@acarmisc/backstage-plugin-litellm-backend 0.26.1 → 0.28.0

package/config.d.ts

@@ -463,6 +463,8 @@ export interface Config {
        * reaches:
        *   - managers of the team (members of its metadata.owning_group, with
        *     team management enabled);
+       *   - team leads (members of the catalog group `<team_alias><leadGroupSuffix>`,
+       *     when leadGroupSuffix is set);
        *   - members of the team holding one of `viewerRoles` in it;
        *   - members of the team granted `litellm.team.usage.read` (only
        *     consulted when permission.enabled is true).
@@ -480,6 +482,13 @@ export interface Config {
          * @default []
          */
         viewerRoles?: string[];
+
+        /**
+         * Suffix of a catalog group named `<team_alias><suffix>` whose members
+         * are team leads (e.g. "-leads" -> group:default/abstrid-leads). For
+         * teams synced without metadata.owning_group. Unset: no lead access.
+         */
+        leadGroupSuffix?: string;
       };
     };
 

package/dist/index.cjs.js

@@ -9449,7 +9449,8 @@ function readMemberBreakdownConfig(config) {
   return {
     enabled: config.getOptionalBoolean("litellm.teamUsage.memberBreakdown.enabled") ?? false,
     viewerRoles: config.getOptionalStringArray("litellm.teamUsage.memberBreakdown.viewerRoles") ?? [],
-    permissionEnabled: config.getOptionalBoolean("permission.enabled") ?? false
+    permissionEnabled: config.getOptionalBoolean("permission.enabled") ?? false,
+    leadGroupSuffix: config.getOptionalString("litellm.teamUsage.memberBreakdown.leadGroupSuffix") || void 0
   };
 }
 function memberEmails(team, keys) {
@@ -9530,6 +9531,47 @@ function redactTeamMemberUsage(usage) {
     members: usage.members.map((m) => ({ ...m, spend: 0 }))
   };
 }
+function buildTeamKeyUsage(teamId, usage, keys, team, profiles = /* @__PURE__ */ new Map()) {
+  const emailById = /* @__PURE__ */ new Map();
+  for (const m of team.members_with_roles ?? []) {
+    if (m.user_id && m.user_email) emailById.set(m.user_id, m.user_email);
+  }
+  const rows = keys.map((k) => {
+    const u = k.token && usage.usage_by_key?.[k.token] || void 0;
+    const userId = k.user_id ?? null;
+    const email = userId && emailById.get(userId) || (userId?.includes("@") ? userId : void 0);
+    const displayName = email && profiles.get(email.toLowerCase())?.displayName;
+    return {
+      key: k.key,
+      ...k.key_alias && { key_alias: k.key_alias },
+      user_id: userId,
+      ...email && { user_email: email },
+      ...displayName && { display_name: displayName },
+      created_at: k.created_at,
+      ...k.expires_at && { expires_at: k.expires_at },
+      blocked: k.blocked === true,
+      ...k.max_budget !== void 0 && { max_budget: k.max_budget },
+      spend: u?.total_spend ?? 0,
+      prompt_tokens: u?.prompt_tokens ?? 0,
+      completion_tokens: u?.completion_tokens ?? 0,
+      total_tokens: u?.total_tokens ?? 0,
+      api_requests: u?.api_requests ?? 0,
+      successful_requests: u?.successful_requests ?? 0,
+      failed_requests: u?.failed_requests ?? 0
+    };
+  });
+  rows.sort(
+    (a, b) => b.spend - a.spend || b.total_tokens - a.total_tokens || a.key.localeCompare(b.key)
+  );
+  return { team_id: teamId, keys: rows };
+}
+function redactTeamKeyUsage(usage) {
+  return {
+    ...usage,
+    budget_hidden: true,
+    keys: usage.keys.map(({ max_budget: _hidden, ...k }) => ({ ...k, spend: 0 }))
+  };
+}
 
