@acarmisc/backstage-plugin-litellm-backend 0.13.0 → 0.14.0

package/dist/client.d.ts

@@ -1,4 +1,10 @@
-import { LiteLLMConfig, UserInfo, VirtualKey, ModelInfo, UsageMetrics, TeamInfo, GenerateKeyRequest, GenerateKeyResponse, UpdateKeyRequest, DeleteKeyRequest, CreateUserRequest, CreateUserResponse, CreateTeamRequest, CreateTeamResponse, UpdateTeamRequest, AuditLogsParams, PaginatedAuditLogs } from './types';
+import { LiteLLMConfig, UserInfo, VirtualKey, ModelInfo, UsageMetrics, TeamInfo, GenerateKeyRequest, GenerateKeyResponse, UpdateKeyRequest, DeleteKeyRequest, CreateUserRequest, CreateUserResponse, CreateTeamRequest, CreateTeamResponse, UpdateTeamRequest, AuditLogsParams, PaginatedAuditLogs, SpendLogEntry, SpendLogsParams } from './types';
+/**
+ * LiteLLM versions differ on `request_tags`: an array of `k:v` strings in
+ * current builds, but historically an object map. Normalise both to a flat
+ * string array so callers can `includes('session:...')` uniformly.
+ */
+export declare function normalizeRequestTags(tags: SpendLogEntry['request_tags']): string[];
 /**
  * Typed error for failed upstream LiteLLM responses. Preserves the HTTP
  * status and the structured `param` (e.g. `key_alias`) from the upstream
@@ -149,6 +155,17 @@ export declare class LiteLLMClient {
         name?: string;
         url?: string;
     }>>;
+    /**
+     * Reads per-request spend logs from LiteLLM (`GET /spend/logs`), filtered
+     * by date range and optionally by key/user/team. Rows are normalised so
+     * `request_tags` is always a `string[]` (LiteLLM returns either an array
+     * or an object depending on version) — callers group by tag to attribute
+     * spend to a conversation or caller.
+     *
+     * This is the admin/DB-backed endpoint: it can return a large number of
+     * rows, so callers should keep the date window tight and cap `page_size`.
+     */
+    getSpendLogs(params: SpendLogsParams): Promise<SpendLogEntry[]>;
     private emptyUsage;
     /**
      * Transforms LiteLLM's SpendAnalyticsPaginatedResponse into the flatter

package/dist/client.js

@@ -1,7 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.LiteLLMClient = exports.LiteLLMUpstreamError = void 0;
+exports.normalizeRequestTags = normalizeRequestTags;
 const DEFAULT_TIMEOUT = 30000;
+/**
+ * LiteLLM versions differ on `request_tags`: an array of `k:v` strings in
+ * current builds, but historically an object map. Normalise both to a flat
+ * string array so callers can `includes('session:...')` uniformly.
+ */
+function normalizeRequestTags(tags) {
+    if (!tags)
+        return [];
+    if (Array.isArray(tags))
+        return tags.filter((t) => typeof t === 'string');
+    return Object.entries(tags).map(([k, v]) => `${k}:${v}`);
+}
 /**
  * Typed error for failed upstream LiteLLM responses. Preserves the HTTP
  * status and the structured `param` (e.g. `key_alias`) from the upstream
@@ -451,6 +464,47 @@ class LiteLLMClient {
         }))
             .filter(r => r.id);
     }
+    /**
+     * Reads per-request spend logs from LiteLLM (`GET /spend/logs`), filtered
+     * by date range and optionally by key/user/team. Rows are normalised so
+     * `request_tags` is always a `string[]` (LiteLLM returns either an array
+     * or an object depending on version) — callers group by tag to attribute
+     * spend to a conversation or caller.
+     *
+     * This is the admin/DB-backed endpoint: it can return a large number of
+     * rows, so callers should keep the date window tight and cap `page_size`.
+     */
+    async getSpendLogs(params) {
+        const query = new URLSearchParams({
+            start_date: params.start_date,
+            end_date: params.end_date,
+        });
+        if (params.api_key)
+            query.append('api_key', params.api_key);
+        if (params.user_id)
+            query.append('user_id', params.user_id);
+        if (params.team_id)
+            query.append('team_id', params.team_id);
+        if (params.page_size)
+            query.append('page_size', String(params.page_size));
+        const raw = await this.request(`/spend/logs?${query.toString()}`);
+        const rows = Array.isArray(raw) ? raw : raw?.data ?? [];
+        return rows.map(row => ({
+            request_id: row?.request_id,
+            startTime: row?.startTime ?? row?.start_time,
+            endTime: row?.endTime ?? row?.end_time,
+            spend: row?.spend ?? 0,
+            total_tokens: row?.total_tokens ?? 0,
+            prompt_tokens: row?.prompt_tokens ?? 0,
+            completion_tokens: row?.completion_tokens ?? 0,
+            model: row?.model,
+            api_key: row?.api_key,
+            user: row?.user,
+            team_id: row?.team_id,
+            request_tags: normalizeRequestTags(row?.request_tags),
+            metadata: row?.metadata,
+        }));
+    }
     emptyUsage() {
         return {
             total_spend: 0,

