@acarmisc/backstage-plugin-litellm-backend 0.18.0 → 0.19.0

package/dist/index.d.ts

@@ -2,13 +2,13 @@ export { litellmPlugin } from './plugin';
 export { litellmPlugin as default } from './plugin';
 export { createRouter } from './router';
 export * from './types';
-export { LiteLLMClient, normalizeRequestTags } from './client';
+export { LiteLLMClient } from './client';
 export { resolveUserId, resolveUserProfile, toLiteLLMUserId, getOrProvisionUser, provisionUser, readProvisioningDefaults, readRoleConfigs, applyRoleOverrides, resolveUserRole, ProvisioningError, } from './provisioning';
 export type { BackstageUserProfile } from './provisioning';
 export { readTeamAdminConfig, isTeamManagementEnabled, assertTeamAdmin, validateTeamWriteInput, validateTeamPatchInput, } from './teamAdmin';
 export type { TeamAdminConfig, TeamAdminCheck, TeamWriteInput, TeamWriteValidation, TeamPatchValidation } from './teamAdmin';
 export { readTeamBudgetVisibility, redactTeamBudget, redactTeamUsage, teamBudgetStatusFor, } from './teamBudgetVisibility';
 export type { TeamBudgetVisibility, TeamBudgetStatus } from './teamBudgetVisibility';
-export { KeycloakJWTVerifier, newDefaultVerifier, readBridgeConfig, resolveBridgeUserId, getOrProvisionUserFromClaims, bridgeListKeys, bridgeGenerateKey, } from './bridge';
+export { KeycloakJWTVerifier, newDefaultVerifier, readBridgeConfig, resolveBridgeUserId, getOrProvisionUserFromClaims, bridgeListKeys, } from './bridge';
 export type { BridgeClaims, TokenVerifier, BridgeConfig, KeycloakJWTVerifierOptions, } from './bridge';
 export { litellmPermissions, litellmKeyCreatePermission, litellmKeyRevokePermission, litellmKeyManagePermission, litellmKeyResetSpendPermission, litellmKeyUnblockPermission, litellmAuditReadPermission, litellmTeamCreatePermission, litellmTeamManagePermission, litellmTeamMembersManagePermission, litellmTeamKnowledgebaseManagePermission, litellmTeamMcpManagePermission, litellmTeamDeletePermission, } from '@acarmisc/backstage-plugin-litellm-common';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyUnblockPermission = exports.litellmKeyResetSpendPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = exports.litellmPermissions = exports.bridgeGenerateKey = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.teamBudgetStatusFor = exports.redactTeamUsage = exports.redactTeamBudget = exports.readTeamBudgetVisibility = exports.validateTeamPatchInput = exports.validateTeamWriteInput = exports.assertTeamAdmin = exports.isTeamManagementEnabled = exports.readTeamAdminConfig = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.normalizeRequestTags = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
+exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyUnblockPermission = exports.litellmKeyResetSpendPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = exports.litellmPermissions = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.teamBudgetStatusFor = exports.redactTeamUsage = exports.redactTeamBudget = exports.readTeamBudgetVisibility = exports.validateTeamPatchInput = exports.validateTeamWriteInput = exports.assertTeamAdmin = exports.isTeamManagementEnabled = exports.readTeamAdminConfig = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
 var plugin_1 = require("./plugin");
 Object.defineProperty(exports, "litellmPlugin", { enumerable: true, get: function () { return plugin_1.litellmPlugin; } });
 var plugin_2 = require("./plugin");
@@ -24,7 +24,6 @@ Object.defineProperty(exports, "createRouter", { enumerable: true, get: function
 __exportStar(require("./types"), exports);
 var client_1 = require("./client");
 Object.defineProperty(exports, "LiteLLMClient", { enumerable: true, get: function () { return client_1.LiteLLMClient; } });
-Object.defineProperty(exports, "normalizeRequestTags", { enumerable: true, get: function () { return client_1.normalizeRequestTags; } });
 var provisioning_1 = require("./provisioning");
 Object.defineProperty(exports, "resolveUserId", { enumerable: true, get: function () { return provisioning_1.resolveUserId; } });
 Object.defineProperty(exports, "resolveUserProfile", { enumerable: true, get: function () { return provisioning_1.resolveUserProfile; } });
@@ -54,7 +53,6 @@ Object.defineProperty(exports, "readBridgeConfig", { enumerable: true, get: func
 Object.defineProperty(exports, "resolveBridgeUserId", { enumerable: true, get: function () { return bridge_1.resolveBridgeUserId; } });
 Object.defineProperty(exports, "getOrProvisionUserFromClaims", { enumerable: true, get: function () { return bridge_1.getOrProvisionUserFromClaims; } });
 Object.defineProperty(exports, "bridgeListKeys", { enumerable: true, get: function () { return bridge_1.bridgeListKeys; } });
-Object.defineProperty(exports, "bridgeGenerateKey", { enumerable: true, get: function () { return bridge_1.bridgeGenerateKey; } });
 var backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 Object.defineProperty(exports, "litellmPermissions", { enumerable: true, get: function () { return backstage_plugin_litellm_common_1.litellmPermissions; } });
 Object.defineProperty(exports, "litellmKeyCreatePermission", { enumerable: true, get: function () { return backstage_plugin_litellm_common_1.litellmKeyCreatePermission; } });

