@acarmisc/backstage-plugin-litellm-backend 0.18.0 → 0.20.0

package/dist/routes/middleware/withUser.d.ts

@@ -1,4 +1,5 @@
 import { Request, Response, NextFunction } from 'express';
+import { UserInfo } from '../../types';
 import type { RouterContext } from '../context';
 /**
  * Express middleware that resolves a Backstage user principal to a LiteLLM user ID.
@@ -10,9 +11,10 @@ export declare function createRequireUser(ctx: RouterContext): (req: Request, re
 /**
  * Helper to fetch and provision a user from res.locals (populated by requireUser middleware).
  * Returns the user info or throws ProvisioningError (which the caller must handle and respond to).
+ * Updates `res.locals.userId` to the resolved LiteLLM user id.
  *
  * This deduplicates the repeated pattern:
- *   const userInfo = await getOrProvisionUser(...);
+ *   const userInfo = await getProvisionedUser(...);
  *   if (error instanceof ProvisioningError) { res.status(...).json(...); return; }
  */
-export declare function getProvisionedUser(ctx: RouterContext, res: Response): Promise<any>;
+export declare function getProvisionedUser(ctx: RouterContext, res: Response): Promise<UserInfo>;

package/dist/routes/middleware/withUser.js

@@ -29,13 +29,17 @@ function createRequireUser(ctx) {
 /**
  * Helper to fetch and provision a user from res.locals (populated by requireUser middleware).
  * Returns the user info or throws ProvisioningError (which the caller must handle and respond to).
+ * Updates `res.locals.userId` to the resolved LiteLLM user id.
  *
  * This deduplicates the repeated pattern:
- *   const userInfo = await getOrProvisionUser(...);
+ *   const userInfo = await getProvisionedUser(...);
  *   if (error instanceof ProvisioningError) { res.status(...).json(...); return; }
  */
 async function getProvisionedUser(ctx, res) {
     const tokenEntityRef = res.locals.tokenEntityRef;
     const userId = res.locals.userId;
-    return (0, provisioning_1.getOrProvisionUser)(ctx.client, tokenEntityRef, userId, ctx.provisioningEnabled, ctx.provisioningDefaults, ctx.roleConfigs, ctx.catalogClient, ctx.auth, ctx.logger);
+    const userInfo = await (0, provisioning_1.getOrProvisionUser)(ctx.client, tokenEntityRef, userId, ctx.provisioningEnabled, ctx.provisioningDefaults, ctx.roleConfigs, ctx.catalogClient, ctx.auth, ctx.logger);
+    // The LiteLLM user may have been found by email under a different id.
+    res.locals.userId = (0, provisioning_1.effectiveUserId)(userId);
+    return userInfo;
 }

package/dist/routes/objectPermissions.js

@@ -3,9 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerObjectPermissionsRoutes = registerObjectPermissionsRoutes;
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const teamAdmin_1 = require("../teamAdmin");
-const teamBudgetVisibility_1 = require("../teamBudgetVisibility");
+const respondTeam_1 = require("../http/respondTeam");
 function registerObjectPermissionsRoutes(router, ctx) {
-    const { client, catalogClient, auth, permissions, logger, teamAdminCfg, teamBudgetVisibility, requireObjectPerms, sendTeamError, authorizeTeamSubresource, } = ctx;
+    const { client, catalogClient, auth, permissions, logger, teamAdminCfg, requireObjectPerms, sendTeamError, authorizeTeamSubresource, } = ctx;
     // ── Knowledge-base (vector store) management ────────────────────────────
     //
     // Attaching a vector store to a team exposes its documents to every team
@@ -91,9 +91,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
                 owningGroup,
                 vector_stores: requested,
             });
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -185,9 +183,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
                 before,
                 after: requested,
             });
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);

package/dist/routes/opencode.js

@@ -66,8 +66,8 @@ function registerOpencodeRoutes(router, ctx) {
                 sendPermissionDenied(res, backstage_plugin_litellm_common_1.litellmKeyCreatePermission);
                 return null;
             }
-            const userId = (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain);
-            const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            const computedUserId = (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain);
+            const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, computedUserId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
             // Optional team binding: must be one of the user's own teams.
             const teamId = (req.query.team || req.body.team);
             if (teamId) {
@@ -84,7 +84,7 @@ function registerOpencodeRoutes(router, ctx) {
                 res.status(400).json({ error: 'A team is required for this connection' });
                 return null;
             }
-            return { tokenEntityRef, userId, userInfo, teamId, redirectUri };
+            return { tokenEntityRef, userId: (0, provisioning_1.effectiveUserId)(computedUserId), userInfo, teamId, redirectUri };
         };
         router.get('/opencode/connect', async (req, res) => {
             try {

