@acarmisc/backstage-plugin-litellm-backend 0.19.0 → 0.21.0

package/dist/index.cjs.js

@@ -7982,20 +7982,20 @@ __export(index_exports, {
   getOrProvisionUser: () => getOrProvisionUser,
   getOrProvisionUserFromClaims: () => getOrProvisionUserFromClaims,
   isTeamManagementEnabled: () => isTeamManagementEnabled,
-  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common11.litellmAuditReadPermission,
-  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common11.litellmKeyCreatePermission,
-  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common11.litellmKeyManagePermission,
-  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common11.litellmKeyResetSpendPermission,
-  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common11.litellmKeyRevokePermission,
-  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common11.litellmKeyUnblockPermission,
-  litellmPermissions: () => import_backstage_plugin_litellm_common11.litellmPermissions,
+  litellmAuditReadPermission: () => import_backstage_plugin_litellm_common12.litellmAuditReadPermission,
+  litellmKeyCreatePermission: () => import_backstage_plugin_litellm_common12.litellmKeyCreatePermission,
+  litellmKeyManagePermission: () => import_backstage_plugin_litellm_common12.litellmKeyManagePermission,
+  litellmKeyResetSpendPermission: () => import_backstage_plugin_litellm_common12.litellmKeyResetSpendPermission,
+  litellmKeyRevokePermission: () => import_backstage_plugin_litellm_common12.litellmKeyRevokePermission,
+  litellmKeyUnblockPermission: () => import_backstage_plugin_litellm_common12.litellmKeyUnblockPermission,
+  litellmPermissions: () => import_backstage_plugin_litellm_common12.litellmPermissions,
   litellmPlugin: () => litellmPlugin,
-  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common11.litellmTeamCreatePermission,
-  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common11.litellmTeamDeletePermission,
-  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamKnowledgebaseManagePermission,
-  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamManagePermission,
-  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMcpManagePermission,
-  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common11.litellmTeamMembersManagePermission,
+  litellmTeamCreatePermission: () => import_backstage_plugin_litellm_common12.litellmTeamCreatePermission,
+  litellmTeamDeletePermission: () => import_backstage_plugin_litellm_common12.litellmTeamDeletePermission,
+  litellmTeamKnowledgebaseManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamKnowledgebaseManagePermission,
+  litellmTeamManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamManagePermission,
+  litellmTeamMcpManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamMcpManagePermission,
+  litellmTeamMembersManagePermission: () => import_backstage_plugin_litellm_common12.litellmTeamMembersManagePermission,
   newDefaultVerifier: () => newDefaultVerifier,
   provisionUser: () => provisionUser,
   readBridgeConfig: () => readBridgeConfig,
@@ -8197,6 +8197,28 @@ var LiteLLMClient = class {
       throw err;
     }
   }
+  /**
+   * Lists every key bound to a team (any owner), following `/key/list`
+   * pagination. Stops after 50 pages of 100 keys.
+   */
+  async listTeamKeys(teamId) {
+    const keys = [];
+    for (let page = 1; page <= 50; page++) {
+      const params = new URLSearchParams({
+        team_id: teamId,
+        return_full_object: "true",
+        page: String(page),
+        size: "100"
+      });
+      const response = await this.request(`/key/list?${params.toString()}`);
+      const rawKeys = (response.keys ?? []).filter(
+        (k) => typeof k === "object" && k !== null
+      );
+      keys.push(...rawKeys.map(this.toVirtualKey));
+      if (rawKeys.length === 0 || page >= (response.total_pages ?? 1)) break;
+    }
+    return keys;
+  }
   toVirtualKey(k) {
     return {
       key: k.key_name ?? k.token,
@@ -8901,6 +8923,38 @@ var ProvisioningError = class extends Error {
     this.body = { error: message2, hint, provisioning };
   }
 };
+var adoptedUserIds = /* @__PURE__ */ new Map();
+function effectiveUserId(userId) {
+  return adoptedUserIds.get(userId) ?? userId;
+}
