@acarmisc/backstage-plugin-litellm-backend 0.18.0 → 0.19.0

package/dist/index.cjs.js

@@ -7976,7 +7976,6 @@ __export(index_exports, {
   ProvisioningError: () => ProvisioningError,
   applyRoleOverrides: () => applyRoleOverrides,
   assertTeamAdmin: () => assertTeamAdmin,
-  bridgeGenerateKey: () => bridgeGenerateKey,
   bridgeListKeys: () => bridgeListKeys,
   createRouter: () => createRouter,
   default: () => litellmPlugin,
@@ -7998,7 +7997,6 @@ __export(index_exports, {
   litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
-  normalizeRequestTags: () => normalizeRequestTags,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
   readProvisioningDefaults: () => readProvisioningDefaults,
@@ -8024,16 +8022,11 @@ var import_backend_plugin_api = require("@backstage/backend-plugin-api");
 // src/router.ts
 var import_express = __toESM(require("express"));
 var import_plugin_permission_common2 = __toESM(require_index_cjs2());
-var import_errors20 = __toESM(require_index_cjs());
+var import_errors21 = __toESM(require_index_cjs());
 var import_catalog_client = require("@backstage/catalog-client");
 
 // src/client.ts
 var DEFAULT_TIMEOUT = 3e4;
-function normalizeRequestTags(tags) {
-  if (!tags) return [];
-  if (Array.isArray(tags)) return tags.filter((t) => typeof t === "string");
-  return Object.entries(tags).map(([k, v]) => `${k}:${v}`);
-}
 var LiteLLMUpstreamError = class extends Error {
   constructor(status, statusText, body) {
     let message2 = `LiteLLM API error: ${status} ${statusText}`;
@@ -8089,6 +8082,29 @@ var LiteLLMClient = class {
       clearTimeout(timeoutId);
     }
   }
+  /**
+   * Normalizes a raw LiteLLM user response to the UserInfo contract.
+   * Handles both `/user/info` (with `user_info` wrapper) and `/user/list`
+   * response shapes, and converts team arrays to team_id strings.
+   */
+  normalizeUserInfo(raw, fallbackUserId) {
+    const inner = raw?.user_info ?? {};
+    const teamIds = Array.isArray(raw?.teams) ? raw.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
+    return {
+      user_id: raw?.user_id ?? inner.user_id ?? fallbackUserId ?? "",
+      user_email: inner.user_email ?? raw?.user_email,
+      email: inner.email ?? raw?.email,
+      teams: teamIds,
+      models: inner.models ?? raw?.models,
+      max_budget: inner.max_budget ?? raw?.max_budget,
+      budget_duration: inner.budget_duration ?? raw?.budget_duration,
+      budget_reset_at: inner.budget_reset_at ?? raw?.budget_reset_at,
+      spend: inner.spend ?? raw?.spend,
+      current_spend: inner.current_spend ?? raw?.current_spend,
+      soft_limit: inner.soft_limit ?? raw?.soft_limit,
+      hard_limit: inner.hard_limit ?? raw?.hard_limit
+    };
+  }
   /**
    * Returns null when the user is not found in LiteLLM (404).
    * Throws on all other errors so callers know something went wrong.
@@ -8102,22 +8118,7 @@ var LiteLLMClient = class {
     const query = userId ? `?user_id=${encodeURIComponent(userId)}` : "";
     try {
       const raw = await this.request(`/user/info${query}`);
-      const inner = raw?.user_info ?? {};
-      const teamIds = Array.isArray(raw?.teams) ? raw.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
-      return {
-        user_id: raw?.user_id ?? inner.user_id ?? userId ?? "",
-        user_email: inner.user_email ?? raw?.user_email,
-        email: inner.email ?? raw?.email,
-        teams: teamIds,
-        models: inner.models ?? raw?.models,
-        max_budget: inner.max_budget ?? raw?.max_budget,
-        budget_duration: inner.budget_duration ?? raw?.budget_duration,
-        budget_reset_at: inner.budget_reset_at ?? raw?.budget_reset_at,
-        spend: inner.spend ?? raw?.spend,
-        current_spend: inner.current_spend ?? raw?.current_spend,
-        soft_limit: inner.soft_limit ?? raw?.soft_limit,
-        hard_limit: inner.hard_limit ?? raw?.hard_limit
-      };
+      return this.normalizeUserInfo(raw, userId);
     } catch (err) {
       if (err instanceof LiteLLMUpstreamError && err.status === 404) return null;
       throw err;
@@ -8144,22 +8145,7 @@ var LiteLLMClient = class {
         (u) => (u.user_email ?? u.email ?? "").toLowerCase() === email.toLowerCase()
       );
       if (!found) return null;
-      const inner = found.user_info ?? {};
-      const teamIds = Array.isArray(found.teams) ? found.teams.map((t) => typeof t === "string" ? t : t?.team_id).filter((t) => typeof t === "string") : [];
