@acarmisc/backstage-plugin-litellm-backend 0.17.7 → 0.19.0

package/dist/index.d.ts

@@ -2,13 +2,13 @@ export { litellmPlugin } from './plugin';
 export { litellmPlugin as default } from './plugin';
 export { createRouter } from './router';
 export * from './types';
-export { LiteLLMClient, normalizeRequestTags } from './client';
+export { LiteLLMClient } from './client';
 export { resolveUserId, resolveUserProfile, toLiteLLMUserId, getOrProvisionUser, provisionUser, readProvisioningDefaults, readRoleConfigs, applyRoleOverrides, resolveUserRole, ProvisioningError, } from './provisioning';
 export type { BackstageUserProfile } from './provisioning';
 export { readTeamAdminConfig, isTeamManagementEnabled, assertTeamAdmin, validateTeamWriteInput, validateTeamPatchInput, } from './teamAdmin';
 export type { TeamAdminConfig, TeamAdminCheck, TeamWriteInput, TeamWriteValidation, TeamPatchValidation } from './teamAdmin';
 export { readTeamBudgetVisibility, redactTeamBudget, redactTeamUsage, teamBudgetStatusFor, } from './teamBudgetVisibility';
 export type { TeamBudgetVisibility, TeamBudgetStatus } from './teamBudgetVisibility';
-export { KeycloakJWTVerifier, newDefaultVerifier, readBridgeConfig, resolveBridgeUserId, getOrProvisionUserFromClaims, bridgeListKeys, bridgeGenerateKey, } from './bridge';
+export { KeycloakJWTVerifier, newDefaultVerifier, readBridgeConfig, resolveBridgeUserId, getOrProvisionUserFromClaims, bridgeListKeys, } from './bridge';
 export type { BridgeClaims, TokenVerifier, BridgeConfig, KeycloakJWTVerifierOptions, } from './bridge';
 export { litellmPermissions, litellmKeyCreatePermission, litellmKeyRevokePermission, litellmKeyManagePermission, litellmKeyResetSpendPermission, litellmKeyUnblockPermission, litellmAuditReadPermission, litellmTeamCreatePermission, litellmTeamManagePermission, litellmTeamMembersManagePermission, litellmTeamKnowledgebaseManagePermission, litellmTeamMcpManagePermission, litellmTeamDeletePermission, } from '@acarmisc/backstage-plugin-litellm-common';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyUnblockPermission = exports.litellmKeyResetSpendPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = exports.litellmPermissions = exports.bridgeGenerateKey = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.teamBudgetStatusFor = exports.redactTeamUsage = exports.redactTeamBudget = exports.readTeamBudgetVisibility = exports.validateTeamPatchInput = exports.validateTeamWriteInput = exports.assertTeamAdmin = exports.isTeamManagementEnabled = exports.readTeamAdminConfig = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.normalizeRequestTags = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
+exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyUnblockPermission = exports.litellmKeyResetSpendPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = exports.litellmPermissions = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.teamBudgetStatusFor = exports.redactTeamUsage = exports.redactTeamBudget = exports.readTeamBudgetVisibility = exports.validateTeamPatchInput = exports.validateTeamWriteInput = exports.assertTeamAdmin = exports.isTeamManagementEnabled = exports.readTeamAdminConfig = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
 var plugin_1 = require("./plugin");
 Object.defineProperty(exports, "litellmPlugin", { enumerable: true, get: function () { return plugin_1.litellmPlugin; } });
 var plugin_2 = require("./plugin");
@@ -24,7 +24,6 @@ Object.defineProperty(exports, "createRouter", { enumerable: true, get: function
 __exportStar(require("./types"), exports);
 var client_1 = require("./client");
 Object.defineProperty(exports, "LiteLLMClient", { enumerable: true, get: function () { return client_1.LiteLLMClient; } });
-Object.defineProperty(exports, "normalizeRequestTags", { enumerable: true, get: function () { return client_1.normalizeRequestTags; } });
 var provisioning_1 = require("./provisioning");
 Object.defineProperty(exports, "resolveUserId", { enumerable: true, get: function () { return provisioning_1.resolveUserId; } });
 Object.defineProperty(exports, "resolveUserProfile", { enumerable: true, get: function () { return provisioning_1.resolveUserProfile; } });
@@ -54,7 +53,6 @@ Object.defineProperty(exports, "readBridgeConfig", { enumerable: true, get: func
 Object.defineProperty(exports, "resolveBridgeUserId", { enumerable: true, get: function () { return bridge_1.resolveBridgeUserId; } });
 Object.defineProperty(exports, "getOrProvisionUserFromClaims", { enumerable: true, get: function () { return bridge_1.getOrProvisionUserFromClaims; } });
 Object.defineProperty(exports, "bridgeListKeys", { enumerable: true, get: function () { return bridge_1.bridgeListKeys; } });
-Object.defineProperty(exports, "bridgeGenerateKey", { enumerable: true, get: function () { return bridge_1.bridgeGenerateKey; } });
 var backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 Object.defineProperty(exports, "litellmPermissions", { enumerable: true, get: function () { return backstage_plugin_litellm_common_1.litellmPermissions; } });
 Object.defineProperty(exports, "litellmKeyCreatePermission", { enumerable: true, get: function () { return backstage_plugin_litellm_common_1.litellmKeyCreatePermission; } });

