@acarmisc/backstage-plugin-litellm-backend 0.17.7 → 0.19.0

package/dist/routes/teams.js

@@ -4,13 +4,12 @@ exports.registerTeamsRoutes = registerTeamsRoutes;
 const provisioning_1 = require("../provisioning");
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const teamAdmin_1 = require("../teamAdmin");
-const teamBudgetVisibility_1 = require("../teamBudgetVisibility");
 const errors_1 = require("../errors");
 const withUser_1 = require("./middleware/withUser");
 const respondTeam_1 = require("../http/respondTeam");
 const teamFetch_1 = require("../http/teamFetch");
 function registerTeamsRoutes(router, ctx) {
-    const { client, catalogClient, auth, permissions, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, teamAdminCfg, teamBudgetVisibility, requireTeamMgmt, sendTeamError, authorizeTeamSubresource, } = ctx;
+    const { client, catalogClient, auth, permissions, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, teamAdminCfg, requireTeamMgmt, sendTeamError, authorizeTeamSubresource, } = ctx;
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
     router.get('/teams', requireUser, async (_req, res) => {
         try {
@@ -43,6 +42,12 @@ function registerTeamsRoutes(router, ctx) {
             res.status(500).json({ error: 'Team management is misconfigured (group is missing)' });
             return;
         }
+        if (teamAdminCfg.readOnly) {
+            res.status(403).json({
+                error: 'Team management is read-only (litellm.teamAdmin.readOnly): teams are managed outside Backstage',
+            });
+            return;
+        }
         const check = await (0, teamAdmin_1.assertTeamAdmin)({
             req,
             auth,
@@ -56,6 +61,16 @@ function registerTeamsRoutes(router, ctx) {
             res.status(check.status).json({ error: check.error });
             return;
         }
+        // createGroups narrows creation to a subset of the admin group.
+        if (teamAdminCfg.createGroups.length > 0) {
+            const memberships = await Promise.all(teamAdminCfg.createGroups.map(group => (0, provisioning_1.isUserMemberOfGroup)(check.userEntityRef, group, catalogClient, auth, logger)));
+            if (!memberships.some(Boolean)) {
+                res.status(403).json({
+                    error: `Access denied: team creation is limited to ${teamAdminCfg.createGroups.join(', ')}`,
+                });
+                return;
+            }
+        }
         const v = (0, teamAdmin_1.validateTeamWriteInput)(req.body ?? {}, teamAdminCfg);
         if (!v.ok) {
             res.status(400).json({ error: v.error });
@@ -67,7 +82,7 @@ function registerTeamsRoutes(router, ctx) {
             logger.info(`Team creation already in flight for ${key} — joining`);
             try {
                 const result = await pending;
-                res.json(result);
+                (0, respondTeam_1.respondTeam)(res, result, ctx, 'manager');
             }
             catch (err) {
                 sendTeamError(err, res);
@@ -100,10 +115,7 @@ function registerTeamsRoutes(router, ctx) {
         teamFetch_1.teamCreateInFlight.set(key, createPromise);
         try {
             const result = await createPromise;
-            // Manager surface: redact dollars when hidden even from managers.
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(result)
-                : result);
+            (0, respondTeam_1.respondTeam)(res, result, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -150,9 +162,7 @@ function registerTeamsRoutes(router, ctx) {
                 teamId,
                 owningGroup,
             });
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(r)
-                : r);
+            (0, respondTeam_1.respondTeam)(res, r, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -224,10 +234,7 @@ function registerTeamsRoutes(router, ctx) {
             // the caller's group set and filter with includes().
             const owned = all.filter(t => typeof t.metadata?.owning_group === 'string' &&
                 t.metadata.owning_group === teamAdminCfg.group);
-            // Manager surface: strip dollar amounts when hidden even from managers.
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? owned.map(teamBudgetVisibility_1.redactTeamBudget)
-                : owned);
+            (0, respondTeam_1.respondTeamList)(res, owned, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -240,10 +247,10 @@ function registerTeamsRoutes(router, ctx) {
     // provision them on the spot when auto-provisioning is enabled. Only the
     // 'user' team role can be assigned from Backstage.
     router.post('/teams/:teamId/members', async (req, res) => {
-        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission);
+        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission, { allowTeamRole: true });
         if (!authz)
             return;
-        const { teamId, owningGroup, actor } = authz;
+        const { teamId, owningGroup, actor, via } = authz;
         const body = (req.body ?? {});
         const userEntityRef = (body.userEntityRef ?? '').trim();
         if (!userEntityRef) {
@@ -267,6 +274,12 @@ function registerTeamsRoutes(router, ctx) {
                 return;
             }
             maxBudgetInTeam = body.maxBudgetInTeam;
+            if (via === 'teamRole') {
+                res.status(403).json({
+                    error: 'Team member managers cannot set member budgets',
+                });
+                return;
+            }
         }
         // (a) the member must be a real User in the Backstage catalog
         try {
@@ -318,11 +331,10 @@ function registerTeamsRoutes(router, ctx) {
                 teamId,
                 member: litellmUserId,
                 owningGroup,
+                via,
             });
             const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -332,10 +344,10 @@ function registerTeamsRoutes(router, ctx) {
     // from the `userEntityRef` query param (entity refs contain ':' and '/', so
     // they can't be a path segment). No catalog re-check on removal.
     router.delete('/teams/:teamId/members', async (req, res) => {
-        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission);
+        const authz = await authorizeTeamSubresource(req, res, backstage_plugin_litellm_common_1.litellmTeamMembersManagePermission, { allowTeamRole: true });
         if (!authz)
             return;
-        const { teamId, owningGroup, actor } = authz;
+        const { teamId, owningGroup, actor, team, via } = authz;
         const userEntityRef = String(req.query.userEntityRef ?? '').trim();
         if (!userEntityRef) {
             res
@@ -344,6 +356,21 @@ function registerTeamsRoutes(router, ctx) {
             return;
         }
         const litellmUserId = (0, provisioning_1.toLiteLLMUserId)(userEntityRef, userIdDomain);
+        // Team-role managers change membership only: they cannot remove
+        // themselves nor a peer holding a manager role.
+        if (via === 'teamRole') {
+            if (litellmUserId === (0, provisioning_1.toLiteLLMUserId)(actor, userIdDomain)) {
+                res.status(400).json({ error: 'You cannot remove yourself from the team' });
+                return;
+            }
+            const role = team.members_with_roles?.find(m => m.user_id === litellmUserId)?.role;
+            if (role && teamAdminCfg.memberManagerRoles.includes(role)) {
+                res.status(403).json({
+                    error: `Only platform team admins can remove a team ${role}`,
+                });
+                return;
+            }
+        }
         try {
             await client.teamMemberDelete({
                 team_id: teamId,
@@ -354,11 +381,10 @@ function registerTeamsRoutes(router, ctx) {
                 teamId,
                 member: litellmUserId,
                 owningGroup,
+                via,
             });
             const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);

