@acarmisc/backstage-plugin-litellm-backend 0.27.0 → 0.29.0

package/config.d.ts

@@ -450,6 +450,17 @@ export interface Config {
        * @default false
        */
       hideTeamBudgetForManagers?: boolean;
+
+      /**
+       * Key-alias prefixes that identify system / service keys (e.g.
+       * ["svc-", "system-"]). The Keys table hides keys whose alias starts
+       * with one of these prefixes behind a "Hide service keys" toggle that
+       * is on by default; users can switch it off to see every key.
+       * Matching is case-insensitive. Display-only: the keys are still
+       * returned by the API and nothing is enforced server-side.
+       * @default []
+       */
+      serviceKeyPrefixes?: string[];
     };
 
     /**
@@ -463,6 +474,8 @@ export interface Config {
        * reaches:
        *   - managers of the team (members of its metadata.owning_group, with
        *     team management enabled);
+       *   - team leads (members of the catalog group `<team_alias><leadGroupSuffix>`,
+       *     when leadGroupSuffix is set);
        *   - members of the team holding one of `viewerRoles` in it;
        *   - members of the team granted `litellm.team.usage.read` (only
        *     consulted when permission.enabled is true).
@@ -480,6 +493,13 @@ export interface Config {
          * @default []
          */
         viewerRoles?: string[];
+
+        /**
+         * Suffix of a catalog group named `<team_alias><suffix>` whose members
+         * are team leads (e.g. "-leads" -> group:default/abstrid-leads). For
+         * teams synced without metadata.owning_group. Unset: no lead access.
+         */
+        leadGroupSuffix?: string;
       };
     };
 

package/dist/index.cjs.js

@@ -9449,7 +9449,8 @@ function readMemberBreakdownConfig(config) {
   return {
     enabled: config.getOptionalBoolean("litellm.teamUsage.memberBreakdown.enabled") ?? false,
     viewerRoles: config.getOptionalStringArray("litellm.teamUsage.memberBreakdown.viewerRoles") ?? [],
-    permissionEnabled: config.getOptionalBoolean("permission.enabled") ?? false
+    permissionEnabled: config.getOptionalBoolean("permission.enabled") ?? false,
+    leadGroupSuffix: config.getOptionalString("litellm.teamUsage.memberBreakdown.leadGroupSuffix") || void 0
   };
 }
 function memberEmails(team, keys) {
@@ -9785,7 +9786,8 @@ var openApiSpec = {
               } },
               display: { type: "object", properties: {
                 hideTeamBudgetForMembers: { type: "boolean" },
-                hideTeamBudgetForManagers: { type: "boolean" }
+                hideTeamBudgetForManagers: { type: "boolean" },
+                serviceKeyPrefixes: { type: "array", items: { type: "string" } }
               } }
             } } } }
           }
@@ -10053,7 +10055,8 @@ function registerConfigRoutes(router, ctx) {
       },
       display: {
         hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,
-        hideTeamBudgetForManagers: ctx.teamBudgetVisibility.hideTeamBudgetForManagers
+        hideTeamBudgetForManagers: ctx.teamBudgetVisibility.hideTeamBudgetForManagers,
+        serviceKeyPrefixes: ctx.serviceKeyPrefixes
       }
     });
   });
@@ -11521,6 +11524,22 @@ function registerTeamUsageRoutes(router, ctx) {
     teamBudgetVisibility
   } = ctx;
   const requireUser = createRequireUser(ctx);
+  async function isTeamManager(team, tokenEntityRef) {
+    const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
+    if (ctx.teamMgmtEnabled && owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger)) {
+      return true;
+    }
+    const suffix = ctx.memberBreakdownCfg.leadGroupSuffix;
+    if (!suffix || !team.team_alias) return false;
+    const slug = team.team_alias.toLowerCase().replace(/[^a-z0-9\-_.]/g, "-");
+    return isUserMemberOfGroup(
+      tokenEntityRef,
+      `group:default/${slug}${suffix}`,
+      catalogClient,
+      auth,
+      logger
+    );
+  }
   router.get("/teams/:teamId/usage", requireUser, async (req, res) => {
     try {
       const { teamId } = req.params;
@@ -11533,20 +11552,11 @@ function registerTeamUsageRoutes(router, ctx) {
       const userInfo = await getProvisionedUser(ctx, res);
       const isMember = userInfo?.teams?.includes(teamId) ?? false;
       let isManager = false;
-      const managerCheckNeeded = ctx.teamMgmtEnabled && (!isMember || teamBudgetVisibility.hideTeamBudgetForMembers !== teamBudgetVisibility.hideTeamBudgetForManagers);
+      const managerCheckNeeded = (ctx.teamMgmtEnabled || !!ctx.memberBreakdownCfg.leadGroupSuffix) && (!isMember || teamBudgetVisibility.hideTeamBudgetForMembers !== teamBudgetVisibility.hideTeamBudgetForManagers);
       if (managerCheckNeeded) {
         try {
           const team = await withTeamFetchRetry(() => client.getTeamInfo(teamId));
-          const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
-          if (owningGroup) {
-            isManager = await isUserMemberOfGroup(
-              tokenEntityRef,
-              owningGroup,
-              catalogClient,
-              auth,
-              logger
-            );
-          }
+          isManager = await isTeamManager(team, tokenEntityRef);
         } catch (err) {
           const message2 = err instanceof Error ? err.message : String(err);
           logger.warn(`Team-manager check failed: ${message2}`);
@@ -11600,8 +11610,7 @@ function registerTeamUsageRoutes(router, ctx) {
       }
       throw err;
     }
-    const owningGroup = typeof team.metadata?.owning_group === "string" ? team.metadata.owning_group : void 0;
-    const isManager = ctx.teamMgmtEnabled && !!owningGroup && await isUserMemberOfGroup(tokenEntityRef, owningGroup, catalogClient, auth, logger);
+    const isManager = await isTeamManager(team, tokenEntityRef);
     if (!isMember && !isManager) {
       res.status(404).json({ error: "Team not found" });
       return null;
@@ -13663,6 +13672,7 @@ async function createRouter(options) {
   const userIdDomain = config.getOptionalString("litellm.userIdDomain");
   const publicBaseUrl = config.getOptionalString("litellm.publicBaseUrl") ?? null;
   const supportContact = config.getOptionalString("litellm.supportContact");
+  const serviceKeyPrefixes = (config.getOptionalStringArray("litellm.display.serviceKeyPrefixes") ?? []).map((p) => p.trim()).filter((p) => p.length > 0);
   const baseClient = options.client ?? new LiteLLMClient({ baseUrl, masterKey });
   const userInfoCacheTtlSeconds = config.getOptionalNumber("litellm.cache.userInfoTtlSeconds") ?? 10;
   const client = userInfoCacheTtlSeconds > 0 ? withUserInfoCache(baseClient, { ttlMs: userInfoCacheTtlSeconds * 1e3 }) : baseClient;
@@ -13721,6 +13731,7 @@ async function createRouter(options) {
     baseUrl,
     publicBaseUrl,
     supportContact,
+    serviceKeyPrefixes,
     userIdDomain,
     provisioningEnabled,
     provisioningDefaults,