@acarmisc/backstage-plugin-litellm-backend 0.27.0 → 0.29.0

package/dist/openapi.js

@@ -69,6 +69,7 @@ exports.openApiSpec = {
                                         display: { type: 'object', properties: {
                                                 hideTeamBudgetForMembers: { type: 'boolean' },
                                                 hideTeamBudgetForManagers: { type: 'boolean' },
+                                                serviceKeyPrefixes: { type: 'array', items: { type: 'string' } },
                                             } },
                                     } } } },
                     },

package/dist/router.js

@@ -71,6 +71,10 @@ async function createRouter(options) {
     const publicBaseUrl = config.getOptionalString('litellm.publicBaseUrl') ?? null;
     // Support contact for unprovisioned users (optional).
     const supportContact = config.getOptionalString('litellm.supportContact');
+    // Alias prefixes of system/service keys the frontend hides by default.
+    const serviceKeyPrefixes = (config.getOptionalStringArray('litellm.display.serviceKeyPrefixes') ?? [])
+        .map(p => p.trim())
+        .filter(p => p.length > 0);
     const baseClient = options.client ?? new client_1.LiteLLMClient({ baseUrl, masterKey });
     // Wrap client with userInfoCache. TTL is configurable (default 10s, 0 disables).
     const userInfoCacheTtlSeconds = config.getOptionalNumber('litellm.cache.userInfoTtlSeconds') ?? 10;
@@ -134,6 +138,7 @@ async function createRouter(options) {
         baseUrl,
         publicBaseUrl,
         supportContact,
+        serviceKeyPrefixes,
         userIdDomain,
         provisioningEnabled,
         provisioningDefaults,

package/dist/routes/config.js

@@ -35,6 +35,7 @@ function registerConfigRoutes(router, ctx) {
             display: {
                 hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,
                 hideTeamBudgetForManagers: ctx.teamBudgetVisibility.hideTeamBudgetForManagers,
+                serviceKeyPrefixes: ctx.serviceKeyPrefixes,
             },
         });
     });

package/dist/routes/context.d.ts

@@ -23,6 +23,8 @@ export interface RouterContext {
     baseUrl: string;
     publicBaseUrl: string | null;
     supportContact: string | undefined;
+    /** Key-alias prefixes treated as service keys by the frontend (display-only). */
+    serviceKeyPrefixes: string[];
     userIdDomain: string | undefined;
     provisioningEnabled: boolean;
     provisioningDefaults: ProvisioningDefaults;

package/dist/routes/teamUsage.js

@@ -12,6 +12,23 @@ const withUser_1 = require("./middleware/withUser");
 function registerTeamUsageRoutes(router, ctx) {
     const { client, catalogClient, auth, logger, teamBudgetVisibility, } = ctx;
     const requireUser = (0, withUser_1.createRequireUser)(ctx);
+    // A team manager: a member of the team's owning group (team management
+    // enabled), or a member of the catalog lead group `<alias><leadGroupSuffix>`
+    // for teams synced without an owning_group.
+    async function isTeamManager(team, tokenEntityRef) {
+        const owningGroup = typeof team.metadata?.owning_group === 'string' ? team.metadata.owning_group : undefined;
+        if (ctx.teamMgmtEnabled &&
+            owningGroup &&
+            (await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, owningGroup, catalogClient, auth, logger))) {
+            return true;
+        }
+        const suffix = ctx.memberBreakdownCfg.leadGroupSuffix;
+        if (!suffix || !team.team_alias)
+            return false;
+        // Same slug rule as the catalog group names: lower-case, other chars become '-'.
+        const slug = team.team_alias.toLowerCase().replace(/[^a-z0-9\-_.]/g, '-');
+        return (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, `group:default/${slug}${suffix}`, catalogClient, auth, logger);
+    }
     router.get('/teams/:teamId/usage', requireUser, async (req, res) => {
         try {
             const { teamId } = req.params;
@@ -25,24 +42,20 @@ function registerTeamUsageRoutes(router, ctx) {
             const userInfo = await (0, withUser_1.getProvisionedUser)(ctx, res);
             // Check membership: user must be in the team OR be a team manager
             const isMember = userInfo?.teams?.includes(teamId) ?? false;
-            // A "manager" administers this specific team: team management is enabled
-            // and the caller belongs to the team's owning group (metadata.owning_group).
+            // A "manager" administers this specific team (see isTeamManager).
             // Membership of the global team-admin group alone is not enough.
             let isManager = false;
             // Skip the extra lookup when it can't change the outcome: members always
             // get through, and manager-ness only matters for members when the budget
             // hiding flags differ between the two roles.
-            const managerCheckNeeded = ctx.teamMgmtEnabled &&
+            const managerCheckNeeded = (ctx.teamMgmtEnabled || !!ctx.memberBreakdownCfg.leadGroupSuffix) &&
                 (!isMember ||
                     teamBudgetVisibility.hideTeamBudgetForMembers !==
                         teamBudgetVisibility.hideTeamBudgetForManagers);
             if (managerCheckNeeded) {
                 try {
                     const team = await (0, teamFetch_1.withTeamFetchRetry)(() => client.getTeamInfo(teamId));
-                    const owningGroup = typeof team.metadata?.owning_group === 'string' ? team.metadata.owning_group : undefined;
-                    if (owningGroup) {
-                        isManager = await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, owningGroup, catalogClient, auth, logger);
-                    }
+                    isManager = await isTeamManager(team, tokenEntityRef);
                 }
                 catch (err) {
                     const message = err instanceof Error ? err.message : String(err);
@@ -104,10 +117,7 @@ function registerTeamUsageRoutes(router, ctx) {
             }
             throw err;
         }
-        const owningGroup = typeof team.metadata?.owning_group === 'string' ? team.metadata.owning_group : undefined;
-        const isManager = ctx.teamMgmtEnabled &&
-            !!owningGroup &&
-            (await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, owningGroup, catalogClient, auth, logger));
+        const isManager = await isTeamManager(team, tokenEntityRef);
         if (!isMember && !isManager) {
             res.status(404).json({ error: 'Team not found' });
             return null;

package/dist/teamMemberUsage.d.ts

@@ -8,6 +8,8 @@ export interface MemberBreakdownConfig {
     viewerRoles: string[];
     /** Whether `litellm.team.usage.read` may grant access (needs `permission.enabled`). */
     permissionEnabled: boolean;
+    /** Suffix of a catalog group named `<team_alias><suffix>` whose members are team leads. */
+    leadGroupSuffix?: string;
 }
 export declare function readMemberBreakdownConfig(config: Config): MemberBreakdownConfig;
 /** Catalog profile of a member, keyed by lower-cased email. */

package/dist/teamMemberUsage.js

@@ -11,6 +11,7 @@ function readMemberBreakdownConfig(config) {
         enabled: config.getOptionalBoolean('litellm.teamUsage.memberBreakdown.enabled') ?? false,
         viewerRoles: config.getOptionalStringArray('litellm.teamUsage.memberBreakdown.viewerRoles') ?? [],
         permissionEnabled: config.getOptionalBoolean('permission.enabled') ?? false,
+        leadGroupSuffix: config.getOptionalString('litellm.teamUsage.memberBreakdown.leadGroupSuffix') || undefined,
     };
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.27.0",
+  "version": "0.29.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",