@acarmisc/backstage-plugin-litellm-backend 0.22.0 → 0.23.0

package/dist/router.js

@@ -56,6 +56,7 @@ const opencode_2 = require("./routes/opencode");
 const teams_1 = require("./routes/teams");
 const objectPermissions_1 = require("./routes/objectPermissions");
 const teamUsage_1 = require("./routes/teamUsage");
+const insights_1 = require("./routes/insights");
 const bridge_1 = require("./routes/bridge");
 const teamFetch_1 = require("./http/teamFetch");
 async function createRouter(options) {
@@ -311,7 +312,7 @@ async function createRouter(options) {
     // string or body — so service/external principals (and anonymous callers)
     // are rejected instead of being allowed to name an arbitrary user_id.
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
-    router.use(['/user/info', '/keys', '/usage'], requireUser);
+    router.use(['/user/info', '/keys', '/usage', '/insights'], requireUser);
     // Register config routes (/health, /config, /openapi.json, /provisioning/preview)
     (0, config_1.registerConfigRoutes)(router, ctx);
     (0, keys_1.registerKeysRoutes)(router, ctx);
@@ -319,6 +320,7 @@ async function createRouter(options) {
     (0, teams_1.registerTeamsRoutes)(router, ctx);
     (0, objectPermissions_1.registerObjectPermissionsRoutes)(router, ctx);
     (0, teamUsage_1.registerTeamUsageRoutes)(router, ctx);
+    (0, insights_1.registerInsightsRoutes)(router, ctx);
     (0, bridge_1.registerBridgeRoutes)(router, ctx, { config, tokenVerifier: options.tokenVerifier });
     return router;
 }

package/dist/routes/insights.d.ts

@@ -0,0 +1,3 @@
+import { Router } from 'express';
+import type { RouterContext } from './context';
+export declare function registerInsightsRoutes(router: Router, ctx: RouterContext): void;

package/dist/routes/insights.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerInsightsRoutes = registerInsightsRoutes;
+const provisioning_1 = require("../provisioning");
+const errors_1 = require("../errors");
+const withUser_1 = require("./middleware/withUser");
+function registerInsightsRoutes(router, ctx) {
+    const { client, catalogClient, auth, logger, auditGroup } = ctx;
+    const requireUser = (0, withUser_1.createRequireUser)(ctx);
+    router.get('/insights/spend-logs', requireUser, async (req, res) => {
+        try {
+            const { start_date, end_date, userId, teamId, page, page_size } = req.query;
+            if (!start_date || !end_date) {
+                res.status(400).json({ error: 'start_date and end_date are required' });
+                return;
+            }
+            const tokenEntityRef = res.locals.tokenEntityRef;
+            await (0, withUser_1.getProvisionedUser)(ctx, res);
+            const callerId = res.locals.userId;
+            const isAudit = auditGroup
+                ? await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, auditGroup, catalogClient, auth, logger)
+                : false;
+            // Server-side scoping: only audit-group members may query other
+            // users/teams — everyone else is forced to their own user_id.
+            const result = await client.getSpendLogs({
+                startDate: start_date,
+                endDate: end_date,
+                userId: isAudit ? userId || callerId : callerId,
+                teamId: isAudit ? teamId : undefined,
+                page: page ? Number(page) : undefined,
+                pageSize: page_size ? Number(page_size) : undefined,
+            });
+            res.json(result);
+        }
+        catch (error) {
+            if (error instanceof provisioning_1.ProvisioningError) {
+                res.status(error.status).json(error.body);
+                return;
+            }
+            (0, errors_1.sendError)(res, error, logger, 'fetch spend logs');
+        }
+    });
+}

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type TeamMemberUsage,\n  type TeamMemberUsageRow,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type TeamMemberUsage,\n  type TeamMemberUsageRow,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n  type SpendLogEntry,\n  type SpendLogsParams,\n  type PaginatedSpendLogs,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -1,4 +1,4 @@
-export { type UserInfo, type TeamMember, type TeamObjectPermission, type TeamInfo, type CreateTeamResponse, type VirtualKey, type ModelInfo, type UsageModelBreakdown, type UsageKeyBreakdown, type UsageDailyPoint, type UsageDailyModelPoint, type UsageMetrics, type TeamMemberUsage, type TeamMemberUsageRow, type GenerateKeyRequest, type UpdateKeyRequest, type GenerateKeyResponse, type AuditLogEntry, type PaginatedAuditLogs, } from '@acarmisc/backstage-plugin-litellm-common';
+export { type UserInfo, type TeamMember, type TeamObjectPermission, type TeamInfo, type CreateTeamResponse, type VirtualKey, type ModelInfo, type UsageModelBreakdown, type UsageKeyBreakdown, type UsageDailyPoint, type UsageDailyModelPoint, type UsageMetrics, type TeamMemberUsage, type TeamMemberUsageRow, type GenerateKeyRequest, type UpdateKeyRequest, type GenerateKeyResponse, type AuditLogEntry, type PaginatedAuditLogs, type SpendLogEntry, type SpendLogsParams, type PaginatedSpendLogs, } from '@acarmisc/backstage-plugin-litellm-common';
 export interface CreateTeamRequest {
     team_alias: string;
     models?: string[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -35,7 +35,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@acarmisc/backstage-plugin-litellm-common": "0.2.0",
+    "@acarmisc/backstage-plugin-litellm-common": "0.3.0",
     "@backstage/backend-plugin-api": "^1.9.1",
     "@backstage/catalog-client": "^1.9.0",
     "@backstage/config": "^1.3.0",