+async function getUserByIdOrAdopted(client, userId) {
+  const adopted = adoptedUserIds.get(userId);
+  if (adopted) {
+    const info = await client.getUserInfo(adopted);
+    if (info) return info;
+    adoptedUserIds.delete(userId);
+  }
+  return client.getUserInfo(userId);
+}
+async function adoptUserByEmail(client, userId, email, logger) {
+  if (!email) return null;
+  const byEmail = await client.getUserByEmail(email);
+  if (!byEmail?.user_id) return null;
+  if (byEmail.user_id !== userId) {
+    logger.info(
+      `Found existing LiteLLM user ${byEmail.user_id} by email ${email}, reusing for ${userId}`
+    );
+    adoptedUserIds.set(userId, byEmail.user_id);
+  }
+  return byEmail;
+}
+async function findLiteLLMUser(client, tokenEntityRef, userId, catalogClient, auth, logger) {
+  const existing = await getUserByIdOrAdopted(client, userId);
+  if (existing) return existing;
+  if (!tokenEntityRef) return null;
+  const profile = await resolveUserProfile(tokenEntityRef, catalogClient, auth, logger);
+  return adoptUserByEmail(client, userId, profile.email, logger);
+}
 async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger) {
   if (!userId) {
     throw new ProvisioningError(
@@ -8909,17 +8963,10 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
       provisioningEnabled
     );
   }
-  const existing = await client.getUserInfo(userId);
+  const existing = await getUserByIdOrAdopted(client, userId);
   if (existing) {
     return existing;
   }
-  if (!provisioningEnabled) {
-    throw new ProvisioningError(
-      "User not found in LiteLLM",
-      "Enable litellm.provisioning.enabled in app-config.yaml or create the user manually",
-      false
-    );
-  }
   const pending = provisioningInFlight.get(userId);
   if (pending) {
     logger.info(
@@ -8928,11 +8975,25 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
     return pending;
   }
   const provisionPromise = (async () => {
-    const catalogRef = tokenEntityRef ?? userId;
-    const [matchedRole, profile] = await Promise.all([
-      resolveUserRole(catalogRef, roleConfigs, catalogClient, auth, logger),
-      tokenEntityRef ? resolveUserProfile(tokenEntityRef, catalogClient, auth, logger) : Promise.resolve({})
-    ]);
+    const profile = tokenEntityRef ? await resolveUserProfile(tokenEntityRef, catalogClient, auth, logger) : {};
+    const byEmail = await adoptUserByEmail(client, userId, profile.email, logger);
+    if (byEmail) {
+      return byEmail;
+    }
+    if (!provisioningEnabled) {
+      throw new ProvisioningError(
+        "User not found in LiteLLM",
+        "Enable litellm.provisioning.enabled in app-config.yaml or create the user manually",
+        false
+      );
+    }
+    const matchedRole = await resolveUserRole(
+      tokenEntityRef ?? userId,
+      roleConfigs,
+      catalogClient,
+      auth,
+      logger
+    );
     const effectiveDefaults = matchedRole ? applyRoleOverrides(provisioningDefaults, matchedRole) : provisioningDefaults;
     if (matchedRole) {
       logger.info(
@@ -8961,7 +9022,7 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
         logger.info(
           `LiteLLM user ${userId} already exists during provisioning \u2014 re-fetching`
         );
-        const refetched = await client.getUserInfo(userId);
+        const refetched = await client.getUserInfo(userId) ?? await adoptUserByEmail(client, userId, profile.email, logger);
         if (refetched) {
           return refetched;
         }
@@ -9022,7 +9083,7 @@ async function resolveUserRole(userEntityRef, roleConfigs, catalogClient, auth,
 }
 
 // src/router.ts
-var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
 
 // src/teamAdmin.ts
 var import_plugin_permission_common = __toESM(require_index_cjs2());
@@ -9290,6 +9351,7 @@ function readOpencodeConfig(config) {
     enabled,
     keyDuration: config.getOptionalString("litellm.opencode.keyDuration") ?? "30d",
     maxBudget: config.getOptionalNumber("litellm.opencode.maxBudget") ?? 50,
+    budgetDuration: config.getOptionalString("litellm.opencode.budgetDuration"),
     requireTeam: config.getOptionalBoolean("litellm.opencode.requireTeam") ?? false,
     metadata: config.getOptional(
       "litellm.opencode.metadata"
