@acarmisc/backstage-plugin-litellm-backend 0.17.7 → 0.18.0

package/dist/router.js

@@ -201,13 +201,19 @@ async function createRouter(options) {
         sendTeamError: (err, res) => {
             (0, errors_2.sendError)(res, err, logger, 'team operation');
         },
-        authorizeTeamSubresource: async (req, res, permission) => {
+        authorizeTeamSubresource: async (req, res, permission, opts) => {
             if (!ctx.requireTeamMgmt(res))
                 return null;
             if (!teamAdminCfg.group) {
                 res.status(500).json({ error: 'Team management is misconfigured (group is missing)' });
                 return null;
             }
+            if (teamAdminCfg.readOnly) {
+                res.status(403).json({
+                    error: 'Team management is read-only (litellm.teamAdmin.readOnly): teams are managed outside Backstage',
+                });
+                return null;
+            }
             const check = await (0, teamAdmin_1.assertTeamAdmin)({
                 req,
                 auth,
@@ -217,7 +223,11 @@ async function createRouter(options) {
                 permission,
                 logger,
             });
-            if (!check.ok) {
+            // A caller outside the admin group may still qualify through their
+            // LiteLLM team role (litellm.teamAdmin.memberManagerRoles), so a 403
+            // here is deferred until that path has been tried.
+            const teamRoleEligible = !!opts?.allowTeamRole && teamAdminCfg.memberManagerRoles.length > 0;
+            if (!check.ok && !(check.status === 403 && teamRoleEligible)) {
                 res.status(check.status).json({ error: check.error });
                 return null;
             }
@@ -241,25 +251,53 @@ async function createRouter(options) {
             const owningGroup = typeof existing.metadata?.owning_group === 'string'
                 ? existing.metadata.owning_group
                 : undefined;
-            if (!owningGroup) {
-                res.status(403).json({
+            // Group path: admin-group member whose group owns the team.
+            let denial;
+            if (!check.ok) {
+                denial = { status: check.status, error: check.error };
+            }
+            else if (!owningGroup) {
+                denial = {
+                    status: 403,
                     error: 'This team is not managed by Backstage team admins and cannot be edited here',
-                });
-                return null;
+                };
             }
-            const owns = await (0, provisioning_1.isUserMemberOfGroup)(check.userEntityRef, owningGroup, catalogClient, auth, logger);
-            if (!owns) {
-                res
-                    .status(403)
-                    .json({ error: `Access denied: team is owned by ${owningGroup}` });
-                return null;
+            else if (await (0, provisioning_1.isUserMemberOfGroup)(check.userEntityRef, owningGroup, catalogClient, auth, logger)) {
+                return {
+                    teamId,
+                    owningGroup,
+                    actor: check.userEntityRef,
+                    team: existing,
+                    via: 'group',
+                };
+            }
+            else {
+                denial = {
+                    status: 403,
+                    error: `Access denied: team is owned by ${owningGroup}`,
+                };
+            }
+            // Team-role path: the caller holds an allowed role in this very team.
+            // The permission framework still has the final say.
+            if (teamRoleEligible) {
+                const actor = await (0, provisioning_1.resolveUserId)(req, auth);
+                const litellmUserId = actor && (0, provisioning_1.toLiteLLMUserId)(actor, userIdDomain);
+                const role = existing.members_with_roles?.find(m => m.user_id === litellmUserId)?.role;
+                if (actor &&
+                    role &&
+                    teamAdminCfg.memberManagerRoles.includes(role) &&
+                    (await ctx.assertPermission(req, permission))) {
+                    return {
+                        teamId,
+                        owningGroup: owningGroup ?? '',
+                        actor,
+                        team: existing,
+                        via: 'teamRole',
+                    };
+                }
             }
-            return {
-                teamId,
-                owningGroup,
-                actor: check.userEntityRef,
-                team: existing,
-            };
+            res.status(denial.status).json({ error: denial.error });
+            return null;
         },
     };
     const router = (0, express_1.Router)();