package/dist/provisioning.d.ts

@@ -49,11 +49,13 @@ export declare function readProvisioningDefaults(config: Config): {
  * Extracts the authenticated Backstage user identity from the request token.
  * Returns the userEntityRef (e.g. "user:default/john.doe") or undefined when
  * the request carries no user credential (service-to-service calls).
+ * Only accepts headers starting with 'Bearer ' (case-sensitive as Backstage sends it).
  */
 export declare function resolveUserId(req: Request, auth: AuthService): Promise<string | undefined>;
 /**
  * Like resolveUserId, but returns the raw BackstageCredentials object
  * (rather than just the entity ref) for passing into PermissionsService.authorize().
+ * Only accepts headers starting with 'Bearer ' (case-sensitive as Backstage sends it).
  */
 export declare function resolveCredentials(req: Request, auth: AuthService): Promise<BackstageCredentials | undefined>;
 /**

package/dist/provisioning.js

@@ -13,6 +13,7 @@ exports.getOrProvisionUser = getOrProvisionUser;
 exports.isUserMemberOfGroup = isUserMemberOfGroup;
 exports.resolveUserRole = resolveUserRole;
 const client_1 = require("./client");
+const errors_1 = require("./errors");
 /**
  * Converts a Backstage user entity ref to a LiteLLM user_id.
  *
@@ -107,11 +108,13 @@ function readProvisioningDefaults(config) {
  * Extracts the authenticated Backstage user identity from the request token.
  * Returns the userEntityRef (e.g. "user:default/john.doe") or undefined when
  * the request carries no user credential (service-to-service calls).
+ * Only accepts headers starting with 'Bearer ' (case-sensitive as Backstage sends it).
  */
 async function resolveUserId(req, auth) {
-    const rawToken = req.headers.authorization?.slice(7);
-    if (!rawToken)
+    const authHeader = req.headers.authorization ?? '';
+    if (!authHeader.startsWith('Bearer '))
         return undefined;
+    const rawToken = authHeader.slice(7);
     try {
         const credentials = await auth.authenticate(rawToken);
         const principal = credentials.principal;
@@ -120,18 +123,20 @@ async function resolveUserId(req, auth) {
         }
     }
     catch {
-        // invalid or service token — caller gets query-param fallback
+        // invalid or service token
     }
     return undefined;
 }
 /**
  * Like resolveUserId, but returns the raw BackstageCredentials object
  * (rather than just the entity ref) for passing into PermissionsService.authorize().
+ * Only accepts headers starting with 'Bearer ' (case-sensitive as Backstage sends it).
  */
 async function resolveCredentials(req, auth) {
-    const rawToken = req.headers.authorization?.slice(7);
-    if (!rawToken)
+    const authHeader = req.headers.authorization ?? '';
+    if (!authHeader.startsWith('Bearer '))
         return undefined;
+    const rawToken = authHeader.slice(7);
     try {
         return await auth.authenticate(rawToken);
     }
@@ -236,20 +241,6 @@ async function provisionUser(client, userId, defaults, profile, backstageEntity,
  * requests for a re-deleted user can still trigger fresh provisioning.
  */
 const provisioningInFlight = new Map();
-/**
- * Strips any echoed Authorization bearer token from upstream LiteLLM error
- * messages before they're shipped back to the browser. LiteLLM normally does
- * not echo the master key, but defense in depth: never let a `Bearer …`
- * substring travel out in a response body.
- */
-function sanitizeUpstreamMessage(message) {
-    if (!message)
-        return 'unknown error';
-    return message
-        .replace(/Bearer\s+[A-Za-z0-9._\-+/=]+/g, 'Bearer [redacted]')
-        .replace(/sk-[A-Za-z0-9_\-]{8,}/g, 'sk-[redacted]')
-        .slice(0, 500);
-}
 class ProvisioningError extends Error {
     constructor(message, hint, provisioning, status = 404) {
         super(message);
@@ -331,7 +322,7 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
                 ? upstreamStatus
                 : 502;
             const errMessage = err instanceof Error ? err.message : String(err);
-            throw new ProvisioningError('LiteLLM auto-provisioning failed', `LiteLLM upstream ${upstreamStatus ?? 'error'}: ${sanitizeUpstreamMessage(errMessage)}`, true, passThrough);
+            throw new ProvisioningError('LiteLLM auto-provisioning failed', `LiteLLM upstream ${upstreamStatus ?? 'error'}: ${(0, errors_1.sanitizeUpstreamMessage)(errMessage)}`, true, passThrough);
         }
     })();
     provisioningInFlight.set(userId, provisionPromise);