-      return {
-        user_id: found.user_id ?? inner.user_id ?? "",
-        user_email: inner.user_email ?? found.user_email,
-        email: inner.email ?? found.email,
-        teams: teamIds,
-        models: inner.models ?? found.models,
-        max_budget: inner.max_budget ?? found.max_budget,
-        budget_duration: inner.budget_duration ?? found.budget_duration,
-        budget_reset_at: inner.budget_reset_at ?? found.budget_reset_at,
-        spend: inner.spend ?? found.spend,
-        current_spend: inner.current_spend ?? found.current_spend,
-        soft_limit: inner.soft_limit ?? found.soft_limit,
-        hard_limit: inner.hard_limit ?? found.hard_limit
-      };
+      return this.normalizeUserInfo(found);
     } catch (err) {
       if (err instanceof LiteLLMUpstreamError && err.status === 404) return null;
       throw err;
@@ -8423,18 +8409,6 @@ var LiteLLMClient = class {
       body: JSON.stringify({ team_ids: [teamId] })
     });
   }
-  async blockTeam(teamId) {
-    return this.request("/team/block", {
-      method: "POST",
-      body: JSON.stringify({ team_id: teamId })
-    });
-  }
-  async unblockTeam(teamId) {
-    return this.request("/team/unblock", {
-      method: "POST",
-      body: JSON.stringify({ team_id: teamId })
-    });
-  }
   /**
    * Adds a member to a team. LiteLLM's `/team/member_add` nests the member
    * under a `member` object; `role` is 'user' or 'admin' (we only ever send
@@ -8498,43 +8472,6 @@ var LiteLLMClient = class {
       url: r?.url ?? void 0
     })).filter((r) => r.id);
   }
-  /**
-   * Reads per-request spend logs from LiteLLM (`GET /spend/logs`), filtered
-   * by date range and optionally by key/user/team. Rows are normalised so
-   * `request_tags` is always a `string[]` (LiteLLM returns either an array
-   * or an object depending on version) — callers group by tag to attribute
-   * spend to a conversation or caller.
-   *
-   * This is the admin/DB-backed endpoint: it can return a large number of
-   * rows, so callers should keep the date window tight and cap `page_size`.
-   */
-  async getSpendLogs(params) {
-    const query = new URLSearchParams({
-      start_date: params.start_date,
-      end_date: params.end_date
-    });
-    if (params.api_key) query.append("api_key", params.api_key);
-    if (params.user_id) query.append("user_id", params.user_id);
-    if (params.team_id) query.append("team_id", params.team_id);
-    if (params.page_size) query.append("page_size", String(params.page_size));
-    const raw = await this.request(`/spend/logs?${query.toString()}`);
-    const rows = Array.isArray(raw) ? raw : raw?.data ?? [];
-    return rows.map((row) => ({
-      request_id: row?.request_id,
-      startTime: row?.startTime ?? row?.start_time,
-      endTime: row?.endTime ?? row?.end_time,
-      spend: row?.spend ?? 0,
-      total_tokens: row?.total_tokens ?? 0,
-      prompt_tokens: row?.prompt_tokens ?? 0,
-      completion_tokens: row?.completion_tokens ?? 0,
-      model: row?.model,
-      api_key: row?.api_key,
-      user: row?.user,
-      team_id: row?.team_id,
-      request_tags: normalizeRequestTags(row?.request_tags),
-      metadata: row?.metadata
-    }));
-  }
   emptyUsage() {
     return {
       total_spend: 0,
@@ -8698,6 +8635,114 @@ var LiteLLMClient = class {
   }
 };
 
+// src/errors.ts
+var HTML_TAG_PATTERN = /<[^>]*>|&[a-z]+;/gi;
+function isHttpishError(error) {
+  return error !== null && typeof error === "object" && "status" in error && "body" in error && typeof error.status === "number" && // any: property access after guard check
+  typeof error.body === "object";
+}
+function sanitizeUpstreamMessage(msg) {
+  if (!msg || typeof msg !== "string") return "";
+  return msg.replace(/Bearer\s+[A-Za-z0-9._\-+/=]+/g, "Bearer [redacted]").replace(/sk-[A-Za-z0-9_\-]{8,}/g, "sk-[redacted]").replace(HTML_TAG_PATTERN, "").replace(/\s+/g, " ").trim().slice(0, 500);
+}
+function toHttpError(error) {
+  if (isHttpishError(error)) {
+    return {
+      status: error.status,
+      body: error.body,
+      logLevel: "warn"
+    };
+  }
+  if (error instanceof LiteLLMUpstreamError) {
+    if (error.status === 401 || error.status === 403) {
+      return {
+        status: 502,
+        body: { error: "LiteLLM rejected the request" },
+        logLevel: "warn"
+      };
+    }
