@acarmisc/backstage-plugin-litellm-backend 0.14.0 → 0.16.0

package/dist/routes/bridge.d.ts

@@ -0,0 +1,8 @@
+import { Router } from 'express';
+import { Config } from '@backstage/config';
+import { TokenVerifier } from '../bridge';
+import type { RouterContext } from './context';
+export declare function registerBridgeRoutes(router: Router, ctx: RouterContext, bridgeOpts: {
+    config: Config;
+    tokenVerifier?: TokenVerifier;
+}): void;

package/dist/routes/bridge.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerBridgeRoutes = registerBridgeRoutes;
+const provisioning_1 = require("../provisioning");
+const bridge_1 = require("../bridge");
+const keyService_1 = require("../services/keyService");
+const errors_1 = require("../errors");
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+function registerBridgeRoutes(router, ctx, bridgeOpts) {
+    const { client, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, allowUnlimitedBudget, teamRequired, keyValidationConfig, } = ctx;
+    const { config } = bridgeOpts;
+    const generateKeyInputSchema = (0, backstage_plugin_litellm_common_1.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
+    // ---------------------------------------------------------------------------
+    // Bridge endpoints (CLI / Abby)
+    //
+    // Authenticated by a Keycloak access token (JWKS-verified), NOT by Backstage's
+    // own auth. Lets CLI clients list/mint virtual keys without holding the master
+    // key. Gated by litellm.bridge.enabled; the verifier needs litellm.bridge.issuer.
+    const bridgeCfg = (0, bridge_1.readBridgeConfig)(config);
+    let tokenVerifier = bridgeOpts.tokenVerifier;
+    if (bridgeCfg.enabled && !tokenVerifier) {
+        try {
+            tokenVerifier = (0, bridge_1.newDefaultVerifier)(bridgeCfg);
+        }
+        catch (e) {
+            logger.error(`LiteLLM bridge enabled but misconfigured: ${e.message}`);
+        }
+    }
+    if (bridgeCfg.enabled && tokenVerifier) {
+        // Capture tokenVerifier in the closure to avoid non-null assertion
+        const verifier = tokenVerifier;
+        const requireClaims = async (req) => {
+            const header = req.headers.authorization ?? '';
+            const token = header.startsWith('Bearer ') ? header.slice(7) : '';
+            if (!token)
+                throw new bridge_1.BridgeAuthError('missing Bearer token');
+            return verifier.verify(token);
+        };
+        const handleBridgeError = (error, res) => {
+            if (error instanceof bridge_1.BridgeAuthError) {
+                // Log the jose error details server-side, send opaque 401 to client
+                logger.warn(`Bridge auth error: ${error.message}`);
+                res.status(401).json({ error: 'unauthorized' });
+                return;
+            }
+            if (error instanceof bridge_1.BridgeIdentityError) {
+                res.status(403).json({ error: 'forbidden', detail: error.message });
+                return;
+            }
+            if (error instanceof keyService_1.KeyServiceError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            (0, errors_1.sendError)(res, error, logger, 'bridge request');
+        };
+        router.get('/bridge/health', (_req, res) => {
+            res.json({ status: 'ok', bridge: true, clientId: bridgeCfg.clientId });
+        });
+        router.get('/bridge/keys', async (req, res) => {
+            try {
+                const claims = await requireClaims(req);
+                const keys = await (0, bridge_1.bridgeListKeys)(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain);
+                res.json(keys);
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
+        router.post('/bridge/keys', async (req, res) => {
+            try {
+                const claims = await requireClaims(req);
+                // ── Parse & validate input with strict schema ────────────────────────
+                const parseResult = generateKeyInputSchema.safeParse(req.body);
+                if (!parseResult.success) {
+                    const errorMessages = parseResult.error.errors
+                        .map(e => `${e.path.join('.')}: ${e.message}`)
+                        .join('; ');
+                    res.status(400).json({
+                        error: 'Invalid request body',
+                        details: errorMessages,
+                    });
+                    return;
+                }
+                const input = parseResult.data;
+                // ── Resolve user identity from verified claims ───────────────────────
+                const userId = (0, bridge_1.resolveBridgeUserId)(claims, userIdDomain);
+                // ── Create key via unified service ──────────────────────────────────
+                const keyCreateCtx = {
+                    client,
+                    config: {
+                        allowUnlimitedBudget,
+                        teamRequired,
+                    },
+                    // Bridge does not have Backstage catalogClient/auth
+                    // so provisioning from JWT claims only (no Backstage profile enrichment)
+                    catalogClient: undefined,
+                    auth: undefined,
+                    logger,
+                    keyValidationConfig,
+                    provisioningEnabled,
+                    provisioningDefaults,
+                    roleConfigs,
+                    userIdDomain,
+                };
+                const result = await (0, keyService_1.createKeyForUser)({ userId }, input, keyCreateCtx);
+                res.json(result);
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
+        router.get('/bridge/models', async (req, res) => {
+            try {
+                await requireClaims(req); // authenticate only
+                const models = await client.listModels();
+                res.json(models);
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
+    }
+    else if (bridgeCfg.enabled) {
+        logger.warn('litellm.bridge.enabled is true but no verifier could be built — bridge endpoints not mounted');
+    }
+}