package/dist/router.js

@@ -148,22 +148,6 @@ async function createRouter(options) {
             }
             return { tokenEntityRef, userId, key };
         },
-        sendOwnershipError: (err, res) => {
-            // Handle NotAllowedError from authorizeKeyAction
-            if (err instanceof errors_1.NotAllowedError) {
-                res.status(403).json({ error: err.message });
-                return true;
-            }
-            // Fallback for legacy errors with status and body
-            if (err && typeof err === 'object' && 'status' in err && 'body' in err) {
-                const errObj = err;
-                if (typeof errObj.status === 'number' && errObj.body) {
-                    res.status(errObj.status).json(errObj.body);
-                    return true;
-                }
-            }
-            return false;
-        },
         assertPermission: async (req, permission) => {
             const credentials = await (0, provisioning_1.resolveCredentials)(req, auth);
             if (!credentials)
@@ -201,13 +185,19 @@ async function createRouter(options) {
         sendTeamError: (err, res) => {
             (0, errors_2.sendError)(res, err, logger, 'team operation');
         },
-        authorizeTeamSubresource: async (req, res, permission) => {
+        authorizeTeamSubresource: async (req, res, permission, opts) => {
             if (!ctx.requireTeamMgmt(res))
                 return null;
             if (!teamAdminCfg.group) {
                 res.status(500).json({ error: 'Team management is misconfigured (group is missing)' });
                 return null;
             }
+            if (teamAdminCfg.readOnly) {
+                res.status(403).json({
+                    error: 'Team management is read-only (litellm.teamAdmin.readOnly): teams are managed outside Backstage',
+                });
+                return null;
+            }
             const check = await (0, teamAdmin_1.assertTeamAdmin)({
                 req,
                 auth,
@@ -217,7 +207,11 @@ async function createRouter(options) {
                 permission,
                 logger,
             });
-            if (!check.ok) {
+            // A caller outside the admin group may still qualify through their
+            // LiteLLM team role (litellm.teamAdmin.memberManagerRoles), so a 403
+            // here is deferred until that path has been tried.
+            const teamRoleEligible = !!opts?.allowTeamRole && teamAdminCfg.memberManagerRoles.length > 0;
+            if (!check.ok && !(check.status === 403 && teamRoleEligible)) {
                 res.status(check.status).json({ error: check.error });
                 return null;
             }
@@ -241,25 +235,53 @@ async function createRouter(options) {
             const owningGroup = typeof existing.metadata?.owning_group === 'string'
                 ? existing.metadata.owning_group
                 : undefined;
-            if (!owningGroup) {
-                res.status(403).json({
+            // Group path: admin-group member whose group owns the team.
+            let denial;
+            if (!check.ok) {
+                denial = { status: check.status, error: check.error };
+            }
+            else if (!owningGroup) {
+                denial = {
+                    status: 403,
                     error: 'This team is not managed by Backstage team admins and cannot be edited here',
-                });
-                return null;
+                };
             }
-            const owns = await (0, provisioning_1.isUserMemberOfGroup)(check.userEntityRef, owningGroup, catalogClient, auth, logger);
-            if (!owns) {
-                res
-                    .status(403)
-                    .json({ error: `Access denied: team is owned by ${owningGroup}` });
-                return null;
+            else if (await (0, provisioning_1.isUserMemberOfGroup)(check.userEntityRef, owningGroup, catalogClient, auth, logger)) {
+                return {
+                    teamId,
+                    owningGroup,
+                    actor: check.userEntityRef,
+                    team: existing,
+                    via: 'group',
+                };
+            }
+            else {
+                denial = {
+                    status: 403,
+                    error: `Access denied: team is owned by ${owningGroup}`,
+                };
+            }
+            // Team-role path: the caller holds an allowed role in this very team.
+            // The permission framework still has the final say.
+            if (teamRoleEligible) {
+                const actor = await (0, provisioning_1.resolveUserId)(req, auth);
+                const litellmUserId = actor && (0, provisioning_1.toLiteLLMUserId)(actor, userIdDomain);
+                const role = existing.members_with_roles?.find(m => m.user_id === litellmUserId)?.role;
+                if (actor &&
+                    role &&
+                    teamAdminCfg.memberManagerRoles.includes(role) &&
+                    (await ctx.assertPermission(req, permission))) {
+                    return {
+                        teamId,
+                        owningGroup: owningGroup ?? '',
+                        actor,
+                        team: existing,
+                        via: 'teamRole',
+                    };
+                }
             }
-            return {
-                teamId,
-                owningGroup,
-                actor: check.userEntityRef,
-                team: existing,
-            };
+            res.status(denial.status).json({ error: denial.error });
+            return null;
         },
     };
     const router = (0, express_1.Router)();

