@acarmisc/backstage-plugin-litellm-backend 0.17.0 → 0.17.1

package/dist/bridge.d.ts

@@ -87,6 +87,11 @@ export interface BridgeIdentityOptions {
  *    from the email (and would provision a duplicate). The realm is the same
  *    IdP Backstage signs users in with, so its usernames are the entity names.
  *
+ *    When `preferred_username` is email-shaped (contains '@') and its domain
+ *    is in the trusted list, we extract the local part and use that as the
+ *    username instead. This handles the Abby CLI case where `preferred_username`
+ *    is the full email.
+ *
  * @throws BridgeIdentityError (403) if identity validation fails
  */
 export declare function resolveBridgeUserId(claims: BridgeClaims, identity?: string | BridgeIdentityOptions): string;
@@ -95,6 +100,12 @@ export declare function resolveBridgeUserId(claims: BridgeClaims, identity?: str
  * missing and provisioning is enabled, creates it from the JWT claims (email +
  * name); if provisioning is disabled, throws a 404 telling the caller to log
  * in to Backstage first (the UI is the primary provisioning entry point).
+ *
+ * When the computed userId is not found, before provisioning we also search
+ * for an existing user by email. This handles the case where a UI user (created
+ * with a bare entity name) is accessed via the CLI (which uses email-shaped
+ * preferred_username), and helps recover from cases where the bridge's userId
+ * computation and the UI's differ.
  */
 export declare function getOrProvisionUserFromClaims(client: LiteLLMClient, claims: BridgeClaims, provisioningEnabled: boolean, provisioningDefaults: ProvisioningDefaults, logger: LoggerService, userIdDomain?: string | BridgeIdentityOptions): Promise<UserInfo>;
 /** Lists the caller's virtual keys (provisioning the user first if needed). */

package/dist/bridge.js

@@ -139,6 +139,11 @@ function normalizeIdentityOptions(opts) {
  *    from the email (and would provision a duplicate). The realm is the same
  *    IdP Backstage signs users in with, so its usernames are the entity names.
  *
+ *    When `preferred_username` is email-shaped (contains '@') and its domain
+ *    is in the trusted list, we extract the local part and use that as the
+ *    username instead. This handles the Abby CLI case where `preferred_username`
+ *    is the full email.
+ *
  * @throws BridgeIdentityError (403) if identity validation fails
  */
 function resolveBridgeUserId(claims, identity) {
@@ -160,7 +165,20 @@ function resolveBridgeUserId(claims, identity) {
     if (!trusted.includes(domain.toLowerCase())) {
         throw new BridgeIdentityError(`email domain mismatch: "${domain}" is not allowed for this deployment`);
     }
-    const name = claims.preferred_username?.trim() || emailLocalPart;
+    let name = claims.preferred_username?.trim();
+    // If preferred_username is email-shaped and its domain is trusted, use the
+    // local part so the CLI (which uses full email as preferred_username) maps
+    // to the same user as the UI (which uses bare entity name).
+    if (name && name.includes('@')) {
+        const usernameParts = name.split('@');
+        if (usernameParts.length === 2 && usernameParts[0]) {
+            const [userLocal, userDomain] = usernameParts;
+            if (trusted.includes(userDomain.toLowerCase())) {
+                name = userLocal;
+            }
+        }
+    }
+    name = name || emailLocalPart;
     return (0, provisioning_1.toLiteLLMUserId)(name, userIdDomain);
 }
 /**
@@ -168,12 +186,28 @@ function resolveBridgeUserId(claims, identity) {
  * missing and provisioning is enabled, creates it from the JWT claims (email +
  * name); if provisioning is disabled, throws a 404 telling the caller to log
  * in to Backstage first (the UI is the primary provisioning entry point).
+ *
+ * When the computed userId is not found, before provisioning we also search
+ * for an existing user by email. This handles the case where a UI user (created
+ * with a bare entity name) is accessed via the CLI (which uses email-shaped
+ * preferred_username), and helps recover from cases where the bridge's userId
+ * computation and the UI's differ.
  */
 async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
     const userId = resolveBridgeUserId(claims, userIdDomain);
     const existing = await client.getUserInfo(userId);
     if (existing)
         return existing;
+    // Before provisioning, try to find an existing user by email.
+    // This handles the case where the UI created a user under a different ID
+    // (e.g. bare entity name) but the same email.
+    if (claims.email) {
+        const byEmail = await client.getUserByEmail(claims.email);
+        if (byEmail) {
+            logger.info(`Found existing LiteLLM user ${byEmail.user_id} by email ${claims.email}, reusing for ${userId}`);
+            return byEmail;
+        }
+    }
     if (!provisioningEnabled) {
         throw new provisioning_1.ProvisioningError('User not found in LiteLLM', 'No LiteLLM user for this identity. Log in to Backstage once to be provisioned, or enable litellm.provisioning.enabled.', false);
     }
@@ -189,20 +223,19 @@ async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled,
 }
 /** Lists the caller's virtual keys (provisioning the user first if needed). */
 async function bridgeListKeys(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
-    await getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain);
-    return client.listKeys(resolveBridgeUserId(claims, userIdDomain));
+    const user = await getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain);
+    return client.listKeys(user.user_id);
 }
 /** Mints a new virtual key for the caller (provisioning the user first if needed). */
 async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioningDefaults, logger, request, userIdDomain) {
-    await getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain);
-    const userId = resolveBridgeUserId(claims, userIdDomain);
+    const user = await getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain);
     const enriched = {
         ...request,
-        user_id: userId,
+        user_id: user.user_id,
         metadata: {
             ...(request.metadata ?? {}),
             created_via: 'abby-cli',
-            created_by: userId,
+            created_by: user.user_id,
             created_at_iso: new Date().toISOString(),
         },
     };

