@acarmisc/backstage-plugin-litellm-backend 0.29.0 → 0.30.1

package/dist/keySnippets.d.ts

@@ -0,0 +1,8 @@
+/** Starter-snippet tabs the key dialog can show, in default order. */
+export declare const KEY_SNIPPET_TABS: readonly ["office365", "opencode", "claude-code", "pi", "openai", "curl"];
+export type KeySnippetTab = (typeof KEY_SNIPPET_TABS)[number];
+/**
+ * Reads litellm.display.keySnippets. Omitted means every tab in default order.
+ * Throws at startup on an empty, unknown or duplicated list so a typo fails loudly.
+ */
+export declare function parseKeySnippetTabs(raw: string[] | undefined): KeySnippetTab[];

package/dist/keySnippets.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KEY_SNIPPET_TABS = void 0;
+exports.parseKeySnippetTabs = parseKeySnippetTabs;
+/** Starter-snippet tabs the key dialog can show, in default order. */
+exports.KEY_SNIPPET_TABS = ['office365', 'opencode', 'claude-code', 'pi', 'openai', 'curl'];
+/**
+ * Reads litellm.display.keySnippets. Omitted means every tab in default order.
+ * Throws at startup on an empty, unknown or duplicated list so a typo fails loudly.
+ */
+function parseKeySnippetTabs(raw) {
+    if (raw === undefined)
+        return [...exports.KEY_SNIPPET_TABS];
+    if (raw.length === 0) {
+        throw new Error('litellm.display.keySnippets must list at least one tab');
+    }
+    const allowed = exports.KEY_SNIPPET_TABS;
+    const unknown = raw.filter(tab => !allowed.includes(tab));
+    if (unknown.length > 0) {
+        throw new Error(`litellm.display.keySnippets: unknown tab(s) ${unknown.join(', ')}. Allowed: ${exports.KEY_SNIPPET_TABS.join(', ')}`);
+    }
+    if (new Set(raw).size !== raw.length) {
+        throw new Error('litellm.display.keySnippets lists a tab more than once');
+    }
+    return raw;
+}

package/dist/openapi.js

@@ -70,6 +70,7 @@ exports.openApiSpec = {
                                                 hideTeamBudgetForMembers: { type: 'boolean' },
                                                 hideTeamBudgetForManagers: { type: 'boolean' },
                                                 serviceKeyPrefixes: { type: 'array', items: { type: 'string' } },
+                                                keySnippets: { type: 'array', items: { type: 'string', enum: ['office365', 'opencode', 'claude-code', 'pi', 'openai', 'curl'] } },
                                             } },
                                     } } } },
                     },

package/dist/router.js

@@ -42,6 +42,7 @@ const catalog_client_1 = require("@backstage/catalog-client");
 const client_1 = require("./client");
 const provisioning_1 = require("./provisioning");
 Object.defineProperty(exports, "ProvisioningError", { enumerable: true, get: function () { return provisioning_1.ProvisioningError; } });
+const keySnippets_1 = require("./keySnippets");
 const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const teamAdmin_1 = require("./teamAdmin");
 const teamBudgetVisibility_1 = require("./teamBudgetVisibility");
@@ -75,6 +76,8 @@ async function createRouter(options) {
     const serviceKeyPrefixes = (config.getOptionalStringArray('litellm.display.serviceKeyPrefixes') ?? [])
         .map(p => p.trim())
         .filter(p => p.length > 0);
+    // Starter-snippet tabs shown after key generation, in order (display-only).
+    const keySnippets = (0, keySnippets_1.parseKeySnippetTabs)(config.getOptionalStringArray('litellm.display.keySnippets'));
     const baseClient = options.client ?? new client_1.LiteLLMClient({ baseUrl, masterKey });
     // Wrap client with userInfoCache. TTL is configurable (default 10s, 0 disables).
     const userInfoCacheTtlSeconds = config.getOptionalNumber('litellm.cache.userInfoTtlSeconds') ?? 10;
@@ -139,6 +142,7 @@ async function createRouter(options) {
         publicBaseUrl,
         supportContact,
         serviceKeyPrefixes,
+        keySnippets,
         userIdDomain,
         provisioningEnabled,
         provisioningDefaults,

package/dist/routes/config.js

@@ -36,6 +36,7 @@ function registerConfigRoutes(router, ctx) {
                 hideTeamBudgetForMembers: ctx.teamBudgetVisibility.hideTeamBudgetForMembers,
                 hideTeamBudgetForManagers: ctx.teamBudgetVisibility.hideTeamBudgetForManagers,
                 serviceKeyPrefixes: ctx.serviceKeyPrefixes,
+                keySnippets: ctx.keySnippets,
             },
         });
     });