@@ -9297,6 +9359,93 @@ function readOpencodeConfig(config) {
   };
 }
 
+// src/teamMemberUsage.ts
+function readMemberBreakdownConfig(config) {
+  return {
+    enabled: config.getOptionalBoolean("litellm.teamUsage.memberBreakdown.enabled") ?? false,
+    viewerRoles: config.getOptionalStringArray("litellm.teamUsage.memberBreakdown.viewerRoles") ?? [],
+    permissionEnabled: config.getOptionalBoolean("permission.enabled") ?? false
+  };
+}
+function memberEmails(team, keys) {
+  const emails = /* @__PURE__ */ new Set();
+  for (const m of team.members_with_roles ?? []) {
+    if (m.user_email) emails.add(m.user_email.toLowerCase());
+    else if (m.user_id?.includes("@")) emails.add(m.user_id.toLowerCase());
+  }
+  for (const k of keys) {
+    if (k.user_id?.includes("@")) emails.add(k.user_id.toLowerCase());
+  }
+  return [...emails];
+}
+function buildTeamMemberUsage(teamId, usage, keys, team, profiles = /* @__PURE__ */ new Map()) {
+  const rows = /* @__PURE__ */ new Map();
+  const rowFor = (userId) => {
+    let row = rows.get(userId);
+    if (!row) {
+      row = {
+        user_id: userId,
+        spend: 0,
+        spend_share_pct: 0,
+        prompt_tokens: 0,
+        completion_tokens: 0,
+        total_tokens: 0,
+        api_requests: 0,
+        successful_requests: 0,
+        failed_requests: 0,
+        success_rate: null,
+        key_count: 0
+      };
+      rows.set(userId, row);
+    }
+    return row;
+  };
+  for (const m of team.members_with_roles ?? []) {
+    if (!m.user_id) continue;
+    const row = rowFor(m.user_id);
+    row.role = m.role;
+    if (m.user_email) row.user_email = m.user_email;
+  }
+  const ownerByKey = /* @__PURE__ */ new Map();
+  for (const k of keys) {
+    if (!k.user_id || !k.token) continue;
+    ownerByKey.set(k.token, k.user_id);
+    rowFor(k.user_id).key_count += 1;
+  }
+  for (const [keyHash, k] of Object.entries(usage.usage_by_key ?? {})) {
+    const row = rowFor(ownerByKey.get(keyHash) ?? null);
+    row.spend += k.total_spend ?? 0;
+    row.prompt_tokens += k.prompt_tokens ?? 0;
+    row.completion_tokens += k.completion_tokens ?? 0;
+    row.total_tokens += k.total_tokens ?? 0;
+    row.api_requests += k.api_requests ?? 0;
+    row.successful_requests += k.successful_requests ?? 0;
+    row.failed_requests += k.failed_requests ?? 0;
+  }
+  const members = [...rows.values()];
+  const totalSpend = members.reduce((sum, r) => sum + r.spend, 0);
+  for (const row of members) {
+    row.spend_share_pct = totalSpend > 0 ? row.spend / totalSpend * 100 : 0;
+    const finished = row.successful_requests + row.failed_requests;
+    row.success_rate = finished > 0 ? row.successful_requests / finished * 100 : null;
+    if (!row.user_email && row.user_id?.includes("@")) row.user_email = row.user_id;
+    const profile = row.user_email && profiles.get(row.user_email.toLowerCase());
+    if (profile && profile.displayName) row.display_name = profile.displayName;
+  }
+  members.sort(
+    (a, b) => b.spend - a.spend || b.total_tokens - a.total_tokens || String(a.user_id ?? "\uFFFF").localeCompare(String(b.user_id ?? "\uFFFF"))
+  );
+  return { team_id: teamId, total_spend: totalSpend, members };
+}
+function redactTeamMemberUsage(usage) {
+  return {
+    ...usage,
+    total_spend: 0,
+    budget_hidden: true,
+    members: usage.members.map((m) => ({ ...m, spend: 0 }))
+  };
+}
+
 // src/routes/middleware/withUser.ts
 function createRequireUser(ctx) {
   return async (req, res, next) => {
@@ -9317,7 +9466,7 @@ function createRequireUser(ctx) {
 async function getProvisionedUser(ctx, res) {
   const tokenEntityRef = res.locals.tokenEntityRef;
   const userId = res.locals.userId;
-  return getOrProvisionUser(
+  const userInfo = await getOrProvisionUser(
     ctx.client,
     tokenEntityRef,
     userId,
@@ -9328,6 +9477,8 @@ async function getProvisionedUser(ctx, res) {
     ctx.auth,
     ctx.logger
   );
+  res.locals.userId = effectiveUserId(userId);
+  return userInfo;
 }
 
 // src/services/userInfoCache.ts
@@ -9536,6 +9687,7 @@ var openApiSpec = {
             team_id: { type: "string" },
             duration: { type: "string" },
             max_budget: { type: "number", nullable: true, description: "Positive number caps spend; null = unlimited" },
