@acarmisc/backstage-plugin-litellm-backend 0.15.0 → 0.16.1

package/dist/routes/teams.js

@@ -0,0 +1,367 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerTeamsRoutes = registerTeamsRoutes;
+const provisioning_1 = require("../provisioning");
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+const teamAdmin_1 = require("../teamAdmin");
+const teamBudgetVisibility_1 = require("../teamBudgetVisibility");
+const errors_1 = require("../errors");
+const withUser_1 = require("./middleware/withUser");
+const respondTeam_1 = require("../http/respondTeam");
+const teamFetch_1 = require("../http/teamFetch");
+function registerTeamsRoutes(router, ctx) {
+    const { client, catalogClient, auth, permissions, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, teamAdminCfg, teamBudgetVisibility, requireTeamMgmt, sendTeamError, authorizeTeamSubresource, } = ctx;
+    const requireUser = (0, withUser_1.createRequireUser)(ctx);
+    router.get('/teams', requireUser, async (_req, res) => {
+        try {
+            const userInfo = await (0, withUser_1.getProvisionedUser)(ctx, res);
+            if (!userInfo?.teams?.length) {
+                res.json([]);
+                return;
+            }
+            const teams = await Promise.all(userInfo.teams.map((teamId) => (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId)).catch(err => {
+                logger.warn(`Failed to fetch team ${teamId} after retries: ${err.message}`);
+                return null;
+            })));
+            const list = teams.filter(Boolean);
+            // Member surface: strip dollar amounts when the operator hides them
+            // from members. Managers who need the numbers use /teams/managed.
+            (0, respondTeam_1.respondTeamList)(res, list, ctx, 'member');
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            (0, errors_1.sendError)(res, error, logger, 'fetch teams');
+        }
+    });
+    router.post('/teams', async (req, res) => {
+        if (!requireTeamMgmt(res))
+            return;
+        if (!teamAdminCfg.group) {
+            res.status(500).json({ error: 'Team management is misconfigured (group is missing)' });
+            return;
+        }
+        const check = await (0, teamAdmin_1.assertTeamAdmin)({
+            req,
+            auth,
+            permissions,
+            catalogClient,
+            teamAdminGroup: teamAdminCfg.group,
+            permission: backstage_plugin_litellm_common_1.litellmTeamCreatePermission,
+            logger,
+        });
+        if (!check.ok) {
+            res.status(check.status).json({ error: check.error });
+            return;
+        }
+        const v = (0, teamAdmin_1.validateTeamWriteInput)(req.body ?? {}, teamAdminCfg);
+        if (!v.ok) {
+            res.status(400).json({ error: v.error });
+            return;
+        }
+        const key = v.value.team_alias.trim().toLowerCase();
+        const pending = teamFetch_1.teamCreateInFlight.get(key);
+        if (pending) {
+            logger.info(`Team creation already in flight for ${key} — joining`);
+            try {
+                const result = await pending;
+                res.json(result);
+            }
+            catch (err) {
+                sendTeamError(err, res);
+            }
+            return;
+        }
+        const payload = {
+            team_alias: v.value.team_alias,
+            models: v.value.models,
+            ...(v.value.max_budget !== undefined && { max_budget: v.value.max_budget }),
+            ...(v.value.budget_duration && { budget_duration: v.value.budget_duration }),
+            ...(v.value.tpm_limit !== undefined && { tpm_limit: v.value.tpm_limit }),
+            ...(v.value.rpm_limit !== undefined && { rpm_limit: v.value.rpm_limit }),
+            metadata: {
+                owning_group: teamAdminCfg.group,
+                created_by_backstage_user: check.userEntityRef,
+                created_via: 'backstage',
+                created_at_iso: new Date().toISOString(),
+            },
+        };
+        const createPromise = (async () => {
+            const result = await client.createTeam(payload);
+            logger.info('team.create', {
+                actor: check.userEntityRef,
+                teamAlias: v.value.team_alias,
+                owningGroup: teamAdminCfg.group,
+            });
+            return result;
+        })();
+        teamFetch_1.teamCreateInFlight.set(key, createPromise);
+        try {
+            const result = await createPromise;
+            // Manager surface: redact dollars when hidden even from managers.