package/dist/provisioning.d.ts

@@ -49,11 +49,13 @@ export declare function readProvisioningDefaults(config: Config): {
  * Extracts the authenticated Backstage user identity from the request token.
  * Returns the userEntityRef (e.g. "user:default/john.doe") or undefined when
  * the request carries no user credential (service-to-service calls).
+ * Only accepts headers starting with 'Bearer ' (case-sensitive as Backstage sends it).
  */
 export declare function resolveUserId(req: Request, auth: AuthService): Promise<string | undefined>;
 /**
  * Like resolveUserId, but returns the raw BackstageCredentials object
  * (rather than just the entity ref) for passing into PermissionsService.authorize().
+ * Only accepts headers starting with 'Bearer ' (case-sensitive as Backstage sends it).
  */
 export declare function resolveCredentials(req: Request, auth: AuthService): Promise<BackstageCredentials | undefined>;
 /**

package/dist/provisioning.js

@@ -13,6 +13,7 @@ exports.getOrProvisionUser = getOrProvisionUser;
 exports.isUserMemberOfGroup = isUserMemberOfGroup;
 exports.resolveUserRole = resolveUserRole;
 const client_1 = require("./client");
+const errors_1 = require("./errors");
 /**
  * Converts a Backstage user entity ref to a LiteLLM user_id.
  *
@@ -107,11 +108,13 @@ function readProvisioningDefaults(config) {
  * Extracts the authenticated Backstage user identity from the request token.
  * Returns the userEntityRef (e.g. "user:default/john.doe") or undefined when
  * the request carries no user credential (service-to-service calls).
+ * Only accepts headers starting with 'Bearer ' (case-sensitive as Backstage sends it).
  */
 async function resolveUserId(req, auth) {
-    const rawToken = req.headers.authorization?.slice(7);
-    if (!rawToken)
+    const authHeader = req.headers.authorization ?? '';
+    if (!authHeader.startsWith('Bearer '))
         return undefined;
+    const rawToken = authHeader.slice(7);
     try {
         const credentials = await auth.authenticate(rawToken);
         const principal = credentials.principal;
@@ -120,18 +123,20 @@ async function resolveUserId(req, auth) {
         }
     }
     catch {
-        // invalid or service token — caller gets query-param fallback
+        // invalid or service token
     }
     return undefined;
 }
 /**
  * Like resolveUserId, but returns the raw BackstageCredentials object
  * (rather than just the entity ref) for passing into PermissionsService.authorize().
+ * Only accepts headers starting with 'Bearer ' (case-sensitive as Backstage sends it).
  */
 async function resolveCredentials(req, auth) {
-    const rawToken = req.headers.authorization?.slice(7);
-    if (!rawToken)
+    const authHeader = req.headers.authorization ?? '';
+    if (!authHeader.startsWith('Bearer '))