+            budget_duration: { type: "string", description: 'How often max_budget resets (e.g. "30d", "1mo"); one of litellm.keys.allowedBudgetDurations' },
             tpm_limit: { type: "number" },
             rpm_limit: { type: "number" }
           } } } }
@@ -9632,6 +9784,24 @@ var openApiSpec = {
         responses: { "200": { description: "Team usage" }, "400": { description: "Missing date range" } }
       }
     },
+    "/teams/{teamId}/usage/members": {
+      get: {
+        tags: ["Teams"],
+        summary: "Per-member usage breakdown for a team",
+        description: "Needs litellm.teamUsage.memberBreakdown.enabled. Allowed for team managers, members holding one of memberBreakdown.viewerRoles, and members granted litellm.team.usage.read. Spend is zeroed (with budget_hidden: true) under team budget hiding; spend_share_pct remains.",
+        parameters: [
+          { name: "teamId", in: "path", required: true, schema: { type: "string" } },
+          { name: "start_date", in: "query", required: true, schema: { type: "string" } },
+          { name: "end_date", in: "query", required: true, schema: { type: "string" } }
+        ],
+        responses: {
+          "200": { description: "One row per member, sorted by spend" },
+          "400": { description: "Missing date range" },
+          "403": { description: "Caller may see the team but not its member breakdown" },
+          "404": { description: "Feature disabled, or team not found / not visible to the caller" }
+        }
+      }
+    },
     "/usage": {
       get: {
         tags: ["Usage"],
@@ -9737,6 +9907,9 @@ function registerConfigRoutes(router, ctx) {
         readOnly: ctx.teamAdminCfg.readOnly,
         memberManagerRoles: ctx.teamAdminCfg.memberManagerRoles
       },
+      teamUsage: {
+        memberBreakdown: ctx.memberBreakdownCfg.enabled
+      },
       display: {
         hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,
         hideTeamBudgetForManagers: ctx.teamBudgetVisibility.hideTeamBudgetForManagers
@@ -9908,6 +10081,9 @@ async function createKeyForUser(user, input, ctx) {
   if (input.max_budget !== void 0) {
     upstreamRequest.max_budget = input.max_budget ?? void 0;
   }
+  if (input.budget_duration !== void 0) {
+    upstreamRequest.budget_duration = input.budget_duration;
+  }
   if (input.tpm_limit !== void 0) {
     upstreamRequest.tpm_limit = input.tpm_limit;
   }
@@ -9966,8 +10142,8 @@ function registerKeysRoutes(router, ctx) {
   });
   router.get("/keys", async (_req, res) => {
     try {
-      const userId = res.locals.userId;
       await getProvisionedUser(ctx, res);
+      const userId = res.locals.userId;
       const keys = await client.listKeys(userId);
       res.json(keys);
     } catch (error) {
@@ -9984,8 +10160,8 @@ function registerKeysRoutes(router, ctx) {
         sendPermissionDenied(res, import_backstage_plugin_litellm_common3.litellmKeyRevokePermission);
         return;
       }
-      const userId = res.locals.userId;
       await getProvisionedUser(ctx, res);
+      const userId = res.locals.userId;
       const keys = await client.listKeys(userId);
       const now = Date.now();
       const expiredKeys = keys.filter((k) => {
@@ -10378,11 +10554,11 @@ function registerOpencodeRoutes(router, ctx) {
         sendPermissionDenied(res, import_backstage_plugin_litellm_common4.litellmKeyCreatePermission);
         return null;
       }
-      const userId = toLiteLLMUserId(tokenEntityRef, userIdDomain);
+      const computedUserId = toLiteLLMUserId(tokenEntityRef, userIdDomain);
       const userInfo = await getOrProvisionUser(
         client,
         tokenEntityRef,
-        userId,
+        computedUserId,
         provisioningEnabled,
         provisioningDefaults,
         roleConfigs,
@@ -10404,7 +10580,7 @@ function registerOpencodeRoutes(router, ctx) {
         res.status(400).json({ error: "A team is required for this connection" });
         return null;
       }
-      return { tokenEntityRef, userId, userInfo, teamId, redirectUri };
+      return { tokenEntityRef, userId: effectiveUserId(computedUserId), userInfo, teamId, redirectUri };
     };
     router.get("/opencode/connect", async (req, res) => {
