@acarmisc/backstage-plugin-litellm-backend 0.12.0 → 0.13.0

package/config.d.ts

@@ -248,6 +248,34 @@ export interface Config {
       };
     };
 
+    /**
+     * Display controls for team budget amounts in the frontend.
+     * Each flag independently hides real dollar budgets while the backend
+     * still exposes the consumption level (percent of cap + ok/near/over
+     * status + reset window). Enforcement is server-side: the backend
+     * redacts max_budget/spend from the corresponding endpoints, so the
+     * dollars are not merely hidden in CSS.
+     */
+    display?: {
+      /**
+       * Hide dollar budgets from regular team members (GET /teams, Teams
+       * cards, TEAM section of the budget widget). Team managers still see
+       * dollars unless hideTeamBudgetForManagers is also set.
+       * @default false
+       * @visibility frontend
+       */
+      hideTeamBudgetForMembers?: boolean;
+
+      /**
+       * Hide dollar budgets even from team managers (GET /teams/managed,
+       * team write responses, ManageTeamDialog budget field which becomes
+       * write-only). Useful when budgets are finance-sensitive.
+       * @default false
+       * @visibility frontend
+       */
+      hideTeamBudgetForManagers?: boolean;
+    };
+
     bridge?: {
       /**
        * When true, mount the /bridge/keys, /bridge/keys (POST), /bridge/models

package/dist/index.cjs.js

@@ -8002,10 +8002,14 @@ __export(index_exports, {
   readProvisioningDefaults: () => readProvisioningDefaults,
   readRoleConfigs: () => readRoleConfigs,
   readTeamAdminConfig: () => readTeamAdminConfig,
+  readTeamBudgetVisibility: () => readTeamBudgetVisibility,
+  redactTeamBudget: () => redactTeamBudget,
+  redactTeamUsage: () => redactTeamUsage,
   resolveBridgeUserId: () => resolveBridgeUserId,
   resolveUserId: () => resolveUserId,
   resolveUserProfile: () => resolveUserProfile,
   resolveUserRole: () => resolveUserRole,
+  teamBudgetStatusFor: () => teamBudgetStatusFor,
   toLiteLLMUserId: () => toLiteLLMUserId,
   validateTeamPatchInput: () => validateTeamPatchInput,
   validateTeamWriteInput: () => validateTeamWriteInput
@@ -8629,6 +8633,10 @@ var openApiSpec = {
               keyGeneration: { type: "object", properties: {
                 allowUnlimitedBudget: { type: "boolean" },
                 teamRequired: { type: "boolean" }
+              } },
+              display: { type: "object", properties: {
+                hideTeamBudgetForMembers: { type: "boolean" },
+                hideTeamBudgetForManagers: { type: "boolean" }
               } }
             } } } }
           }
@@ -8733,6 +8741,7 @@ var openApiSpec = {
       get: {
         tags: ["Teams"],
         summary: "List teams the current user belongs to",
+        description: "When litellm.display.hideTeamBudgetForMembers is set, max_budget/spend are stripped and budget_pct/budget_status/budget_hidden carry the consumption level instead.",
         responses: { "200": { description: "Array of teams" } }
       }
     },
@@ -8740,6 +8749,7 @@ var openApiSpec = {
       get: {
         tags: ["Teams"],
         summary: "Usage metrics for a team",
+        description: "Spend fields are zeroed when the caller is subject to team budget hiding (member or manager flag, whichever applies to them).",
         parameters: [
           { name: "teamId", in: "path", required: true, schema: { type: "string" } },
           { name: "start_date", in: "query", required: true, schema: { type: "string" } },
@@ -10827,6 +10837,65 @@ function validateTeamPatchInput(input, cfg) {
   return { ok: true, value: result };
 }
 
