@acarmisc/backstage-plugin-litellm-backend 0.27.0 → 0.28.0

package/dist/routes/teamUsage.js

@@ -12,6 +12,23 @@ const withUser_1 = require("./middleware/withUser");
 function registerTeamUsageRoutes(router, ctx) {
     const { client, catalogClient, auth, logger, teamBudgetVisibility, } = ctx;
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
+    // A team manager: a member of the team's owning group (team management
+    // enabled), or a member of the catalog lead group `<alias><leadGroupSuffix>`
+    // for teams synced without an owning_group.
+    async function isTeamManager(team, tokenEntityRef) {
+        const owningGroup = typeof team.metadata?.owning_group === 'string' ? team.metadata.owning_group : undefined;
+        if (ctx.teamMgmtEnabled &&
+            owningGroup &&
+            (await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, owningGroup, catalogClient, auth, logger))) {
+            return true;
+        }
+        const suffix = ctx.memberBreakdownCfg.leadGroupSuffix;
+        if (!suffix || !team.team_alias)
+            return false;
+        // Same slug rule as the catalog group names: lower-case, other chars become '-'.
+        const slug = team.team_alias.toLowerCase().replace(/[^a-z0-9\-_.]/g, '-');
+        return (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, `group:default/${slug}${suffix}`, catalogClient, auth, logger);
+    }
     router.get('/teams/:teamId/usage', requireUser, async (req, res) => {
         try {
             const { teamId } = req.params;
@@ -25,24 +42,20 @@ function registerTeamUsageRoutes(router, ctx) {
             const userInfo = await (0, withUser_1.getProvisionedUser)(ctx, res);
             // Check membership: user must be in the team OR be a team manager
             const isMember = userInfo?.teams?.includes(teamId) ?? false;
-            // A "manager" administers this specific team: team management is enabled
-            // and the caller belongs to the team's owning group (metadata.owning_group).
+            // A "manager" administers this specific team (see isTeamManager).
             // Membership of the global team-admin group alone is not enough.
             let isManager = false;
             // Skip the extra lookup when it can't change the outcome: members always
             // get through, and manager-ness only matters for members when the budget
             // hiding flags differ between the two roles.
-            const managerCheckNeeded = ctx.teamMgmtEnabled &&
+            const managerCheckNeeded = (ctx.teamMgmtEnabled || !!ctx.memberBreakdownCfg.leadGroupSuffix) &&
                 (!isMember ||
                     teamBudgetVisibility.hideTeamBudgetForMembers !==
                         teamBudgetVisibility.hideTeamBudgetForManagers);
             if (managerCheckNeeded) {
                 try {
                     const team = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
-                    const owningGroup = typeof team.metadata?.owning_group === 'string' ? team.metadata.owning_group : undefined;
-                    if (owningGroup) {
-                        isManager = await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, owningGroup, catalogClient, auth, logger);
-                    }
+                    isManager = await isTeamManager(team, tokenEntityRef);
                 }
                 catch (err) {
                     const message = err instanceof Error ? err.message : String(err);
@@ -104,10 +117,7 @@ function registerTeamUsageRoutes(router, ctx) {
             }
             throw err;
         }
-        const owningGroup = typeof team.metadata?.owning_group === 'string' ? team.metadata.owning_group : undefined;
-        const isManager = ctx.teamMgmtEnabled &&
-            !!owningGroup &&
-            (await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, owningGroup, catalogClient, auth, logger));
+        const isManager = await isTeamManager(team, tokenEntityRef);
         if (!isMember && !isManager) {
             res.status(404).json({ error: 'Team not found' });
             return null;

package/dist/teamMemberUsage.d.ts

@@ -8,6 +8,8 @@ export interface MemberBreakdownConfig {
     viewerRoles: string[];
     /** Whether `litellm.team.usage.read` may grant access (needs `permission.enabled`). */
     permissionEnabled: boolean;
+    /** Suffix of a catalog group named `<team_alias><suffix>` whose members are team leads. */
+    leadGroupSuffix?: string;
 }
 export declare function readMemberBreakdownConfig(config: Config): MemberBreakdownConfig;
 /** Catalog profile of a member, keyed by lower-cased email. */

package/dist/teamMemberUsage.js

@@ -11,6 +11,7 @@ function readMemberBreakdownConfig(config) {
         enabled: config.getOptionalBoolean('litellm.teamUsage.memberBreakdown.enabled') ?? false,
         viewerRoles: config.getOptionalStringArray('litellm.teamUsage.memberBreakdown.viewerRoles') ?? [],
         permissionEnabled: config.getOptionalBoolean('permission.enabled') ?? false,
+        leadGroupSuffix: config.getOptionalString('litellm.teamUsage.memberBreakdown.leadGroupSuffix') || undefined,
     };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",