package/dist/index.cjs.js

@@ -7997,6 +7997,7 @@ __export(index_exports, {
   litellmTeamMcpManagePermission: () => litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission: () => litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
+  normalizeRequestTags: () => normalizeRequestTags,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
   readProvisioningDefaults: () => readProvisioningDefaults,
@@ -8026,6 +8027,11 @@ var import_catalog_client = require("@backstage/catalog-client");
 
 // src/client.ts
 var DEFAULT_TIMEOUT = 3e4;
+function normalizeRequestTags(tags) {
+  if (!tags) return [];
+  if (Array.isArray(tags)) return tags.filter((t) => typeof t === "string");
+  return Object.entries(tags).map(([k, v]) => `${k}:${v}`);
+}
 var LiteLLMUpstreamError = class extends Error {
   constructor(status, statusText, body) {
     let message2 = `LiteLLM API error: ${status} ${statusText} - ${body}`;
@@ -8429,6 +8435,43 @@ var LiteLLMClient = class {
       url: r?.url ?? void 0
     })).filter((r) => r.id);
   }
+  /**
+   * Reads per-request spend logs from LiteLLM (`GET /spend/logs`), filtered
+   * by date range and optionally by key/user/team. Rows are normalised so
+   * `request_tags` is always a `string[]` (LiteLLM returns either an array
+   * or an object depending on version) — callers group by tag to attribute
+   * spend to a conversation or caller.
+   *
+   * This is the admin/DB-backed endpoint: it can return a large number of
+   * rows, so callers should keep the date window tight and cap `page_size`.
+   */
+  async getSpendLogs(params) {
+    const query = new URLSearchParams({
+      start_date: params.start_date,
+      end_date: params.end_date
+    });
+    if (params.api_key) query.append("api_key", params.api_key);
+    if (params.user_id) query.append("user_id", params.user_id);
+    if (params.team_id) query.append("team_id", params.team_id);
+    if (params.page_size) query.append("page_size", String(params.page_size));
+    const raw = await this.request(`/spend/logs?${query.toString()}`);
+    const rows = Array.isArray(raw) ? raw : raw?.data ?? [];
+    return rows.map((row) => ({
+      request_id: row?.request_id,
+      startTime: row?.startTime ?? row?.start_time,
+      endTime: row?.endTime ?? row?.end_time,
+      spend: row?.spend ?? 0,
+      total_tokens: row?.total_tokens ?? 0,
+      prompt_tokens: row?.prompt_tokens ?? 0,
+      completion_tokens: row?.completion_tokens ?? 0,
+      model: row?.model,
+      api_key: row?.api_key,
+      user: row?.user,
+      team_id: row?.team_id,
+      request_tags: normalizeRequestTags(row?.request_tags),
+      metadata: row?.metadata
+    }));
+  }
   emptyUsage() {
     return {
       total_spend: 0,
@@ -10896,6 +10939,20 @@ function redactTeamUsage(usage) {
   };
 }
 