package/dist/routes/teamUsage.js

@@ -1,13 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerTeamUsageRoutes = registerTeamUsageRoutes;
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+const client_1 = require("../client");
 const provisioning_1 = require("../provisioning");
 const teamBudgetVisibility_1 = require("../teamBudgetVisibility");
+const teamMemberUsage_1 = require("../teamMemberUsage");
 const errors_1 = require("../errors");
 const teamFetch_1 = require("../http/teamFetch");
 const withUser_1 = require("./middleware/withUser");
 function registerTeamUsageRoutes(router, ctx) {
-    const { client, catalogClient, auth, logger, provisioningEnabled, provisioningDefaults, roleConfigs, teamBudgetVisibility, } = ctx;
+    const { client, catalogClient, auth, logger, teamBudgetVisibility, } = ctx;
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
     router.get('/teams/:teamId/usage', requireUser, async (req, res) => {
         try {
@@ -19,8 +22,7 @@ function registerTeamUsageRoutes(router, ctx) {
             }
             // Authorize: member of the team OR a team manager
             const tokenEntityRef = res.locals.tokenEntityRef;
-            const userId = res.locals.userId;
-            const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            const userInfo = await (0, withUser_1.getProvisionedUser)(ctx, res);
             // Check membership: user must be in the team OR be a team manager
             const isMember = userInfo?.teams?.includes(teamId) ?? false;
             // A "manager" administers this specific team: team management is enabled
@@ -70,4 +72,110 @@ function registerTeamUsageRoutes(router, ctx) {
             (0, errors_1.sendError)(res, error, logger, 'fetch team usage');
         }
     });
+    // Per-member breakdown of a team's usage. Opt-in (404 when disabled) and
+    // fail-closed: the caller must be a manager of the team (owning_group), or
+    // a member who holds one of memberBreakdown.viewerRoles in the team or is
+    // granted litellm.team.usage.read.
+    router.get('/teams/:teamId/usage/members', requireUser, async (req, res) => {
+        const cfg = ctx.memberBreakdownCfg;
+        if (!cfg.enabled) {
+            res.status(404).json({ error: 'Not found' });
+            return;
+        }
+        try {
+            const { teamId } = req.params;
+            const { start_date, end_date } = req.query;
+            if (!start_date || !end_date) {
+                res.status(400).json({ error: 'start_date and end_date are required' });
+                return;
+            }
+            const tokenEntityRef = res.locals.tokenEntityRef;
+            const userInfo = await (0, withUser_1.getProvisionedUser)(ctx, res);
+            const callerId = res.locals.userId;
+            const isMember = userInfo?.teams?.includes(teamId) ?? false;
+            let team;
+            try {
+                team = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
+            }
+            catch (err) {
+                if (err instanceof client_1.LiteLLMUpstreamError && err.status === 404) {
+                    res.status(404).json({ error: 'Team not found' });
+                    return;
+                }
+                throw err;
+            }
+            const owningGroup = typeof team.metadata?.owning_group === 'string' ? team.metadata.owning_group : undefined;
+            const isManager = ctx.teamMgmtEnabled &&
+                !!owningGroup &&
+                (await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, owningGroup, catalogClient, auth, logger));
+            if (!isMember && !isManager) {
+                res.status(404).json({ error: 'Team not found' });
+                return;
+            }
+            const role = team.members_with_roles?.find(m => m.user_id === callerId)?.role;
+            const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
+            const allowed = isManager ||
+                viaRole ||
+                (isMember &&
+                    cfg.permissionEnabled &&
+                    (await ctx.assertPermission(req, backstage_plugin_litellm_common_1.litellmTeamUsageReadPermission)));
+            if (!allowed) {
+                res.status(403).json({
+                    error: 'Access denied: viewing per-member usage needs a team role or permission',
+                });
+                return;
+            }
+            const [usage, keys] = await Promise.all([
+                client.getTeamUsage(teamId, start_date, end_date),
+                client.listTeamKeys(teamId),
+            ]);
+            const profiles = await lookupProfiles((0, teamMemberUsage_1.memberEmails)(team, keys));
+            const breakdown = (0, teamMemberUsage_1.buildTeamMemberUsage)(teamId, usage, keys, team, profiles);
+            let via = 'permission';
+            if (isManager)
+                via = 'manager';
+            else if (viaRole)
+                via = 'teamRole';
+            logger.info('team.usage.members.read', { actor: tokenEntityRef, teamId, via });
+            const hide = isManager
+                ? teamBudgetVisibility.hideTeamBudgetForManagers
+                : teamBudgetVisibility.hideTeamBudgetForMembers;
+            res.json(hide ? (0, teamMemberUsage_1.redactTeamMemberUsage)(breakdown) : breakdown);
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            (0, errors_1.sendError)(res, error, logger, 'fetch team member usage');
+        }
+    });
+    // Display names from catalog User entities with these emails. Best effort:
+    // a catalog failure only drops the names.
+    async function lookupProfiles(emails) {
+        const profiles = new Map();
+        if (!emails.length)
+            return profiles;
+        try {
+            const { token } = await auth.getPluginRequestToken({
+                onBehalfOf: await auth.getOwnServiceCredentials(),
+                targetPluginId: 'catalog',
+            });
+            const { items } = await catalogClient.getEntities({
+                filter: { kind: 'User', 'spec.profile.email': emails },
+                fields: ['spec.profile'],
+            }, { token });
+            for (const entity of items) {
+                const profile = entity.spec?.profile ?? {};
+                if (typeof profile.email === 'string') {
+                    profiles.set(profile.email.toLowerCase(), { displayName: profile.displayName });
+                }
+            }
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            logger.warn(`Catalog lookup for team member names failed: ${message}`);
+        }
+        return profiles;
+    }
 }

