@acarmisc/backstage-plugin-litellm-backend 0.17.7 → 0.18.0

package/config.d.ts

@@ -324,6 +324,34 @@ export interface Config {
        */
       allowTeamDelete?: boolean;
 
+      /**
+       * When true, all team write operations return 403 even for admins:
+       * POST /teams, PATCH /teams/:id, DELETE /teams/:id,
+       * POST/DELETE /teams/:id/members, and PUT objectPermissions routes.
+       * Reads (GET /teams, GET /teams/managed) keep working.
+       * Error message: 'Team management is read-only (litellm.teamAdmin.readOnly): teams are managed outside Backstage'.
+       * @default false
+       */
+      readOnly?: boolean;
+
+      /**
+       * Backstage group refs that must include the caller for team creation.
+       * When non-empty, POST /teams additionally requires the caller to be
+       * a member of at least one of these groups, narrowing the permission.
+       * Error message: 'Access denied: team creation is limited to <comma-joined groups>'.
+       * @default []
+       */
+      createGroups?: string[];
+
+      /**
+       * LiteLLM team roles whose holders may add/remove members of their own team.
+       * When non-empty, callers with one of these roles in members_with_roles
+       * can POST/DELETE /teams/:teamId/members without owning the team's group.
+       * Allows non-admins to manage their team's membership without full admin access.
+       * @default []
+       */
+      memberManagerRoles?: string[];
+
       /**
        * Object-permission management (attaching knowledge bases / MCP servers
        * to a team). This is the highest-risk surface — attaching a vector store

package/dist/index.cjs.js

@@ -568,9 +568,9 @@ var require_index_cjs = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/webidl-conversions/lib/index.js
+// ../../node_modules/webidl-conversions/lib/index.js
 var require_lib = __commonJS({
-  "../../node_modules/node-fetch/node_modules/webidl-conversions/lib/index.js"(exports2, module2) {
+  "../../node_modules/webidl-conversions/lib/index.js"(exports2, module2) {
     "use strict";
     var conversions = {};
     module2.exports = conversions;
@@ -721,9 +721,9 @@ var require_lib = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/utils.js
+// ../../node_modules/whatwg-url/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/utils.js"(exports2, module2) {
+  "../../node_modules/whatwg-url/lib/utils.js"(exports2, module2) {
     "use strict";
     module2.exports.mixin = function mixin(target, source) {
       const keys = Object.getOwnPropertyNames(source);
@@ -910,9 +910,9 @@ var require_tr46 = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/url-state-machine.js
+// ../../node_modules/whatwg-url/lib/url-state-machine.js
 var require_url_state_machine = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/url-state-machine.js"(exports2, module2) {
+  "../../node_modules/whatwg-url/lib/url-state-machine.js"(exports2, module2) {
     "use strict";
     var punycode = require("punycode");
     var tr46 = require_tr46();
@@ -1982,9 +1982,9 @@ var require_url_state_machine = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL-impl.js
+// ../../node_modules/whatwg-url/lib/URL-impl.js
 var require_URL_impl = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL-impl.js"(exports2) {
+  "../../node_modules/whatwg-url/lib/URL-impl.js"(exports2) {
     "use strict";
     var usm = require_url_state_machine();
     exports2.implementation = class URLImpl {
@@ -2139,9 +2139,9 @@ var require_URL_impl = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL.js
+// ../../node_modules/whatwg-url/lib/URL.js
 var require_URL = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/URL.js"(exports2, module2) {
+  "../../node_modules/whatwg-url/lib/URL.js"(exports2, module2) {
     "use strict";
     var conversions = require_lib();
     var utils = require_utils();
@@ -2321,9 +2321,9 @@ var require_URL = __commonJS({
   }
 });
 
