@acarmisc/backstage-plugin-litellm-backend 0.16.1 → 0.17.1

package/dist/index.cjs.js

@@ -568,9 +568,9 @@ var require_index_cjs = __commonJS({
   }
 });
 
-// ../../node_modules/webidl-conversions/lib/index.js
+// ../../node_modules/node-fetch/node_modules/webidl-conversions/lib/index.js
 var require_lib = __commonJS({
-  "../../node_modules/webidl-conversions/lib/index.js"(exports2, module2) {
+  "../../node_modules/node-fetch/node_modules/webidl-conversions/lib/index.js"(exports2, module2) {
     "use strict";
     var conversions = {};
     module2.exports = conversions;
@@ -721,9 +721,9 @@ var require_lib = __commonJS({
   }
 });
 
-// ../../node_modules/whatwg-url/lib/utils.js
+// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/whatwg-url/lib/utils.js"(exports2, module2) {
+  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/utils.js"(exports2, module2) {
     "use strict";
     module2.exports.mixin = function mixin(target, source) {
       const keys = Object.getOwnPropertyNames(source);
@@ -910,9 +910,9 @@ var require_tr46 = __commonJS({
   }
 });
 
-// ../../node_modules/whatwg-url/lib/url-state-machine.js
+// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/url-state-machine.js
 var require_url_state_machine = __commonJS({
-  "../../node_modules/whatwg-url/lib/url-state-machine.js"(exports2, module2) {
+  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/url-state-machine.js"(exports2, module2) {
     "use strict";
     var punycode = require("punycode");
     var tr46 = require_tr46();
@@ -1982,9 +1982,9 @@ var require_url_state_machine = __commonJS({
   }
 });
 
-// ../../node_modules/whatwg-url/lib/URL-impl.js
+// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL-impl.js
 var require_URL_impl = __commonJS({
-  "../../node_modules/whatwg-url/lib/URL-impl.js"(exports2) {
+  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL-impl.js"(exports2) {
     "use strict";
     var usm = require_url_state_machine();
     exports2.implementation = class URLImpl {
@@ -2139,9 +2139,9 @@ var require_URL_impl = __commonJS({
   }
 });
 
-// ../../node_modules/whatwg-url/lib/URL.js
+// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL.js
 var require_URL = __commonJS({
-  "../../node_modules/whatwg-url/lib/URL.js"(exports2, module2) {
+  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL.js"(exports2, module2) {
     "use strict";
     var conversions = require_lib();
     var utils = require_utils();
@@ -2321,9 +2321,9 @@ var require_URL = __commonJS({
   }
 });
 
-// ../../node_modules/whatwg-url/lib/public-api.js
+// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/public-api.js
 var require_public_api = __commonJS({
-  "../../node_modules/whatwg-url/lib/public-api.js"(exports2) {
+  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/public-api.js"(exports2) {
     "use strict";
     exports2.URL = require_URL().interface;
     exports2.serializeURL = require_url_state_machine().serializeURL;
@@ -8123,6 +8123,48 @@ var LiteLLMClient = class {
       throw err;
     }
   }
+  /**
+   * Searches for an existing user by email address. Returns the first matching
+   * user or null if none found. Handles both response shapes: a bare array
+   * or `{ users: [...] }`. Matching is case-insensitive on the email address.
+   */
+  async getUserByEmail(email) {
+    try {
+      const raw = await this.request(
+        `/user/list?user_email=${encodeURIComponent(email)}`
+      );
+      let users = [];
+      if (Array.isArray(raw)) {
+        users = raw;
+      } else if (Array.isArray(raw?.users)) {
+        users = raw.users;
+      }
+      if (!users.length) return null;
+      const found = users.find(
+        (u) => (u.user_email ?? u.email ?? "").toLowerCase() === email.toLowerCase()
+      );
+      if (!found) return null;
+      const inner = found.user_info ?? {};
+      const teamIds = Array.isArray(found.teams) ? found.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
+      return {
+        user_id: found.user_id ?? inner.user_id ?? "",
+        user_email: inner.user_email ?? found.user_email,
+        email: inner.email ?? found.email,
+        teams: teamIds,
+        models: inner.models ?? found.models,
+        max_budget: inner.max_budget ?? found.max_budget,
+        budget_duration: inner.budget_duration ?? found.budget_duration,
+        budget_reset_at: inner.budget_reset_at ?? found.budget_reset_at,
+        spend: inner.spend ?? found.spend,
+        current_spend: inner.current_spend ?? found.current_spend,
+        soft_limit: inner.soft_limit ?? found.soft_limit,
+        hard_limit: inner.hard_limit ?? found.hard_limit
+      };
+    } catch (err) {
+      if (err instanceof LiteLLMUpstreamError && err.status === 404) return null;
+      throw err;
+    }
+  }
   async createUser(payload) {
     return this.request("/user/new", {
       method: "POST",
@@ -10292,12 +10334,9 @@ function registerKeysRoutes(router, ctx) {
     try {
       const { keyId } = req.params;
       const { tokenEntityRef, key } = await authorizeKeyAction(req, keyId);
-      const isOwnerUnblockingOwnBlock = key.metadata?.blocked_by === tokenEntityRef;
-      if (!isOwnerUnblockingOwnBlock) {
-        if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyUnblockPermission)) {
-          sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyUnblockPermission);
-          return;
-        }
+      if (!await assertPermission(req, import_backstage_plugin_litellm_common3.litellmKeyUnblockPermission)) {
+        sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyUnblockPermission);
+        return;
       }
       await client.unblockKey(keyId);
       const updatedMetadata = {
@@ -11275,10 +11314,10 @@ function registerTeamUsageRoutes(router, ctx) {
   });
 }
 