package/dist/routes/bridge.js

@@ -8,7 +8,7 @@ const keyService_1 = require("../services/keyService");
 const errors_1 = require("../errors");
 const backstage_plugin_litellm_common_2 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
-    const { client, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, allowUnlimitedBudget, teamRequired, keyValidationConfig, } = ctx;
+    const { client, logger, userIdDomain, provisioningEnabled, provisioningDefaults, allowUnlimitedBudget, teamRequired, keyValidationConfig, } = ctx;
     const { config } = bridgeOpts;
     const generateKeyInputSchema = (0, backstage_plugin_litellm_common_2.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
     // ---------------------------------------------------------------------------
@@ -99,8 +99,8 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
                 if (!allowUnlimitedBudget && input.max_budget === undefined) {
                     input.max_budget = provisioningDefaults.maxBudget;
                 }
-                // ── Resolve user identity from verified claims ───────────────────────
-                const userId = (0, bridge_1.resolveBridgeUserId)(claims, bridgeIdentity);
+                // ── Resolve and provision user from verified claims ──────────────────
+                const userInfo = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
                 // ── Create key via unified service ──────────────────────────────────
                 const keyCreateCtx = {
                     client,
@@ -108,18 +108,10 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
                         allowUnlimitedBudget,
                         teamRequired,
                     },
-                    // Bridge does not have Backstage catalogClient/auth
-                    // so provisioning from JWT claims only (no Backstage profile enrichment)
-                    catalogClient: undefined,
-                    auth: undefined,
                     logger,
                     keyValidationConfig,
-                    provisioningEnabled,
-                    provisioningDefaults,
-                    roleConfigs,
-                    userIdDomain,
                 };
-                const result = await (0, keyService_1.createKeyForUser)({ userId }, input, keyCreateCtx);
+                const result = await (0, keyService_1.createKeyForUser)({ userInfo, createdVia: 'abby-cli' }, input, keyCreateCtx);
                 res.json(result);
             }
             catch (error) {
@@ -132,23 +124,22 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
             try {
                 const claims = await requireClaims(req);
                 const user = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
-                // Enrich team list with metadata (display names, etc.)
+                // Enrich team list with metadata (display names, etc.) in parallel
                 const teamIds = user.teams ?? [];
-                const teamMetadata = [];
-                for (const teamId of teamIds) {
+                const teamMetadata = await Promise.all(teamIds.map(async (teamId) => {
                     try {
                         const teamInfo = await client.getTeamInfo(teamId);
-                        teamMetadata.push({
+                        return {
                             id: teamId,
                             name: teamInfo.team_alias || teamId, // Use alias as display name, fallback to ID
-                        });
+                        };
                     }
                     catch (e) {
                         // If we can't fetch team info, just use the ID
                         logger.debug(`Could not fetch team info for ${teamId}: ${e.message}`);
-                        teamMetadata.push({ id: teamId });
+                        return { id: teamId };
                     }
-                }
+                }));
                 res.json({ user_id: user.user_id, teams: teamIds, team_metadata: teamMetadata });
             }
             catch (error) {