package/dist/services/keyService.d.ts

@@ -1,20 +1,23 @@
 /**
- * Key generation service — unified by PR-6.
+ * Key generation service.
  *
  * Extracts the common logic for creating API keys from both the UI (POST /keys/generate)
- * and the bridge (POST /bridge/keys). Handles validation, provisioning, team/model checks,
- * and explicit upstream request construction.
+ * and the bridge (POST /bridge/keys). Handles validation, team/model checks,
+ * and explicit upstream request construction. Callers resolve the user beforehand.
  */
 import { AuthService, LoggerService } from '@backstage/backend-plugin-api';
 import { CatalogClient } from '@backstage/catalog-client';
 import { LiteLLMClient } from '../client';
-import { GenerateKeyResponse, ProvisioningDefaults, RoleConfig } from '../types';
+import { GenerateKeyResponse, UserInfo } from '../types';
 import { type KeyValidationConfig, type GenerateKeyInput } from '@acarmisc/backstage-plugin-litellm-common';
+/** User identity for key creation — already resolved by the caller. */
 export interface KeyCreateUser {
     /** Backstage user entity ref, e.g. "user:default/alice" (may be empty for bridge). */
     tokenEntityRef?: string;
-    /** Resolved LiteLLM user_id. Required. */
-    userId: string;
+    /** Resolved user info from LiteLLM. Required. */
+    userInfo: UserInfo;
+    /** How the key was created (for metadata stamping). Defaults to 'backstage'. */
+    createdVia?: string;
 }
 /** Context needed to create a key — configuration, clients, and services. */
 export interface KeyCreateContext {
@@ -27,10 +30,6 @@ export interface KeyCreateContext {
     auth?: AuthService;
     logger: LoggerService;
     keyValidationConfig: KeyValidationConfig;
-    provisioningEnabled: boolean;
-    provisioningDefaults: ProvisioningDefaults;
-    roleConfigs: RoleConfig[];
-    userIdDomain?: string;
 }
 /** Error thrown during key creation — maps to HTTP responses. */
 export declare class KeyServiceError extends Error {
@@ -44,18 +43,16 @@ export declare class KeyServiceError extends Error {
  * Performs:
  * - Schema validation of the input
  * - Config flag enforcement (allowUnlimitedBudget, teamRequired)
- * - User provisioning (single-flight, role configs)
  * - Team membership validation
  * - Model subset validation
  * - Metadata stamping
  * - Explicit upstream request construction and call
  *
- * @param user Verified identity: tokenEntityRef (optional) + userId (required)
+ * @param user Resolved identity: tokenEntityRef (optional) + userInfo (required, pre-provisioned)
  * @param input Parsed GenerateKeyInput from the schema
  * @param ctx Configuration and service clients
  * @returns The new key response from LiteLLM
  * @throws KeyServiceError with status and body for HTTP response
- * @throws ProvisioningError for provisioning failures
  * @throws LiteLLMUpstreamError for upstream LiteLLM errors
  */
 export declare function createKeyForUser(user: KeyCreateUser, input: GenerateKeyInput, ctx: KeyCreateContext): Promise<GenerateKeyResponse>;