 // src/langfuse.ts
 function readLangfuseConfig(config) {
@@ -11480,6 +11522,22 @@ function registerTeamUsageRoutes(router, ctx) {
     teamBudgetVisibility
   } = ctx;
   const requireUser = createRequireUser(ctx);
+  async function isTeamManager(team, tokenEntityRef) {
+    const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
+    if (ctx.teamMgmtEnabled && owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger)) {
+      return true;
+    }
+    const suffix = ctx.memberBreakdownCfg.leadGroupSuffix;
+    if (!suffix || !team.team_alias) return false;
+    const slug = team.team_alias.toLowerCase().replace(/[^a-z0-9\-_.]/g, "-");
+    return isUserMemberOfGroup(
+      tokenEntityRef,
+      `group:default/${slug}${suffix}`,
+      catalogClient,
+      auth,
+      logger
+    );
+  }
   router.get("/teams/:teamId/usage", requireUser, async (req, res) => {
     try {
       const { teamId } = req.params;
@@ -11492,20 +11550,11 @@ function registerTeamUsageRoutes(router, ctx) {
       const userInfo = await getProvisionedUser(ctx, res);
       const isMember = userInfo?.teams?.includes(teamId) ?? false;
       let isManager = false;
-      const managerCheckNeeded = ctx.teamMgmtEnabled && (!isMember || teamBudgetVisibility.hideTeamBudgetForMembers !== teamBudgetVisibility.hideTeamBudgetForManagers);
+      const managerCheckNeeded = (ctx.teamMgmtEnabled || !!ctx.memberBreakdownCfg.leadGroupSuffix) && (!isMember || teamBudgetVisibility.hideTeamBudgetForMembers !== teamBudgetVisibility.hideTeamBudgetForManagers);
       if (managerCheckNeeded) {
         try {
           const team = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-          const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
-          if (owningGroup) {
-            isManager = await isUserMemberOfGroup(
-              tokenEntityRef,
-              owningGroup,
-              catalogClient,
-              auth,
-              logger
-            );
-          }
+          isManager = await isTeamManager(team, tokenEntityRef);
         } catch (err) {
           const message2 = err instanceof Error ? err.message : String(err);
           logger.warn(`Team-manager check failed: ${message2}`);
@@ -11533,60 +11582,76 @@ function registerTeamUsageRoutes(router, ctx) {
       sendError(res, error, logger, "fetch team usage");
     }
   });
-  router.get("/teams/:teamId/usage/members", requireUser, async (req, res) => {
+  async function authorizeMemberView(req, res) {
     const cfg = ctx.memberBreakdownCfg;
     if (!cfg.enabled) {
       res.status(404).json({ error: "Not found" });
-      return;
+      return null;
+    }
+    const { teamId } = req.params;
+    const { start_date, end_date } = req.query;
+    if (!start_date || !end_date) {
+      res.status(400).json({ error: "start_date and end_date are required" });
+      return null;
     }
+    const tokenEntityRef = res.locals.tokenEntityRef;
+    const userInfo = await getProvisionedUser(ctx, res);
+    const callerId = res.locals.userId;
+    const isMember = userInfo?.teams?.includes(teamId) ?? false;
+    let team;
     try {
-      const { teamId } = req.params;
-      const { start_date, end_date } = req.query;
-      if (!start_date || !end_date) {
-        res.status(400).json({ error: "start_date and end_date are required" });
-        return;
-      }
-      const tokenEntityRef = res.locals.tokenEntityRef;
-      const userInfo = await getProvisionedUser(ctx, res);
-      const callerId = res.locals.userId;
-      const isMember = userInfo?.teams?.includes(teamId) ?? false;
-      let team;
-      try {
-        team = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-      } catch (err) {
-        if (err instanceof LiteLLMUpstreamError && err.status === 404) {
-          res.status(404).json({ error: "Team not found" });
-          return;
-        }
-        throw err;
-      }
-      const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
-      const isManager = ctx.teamMgmtEnabled && !!owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger);
-      if (!isMember && !isManager) {
+      team = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
+    } catch (err) {
+      if (err instanceof LiteLLMUpstreamError && err.status === 404) {
