
+            if (userId) {
+                await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            }
+            const usage = await client.getUsage(start_date, end_date, userId, group_by);
+            res.json(usage);
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            logger.error('Failed to fetch usage', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    return router;
+}