         return undefined;
+    const rawToken = authHeader.slice(7);
     try {
         return await auth.authenticate(rawToken);
     }
@@ -236,20 +241,6 @@ async function provisionUser(client, userId, defaults, profile, backstageEntity,
  * requests for a re-deleted user can still trigger fresh provisioning.
  */
 const provisioningInFlight = new Map();
-/**
- * Strips any echoed Authorization bearer token from upstream LiteLLM error
- * messages before they're shipped back to the browser. LiteLLM normally does
- * not echo the master key, but defense in depth: never let a `Bearer …`
- * substring travel out in a response body.
- */
-function sanitizeUpstreamMessage(message) {
-    if (!message)
-        return 'unknown error';
-    return message
-        .replace(/Bearer\s+[A-Za-z0-9._\-+/=]+/g, 'Bearer [redacted]')
-        .replace(/sk-[A-Za-z0-9_\-]{8,}/g, 'sk-[redacted]')
-        .slice(0, 500);
-}
 class ProvisioningError extends Error {
     constructor(message, hint, provisioning, status = 404) {
         super(message);
@@ -331,7 +322,7 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
                 ? upstreamStatus
                 : 502;
             const errMessage = err instanceof Error ? err.message : String(err);
-            throw new ProvisioningError('LiteLLM auto-provisioning failed', `LiteLLM upstream ${upstreamStatus ?? 'error'}: ${sanitizeUpstreamMessage(errMessage)}`, true, passThrough);
+            throw new ProvisioningError('LiteLLM auto-provisioning failed', `LiteLLM upstream ${upstreamStatus ?? 'error'}: ${(0, errors_1.sanitizeUpstreamMessage)(errMessage)}`, true, passThrough);
         }
     })();
     provisioningInFlight.set(userId, provisionPromise);

package/dist/router.js

@@ -148,22 +148,6 @@ async function createRouter(options) {
             }
             return { tokenEntityRef, userId, key };
         },
-        sendOwnershipError: (err, res) => {
-            // Handle NotAllowedError from authorizeKeyAction
-            if (err instanceof errors_1.NotAllowedError) {
-                res.status(403).json({ error: err.message });
-                return true;
-            }
-            // Fallback for legacy errors with status and body
-            if (err && typeof err === 'object' && 'status' in err && 'body' in err) {
-                const errObj = err;
-                if (typeof errObj.status === 'number' && errObj.body) {
-                    res.status(errObj.status).json(errObj.body);
-                    return true;
-                }
-            }
-            return false;
-        },
         assertPermission: async (req, permission) => {
             const credentials = await (0, provisioning_1.resolveCredentials)(req, auth);
             if (!credentials)