-// ../../node_modules/node-fetch/node_modules/whatwg-url/lib/public-api.js
+// ../../node_modules/whatwg-url/lib/public-api.js
 var require_public_api = __commonJS({
-  "../../node_modules/node-fetch/node_modules/whatwg-url/lib/public-api.js"(exports2) {
+  "../../node_modules/whatwg-url/lib/public-api.js"(exports2) {
     "use strict";
     exports2.URL = require_URL().interface;
     exports2.serializeURL = require_url_state_machine().serializeURL;
@@ -9050,7 +9050,10 @@ function readTeamAdminConfig(config) {
     allowedMcpAccessGroups: config.getOptionalStringArray(
       "litellm.teamAdmin.allowedMcpAccessGroups"
     ) ?? [],
-    allowTeamDelete: config.getOptionalBoolean("litellm.teamAdmin.allowTeamDelete") ?? false
+    allowTeamDelete: config.getOptionalBoolean("litellm.teamAdmin.allowTeamDelete") ?? false,
+    readOnly: config.getOptionalBoolean("litellm.teamAdmin.readOnly") ?? false,
+    createGroups: config.getOptionalStringArray("litellm.teamAdmin.createGroups") ?? [],
+    memberManagerRoles: config.getOptionalStringArray("litellm.teamAdmin.memberManagerRoles") ?? []
   };
 }
 function validateTeamWriteInput(input, cfg) {
@@ -9795,7 +9798,9 @@ function registerConfigRoutes(router, ctx) {
         enabled: ctx.teamMgmtEnabled,
         maxBudgetCeiling: ctx.teamAdminCfg.maxBudgetCeiling,
         allowUnlimitedBudget: ctx.teamAdminCfg.allowUnlimitedBudget,
-        objectPermissionsEnabled: ctx.objectPermsEnabled
+        objectPermissionsEnabled: ctx.objectPermsEnabled,
+        readOnly: ctx.teamAdminCfg.readOnly,
+        memberManagerRoles: ctx.teamAdminCfg.memberManagerRoles
       },
       display: {
         hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,
@@ -10748,6 +10753,12 @@ function registerTeamsRoutes(router, ctx) {
       res.status(500).json({ error: "Team management is misconfigured (group is missing)" });
       return;
     }
+    if (teamAdminCfg.readOnly) {
+      res.status(403).json({
+        error: "Team management is read-only (litellm.teamAdmin.readOnly): teams are managed outside Backstage"
+      });
+      return;
+    }
     const check = await assertTeamAdmin({
       req,
       auth,
@@ -10761,6 +10772,19 @@ function registerTeamsRoutes(router, ctx) {
       res.status(check.status).json({ error: check.error });
       return;
     }
+    if (teamAdminCfg.createGroups.length > 0) {
+      const memberships = await Promise.all(
+        teamAdminCfg.createGroups.map(
+          (group) => isUserMemberOfGroup(check.userEntityRef, group, catalogClient, auth, logger)
+        )
+      );
+      if (!memberships.some(Boolean)) {
+        res.status(403).json({
+          error: `Access denied: team creation is limited to ${teamAdminCfg.createGroups.join(", ")}`
+        });
+        return;
+      }
+    }
     const v = validateTeamWriteInput(req.body ?? {}, teamAdminCfg);
     if (!v.ok) {
       res.status(400).json({ error: v.error });
@@ -10923,9 +10947,14 @@ function registerTeamsRoutes(router, ctx) {
   router.post(
     "/teams/:teamId/members",
     async (req, res) => {
-      const authz = await authorizeTeamSubresource(req, res, import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission);
+      const authz = await authorizeTeamSubresource(
+        req,
+        res,
+        import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission,
+        { allowTeamRole: true }
+      );
       if (!authz) return;
-      const { teamId, owningGroup, actor } = authz;
+      const { teamId, owningGroup, actor, via } = authz;
       const body = req.body ?? {};
       const userEntityRef = (body.userEntityRef ?? "").trim();
       if (!userEntityRef) {
@@ -10945,6 +10974,12 @@ function registerTeamsRoutes(router, ctx) {
           return;
         }
         maxBudgetInTeam = body.maxBudgetInTeam;
+        if (via === "teamRole") {
+          res.status(403).json({
+            error: "Team member managers cannot set member budgets"
+          });
+          return;
+        }
       }
       try {
         const { token } = await auth.getPluginRequestToken({
@@ -11003,7 +11038,8 @@ function registerTeamsRoutes(router, ctx) {
           actor,
           teamId,
           member: litellmUserId,
-          owningGroup
+          owningGroup,
+          via
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
         res.json(
@@ -11017,15 +11053,35 @@ function registerTeamsRoutes(router, ctx) {
   router.delete(
     "/teams/:teamId/members",
     async (req, res) => {
-      const authz = await authorizeTeamSubresource(req, res, import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission);
+      const authz = await authorizeTeamSubresource(
+        req,
+        res,
+        import_backstage_plugin_litellm_common5.litellmTeamMembersManagePermission,
+        { allowTeamRole: true }
+      );
       if (!authz) return;
-      const { teamId, owningGroup, actor } = authz;
+      const { teamId, owningGroup, actor, team, via } = authz;
       const userEntityRef = String(req.query.userEntityRef ?? "").trim();
       if (!userEntityRef) {
         res.status(400).json({ error: "userEntityRef query parameter is required" });
         return;
       }
       const litellmUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
+      if (via === "teamRole") {
+        if (litellmUserId === toLiteLLMUserId(actor, userIdDomain)) {
+          res.status(400).json({ error: "You cannot remove yourself from the team" });
+          return;
+        }
+        const role = team.members_with_roles?.find(
+          (m) => m.user_id === litellmUserId
+        )?.role;
+        if (role && teamAdminCfg.memberManagerRoles.includes(role)) {
+          res.status(403).json({
+            error: `Only platform team admins can remove a team ${role}`
+          });
+          return;
+        }
+      }
       try {
         await client.teamMemberDelete({
           team_id: teamId,
@@ -11035,7 +11091,8 @@ function registerTeamsRoutes(router, ctx) {
           actor,
           teamId,
           member: litellmUserId,
-          owningGroup
+          owningGroup,
+          via
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
         res.json(
@@ -11314,10 +11371,10 @@ function registerTeamUsageRoutes(router, ctx) {
   });
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/base64url.js
+// node_modules/jose/dist/node/esm/runtime/base64url.js
 var import_node_buffer = require("node:buffer");
 