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(result)
+                : result);
+        }
+        catch (err) {
+            sendTeamError(err, res);
+        }
+        finally {
+            teamFetch_1.teamCreateInFlight.delete(key);
+        }
+    });
+    router.patch('/teams/:teamId', async (req, res) => {
+        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamManagePermission);
+        if (!authz)
+            return;
+        const { teamId, owningGroup, actor, team: existing } = authz;
+        const v = (0, teamAdmin_1.validateTeamPatchInput)(req.body ?? {}, teamAdminCfg);
+        if (!v.ok) {
+            res.status(400).json({ error: v.error });
+            return;
+        }
+        // Optimistic-concurrency guard (opt-in): when the client sends the
+        // `expectedUpdatedAtIso` it based its edit on, reject if the stored value
+        // has moved on — a concurrent edit landed in between. Callers that don't
+        // send it are unaffected (last-writer-wins, as before).
+        const expected = (req.body ?? {}).expectedUpdatedAtIso;
+        if (expected !== undefined &&
+            expected !== existing.metadata?.updated_at_iso) {
+            res.status(409).json({
+                error: 'This team was modified since you loaded it. Reload and re-apply your change.',
+            });
+            return;
+        }
+        const payload = {
+            team_id: teamId,
+            ...v.value,
+            metadata: {
+                ...(existing.metadata ?? {}),
+                updated_by_backstage_user: actor,
+                updated_at_iso: new Date().toISOString(),
+            },
+        };
+        try {
+            const r = await client.updateTeam(payload);
+            logger.info('team.update', {
+                actor,
+                teamId,
+                owningGroup,
+            });
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(r)
+                : r);
+        }
+        catch (err) {
+            sendTeamError(err, res);
+        }
+    });
+    // Delete a team the caller's group owns. Gated by litellm.teamAdmin.allowTeamDelete
+    // (default false — deletion is destructive: it orphans keys and revokes access
+    // for every member). Refuses when the team id is referenced by provisioning
+    // config unless ?force=true. Prefer blocking a team over deleting it.
+    router.delete('/teams/:teamId', async (req, res) => {
+        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamDeletePermission);
+        if (!authz)
+            return;
+        const { teamId, owningGroup, actor } = authz;
+        if (!teamAdminCfg.allowTeamDelete) {
+            res.status(403).json({
+                error: 'Team deletion is disabled (set litellm.teamAdmin.allowTeamDelete: true). Block the team instead.',
+            });
+            return;
+        }
+        const provisioningRefs = [
+            ...provisioningDefaults.teams,
+            ...roleConfigs.flatMap(r => r.teams ?? []),
+        ];
+        const force = String(req.query.force ?? '') === 'true';
+        if (provisioningRefs.includes(teamId) && !force) {
+            res.status(409).json({
+                error: `Team ${teamId} is referenced by litellm.provisioning config; deleting it will break user provisioning. Re-send with ?force=true to override.`,
+            });
+            return;
+        }
+        try {
+            await client.deleteTeam(teamId);
+            logger.info('team.delete', { actor, teamId, owningGroup, force });
+            res.json({ success: true });
+        }
+        catch (err) {
+            sendTeamError(err, res);
+        }
+    });
+    // Scoped listing for team admins: returns ONLY the teams whose
+    // `metadata.owning_group` equals the configured admin group, so a team admin
+    // can see and edit teams their group owns even when they are not a member.
+    // This deliberately never returns a global team list. Registered before any
+    // `/teams/:param` route so the literal path is not shadowed.
+    router.get('/teams/managed', async (req, res) => {
+        if (!requireTeamMgmt(res))
+            return;
+        if (!teamAdminCfg.group) {
+            res.status(500).json({ error: 'Team management is misconfigured (group is missing)' });
+            return;
+        }
+        const check = await (0, teamAdmin_1.assertTeamAdmin)({
+            req,
+            auth,
+            permissions,
+            catalogClient,
+            teamAdminGroup: teamAdminCfg.group,
+            permission: backstage_plugin_litellm_common_1.litellmTeamManagePermission,
+            logger,
+        });
+        if (!check.ok) {
+            res.status(check.status).json({ error: check.error });
+            return;
+        }
+        try {
+            const all = await client.listTeams();
+            // TODO(multi-group): when litellm.teamAdmin.group becomes a list, resolve
+            // the caller's group set and filter with includes().
+            const owned = all.filter(t => typeof t.metadata?.owning_group === 'string' &&
+                t.metadata.owning_group === teamAdminCfg.group);
+            // Manager surface: strip dollar amounts when hidden even from managers.