package/dist/routes/teams.js

@@ -4,13 +4,12 @@ exports.registerTeamsRoutes = registerTeamsRoutes;
 const provisioning_1 = require("../provisioning");
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const teamAdmin_1 = require("../teamAdmin");
-const teamBudgetVisibility_1 = require("../teamBudgetVisibility");
 const errors_1 = require("../errors");
 const withUser_1 = require("./middleware/withUser");
 const respondTeam_1 = require("../http/respondTeam");
 const teamFetch_1 = require("../http/teamFetch");
 function registerTeamsRoutes(router, ctx) {
-    const { client, catalogClient, auth, permissions, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, teamAdminCfg, teamBudgetVisibility, requireTeamMgmt, sendTeamError, authorizeTeamSubresource, } = ctx;
+    const { client, catalogClient, auth, permissions, logger, userIdDomain, provisioningEnabled, provisioningDefaults, roleConfigs, teamAdminCfg, requireTeamMgmt, sendTeamError, authorizeTeamSubresource, } = ctx;
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
     router.get('/teams', requireUser, async (_req, res) => {
         try {
@@ -83,7 +82,7 @@ function registerTeamsRoutes(router, ctx) {
             logger.info(`Team creation already in flight for ${key} — joining`);
             try {
                 const result = await pending;
-                res.json(result);
+                (0, respondTeam_1.respondTeam)(res, result, ctx, 'manager');
             }
             catch (err) {
                 sendTeamError(err, res);
@@ -116,10 +115,7 @@ function registerTeamsRoutes(router, ctx) {
         teamFetch_1.teamCreateInFlight.set(key, createPromise);
         try {
             const result = await createPromise;
-            // Manager surface: redact dollars when hidden even from managers.
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(result)
-                : result);
+            (0, respondTeam_1.respondTeam)(res, result, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -166,9 +162,7 @@ function registerTeamsRoutes(router, ctx) {
                 teamId,
                 owningGroup,
             });
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(r)
-                : r);
+            (0, respondTeam_1.respondTeam)(res, r, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -240,10 +234,7 @@ function registerTeamsRoutes(router, ctx) {
             // the caller's group set and filter with includes().
             const owned = all.filter(t => typeof t.metadata?.owning_group === 'string' &&
                 t.metadata.owning_group === teamAdminCfg.group);
-            // Manager surface: strip dollar amounts when hidden even from managers.
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? owned.map(teamBudgetVisibility_1.redactTeamBudget)
-                : owned);
+            (0, respondTeam_1.respondTeamList)(res, owned, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -315,9 +306,9 @@ function registerTeamsRoutes(router, ctx) {
             return;
         }
         // (b) the member must exist in LiteLLM — provision on the spot if enabled
-        const litellmUserId = (0, provisioning_1.toLiteLLMUserId)(userEntityRef, userIdDomain);
+        const computedUserId = (0, provisioning_1.toLiteLLMUserId)(userEntityRef, userIdDomain);
         try {
-            await (0, provisioning_1.getOrProvisionUser)(client, userEntityRef, litellmUserId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
+            await (0, provisioning_1.getOrProvisionUser)(client, userEntityRef, computedUserId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
         }
         catch (err) {
             if (err instanceof provisioning_1.ProvisioningError) {
@@ -326,6 +317,8 @@ function registerTeamsRoutes(router, ctx) {
             }
             throw err;
         }
+        // The member may exist under a different id, found by email.
+        const litellmUserId = (0, provisioning_1.effectiveUserId)(computedUserId);
         try {
             await client.teamMemberAdd({
                 team_id: teamId,
@@ -343,9 +336,7 @@ function registerTeamsRoutes(router, ctx) {
                 via,
             });
             const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);
@@ -366,11 +357,11 @@ function registerTeamsRoutes(router, ctx) {
                 .json({ error: 'userEntityRef query parameter is required' });
             return;
         }
-        const litellmUserId = (0, provisioning_1.toLiteLLMUserId)(userEntityRef, userIdDomain);
+        const litellmUserId = await ctx.resolveMemberUserId(userEntityRef);
         // Team-role managers change membership only: they cannot remove
         // themselves nor a peer holding a manager role.
         if (via === 'teamRole') {
-            if (litellmUserId === (0, provisioning_1.toLiteLLMUserId)(actor, userIdDomain)) {
+            if (litellmUserId === (await ctx.resolveMemberUserId(actor))) {
                 res.status(400).json({ error: 'You cannot remove yourself from the team' });
                 return;
             }
@@ -395,9 +386,7 @@ function registerTeamsRoutes(router, ctx) {
                 via,
             });
             const updated = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
-            res.json(teamBudgetVisibility.hideTeamBudgetForManagers
-                ? (0, teamBudgetVisibility_1.redactTeamBudget)(updated)
-                : updated);
+            (0, respondTeam_1.respondTeam)(res, updated, ctx, 'manager');
         }
         catch (err) {
             sendTeamError(err, res);