+    if (error.status >= 500 || error.status < 100) {
+      return {
+        status: 502,
+        body: { error: "LiteLLM is unavailable" },
+        logLevel: "error"
+      };
+    }
+    return {
+      status: error.status === 404 || error.status === 409 ? error.status : 400,
+      body: {
+        error: sanitizeUpstreamMessage(error.message),
+        ...error.param ? { param: error.param } : {}
+      },
+      logLevel: "warn"
+    };
+  }
+  if (error && typeof error === "object" && "name" in error && "message" in error) {
+    const name = error.name;
+    const message3 = String(error.message);
+    if (name === "InputError") {
+      return {
+        status: 400,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+    if (name === "NotAllowedError") {
+      return {
+        status: 403,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+    if (name === "NotFoundError") {
+      return {
+        status: 404,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+    if (name === "ConflictError") {
+      return {
+        status: 409,
+        body: { error: message3 },
+        logLevel: "warn"
+      };
+    }
+  }
+  if (error instanceof Error) {
+    const code = error.code;
+    const cause = error.cause;
+    const networkCodes = ["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "ETIMEDOUT", "EAI_AGAIN", "UND_ERR_CONNECT_TIMEOUT"];
+    if (error.name === "AbortError" || error.name === "TimeoutError" || error.name === "TypeError" && error.message === "fetch failed" || typeof code === "string" && networkCodes.includes(code) || typeof cause?.code === "string" && networkCodes.includes(cause.code)) {
+      return {
+        status: 502,
+        body: { error: "LiteLLM is unavailable" },
+        logLevel: "error",
+        _logMessage: error.message
+      };
+    }
+  }
+  const message2 = error instanceof Error ? error.message : String(error);
+  return {
+    status: 500,
+    body: { error: "Internal error" },
+    logLevel: "error",
+    _logMessage: message2
+  };
+}
+function sendError(res, error, logger, context) {
+  const { status, body, logLevel, _logMessage } = toHttpError(error);
+  const realMessage = _logMessage || (error instanceof Error ? error.message : String(error));
+  if (logLevel === "error") {
+    logger.error(`Failed to ${context}`, error instanceof Error ? error : new Error(String(error)));
+  } else if (logLevel === "warn") {
+    logger.warn(`${context}: ${realMessage}`);
+  } else {
+    logger.info(`${context}: ${realMessage}`);
+  }
+  res.status(status).json(body);
+}
+
 // src/provisioning.ts
 function toLiteLLMUserId(userEntityRef, userIdDomain) {
   const name = userEntityRef.split("/").pop() ?? userEntityRef;
@@ -8754,8 +8799,9 @@ function readProvisioningDefaults(config) {
   return { enabled, defaults };
 }
 async function resolveUserId(req, auth) {
-  const rawToken = req.headers.authorization?.slice(7);
-  if (!rawToken) return void 0;
+  const authHeader = req.headers.authorization ?? "";
+  if (!authHeader.startsWith("Bearer ")) return void 0;
+  const rawToken = authHeader.slice(7);
   try {
     const credentials = await auth.authenticate(rawToken);
     const principal = credentials.principal;
@@ -8767,8 +8813,9 @@ async function resolveUserId(req, auth) {
   return void 0;
 }
 async function resolveCredentials(req, auth) {
-  const rawToken = req.headers.authorization?.slice(7);
-  if (!rawToken) return void 0;
+  const authHeader = req.headers.authorization ?? "";
+  if (!authHeader.startsWith("Bearer ")) return void 0;
+  const rawToken = authHeader.slice(7);
   try {
     return await auth.authenticate(rawToken);
   } catch {
@@ -8847,10 +8894,6 @@ async function provisionUser(client, userId, defaults, profile, backstageEntity,
   }
 }
 var provisioningInFlight = /* @__PURE__ */ new Map();
-function sanitizeUpstreamMessage(message2) {
-  if (!message2) return "unknown error";
-  return message2.replace(/Bearer\s+[A-Za-z0-9._\-+/=]+/g, "Bearer [redacted]").replace(/sk-[A-Za-z0-9_\-]{8,}/g, "sk-[redacted]").slice(0, 500);
-}
 var ProvisioningError = class extends Error {
   constructor(message2, hint, provisioning, status = 404) {
     super(message2);
@@ -9254,114 +9297,6 @@ function readOpencodeConfig(config) {
   };
 }
 
-// src/errors.ts
-var HTML_TAG_PATTERN = /<[^>]*>|&[a-z]+;/gi;
-function isHttpishError(error) {