-// ../../node_modules/jose/dist/node/esm/lib/buffer_utils.js
+// node_modules/jose/dist/node/esm/lib/buffer_utils.js
 var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 var MAX_INT32 = 2 ** 32;
@@ -11332,7 +11389,7 @@ function concat(...buffers) {
   return buf;
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/base64url.js
+// node_modules/jose/dist/node/esm/runtime/base64url.js
 function normalize(input) {
   let encoded = input;
   if (encoded instanceof Uint8Array) {
@@ -11342,7 +11399,7 @@ function normalize(input) {
 }
 var decode = (input) => new Uint8Array(import_node_buffer.Buffer.from(normalize(input), "base64url"));
 
-// ../../node_modules/jose/dist/node/esm/util/errors.js
+// node_modules/jose/dist/node/esm/util/errors.js
 var JOSEError = class extends Error {
   static code = "ERR_JOSE_GENERIC";
   code = "ERR_JOSE_GENERIC";
@@ -11428,18 +11485,18 @@ var JWSSignatureVerificationFailed = class extends JOSEError {
   }
 };
 
-// ../../node_modules/jose/dist/node/esm/runtime/is_key_object.js
+// node_modules/jose/dist/node/esm/runtime/is_key_object.js
 var util = __toESM(require("node:util"), 1);
 var is_key_object_default = (obj) => util.types.isKeyObject(obj);
 
-// ../../node_modules/jose/dist/node/esm/runtime/webcrypto.js
+// node_modules/jose/dist/node/esm/runtime/webcrypto.js
 var crypto = __toESM(require("node:crypto"), 1);
 var util2 = __toESM(require("node:util"), 1);
 var webcrypto2 = crypto.webcrypto;
 var webcrypto_default = webcrypto2;
 var isCryptoKey = (key) => util2.types.isCryptoKey(key);
 
-// ../../node_modules/jose/dist/node/esm/lib/crypto_key.js
+// node_modules/jose/dist/node/esm/lib/crypto_key.js
 function unusable(name, prop = "algorithm.name") {
   return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -11538,7 +11595,7 @@ function checkSigCryptoKey(key, alg, ...usages) {
   checkUsage(key, usages);
 }
 
-// ../../node_modules/jose/dist/node/esm/lib/invalid_key_input.js
+// node_modules/jose/dist/node/esm/lib/invalid_key_input.js
 function message(msg, actual, ...types4) {
   types4 = types4.filter(Boolean);
   if (types4.length > 2) {
@@ -11567,14 +11624,14 @@ function withAlg(alg, actual, ...types4) {
   return message(`Key for the ${alg} algorithm must be `, actual, ...types4);
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/is_key_like.js
+// node_modules/jose/dist/node/esm/runtime/is_key_like.js
 var is_key_like_default = (key) => is_key_object_default(key) || isCryptoKey(key);
 var types3 = ["KeyObject"];
 if (globalThis.CryptoKey || webcrypto_default?.CryptoKey) {
   types3.push("CryptoKey");
 }
 
-// ../../node_modules/jose/dist/node/esm/lib/is_disjoint.js
+// node_modules/jose/dist/node/esm/lib/is_disjoint.js
 var isDisjoint = (...headers) => {
   const sources = headers.filter(Boolean);
   if (sources.length === 0 || sources.length === 1) {
@@ -11598,7 +11655,7 @@ var isDisjoint = (...headers) => {
 };
 var is_disjoint_default = isDisjoint;
 