package/dist/routes/bridge.js

@@ -8,7 +8,7 @@ const keyService_1 = require("../services/keyService");
 const errors_1 = require("../errors");
 const backstage_plugin_litellm_common_2 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
-    const { client, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, allowUnlimitedBudget, teamRequired, keyValidationConfig, } = ctx;
+    const { client, logger, userIdDomain, provisioningEnabled, provisioningDefaults, allowUnlimitedBudget, teamRequired, keyValidationConfig, } = ctx;
     const { config } = bridgeOpts;
     const generateKeyInputSchema = (0, backstage_plugin_litellm_common_2.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
     // ---------------------------------------------------------------------------
@@ -99,8 +99,8 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
                 if (!allowUnlimitedBudget && input.max_budget === undefined) {
                     input.max_budget = provisioningDefaults.maxBudget;
                 }
-                // ── Resolve user identity from verified claims ───────────────────────
-                const userId = (0, bridge_1.resolveBridgeUserId)(claims, bridgeIdentity);
+                // ── Resolve and provision user from verified claims ──────────────────
+                const userInfo = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
                 // ── Create key via unified service ──────────────────────────────────
                 const keyCreateCtx = {
                     client,
@@ -108,18 +108,10 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
                         allowUnlimitedBudget,
                         teamRequired,
                     },
-                    // Bridge does not have Backstage catalogClient/auth
-                    // so provisioning from JWT claims only (no Backstage profile enrichment)
-                    catalogClient: undefined,
-                    auth: undefined,
                     logger,
                     keyValidationConfig,
-                    provisioningEnabled,
-                    provisioningDefaults,
-                    roleConfigs,
-                    userIdDomain,
                 };
-                const result = await (0, keyService_1.createKeyForUser)({ userId }, input, keyCreateCtx);
+                const result = await (0, keyService_1.createKeyForUser)({ userInfo, createdVia: 'abby-cli' }, input, keyCreateCtx);
                 res.json(result);
             }
             catch (error) {
@@ -132,23 +124,22 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
             try {
                 const claims = await requireClaims(req);
                 const user = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
-                // Enrich team list with metadata (display names, etc.)
+                // Enrich team list with metadata (display names, etc.) in parallel
                 const teamIds = user.teams ?? [];
-                const teamMetadata = [];
-                for (const teamId of teamIds) {
+                const teamMetadata = await Promise.all(teamIds.map(async (teamId) => {
                     try {
                         const teamInfo = await client.getTeamInfo(teamId);
-                        teamMetadata.push({
+                        return {
                             id: teamId,
                             name: teamInfo.team_alias || teamId, // Use alias as display name, fallback to ID
-                        });
+                        };
                     }
                     catch (e) {
                         // If we can't fetch team info, just use the ID
                         logger.debug(`Could not fetch team info for ${teamId}: ${e.message}`);
-                        teamMetadata.push({ id: teamId });
+                        return { id: teamId };
                     }
-                }
+                }));
                 res.json({ user_id: user.user_id, teams: teamIds, team_metadata: teamMetadata });
             }
             catch (error) {

package/dist/routes/context.d.ts

@@ -40,7 +40,6 @@ export interface RouterContext {
         userId: string;
         key: VirtualKey;
     }>;
-    sendOwnershipError(err: unknown, res: Response): boolean;
     assertPermission(req: Request, permission: BasicPermission): Promise<boolean>;
     sendPermissionDenied(res: Response, permission: BasicPermission): void;
     requireTeamMgmt(res: Response): boolean;

