@acarmisc/backstage-plugin-litellm-backend 0.2.0 → 0.2.2

package/dist/router.js

@@ -1,8 +1,41 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ProvisioningError = void 0;
 exports.createRouter = createRouter;
-const express_1 = require("express");
+const express_1 = __importStar(require("express"));
 const catalog_client_1 = require("@backstage/catalog-client");
 const client_1 = require("./client");
 const provisioning_1 = require("./provisioning");
@@ -17,9 +50,15 @@ async function createRouter(options) {
     const roleConfigs = (0, provisioning_1.readRoleConfigs)(config);
     const catalogClient = new catalog_client_1.CatalogClient({ discoveryApi: discovery });
     if (provisioningEnabled) {
-        logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length ? provisioningDefaults.models.join(',') : 'all'}, teams=[${provisioningDefaults.teams.join(',')}]`);
+        logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length
+            ? provisioningDefaults.models.join(',')
+            : 'all'}, teams=[${provisioningDefaults.teams.join(',')}]`);
     }
     const router = (0, express_1.Router)();
+    // JSON body parser. Without this, every POST/PUT endpoint sees an empty
+    // req.body. Backstage's httpRouter does not apply a body parser at the
+    // plugin-router level, so each plugin must attach its own.
+    router.use(express_1.default.json());
     router.get('/health', (_req, res) => {
         res.json({ status: 'ok', provisioning: provisioningEnabled });
     });
@@ -62,13 +101,52 @@ async function createRouter(options) {
     });
     router.post('/keys/generate', async (req, res) => {
         try {
+            // Only alias + max_budget are required. An empty models array is
+            // intentional — in LiteLLM `models: []` means "all models the user
+            // can access" which is the desired default. Forcing a selection
+            // up front is too restrictive for the common case.
+            const body = (req.body ?? {});
+            const missing = [];
+            if (!body.alias?.trim())
+                missing.push('alias');
+            if (typeof body.max_budget !== 'number' || body.max_budget <= 0) {
+                missing.push('max_budget (positive number)');
+            }
+            if (missing.length) {
+                res.status(400).json({
+                    error: 'Missing required fields',
+                    hint: `Required: ${missing.join(', ')}`,
+                });
+                return;
+            }
             const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
-            const resolvedUserId = tokenEntityRef ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain) : undefined;
+            const resolvedUserId = tokenEntityRef
+                ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+                : undefined;
             if (resolvedUserId) {
                 await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, resolvedUserId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
             }
+            // Stamp ownership into LiteLLM key metadata. LiteLLM's native
+            // `created_by` column is only populated when the caller authenticates
+            // via JWT/SSO; we always call with the master key, so that column
+            // stays null. Enriching `metadata` makes the owner identity visible
+            // in LiteLLM's UI and queryable via API.
+            const profile = tokenEntityRef
+                ? await (0, provisioning_1.resolveUserProfile)(tokenEntityRef, catalogClient, auth, logger)
+                : {};
+            const enrichedMetadata = {
+                ...(body.metadata ?? {}),
+                created_by_backstage_user: tokenEntityRef ?? 'unknown',
+                ...(profile.email && { created_by_email: profile.email }),
+                ...(profile.displayName && {
+                    created_by_display_name: profile.displayName,
+                }),
+                created_via: 'backstage',
+                created_at_iso: new Date().toISOString(),
+            };
             const request = {
-                ...req.body,
+                ...body,
+                metadata: enrichedMetadata,
                 ...(resolvedUserId && { user_id: resolvedUserId }),
             };
             const result = await client.generateKey(request);

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  spend: number;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n}\n\nexport interface VirtualKey {\n  key: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n"],
+  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  spend: number;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -26,6 +26,7 @@ export interface TeamInfo {
 }
 export interface VirtualKey {
     key: string;
+    token: string;
     key_alias?: string;
     created_at: string;
     expires_at?: string;
@@ -36,6 +37,26 @@ export interface VirtualKey {
     models?: string[];
     user_id?: string;
 }
+/**
+ * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.
+ * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes
+ * both a hashed `token` and a masked `key_name`, and fields are nullable
+ * rather than optional.
+ */
+export interface LiteLLMUserKey {
+    token: string;
+    key_name?: string;
+    key_alias?: string | null;
+    spend?: number;
+    expires?: string | null;
+    models?: string[];
+    tpm_limit?: number | null;
+    rpm_limit?: number | null;
+    max_budget?: number | null;
+    user_id?: string | null;
+    team_id?: string | null;
+    created_at: string;
+}
 export interface ModelInfo {
     model_name: string;
     mode: string;
@@ -109,6 +130,7 @@ export interface GenerateKeyRequest {
     user_id?: string;
     team_id?: string;
     key_type?: string;
+    metadata?: Record<string, string>;
 }
 export interface UpdateKeyRequest {
     key: string;
@@ -143,6 +165,13 @@ export interface ProvisioningDefaults {
     teams: string[];
     tpmLimit?: number;
     rpmLimit?: number;
+    /**
+     * LiteLLM user role applied on /user/new. Defaults to "internal_user"
+     * which grants self-service Create/Delete/View on the user's own keys.
+     * Valid values: proxy_admin, proxy_admin_viewer, internal_user,
+     * internal_user_viewer, team.
+     */
+    userRole?: string;
     metadata: Record<string, string>;
 }
 export interface RoleConfig {
@@ -153,11 +182,14 @@ export interface RoleConfig {
     teams?: string[];
     tpmLimit?: number;
     rpmLimit?: number;
+    userRole?: string;
     metadata?: Record<string, string>;
 }
 export interface CreateUserRequest {
     user_id: string;
     user_email?: string;
+    user_alias?: string;
+    user_role?: string;
     max_budget?: number;
     budget_duration?: string;
     models?: string[];
@@ -165,6 +197,7 @@ export interface CreateUserRequest {
     tpm_limit?: number;
     rpm_limit?: number;
     metadata?: Record<string, string>;
+    auto_create_key?: boolean;
 }
 export interface CreateUserResponse {
     user_id: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -23,8 +23,8 @@
     "config.d.ts"
   ],
   "scripts": {
-    "build": "echo 'Build dist/ from Backstage monorepo: backstage-cli package build'",
-    "prepack": "echo 'Dist files must be built in Backstage monorepo and copied here'",
+    "build": "node build.js && tsc -p tsconfig.json",
+    "prepack": "npm run build",
     "postpack": ""
   },
   "dependencies": {