package/dist/routes/config.d.ts

@@ -0,0 +1,7 @@
+import { Router } from 'express';
+import type { RouterContext } from './context';
+/**
+ * Register config-related routes (/health, /config, /openapi.json, /provisioning/preview).
+ * These routes expose configuration and metadata for the LiteLLM plugin.
+ */
+export declare function registerConfigRoutes(router: Router, ctx: RouterContext): void;

package/dist/routes/config.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerConfigRoutes = registerConfigRoutes;
+const provisioning_1 = require("../provisioning");
+const openapi_1 = require("../openapi");
+const errors_1 = require("../errors");
+/**
+ * Register config-related routes (/health, /config, /openapi.json, /provisioning/preview).
+ * These routes expose configuration and metadata for the LiteLLM plugin.
+ */
+function registerConfigRoutes(router, ctx) {
+    router.get('/health', (_req, res) => {
+        res.json({ status: 'ok', provisioning: ctx.provisioningEnabled });
+    });
+    // Exposes the public LiteLLM proxy URL so the frontend can build
+    // ready-to-paste curl / OpenAI-SDK snippets for freshly generated keys.
+    router.get('/config', (_req, res) => {
+        res.json({
+            baseUrl: ctx.publicBaseUrl,
+            supportContact: ctx.supportContact,
+            keyGeneration: { allowUnlimitedBudget: ctx.allowUnlimitedBudget, teamRequired: ctx.teamRequired },
+            keyActions: { allowOwnerResetSpend: ctx.allowOwnerResetSpend },
+            opencode: { enabled: ctx.opencodeCfg.enabled },
+            teamManagement: {
+                enabled: ctx.teamMgmtEnabled,
+                maxBudgetCeiling: ctx.teamAdminCfg.maxBudgetCeiling,
+                allowUnlimitedBudget: ctx.teamAdminCfg.allowUnlimitedBudget,
+                objectPermissionsEnabled: ctx.objectPermsEnabled,
+            },
+            display: {
+                hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,
+                hideTeamBudgetForManagers: ctx.teamBudgetVisibility.hideTeamBudgetForManagers,
+            },
+        });
+    });
+    // Self-hosted OpenAPI 3.1 contract — lets integrators read a spec instead
+    // of router.ts. No swagger-ui dependency; serve the JSON and point external
+    // renderers (Stoplight, Swagger UI hosted elsewhere) at this endpoint.
+    router.get('/openapi.json', (_req, res) => {
+        res.json(openapi_1.openApiSpec);
+    });
+    // Provisioning dry-run: resolves which role a Backstage group maps to and
+    // echoes the effective defaults, collapsing the config → deploy → test loop
+    // into one request. Admin-gated by the audit group (same RBAC as /audit).
+    router.get('/provisioning/preview', async (req, res) => {
+        if (!ctx.auditGroup) {
+            res.status(403).json({ error: 'Preview is not configured (litellm.audit.group not set)' });
+            return;
+        }
+        const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, ctx.auth);
+        if (!tokenEntityRef) {
+            res.status(401).json({ error: 'Authentication required' });
+            return;
+        }
+        const allowed = await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, ctx.auditGroup, ctx.catalogClient, ctx.auth, ctx.logger);
+        if (!allowed) {
+            res.status(403).json({ error: 'Access denied: not a member of the audit group' });
+            return;
+        }
+        const group = req.query.group?.trim();
+        if (!group) {
+            res.status(400).json({ error: 'group query parameter is required (e.g. group=group:default/ai-platform)' });
+            return;
+        }
+        if (!ctx.roleConfigs.length) {
+            res.json({
+                group,
+                matched_role: null,
+                effective_defaults: ctx.provisioningDefaults,
+                note: 'No litellm.provisioning.roles configured — every group receives the base defaults.',
+            });
+            return;
+        }
+        try {
+            const matched = ctx.roleConfigs.find(rc => rc.group === group);
+            const effective = matched
+                ? (0, provisioning_1.applyRoleOverrides)(ctx.provisioningDefaults, matched)
+                : ctx.provisioningDefaults;
+            res.json({
+                group,
+                matched_role: matched?.group ?? null,
+                effective_defaults: effective,
+            });
+        }
+        catch (error) {
+            (0, errors_1.sendError)(res, error, ctx.logger, 'resolve provisioning preview');
+        }
+    });
+}