-// node_modules/jose/dist/node/esm/runtime/base64url.js
+// ../../node_modules/jose/dist/node/esm/runtime/base64url.js
 var import_node_buffer = require("node:buffer");
 
-// node_modules/jose/dist/node/esm/lib/buffer_utils.js
+// ../../node_modules/jose/dist/node/esm/lib/buffer_utils.js
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 var MAX_INT32 = 2 ** 32;
@@ -11293,7 +11332,7 @@ function concat(...buffers) {
   return buf;
 }
 
-// node_modules/jose/dist/node/esm/runtime/base64url.js
+// ../../node_modules/jose/dist/node/esm/runtime/base64url.js
 function normalize(input) {
   let encoded = input;
   if (encoded instanceof Uint8Array) {
@@ -11303,7 +11342,7 @@ function normalize(input) {
 }
 var decode = (input) => new Uint8Array(import_node_buffer.Buffer.from(normalize(input), "base64url"));
 
-// node_modules/jose/dist/node/esm/util/errors.js
+// ../../node_modules/jose/dist/node/esm/util/errors.js
 var JOSEError = class extends Error {
   static code = "ERR_JOSE_GENERIC";
   code = "ERR_JOSE_GENERIC";
@@ -11389,18 +11428,18 @@ var JWSSignatureVerificationFailed = class extends JOSEError {
   }
 };
 
-// node_modules/jose/dist/node/esm/runtime/is_key_object.js
+// ../../node_modules/jose/dist/node/esm/runtime/is_key_object.js
 var util = __toESM(require("node:util"), 1);
 var is_key_object_default = (obj) => util.types.isKeyObject(obj);
 
-// node_modules/jose/dist/node/esm/runtime/webcrypto.js
+// ../../node_modules/jose/dist/node/esm/runtime/webcrypto.js
 var crypto = __toESM(require("node:crypto"), 1);
 var util2 = __toESM(require("node:util"), 1);
 var webcrypto2 = crypto.webcrypto;
 var webcrypto_default = webcrypto2;
 var isCryptoKey = (key) => util2.types.isCryptoKey(key);
 
-// node_modules/jose/dist/node/esm/lib/crypto_key.js
+// ../../node_modules/jose/dist/node/esm/lib/crypto_key.js
 function unusable(name, prop = "algorithm.name") {
   return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -11499,7 +11538,7 @@ function checkSigCryptoKey(key, alg, ...usages) {
   checkUsage(key, usages);
 }
 
-// node_modules/jose/dist/node/esm/lib/invalid_key_input.js
+// ../../node_modules/jose/dist/node/esm/lib/invalid_key_input.js
 function message(msg, actual, ...types4) {
   types4 = types4.filter(Boolean);
   if (types4.length > 2) {
@@ -11528,14 +11567,14 @@ function withAlg(alg, actual, ...types4) {
   return message(`Key for the ${alg} algorithm must be `, actual, ...types4);
 }
 
-// node_modules/jose/dist/node/esm/runtime/is_key_like.js
+// ../../node_modules/jose/dist/node/esm/runtime/is_key_like.js
 var is_key_like_default = (key) => is_key_object_default(key) || isCryptoKey(key);
 var types3 = ["KeyObject"];
 if (globalThis.CryptoKey || webcrypto_default?.CryptoKey) {
   types3.push("CryptoKey");
 }
 