package/dist/services/keyService.d.ts

@@ -1,20 +1,23 @@
 /**
- * Key generation service — unified by PR-6.
+ * Key generation service.
  *
  * Extracts the common logic for creating API keys from both the UI (POST /keys/generate)
- * and the bridge (POST /bridge/keys). Handles validation, provisioning, team/model checks,
- * and explicit upstream request construction.
+ * and the bridge (POST /bridge/keys). Handles validation, team/model checks,
+ * and explicit upstream request construction. Callers resolve the user beforehand.
  */
 import { AuthService, LoggerService } from '@backstage/backend-plugin-api';
 import { CatalogClient } from '@backstage/catalog-client';
 import { LiteLLMClient } from '../client';
-import { GenerateKeyResponse, ProvisioningDefaults, RoleConfig } from '../types';
+import { GenerateKeyResponse, UserInfo } from '../types';
 import { type KeyValidationConfig, type GenerateKeyInput } from '@acarmisc/backstage-plugin-litellm-common';
+/** User identity for key creation — already resolved by the caller. */
 export interface KeyCreateUser {
     /** Backstage user entity ref, e.g. "user:default/alice" (may be empty for bridge). */
     tokenEntityRef?: string;
-    /** Resolved LiteLLM user_id. Required. */
-    userId: string;
+    /** Resolved user info from LiteLLM. Required. */
+    userInfo: UserInfo;
+    /** How the key was created (for metadata stamping). Defaults to 'backstage'. */
+    createdVia?: string;
 }
 /** Context needed to create a key — configuration, clients, and services. */
 export interface KeyCreateContext {
@@ -27,10 +30,6 @@ export interface KeyCreateContext {
     auth?: AuthService;
     logger: LoggerService;
     keyValidationConfig: KeyValidationConfig;
-    provisioningEnabled: boolean;
-    provisioningDefaults: ProvisioningDefaults;
-    roleConfigs: RoleConfig[];
-    userIdDomain?: string;
 }
 /** Error thrown during key creation — maps to HTTP responses. */
 export declare class KeyServiceError extends Error {
@@ -44,18 +43,16 @@ export declare class KeyServiceError extends Error {
  * Performs:
  * - Schema validation of the input
  * - Config flag enforcement (allowUnlimitedBudget, teamRequired)
- * - User provisioning (single-flight, role configs)
  * - Team membership validation
  * - Model subset validation
  * - Metadata stamping
  * - Explicit upstream request construction and call
  *
- * @param user Verified identity: tokenEntityRef (optional) + userId (required)
+ * @param user Resolved identity: tokenEntityRef (optional) + userInfo (required, pre-provisioned)
  * @param input Parsed GenerateKeyInput from the schema
  * @param ctx Configuration and service clients
  * @returns The new key response from LiteLLM
  * @throws KeyServiceError with status and body for HTTP response
- * @throws ProvisioningError for provisioning failures
  * @throws LiteLLMUpstreamError for upstream LiteLLM errors
  */
 export declare function createKeyForUser(user: KeyCreateUser, input: GenerateKeyInput, ctx: KeyCreateContext): Promise<GenerateKeyResponse>;

