@acarmisc/backstage-plugin-litellm-backend 0.16.1 → 0.17.1

package/dist/routes/keys.js

@@ -343,15 +343,15 @@ function registerKeysRoutes(router, ctx) {
         try {
             const { keyId } = req.params;
             const { tokenEntityRef, key } = await authorizeKeyAction(req, keyId);
-            // Check if the key can be unblocked:
-            // - Owner can unblock a self-blocked key (metadata.blocked_by === tokenEntityRef)
-            // - Otherwise require the unblock permission
-            const isOwnerUnblockingOwnBlock = key.metadata?.blocked_by === tokenEntityRef;
-            if (!isOwnerUnblockingOwnBlock) {
-                if (!(await assertPermission(req, backstage_plugin_litellm_common_1.litellmKeyUnblockPermission))) {
-                    sendPermissionDenied(res, backstage_plugin_litellm_common_1.litellmKeyUnblockPermission);
-                    return;
-                }
+            // Unblocking always needs the dedicated permission, on top of ownership.
+            // `metadata.blocked_by` is deliberately NOT trusted here: it lives in a
+            // record the owner can influence (older keys, or a stale value left after
+            // an admin unblocked in the LiteLLM UI), so "I blocked it myself" can't be
+            // told apart from "an admin blocked it". Grant `litellm.key.unblock` only
+            // to roles that may lift blocks; everyone else asks an administrator.
+            if (!(await assertPermission(req, backstage_plugin_litellm_common_1.litellmKeyUnblockPermission))) {
+                sendPermissionDenied(res, backstage_plugin_litellm_common_1.litellmKeyUnblockPermission);
+                return;
             }
             await client.unblockKey(keyId);
             // Clear the block record on unblock. Set the fields to null rather than

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.16.1",
+  "version": "0.17.1",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",