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? owned.map(teamBudgetVisibility_1.redactTeamBudget)
+                : owned);
+        }
+        catch (err) {
+            sendTeamError(err, res);
+        }
+    });
+    // ── Team member routes ──────────────────────────────────────────────────
+    //
+    // Add a member to a team the caller's group owns. The member must (a) resolve
+    // to a real User in the Backstage catalog and (b) exist in LiteLLM — we
+    // provision them on the spot when auto-provisioning is enabled. Only the
+    // 'user' team role can be assigned from Backstage.
+    router.post('/teams/:teamId/members', async (req, res) => {
+        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission);
+        if (!authz)
+            return;
+        const { teamId, owningGroup, actor } = authz;
+        const body = (req.body ?? {});
+        const userEntityRef = (body.userEntityRef ?? '').trim();
+        if (!userEntityRef) {
+            res.status(400).json({ error: 'userEntityRef is required' });
+            return;
+        }
+        if (body.role !== undefined && body.role !== 'user') {
+            res.status(400).json({
+                error: "only the 'user' team role can be assigned from Backstage",
+            });
+            return;
+        }
+        let maxBudgetInTeam;
+        if (body.maxBudgetInTeam !== undefined) {
+            if (typeof body.maxBudgetInTeam !== 'number' ||
+                !Number.isFinite(body.maxBudgetInTeam) ||
+                body.maxBudgetInTeam <= 0) {
+                res
+                    .status(400)
+                    .json({ error: 'maxBudgetInTeam must be a positive number' });
+                return;
+            }
+            maxBudgetInTeam = body.maxBudgetInTeam;
+        }
+        // (a) the member must be a real User in the Backstage catalog
+        try {
+            const { token } = await auth.getPluginRequestToken({
+                onBehalfOf: await auth.getOwnServiceCredentials(),
+                targetPluginId: 'catalog',
+            });
+            const entity = await catalogClient.getEntityByRef(userEntityRef, {
+                token,
+            });
+            if (!entity || entity.kind !== 'User') {
+                res.status(400).json({
+                    error: `${userEntityRef} is not a User in the Backstage catalog`,
+                });
+                return;
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logger.warn(`Catalog lookup failed for ${userEntityRef}: ${message}`);
+            res.status(400).json({
+                error: `Could not verify ${userEntityRef} in the Backstage catalog`,
+            });
+            return;
+        }
+        // (b) the member must exist in LiteLLM — provision on the spot if enabled
+        const litellmUserId = (0, provisioning_1.toLiteLLMUserId)(userEntityRef, userIdDomain);
+        try {
+            await (0, provisioning_1.getOrProvisionUser)(client, userEntityRef, litellmUserId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+        }
+        catch (err) {
+            if (err instanceof provisioning_1.ProvisioningError) {
+                res.status(err.status).json(err.body);
+                return;
+            }
+            throw err;
+        }
+        try {
+            await client.teamMemberAdd({
+                team_id: teamId,
+                user_id: litellmUserId,
+                role: 'user',
+                ...(maxBudgetInTeam !== undefined && {
+                    max_budget_in_team: maxBudgetInTeam,
+                }),
+            });
+            logger.info('team.member.add', {
+                actor,
+                teamId,
+                member: litellmUserId,
+                owningGroup,
+            });
+            const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
+                : updated);
+        }
+        catch (err) {
+            sendTeamError(err, res);
+        }
+    });
+    // Remove a member from a team the caller's group owns. The member ref comes
+    // from the `userEntityRef` query param (entity refs contain ':' and '/', so
+    // they can't be a path segment). No catalog re-check on removal.
+    router.delete('/teams/:teamId/members', async (req, res) => {
+        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission);
+        if (!authz)
+            return;
+        const { teamId, owningGroup, actor } = authz;
+        const userEntityRef = String(req.query.userEntityRef ?? '').trim();
+        if (!userEntityRef) {
+            res
+                .status(400)
+                .json({ error: 'userEntityRef query parameter is required' });
+            return;
+        }
+        const litellmUserId = (0, provisioning_1.toLiteLLMUserId)(userEntityRef, userIdDomain);
+        try {
+            await client.teamMemberDelete({
+                team_id: teamId,
+                user_id: litellmUserId,
+            });
+            logger.info('team.member.remove', {
+                actor,
+                teamId,
+                member: litellmUserId,
+                owningGroup,
+            });
+            const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
+            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
+                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
+                : updated);
+        }
+        catch (err) {
+            sendTeamError(err, res);
+        }
+    });
+}

package/dist/services/keyService.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Key generation service — unified by PR-6.