-  return error !== null && typeof error === "object" && "status" in error && "body" in error && typeof error.status === "number" && // any: property access after guard check
-  typeof error.body === "object";
-}
-function sanitizeUpstreamMessage2(msg) {
-  if (!msg || typeof msg !== "string") return "";
-  return msg.replace(HTML_TAG_PATTERN, "").replace(/\s+/g, " ").trim().slice(0, 500);
-}
-function toHttpError(error) {
-  if (isHttpishError(error)) {
-    return {
-      status: error.status,
-      body: error.body,
-      logLevel: "warn"
-    };
-  }
-  if (error instanceof LiteLLMUpstreamError) {
-    if (error.status === 401 || error.status === 403) {
-      return {
-        status: 502,
-        body: { error: "LiteLLM rejected the request" },
-        logLevel: "warn"
-      };
-    }
-    if (error.status >= 500 || error.status < 100) {
-      return {
-        status: 502,
-        body: { error: "LiteLLM is unavailable" },
-        logLevel: "error"
-      };
-    }
-    return {
-      status: error.status === 404 || error.status === 409 ? error.status : 400,
-      body: {
-        error: sanitizeUpstreamMessage2(error.message),
-        ...error.param ? { param: error.param } : {}
-      },
-      logLevel: "warn"
-    };
-  }
-  if (error && typeof error === "object" && "name" in error && "message" in error) {
-    const name = error.name;
-    const message3 = String(error.message);
-    if (name === "InputError") {
-      return {
-        status: 400,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-    if (name === "NotAllowedError") {
-      return {
-        status: 403,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-    if (name === "NotFoundError") {
-      return {
-        status: 404,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-    if (name === "ConflictError") {
-      return {
-        status: 409,
-        body: { error: message3 },
-        logLevel: "warn"
-      };
-    }
-  }
-  if (error instanceof Error) {
-    const code = error.code;
-    const cause = error.cause;
-    const networkCodes = ["ECONNREFUSED", "ECONNRESET", "ENOTFOUND", "ETIMEDOUT", "EAI_AGAIN", "UND_ERR_CONNECT_TIMEOUT"];
-    if (error.name === "AbortError" || error.name === "TimeoutError" || error.name === "TypeError" && error.message === "fetch failed" || typeof code === "string" && networkCodes.includes(code) || typeof cause?.code === "string" && networkCodes.includes(cause.code)) {
-      return {
-        status: 502,
-        body: { error: "LiteLLM is unavailable" },
-        logLevel: "error",
-        _logMessage: error.message
-      };
-    }
-  }
-  const message2 = error instanceof Error ? error.message : String(error);
-  return {
-    status: 500,
-    body: { error: "Internal error" },
-    logLevel: "error",
-    _logMessage: message2
-  };
-}
-function sendError(res, error, logger, context) {
-  const { status, body, logLevel, _logMessage } = toHttpError(error);
-  const realMessage = _logMessage || (error instanceof Error ? error.message : String(error));
-  if (logLevel === "error") {
-    logger.error(`Failed to ${context}`, error instanceof Error ? error : new Error(String(error)));
-  } else if (logLevel === "warn") {
-    logger.warn(`${context}: ${realMessage}`);
-  } else {
-    logger.info(`${context}: ${realMessage}`);
-  }
-  res.status(status).json(body);
-}
-
 // src/routes/middleware/withUser.ts
 function createRequireUser(ctx) {
   return async (req, res, next) => {
@@ -9897,56 +9832,9 @@ async function createKeyForUser(user, input, ctx) {
     config,
     catalogClient,
     auth,
-    logger,
-    provisioningEnabled,
-    provisioningDefaults,
-    roleConfigs
+    logger
   } = ctx;
-  let userInfo;
-  if (catalogClient !== void 0 && catalogClient !== null && auth !== void 0 && auth !== null) {
-    userInfo = await getOrProvisionUser(
-      client,
-      user.tokenEntityRef || "",
-      user.userId,
-      provisioningEnabled,
-      provisioningDefaults,
-      roleConfigs,
-      catalogClient,
-      auth,
-      logger
-    );
-  } else {
-    userInfo = await client.getUserInfo(user.userId);
-    if (!userInfo) {
-      if (!provisioningEnabled) {
-        throw new KeyServiceError(
-          404,
-          {
-            error: "User not found in LiteLLM",
-            detail: "No LiteLLM user for this identity. Log in to Backstage once to be provisioned, or enable litellm.provisioning.enabled."