       try {
@@ -10472,6 +10648,7 @@ function registerOpencodeRoutes(router, ctx) {
             alias,
             duration: opencodeCfg.keyDuration,
             max_budget: opencodeCfg.maxBudget,
+            ...opencodeCfg.budgetDuration && { budget_duration: opencodeCfg.budgetDuration },
             team_id: teamId,
             metadata: {
               ...opencodeCfg.metadata,
@@ -10506,14 +10683,15 @@ function registerOpencodeRoutes(router, ctx) {
           res.status(502).json({ error: "LiteLLM returned no key material" });
           return;
         }
+        logger.info("opencode.connect", { userId, team: teamId ?? null, rotated });
+        if (req.is("application/json")) {
+          res.set("Cache-Control", "no-store");
+          res.json({ key, team: teamId ?? null });
+          return;
+        }
         const url = new URL(redirectUri);
         url.searchParams.set("key", key);
         if (teamId) url.searchParams.set("team", teamId);
-        logger.info("opencode.connect", {
-          userId,
-          team: teamId ?? null,
-          rotated
-        });
         res.redirect(302, url.href);
       } catch (error) {
         if (error instanceof ProvisioningError) {
@@ -10866,12 +11044,12 @@ function registerTeamsRoutes(router, ctx) {
         });
         return;
       }
-      const litellmUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
+      const computedUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
       try {
         await getOrProvisionUser(
           client,
           userEntityRef,
-          litellmUserId,
+          computedUserId,
           provisioningEnabled,
           provisioningDefaults,
           roleConfigs,
@@ -10886,6 +11064,7 @@ function registerTeamsRoutes(router, ctx) {
         }
         throw err;
       }
+      const litellmUserId = effectiveUserId(computedUserId);
       try {
         await client.teamMemberAdd({
           team_id: teamId,
@@ -10925,9 +11104,9 @@ function registerTeamsRoutes(router, ctx) {
         res.status(400).json({ error: "userEntityRef query parameter is required" });
         return;
       }
-      const litellmUserId = toLiteLLMUserId(userEntityRef, userIdDomain);
+      const litellmUserId = await ctx.resolveMemberUserId(userEntityRef);
       if (via === "teamRole") {
-        if (litellmUserId === toLiteLLMUserId(actor, userIdDomain)) {
+        if (litellmUserId === await ctx.resolveMemberUserId(actor)) {
           res.status(400).json({ error: "You cannot remove yourself from the team" });
           return;
         }
@@ -11145,6 +11324,7 @@ function registerObjectPermissionsRoutes(router, ctx) {
 }
 
 // src/routes/teamUsage.ts
+var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerTeamUsageRoutes(router, ctx) {
   const {
     client,
@@ -11207,6 +11387,95 @@ function registerTeamUsageRoutes(router, ctx) {
       sendError(res, error, logger, "fetch team usage");
     }
   });
+  router.get("/teams/:teamId/usage/members", requireUser, async (req, res) => {
+    const cfg = ctx.memberBreakdownCfg;
+    if (!cfg.enabled) {
+      res.status(404).json({ error: "Not found" });
+      return;
+    }
+    try {
+      const { teamId } = req.params;
+      const { start_date, end_date } = req.query;
+      if (!start_date || !end_date) {
+        res.status(400).json({ error: "start_date and end_date are required" });
+        return;
+      }
+      const tokenEntityRef = res.locals.tokenEntityRef;
+      const userInfo = await getProvisionedUser(ctx, res);
+      const callerId = res.locals.userId;
+      const isMember = userInfo?.teams?.includes(teamId) ?? false;
+      let team;
+      try {
+        team = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
+      } catch (err) {
+        if (err instanceof LiteLLMUpstreamError && err.status === 404) {
+          res.status(404).json({ error: "Team not found" });
+          return;
+        }
+        throw err;
+      }
+      const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
+      const isManager = ctx.teamMgmtEnabled && !!owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger);
+      if (!isMember && !isManager) {
+        res.status(404).json({ error: "Team not found" });