+ *
+ * Extracts the common logic for creating API keys from both the UI (POST /keys/generate)
+ * and the bridge (POST /bridge/keys). Handles validation, provisioning, team/model checks,
+ * and explicit upstream request construction.
+ */
+import { AuthService, LoggerService } from '@backstage/backend-plugin-api';
+import { CatalogClient } from '@backstage/catalog-client';
+import { LiteLLMClient } from '../client';
+import { GenerateKeyResponse, ProvisioningDefaults, RoleConfig } from '../types';
+import { type KeyValidationConfig, type GenerateKeyInput } from '@acarmisc/backstage-plugin-litellm-common';
+export interface KeyCreateUser {
+    /** Backstage user entity ref, e.g. "user:default/alice" (may be empty for bridge). */
+    tokenEntityRef?: string;
+    /** Resolved LiteLLM user_id. Required. */
+    userId: string;
+}
+/** Context needed to create a key — configuration, clients, and services. */
+export interface KeyCreateContext {
+    client: LiteLLMClient;
+    config: {
+        allowUnlimitedBudget: boolean;
+        teamRequired: boolean;
+    };
+    catalogClient?: CatalogClient;
+    auth?: AuthService;
+    logger: LoggerService;
+    keyValidationConfig: KeyValidationConfig;
+    provisioningEnabled: boolean;
+    provisioningDefaults: ProvisioningDefaults;
+    roleConfigs: RoleConfig[];
+    userIdDomain?: string;
+}
+/** Error thrown during key creation — maps to HTTP responses. */
+export declare class KeyServiceError extends Error {
+    status: number;
+    body: Record<string, unknown>;
+    constructor(status: number, body: Record<string, unknown>, message?: string);
+}
+/**
+ * Creates a new API key for the specified user.
+ *
+ * Performs:
+ * - Schema validation of the input
+ * - Config flag enforcement (allowUnlimitedBudget, teamRequired)
+ * - User provisioning (single-flight, role configs)
+ * - Team membership validation
+ * - Model subset validation
+ * - Metadata stamping
+ * - Explicit upstream request construction and call
+ *
+ * @param user Verified identity: tokenEntityRef (optional) + userId (required)
+ * @param input Parsed GenerateKeyInput from the schema
+ * @param ctx Configuration and service clients
+ * @returns The new key response from LiteLLM
+ * @throws KeyServiceError with status and body for HTTP response
+ * @throws ProvisioningError for provisioning failures
+ * @throws LiteLLMUpstreamError for upstream LiteLLM errors
+ */
+export declare function createKeyForUser(user: KeyCreateUser, input: GenerateKeyInput, ctx: KeyCreateContext): Promise<GenerateKeyResponse>;

package/dist/services/keyService.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * Key generation service — unified by PR-6.
+ *
+ * Extracts the common logic for creating API keys from both the UI (POST /keys/generate)
+ * and the bridge (POST /bridge/keys). Handles validation, provisioning, team/model checks,
+ * and explicit upstream request construction.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyServiceError = void 0;
+exports.createKeyForUser = createKeyForUser;
+const provisioning_1 = require("../provisioning");
+/** Unified identity for key creation — resolved from either Backstage or JWT claims. */
+const modelAccess_1 = require("./modelAccess");
+/** Error thrown during key creation — maps to HTTP responses. */
+class KeyServiceError extends Error {
+    constructor(status, body, message) {
+        super(message || JSON.stringify(body));
+        this.status = status;
+        this.body = body;
+    }
+}
+exports.KeyServiceError = KeyServiceError;
+/**
+ * Creates a new API key for the specified user.