+// src/opencode.ts
+function readOpencodeConfig(config) {
+  const enabled = config.getOptionalBoolean("litellm.opencode.enabled") ?? false;
+  return {
+    enabled,
+    keyDuration: config.getOptionalString("litellm.opencode.keyDuration") ?? "30d",
+    maxBudget: config.getOptionalNumber("litellm.opencode.maxBudget") ?? 50,
+    requireTeam: config.getOptionalBoolean("litellm.opencode.requireTeam") ?? false,
+    metadata: config.getOptional(
+      "litellm.opencode.metadata"
+    ) ?? {}
+  };
+}
+
 // src/router.ts
 var teamCreateInFlight = /* @__PURE__ */ new Map();
 var TEAM_FETCH_RETRY_DELAYS_MS = [100, 300, 900];
@@ -10917,6 +10974,15 @@ async function withTeamFetchRetry(fn, delaysMs = TEAM_FETCH_RETRY_DELAYS_MS) {
     }
   }
 }
+function isValidRedirectUri(uri) {
+  if (!uri) return false;
+  try {
+    const url = new URL(uri);
+    return url.protocol === "http:" && (url.hostname === "localhost" || url.hostname === "127.0.0.1") && url.pathname === "/callback";
+  } catch {
+    return false;
+  }
+}
 async function createRouter(options) {
   const { config, logger, auth, discovery, permissions } = options;
   const baseUrl = config.getString("litellm.baseUrl");
@@ -10933,6 +10999,7 @@ async function createRouter(options) {
   const objectPermsEnabled = isObjectPermissionsEnabled(config);
   const teamAdminCfg = readTeamAdminConfig(config);
   const teamBudgetVisibility = readTeamBudgetVisibility(config);
+  const opencodeCfg = readOpencodeConfig(config);
   const catalogClient = options.catalogClient ?? new import_catalog_client.CatalogClient({ discoveryApi: discovery });
   if (provisioningEnabled) {
     logger.info(
@@ -10958,6 +11025,7 @@ async function createRouter(options) {
     res.json({
       baseUrl: publicBaseUrl,
       keyGeneration: { allowUnlimitedBudget, teamRequired },
+      opencode: { enabled: opencodeCfg.enabled },
       teamManagement: {
         enabled: teamMgmtEnabled,
         maxBudgetCeiling: teamAdminCfg.maxBudgetCeiling,
@@ -11194,6 +11262,109 @@ async function createRouter(options) {
       res.status(500).json({ error: error.message });
     }
   });
+  if (opencodeCfg.enabled) {
+    logger.info(
+      `OpenCode connect endpoint enabled \u2014 duration=${opencodeCfg.keyDuration}, maxBudget=$${opencodeCfg.maxBudget}`
+    );
+    router.get("/opencode/connect", async (req, res) => {
+      try {
+        const tokenEntityRef = await resolveUserId(req, auth);
+        if (!tokenEntityRef) {
+          res.status(401).json({ error: "Authentication required" });
+          return;
+        }
+        const redirectUri = req.query.redirect_uri;
+        if (!isValidRedirectUri(redirectUri)) {
+          res.status(400).json({
+            error: "Invalid redirect_uri \u2014 expected http://localhost:<port>/callback"
+          });
+          return;
+        }
+        if (!await assertPermission(req, litellmKeyCreatePermission)) {
+          sendPermissionDenied(res, litellmKeyCreatePermission);
+          return;
+        }
+        const userId = toLiteLLMUserId(tokenEntityRef, userIdDomain);
+        const userInfo = await getOrProvisionUser(
+          client,
+          tokenEntityRef,
+          userId,
+          provisioningEnabled,
+          provisioningDefaults,
+          roleConfigs,
+          catalogClient,
+          auth,
+          logger
+        );
+        const teamId = req.query.team;
+        if (teamId) {
+          const userTeams = userInfo?.teams ?? [];
+          if (!userTeams.includes(teamId)) {
+            res.status(403).json({
+              error: "Access denied: team is not one of your teams",
+              team: teamId
+            });
+            return;
+          }
+        } else if (opencodeCfg.requireTeam) {
+          res.status(400).json({ error: "A team is required for this connection" });
+          return;
+        }
+        const alias = teamId ? `opencode-${userId}-${teamId}` : `opencode-${userId}`;
+        const existing = await client.listKeys(userId).catch(() => []);
+        const reusable = existing.find(
+          (k) => k.key_alias === alias && !k.blocked && k.user_id === userId
+        );
+        let key;
+        if (reusable?.token ?? reusable?.key) {
+          key = reusable.token ?? reusable.key;
+        } else {
+          const profile = await resolveUserProfile(
+            tokenEntityRef,
+            catalogClient,
+            auth,
+            logger
+          );
+          const result = await client.generateKey({
+            alias,
+            duration: opencodeCfg.keyDuration,
+            max_budget: opencodeCfg.maxBudget,
+            team_id: teamId,
+            metadata: {
+              ...opencodeCfg.metadata,
+              created_via: "opencode-connect",
+              created_by_backstage_user: tokenEntityRef,
+              ...profile.email && { created_by_email: profile.email },
+              ...teamId && { opencode_team: teamId }
+            },
+            user_id: userId
+          });
+          if (!result.key) {
+            res.status(502).json({ error: "LiteLLM returned no key material" });
+            return;
+          }
+          key = result.key;
+        }
+        const url = new URL(redirectUri);
+        url.searchParams.set("key", key);
+        if (teamId) url.searchParams.set("team", teamId);
+        logger.info({
+          action: "opencode.connect",
+          userId,
+          team: teamId ?? null,
+          reused: Boolean(reusable?.token ?? reusable?.key)
+        });
+        res.redirect(302, url.href);
+      } catch (error) {
+        if (error instanceof ProvisioningError) {
+          res.status(error.status).json(error.body);
+          return;
+        }
+        logger.error("OpenCode connect failed", error);
+        res.status(500).json({ error: error.message });
+      }
+    });
+  }
   router.post("/keys/:keyId/update", async (req, res) => {
     try {
       const { keyId } = req.params;
@@ -12150,6 +12321,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
   litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission,
   newDefaultVerifier,
+  normalizeRequestTags,
   provisionUser,
   readBridgeConfig,
   readProvisioningDefaults,