+        return;
+      }
+      const role = team.members_with_roles?.find((m) => m.user_id === callerId)?.role;
+      const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
+      const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common7.litellmTeamUsageReadPermission);
+      if (!allowed) {
+        res.status(403).json({
+          error: "Access denied: viewing per-member usage needs a team role or permission"
+        });
+        return;
+      }
+      const [usage, keys] = await Promise.all([
+        client.getTeamUsage(teamId, start_date, end_date),
+        client.listTeamKeys(teamId)
+      ]);
+      const profiles = await lookupProfiles(memberEmails(team, keys));
+      const breakdown = buildTeamMemberUsage(teamId, usage, keys, team, profiles);
+      let via = "permission";
+      if (isManager) via = "manager";
+      else if (viaRole) via = "teamRole";
+      logger.info("team.usage.members.read", { actor: tokenEntityRef, teamId, via });
+      const hide = isManager ? teamBudgetVisibility.hideTeamBudgetForManagers : teamBudgetVisibility.hideTeamBudgetForMembers;
+      res.json(hide ? redactTeamMemberUsage(breakdown) : breakdown);
+    } catch (error) {
+      if (error instanceof ProvisioningError) {
+        res.status(error.status).json(error.body);
+        return;
+      }
+      sendError(res, error, logger, "fetch team member usage");
+    }
+  });
+  async function lookupProfiles(emails) {
+    const profiles = /* @__PURE__ */ new Map();
+    if (!emails.length) return profiles;
+    try {
+      const { token } = await auth.getPluginRequestToken({
+        onBehalfOf: await auth.getOwnServiceCredentials(),
+        targetPluginId: "catalog"
+      });
+      const { items } = await catalogClient.getEntities(
+        {
+          filter: { kind: "User", "spec.profile.email": emails },
+          fields: ["spec.profile"]
+        },
+        { token }
+      );
+      for (const entity of items) {
+        const profile = entity.spec?.profile ?? {};
+        if (typeof profile.email === "string") {
+          profiles.set(profile.email.toLowerCase(), { displayName: profile.displayName });
+        }
+      }
+    } catch (err) {
+      const message2 = err instanceof Error ? err.message : String(err);
+      logger.warn(`Catalog lookup for team member names failed: ${message2}`);
+    }
+    return profiles;
+  }
 }
 
 // node_modules/jose/dist/node/esm/runtime/base64url.js
@@ -12722,8 +12991,8 @@ async function bridgeListKeys(client, claims, provisioningEnabled, provisioningD
 }
 
 // src/routes/bridge.ts
-var import_backstage_plugin_litellm_common7 = require("@acarmisc/backstage-plugin-litellm-common");
 var import_backstage_plugin_litellm_common8 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common9 = require("@acarmisc/backstage-plugin-litellm-common");
 function registerBridgeRoutes(router, ctx, bridgeOpts) {
   const {
     client,
@@ -12736,7 +13005,7 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
     keyValidationConfig
   } = ctx;
   const { config } = bridgeOpts;
-  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common8.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
+  const generateKeyInputSchema = (0, import_backstage_plugin_litellm_common9.createGenerateKeyInputSchema)(ctx.keyValidationConfig);
   const bridgeCfg = readBridgeConfig(config);
   const bridgeIdentity = {
     userIdDomain,
@@ -12897,11 +13166,11 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
         }
         const team = await client.getTeamInfo(teamId);
         const allowed = team.models;
-        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common7.ALL_PROXY_MODELS)) {
+        if (!allowed || allowed.length === 0 || allowed.includes(import_backstage_plugin_litellm_common8.ALL_PROXY_MODELS)) {
           res.json(models);
           return;
         }
-        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common7.isModelAllowed)(m, allowed)));
+        res.json(models.filter((m) => (0, import_backstage_plugin_litellm_common8.isModelAllowed)(m, allowed)));
       } catch (error) {
         handleBridgeError(error, res);
       }
@@ -12933,18 +13202,20 @@ async function createRouter(options) {
