@acarmisc/backstage-plugin-litellm-backend 0.17.3 → 0.17.5

package/dist/plugin.d.ts

@@ -1 +1,7 @@
+/**
+ * Bridge routes exempt from Backstage's default auth policy (they verify the
+ * Keycloak JWT themselves). Every route registered in routes/bridge.ts must be
+ * listed here, or the framework answers 401 before the bridge verifier runs.
+ */
+export declare const BRIDGE_UNAUTHENTICATED_PATHS: string[];
 export declare const litellmPlugin: import("@backstage/backend-plugin-api").BackendFeature;

package/dist/plugin.js

@@ -1,10 +1,21 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.litellmPlugin = void 0;
+exports.litellmPlugin = exports.BRIDGE_UNAUTHENTICATED_PATHS = void 0;
 const backend_plugin_api_1 = require("@backstage/backend-plugin-api");
 const router_1 = require("./router");
 const bridge_1 = require("./bridge");
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+/**
+ * Bridge routes exempt from Backstage's default auth policy (they verify the
+ * Keycloak JWT themselves). Every route registered in routes/bridge.ts must be
+ * listed here, or the framework answers 401 before the bridge verifier runs.
+ */
+exports.BRIDGE_UNAUTHENTICATED_PATHS = [
+    '/bridge/health',
+    '/bridge/keys',
+    '/bridge/models',
+    '/bridge/user/info',
+];
 exports.litellmPlugin = (0, backend_plugin_api_1.createBackendPlugin)({
     pluginId: 'litellm',
     register(reg) {
@@ -33,11 +44,7 @@ exports.litellmPlugin = (0, backend_plugin_api_1.createBackendPlugin)({
                 // policy, otherwise the framework rejects the Keycloak Bearer with
                 // "Illegal token" before the bridge verifier ever runs.
                 if ((0, bridge_1.readBridgeConfig)(config).enabled) {
-                    for (const path of [
-                        '/bridge/health',
-                        '/bridge/keys',
-                        '/bridge/models',
-                    ]) {
+                    for (const path of exports.BRIDGE_UNAUTHENTICATED_PATHS) {
                         httpRouter.addAuthPolicy({ path, allow: 'unauthenticated' });
                     }
                 }

package/dist/routes/bridge.js

@@ -132,7 +132,24 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
             try {
                 const claims = await requireClaims(req);
                 const user = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
-                res.json({ user_id: user.user_id, teams: user.teams ?? [] });
+                // Enrich team list with metadata (display names, etc.)
+                const teamIds = user.teams ?? [];
+                const teamMetadata = [];
+                for (const teamId of teamIds) {
+                    try {
+                        const teamInfo = await client.getTeamInfo(teamId);
+                        teamMetadata.push({
+                            id: teamId,
+                            name: teamInfo.team_alias || teamId, // Use alias as display name, fallback to ID
+                        });
+                    }
+                    catch (e) {
+                        // If we can't fetch team info, just use the ID
+                        logger.debug(`Could not fetch team info for ${teamId}: ${e.message}`);
+                        teamMetadata.push({ id: teamId });
+                    }
+                }
+                res.json({ user_id: user.user_id, teams: teamMetadata });
             }
             catch (error) {
                 handleBridgeError(error, res);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.17.3",
+  "version": "0.17.5",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",