-// node_modules/jose/dist/node/esm/lib/is_disjoint.js
+// ../../node_modules/jose/dist/node/esm/lib/is_disjoint.js
 var isDisjoint = (...headers) => {
   const sources = headers.filter(Boolean);
   if (sources.length === 0 || sources.length === 1) {
@@ -11559,7 +11598,7 @@ var isDisjoint = (...headers) => {
 };
 var is_disjoint_default = isDisjoint;
 
-// node_modules/jose/dist/node/esm/lib/is_object.js
+// ../../node_modules/jose/dist/node/esm/lib/is_object.js
 function isObjectLike(value) {
   return typeof value === "object" && value !== null;
 }
@@ -11577,10 +11616,10 @@ function isObject(input) {
   return Object.getPrototypeOf(input) === proto;
 }
 
-// node_modules/jose/dist/node/esm/runtime/get_named_curve.js
+// ../../node_modules/jose/dist/node/esm/runtime/get_named_curve.js
 var import_node_crypto = require("node:crypto");
 
-// node_modules/jose/dist/node/esm/lib/is_jwk.js
+// ../../node_modules/jose/dist/node/esm/lib/is_jwk.js
 function isJWK(key) {
   return isObject(key) && typeof key.kty === "string";
 }
@@ -11594,7 +11633,7 @@ function isSecretJWK(key) {
   return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
 }
 
-// node_modules/jose/dist/node/esm/runtime/get_named_curve.js
+// ../../node_modules/jose/dist/node/esm/runtime/get_named_curve.js
 var namedCurveToJOSE = (namedCurve) => {
   switch (namedCurve) {
     case "prime256v1":
@@ -11643,7 +11682,7 @@ var getNamedCurve2 = (kee, raw) => {
 };
 var get_named_curve_default = getNamedCurve2;
 
-// node_modules/jose/dist/node/esm/runtime/check_key_length.js
+// ../../node_modules/jose/dist/node/esm/runtime/check_key_length.js
 var import_node_crypto2 = require("node:crypto");
 var check_key_length_default = (key, alg) => {
   let modulusLength;
@@ -11660,7 +11699,7 @@ var check_key_length_default = (key, alg) => {
   }
 };
 
-// node_modules/jose/dist/node/esm/runtime/jwk_to_key.js
+// ../../node_modules/jose/dist/node/esm/runtime/jwk_to_key.js
 var import_node_crypto3 = require("node:crypto");
 var parse = (key) => {
   if (key.d) {
@@ -11670,7 +11709,7 @@ var parse = (key) => {
 };
 var jwk_to_key_default = parse;
 
-// node_modules/jose/dist/node/esm/key/import.js
+// ../../node_modules/jose/dist/node/esm/key/import.js
 async function importJWK(jwk, alg) {
   if (!isObject(jwk)) {
     throw new TypeError("JWK must be an object");
@@ -11694,7 +11733,7 @@ async function importJWK(jwk, alg) {
   }
 }
 
-// node_modules/jose/dist/node/esm/lib/check_key_type.js
+// ../../node_modules/jose/dist/node/esm/lib/check_key_type.js
 var tag = (key) => key?.[Symbol.toStringTag];
 var jwkMatchesOp = (alg, key, usage) => {
   if (key.use !== void 0 && key.use !== "sig") {
@@ -11766,7 +11805,7 @@ function checkKeyType(allowJwk, alg, key, usage) {
 var check_key_type_default = checkKeyType.bind(void 0, false);
 var checkKeyTypeWithJwk = checkKeyType.bind(void 0, true);
 
-// node_modules/jose/dist/node/esm/lib/validate_crit.js
+// ../../node_modules/jose/dist/node/esm/lib/validate_crit.js
 function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
   if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) {
     throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
@@ -11798,7 +11837,7 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
 }
 var validate_crit_default = validateCrit;
 
-// node_modules/jose/dist/node/esm/lib/validate_algorithms.js
+// ../../node_modules/jose/dist/node/esm/lib/validate_algorithms.js
 var validateAlgorithms = (option, algorithms) => {
   if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
     throw new TypeError(`"${option}" option must be an array of strings`);
@@ -11810,11 +11849,11 @@ var validateAlgorithms = (option, algorithms) => {
 };
 var validate_algorithms_default = validateAlgorithms;
 