package/dist/routes/keys.js

@@ -13,7 +13,7 @@ const withUser_1 = require("./middleware/withUser");
  * location and access to shared state (via ctx) differ.
  */
 function registerKeysRoutes(router, ctx) {
-    const { client, catalogClient, auth, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, auditGroup, allowUnlimitedBudget, teamRequired, allowOwnerResetSpend, keyValidationConfig, authorizeKeyAction, sendOwnershipError, assertPermission, sendPermissionDenied, } = ctx;
+    const { client, catalogClient, auth, logger, auditGroup, allowUnlimitedBudget, teamRequired, allowOwnerResetSpend, keyValidationConfig, authorizeKeyAction, assertPermission, sendPermissionDenied, } = ctx;
     const generateKeyInputSchema = (0, backstage_plugin_litellm_common_1.createGenerateKeyInputSchema)(keyValidationConfig);
     const updateKeyInputSchema = (0, backstage_plugin_litellm_common_1.createUpdateKeyInputSchema)(keyValidationConfig);
     router.get('/user/info', async (_req, res) => {
@@ -132,7 +132,8 @@ function registerKeysRoutes(router, ctx) {
                 return;
             }
             const tokenEntityRef = res.locals.tokenEntityRef;
-            const resolvedUserId = res.locals.userId;
+            // ── Resolve and provision user ──────────────────────────────────────
+            const userInfo = await (0, withUser_1.getProvisionedUser)(ctx, res);
             // ── Create key via unified service ──────────────────────────────────
             const keyCreateCtx = {
                 client,
@@ -144,12 +145,8 @@ function registerKeysRoutes(router, ctx) {
                 auth,
                 logger,
                 keyValidationConfig,
-                provisioningEnabled,
-                provisioningDefaults,
-                roleConfigs,
-                userIdDomain,
             };
-            const result = await (0, keyService_1.createKeyForUser)({ tokenEntityRef, userId: resolvedUserId }, input, keyCreateCtx);
+            const result = await (0, keyService_1.createKeyForUser)({ tokenEntityRef, userInfo }, input, keyCreateCtx);
             res.json(result);
         }
         catch (error) {
@@ -277,8 +274,6 @@ function registerKeysRoutes(router, ctx) {
             res.json(result);
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'update key');
         }
     });
@@ -299,8 +294,6 @@ function registerKeysRoutes(router, ctx) {
             res.json({ success: true });
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'delete key');
         }
     });
@@ -334,8 +327,6 @@ function registerKeysRoutes(router, ctx) {
             res.json({ success: true });
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'block key');
         }
     });
@@ -371,8 +362,6 @@ function registerKeysRoutes(router, ctx) {
             res.json({ success: true });
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'unblock key');
         }
     });
@@ -397,8 +386,6 @@ function registerKeysRoutes(router, ctx) {
             res.json({ success: true });
         }
         catch (error) {
-            if (sendOwnershipError(error, res))
-                return;
             (0, errors_1.sendError)(res, error, logger, 'reset key spend');
         }
     });
@@ -454,10 +441,10 @@ function registerKeysRoutes(router, ctx) {
                 res.status(400).json({ error: 'start_date and end_date are required' });
                 return;
             }
-            const tokenEntityRef = res.locals.tokenEntityRef;
-            const userId = res.locals.userId;
-            await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
-            const usage = await client.getUsage(start_date, end_date, userId);
+            await (0, withUser_1.getProvisionedUser)(ctx, res);
+            // Always filter by the caller's id: an empty user_id makes LiteLLM
+            // return org-wide activity.
+            const usage = await client.getUsage(start_date, end_date, res.locals.userId);
             res.json(usage);
         }
         catch (error) {

package/dist/routes/middleware/withUser.d.ts

@@ -1,4 +1,5 @@
 import { Request, Response, NextFunction } from 'express';
+import { UserInfo } from '../../types';
 import type { RouterContext } from '../context';
 /**
  * Express middleware that resolves a Backstage user principal to a LiteLLM user ID.
@@ -12,7 +13,7 @@ export declare function createRequireUser(ctx: RouterContext): (req: Request, re
  * Returns the user info or throws ProvisioningError (which the caller must handle and respond to).
  *
  * This deduplicates the repeated pattern:
- *   const userInfo = await getOrProvisionUser(...);
+ *   const userInfo = await getProvisionedUser(...);
  *   if (error instanceof ProvisioningError) { res.status(...).json(...); return; }
  */
-export declare function getProvisionedUser(ctx: RouterContext, res: Response): Promise<any>;
+export declare function getProvisionedUser(ctx: RouterContext, res: Response): Promise<UserInfo>;

package/dist/routes/middleware/withUser.js

@@ -31,7 +31,7 @@ function createRequireUser(ctx) {
  * Returns the user info or throws ProvisioningError (which the caller must handle and respond to).
  *
  * This deduplicates the repeated pattern:
- *   const userInfo = await getOrProvisionUser(...);
+ *   const userInfo = await getProvisionedUser(...);
  *   if (error instanceof ProvisioningError) { res.status(...).json(...); return; }
  */
 async function getProvisionedUser(ctx, res) {