package/dist/services/keyService.js

@@ -1,16 +1,15 @@
 "use strict";
 /**
- * Key generation service — unified by PR-6.
+ * Key generation service.
  *
  * Extracts the common logic for creating API keys from both the UI (POST /keys/generate)
- * and the bridge (POST /bridge/keys). Handles validation, provisioning, team/model checks,
- * and explicit upstream request construction.
+ * and the bridge (POST /bridge/keys). Handles validation, team/model checks,
+ * and explicit upstream request construction. Callers resolve the user beforehand.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyServiceError = void 0;
 exports.createKeyForUser = createKeyForUser;
 const provisioning_1 = require("../provisioning");
-/** Unified identity for key creation — resolved from either Backstage or JWT claims. */
 const modelAccess_1 = require("./modelAccess");
 /** Error thrown during key creation — maps to HTTP responses. */
 class KeyServiceError extends Error {
@@ -27,57 +26,21 @@ exports.KeyServiceError = KeyServiceError;
  * Performs:
  * - Schema validation of the input
  * - Config flag enforcement (allowUnlimitedBudget, teamRequired)
- * - User provisioning (single-flight, role configs)
  * - Team membership validation
  * - Model subset validation
  * - Metadata stamping
  * - Explicit upstream request construction and call
  *
- * @param user Verified identity: tokenEntityRef (optional) + userId (required)
+ * @param user Resolved identity: tokenEntityRef (optional) + userInfo (required, pre-provisioned)
  * @param input Parsed GenerateKeyInput from the schema
  * @param ctx Configuration and service clients
  * @returns The new key response from LiteLLM
  * @throws KeyServiceError with status and body for HTTP response
- * @throws ProvisioningError for provisioning failures
  * @throws LiteLLMUpstreamError for upstream LiteLLM errors
  */
 async function createKeyForUser(user, input, ctx) {
-    const { client, config, catalogClient, auth, logger, provisioningEnabled, provisioningDefaults, roleConfigs, } = ctx;
-    // ── Ensure user is provisioned ──────────────────────────────────────
-    // For bridge (no catalogClient/auth), use direct provisioning from JWT;
-    // for UI (with catalogClient/auth), use full provisioning with group roles.
-    let userInfo;
-    if (catalogClient !== undefined && catalogClient !== null && auth !== undefined && auth !== null) {
-        userInfo = await (0, provisioning_1.getOrProvisionUser)(client, user.tokenEntityRef || '', user.userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
-    }
-    else {
-        // Bridge path: just check if user exists, or provision with minimal info
-        userInfo = await client.getUserInfo(user.userId);
-        if (!userInfo) {
-            if (!provisioningEnabled) {
-                throw new KeyServiceError(404, {
-                    error: 'User not found in LiteLLM',
-                    detail: 'No LiteLLM user for this identity. Log in to Backstage once to be provisioned, or enable litellm.provisioning.enabled.',
-                });
-            }
-            // Provision with minimal info (just user_id, will use defaults)
-            const created = await client.createUser({
-                user_id: user.userId,
-                user_email: user.userId,
-                max_budget: provisioningDefaults.maxBudget,
-                budget_duration: provisioningDefaults.budgetDuration,
-                models: provisioningDefaults.models,
-                teams: provisioningDefaults.teams?.length ? [provisioningDefaults.teams[0]] : [],
-            });
-            if (!created) {
-                throw new KeyServiceError(500, {
-                    error: 'User provisioning failed',
-                    detail: 'Failed to create user in LiteLLM',
-                });
-            }
-            userInfo = await client.getUserInfo(user.userId);
-        }
-    }
+    const { client, config, catalogClient, auth, logger, } = ctx;
+    const userInfo = user.userInfo;
     // ── Enforce config flags ────────────────────────────────────────────
     if (!config.allowUnlimitedBudget && (input.max_budget === null || input.max_budget === undefined)) {
         throw new KeyServiceError(400, { error: 'max_budget is required when unlimited budgets are not allowed' });
@@ -127,13 +90,15 @@ async function createKeyForUser(user, input, ctx) {
         ? await (0, provisioning_1.resolveUserProfile)(user.tokenEntityRef, catalogClient, auth, logger)
         : {};
     const clientMetadata = input.metadata ?? {};
+    const createdVia = user.createdVia ?? 'backstage';
     const serverMetadata = {
-        created_by_backstage_user: user.tokenEntityRef ?? 'unknown',
+        ...(user.tokenEntityRef && { created_by_backstage_user: user.tokenEntityRef }),
+        ...(!user.tokenEntityRef && { created_by: userInfo.user_id }),
         ...(profile.email && { created_by_email: profile.email }),
         ...(profile.displayName && {
             created_by_display_name: profile.displayName,
         }),
-        created_via: 'backstage',
+        created_via: createdVia,
         created_at_iso: new Date().toISOString(),
     };
     // Server-owned keys override client values
@@ -145,7 +110,7 @@ async function createKeyForUser(user, input, ctx) {
     // Never spread the raw body; only include fields we've explicitly validated.
     const upstreamRequest = {
         alias: input.alias,
-        user_id: user.userId,
+        user_id: userInfo.user_id,
     };
     if (input.models !== undefined) {
         upstreamRequest.models = input.models;
@@ -174,6 +139,6 @@ async function createKeyForUser(user, input, ctx) {
     upstreamRequest.metadata = enrichedMetadata;
     // ── Call upstream LiteLLM ───────────────────────────────────────────
     const result = await client.generateKey(upstreamRequest);
-    logger.info('key.generate', { userId: user.userId, keyAlias: input.alias });
+    logger.info('key.generate', { userId: userInfo.user_id, keyAlias: input.alias });
     return result;
 }

