@acarmisc/backstage-plugin-litellm-backend 0.18.0 → 0.19.0

package/dist/services/keyService.js

@@ -1,16 +1,15 @@
 "use strict";
 /**
- * Key generation service — unified by PR-6.
+ * Key generation service.
  *
  * Extracts the common logic for creating API keys from both the UI (POST /keys/generate)
- * and the bridge (POST /bridge/keys). Handles validation, provisioning, team/model checks,
- * and explicit upstream request construction.
+ * and the bridge (POST /bridge/keys). Handles validation, team/model checks,
+ * and explicit upstream request construction. Callers resolve the user beforehand.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyServiceError = void 0;
 exports.createKeyForUser = createKeyForUser;
 const provisioning_1 = require("../provisioning");
-/** Unified identity for key creation — resolved from either Backstage or JWT claims. */
 const modelAccess_1 = require("./modelAccess");
 /** Error thrown during key creation — maps to HTTP responses. */
 class KeyServiceError extends Error {
@@ -27,57 +26,21 @@ exports.KeyServiceError = KeyServiceError;
  * Performs:
  * - Schema validation of the input
  * - Config flag enforcement (allowUnlimitedBudget, teamRequired)
- * - User provisioning (single-flight, role configs)
  * - Team membership validation
  * - Model subset validation
  * - Metadata stamping
  * - Explicit upstream request construction and call
  *
- * @param user Verified identity: tokenEntityRef (optional) + userId (required)
+ * @param user Resolved identity: tokenEntityRef (optional) + userInfo (required, pre-provisioned)
  * @param input Parsed GenerateKeyInput from the schema
  * @param ctx Configuration and service clients
  * @returns The new key response from LiteLLM
  * @throws KeyServiceError with status and body for HTTP response
- * @throws ProvisioningError for provisioning failures
  * @throws LiteLLMUpstreamError for upstream LiteLLM errors
  */
 async function createKeyForUser(user, input, ctx) {
-    const { client, config, catalogClient, auth, logger, provisioningEnabled, provisioningDefaults, roleConfigs, } = ctx;
-    // ── Ensure user is provisioned ──────────────────────────────────────
-    // For bridge (no catalogClient/auth), use direct provisioning from JWT;
-    // for UI (with catalogClient/auth), use full provisioning with group roles.
-    let userInfo;
-    if (catalogClient !== undefined && catalogClient !== null && auth !== undefined && auth !== null) {
-        userInfo = await (0, provisioning_1.getOrProvisionUser)(client, user.tokenEntityRef || '', user.userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
-    }
-    else {
-        // Bridge path: just check if user exists, or provision with minimal info
-        userInfo = await client.getUserInfo(user.userId);
-        if (!userInfo) {
-            if (!provisioningEnabled) {
-                throw new KeyServiceError(404, {
-                    error: 'User not found in LiteLLM',
-                    detail: 'No LiteLLM user for this identity. Log in to Backstage once to be provisioned, or enable litellm.provisioning.enabled.',
-                });
-            }
-            // Provision with minimal info (just user_id, will use defaults)
-            const created = await client.createUser({
-                user_id: user.userId,
-                user_email: user.userId,
-                max_budget: provisioningDefaults.maxBudget,
-                budget_duration: provisioningDefaults.budgetDuration,
-                models: provisioningDefaults.models,
-                teams: provisioningDefaults.teams?.length ? [provisioningDefaults.teams[0]] : [],
-            });
-            if (!created) {
-                throw new KeyServiceError(500, {
-                    error: 'User provisioning failed',
-                    detail: 'Failed to create user in LiteLLM',
-                });
-            }
-            userInfo = await client.getUserInfo(user.userId);
-        }
-    }
+    const { client, config, catalogClient, auth, logger, } = ctx;
+    const userInfo = user.userInfo;
     // ── Enforce config flags ────────────────────────────────────────────
     if (!config.allowUnlimitedBudget && (input.max_budget === null || input.max_budget === undefined)) {
         throw new KeyServiceError(400, { error: 'max_budget is required when unlimited budgets are not allowed' });
@@ -127,13 +90,15 @@ async function createKeyForUser(user, input, ctx) {
         ? await (0, provisioning_1.resolveUserProfile)(user.tokenEntityRef, catalogClient, auth, logger)
         : {};
     const clientMetadata = input.metadata ?? {};
+    const createdVia = user.createdVia ?? 'backstage';
     const serverMetadata = {
-        created_by_backstage_user: user.tokenEntityRef ?? 'unknown',
+        ...(user.tokenEntityRef && { created_by_backstage_user: user.tokenEntityRef }),
+        ...(!user.tokenEntityRef && { created_by: userInfo.user_id }),
         ...(profile.email && { created_by_email: profile.email }),
         ...(profile.displayName && {
             created_by_display_name: profile.displayName,
         }),
-        created_via: 'backstage',
+        created_via: createdVia,
         created_at_iso: new Date().toISOString(),
     };
     // Server-owned keys override client values
@@ -145,7 +110,7 @@ async function createKeyForUser(user, input, ctx) {
     // Never spread the raw body; only include fields we've explicitly validated.
     const upstreamRequest = {
         alias: input.alias,
-        user_id: user.userId,
+        user_id: userInfo.user_id,
     };
     if (input.models !== undefined) {
         upstreamRequest.models = input.models;
@@ -174,6 +139,6 @@ async function createKeyForUser(user, input, ctx) {
     upstreamRequest.metadata = enrichedMetadata;
     // ── Call upstream LiteLLM ───────────────────────────────────────────
     const result = await client.generateKey(upstreamRequest);
-    logger.info('key.generate', { userId: user.userId, keyAlias: input.alias });
+    logger.info('key.generate', { userId: userInfo.user_id, keyAlias: input.alias });
     return result;
 }