-          }
-        );
-      }
-      const created = await client.createUser({
-        user_id: user.userId,
-        user_email: user.userId,
-        max_budget: provisioningDefaults.maxBudget,
-        budget_duration: provisioningDefaults.budgetDuration,
-        models: provisioningDefaults.models,
-        teams: provisioningDefaults.teams?.length ? [provisioningDefaults.teams[0]] : []
-      });
-      if (!created) {
-        throw new KeyServiceError(
-          500,
-          {
-            error: "User provisioning failed",
-            detail: "Failed to create user in LiteLLM"
-          }
-        );
-      }
-      userInfo = await client.getUserInfo(user.userId);
-    }
-  }
+  const userInfo = user.userInfo;
   if (!config.allowUnlimitedBudget && (input.max_budget === null || input.max_budget === void 0)) {
     throw new KeyServiceError(
       400,
@@ -9992,13 +9880,15 @@ async function createKeyForUser(user, input, ctx) {
   }
   const profile = user.tokenEntityRef && catalogClient !== void 0 && catalogClient !== null && auth !== void 0 && auth !== null ? await resolveUserProfile(user.tokenEntityRef, catalogClient, auth, logger) : {};
   const clientMetadata = input.metadata ?? {};
+  const createdVia = user.createdVia ?? "backstage";
   const serverMetadata = {
-    created_by_backstage_user: user.tokenEntityRef ?? "unknown",
+    ...user.tokenEntityRef && { created_by_backstage_user: user.tokenEntityRef },
+    ...!user.tokenEntityRef && { created_by: userInfo.user_id },
     ...profile.email && { created_by_email: profile.email },
     ...profile.displayName && {
       created_by_display_name: profile.displayName
     },
-    created_via: "backstage",
+    created_via: createdVia,
     created_at_iso: (/* @__PURE__ */ new Date()).toISOString()
   };
   const enrichedMetadata = {
@@ -10007,7 +9897,7 @@ async function createKeyForUser(user, input, ctx) {
   };
   const upstreamRequest = {
     alias: input.alias,
-    user_id: user.userId
+    user_id: userInfo.user_id
   };
   if (input.models !== void 0) {
     upstreamRequest.models = input.models;
@@ -10032,7 +9922,7 @@ async function createKeyForUser(user, input, ctx) {
   }
   upstreamRequest.metadata = enrichedMetadata;
   const result = await client.generateKey(upstreamRequest);
-  logger.info("key.generate", { userId: user.userId, keyAlias: input.alias });
+  logger.info("key.generate", { userId: userInfo.user_id, keyAlias: input.alias });
   return result;
 }
 
@@ -10043,17 +9933,12 @@ function registerKeysRoutes(router, ctx) {
     catalogClient,
     auth,
     logger,
-    userIdDomain,
-    provisioningEnabled,
-    provisioningDefaults,
-    roleConfigs,
     auditGroup,
     allowUnlimitedBudget,
     teamRequired,
     allowOwnerResetSpend,
     keyValidationConfig,
     authorizeKeyAction,
-    sendOwnershipError,
     assertPermission,
     sendPermissionDenied
   } = ctx;
@@ -10125,7 +10010,7 @@ function registerKeysRoutes(router, ctx) {
           const keyId = key.token ?? key.key;
           let errorMsg = "Unknown error";
           if (err instanceof Error) {
-            errorMsg = sanitizeUpstreamMessage2(err.message) || "Unknown error";
+            errorMsg = sanitizeUpstreamMessage(err.message) || "Unknown error";
           }
           failures.push({ keyId, error: errorMsg });
           logger.warn("key.prune-expired failed", {
@@ -10165,7 +10050,7 @@ function registerKeysRoutes(router, ctx) {
         return;
       }
       const tokenEntityRef = res.locals.tokenEntityRef;
-      const resolvedUserId = res.locals.userId;
+      const userInfo = await getProvisionedUser(ctx, res);
       const keyCreateCtx = {
         client,
         config: {
@@ -10175,14 +10060,10 @@ function registerKeysRoutes(router, ctx) {
         catalogClient,
         auth,
         logger,
-        keyValidationConfig,
-        provisioningEnabled,
-        provisioningDefaults,
-        roleConfigs,
-        userIdDomain
+        keyValidationConfig
       };
       const result = await createKeyForUser(
-        { tokenEntityRef, userId: resolvedUserId },
+        { tokenEntityRef, userInfo },
         input,
         keyCreateCtx
       );
@@ -10282,7 +10163,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.update", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json(result);
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "update key");
     }
   });
@@ -10302,7 +10182,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.delete", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "delete key");
     }
   });