package/dist/teamAdmin.d.ts

@@ -61,6 +61,30 @@ export interface TeamAdminConfig {
      * Allow an admin to delete a team (vs. only block/deactivate).
      */
     allowTeamDelete: boolean;
+    /**
+     * When true, all team write operations return 403 even for admins:
+     * POST /teams, PATCH /teams/:id, DELETE /teams/:id,
+     * POST/DELETE /teams/:id/members, and PUT objectPermissions routes.
+     * Reads (GET /teams, GET /teams/managed) keep working.
+     * Fail-closed: defaults to false (writes allowed).
+     */
+    readOnly: boolean;
+    /**
+     * Backstage group refs that must include the caller for team creation.
+     * Empty => no group restriction, admin group check alone suffices.
+     * When non-empty, POST /teams additionally requires the caller to be
+     * a member of at least one of these groups, narrowing the permission.
+     * Fail-closed: defaults to [] (no extra restriction).
+     */
+    createGroups: string[];
+    /**
+     * LiteLLM team roles whose holders may add/remove members of their own team.
+     * Empty => feature off, only admins can manage members.
+     * When non-empty, callers with one of these roles in members_with_roles
+     * can POST/DELETE /teams/:teamId/members without owning the team's group.
+     * Fail-closed: defaults to [] (off).
+     */
+    memberManagerRoles: string[];
 }
 /**
  * Whether team-management routes should be mounted.