   const keyMaxBudget = config.getOptionalNumber("litellm.keys.maxBudget") ?? 100;
   const keyMaxTpm = config.getOptionalNumber("litellm.keys.maxTpm") ?? 1e5;
   const keyMaxRpm = config.getOptionalNumber("litellm.keys.maxRpm") ?? 1e3;
-  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common9.DEFAULT_KEY_DURATIONS;
+  const keyAllowedDurations = config.getOptionalStringArray("litellm.keys.allowedDurations") ?? import_backstage_plugin_litellm_common10.DEFAULT_KEY_DURATIONS;
   const keyValidationConfig = {
     maxBudget: keyMaxBudget,
     maxTpm: keyMaxTpm,
     maxRpm: keyMaxRpm,
-    allowedDurations: keyAllowedDurations
+    allowedDurations: keyAllowedDurations,
+    allowedBudgetDurations: config.getOptionalStringArray("litellm.keys.allowedBudgetDurations") ?? import_backstage_plugin_litellm_common10.DEFAULT_KEY_BUDGET_DURATIONS
   };
   const teamMgmtEnabled = isTeamManagementEnabled(config);
   const objectPermsEnabled = isObjectPermissionsEnabled(config);
   const teamAdminCfg = readTeamAdminConfig(config);
   const teamBudgetVisibility = readTeamBudgetVisibility(config);
   const opencodeCfg = readOpencodeConfig(config);
+  const memberBreakdownCfg = readMemberBreakdownConfig(config);
   const catalogClient = options.catalogClient ?? new import_catalog_client.CatalogClient({ discoveryApi: discovery });
   if (provisioningEnabled) {
     logger.info(
@@ -12961,7 +13232,13 @@ async function createRouter(options) {
       `LiteLLM team budget hiding enabled \u2014 members: ${teamBudgetVisibility.hideTeamBudgetForMembers}, managers: ${teamBudgetVisibility.hideTeamBudgetForManagers}`
     );
   }
+  const resolveMemberUserId = async (userEntityRef) => {
+    const computed = toLiteLLMUserId(userEntityRef, userIdDomain);
+    await findLiteLLMUser(client, userEntityRef, computed, catalogClient, auth, logger);
+    return effectiveUserId(computed);
+  };
   const ctx = {
+    resolveMemberUserId,
     client,
     catalogClient,
     auth,
@@ -12984,13 +13261,14 @@ async function createRouter(options) {
     teamAdminCfg,
     teamBudgetVisibility,
     opencodeCfg,
+    memberBreakdownCfg,
     // Helper functions - defined inline below this object
     authorizeKeyAction: async (req, keyId) => {
       if (!req.res || !req.res.locals.tokenEntityRef || !req.res.locals.userId) {
         throw new import_errors21.NotAllowedError("User identity not found in request");
       }
       const tokenEntityRef = req.res.locals.tokenEntityRef;
-      const userId = req.res.locals.userId;
+      const userId = await resolveMemberUserId(tokenEntityRef);
       const ownKeys = await client.listKeys(userId);
       const key = ownKeys.find((k) => (k.token ?? k.key) === keyId);
       if (!key) {
@@ -13106,7 +13384,7 @@ async function createRouter(options) {
       }
       if (teamRoleEligible) {
         const actor = await resolveUserId(req, auth);
-        const litellmUserId = actor && toLiteLLMUserId(actor, userIdDomain);
+        const litellmUserId = actor && await resolveMemberUserId(actor);
         const role = existing.members_with_roles?.find(
           (m) => m.user_id === litellmUserId
         )?.role;
@@ -13140,7 +13418,7 @@ async function createRouter(options) {
 }
 
 // src/plugin.ts
-var import_backstage_plugin_litellm_common10 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
 var BRIDGE_UNAUTHENTICATED_PATHS = [
   "/bridge/health",
   "/bridge/keys",
@@ -13169,7 +13447,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
         permissions,
         permissionsRegistry
       }) {
-        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common10.litellmPermissions);
+        permissionsRegistry.addPermissions(import_backstage_plugin_litellm_common11.litellmPermissions);
         const router = await createRouter({
           config,
           logger,
@@ -13189,7 +13467,7 @@ var litellmPlugin = (0, import_backend_plugin_api.createBackendPlugin)({
 });
 
 // src/index.ts
-var import_backstage_plugin_litellm_common11 = require("@acarmisc/backstage-plugin-litellm-common");
+var import_backstage_plugin_litellm_common12 = require("@acarmisc/backstage-plugin-litellm-common");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   KeycloakJWTVerifier,