@@ -10331,7 +10210,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.block", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "block key");
     }
   });
@@ -10356,7 +10234,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.unblock", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "unblock key");
     }
   });
@@ -10378,7 +10255,6 @@ function registerKeysRoutes(router, ctx) {
       logger.info("key.reset_spend", { userId: tokenEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
-      if (sendOwnershipError(error, res)) return;
       sendError(res, error, logger, "reset key spend");
     }
   });
@@ -10438,23 +10314,11 @@ function registerKeysRoutes(router, ctx) {
         res.status(400).json({ error: "start_date and end_date are required" });
         return;
       }
-      const tokenEntityRef = res.locals.tokenEntityRef;
-      const userId = res.locals.userId;
-      await getOrProvisionUser(
-        client,
-        tokenEntityRef,
-        userId,
-        provisioningEnabled,
-        provisioningDefaults,
-        roleConfigs,
-        catalogClient,
-        auth,
-        logger
-      );
+      await getProvisionedUser(ctx, res);
       const usage = await client.getUsage(
         start_date,
         end_date,
-        userId
+        res.locals.userId
       );
       res.json(usage);
     } catch (error) {
@@ -10676,6 +10540,10 @@ function registerOpencodeRoutes(router, ctx) {
 var import_backstage_plugin_litellm_common5 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/http/respondTeam.ts
+function respondTeam(res, team, ctx, caller) {
+  const shouldHide = caller === "member" ? ctx.teamBudgetVisibility.hideTeamBudgetForMembers : ctx.teamBudgetVisibility.hideTeamBudgetForManagers;
+  res.json(shouldHide ? redactTeamBudget(team) : team);
+}
 function respondTeamList(res, teams, ctx, caller) {
   const shouldHide = caller === "member" ? ctx.teamBudgetVisibility.hideTeamBudgetForMembers : ctx.teamBudgetVisibility.hideTeamBudgetForManagers;
   res.json(shouldHide ? teams.map(redactTeamBudget) : teams);
@@ -10716,7 +10584,6 @@ function registerTeamsRoutes(router, ctx) {
     provisioningDefaults,
     roleConfigs,
     teamAdminCfg,
-    teamBudgetVisibility,
     requireTeamMgmt,
     sendTeamError,
     authorizeTeamSubresource
@@ -10796,7 +10663,7 @@ function registerTeamsRoutes(router, ctx) {
       logger.info(`Team creation already in flight for ${key} \u2014 joining`);
       try {
         const result = await pending;
-        res.json(result);
+        respondTeam(res, result, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -10828,9 +10695,7 @@ function registerTeamsRoutes(router, ctx) {
     teamCreateInFlight.set(key, createPromise);
     try {
       const result = await createPromise;
-      res.json(
-        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(result) : result
-      );
+      respondTeam(res, result, ctx, "manager");
     } catch (err) {
       sendTeamError(err, res);
     } finally {
@@ -10873,9 +10738,7 @@ function registerTeamsRoutes(router, ctx) {
         teamId,
         owningGroup
       });
-      res.json(
-        teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(r) : r
-      );
+      respondTeam(res, r, ctx, "manager");
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -10937,9 +10800,7 @@ function registerTeamsRoutes(router, ctx) {
       const owned = all.filter(
         (t) => typeof t.metadata?.owning_group === "string" && t.metadata.owning_group === teamAdminCfg.group
       );
-      res.json(
-        teamBudgetVisibility.hideTeamBudgetForManagers ? owned.map(redactTeamBudget) : owned
-      );
+      respondTeamList(res, owned, ctx, "manager");
     } catch (err) {
       sendTeamError(err, res);
     }
@@ -11042,9 +10903,7 @@ function registerTeamsRoutes(router, ctx) {
           via
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11095,9 +10954,7 @@ function registerTeamsRoutes(router, ctx) {
           via
         });
         const updated = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11115,7 +10972,6 @@ function registerObjectPermissionsRoutes(router, ctx) {
     permissions,
     logger,
     teamAdminCfg,
-    teamBudgetVisibility,
     requireObjectPerms,
     sendTeamError,
     authorizeTeamSubresource
@@ -11196,9 +11052,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
           owningGroup,
           vector_stores: requested
         });
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11282,9 +11136,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
           before,