package/dist/teamAdmin.js

@@ -112,6 +112,9 @@ function readTeamAdminConfig(config) {
         allowedMcpServers: config.getOptionalStringArray('litellm.teamAdmin.allowedMcpServers') ?? [],
         allowedMcpAccessGroups: config.getOptionalStringArray('litellm.teamAdmin.allowedMcpAccessGroups') ?? [],
         allowTeamDelete: config.getOptionalBoolean('litellm.teamAdmin.allowTeamDelete') ?? false,
+        readOnly: config.getOptionalBoolean('litellm.teamAdmin.readOnly') ?? false,
+        createGroups: config.getOptionalStringArray('litellm.teamAdmin.createGroups') ?? [],
+        memberManagerRoles: config.getOptionalStringArray('litellm.teamAdmin.memberManagerRoles') ?? [],
     };
 }
 function validateTeamWriteInput(input, cfg) {

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n/** One row from LiteLLM's `/spend/logs` (per-request spend log entry). */\nexport interface SpendLogEntry {\n  request_id?: string;\n  /** ISO timestamp of the call. */\n  startTime?: string;\n  endTime?: string;\n  spend?: number;\n  total_tokens?: number;\n  prompt_tokens?: number;\n  completion_tokens?: number;\n  model?: string;\n  /** Virtual key alias or hash the request was billed to. */\n  api_key?: string;\n  user?: string;\n  team_id?: string;\n  /**\n   * Tags attached to the request (e.g. `channel:backstage`,\n   * `session:<thread>`, `invoked-by:<user>`). Shape varies across LiteLLM\n   * versions (array or object) and is normalised to a string[].\n   */\n  request_tags?: string[] | Record<string, string>;\n  /** LiteLLM `metadata` blob; carries trace ids and session grouping. */\n  metadata?: Record<string, unknown> | string | null;\n}\n\nexport interface SpendLogsParams {\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  start_date: string;\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  end_date: string;\n  /** Restrict to the given virtual key. */\n  api_key?: string;\n  user_id?: string;\n  team_id?: string;\n  /** Max rows to return (LiteLLM caps at 1000 per page). */\n  page_size?: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -96,42 +96,6 @@ export interface CreateUserResponse {
     models?: string[];
     teams?: string[];
 }
-/** One row from LiteLLM's `/spend/logs` (per-request spend log entry). */
-export interface SpendLogEntry {
-    request_id?: string;
-    /** ISO timestamp of the call. */
-    startTime?: string;
-    endTime?: string;
-    spend?: number;
-    total_tokens?: number;
-    prompt_tokens?: number;
-    completion_tokens?: number;
-    model?: string;
-    /** Virtual key alias or hash the request was billed to. */
-    api_key?: string;
-    user?: string;
-    team_id?: string;
-    /**
-     * Tags attached to the request (e.g. `channel:backstage`,
-     * `session:<thread>`, `invoked-by:<user>`). Shape varies across LiteLLM
-     * versions (array or object) and is normalised to a string[].
-     */
-    request_tags?: string[] | Record<string, string>;
-    /** LiteLLM `metadata` blob; carries trace ids and session grouping. */
-    metadata?: Record<string, unknown> | string | null;
-}
-export interface SpendLogsParams {
-    /** ISO date `YYYY-MM-DD` (inclusive). */
-    start_date: string;
-    /** ISO date `YYYY-MM-DD` (inclusive). */
-    end_date: string;
-    /** Restrict to the given virtual key. */
-    api_key?: string;
-    user_id?: string;
-    team_id?: string;
-    /** Max rows to return (LiteLLM caps at 1000 per page). */
-    page_size?: number;
-}
 export interface AuditLogsParams {
     page?: number;
     page_size?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.17.7",
+  "version": "0.19.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -32,21 +32,17 @@
     "lint": "eslint src --ext .ts",
     "test": "tsc -p tsconfig.test.json && node --test \"dist-test/**/*.test.js\"",
     "api-report": "npm run build && api-extractor run --local --verbose",
-    "prepack": "npm run build",
-    "postpack": ""
+    "prepack": "npm run build"
   },
   "dependencies": {
     "@acarmisc/backstage-plugin-litellm-common": "0.1.0",
     "@backstage/backend-plugin-api": "^1.9.1",
     "@backstage/catalog-client": "^1.9.0",
-    "@backstage/catalog-model": "^1.7.0",
     "@backstage/config": "^1.3.0",
     "@backstage/errors": "^1.3.0",
     "@backstage/plugin-permission-common": "^0.9.10",
-    "@backstage/types": "^1.2.0",
     "express": "^4.18.2",
-    "jose": "^5.9.6",
-    "zod": "^3.22.0"
+    "jose": "^5.9.6"
   },
   "devDependencies": {
     "@backstage/cli": "^0.36.2",