+ *
+ * Performs:
+ * - Schema validation of the input
+ * - Config flag enforcement (allowUnlimitedBudget, teamRequired)
+ * - User provisioning (single-flight, role configs)
+ * - Team membership validation
+ * - Model subset validation
+ * - Metadata stamping
+ * - Explicit upstream request construction and call
+ *
+ * @param user Verified identity: tokenEntityRef (optional) + userId (required)
+ * @param input Parsed GenerateKeyInput from the schema
+ * @param ctx Configuration and service clients
+ * @returns The new key response from LiteLLM
+ * @throws KeyServiceError with status and body for HTTP response
+ * @throws ProvisioningError for provisioning failures
+ * @throws LiteLLMUpstreamError for upstream LiteLLM errors
+ */
+async function createKeyForUser(user, input, ctx) {
+    const { client, config, catalogClient, auth, logger, provisioningEnabled, provisioningDefaults, roleConfigs, } = ctx;
+    // ── Ensure user is provisioned ──────────────────────────────────────
+    // For bridge (no catalogClient/auth), use direct provisioning from JWT;
+    // for UI (with catalogClient/auth), use full provisioning with group roles.
+    let userInfo;
+    if (catalogClient !== undefined && catalogClient !== null && auth !== undefined && auth !== null) {
+        userInfo = await (0, provisioning_1.getOrProvisionUser)(client, user.tokenEntityRef || '', user.userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+    }
+    else {
+        // Bridge path: just check if user exists, or provision with minimal info
+        userInfo = await client.getUserInfo(user.userId);
+        if (!userInfo) {
+            if (!provisioningEnabled) {
+                throw new KeyServiceError(404, {
+                    error: 'User not found in LiteLLM',
+                    detail: 'No LiteLLM user for this identity. Log in to Backstage once to be provisioned, or enable litellm.provisioning.enabled.',
+                });
+            }
+            // Provision with minimal info (just user_id, will use defaults)
+            const created = await client.createUser({
+                user_id: user.userId,
+                user_email: user.userId,
+                max_budget: provisioningDefaults.maxBudget,
+                budget_duration: provisioningDefaults.budgetDuration,
+                models: provisioningDefaults.models,
+                teams: provisioningDefaults.teams?.length ? [provisioningDefaults.teams[0]] : [],
+            });
+            if (!created) {
+                throw new KeyServiceError(500, {
+                    error: 'User provisioning failed',
+                    detail: 'Failed to create user in LiteLLM',
+                });
+            }
+            userInfo = await client.getUserInfo(user.userId);
+        }
+    }
+    // ── Enforce config flags ────────────────────────────────────────────
+    if (!config.allowUnlimitedBudget && (input.max_budget === null || input.max_budget === undefined)) {
+        throw new KeyServiceError(400, { error: 'max_budget is required when unlimited budgets are not allowed' });
+    }
+    if (config.teamRequired && !input.team_id) {
+        throw new KeyServiceError(400, { error: 'team_id is required' });
+    }
+    // ── Validate team membership ────────────────────────────────────────
+    if (input.team_id) {
+        const userTeams = userInfo?.teams ?? [];
+        if (!userTeams.includes(input.team_id)) {
+            throw new KeyServiceError(403, {
+                error: 'Access denied: team is not one of your teams',
+                team_id: input.team_id,
+            });
+        }
+    }
+    // ── Validate models are subset of allowed ────────────────────────────
+    if (input.models && input.models.length > 0) {
+        // When team_id is set, use team's models; otherwise use user's models.
+        // Empty/missing allowedModels list means unrestricted.
+        let allowedModels = [];
+        if (input.team_id) {
+            // Fetch team info to get its allowed models.
+            // Fail closed: if the team can't be fetched the error propagates
+            // rather than silently skipping the model check.
+            const teamInfo = await client.getTeamInfo(input.team_id);
+            allowedModels = teamInfo?.models ?? [];
+        }
+        else {
+            allowedModels = userInfo?.models ?? [];
+        }
+        const disallowed = await (0, modelAccess_1.findDisallowedModels)(client, input.models, allowedModels);
+        if (disallowed.length > 0) {
+            throw new KeyServiceError(400, {
+                error: 'One or more requested models are not allowed',
+                disallowed_models: disallowed,
+            });
+        }
+    }
+    // ── Stamp ownership into LiteLLM key metadata ────────────────────────
+    // LiteLLM's native `created_by` column is only populated when the caller
+    // authenticates via JWT/SSO; we always call with the master key, so that
+    // column stays null. Enriching `metadata` makes the owner identity visible
+    // in LiteLLM's UI and queryable via API.