package/dist/routes/objectPermissions.js

@@ -3,9 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerObjectPermissionsRoutes = registerObjectPermissionsRoutes;
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const teamAdmin_1 = require("../teamAdmin");
-const teamBudgetVisibility_1 = require("../teamBudgetVisibility");
+const respondTeam_1 = require("../http/respondTeam");
 function registerObjectPermissionsRoutes(router, ctx) {
-    const { client, catalogClient, auth, permissions, logger, teamAdminCfg, teamBudgetVisibility, requireObjectPerms, sendTeamError, authorizeTeamSubresource, } = ctx;
+    const { client, catalogClient, auth, permissions, logger, teamAdminCfg, requireObjectPerms, sendTeamError, authorizeTeamSubresource, } = ctx;
     // ── Knowledge-base (vector store) management ────────────────────────────
     //
     // Attaching a vector store to a team exposes its documents to every team
@@ -91,9 +91,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
                 owningGroup,
                 vector_stores: requested,
             });
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -185,9 +183,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
                 before,
                 after: requested,
             });
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);

package/dist/routes/teamUsage.js

@@ -7,7 +7,7 @@ const errors_1 = require("../errors");
 const teamFetch_1 = require("../http/teamFetch");
 const withUser_1 = require("./middleware/withUser");
 function registerTeamUsageRoutes(router, ctx) {
-    const { client, catalogClient, auth, logger, provisioningEnabled, provisioningDefaults, roleConfigs, teamBudgetVisibility, } = ctx;
+    const { client, catalogClient, auth, logger, teamBudgetVisibility, } = ctx;
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
     router.get('/teams/:teamId/usage', requireUser, async (req, res) => {
         try {
@@ -19,8 +19,7 @@ function registerTeamUsageRoutes(router, ctx) {
             }
             // Authorize: member of the team OR a team manager
             const tokenEntityRef = res.locals.tokenEntityRef;
-            const userId = res.locals.userId;
-            const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            const userInfo = await (0, withUser_1.getProvisionedUser)(ctx, res);
             // Check membership: user must be in the team OR be a team manager
             const isMember = userInfo?.teams?.includes(teamId) ?? false;
             // A "manager" administers this specific team: team management is enabled

package/dist/routes/teams.js

@@ -4,13 +4,12 @@ exports.registerTeamsRoutes = registerTeamsRoutes;
 const provisioning_1 = require("../provisioning");
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const teamAdmin_1 = require("../teamAdmin");
-const teamBudgetVisibility_1 = require("../teamBudgetVisibility");
 const errors_1 = require("../errors");
 const withUser_1 = require("./middleware/withUser");
 const respondTeam_1 = require("../http/respondTeam");
 const teamFetch_1 = require("../http/teamFetch");
 function registerTeamsRoutes(router, ctx) {
-    const { client, catalogClient, auth, permissions, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, teamAdminCfg, teamBudgetVisibility, requireTeamMgmt, sendTeamError, authorizeTeamSubresource, } = ctx;
+    const { client, catalogClient, auth, permissions, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, teamAdminCfg, requireTeamMgmt, sendTeamError, authorizeTeamSubresource, } = ctx;
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
     router.get('/teams', requireUser, async (_req, res) => {
         try {
@@ -83,7 +82,7 @@ function registerTeamsRoutes(router, ctx) {
             logger.info(`Team creation already in flight for ${key} — joining`);
             try {
                 const result = await pending;
-                res.json(result);
+                (0, respondTeam_1.respondTeam)(res, result, ctx, 'manager');
             }
             catch (err) {
                 sendTeamError(err, res);
@@ -116,10 +115,7 @@ function registerTeamsRoutes(router, ctx) {
         teamFetch_1.teamCreateInFlight.set(key, createPromise);
         try {
             const result = await createPromise;
-            // Manager surface: redact dollars when hidden even from managers.
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(result)
-                : result);
+            (0, respondTeam_1.respondTeam)(res, result, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -166,9 +162,7 @@ function registerTeamsRoutes(router, ctx) {
                 teamId,
                 owningGroup,
             });
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(r)
-                : r);
+            (0, respondTeam_1.respondTeam)(res, r, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -240,10 +234,7 @@ function registerTeamsRoutes(router, ctx) {
             // the caller's group set and filter with includes().
             const owned = all.filter(t => typeof t.metadata?.owning_group === 'string' &&
                 t.metadata.owning_group === teamAdminCfg.group);
-            // Manager surface: strip dollar amounts when hidden even from managers.
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? owned.map(teamBudgetVisibility_1.redactTeamBudget)
-                : owned);
+            (0, respondTeam_1.respondTeamList)(res, owned, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -343,9 +334,7 @@ function registerTeamsRoutes(router, ctx) {
                 via,
             });
             const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -395,9 +384,7 @@ function registerTeamsRoutes(router, ctx) {
                 via,
             });
             const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);