package/dist/routes/config.js

@@ -26,6 +26,8 @@ function registerConfigRoutes(router, ctx) {
                 maxBudgetCeiling: ctx.teamAdminCfg.maxBudgetCeiling,
                 allowUnlimitedBudget: ctx.teamAdminCfg.allowUnlimitedBudget,
                 objectPermissionsEnabled: ctx.objectPermsEnabled,
+                readOnly: ctx.teamAdminCfg.readOnly,
+                memberManagerRoles: ctx.teamAdminCfg.memberManagerRoles,
             },
             display: {
                 hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,

package/dist/routes/context.d.ts

@@ -46,10 +46,13 @@ export interface RouterContext {
     requireTeamMgmt(res: Response): boolean;
     requireObjectPerms(res: Response): boolean;
     sendTeamError(err: unknown, res: Response): void;
-    authorizeTeamSubresource(req: Request, res: Response, permission: BasicPermission): Promise<{
+    authorizeTeamSubresource(req: Request, res: Response, permission: BasicPermission, opts?: {
+        allowTeamRole?: boolean;
+    }): Promise<{
         teamId: string;
         owningGroup: string;
         actor: string;
         team: TeamInfo;
+        via: 'group' | 'teamRole';
     } | null>;
 }

package/dist/routes/teams.js

@@ -43,6 +43,12 @@ function registerTeamsRoutes(router, ctx) {
             res.status(500).json({ error: 'Team management is misconfigured (group is missing)' });
             return;
         }
+        if (teamAdminCfg.readOnly) {
+            res.status(403).json({
+                error: 'Team management is read-only (litellm.teamAdmin.readOnly): teams are managed outside Backstage',
+            });
+            return;
+        }
         const check = await (0, teamAdmin_1.assertTeamAdmin)({
             req,
             auth,
@@ -56,6 +62,16 @@ function registerTeamsRoutes(router, ctx) {
             res.status(check.status).json({ error: check.error });
             return;
         }
+        // createGroups narrows creation to a subset of the admin group.
+        if (teamAdminCfg.createGroups.length > 0) {
+            const memberships = await Promise.all(teamAdminCfg.createGroups.map(group => (0, provisioning_1.isUserMemberOfGroup)(check.userEntityRef, group, catalogClient, auth, logger)));
+            if (!memberships.some(Boolean)) {
+                res.status(403).json({
+                    error: `Access denied: team creation is limited to ${teamAdminCfg.createGroups.join(', ')}`,
+                });
+                return;
+            }
+        }
         const v = (0, teamAdmin_1.validateTeamWriteInput)(req.body ?? {}, teamAdminCfg);
         if (!v.ok) {
             res.status(400).json({ error: v.error });
@@ -240,10 +256,10 @@ function registerTeamsRoutes(router, ctx) {
     // provision them on the spot when auto-provisioning is enabled. Only the
     // 'user' team role can be assigned from Backstage.
     router.post('/teams/:teamId/members', async (req, res) => {
-        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission);
+        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission, { allowTeamRole: true });
         if (!authz)
             return;
-        const { teamId, owningGroup, actor } = authz;
+        const { teamId, owningGroup, actor, via } = authz;
         const body = (req.body ?? {});
         const userEntityRef = (body.userEntityRef ?? '').trim();
         if (!userEntityRef) {
@@ -267,6 +283,12 @@ function registerTeamsRoutes(router, ctx) {
                 return;
             }
             maxBudgetInTeam = body.maxBudgetInTeam;
+            if (via === 'teamRole') {
+                res.status(403).json({
+                    error: 'Team member managers cannot set member budgets',
+                });
+                return;
+            }
         }
         // (a) the member must be a real User in the Backstage catalog
         try {
@@ -318,6 +340,7 @@ function registerTeamsRoutes(router, ctx) {
                 teamId,
                 member: litellmUserId,
                 owningGroup,
+                via,
             });
             const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
             res.json(teamBudgetVisibility.hideTeamBudgetForManagers
@@ -332,10 +355,10 @@ function registerTeamsRoutes(router, ctx) {
     // from the `userEntityRef` query param (entity refs contain ':' and '/', so
     // they can't be a path segment). No catalog re-check on removal.
     router.delete('/teams/:teamId/members', async (req, res) => {
-        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission);
+        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission, { allowTeamRole: true });
         if (!authz)
             return;
-        const { teamId, owningGroup, actor } = authz;
+        const { teamId, owningGroup, actor, team, via } = authz;
         const userEntityRef = String(req.query.userEntityRef ?? '').trim();
         if (!userEntityRef) {
             res
@@ -344,6 +367,21 @@ function registerTeamsRoutes(router, ctx) {
             return;
         }
         const litellmUserId = (0, provisioning_1.toLiteLLMUserId)(userEntityRef, userIdDomain);
+        // Team-role managers change membership only: they cannot remove
+        // themselves nor a peer holding a manager role.
+        if (via === 'teamRole') {
+            if (litellmUserId === (0, provisioning_1.toLiteLLMUserId)(actor, userIdDomain)) {
+                res.status(400).json({ error: 'You cannot remove yourself from the team' });
+                return;
+            }
+            const role = team.members_with_roles?.find(m => m.user_id === litellmUserId)?.role;
+            if (role && teamAdminCfg.memberManagerRoles.includes(role)) {
+                res.status(403).json({
+                    error: `Only platform team admins can remove a team ${role}`,
+                });
+                return;
+            }
+        }
         try {
             await client.teamMemberDelete({
                 team_id: teamId,
@@ -354,6 +392,7 @@ function registerTeamsRoutes(router, ctx) {
                 teamId,
                 member: litellmUserId,
                 owningGroup,
+                via,
             });
             const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
             res.json(teamBudgetVisibility.hideTeamBudgetForManagers