+    const profile = user.tokenEntityRef && catalogClient !== undefined && catalogClient !== null && auth !== undefined && auth !== null
+        ? await (0, provisioning_1.resolveUserProfile)(user.tokenEntityRef, catalogClient, auth, logger)
+        : {};
+    const clientMetadata = input.metadata ?? {};
+    const serverMetadata = {
+        created_by_backstage_user: user.tokenEntityRef ?? 'unknown',
+        ...(profile.email && { created_by_email: profile.email }),
+        ...(profile.displayName && {
+            created_by_display_name: profile.displayName,
+        }),
+        created_via: 'backstage',
+        created_at_iso: new Date().toISOString(),
+    };
+    // Server-owned keys override client values
+    const enrichedMetadata = {
+        ...clientMetadata,
+        ...serverMetadata,
+    };
+    // ── Build upstream request EXPLICITLY from parsed fields ──────────────
+    // Never spread the raw body; only include fields we've explicitly validated.
+    const upstreamRequest = {
+        alias: input.alias,
+        user_id: user.userId,
+    };
+    if (input.models !== undefined) {
+        upstreamRequest.models = input.models;
+    }
+    // Never mint a non-expiring key by omission: default to 30d, or the first
+    // allowed duration when 30d isn't offered.
+    const durations = ctx.keyValidationConfig.allowedDurations;
+    const defaultDuration = durations.length === 0 || durations.includes('30d') ? '30d' : durations[0];
+    upstreamRequest.duration = input.duration ?? defaultDuration;
+    if (input.max_budget !== undefined) {
+        // max_budget from input can be null (unlimited) or a number
+        upstreamRequest.max_budget = input.max_budget ?? undefined;
+    }
+    if (input.tpm_limit !== undefined) {
+        upstreamRequest.tpm_limit = input.tpm_limit;
+    }
+    if (input.rpm_limit !== undefined) {
+        upstreamRequest.rpm_limit = input.rpm_limit;
+    }
+    if (input.team_id !== undefined) {
+        upstreamRequest.team_id = input.team_id;
+    }
+    if (input.key_type !== undefined) {
+        upstreamRequest.key_type = input.key_type;
+    }
+    upstreamRequest.metadata = enrichedMetadata;
+    // ── Call upstream LiteLLM ───────────────────────────────────────────
+    const result = await client.generateKey(upstreamRequest);
+    logger.info('key.generate', { userId: user.userId, keyAlias: input.alias });
+    return result;
+}

package/dist/services/modelAccess.d.ts

@@ -0,0 +1,9 @@
+import type { LiteLLMClient } from '../client';
+/**
+ * Returns the requested models that the allow-list does not permit. The list is
+ * the team's `models` (or the user's, without a team); entries may be literal
+ * model names, access-group names, or the `all-proxy-models` sentinel — the same
+ * rules the key form applies. Model metadata (for access groups) is only fetched
+ * when a literal comparison isn't enough.
+ */
+export declare function findDisallowedModels(client: Pick<LiteLLMClient, 'listModels'>, requested: string[], allowed: string[] | undefined): Promise<string[]>;

package/dist/services/modelAccess.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findDisallowedModels = findDisallowedModels;
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+/**
+ * Returns the requested models that the allow-list does not permit. The list is
+ * the team's `models` (or the user's, without a team); entries may be literal
+ * model names, access-group names, or the `all-proxy-models` sentinel — the same
+ * rules the key form applies. Model metadata (for access groups) is only fetched
+ * when a literal comparison isn't enough.
+ */
+async function findDisallowedModels(client, requested, allowed) {
+    if (!allowed || allowed.length === 0 || allowed.includes(backstage_plugin_litellm_common_1.ALL_PROXY_MODELS)) {
+        return [];
+    }
+    const notLiteral = requested.filter(m => !allowed.includes(m));
+    if (notLiteral.length === 0)
+        return [];
+    // Fail closed: if the model catalogue can't be read the error propagates.
+    const catalogue = await client.listModels();
+    // /model/info returns one row per deployment; a model name can appear several
+    // times with different access groups, so merge them per name.
+    const byName = new Map();
+    for (const m of catalogue) {
+        const entry = byName.get(m.model_name) ?? { model_name: m.model_name, access_groups: [] };
+        entry.access_groups = [...new Set([...entry.access_groups, ...(m.access_groups ?? [])])];
+        byName.set(m.model_name, entry);
+    }
+    return notLiteral.filter(name => !(0, backstage_plugin_litellm_common_1.isModelAllowed)(byName.get(name) ?? { model_name: name }, allowed));
+}