           after: requested
         });
-        res.json(
-          teamBudgetVisibility.hideTeamBudgetForManagers ? redactTeamBudget(updated) : updated
-        );
+        respondTeam(res, updated, ctx, "manager");
       } catch (err) {
         sendTeamError(err, res);
       }
@@ -11299,9 +11151,6 @@ function registerTeamUsageRoutes(router, ctx) {
     catalogClient,
     auth,
     logger,
-    provisioningEnabled,
-    provisioningDefaults,
-    roleConfigs,
     teamBudgetVisibility
   } = ctx;
   const requireUser = createRequireUser(ctx);
@@ -11314,18 +11163,7 @@ function registerTeamUsageRoutes(router, ctx) {
         return;
       }
       const tokenEntityRef = res.locals.tokenEntityRef;
-      const userId = res.locals.userId;
-      const userInfo = await getOrProvisionUser(
-        client,
-        tokenEntityRef,
-        userId,
-        provisioningEnabled,
-        provisioningDefaults,
-        roleConfigs,
-        catalogClient,
-        auth,
-        logger
-      );
+      const userInfo = await getProvisionedUser(ctx, res);
       const isMember = userInfo?.teams?.includes(teamId) ?? false;
       let isManager = false;
       const managerCheckNeeded = ctx.teamMgmtEnabled && (!isMember || teamBudgetVisibility.hideTeamBudgetForMembers !== teamBudgetVisibility.hideTeamBudgetForManagers);
@@ -12784,18 +12622,17 @@ function newDefaultVerifier(cfg) {
   return new KeycloakJWTVerifier({ issuer: cfg.issuer, clientId: cfg.clientId });
 }
 function normalizeIdentityOptions(opts) {
-  const o = typeof opts === "string" ? { userIdDomain: opts } : opts ?? {};
   let domains = [];
-  if (o.trustedEmailDomains?.length) {
-    domains = o.trustedEmailDomains;
-  } else if (o.userIdDomain) {
-    domains = [o.userIdDomain];
+  if (opts.trustedEmailDomains?.length) {
+    domains = opts.trustedEmailDomains;
+  } else if (opts.userIdDomain) {
+    domains = [opts.userIdDomain];
   }
   const trusted = domains.map((d) => d.toLowerCase());
-  return { userIdDomain: o.userIdDomain, trusted };
+  return { userIdDomain: opts.userIdDomain, trusted };
 }
 function resolveBridgeUserId(claims, identity) {
-  const { userIdDomain, trusted } = normalizeIdentityOptions(identity);
+  const { userIdDomain, trusted } = normalizeIdentityOptions(identity ?? {});
   if (trusted.length === 0) {
     throw new BridgeIdentityError(
       "set litellm.bridge.allowedEmailDomains (or litellm.userIdDomain) to use the CLI bridge"
@@ -12830,8 +12667,8 @@ function resolveBridgeUserId(claims, identity) {
   name = name || emailLocalPart;
   return toLiteLLMUserId(name, userIdDomain);
 }
-async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
-  const userId = resolveBridgeUserId(claims, userIdDomain);
+async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, identity) {
+  const userId = resolveBridgeUserId(claims, identity);
   const existing = await client.getUserInfo(userId);
   if (existing) return existing;
   if (claims.email) {
@@ -12872,38 +12709,17 @@ async function getOrProvisionUserFromClaims(client, claims, provisioningEnabled,
   }
   return created;
 }
-async function bridgeListKeys(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain) {
+async function bridgeListKeys(client, claims, provisioningEnabled, provisioningDefaults, logger, identity) {
   const user = await getOrProvisionUserFromClaims(
     client,
     claims,
     provisioningEnabled,
     provisioningDefaults,
     logger,
-    userIdDomain
+    identity
   );
   return client.listKeys(user.user_id);
 }
-async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioningDefaults, logger, request, userIdDomain) {
-  const user = await getOrProvisionUserFromClaims(
-    client,
-    claims,
-    provisioningEnabled,
-    provisioningDefaults,
-    logger,
-    userIdDomain
-  );
-  const enriched = {
-    ...request,
-    user_id: user.user_id,
-    metadata: {
-      ...request.metadata ?? {},
-      created_via: "abby-cli",
-      created_by: user.user_id,
-      created_at_iso: (/* @__PURE__ */ new Date()).toISOString()
-    }
-  };
-  return client.generateKey(enriched);
-}
 
 // src/routes/bridge.ts
 var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
@@ -12915,7 +12731,6 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
     userIdDomain,
     provisioningEnabled,
     provisioningDefaults,
-    roleConfigs,
     allowUnlimitedBudget,
     teamRequired,
     keyValidationConfig
@@ -13000,26 +12815,25 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
         if (!allowUnlimitedBudget && input.max_budget === void 0) {