package/dist/services/keyService.d.ts

@@ -1,20 +1,23 @@
 /**
- * Key generation service — unified by PR-6.
+ * Key generation service.
  *
  * Extracts the common logic for creating API keys from both the UI (POST /keys/generate)
- * and the bridge (POST /bridge/keys). Handles validation, provisioning, team/model checks,
- * and explicit upstream request construction.
+ * and the bridge (POST /bridge/keys). Handles validation, team/model checks,
+ * and explicit upstream request construction. Callers resolve the user beforehand.
  */
 import { AuthService, LoggerService } from '@backstage/backend-plugin-api';
 import { CatalogClient } from '@backstage/catalog-client';
 import { LiteLLMClient } from '../client';
-import { GenerateKeyResponse, ProvisioningDefaults, RoleConfig } from '../types';
+import { GenerateKeyResponse, UserInfo } from '../types';
 import { type KeyValidationConfig, type GenerateKeyInput } from '@acarmisc/backstage-plugin-litellm-common';
+/** User identity for key creation — already resolved by the caller. */
 export interface KeyCreateUser {
     /** Backstage user entity ref, e.g. "user:default/alice" (may be empty for bridge). */
     tokenEntityRef?: string;
-    /** Resolved LiteLLM user_id. Required. */
-    userId: string;
+    /** Resolved user info from LiteLLM. Required. */
+    userInfo: UserInfo;
+    /** How the key was created (for metadata stamping). Defaults to 'backstage'. */
+    createdVia?: string;
 }
 /** Context needed to create a key — configuration, clients, and services. */
 export interface KeyCreateContext {
@@ -27,10 +30,6 @@ export interface KeyCreateContext {
     auth?: AuthService;
     logger: LoggerService;
     keyValidationConfig: KeyValidationConfig;
-    provisioningEnabled: boolean;
-    provisioningDefaults: ProvisioningDefaults;
-    roleConfigs: RoleConfig[];
-    userIdDomain?: string;
 }
 /** Error thrown during key creation — maps to HTTP responses. */
 export declare class KeyServiceError extends Error {
@@ -44,18 +43,16 @@ export declare class KeyServiceError extends Error {
  * Performs:
  * - Schema validation of the input
  * - Config flag enforcement (allowUnlimitedBudget, teamRequired)
- * - User provisioning (single-flight, role configs)
  * - Team membership validation
  * - Model subset validation
  * - Metadata stamping
  * - Explicit upstream request construction and call
  *
- * @param user Verified identity: tokenEntityRef (optional) + userId (required)
+ * @param user Resolved identity: tokenEntityRef (optional) + userInfo (required, pre-provisioned)
  * @param input Parsed GenerateKeyInput from the schema
  * @param ctx Configuration and service clients
  * @returns The new key response from LiteLLM
  * @throws KeyServiceError with status and body for HTTP response
- * @throws ProvisioningError for provisioning failures
  * @throws LiteLLMUpstreamError for upstream LiteLLM errors
  */
 export declare function createKeyForUser(user: KeyCreateUser, input: GenerateKeyInput, ctx: KeyCreateContext): Promise<GenerateKeyResponse>;