package/dist/client.d.ts

@@ -33,6 +33,12 @@ export declare class LiteLLMClient {
      * the rest of the code can rely on the UserInfo contract.
      */
     getUserInfo(userId?: string): Promise<UserInfo | null>;
+    /**
+     * Searches for an existing user by email address. Returns the first matching
+     * user or null if none found. Handles both response shapes: a bare array
+     * or `{ users: [...] }`. Matching is case-insensitive on the email address.
+     */
+    getUserByEmail(email: string): Promise<UserInfo | null>;
     createUser(payload: CreateUserRequest): Promise<CreateUserResponse>;
     /**
      * Updates an existing LiteLLM user record. Used as a defensive follow-up

package/dist/client.js

@@ -127,6 +127,56 @@ class LiteLLMClient {
             throw err;
         }
     }
+    /**
+     * Searches for an existing user by email address. Returns the first matching
+     * user or null if none found. Handles both response shapes: a bare array
+     * or `{ users: [...] }`. Matching is case-insensitive on the email address.
+     */
+    async getUserByEmail(email) {
+        try {
+            const raw = await this.request(`/user/list?user_email=${encodeURIComponent(email)}`);
+            let users = [];
+            if (Array.isArray(raw)) {
+                users = raw;
+            }
+            else if (Array.isArray(raw?.users)) {
+                users = raw.users;
+            }
+            if (!users.length)
+                return null;
+            // Match the first user (case-insensitive email comparison)
+            const found = users.find((u) => (u.user_email ?? u.email ?? '')
+                .toLowerCase() === email.toLowerCase());
+            if (!found)
+                return null;
+            // Normalize to UserInfo shape (same as getUserInfo does)
+            const inner = found.user_info ?? {};
+            const teamIds = Array.isArray(found.teams)
+                ? found.teams
+                    .map((t) => (typeof t === 'string' ? t : t?.team_id))
+                    .filter((t) => typeof t === 'string')
+                : [];
+            return {
+                user_id: found.user_id ?? inner.user_id ?? '',
+                user_email: inner.user_email ?? found.user_email,
+                email: inner.email ?? found.email,
+                teams: teamIds,
+                models: inner.models ?? found.models,
+                max_budget: inner.max_budget ?? found.max_budget,
+                budget_duration: inner.budget_duration ?? found.budget_duration,
+                budget_reset_at: inner.budget_reset_at ?? found.budget_reset_at,
+                spend: inner.spend ?? found.spend,
+                current_spend: inner.current_spend ?? found.current_spend,
+                soft_limit: inner.soft_limit ?? found.soft_limit,
+                hard_limit: inner.hard_limit ?? found.hard_limit,
+            };
+        }
+        catch (err) {
+            if (err instanceof LiteLLMUpstreamError && err.status === 404)
+                return null;
+            throw err;
+        }
+    }
     async createUser(payload) {
         return this.request('/user/new', {
             method: 'POST',