           input.max_budget = provisioningDefaults.maxBudget;
         }
-        const userId = resolveBridgeUserId(claims, bridgeIdentity);
+        const userInfo = await getOrProvisionUserFromClaims(
+          client,
+          claims,
+          provisioningEnabled,
+          provisioningDefaults,
+          logger,
+          bridgeIdentity
+        );
         const keyCreateCtx = {
           client,
           config: {
             allowUnlimitedBudget,
             teamRequired
           },
-          // Bridge does not have Backstage catalogClient/auth
-          // so provisioning from JWT claims only (no Backstage profile enrichment)
-          catalogClient: void 0,
-          auth: void 0,
           logger,
-          keyValidationConfig,
-          provisioningEnabled,
-          provisioningDefaults,
-          roleConfigs,
-          userIdDomain
+          keyValidationConfig
         };
         const result = await createKeyForUser(
-          { userId },
+          { userInfo, createdVia: "abby-cli" },
           input,
           keyCreateCtx
         );
@@ -13040,20 +12854,21 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
           bridgeIdentity
         );
         const teamIds = user.teams ?? [];
-        const teamMetadata = [];
-        for (const teamId of teamIds) {
-          try {
-            const teamInfo = await client.getTeamInfo(teamId);
-            teamMetadata.push({
-              id: teamId,
-              name: teamInfo.team_alias || teamId
-              // Use alias as display name, fallback to ID
-            });
-          } catch (e) {
-            logger.debug(`Could not fetch team info for ${teamId}: ${e.message}`);
-            teamMetadata.push({ id: teamId });
-          }
-        }
+        const teamMetadata = await Promise.all(
+          teamIds.map(async (teamId) => {
+            try {
+              const teamInfo = await client.getTeamInfo(teamId);
+              return {
+                id: teamId,
+                name: teamInfo.team_alias || teamId
+                // Use alias as display name, fallback to ID
+              };
+            } catch (e) {
+              logger.debug(`Could not fetch team info for ${teamId}: ${e.message}`);
+              return { id: teamId };
+            }
+          })
+        );
         res.json({ user_id: user.user_id, teams: teamIds, team_metadata: teamMetadata });
       } catch (error) {
         handleBridgeError(error, res);
@@ -13172,31 +12987,17 @@ async function createRouter(options) {
     // Helper functions - defined inline below this object
     authorizeKeyAction: async (req, keyId) => {
       if (!req.res || !req.res.locals.tokenEntityRef || !req.res.locals.userId) {
-        throw new import_errors20.NotAllowedError("User identity not found in request");
+        throw new import_errors21.NotAllowedError("User identity not found in request");
       }
       const tokenEntityRef = req.res.locals.tokenEntityRef;
       const userId = req.res.locals.userId;
       const ownKeys = await client.listKeys(userId);
       const key = ownKeys.find((k) => (k.token ?? k.key) === keyId);
       if (!key) {
-        throw new import_errors20.NotAllowedError("Access denied: key does not belong to the caller");
+        throw new import_errors21.NotAllowedError("Access denied: key does not belong to the caller");
       }
       return { tokenEntityRef, userId, key };
     },
-    sendOwnershipError: (err, res) => {
-      if (err instanceof import_errors20.NotAllowedError) {
-        res.status(403).json({ error: err.message });
-        return true;
-      }
-      if (err && typeof err === "object" && "status" in err && "body" in err) {
-        const errObj = err;
-        if (typeof errObj.status === "number" && errObj.body) {
-          res.status(errObj.status).json(errObj.body);
-          return true;
-        }
-      }
-      return false;
-    },
     assertPermission: async (req, permission) => {
       const credentials = await resolveCredentials(req, auth);
       if (!credentials) return false;
@@ -13396,7 +13197,6 @@ var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plug
   ProvisioningError,
   applyRoleOverrides,
   assertTeamAdmin,
-  bridgeGenerateKey,
   bridgeListKeys,
   createRouter,
   getOrProvisionUser,
@@ -13417,7 +13217,6 @@ var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plug
   litellmTeamMcpManagePermission,
   litellmTeamMembersManagePermission,
   newDefaultVerifier,
-  normalizeRequestTags,
   provisionUser,
   readBridgeConfig,
   readProvisioningDefaults,