         res.status(404).json({ error: "Team not found" });
-        return;
-      }
-      const role = team.members_with_roles?.find((m) => m.user_id === callerId)?.role;
-      const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
-      const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common8.litellmTeamUsageReadPermission);
-      if (!allowed) {
-        res.status(403).json({
-          error: "Access denied: viewing per-member usage needs a team role or permission"
-        });
-        return;
+        return null;
       }
+      throw err;
+    }
+    const isManager = await isTeamManager(team, tokenEntityRef);
+    if (!isMember && !isManager) {
+      res.status(404).json({ error: "Team not found" });
+      return null;
+    }
+    const role = team.members_with_roles?.find((m) => m.user_id === callerId)?.role;
+    const viaRole = isMember && !!role && cfg.viewerRoles.includes(role);
+    const allowed = isManager || viaRole || isMember && cfg.permissionEnabled && await ctx.assertPermission(req, import_backstage_plugin_litellm_common8.litellmTeamUsageReadPermission);
+    if (!allowed) {
+      res.status(403).json({
+        error: "Access denied: viewing per-member usage needs a team role or permission"
+      });
+      return null;
+    }
+    let via = "permission";
+    if (isManager) via = "manager";
+    else if (viaRole) via = "teamRole";
+    return {
+      teamId,
+      team,
+      startDate: start_date,
+      endDate: end_date,
+      isManager,
+      via
+    };
+  }
+  const hideFor = (isManager) => isManager ? teamBudgetVisibility.hideTeamBudgetForManagers : teamBudgetVisibility.hideTeamBudgetForMembers;
+  router.get("/teams/:teamId/usage/members", requireUser, async (req, res) => {
+    try {
+      const gate = await authorizeMemberView(req, res);
+      if (!gate) return;
+      const { teamId, team, startDate, endDate, isManager, via } = gate;
       const [usage, keys] = await Promise.all([
-        client.getTeamUsage(teamId, start_date, end_date),
+        client.getTeamUsage(teamId, startDate, endDate),
         client.listTeamKeys(teamId)
       ]);
       const profiles = await lookupProfiles(memberEmails(team, keys));
       const breakdown = buildTeamMemberUsage(teamId, usage, keys, team, profiles);
-      let via = "permission";
-      if (isManager) via = "manager";
-      else if (viaRole) via = "teamRole";
-      logger.info("team.usage.members.read", { actor: tokenEntityRef, teamId, via });
-      const hide = isManager ? teamBudgetVisibility.hideTeamBudgetForManagers : teamBudgetVisibility.hideTeamBudgetForMembers;
-      res.json(hide ? redactTeamMemberUsage(breakdown) : breakdown);
+      logger.info("team.usage.members.read", {
+        actor: res.locals.tokenEntityRef,
+        teamId,
+        via
+      });
+      res.json(hideFor(isManager) ? redactTeamMemberUsage(breakdown) : breakdown);
     } catch (error) {
       if (error instanceof ProvisioningError) {
         res.status(error.status).json(error.body);
@@ -11595,6 +11660,31 @@ function registerTeamUsageRoutes(router, ctx) {
       sendError(res, error, logger, "fetch team member usage");
     }
   });
+  router.get("/teams/:teamId/usage/keys", requireUser, async (req, res) => {
+    try {
+      const gate = await authorizeMemberView(req, res);
+      if (!gate) return;
+      const { teamId, team, startDate, endDate, isManager, via } = gate;
+      const [usage, keys] = await Promise.all([
+        client.getTeamUsage(teamId, startDate, endDate),
+        client.listTeamKeys(teamId)
+      ]);
+      const profiles = await lookupProfiles(memberEmails(team, keys));
+      const keyUsage = buildTeamKeyUsage(teamId, usage, keys, team, profiles);
+      logger.info("team.usage.keys.read", {
+        actor: res.locals.tokenEntityRef,
+        teamId,
+        via
+      });
+      res.json(hideFor(isManager) ? redactTeamKeyUsage(keyUsage) : keyUsage);
+    } catch (error) {
+      if (error instanceof ProvisioningError) {
+        res.status(error.status).json(error.body);
+        return;
+      }
+      sendError(res, error, logger, "fetch team key usage");
+    }
+  });
   async function lookupProfiles(emails) {
     const profiles = /* @__PURE__ */ new Map();
     if (!emails.length) return profiles;