-// ../../node_modules/jose/dist/node/esm/lib/is_object.js
+// node_modules/jose/dist/node/esm/lib/is_object.js
 function isObjectLike(value) {
   return typeof value === "object" && value !== null;
 }
@@ -11616,10 +11673,10 @@ function isObject(input) {
   return Object.getPrototypeOf(input) === proto;
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/get_named_curve.js
+// node_modules/jose/dist/node/esm/runtime/get_named_curve.js
 var import_node_crypto = require("node:crypto");
 
-// ../../node_modules/jose/dist/node/esm/lib/is_jwk.js
+// node_modules/jose/dist/node/esm/lib/is_jwk.js
 function isJWK(key) {
   return isObject(key) && typeof key.kty === "string";
 }
@@ -11633,7 +11690,7 @@ function isSecretJWK(key) {
   return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/get_named_curve.js
+// node_modules/jose/dist/node/esm/runtime/get_named_curve.js
 var namedCurveToJOSE = (namedCurve) => {
   switch (namedCurve) {
     case "prime256v1":
@@ -11682,7 +11739,7 @@ var getNamedCurve2 = (kee, raw) => {
 };
 var get_named_curve_default = getNamedCurve2;
 
-// ../../node_modules/jose/dist/node/esm/runtime/check_key_length.js
+// node_modules/jose/dist/node/esm/runtime/check_key_length.js
 var import_node_crypto2 = require("node:crypto");
 var check_key_length_default = (key, alg) => {
   let modulusLength;
@@ -11699,7 +11756,7 @@ var check_key_length_default = (key, alg) => {
   }
 };
 
-// ../../node_modules/jose/dist/node/esm/runtime/jwk_to_key.js
+// node_modules/jose/dist/node/esm/runtime/jwk_to_key.js
 var import_node_crypto3 = require("node:crypto");
 var parse = (key) => {
   if (key.d) {
@@ -11709,7 +11766,7 @@ var parse = (key) => {
 };
 var jwk_to_key_default = parse;
 
-// ../../node_modules/jose/dist/node/esm/key/import.js
+// node_modules/jose/dist/node/esm/key/import.js
 async function importJWK(jwk, alg) {
   if (!isObject(jwk)) {
     throw new TypeError("JWK must be an object");
@@ -11733,7 +11790,7 @@ async function importJWK(jwk, alg) {
   }
 }
 
-// ../../node_modules/jose/dist/node/esm/lib/check_key_type.js
+// node_modules/jose/dist/node/esm/lib/check_key_type.js
 var tag = (key) => key?.[Symbol.toStringTag];
 var jwkMatchesOp = (alg, key, usage) => {
   if (key.use !== void 0 && key.use !== "sig") {
@@ -11805,7 +11862,7 @@ function checkKeyType(allowJwk, alg, key, usage) {
 var check_key_type_default = checkKeyType.bind(void 0, false);
 var checkKeyTypeWithJwk = checkKeyType.bind(void 0, true);
 
-// ../../node_modules/jose/dist/node/esm/lib/validate_crit.js
+// node_modules/jose/dist/node/esm/lib/validate_crit.js
 function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
   if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0) {
     throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
@@ -11837,7 +11894,7 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
 }
 var validate_crit_default = validateCrit;
 
-// ../../node_modules/jose/dist/node/esm/lib/validate_algorithms.js
+// node_modules/jose/dist/node/esm/lib/validate_algorithms.js
 var validateAlgorithms = (option, algorithms) => {
   if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== "string"))) {
     throw new TypeError(`"${option}" option must be an array of strings`);
@@ -11849,11 +11906,11 @@ var validateAlgorithms = (option, algorithms) => {
 };
 var validate_algorithms_default = validateAlgorithms;
 
-// ../../node_modules/jose/dist/node/esm/runtime/verify.js
+// node_modules/jose/dist/node/esm/runtime/verify.js
 var crypto3 = __toESM(require("node:crypto"), 1);
 var import_node_util2 = require("node:util");
 
