@acarmisc/backstage-plugin-litellm-backend 0.2.1 → 0.3.0

package/dist/router.d.ts

@@ -1,12 +1,18 @@
 import { Router } from 'express';
 import { Config } from '@backstage/config';
 import { AuthService, DiscoveryService } from '@backstage/backend-plugin-api';
+import { LiteLLMClient } from './client';
 import { ProvisioningError } from './provisioning';
+import { TokenVerifier } from './bridge';
 export { ProvisioningError };
 export interface RouterOptions {
     config: Config;
     logger: any;
     auth: AuthService;
     discovery: DiscoveryService;
+    /** Override the LiteLLM client (tests). Defaults to one built from config. */
+    client?: LiteLLMClient;
+    /** Override the bridge token verifier (tests). Defaults to a Keycloak JWKS verifier. */
+    tokenVerifier?: TokenVerifier;
 }
 export declare function createRouter(options: RouterOptions): Promise<Router>;

package/dist/router.js

@@ -40,12 +40,13 @@ const catalog_client_1 = require("@backstage/catalog-client");
 const client_1 = require("./client");
 const provisioning_1 = require("./provisioning");
 Object.defineProperty(exports, "ProvisioningError", { enumerable: true, get: function () { return provisioning_1.ProvisioningError; } });
+const bridge_1 = require("./bridge");
 async function createRouter(options) {
     const { config, logger, auth, discovery } = options;
     const baseUrl = config.getString('litellm.baseUrl');
     const masterKey = config.getString('litellm.masterKey');
     const userIdDomain = config.getOptionalString('litellm.userIdDomain');
-    const client = new client_1.LiteLLMClient({ baseUrl, masterKey });
+    const client = options.client ?? new client_1.LiteLLMClient({ baseUrl, masterKey });
     const { enabled: provisioningEnabled, defaults: provisioningDefaults } = (0, provisioning_1.readProvisioningDefaults)(config);
     const roleConfigs = (0, provisioning_1.readRoleConfigs)(config);
     const catalogClient = new catalog_client_1.CatalogClient({ discoveryApi: discovery });
@@ -270,5 +271,78 @@ async function createRouter(options) {
             res.status(500).json({ error: error.message });
         }
     });
+    // ---------------------------------------------------------------------------
+    // Bridge endpoints (CLI / Abby)
+    //
+    // Authenticated by a Keycloak access token (JWKS-verified), NOT by Backstage's
+    // own auth. Lets CLI clients list/mint virtual keys without holding the master
+    // key. Gated by litellm.bridge.enabled; the verifier needs litellm.bridge.issuer.
+    const bridgeCfg = (0, bridge_1.readBridgeConfig)(config);
+    let tokenVerifier = options.tokenVerifier;
+    if (bridgeCfg.enabled && !tokenVerifier) {
+        try {
+            tokenVerifier = (0, bridge_1.newDefaultVerifier)(bridgeCfg);
+        }
+        catch (e) {
+            logger.error(`LiteLLM bridge enabled but misconfigured: ${e.message}`);
+        }
+    }
+    if (bridgeCfg.enabled && tokenVerifier) {
+        const requireClaims = async (req) => {
+            const header = req.headers.authorization ?? '';
+            const token = header.startsWith('Bearer ') ? header.slice(7) : '';
+            if (!token)
+                throw new bridge_1.BridgeAuthError('missing Bearer token');
+            return tokenVerifier.verify(token);
+        };
+        const handleBridgeError = (error, res) => {
+            if (error instanceof bridge_1.BridgeAuthError) {
+                res.status(401).json({ error: 'unauthorized', hint: error.message });
+                return;
+            }
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            logger.error('Bridge request failed', error);
+            res.status(500).json({ error: error.message });
+        };
+        router.get('/bridge/health', (_req, res) => {
+            res.json({ status: 'ok', bridge: true, clientId: bridgeCfg.clientId });
+        });
+        router.get('/bridge/keys', async (req, res) => {
+            try {
+                const claims = await requireClaims(req);
+                const keys = await (0, bridge_1.bridgeListKeys)(client, claims, provisioningEnabled, provisioningDefaults, logger);
+                res.json(keys);
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
+        router.post('/bridge/keys', async (req, res) => {
+            try {
+                const claims = await requireClaims(req);
+                const result = await (0, bridge_1.bridgeGenerateKey)(client, claims, provisioningEnabled, provisioningDefaults, logger, (req.body ?? {}));
+                res.json(result);
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
+        router.get('/bridge/models', async (req, res) => {
+            try {
+                await requireClaims(req); // authenticate only
+                const models = await client.listModels();
+                res.json(models);
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
+    }
+    else if (bridgeCfg.enabled) {
+        logger.warn('litellm.bridge.enabled is true but no verifier could be built — bridge endpoints not mounted');
+    }
     return router;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -33,13 +33,15 @@
     "@backstage/catalog-model": "^1.7.0",
     "@backstage/config": "^1.3.0",
     "@backstage/types": "^1.2.0",
-    "express": "^4.18.2"
+    "express": "^4.18.2",
+    "jose": "^5.9.6"
   },
   "devDependencies": {
     "@backstage/cli": "^0.36.2",
     "@types/express": "^4.17.25",
     "esbuild": "^0.28.0",
-    "typescript": "^5.9.3"
+    "typescript": "^5.9.3",
+    "@types/node": "^20.0.0"
   },
   "configSchema": "config.d.ts"
-}
+}