package/dist/teamAdmin.d.ts

@@ -61,6 +61,30 @@ export interface TeamAdminConfig {
      * Allow an admin to delete a team (vs. only block/deactivate).
      */
     allowTeamDelete: boolean;
+    /**
+     * When true, all team write operations return 403 even for admins:
+     * POST /teams, PATCH /teams/:id, DELETE /teams/:id,
+     * POST/DELETE /teams/:id/members, and PUT objectPermissions routes.
+     * Reads (GET /teams, GET /teams/managed) keep working.
+     * Fail-closed: defaults to false (writes allowed).
+     */
+    readOnly: boolean;
+    /**
+     * Backstage group refs that must include the caller for team creation.
+     * Empty => no group restriction, admin group check alone suffices.
+     * When non-empty, POST /teams additionally requires the caller to be
+     * a member of at least one of these groups, narrowing the permission.
+     * Fail-closed: defaults to [] (no extra restriction).
+     */
+    createGroups: string[];
+    /**
+     * LiteLLM team roles whose holders may add/remove members of their own team.
+     * Empty => feature off, only admins can manage members.
+     * When non-empty, callers with one of these roles in members_with_roles
+     * can POST/DELETE /teams/:teamId/members without owning the team's group.
+     * Fail-closed: defaults to [] (off).
+     */
+    memberManagerRoles: string[];
 }
 /**
  * Whether team-management routes should be mounted.

package/dist/teamAdmin.js

@@ -112,6 +112,9 @@ function readTeamAdminConfig(config) {
         allowedMcpServers: config.getOptionalStringArray('litellm.teamAdmin.allowedMcpServers') ?? [],
         allowedMcpAccessGroups: config.getOptionalStringArray('litellm.teamAdmin.allowedMcpAccessGroups') ?? [],
         allowTeamDelete: config.getOptionalBoolean('litellm.teamAdmin.allowTeamDelete') ?? false,
+        readOnly: config.getOptionalBoolean('litellm.teamAdmin.readOnly') ?? false,
+        createGroups: config.getOptionalStringArray('litellm.teamAdmin.createGroups') ?? [],
+        memberManagerRoles: config.getOptionalStringArray('litellm.teamAdmin.memberManagerRoles') ?? [],
     };
 }
 function validateTeamWriteInput(input, cfg) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.17.7",
+  "version": "0.18.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",