package/dist/routes/context.d.ts

@@ -5,6 +5,7 @@ import { CatalogClient } from '@backstage/catalog-client';
 import { LiteLLMClient } from '../client';
 import { ProvisioningDefaults, RoleConfig, VirtualKey, TeamInfo } from '../types';
 import { TeamAdminConfig } from '../teamAdmin';
+import type { KeySnippetTab } from '../keySnippets';
 import type { KeyValidationConfig } from '@acarmisc/backstage-plugin-litellm-common';
 import { TeamBudgetVisibility } from '../teamBudgetVisibility';
 import { OpencodeConfig } from '../opencode';
@@ -25,6 +26,8 @@ export interface RouterContext {
     supportContact: string | undefined;
     /** Key-alias prefixes treated as service keys by the frontend (display-only). */
     serviceKeyPrefixes: string[];
+    /** Starter-snippet tabs the key dialog shows, in order (display-only). */
+    keySnippets: KeySnippetTab[];
     userIdDomain: string | undefined;
     provisioningEnabled: boolean;
     provisioningDefaults: ProvisioningDefaults;

package/dist/services/keyService.js

@@ -119,7 +119,15 @@ async function createKeyForUser(user, input, ctx) {
         if (!input.team_id) {
             throw new KeyServiceError(400, { error: 'team_id is required when mcp_servers is set' });
         }
-        const disallowed = (0, mcpAccess_1.findDisallowedMcpServers)(mcpServers, (0, mcpAccess_1.teamMcpServers)(await getTeam(input.team_id)));
+        const allowed = (0, mcpAccess_1.teamMcpServers)(await getTeam(input.team_id));
+        let disallowed = (0, mcpAccess_1.findDisallowedMcpServers)(mcpServers, allowed);
+        if (disallowed.length > 0) {
+            // LiteLLM stores a team's grant by server id while callers name servers, so
+            // resolve the gateway's listing before refusing. A failed listing keeps the
+            // plain comparison.
+            const servers = await client.listMcpServers().catch(() => []);
+            disallowed = (0, mcpAccess_1.findDisallowedMcpServers)(mcpServers, allowed, servers);
+        }
         if (disallowed.length > 0) {
             throw new KeyServiceError(403, {
                 error: 'One or more requested MCP servers are not allowed',

package/dist/services/mcpAccess.d.ts

@@ -16,5 +16,13 @@ export declare function teamMcpServers(team: {
         mcp_servers?: string[];
     };
 } | undefined): string[];
-/** Requested names that are not in `allowed`, de-duplicated. */
-export declare function findDisallowedMcpServers(requested: string[], allowed: string[]): string[];
+/**
+ * Requested names that are not granted, de-duplicated. A team's list may hold a
+ * server's id while a caller names it (or the reverse), so a request also counts
+ * as granted when the gateway's listing links its name and id to an allowed entry.
+ * Without `servers` only exact matches count.
+ */
+export declare function findDisallowedMcpServers(requested: string[], allowed: string[], servers?: Array<{
+    id: string;
+    name?: string;
+}>): string[];

package/dist/services/mcpAccess.js

@@ -21,8 +21,15 @@ function teamMcpServers(team) {
     const listed = team?.object_permission?.mcp_servers ?? [];
     return [...new Set(listed)].filter(n => backstage_plugin_litellm_common_1.MCP_SERVER_NAME_RE.test(n));
 }
-/** Requested names that are not in `allowed`, de-duplicated. */
-function findDisallowedMcpServers(requested, allowed) {
+/**
+ * Requested names that are not granted, de-duplicated. A team's list may hold a
+ * server's id while a caller names it (or the reverse), so a request also counts
+ * as granted when the gateway's listing links its name and id to an allowed entry.
+ * Without `servers` only exact matches count.
+ */
+function findDisallowedMcpServers(requested, allowed, servers = []) {
     const ok = new Set(allowed);
-    return [...new Set(requested)].filter(n => !ok.has(n));
+    const granted = (n) => ok.has(n) ||
+        servers.some(s => (s.name === n || s.id === n) && (ok.has(s.id) || (s.name !== undefined && ok.has(s.name))));
+    return [...new Set(requested)].filter(n => !granted(n));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.29.0",
+  "version": "0.30.1",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",