-// node_modules/jose/dist/node/esm/runtime/verify.js
+// ../../node_modules/jose/dist/node/esm/runtime/verify.js
 var crypto3 = __toESM(require("node:crypto"), 1);
 var import_node_util2 = require("node:util");
 
-// node_modules/jose/dist/node/esm/runtime/dsa_digest.js
+// ../../node_modules/jose/dist/node/esm/runtime/dsa_digest.js
 function dsaDigest(alg) {
   switch (alg) {
     case "PS256":
@@ -11838,7 +11877,7 @@ function dsaDigest(alg) {
   }
 }
 
-// node_modules/jose/dist/node/esm/runtime/node_key.js
+// ../../node_modules/jose/dist/node/esm/runtime/node_key.js
 var import_node_crypto4 = require("node:crypto");
 var ecCurveAlgMap = /* @__PURE__ */ new Map([
   ["ES256", "P-256"],
@@ -11942,11 +11981,11 @@ function keyForCrypto(alg, key) {
   return options ? { ...options, key } : key;
 }
 
-// node_modules/jose/dist/node/esm/runtime/sign.js
+// ../../node_modules/jose/dist/node/esm/runtime/sign.js
 var crypto2 = __toESM(require("node:crypto"), 1);
 var import_node_util = require("node:util");
 
-// node_modules/jose/dist/node/esm/runtime/hmac_digest.js
+// ../../node_modules/jose/dist/node/esm/runtime/hmac_digest.js
 function hmacDigest(alg) {
   switch (alg) {
     case "HS256":
@@ -11960,7 +11999,7 @@ function hmacDigest(alg) {
   }
 }
 
-// node_modules/jose/dist/node/esm/runtime/get_sign_verify_key.js
+// ../../node_modules/jose/dist/node/esm/runtime/get_sign_verify_key.js
 var import_node_crypto5 = require("node:crypto");
 function getSignVerifyKey(alg, key, usage) {
   if (key instanceof Uint8Array) {
@@ -11985,7 +12024,7 @@ function getSignVerifyKey(alg, key, usage) {
   throw new TypeError(invalid_key_input_default(key, ...types3, "Uint8Array", "JSON Web Key"));
 }
 
-// node_modules/jose/dist/node/esm/runtime/sign.js
+// ../../node_modules/jose/dist/node/esm/runtime/sign.js
 var oneShotSign = (0, import_node_util.promisify)(crypto2.sign);
 var sign2 = async (alg, key, data) => {
   const k = getSignVerifyKey(alg, key, "sign");
@@ -11998,7 +12037,7 @@ var sign2 = async (alg, key, data) => {
 };
 var sign_default = sign2;
 
-// node_modules/jose/dist/node/esm/runtime/verify.js
+// ../../node_modules/jose/dist/node/esm/runtime/verify.js
 var oneShotVerify = (0, import_node_util2.promisify)(crypto3.verify);
 var verify2 = async (alg, key, signature, data) => {
   const k = getSignVerifyKey(alg, key, "verify");
@@ -12021,7 +12060,7 @@ var verify2 = async (alg, key, signature, data) => {
 };
 var verify_default = verify2;
 
-// node_modules/jose/dist/node/esm/jws/flattened/verify.js
+// ../../node_modules/jose/dist/node/esm/jws/flattened/verify.js
 async function flattenedVerify(jws, key, options) {
   if (!isObject(jws)) {
     throw new JWSInvalid("Flattened JWS must be an object");
@@ -12127,7 +12166,7 @@ async function flattenedVerify(jws, key, options) {
   return result;
 }
 
-// node_modules/jose/dist/node/esm/jws/compact/verify.js
+// ../../node_modules/jose/dist/node/esm/jws/compact/verify.js
 async function compactVerify(jws, key, options) {
   if (jws instanceof Uint8Array) {
     jws = decoder.decode(jws);
@@ -12147,10 +12186,10 @@ async function compactVerify(jws, key, options) {
   return result;
 }
 
-// node_modules/jose/dist/node/esm/lib/epoch.js
+// ../../node_modules/jose/dist/node/esm/lib/epoch.js
 var epoch_default = (date) => Math.floor(date.getTime() / 1e3);
 
-// node_modules/jose/dist/node/esm/lib/secs.js
+// ../../node_modules/jose/dist/node/esm/lib/secs.js
 var minute = 60;
 var hour = minute * 60;
 var day = hour * 24;
@@ -12207,7 +12246,7 @@ var secs_default = (str) => {
   return numericDate;
 };
 
