@acarmisc/backstage-plugin-litellm-backend 0.17.1 → 0.17.3

package/dist/routes/bridge.js

@@ -3,13 +3,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerBridgeRoutes = registerBridgeRoutes;
 const provisioning_1 = require("../provisioning");
 const bridge_1 = require("../bridge");
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const keyService_1 = require("../services/keyService");
 const errors_1 = require("../errors");
-const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+const backstage_plugin_litellm_common_2 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
     const { client, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, allowUnlimitedBudget, teamRequired, keyValidationConfig, } = ctx;
     const { config } = bridgeOpts;
-    const generateKeyInputSchema = (0, backstage_plugin_litellm_common_1.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
+    const generateKeyInputSchema = (0, backstage_plugin_litellm_common_2.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
     // ---------------------------------------------------------------------------
     // Bridge endpoints (CLI / Abby)
     //
@@ -91,6 +92,13 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
                     return;
                 }
                 const input = parseResult.data;
+                // CLI clients don't know the budget policy. When unlimited budgets are
+                // not allowed and the caller sent no max_budget, fall back to the
+                // provisioning default instead of rejecting the mint. An explicit
+                // value (including null) is left alone and validated as usual.
+                if (!allowUnlimitedBudget && input.max_budget === undefined) {
+                    input.max_budget = provisioningDefaults.maxBudget;
+                }
                 // ── Resolve user identity from verified claims ───────────────────────
                 const userId = (0, bridge_1.resolveBridgeUserId)(claims, bridgeIdentity);
                 // ── Create key via unified service ──────────────────────────────────
@@ -118,11 +126,42 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
                 handleBridgeError(error, res);
             }
         });
+        // Caller's LiteLLM identity: user id + team memberships. Lets CLI clients
+        // offer a team picker and mint keys under a valid team.
+        router.get('/bridge/user/info', async (req, res) => {
+            try {
+                const claims = await requireClaims(req);
+                const user = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
+                res.json({ user_id: user.user_id, teams: user.teams ?? [] });
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
+        // Model catalogue. With ?team_id=X the list is narrowed to the models the
+        // team may use (its `models` plus access groups); the caller must belong
+        // to that team. Without it the full catalogue is returned, as before.
         router.get('/bridge/models', async (req, res) => {
             try {
-                await requireClaims(req); // authenticate only
+                const claims = await requireClaims(req);
+                const teamId = typeof req.query.team_id === 'string' ? req.query.team_id : '';
                 const models = await client.listModels();
-                res.json(models);
+                if (!teamId) {
+                    res.json(models);
+                    return;
+                }
+                const user = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
+                if (!(user.teams ?? []).includes(teamId)) {
+                    res.status(403).json({ error: 'Access denied: team is not one of your teams', team_id: teamId });
+                    return;
+                }
+                const team = await client.getTeamInfo(teamId);
+                const allowed = team.models;
+                if (!allowed || allowed.length === 0 || allowed.includes(backstage_plugin_litellm_common_1.ALL_PROXY_MODELS)) {
+                    res.json(models);
+                    return;
+                }
+                res.json(models.filter(m => (0, backstage_plugin_litellm_common_1.isModelAllowed)(m, allowed)));
             }
             catch (error) {
                 handleBridgeError(error, res);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.17.1",
+  "version": "0.17.3",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",