package/dist/routes/config.js

@@ -26,6 +26,8 @@ function registerConfigRoutes(router, ctx) {
                 maxBudgetCeiling: ctx.teamAdminCfg.maxBudgetCeiling,
                 allowUnlimitedBudget: ctx.teamAdminCfg.allowUnlimitedBudget,
                 objectPermissionsEnabled: ctx.objectPermsEnabled,
+                readOnly: ctx.teamAdminCfg.readOnly,
+                memberManagerRoles: ctx.teamAdminCfg.memberManagerRoles,
             },
             display: {
                 hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,

package/dist/routes/context.d.ts

@@ -40,16 +40,18 @@ export interface RouterContext {
         userId: string;
         key: VirtualKey;
     }>;
-    sendOwnershipError(err: unknown, res: Response): boolean;
     assertPermission(req: Request, permission: BasicPermission): Promise<boolean>;
     sendPermissionDenied(res: Response, permission: BasicPermission): void;
     requireTeamMgmt(res: Response): boolean;
     requireObjectPerms(res: Response): boolean;
     sendTeamError(err: unknown, res: Response): void;
-    authorizeTeamSubresource(req: Request, res: Response, permission: BasicPermission): Promise<{
+    authorizeTeamSubresource(req: Request, res: Response, permission: BasicPermission, opts?: {
+        allowTeamRole?: boolean;
+    }): Promise<{
         teamId: string;
         owningGroup: string;
         actor: string;
         team: TeamInfo;
+        via: 'group' | 'teamRole';
     } | null>;
 }

package/dist/routes/keys.js

@@ -13,7 +13,7 @@ const withUser_1 = require("./middleware/withUser");
  * location and access to shared state (via ctx) differ.
  */
 function registerKeysRoutes(router, ctx) {
-    const { client, catalogClient, auth, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, auditGroup, allowUnlimitedBudget, teamRequired, allowOwnerResetSpend, keyValidationConfig, authorizeKeyAction, sendOwnershipError, assertPermission, sendPermissionDenied, } = ctx;
+    const { client, catalogClient, auth, logger, auditGroup, allowUnlimitedBudget, teamRequired, allowOwnerResetSpend, keyValidationConfig, authorizeKeyAction, assertPermission, sendPermissionDenied, } = ctx;
     const generateKeyInputSchema = (0, backstage_plugin_litellm_common_1.createGenerateKeyInputSchema)(keyValidationConfig);
     const updateKeyInputSchema = (0, backstage_plugin_litellm_common_1.createUpdateKeyInputSchema)(keyValidationConfig);
     router.get('/user/info', async (_req, res) => {
@@ -132,7 +132,8 @@ function registerKeysRoutes(router, ctx) {
                 return;
             }
             const tokenEntityRef = res.locals.tokenEntityRef;
-            const resolvedUserId = res.locals.userId;
+            // ── Resolve and provision user ──────────────────────────────────────
+            const userInfo = await (0, withUser_1.getProvisionedUser)(ctx, res);
             // ── Create key via unified service ──────────────────────────────────
             const keyCreateCtx = {
                 client,
@@ -144,12 +145,8 @@ function registerKeysRoutes(router, ctx) {
                 auth,
                 logger,
                 keyValidationConfig,
-                provisioningEnabled,
-                provisioningDefaults,
-                roleConfigs,
-                userIdDomain,
             };
-            const result = await (0, keyService_1.createKeyForUser)({ tokenEntityRef, userId: resolvedUserId }, input, keyCreateCtx);
+            const result = await (0, keyService_1.createKeyForUser)({ tokenEntityRef, userInfo }, input, keyCreateCtx);
             res.json(result);
         }
         catch (error) {
@@ -277,8 +274,6 @@ function registerKeysRoutes(router, ctx) {
             res.json(result);
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'update key');
         }
     });
@@ -299,8 +294,6 @@ function registerKeysRoutes(router, ctx) {
             res.json({ success: true });
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'delete key');
         }
     });
@@ -334,8 +327,6 @@ function registerKeysRoutes(router, ctx) {
             res.json({ success: true });
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'block key');
         }
     });
@@ -371,8 +362,6 @@ function registerKeysRoutes(router, ctx) {
             res.json({ success: true });
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'unblock key');
         }
     });
@@ -397,8 +386,6 @@ function registerKeysRoutes(router, ctx) {
             res.json({ success: true });
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'reset key spend');
         }
     });
@@ -454,10 +441,10 @@ function registerKeysRoutes(router, ctx) {
                 res.status(400).json({ error: 'start_date and end_date are required' });
                 return;
             }
-            const tokenEntityRef = res.locals.tokenEntityRef;
-            const userId = res.locals.userId;
-            await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
-            const usage = await client.getUsage(start_date, end_date, userId);
+            await (0, withUser_1.getProvisionedUser)(ctx, res);
+            // Always filter by the caller's id: an empty user_id makes LiteLLM
+            // return org-wide activity.
+            const usage = await client.getUsage(start_date, end_date, res.locals.userId);
             res.json(usage);
         }
         catch (error) {

