@acarmisc/backstage-plugin-litellm-backend 0.26.1 → 0.27.0

package/dist/index.cjs.js

@@ -9530,6 +9530,47 @@ function redactTeamMemberUsage(usage) {
     members: usage.members.map((m) => ({ ...m, spend: 0 }))
   };
 }
+function buildTeamKeyUsage(teamId, usage, keys, team, profiles = /* @__PURE__ */ new Map()) {
+  const emailById = /* @__PURE__ */ new Map();
+  for (const m of team.members_with_roles ?? []) {
+    if (m.user_id && m.user_email) emailById.set(m.user_id, m.user_email);
+  }
+  const rows = keys.map((k) => {
+    const u = k.token && usage.usage_by_key?.[k.token] || void 0;
+    const userId = k.user_id ?? null;
+    const email = userId && emailById.get(userId) || (userId?.includes("@") ? userId : void 0);
+    const displayName = email && profiles.get(email.toLowerCase())?.displayName;
+    return {
+      key: k.key,
+      ...k.key_alias && { key_alias: k.key_alias },
+      user_id: userId,
+      ...email && { user_email: email },
+      ...displayName && { display_name: displayName },
+      created_at: k.created_at,
+      ...k.expires_at && { expires_at: k.expires_at },
+      blocked: k.blocked === true,
+      ...k.max_budget !== void 0 && { max_budget: k.max_budget },
+      spend: u?.total_spend ?? 0,
+      prompt_tokens: u?.prompt_tokens ?? 0,
+      completion_tokens: u?.completion_tokens ?? 0,
+      total_tokens: u?.total_tokens ?? 0,
+      api_requests: u?.api_requests ?? 0,
+      successful_requests: u?.successful_requests ?? 0,
+      failed_requests: u?.failed_requests ?? 0
+    };
+  });
+  rows.sort(
+    (a, b) => b.spend - a.spend || b.total_tokens - a.total_tokens || a.key.localeCompare(b.key)
+  );
+  return { team_id: teamId, keys: rows };
+}
+function redactTeamKeyUsage(usage) {
+  return {
+    ...usage,
+    budget_hidden: true,
+    keys: usage.keys.map(({ max_budget: _hidden, ...k }) => ({ ...k, spend: 0 }))
+  };
+}
 
