@acarmisc/backstage-plugin-litellm-backend 0.17.2 → 0.17.4

package/dist/plugin.d.ts

@@ -1 +1,7 @@
+/**
+ * Bridge routes exempt from Backstage's default auth policy (they verify the
+ * Keycloak JWT themselves). Every route registered in routes/bridge.ts must be
+ * listed here, or the framework answers 401 before the bridge verifier runs.
+ */
+export declare const BRIDGE_UNAUTHENTICATED_PATHS: string[];
 export declare const litellmPlugin: import("@backstage/backend-plugin-api").BackendFeature;

package/dist/plugin.js

@@ -1,10 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.litellmPlugin = void 0;
+exports.litellmPlugin = exports.BRIDGE_UNAUTHENTICATED_PATHS = void 0;
 const backend_plugin_api_1 = require("@backstage/backend-plugin-api");
 const router_1 = require("./router");
 const bridge_1 = require("./bridge");
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+/**
+ * Bridge routes exempt from Backstage's default auth policy (they verify the
+ * Keycloak JWT themselves). Every route registered in routes/bridge.ts must be
+ * listed here, or the framework answers 401 before the bridge verifier runs.
+ */
+exports.BRIDGE_UNAUTHENTICATED_PATHS = [
+    '/bridge/health',
+    '/bridge/keys',
+    '/bridge/models',
+    '/bridge/user/info',
+];
 exports.litellmPlugin = (0, backend_plugin_api_1.createBackendPlugin)({
     pluginId: 'litellm',
     register(reg) {
@@ -33,11 +44,7 @@ exports.litellmPlugin = (0, backend_plugin_api_1.createBackendPlugin)({
                 // policy, otherwise the framework rejects the Keycloak Bearer with
                 // "Illegal token" before the bridge verifier ever runs.
                 if ((0, bridge_1.readBridgeConfig)(config).enabled) {
-                    for (const path of [
-                        '/bridge/health',
-                        '/bridge/keys',
-                        '/bridge/models',
-                    ]) {
+                    for (const path of exports.BRIDGE_UNAUTHENTICATED_PATHS) {
                         httpRouter.addAuthPolicy({ path, allow: 'unauthenticated' });
                     }
                 }

package/dist/routes/bridge.js

@@ -3,13 +3,14 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerBridgeRoutes = registerBridgeRoutes;
 const provisioning_1 = require("../provisioning");
 const bridge_1 = require("../bridge");
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const keyService_1 = require("../services/keyService");
 const errors_1 = require("../errors");
-const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+const backstage_plugin_litellm_common_2 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
     const { client, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, allowUnlimitedBudget, teamRequired, keyValidationConfig, } = ctx;
     const { config } = bridgeOpts;
-    const generateKeyInputSchema = (0, backstage_plugin_litellm_common_1.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
+    const generateKeyInputSchema = (0, backstage_plugin_litellm_common_2.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
     // ---------------------------------------------------------------------------
     // Bridge endpoints (CLI / Abby)
     //
@@ -125,11 +126,42 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
                 handleBridgeError(error, res);
             }
         });
+        // Caller's LiteLLM identity: user id + team memberships. Lets CLI clients
+        // offer a team picker and mint keys under a valid team.
+        router.get('/bridge/user/info', async (req, res) => {
+            try {
+                const claims = await requireClaims(req);
+                const user = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
+                res.json({ user_id: user.user_id, teams: user.teams ?? [] });
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
+        // Model catalogue. With ?team_id=X the list is narrowed to the models the
+        // team may use (its `models` plus access groups); the caller must belong
+        // to that team. Without it the full catalogue is returned, as before.
         router.get('/bridge/models', async (req, res) => {
             try {
-                await requireClaims(req); // authenticate only
+                const claims = await requireClaims(req);
+                const teamId = typeof req.query.team_id === 'string' ? req.query.team_id : '';
                 const models = await client.listModels();
-                res.json(models);
+                if (!teamId) {
+                    res.json(models);
+                    return;
+                }
+                const user = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
+                if (!(user.teams ?? []).includes(teamId)) {
+                    res.status(403).json({ error: 'Access denied: team is not one of your teams', team_id: teamId });
+                    return;
+                }
+                const team = await client.getTeamInfo(teamId);
+                const allowed = team.models;
+                if (!allowed || allowed.length === 0 || allowed.includes(backstage_plugin_litellm_common_1.ALL_PROXY_MODELS)) {
+                    res.json(models);
+                    return;
+                }
+                res.json(models.filter(m => (0, backstage_plugin_litellm_common_1.isModelAllowed)(m, allowed)));
             }
             catch (error) {
                 handleBridgeError(error, res);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.17.2",
+  "version": "0.17.4",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",