@acarmisc/backstage-plugin-litellm-backend 0.24.0 → 0.25.0

package/dist/plugin.js

@@ -13,6 +13,7 @@ const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-li
 exports.BRIDGE_UNAUTHENTICATED_PATHS = [
     '/bridge/health',
     '/bridge/keys',
+    '/bridge/mcp',
     '/bridge/models',
     '/bridge/user/info',
 ];

package/dist/routes/bridge.js

@@ -4,6 +4,7 @@ exports.registerBridgeRoutes = registerBridgeRoutes;
 const provisioning_1 = require("../provisioning");
 const bridge_1 = require("../bridge");
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+const mcpAccess_1 = require("../services/mcpAccess");
 const keyService_1 = require("../services/keyService");
 const errors_1 = require("../errors");
 const backstage_plugin_litellm_common_2 = require("@acarmisc/backstage-plugin-litellm-common");
@@ -175,6 +176,29 @@ function registerBridgeRoutes(router, ctx, bridgeOpts) {
                 handleBridgeError(error, res);
             }
         });
+        // MCP servers the caller's team may use, for CLI clients that let the user
+        // pick which to attach to a new key. team_id is required: unlike models
+        // there is no meaningful unscoped catalogue to hand out.
+        router.get('/bridge/mcp', async (req, res) => {
+            try {
+                const claims = await requireClaims(req);
+                const teamId = typeof req.query.team_id === 'string' ? req.query.team_id : '';
+                if (!teamId) {
+                    res.status(400).json({ error: 'team_id is required' });
+                    return;
+                }
+                const user = await (0, bridge_1.getOrProvisionUserFromClaims)(client, claims, provisioningEnabled, provisioningDefaults, logger, bridgeIdentity);
+                if (!(user.teams ?? []).includes(teamId)) {
+                    res.status(403).json({ error: 'Access denied: team is not one of your teams', team_id: teamId });
+                    return;
+                }
+                const names = (0, mcpAccess_1.teamMcpServers)(await client.getTeamInfo(teamId));
+                res.json(names.map(server_name => ({ server_name })));
+            }
+            catch (error) {
+                handleBridgeError(error, res);
+            }
+        });
     }
     else if (bridgeCfg.enabled) {
         logger.warn('litellm.bridge.enabled is true but no verifier could be built — bridge endpoints not mounted');

package/dist/services/keyService.js

@@ -11,6 +11,7 @@ exports.KeyServiceError = void 0;
 exports.createKeyForUser = createKeyForUser;
 const provisioning_1 = require("../provisioning");
 const modelAccess_1 = require("./modelAccess");
+const mcpAccess_1 = require("./mcpAccess");
 /** Error thrown during key creation — maps to HTTP responses. */
 class KeyServiceError extends Error {
     constructor(status, body, message) {
@@ -58,6 +59,9 @@ async function createKeyForUser(user, input, ctx) {
             });
         }
     }
+    // The team is read at most once per mint, and only if a check needs it.
+    let teamPromise;
+    const getTeam = (teamId) => (teamPromise ?? (teamPromise = client.getTeamInfo(teamId)));
     // ── Validate models are subset of allowed ────────────────────────────
     if (input.models && input.models.length > 0) {
         // When team_id is set, use team's models; otherwise use user's models.
@@ -67,7 +71,7 @@ async function createKeyForUser(user, input, ctx) {
             // Fetch team info to get its allowed models.
             // Fail closed: if the team can't be fetched the error propagates
             // rather than silently skipping the model check.
-            const teamInfo = await client.getTeamInfo(input.team_id);
+            const teamInfo = await getTeam(input.team_id);
             allowedModels = teamInfo?.models ?? [];
         }
         else {
@@ -106,6 +110,23 @@ async function createKeyForUser(user, input, ctx) {
         ...clientMetadata,
         ...serverMetadata,
     };
+    // ── Validate MCP servers are a subset of the team's ──────────────────
+    // [] is "no MCP servers" and needs no team; any name needs a team to be
+    // checked against, so a client cannot grant itself servers it has no
+    // ceiling for.
+    const mcpServers = input.mcp_servers ? [...new Set(input.mcp_servers)] : undefined;
+    if (mcpServers && mcpServers.length > 0) {
+        if (!input.team_id) {
+            throw new KeyServiceError(400, { error: 'team_id is required when mcp_servers is set' });
+        }
+        const disallowed = (0, mcpAccess_1.findDisallowedMcpServers)(mcpServers, (0, mcpAccess_1.teamMcpServers)(await getTeam(input.team_id)));
+        if (disallowed.length > 0) {
+            throw new KeyServiceError(403, {
+                error: 'One or more requested MCP servers are not allowed',
+                disallowed_mcp_servers: disallowed,
+            });
+        }
+    }
     // ── Build upstream request EXPLICITLY from parsed fields ──────────────
     // Never spread the raw body; only include fields we've explicitly validated.
     const upstreamRequest = {
@@ -139,6 +160,11 @@ async function createKeyForUser(user, input, ctx) {
     if (input.key_type !== undefined) {
         upstreamRequest.key_type = input.key_type;
     }
+    if (mcpServers) {
+        upstreamRequest.object_permission = {
+            mcp_servers: mcpServers.length > 0 ? mcpServers : [mcpAccess_1.NO_MCP_SERVERS],
+        };
+    }
     upstreamRequest.metadata = enrichedMetadata;
     // ── Call upstream LiteLLM ───────────────────────────────────────────
     const result = await client.generateKey(upstreamRequest);

