@acarmisc/backstage-plugin-litellm-backend 0.27.0 → 0.28.0

package/config.d.ts

@@ -463,6 +463,8 @@ export interface Config {
        * reaches:
        *   - managers of the team (members of its metadata.owning_group, with
        *     team management enabled);
+       *   - team leads (members of the catalog group `<team_alias><leadGroupSuffix>`,
+       *     when leadGroupSuffix is set);
        *   - members of the team holding one of `viewerRoles` in it;
        *   - members of the team granted `litellm.team.usage.read` (only
        *     consulted when permission.enabled is true).
@@ -480,6 +482,13 @@ export interface Config {
          * @default []
          */
         viewerRoles?: string[];
+
+        /**
+         * Suffix of a catalog group named `<team_alias><suffix>` whose members
+         * are team leads (e.g. "-leads" -> group:default/abstrid-leads). For
+         * teams synced without metadata.owning_group. Unset: no lead access.
+         */
+        leadGroupSuffix?: string;
       };
     };
 

package/dist/index.cjs.js

@@ -9449,7 +9449,8 @@ function readMemberBreakdownConfig(config) {
   return {
     enabled: config.getOptionalBoolean("litellm.teamUsage.memberBreakdown.enabled") ?? false,
     viewerRoles: config.getOptionalStringArray("litellm.teamUsage.memberBreakdown.viewerRoles") ?? [],
-    permissionEnabled: config.getOptionalBoolean("permission.enabled") ?? false
+    permissionEnabled: config.getOptionalBoolean("permission.enabled") ?? false,
+    leadGroupSuffix: config.getOptionalString("litellm.teamUsage.memberBreakdown.leadGroupSuffix") || void 0
   };
 }
 function memberEmails(team, keys) {
@@ -11521,6 +11522,22 @@ function registerTeamUsageRoutes(router, ctx) {
     teamBudgetVisibility
   } = ctx;
   const requireUser = createRequireUser(ctx);
+  async function isTeamManager(team, tokenEntityRef) {
+    const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
+    if (ctx.teamMgmtEnabled && owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger)) {
+      return true;
+    }
+    const suffix = ctx.memberBreakdownCfg.leadGroupSuffix;
+    if (!suffix || !team.team_alias) return false;
+    const slug = team.team_alias.toLowerCase().replace(/[^a-z0-9\-_.]/g, "-");
+    return isUserMemberOfGroup(
+      tokenEntityRef,
+      `group:default/${slug}${suffix}`,
+      catalogClient,
+      auth,
+      logger
+    );
+  }
   router.get("/teams/:teamId/usage", requireUser, async (req, res) => {
     try {
       const { teamId } = req.params;
@@ -11533,20 +11550,11 @@ function registerTeamUsageRoutes(router, ctx) {
       const userInfo = await getProvisionedUser(ctx, res);
       const isMember = userInfo?.teams?.includes(teamId) ?? false;
       let isManager = false;
-      const managerCheckNeeded = ctx.teamMgmtEnabled && (!isMember || teamBudgetVisibility.hideTeamBudgetForMembers !== teamBudgetVisibility.hideTeamBudgetForManagers);
+      const managerCheckNeeded = (ctx.teamMgmtEnabled || !!ctx.memberBreakdownCfg.leadGroupSuffix) && (!isMember || teamBudgetVisibility.hideTeamBudgetForMembers !== teamBudgetVisibility.hideTeamBudgetForManagers);
       if (managerCheckNeeded) {
         try {
           const team = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-          const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
-          if (owningGroup) {
-            isManager = await isUserMemberOfGroup(
-              tokenEntityRef,
-              owningGroup,
-              catalogClient,
-              auth,
-              logger
-            );
-          }
+          isManager = await isTeamManager(team, tokenEntityRef);
         } catch (err) {
           const message2 = err instanceof Error ? err.message : String(err);
           logger.warn(`Team-manager check failed: ${message2}`);
@@ -11600,8 +11608,7 @@ function registerTeamUsageRoutes(router, ctx) {
       }
       throw err;
     }
-    const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
-    const isManager = ctx.teamMgmtEnabled && !!owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger);
+    const isManager = await isTeamManager(team, tokenEntityRef);
     if (!isMember && !isManager) {
       res.status(404).json({ error: "Team not found" });
       return null;