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n/** One row from LiteLLM's `/spend/logs` (per-request spend log entry). */\nexport interface SpendLogEntry {\n  request_id?: string;\n  /** ISO timestamp of the call. */\n  startTime?: string;\n  endTime?: string;\n  spend?: number;\n  total_tokens?: number;\n  prompt_tokens?: number;\n  completion_tokens?: number;\n  model?: string;\n  /** Virtual key alias or hash the request was billed to. */\n  api_key?: string;\n  user?: string;\n  team_id?: string;\n  /**\n   * Tags attached to the request (e.g. `channel:backstage`,\n   * `session:<thread>`, `invoked-by:<user>`). Shape varies across LiteLLM\n   * versions (array or object) and is normalised to a string[].\n   */\n  request_tags?: string[] | Record<string, string>;\n  /** LiteLLM `metadata` blob; carries trace ids and session grouping. */\n  metadata?: Record<string, unknown> | string | null;\n}\n\nexport interface SpendLogsParams {\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  start_date: string;\n  /** ISO date `YYYY-MM-DD` (inclusive). */\n  end_date: string;\n  /** Restrict to the given virtual key. */\n  api_key?: string;\n  user_id?: string;\n  team_id?: string;\n  /** Max rows to return (LiteLLM caps at 1000 per page). */\n  page_size?: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -96,42 +96,6 @@ export interface CreateUserResponse {
     models?: string[];
     teams?: string[];
 }
-/** One row from LiteLLM's `/spend/logs` (per-request spend log entry). */
-export interface SpendLogEntry {
-    request_id?: string;
-    /** ISO timestamp of the call. */
-    startTime?: string;
-    endTime?: string;
-    spend?: number;
-    total_tokens?: number;
-    prompt_tokens?: number;
-    completion_tokens?: number;
-    model?: string;
-    /** Virtual key alias or hash the request was billed to. */
-    api_key?: string;
-    user?: string;
-    team_id?: string;
-    /**
-     * Tags attached to the request (e.g. `channel:backstage`,
-     * `session:<thread>`, `invoked-by:<user>`). Shape varies across LiteLLM
-     * versions (array or object) and is normalised to a string[].
-     */
-    request_tags?: string[] | Record<string, string>;
-    /** LiteLLM `metadata` blob; carries trace ids and session grouping. */
-    metadata?: Record<string, unknown> | string | null;
-}
-export interface SpendLogsParams {
-    /** ISO date `YYYY-MM-DD` (inclusive). */
-    start_date: string;
-    /** ISO date `YYYY-MM-DD` (inclusive). */
-    end_date: string;
-    /** Restrict to the given virtual key. */
-    api_key?: string;
-    user_id?: string;
-    team_id?: string;
-    /** Max rows to return (LiteLLM caps at 1000 per page). */
-    page_size?: number;
-}
 export interface AuditLogsParams {
     page?: number;
     page_size?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -32,21 +32,17 @@
     "lint": "eslint src --ext .ts",
     "test": "tsc -p tsconfig.test.json && node --test \"dist-test/**/*.test.js\"",
     "api-report": "npm run build && api-extractor run --local --verbose",
-    "prepack": "npm run build",
-    "postpack": ""
+    "prepack": "npm run build"
   },
   "dependencies": {
     "@acarmisc/backstage-plugin-litellm-common": "0.1.0",
     "@backstage/backend-plugin-api": "^1.9.1",
     "@backstage/catalog-client": "^1.9.0",
-    "@backstage/catalog-model": "^1.7.0",
     "@backstage/config": "^1.3.0",
     "@backstage/errors": "^1.3.0",
     "@backstage/plugin-permission-common": "^0.9.10",
-    "@backstage/types": "^1.2.0",
     "express": "^4.18.2",
-    "jose": "^5.9.6",
-    "zod": "^3.22.0"
+    "jose": "^5.9.6"
   },
   "devDependencies": {
     "@backstage/cli": "^0.36.2",