+// src/teamBudgetVisibility.ts
+function teamBudgetStatusFor(spend, budget) {
+  if (budget > 0 && spend >= budget) return "over";
+  if (budget > 0 && spend >= budget * 0.8) return "near";
+  return "ok";
+}
+function readTeamBudgetVisibility(config) {
+  return {
+    hideTeamBudgetForMembers: config.getOptionalBoolean(
+      "litellm.display.hideTeamBudgetForMembers"
+    ) ?? false,
+    hideTeamBudgetForManagers: config.getOptionalBoolean(
+      "litellm.display.hideTeamBudgetForManagers"
+    ) ?? false
+  };
+}
+function redactTeamBudget(team) {
+  const budget = team.max_budget ?? 0;
+  if (budget <= 0) return team;
+  const spend = team.spend ?? 0;
+  const pct = Math.min(100, Math.max(0, spend / budget * 100));
+  const { max_budget: _dropped, ...rest } = team;
+  return {
+    ...rest,
+    spend: 0,
+    budget_pct: pct,
+    budget_status: teamBudgetStatusFor(spend, budget),
+    budget_hidden: true
+  };
+}
+function redactTeamUsage(usage) {
+  const zeroSpend = (p) => ({
+    ...p,
+    spend: 0
+  });
+  const zeroTotalSpend = (p) => ({
+    ...p,
+    total_spend: 0
+  });
+  return {
+    ...usage,
+    total_spend: 0,
+    usage_by_model: Object.fromEntries(
+      Object.entries(usage.usage_by_model ?? {}).map(([k, v]) => [
+        k,
+        zeroTotalSpend(v)
+      ])
+    ),
+    usage_by_key: Object.fromEntries(
+      Object.entries(usage.usage_by_key ?? {}).map(([k, v]) => [
+        k,
+        zeroTotalSpend(v)
+      ])
+    ),
+    daily_usage: (usage.daily_usage ?? []).map(zeroSpend),
+    daily_by_model: (usage.daily_by_model ?? []).map(zeroSpend)
+  };
+}
+
 // src/router.ts
 var teamCreateInFlight = /* @__PURE__ */ new Map();
 var TEAM_FETCH_RETRY_DELAYS_MS = [100, 300, 900];
@@ -10863,6 +10932,7 @@ async function createRouter(options) {
   const teamMgmtEnabled = isTeamManagementEnabled(config);
   const objectPermsEnabled = isObjectPermissionsEnabled(config);
   const teamAdminCfg = readTeamAdminConfig(config);
+  const teamBudgetVisibility = readTeamBudgetVisibility(config);
   const catalogClient = options.catalogClient ?? new import_catalog_client.CatalogClient({ discoveryApi: discovery });
   if (provisioningEnabled) {
     logger.info(
@@ -10874,6 +10944,11 @@ async function createRouter(options) {
       "litellm.teamAdmin is configured but team management is disabled \u2014 set permission.enabled: true and litellm.teamAdmin.group to enable it."
     );
   }
+  if (teamBudgetVisibility.hideTeamBudgetForMembers || teamBudgetVisibility.hideTeamBudgetForManagers) {
+    logger.info(
+      `LiteLLM team budget hiding enabled \u2014 members: ${teamBudgetVisibility.hideTeamBudgetForMembers}, managers: ${teamBudgetVisibility.hideTeamBudgetForManagers}`
+    );
+  }
   const router = (0, import_express.Router)();
   router.use(import_express.default.json());
   router.get("/health", (_req, res) => {
@@ -10888,6 +10963,10 @@ async function createRouter(options) {
         maxBudgetCeiling: teamAdminCfg.maxBudgetCeiling,
         allowUnlimitedBudget: teamAdminCfg.allowUnlimitedBudget,
         objectPermissionsEnabled: objectPermsEnabled
+      },
+      display: {
+        hideTeamBudgetForMembers: teamBudgetVisibility.hideTeamBudgetForMembers,
+        hideTeamBudgetForManagers: teamBudgetVisibility.hideTeamBudgetForManagers
       }
     });
   });
@@ -11287,7 +11366,10 @@ async function createRouter(options) {
           })
         )
       );
-      res.json(teams.filter(Boolean));
+      const list = teams.filter(Boolean);
+      res.json(
+        teamBudgetVisibility.hideTeamBudgetForMembers ? list.map(redactTeamBudget) : list
+      );
     } catch (error) {
       if (error instanceof ProvisioningError) {
         res.status(error.status).json(error.body);
@@ -11386,7 +11468,9 @@ async function createRouter(options) {
     teamCreateInFlight.set(key, createPromise);
     try {
       const result = await createPromise;
-      res.json(result);
+      res.json(
+        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(result) : result
+      );
     } catch (err) {
       sendTeamError(err, res);
     } finally {
@@ -11430,7 +11514,9 @@ async function createRouter(options) {
         teamId,
         owningGroup
       });
-      res.json(r);
+      res.json(
+        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(r) : r
+      );
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -11488,7 +11574,9 @@ async function createRouter(options) {
       const owned = all.filter(
         (t) => typeof t.metadata?.owning_group === "string" && t.metadata.owning_group === teamAdminCfg.group
       );
-      res.json(owned);
+      res.json(
+        teamBudgetVisibility.hideTeamBudgetForManagers ? owned.map(redactTeamBudget) : owned
+      );
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -11630,7 +11718,9 @@ async function createRouter(options) {
           owningGroup
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(updated);
+        res.json(
+          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
+        );
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11661,7 +11751,9 @@ async function createRouter(options) {
           owningGroup
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(updated);
+        res.json(
+          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
+        );
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11740,7 +11832,9 @@ async function createRouter(options) {
           owningGroup,
           vector_stores: requested
         });
-        res.json(updated);
+        res.json(
+          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
+        );
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11821,7 +11915,9 @@ async function createRouter(options) {
           before,
           after: requested
         });
-        res.json(updated);
+        res.json(
+          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
+        );
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11840,7 +11936,24 @@ async function createRouter(options) {
         start_date,
         end_date
       );
-      res.json(usage);
+      let hide = teamBudgetVisibility.hideTeamBudgetForMembers;
+      if (teamAdminCfg.group) {
+        try {
+          const tokenEntityRef = await resolveUserId(req, auth);
+          const isManager = !!tokenEntityRef && await isUserMemberOfGroup(
+            tokenEntityRef,
+            teamAdminCfg.group,
+            catalogClient,
+            auth,
+            logger
+          );
+          hide = isManager ? teamBudgetVisibility.hideTeamBudgetForManagers : teamBudgetVisibility.hideTeamBudgetForMembers;
+        } catch (err) {
+          logger.warn(`Team-manager check failed, hiding team spend: ${err.message}`);
+          hide = teamBudgetVisibility.hideTeamBudgetForMembers;
+        }
+      }
+      res.json(hide ? redactTeamUsage(usage) : usage);
     } catch (error) {
       logger.error("Failed to fetch team usage", error);
       res.status(500).json({ error: error.message });
@@ -12042,10 +12155,14 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
   readProvisioningDefaults,
   readRoleConfigs,
   readTeamAdminConfig,
+  readTeamBudgetVisibility,
+  redactTeamBudget,
+  redactTeamUsage,
   resolveBridgeUserId,
   resolveUserId,
   resolveUserProfile,
   resolveUserRole,
+  teamBudgetStatusFor,
   toLiteLLMUserId,
   validateTeamPatchInput,
   validateTeamWriteInput