package/dist/services/keyService.js

@@ -1,16 +1,15 @@
 "use strict";
 /**
- * Key generation service — unified by PR-6.
+ * Key generation service.
  *
  * Extracts the common logic for creating API keys from both the UI (POST /keys/generate)
- * and the bridge (POST /bridge/keys). Handles validation, provisioning, team/model checks,
- * and explicit upstream request construction.
+ * and the bridge (POST /bridge/keys). Handles validation, team/model checks,
+ * and explicit upstream request construction. Callers resolve the user beforehand.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyServiceError = void 0;
 exports.createKeyForUser = createKeyForUser;
 const provisioning_1 = require("../provisioning");
-/** Unified identity for key creation — resolved from either Backstage or JWT claims. */
 const modelAccess_1 = require("./modelAccess");
 /** Error thrown during key creation — maps to HTTP responses. */
 class KeyServiceError extends Error {
@@ -27,57 +26,21 @@ exports.KeyServiceError = KeyServiceError;
  * Performs:
  * - Schema validation of the input
  * - Config flag enforcement (allowUnlimitedBudget, teamRequired)
- * - User provisioning (single-flight, role configs)
  * - Team membership validation
  * - Model subset validation
  * - Metadata stamping
  * - Explicit upstream request construction and call
  *
- * @param user Verified identity: tokenEntityRef (optional) + userId (required)
+ * @param user Resolved identity: tokenEntityRef (optional) + userInfo (required, pre-provisioned)
  * @param input Parsed GenerateKeyInput from the schema
  * @param ctx Configuration and service clients
  * @returns The new key response from LiteLLM
  * @throws KeyServiceError with status and body for HTTP response
- * @throws ProvisioningError for provisioning failures
  * @throws LiteLLMUpstreamError for upstream LiteLLM errors
  */
 async function createKeyForUser(user, input, ctx) {
-    const { client, config, catalogClient, auth, logger, provisioningEnabled, provisioningDefaults, roleConfigs, } = ctx;
-    // ── Ensure user is provisioned ──────────────────────────────────────
-    // For bridge (no catalogClient/auth), use direct provisioning from JWT;
-    // for UI (with catalogClient/auth), use full provisioning with group roles.
-    let userInfo;
-    if (catalogClient !== undefined && catalogClient !== null && auth !== undefined && auth !== null) {
-        userInfo = await (0, provisioning_1.getOrProvisionUser)(client, user.tokenEntityRef || '', user.userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
-    }
-    else {
-        // Bridge path: just check if user exists, or provision with minimal info
-        userInfo = await client.getUserInfo(user.userId);
-        if (!userInfo) {
-            if (!provisioningEnabled) {
-                throw new KeyServiceError(404, {
-                    error: 'User not found in LiteLLM',
-                    detail: 'No LiteLLM user for this identity. Log in to Backstage once to be provisioned, or enable litellm.provisioning.enabled.',
-                });
-            }
-            // Provision with minimal info (just user_id, will use defaults)
-            const created = await client.createUser({
-                user_id: user.userId,
-                user_email: user.userId,
-                max_budget: provisioningDefaults.maxBudget,
-                budget_duration: provisioningDefaults.budgetDuration,
-                models: provisioningDefaults.models,
-                teams: provisioningDefaults.teams?.length ? [provisioningDefaults.teams[0]] : [],
-            });
-            if (!created) {
-                throw new KeyServiceError(500, {
-                    error: 'User provisioning failed',
-                    detail: 'Failed to create user in LiteLLM',
-                });
-            }
-            userInfo = await client.getUserInfo(user.userId);
-        }
-    }
+    const { client, config, catalogClient, auth, logger, } = ctx;
+    const userInfo = user.userInfo;
     // ── Enforce config flags ────────────────────────────────────────────
     if (!config.allowUnlimitedBudget && (input.max_budget === null || input.max_budget === undefined)) {
         throw new KeyServiceError(400, { error: 'max_budget is required when unlimited budgets are not allowed' });
@@ -127,13 +90,15 @@ async function createKeyForUser(user, input, ctx) {
         ? await (0, provisioning_1.resolveUserProfile)(user.tokenEntityRef, catalogClient, auth, logger)
         : {};
     const clientMetadata = input.metadata ?? {};
+    const createdVia = user.createdVia ?? 'backstage';
     const serverMetadata = {
-        created_by_backstage_user: user.tokenEntityRef ?? 'unknown',
+        ...(user.tokenEntityRef && { created_by_backstage_user: user.tokenEntityRef }),
+        ...(!user.tokenEntityRef && { created_by: userInfo.user_id }),
         ...(profile.email && { created_by_email: profile.email }),
         ...(profile.displayName && {
             created_by_display_name: profile.displayName,
         }),
-        created_via: 'backstage',
+        created_via: createdVia,
         created_at_iso: new Date().toISOString(),
     };
     // Server-owned keys override client values
@@ -145,7 +110,7 @@ async function createKeyForUser(user, input, ctx) {
     // Never spread the raw body; only include fields we've explicitly validated.
     const upstreamRequest = {
         alias: input.alias,
-        user_id: user.userId,
+        user_id: userInfo.user_id,
     };
     if (input.models !== undefined) {
         upstreamRequest.models = input.models;
@@ -159,6 +124,9 @@ async function createKeyForUser(user, input, ctx) {
         // max_budget from input can be null (unlimited) or a number
         upstreamRequest.max_budget = input.max_budget ?? undefined;
     }
+    if (input.budget_duration !== undefined) {
+        upstreamRequest.budget_duration = input.budget_duration;
+    }
     if (input.tpm_limit !== undefined) {
         upstreamRequest.tpm_limit = input.tpm_limit;
     }
@@ -174,6 +142,6 @@ async function createKeyForUser(user, input, ctx) {
     upstreamRequest.metadata = enrichedMetadata;
     // ── Call upstream LiteLLM ───────────────────────────────────────────
     const result = await client.generateKey(upstreamRequest);
-    logger.info('key.generate', { userId: user.userId, keyAlias: input.alias });
+    logger.info('key.generate', { userId: userInfo.user_id, keyAlias: input.alias });
     return result;
 }