-// ../../node_modules/jose/dist/node/esm/runtime/dsa_digest.js
+// node_modules/jose/dist/node/esm/runtime/dsa_digest.js
 function dsaDigest(alg) {
   switch (alg) {
     case "PS256":
@@ -11877,7 +11934,7 @@ function dsaDigest(alg) {
   }
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/node_key.js
+// node_modules/jose/dist/node/esm/runtime/node_key.js
 var import_node_crypto4 = require("node:crypto");
 var ecCurveAlgMap = /* @__PURE__ */ new Map([
   ["ES256", "P-256"],
@@ -11981,11 +12038,11 @@ function keyForCrypto(alg, key) {
   return options ? { ...options, key } : key;
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/sign.js
+// node_modules/jose/dist/node/esm/runtime/sign.js
 var crypto2 = __toESM(require("node:crypto"), 1);
 var import_node_util = require("node:util");
 
-// ../../node_modules/jose/dist/node/esm/runtime/hmac_digest.js
+// node_modules/jose/dist/node/esm/runtime/hmac_digest.js
 function hmacDigest(alg) {
   switch (alg) {
     case "HS256":
@@ -11999,7 +12056,7 @@ function hmacDigest(alg) {
   }
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/get_sign_verify_key.js
+// node_modules/jose/dist/node/esm/runtime/get_sign_verify_key.js
 var import_node_crypto5 = require("node:crypto");
 function getSignVerifyKey(alg, key, usage) {
   if (key instanceof Uint8Array) {
@@ -12024,7 +12081,7 @@ function getSignVerifyKey(alg, key, usage) {
   throw new TypeError(invalid_key_input_default(key, ...types3, "Uint8Array", "JSON Web Key"));
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/sign.js
+// node_modules/jose/dist/node/esm/runtime/sign.js
 var oneShotSign = (0, import_node_util.promisify)(crypto2.sign);
 var sign2 = async (alg, key, data) => {
   const k = getSignVerifyKey(alg, key, "sign");
@@ -12037,7 +12094,7 @@ var sign2 = async (alg, key, data) => {
 };
 var sign_default = sign2;
 
-// ../../node_modules/jose/dist/node/esm/runtime/verify.js
+// node_modules/jose/dist/node/esm/runtime/verify.js
 var oneShotVerify = (0, import_node_util2.promisify)(crypto3.verify);
 var verify2 = async (alg, key, signature, data) => {
   const k = getSignVerifyKey(alg, key, "verify");
@@ -12060,7 +12117,7 @@ var verify2 = async (alg, key, signature, data) => {
 };
 var verify_default = verify2;
 
-// ../../node_modules/jose/dist/node/esm/jws/flattened/verify.js
+// node_modules/jose/dist/node/esm/jws/flattened/verify.js
 async function flattenedVerify(jws, key, options) {
   if (!isObject(jws)) {
     throw new JWSInvalid("Flattened JWS must be an object");
@@ -12166,7 +12223,7 @@ async function flattenedVerify(jws, key, options) {
   return result;
 }
 
-// ../../node_modules/jose/dist/node/esm/jws/compact/verify.js
+// node_modules/jose/dist/node/esm/jws/compact/verify.js
 async function compactVerify(jws, key, options) {
   if (jws instanceof Uint8Array) {
     jws = decoder.decode(jws);
@@ -12186,10 +12243,10 @@ async function compactVerify(jws, key, options) {
   return result;
 }
 
-// ../../node_modules/jose/dist/node/esm/lib/epoch.js
+// node_modules/jose/dist/node/esm/lib/epoch.js
 var epoch_default = (date) => Math.floor(date.getTime() / 1e3);
 
-// ../../node_modules/jose/dist/node/esm/lib/secs.js
+// node_modules/jose/dist/node/esm/lib/secs.js
 var minute = 60;
 var hour = minute * 60;
 var day = hour * 24;
@@ -12246,7 +12303,7 @@ var secs_default = (str) => {
   return numericDate;
 };
 
-// ../../node_modules/jose/dist/node/esm/lib/jwt_claims_set.js
+// node_modules/jose/dist/node/esm/lib/jwt_claims_set.js
 var normalizeTyp = (value) => value.toLowerCase().replace(/^application\//, "");
 var checkAudiencePresence = (audPayload, audOption) => {
   if (typeof audPayload === "string") {
@@ -12342,7 +12399,7 @@ var jwt_claims_set_default = (protectedHeader, encodedPayload, options = {}) =>
   return payload;
 };
 
-// ../../node_modules/jose/dist/node/esm/jwt/verify.js
+// node_modules/jose/dist/node/esm/jwt/verify.js
 async function jwtVerify(jwt, key, options) {
   const verified = await compactVerify(jwt, key, options);
   if (verified.protectedHeader.crit?.includes("b64") && verified.protectedHeader.b64 === false) {
@@ -12356,7 +12413,7 @@ async function jwtVerify(jwt, key, options) {
   return result;
 }
 