package/dist/routes/context.d.ts

@@ -0,0 +1,55 @@
+import { Response, Request } from 'express';
+import { AuthService, PermissionsService, LoggerService } from '@backstage/backend-plugin-api';
+import { BasicPermission } from '@backstage/plugin-permission-common';
+import { CatalogClient } from '@backstage/catalog-client';
+import { LiteLLMClient } from '../client';
+import { ProvisioningDefaults, RoleConfig, VirtualKey, TeamInfo } from '../types';
+import { TeamAdminConfig } from '../teamAdmin';
+import type { KeyValidationConfig } from '@acarmisc/backstage-plugin-litellm-common';
+import { TeamBudgetVisibility } from '../teamBudgetVisibility';
+import { OpencodeConfig } from '../opencode';
+/**
+ * Shared runtime context for all route handlers. Holds config-derived
+ * constants, service clients, and helper functions needed by routes.
+ */
+export interface RouterContext {
+    client: LiteLLMClient;
+    catalogClient: CatalogClient;
+    auth: AuthService;
+    permissions: PermissionsService;
+    logger: LoggerService;
+    baseUrl: string;
+    publicBaseUrl: string | null;
+    supportContact: string | undefined;
+    userIdDomain: string | undefined;
+    provisioningEnabled: boolean;
+    provisioningDefaults: ProvisioningDefaults;
+    roleConfigs: RoleConfig[];
+    auditGroup: string | undefined;
+    allowUnlimitedBudget: boolean;
+    teamRequired: boolean;
+    allowOwnerResetSpend: boolean;
+    keyValidationConfig: KeyValidationConfig;
+    teamMgmtEnabled: boolean;
+    objectPermsEnabled: boolean;
+    teamAdminCfg: TeamAdminConfig;
+    teamBudgetVisibility: TeamBudgetVisibility;
+    opencodeCfg: OpencodeConfig;
+    authorizeKeyAction(req: Request, keyId: string): Promise<{
+        tokenEntityRef: string;
+        userId: string;
+        key: VirtualKey;
+    }>;
+    sendOwnershipError(err: unknown, res: Response): boolean;
+    assertPermission(req: Request, permission: BasicPermission): Promise<boolean>;
+    sendPermissionDenied(res: Response, permission: BasicPermission): void;
+    requireTeamMgmt(res: Response): boolean;
+    requireObjectPerms(res: Response): boolean;
+    sendTeamError(err: unknown, res: Response): void;
+    authorizeTeamSubresource(req: Request, res: Response, permission: BasicPermission): Promise<{
+        teamId: string;
+        owningGroup: string;
+        actor: string;
+        team: TeamInfo;
+    } | null>;
+}

package/dist/routes/context.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/routes/keys.d.ts

@@ -0,0 +1,8 @@
+import { Router } from 'express';
+import type { RouterContext } from './context';
+/**
+ * Register key and user routes: /user/info, /keys*, key mutations, /audit,
+ * /models and /usage. Handlers are unchanged from router.ts; only their
+ * location and access to shared state (via ctx) differ.
+ */
+export declare function registerKeysRoutes(router: Router, ctx: RouterContext): void;