package/dist/teamMemberUsage.d.ts

@@ -0,0 +1,34 @@
+import { Config } from '@backstage/config';
+import { TeamInfo, TeamMemberUsage, UsageMetrics, VirtualKey } from './types';
+/** `litellm.teamUsage.memberBreakdown`: who may see a team's per-member usage. */
+export interface MemberBreakdownConfig {
+    /** Off by default: the route returns 404 and the UI hides the table. */
+    enabled: boolean;
+    /** LiteLLM team roles (e.g. "admin") whose holders may view their own team's breakdown. */
+    viewerRoles: string[];
+    /** Whether `litellm.team.usage.read` may grant access (needs `permission.enabled`). */
+    permissionEnabled: boolean;
+}
+export declare function readMemberBreakdownConfig(config: Config): MemberBreakdownConfig;
+/** Catalog profile of a member, keyed by lower-cased email. */
+export type MemberProfiles = Map<string, {
+    displayName?: string;
+}>;
+/**
+ * Emails worth looking up in the catalog for the members of a breakdown:
+ * the team roster's emails and email-shaped user ids.
+ */
+export declare function memberEmails(team: TeamInfo, keys: VirtualKey[]): string[];
+/**
+ * Attributes a team's usage to its members. Each key in the team's daily
+ * activity is credited to the key's owner (from `/key/list?team_id=`), so the
+ * rows add up to the team total. Activity of keys with no known owner
+ * (deleted keys, keys without a user) lands in one `user_id: null` row.
+ * Team members without activity get zero rows.
+ */
+export declare function buildTeamMemberUsage(teamId: string, usage: UsageMetrics, keys: VirtualKey[], team: TeamInfo, profiles?: MemberProfiles): TeamMemberUsage;
+/**
+ * Hides dollar amounts: spend becomes 0 and `spend_share_pct` remains the
+ * way to compare members. Tokens and requests are kept.
+ */
+export declare function redactTeamMemberUsage(usage: TeamMemberUsage): TeamMemberUsage;