package/dist/routes/middleware/withUser.d.ts

@@ -1,4 +1,5 @@
 import { Request, Response, NextFunction } from 'express';
+import { UserInfo } from '../../types';
 import type { RouterContext } from '../context';
 /**
  * Express middleware that resolves a Backstage user principal to a LiteLLM user ID.
@@ -12,7 +13,7 @@ export declare function createRequireUser(ctx: RouterContext): (req: Request, re
  * Returns the user info or throws ProvisioningError (which the caller must handle and respond to).
  *
  * This deduplicates the repeated pattern:
- *   const userInfo = await getOrProvisionUser(...);
+ *   const userInfo = await getProvisionedUser(...);
  *   if (error instanceof ProvisioningError) { res.status(...).json(...); return; }
  */
-export declare function getProvisionedUser(ctx: RouterContext, res: Response): Promise<any>;
+export declare function getProvisionedUser(ctx: RouterContext, res: Response): Promise<UserInfo>;

package/dist/routes/middleware/withUser.js

@@ -31,7 +31,7 @@ function createRequireUser(ctx) {
  * Returns the user info or throws ProvisioningError (which the caller must handle and respond to).
  *
  * This deduplicates the repeated pattern:
- *   const userInfo = await getOrProvisionUser(...);
+ *   const userInfo = await getProvisionedUser(...);
  *   if (error instanceof ProvisioningError) { res.status(...).json(...); return; }
  */
 async function getProvisionedUser(ctx, res) {

package/dist/routes/objectPermissions.js

@@ -3,9 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerObjectPermissionsRoutes = registerObjectPermissionsRoutes;
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const teamAdmin_1 = require("../teamAdmin");
-const teamBudgetVisibility_1 = require("../teamBudgetVisibility");
+const respondTeam_1 = require("../http/respondTeam");
 function registerObjectPermissionsRoutes(router, ctx) {
-    const { client, catalogClient, auth, permissions, logger, teamAdminCfg, teamBudgetVisibility, requireObjectPerms, sendTeamError, authorizeTeamSubresource, } = ctx;
+    const { client, catalogClient, auth, permissions, logger, teamAdminCfg, requireObjectPerms, sendTeamError, authorizeTeamSubresource, } = ctx;
     // ── Knowledge-base (vector store) management ────────────────────────────
     //
     // Attaching a vector store to a team exposes its documents to every team
@@ -91,9 +91,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
                 owningGroup,
                 vector_stores: requested,
             });
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -185,9 +183,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
                 before,
                 after: requested,
             });
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);

package/dist/routes/teamUsage.js

@@ -7,7 +7,7 @@ const errors_1 = require("../errors");
 const teamFetch_1 = require("../http/teamFetch");
 const withUser_1 = require("./middleware/withUser");
 function registerTeamUsageRoutes(router, ctx) {
-    const { client, catalogClient, auth, logger, provisioningEnabled, provisioningDefaults, roleConfigs, teamBudgetVisibility, } = ctx;
+    const { client, catalogClient, auth, logger, teamBudgetVisibility, } = ctx;
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
     router.get('/teams/:teamId/usage', requireUser, async (req, res) => {
         try {
@@ -19,8 +19,7 @@ function registerTeamUsageRoutes(router, ctx) {
             }
             // Authorize: member of the team OR a team manager
             const tokenEntityRef = res.locals.tokenEntityRef;
-            const userId = res.locals.userId;
-            const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            const userInfo = await (0, withUser_1.getProvisionedUser)(ctx, res);
             // Check membership: user must be in the team OR be a team manager
             const isMember = userInfo?.teams?.includes(teamId) ?? false;
             // A "manager" administers this specific team: team management is enabled