@acarmisc/backstage-plugin-litellm-backend 0.20.0 → 0.22.0

package/dist/opencode.d.ts

@@ -19,6 +19,11 @@ export interface OpencodeConfig {
     keyDuration: string;
     /** Default max budget (USD) for keys created via the connect flow. Default 50. */
     maxBudget: number;
+    /**
+     * Reset period of maxBudget (e.g. "30d"). Unset: maxBudget covers the key's whole life,
+     * which runs out early on long-lived keys.
+     */
+    budgetDuration?: string;
     /**
      * When true, a team query parameter must reference a team the user is a
      * member of (or manage); otherwise the key is personal-only.

package/dist/opencode.js

@@ -7,6 +7,7 @@ function readOpencodeConfig(config) {
         enabled,
         keyDuration: config.getOptionalString('litellm.opencode.keyDuration') ?? '30d',
         maxBudget: config.getOptionalNumber('litellm.opencode.maxBudget') ?? 50,
+        budgetDuration: config.getOptionalString('litellm.opencode.budgetDuration'),
         requireTeam: config.getOptionalBoolean('litellm.opencode.requireTeam') ?? false,
         metadata: config.getOptional('litellm.opencode.metadata') ?? {},
     };

package/dist/routes/opencode.js

@@ -149,6 +149,13 @@ function registerOpencodeRoutes(router, ctx) {
                     .catch(() => []);
                 // Find a healthy existing key (not blocked).
                 const reusable = existing.find(k => k.key_alias === alias && !k.blocked && k.user_id === userId);
+                // The gateway requires MCP access on the key itself (require_key_mcp_access_defined), and a
+                // key may only list what its team has: copy the team's MCP servers so local clients get
+                // the team's tools. A team lookup failure only costs the tools, never the connection.
+                const teamPerm = teamId ? (await client.getTeamInfo(teamId).catch(() => undefined))?.object_permission : undefined;
+                const mcp = teamPerm?.mcp_servers?.length || teamPerm?.mcp_access_groups?.length
+                    ? { mcp_servers: teamPerm.mcp_servers ?? [], mcp_access_groups: teamPerm.mcp_access_groups ?? [] }
+                    : undefined;
                 // Mint a brand-new key bound to this user (and team) under the slot alias.
                 const mintNewKey = async () => {
                     const profile = await (0, provisioning_1.resolveUserProfile)(tokenEntityRef, catalogClient, auth, logger);
@@ -156,6 +163,7 @@ function registerOpencodeRoutes(router, ctx) {
                         alias,
                         duration: opencodeCfg.keyDuration,
                         max_budget: opencodeCfg.maxBudget,
+                        ...(opencodeCfg.budgetDuration && { budget_duration: opencodeCfg.budgetDuration }),
                         team_id: teamId,
                         metadata: {
                             ...opencodeCfg.metadata,
@@ -165,6 +173,7 @@ function registerOpencodeRoutes(router, ctx) {
                             ...(teamId && { opencode_team: teamId }),
                         },
                         user_id: userId,
+                        ...(mcp && { object_permission: mcp }),
                     });
                     return result.key;
                 };
@@ -176,6 +185,10 @@ function registerOpencodeRoutes(router, ctx) {
                         // Rotate the existing key in place via LiteLLM's key regeneration.
                         key = (await client.regenerateKey(keyHashOrId)).key;
                         rotated = true;
+                        // Rotation keeps the old permissions: refresh them so team MCP changes arrive too.
+                        // object_permission is not in the shared UpdateKeyRequest type yet (common 0.2.0).
+                        if (key && mcp)
+                            await client.updateKey({ key, object_permission: mcp });
                     }
                     catch (err) {
                         // Key regeneration isn't available on every LiteLLM edition. Only
@@ -202,15 +215,18 @@ function registerOpencodeRoutes(router, ctx) {
                     res.status(502).json({ error: 'LiteLLM returned no key material' });
                     return;
                 }
+                logger.info('opencode.connect', { userId, team: teamId ?? null, rotated });
+                // The Backstage connect page calls this with fetchApi (JSON + Bearer) and does the
+                // loopback redirect itself, so it can collect one key per team in a single trip.
+                if (req.is('application/json')) {
+                    res.set('Cache-Control', 'no-store');
+                    res.json({ key, team: teamId ?? null });
+                    return;
+                }
                 const url = new URL(redirectUri);
                 url.searchParams.set('key', key);
                 if (teamId)
                     url.searchParams.set('team', teamId);
-                logger.info('opencode.connect', {
-                    userId,
-                    team: teamId ?? null,
-                    rotated,
-                });
                 res.redirect(302, url.href);
             }
             catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",