package/dist/services/mcpAccess.d.ts

@@ -0,0 +1,20 @@
+/** LiteLLM's documented value that denies every MCP server. */
+export declare const NO_MCP_SERVERS = "no-mcp-servers";
+/**
+ * MCP servers a team may bind to a key: exactly the team's own list, as stored
+ * (LiteLLM accepts a server's name or id interchangeably when enforcing). A team
+ * with no list gets nothing: "empty" means unrestricted to LiteLLM, but a key
+ * list is a grant, so an unrestricted team must not let a member name servers it
+ * was never given. Entries the mint schema would reject are dropped so the
+ * picker never offers an unselectable name.
+ *
+ * shortcut: team `mcp_access_groups` are not expanded into server names; add
+ * that when a team grants MCP access only through groups.
+ */
+export declare function teamMcpServers(team: {
+    object_permission?: {
+        mcp_servers?: string[];
+    };
+} | undefined): string[];
+/** Requested names that are not in `allowed`, de-duplicated. */
+export declare function findDisallowedMcpServers(requested: string[], allowed: string[]): string[];

package/dist/services/mcpAccess.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NO_MCP_SERVERS = void 0;
+exports.teamMcpServers = teamMcpServers;
+exports.findDisallowedMcpServers = findDisallowedMcpServers;
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
+/** LiteLLM's documented value that denies every MCP server. */
+exports.NO_MCP_SERVERS = 'no-mcp-servers';
+/**
+ * MCP servers a team may bind to a key: exactly the team's own list, as stored
+ * (LiteLLM accepts a server's name or id interchangeably when enforcing). A team
+ * with no list gets nothing: "empty" means unrestricted to LiteLLM, but a key
+ * list is a grant, so an unrestricted team must not let a member name servers it
+ * was never given. Entries the mint schema would reject are dropped so the
+ * picker never offers an unselectable name.
+ *
+ * shortcut: team `mcp_access_groups` are not expanded into server names; add
+ * that when a team grants MCP access only through groups.
+ */
+function teamMcpServers(team) {
+    const listed = team?.object_permission?.mcp_servers ?? [];
+    return [...new Set(listed)].filter(n => backstage_plugin_litellm_common_1.MCP_SERVER_NAME_RE.test(n));
+}
+/** Requested names that are not in `allowed`, de-duplicated. */
+function findDisallowedMcpServers(requested, allowed) {
+    const ok = new Set(allowed);
+    return [...new Set(requested)].filter(n => !ok.has(n));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -35,7 +35,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@acarmisc/backstage-plugin-litellm-common": "0.4.0",
+    "@acarmisc/backstage-plugin-litellm-common": "0.5.0",
     "@backstage/backend-plugin-api": "^1.9.1",
     "@backstage/catalog-client": "^1.9.0",
     "@backstage/config": "^1.3.0",