 // src/langfuse.ts
 function readLangfuseConfig(config) {
@@ -11533,60 +11574,77 @@ function registerTeamUsageRoutes(router, ctx) {
       sendError(res, error, logger, "fetch team usage");
     }
   });
-  router.get("/teams/:teamId/usage/members", requireUser, async (req, res) => {
+  async function authorizeMemberView(req, res) {
     const cfg = ctx.memberBreakdownCfg;
     if (!cfg.enabled) {
       res.status(404).json({ error: "Not found" });
-      return;
+      return null;
+    }
+    const { teamId } = req.params;
+    const { start_date, end_date } = req.query;
+    if (!start_date || !end_date) {
+      res.status(400).json({ error: "start_date and end_date are required" });
+      return null;
     }
+    const tokenEntityRef = res.locals.tokenEntityRef;
+    const userInfo = await getProvisionedUser(ctx, res);
+    const callerId = res.locals.userId;
+    const isMember = userInfo?.teams?.includes(teamId) ?? false;
+    let team;
     try {
-      const { teamId } = req.params;
-      const { start_date, end_date } = req.query;
-      if (!start_date || !end_date) {
-        res.status(400).json({ error: "start_date and end_date are required" });
-        return;
-      }
-      const tokenEntityRef = res.locals.tokenEntityRef;
-      const userInfo = await getProvisionedUser(ctx, res);
-      const callerId = res.locals.userId;
-      const isMember = userInfo?.teams?.includes(teamId) ?? false;
-      let team;
-      try {
-        team = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-      } catch (err) {
-        if (err instanceof LiteLLMUpstreamError && err.status === 404) {
-          res.status(404).json({ error: "Team not found" });
-          return;
-        }
-        throw err;
-      }
-      const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
-      const isManager = ctx.teamMgmtEnabled && !!owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger);
-      if (!isMember && !isManager) {
+      team = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
+    } catch (err) {
+      if (err instanceof LiteLLMUpstreamError && err.status === 404) {
         res.status(404).json({ error: "Team not found" });
-        return;
-      }
-      const role = team.members_with_roles?.find((m) => m.user_id === callerId)?.role;
-      const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
-      const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common8.litellmTeamUsageReadPermission);
-      if (!allowed) {
-        res.status(403).json({
-          error: "Access denied: viewing per-member usage needs a team role or permission"
-        });
-        return;
+        return null;
       }
+      throw err;
+    }
+    const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
+    const isManager = ctx.teamMgmtEnabled && !!owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger);
+    if (!isMember && !isManager) {
+      res.status(404).json({ error: "Team not found" });
+      return null;
+    }
+    const role = team.members_with_roles?.find((m) => m.user_id === callerId)?.role;
+    const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
+    const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common8.litellmTeamUsageReadPermission);
+    if (!allowed) {
+      res.status(403).json({
+        error: "Access denied: viewing per-member usage needs a team role or permission"
+      });
+      return null;
+    }
+    let via = "permission";
+    if (isManager) via = "manager";
+    else if (viaRole) via = "teamRole";
+    return {
+      teamId,
+      team,
+      startDate: start_date,
+      endDate: end_date,
+      isManager,
+      via
+    };
+  }
+  const hideFor = (isManager) => isManager ? teamBudgetVisibility.hideTeamBudgetForManagers : teamBudgetVisibility.hideTeamBudgetForMembers;
+  router.get("/teams/:teamId/usage/members", requireUser, async (req, res) => {
+    try {
+      const gate = await authorizeMemberView(req, res);
+      if (!gate) return;
+      const { teamId, team, startDate, endDate, isManager, via } = gate;
       const [usage, keys] = await Promise.all([
-        client.getTeamUsage(teamId, start_date, end_date),
+        client.getTeamUsage(teamId, startDate, endDate),
         client.listTeamKeys(teamId)
       ]);
       const profiles = await lookupProfiles(memberEmails(team, keys));
       const breakdown = buildTeamMemberUsage(teamId, usage, keys, team, profiles);
-      let via = "permission";
-      if (isManager) via = "manager";
-      else if (viaRole) via = "teamRole";
-      logger.info("team.usage.members.read", { actor: tokenEntityRef, teamId, via });
-      const hide = isManager ? teamBudgetVisibility.hideTeamBudgetForManagers : teamBudgetVisibility.hideTeamBudgetForMembers;
-      res.json(hide ? redactTeamMemberUsage(breakdown) : breakdown);
+      logger.info("team.usage.members.read", {
+        actor: res.locals.tokenEntityRef,
+        teamId,
+        via
+      });
+      res.json(hideFor(isManager) ? redactTeamMemberUsage(breakdown) : breakdown);
     } catch (error) {
       if (error instanceof ProvisioningError) {
         res.status(error.status).json(error.body);
@@ -11595,6 +11653,31 @@ function registerTeamUsageRoutes(router, ctx) {
       sendError(res, error, logger, "fetch team member usage");
     }
   });
+  router.get("/teams/:teamId/usage/keys", requireUser, async (req, res) => {
+    try {
+      const gate = await authorizeMemberView(req, res);
+      if (!gate) return;
+      const { teamId, team, startDate, endDate, isManager, via } = gate;
+      const [usage, keys] = await Promise.all([
+        client.getTeamUsage(teamId, startDate, endDate),
+        client.listTeamKeys(teamId)
+      ]);
+      const profiles = await lookupProfiles(memberEmails(team, keys));
+      const keyUsage = buildTeamKeyUsage(teamId, usage, keys, team, profiles);
+      logger.info("team.usage.keys.read", {
+        actor: res.locals.tokenEntityRef,
+        teamId,
+        via
+      });
+      res.json(hideFor(isManager) ? redactTeamKeyUsage(keyUsage) : keyUsage);
+    } catch (error) {
+      if (error instanceof ProvisioningError) {
+        res.status(error.status).json(error.body);
+        return;
+      }
+      sendError(res, error, logger, "fetch team key usage");
+    }
+  });
   async function lookupProfiles(emails) {
     const profiles = /* @__PURE__ */ new Map();
     if (!emails.length) return profiles;