-// node_modules/jose/dist/node/esm/lib/jwt_claims_set.js
+// ../../node_modules/jose/dist/node/esm/lib/jwt_claims_set.js
 var normalizeTyp = (value) => value.toLowerCase().replace(/^application\//, "");
 var checkAudiencePresence = (audPayload, audOption) => {
   if (typeof audPayload === "string") {
@@ -12303,7 +12342,7 @@ var jwt_claims_set_default = (protectedHeader, encodedPayload, options = {}) =>
   return payload;
 };
 
-// node_modules/jose/dist/node/esm/jwt/verify.js
+// ../../node_modules/jose/dist/node/esm/jwt/verify.js
 async function jwtVerify(jwt, key, options) {
   const verified = await compactVerify(jwt, key, options);
   if (verified.protectedHeader.crit?.includes("b64") && verified.protectedHeader.b64 === false) {
@@ -12317,7 +12356,7 @@ async function jwtVerify(jwt, key, options) {
   return result;
 }
 
-// node_modules/jose/dist/node/esm/jwks/local.js
+// ../../node_modules/jose/dist/node/esm/jwks/local.js
 function getKtyFromAlg(alg) {
   switch (typeof alg === "string" && alg.slice(0, 2)) {
     case "RS":
@@ -12438,7 +12477,7 @@ function createLocalJWKSet(jwks) {
   return localJWKSet;
 }
 
-// node_modules/jose/dist/node/esm/runtime/fetch_jwks.js
+// ../../node_modules/jose/dist/node/esm/runtime/fetch_jwks.js
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var import_node_events = require("node:events");
@@ -12480,7 +12519,7 @@ var fetchJwks = async (url, timeout, options) => {
 };
 var fetch_jwks_default = fetchJwks;
 
-// node_modules/jose/dist/node/esm/jwks/remote.js
+// ../../node_modules/jose/dist/node/esm/jwks/remote.js
 function isCloudflareWorkers() {
   return typeof WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime !== "undefined" && EdgeRuntime === "vercel";
 }
@@ -12721,13 +12760,32 @@ function resolveBridgeUserId(claims, identity) {
       `email domain mismatch: "${domain}" is not allowed for this deployment`
     );
   }
-  const name = claims.preferred_username?.trim() || emailLocalPart;
+  let name = claims.preferred_username?.trim();
+  if (name && name.includes("@")) {
+    const usernameParts = name.split("@");
+    if (usernameParts.length === 2 && usernameParts[0]) {
+      const [userLocal, userDomain] = usernameParts;
+      if (trusted.includes(userDomain.toLowerCase())) {
+        name = userLocal;
+      }
+    }
+  }
+  name = name || emailLocalPart;
   return toLiteLLMUserId(name, userIdDomain);
 }
 async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
   const userId = resolveBridgeUserId(claims, userIdDomain);
   const existing = await client.getUserInfo(userId);
   if (existing) return existing;
+  if (claims.email) {
+    const byEmail = await client.getUserByEmail(claims.email);
+    if (byEmail) {
+      logger.info(
+        `Found existing LiteLLM user ${byEmail.user_id} by email ${claims.email}, reusing for ${userId}`
+      );
+      return byEmail;
+    }
+  }
   if (!provisioningEnabled) {
     throw new ProvisioningError(
       "User not found in LiteLLM",
@@ -12758,7 +12816,7 @@ async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled,
   return created;
 }
 async function bridgeListKeys(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
-  await getOrProvisionUserFromClaims(
+  const user = await getOrProvisionUserFromClaims(
     client,
     claims,
     provisioningEnabled,
@@ -12766,10 +12824,10 @@ async function bridgeListKeys(client, claims, provisioningEnabled, provisioningD
     logger,
     userIdDomain
   );
-  return client.listKeys(resolveBridgeUserId(claims, userIdDomain));
+  return client.listKeys(user.user_id);
 }
 async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioningDefaults, logger, request, userIdDomain) {
-  await getOrProvisionUserFromClaims(
+  const user = await getOrProvisionUserFromClaims(
     client,
     claims,
     provisioningEnabled,
@@ -12777,14 +12835,13 @@ async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioni
     logger,
     userIdDomain
   );
-  const userId = resolveBridgeUserId(claims, userIdDomain);
   const enriched = {
     ...request,
-    user_id: userId,
+    user_id: user.user_id,
     metadata: {
       ...request.metadata ?? {},
       created_via: "abby-cli",
-      created_by: userId,
+      created_by: user.user_id,
       created_at_iso: (/* @__PURE__ */ new Date()).toISOString()
     }
   };