@acarmisc/backstage-plugin-litellm-backend 0.17.2 → 0.17.4

package/dist/index.cjs.js

@@ -7983,20 +7983,20 @@ __export(index_exports, {
   getOrProvisionUser: () => getOrProvisionUser,
   getOrProvisionUserFromClaims: () => getOrProvisionUserFromClaims,
   isTeamManagementEnabled: () => isTeamManagementEnabled,
-  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common10.litellmAuditReadPermission,
-  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common10.litellmKeyCreatePermission,
-  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common10.litellmKeyManagePermission,
-  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common10.litellmKeyResetSpendPermission,
-  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common10.litellmKeyRevokePermission,
-  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common10.litellmKeyUnblockPermission,
-  litellmPermissions: () => import_backstage_plugin_litellm_common10.litellmPermissions,
+  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common11.litellmAuditReadPermission,
+  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common11.litellmKeyCreatePermission,
+  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common11.litellmKeyManagePermission,
+  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common11.litellmKeyResetSpendPermission,
+  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common11.litellmKeyRevokePermission,
+  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common11.litellmKeyUnblockPermission,
+  litellmPermissions: () => import_backstage_plugin_litellm_common11.litellmPermissions,
   litellmPlugin: () => litellmPlugin,
-  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common10.litellmTeamCreatePermission,
-  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common10.litellmTeamDeletePermission,
-  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common10.litellmTeamKnowledgebaseManagePermission,
-  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common10.litellmTeamManagePermission,
-  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common10.litellmTeamMcpManagePermission,
-  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common10.litellmTeamMembersManagePermission,
+  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common11.litellmTeamCreatePermission,
+  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common11.litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamManagePermission,
+  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
   normalizeRequestTags: () => normalizeRequestTags,
   provisionUser: () => provisionUser,
@@ -8979,7 +8979,7 @@ async function resolveUserRole(userEntityRef, roleConfigs, catalogClient, auth,
 }
 
 // src/router.ts
-var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/teamAdmin.ts
 var import_plugin_permission_common = __toESM(require_index_cjs2());
@@ -12850,6 +12850,7 @@ async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioni
 
 // src/routes/bridge.ts
 var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
   const {
     client,
@@ -12863,7 +12864,7 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
     keyValidationConfig
   } = ctx;
   const { config } = bridgeOpts;
-  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common7.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
+  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common8.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
   const bridgeCfg = readBridgeConfig(config);
   const bridgeIdentity = {
     userIdDomain,
@@ -12970,11 +12971,50 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
         handleBridgeError(error, res);
       }
     });
+    router.get("/bridge/user/info", async (req, res) => {
+      try {
+        const claims = await requireClaims(req);
+        const user = await getOrProvisionUserFromClaims(
+          client,
+          claims,
+          provisioningEnabled,
+          provisioningDefaults,
+          logger,
+          bridgeIdentity
+        );
+        res.json({ user_id: user.user_id, teams: user.teams ?? [] });
+      } catch (error) {
+        handleBridgeError(error, res);
+      }
+    });
     router.get("/bridge/models", async (req, res) => {
       try {
-        await requireClaims(req);
+        const claims = await requireClaims(req);
+        const teamId = typeof req.query.team_id === "string" ? req.query.team_id : "";
         const models = await client.listModels();
-        res.json(models);
+        if (!teamId) {
+          res.json(models);
+          return;
+        }
+        const user = await getOrProvisionUserFromClaims(
+          client,
+          claims,
+          provisioningEnabled,
+          provisioningDefaults,
+          logger,
+          bridgeIdentity
+        );
+        if (!(user.teams ?? []).includes(teamId)) {
+          res.status(403).json({ error: "Access denied: team is not one of your teams", team_id: teamId });
+          return;
+        }
+        const team = await client.getTeamInfo(teamId);
+        const allowed = team.models;
+        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common7.ALL_PROXY_MODELS)) {
+          res.json(models);
+          return;
+        }
+        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common7.isModelAllowed)(m, allowed)));
       } catch (error) {
         handleBridgeError(error, res);
       }
@@ -13006,7 +13046,7 @@ async function createRouter(options) {
   const keyMaxBudget = config.getOptionalNumber("litellm.keys.maxBudget") ?? 100;
   const keyMaxTpm = config.getOptionalNumber("litellm.keys.maxTpm") ?? 1e5;
   const keyMaxRpm = config.getOptionalNumber("litellm.keys.maxRpm") ?? 1e3;
-  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common8.DEFAULT_KEY_DURATIONS;
+  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common9.DEFAULT_KEY_DURATIONS;
   const keyValidationConfig = {
     maxBudget: keyMaxBudget,
     maxTpm: keyMaxTpm,
@@ -13197,7 +13237,13 @@ async function createRouter(options) {
 }
 
 // src/plugin.ts
-var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
+var BRIDGE_UNAUTHENTICATED_PATHS = [
+  "/bridge/health",
+  "/bridge/keys",
+  "/bridge/models",
+  "/bridge/user/info"
+];
 var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
   pluginId: "litellm",
   register(reg) {
@@ -13220,7 +13266,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
         permissions,
         permissionsRegistry
       }) {
-        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common9.litellmPermissions);
+        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common10.litellmPermissions);
         const router = await createRouter({
           config,
           logger,
@@ -13230,11 +13276,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
         });
         httpRouter.use(router);
         if (readBridgeConfig(config).enabled) {
-          for (const path of [
-            "/bridge/health",
-            "/bridge/keys",
-            "/bridge/models"
-          ]) {
+          for (const path of BRIDGE_UNAUTHENTICATED_PATHS) {
             httpRouter.addAuthPolicy({ path, allow: "unauthenticated" });
           }
         }
@@ -13244,7 +13286,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
 });
 
 // src/index.ts
-var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   KeycloakJWTVerifier,