-// ../../node_modules/jose/dist/node/esm/jwks/local.js
+// node_modules/jose/dist/node/esm/jwks/local.js
 function getKtyFromAlg(alg) {
   switch (typeof alg === "string" && alg.slice(0, 2)) {
     case "RS":
@@ -12477,7 +12534,7 @@ function createLocalJWKSet(jwks) {
   return localJWKSet;
 }
 
-// ../../node_modules/jose/dist/node/esm/runtime/fetch_jwks.js
+// node_modules/jose/dist/node/esm/runtime/fetch_jwks.js
 var http = __toESM(require("node:http"), 1);
 var https = __toESM(require("node:https"), 1);
 var import_node_events = require("node:events");
@@ -12519,7 +12576,7 @@ var fetchJwks = async (url, timeout, options) => {
 };
 var fetch_jwks_default = fetchJwks;
 
-// ../../node_modules/jose/dist/node/esm/jwks/remote.js
+// node_modules/jose/dist/node/esm/jwks/remote.js
 function isCloudflareWorkers() {
   return typeof WebSocketPair !== "undefined" || typeof navigator !== "undefined" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime !== "undefined" && EdgeRuntime === "vercel";
 }
@@ -13175,12 +13232,18 @@ async function createRouter(options) {
     sendTeamError: (err, res) => {
       sendError(res, err, logger, "team operation");
     },
-    authorizeTeamSubresource: async (req, res, permission) => {
+    authorizeTeamSubresource: async (req, res, permission, opts) => {
       if (!ctx.requireTeamMgmt(res)) return null;
       if (!teamAdminCfg.group) {
         res.status(500).json({ error: "Team management is misconfigured (group is missing)" });
         return null;
       }
+      if (teamAdminCfg.readOnly) {
+        res.status(403).json({
+          error: "Team management is read-only (litellm.teamAdmin.readOnly): teams are managed outside Backstage"
+        });
+        return null;
+      }
       const check = await assertTeamAdmin({
         req,
         auth,
@@ -13190,7 +13253,8 @@ async function createRouter(options) {
         permission,
         logger
       });
-      if (!check.ok) {
+      const teamRoleEligible = !!opts?.allowTeamRole && teamAdminCfg.memberManagerRoles.length > 0;
+      if (!check.ok && !(check.status === 403 && teamRoleEligible)) {
         res.status(check.status).json({ error: check.error });
         return null;
       }
@@ -13211,29 +13275,52 @@ async function createRouter(options) {
         return null;
       }
       const owningGroup = typeof existing.metadata?.owning_group === "string" ? existing.metadata.owning_group : void 0;
-      if (!owningGroup) {
-        res.status(403).json({
+      let denial;
+      if (!check.ok) {
+        denial = { status: check.status, error: check.error };
+      } else if (!owningGroup) {
+        denial = {
+          status: 403,
           error: "This team is not managed by Backstage team admins and cannot be edited here"
-        });
-        return null;
-      }
-      const owns = await isUserMemberOfGroup(
+        };
+      } else if (await isUserMemberOfGroup(
         check.userEntityRef,
         owningGroup,
         catalogClient,
         auth,
         logger
-      );
-      if (!owns) {
-        res.status(403).json({ error: `Access denied: team is owned by ${owningGroup}` });
-        return null;
+      )) {
+        return {
+          teamId,
+          owningGroup,
+          actor: check.userEntityRef,
+          team: existing,
+          via: "group"
+        };
+      } else {
+        denial = {
+          status: 403,
+          error: `Access denied: team is owned by ${owningGroup}`
+        };
       }
-      return {
-        teamId,
-        owningGroup,
-        actor: check.userEntityRef,
-        team: existing
-      };
+      if (teamRoleEligible) {
+        const actor = await resolveUserId(req, auth);
+        const litellmUserId = actor && toLiteLLMUserId(actor, userIdDomain);
+        const role = existing.members_with_roles?.find(
+          (m) => m.user_id === litellmUserId
+        )?.role;
+        if (actor && role && teamAdminCfg.memberManagerRoles.includes(role) && await ctx.assertPermission(req, permission)) {
+          return {
+            teamId,
+            owningGroup: owningGroup ?? "",
+            actor,
+            team: existing,
+            via: "teamRole"
+          };
+        }
+      }
+      res.status(denial.status).json({ error: denial.error });
+      return null;
     }
   };
   const router = (0, import_express.Router)();