@acarmisc/backstage-plugin-litellm-backend 0.21.0 → 0.23.0

package/dist/router.js

@@ -56,6 +56,7 @@ const opencode_2 = require("./routes/opencode");
 const teams_1 = require("./routes/teams");
 const objectPermissions_1 = require("./routes/objectPermissions");
 const teamUsage_1 = require("./routes/teamUsage");
+const insights_1 = require("./routes/insights");
 const bridge_1 = require("./routes/bridge");
 const teamFetch_1 = require("./http/teamFetch");
 async function createRouter(options) {
@@ -311,7 +312,7 @@ async function createRouter(options) {
     // string or body — so service/external principals (and anonymous callers)
     // are rejected instead of being allowed to name an arbitrary user_id.
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
-    router.use(['/user/info', '/keys', '/usage'], requireUser);
+    router.use(['/user/info', '/keys', '/usage', '/insights'], requireUser);
     // Register config routes (/health, /config, /openapi.json, /provisioning/preview)
     (0, config_1.registerConfigRoutes)(router, ctx);
     (0, keys_1.registerKeysRoutes)(router, ctx);
@@ -319,6 +320,7 @@ async function createRouter(options) {
     (0, teams_1.registerTeamsRoutes)(router, ctx);
     (0, objectPermissions_1.registerObjectPermissionsRoutes)(router, ctx);
     (0, teamUsage_1.registerTeamUsageRoutes)(router, ctx);
+    (0, insights_1.registerInsightsRoutes)(router, ctx);
     (0, bridge_1.registerBridgeRoutes)(router, ctx, { config, tokenVerifier: options.tokenVerifier });
     return router;
 }

package/dist/routes/insights.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import type { RouterContext } from './context';
+export declare function registerInsightsRoutes(router: Router, ctx: RouterContext): void;

package/dist/routes/insights.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerInsightsRoutes = registerInsightsRoutes;
+const provisioning_1 = require("../provisioning");
+const errors_1 = require("../errors");
+const withUser_1 = require("./middleware/withUser");
+function registerInsightsRoutes(router, ctx) {
+    const { client, catalogClient, auth, logger, auditGroup } = ctx;
+    const requireUser = (0, withUser_1.createRequireUser)(ctx);
+    router.get('/insights/spend-logs', requireUser, async (req, res) => {
+        try {
+            const { start_date, end_date, userId, teamId, page, page_size } = req.query;
+            if (!start_date || !end_date) {
+                res.status(400).json({ error: 'start_date and end_date are required' });
+                return;
+            }
+            const tokenEntityRef = res.locals.tokenEntityRef;
+            await (0, withUser_1.getProvisionedUser)(ctx, res);
+            const callerId = res.locals.userId;
+            const isAudit = auditGroup
+                ? await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, auditGroup, catalogClient, auth, logger)
+                : false;
+            // Server-side scoping: only audit-group members may query other
+            // users/teams — everyone else is forced to their own user_id.
+            const result = await client.getSpendLogs({
+                startDate: start_date,
+                endDate: end_date,
+                userId: isAudit ? userId || callerId : callerId,
+                teamId: isAudit ? teamId : undefined,
+                page: page ? Number(page) : undefined,
+                pageSize: page_size ? Number(page_size) : undefined,
+            });
+            res.json(result);
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            (0, errors_1.sendError)(res, error, logger, 'fetch spend logs');
+        }
+    });
+}

package/dist/routes/opencode.js

@@ -149,6 +149,13 @@ function registerOpencodeRoutes(router, ctx) {
                     .catch(() => []);
                 // Find a healthy existing key (not blocked).
                 const reusable = existing.find(k => k.key_alias === alias && !k.blocked && k.user_id === userId);
+                // The gateway requires MCP access on the key itself (require_key_mcp_access_defined), and a
+                // key may only list what its team has: copy the team's MCP servers so local clients get
+                // the team's tools. A team lookup failure only costs the tools, never the connection.
+                const teamPerm = teamId ? (await client.getTeamInfo(teamId).catch(() => undefined))?.object_permission : undefined;
+                const mcp = teamPerm?.mcp_servers?.length || teamPerm?.mcp_access_groups?.length
+                    ? { mcp_servers: teamPerm.mcp_servers ?? [], mcp_access_groups: teamPerm.mcp_access_groups ?? [] }
+                    : undefined;
                 // Mint a brand-new key bound to this user (and team) under the slot alias.
                 const mintNewKey = async () => {
                     const profile = await (0, provisioning_1.resolveUserProfile)(tokenEntityRef, catalogClient, auth, logger);
@@ -166,6 +173,7 @@ function registerOpencodeRoutes(router, ctx) {
                             ...(teamId && { opencode_team: teamId }),
                         },
                         user_id: userId,
+                        ...(mcp && { object_permission: mcp }),
                     });
                     return result.key;
                 };
@@ -177,6 +185,10 @@ function registerOpencodeRoutes(router, ctx) {
                         // Rotate the existing key in place via LiteLLM's key regeneration.
                         key = (await client.regenerateKey(keyHashOrId)).key;
                         rotated = true;
+                        // Rotation keeps the old permissions: refresh them so team MCP changes arrive too.
+                        // object_permission is not in the shared UpdateKeyRequest type yet (common 0.2.0).
+                        if (key && mcp)
+                            await client.updateKey({ key, object_permission: mcp });
                     }
                     catch (err) {
                         // Key regeneration isn't available on every LiteLLM edition. Only

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type TeamMemberUsage,\n  type TeamMemberUsageRow,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type TeamMemberUsage,\n  type TeamMemberUsageRow,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n  type SpendLogEntry,\n  type SpendLogsParams,\n  type PaginatedSpendLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export { type UserInfo, type TeamMember, type TeamObjectPermission, type TeamInfo, type CreateTeamResponse, type VirtualKey, type ModelInfo, type UsageModelBreakdown, type UsageKeyBreakdown, type UsageDailyPoint, type UsageDailyModelPoint, type UsageMetrics, type TeamMemberUsage, type TeamMemberUsageRow, type GenerateKeyRequest, type UpdateKeyRequest, type GenerateKeyResponse, type AuditLogEntry, type PaginatedAuditLogs, } from '@acarmisc/backstage-plugin-litellm-common';
+export { type UserInfo, type TeamMember, type TeamObjectPermission, type TeamInfo, type CreateTeamResponse, type VirtualKey, type ModelInfo, type UsageModelBreakdown, type UsageKeyBreakdown, type UsageDailyPoint, type UsageDailyModelPoint, type UsageMetrics, type TeamMemberUsage, type TeamMemberUsageRow, type GenerateKeyRequest, type UpdateKeyRequest, type GenerateKeyResponse, type AuditLogEntry, type PaginatedAuditLogs, type SpendLogEntry, type SpendLogsParams, type PaginatedSpendLogs, } from '@acarmisc/backstage-plugin-litellm-common';
 export interface CreateTeamRequest {
     team_alias: string;
     models?: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -35,7 +35,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@acarmisc/backstage-plugin-litellm-common": "0.2.0",
+    "@acarmisc/backstage-plugin-litellm-common": "0.3.0",
     "@backstage/backend-plugin-api": "^1.9.1",
     "@backstage/catalog-client": "^1.9.0",
     "@backstage/config": "^1.3.0",