@acarmisc/backstage-plugin-litellm-backend 0.3.4 → 0.4.0

package/dist/provisioning.d.ts

@@ -80,6 +80,11 @@ export declare class ProvisioningError extends Error {
  * When provisioning is disabled, throws a ProvisioningError with a clear message.
  */
 export declare function getOrProvisionUser(client: LiteLLMClient, tokenEntityRef: string | undefined, userId: string | undefined, provisioningEnabled: boolean, provisioningDefaults: ProvisioningDefaults, roleConfigs: RoleConfig[], catalogClient: CatalogClient, auth: AuthService, logger: any): Promise<UserInfo>;
+/**
+ * Returns true when the user is a member of the given Backstage group entity ref.
+ * Used for RBAC gates (e.g. audit log visibility) without the role-config machinery.
+ */
+export declare function isUserMemberOfGroup(userEntityRef: string, group: string, catalogClient: CatalogClient, auth: AuthService, logger: any): Promise<boolean>;
 /**
  * Fetches the user's Backstage group memberships and returns the first matching
  * role config (priority order), or undefined when no role matches.

package/dist/provisioning.js

@@ -9,6 +9,7 @@ exports.resolveUserId = resolveUserId;
 exports.resolveUserProfile = resolveUserProfile;
 exports.provisionUser = provisionUser;
 exports.getOrProvisionUser = getOrProvisionUser;
+exports.isUserMemberOfGroup = isUserMemberOfGroup;
 exports.resolveUserRole = resolveUserRole;
 /**
  * Converts a Backstage user entity ref to a LiteLLM user_id.
@@ -314,6 +315,27 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
         provisioningInFlight.delete(userId);
     }
 }
+/**
+ * Returns true when the user is a member of the given Backstage group entity ref.
+ * Used for RBAC gates (e.g. audit log visibility) without the role-config machinery.
+ */
+async function isUserMemberOfGroup(userEntityRef, group, catalogClient, auth, logger) {
+    try {
+        const { token } = await auth.getPluginRequestToken({
+            onBehalfOf: await auth.getOwnServiceCredentials(),
+            targetPluginId: 'catalog',
+        });
+        const entity = await catalogClient.getEntityByRef(userEntityRef, { token });
+        const groups = (entity?.relations ?? [])
+            .filter(r => r.type === 'memberOf')
+            .map(r => r.targetRef);
+        return groups.includes(group);
+    }
+    catch (err) {
+        logger.warn(`Could not check group membership for ${userEntityRef}: ${err.message}`);
+        return false;
+    }
+}
 /**
  * Fetches the user's Backstage group memberships and returns the first matching
  * role config (priority order), or undefined when no role matches.

package/dist/router.js

@@ -49,6 +49,7 @@ async function createRouter(options) {
     const client = options.client ?? new client_1.LiteLLMClient({ baseUrl, masterKey });
     const { enabled: provisioningEnabled, defaults: provisioningDefaults } = (0, provisioning_1.readProvisioningDefaults)(config);
     const roleConfigs = (0, provisioning_1.readRoleConfigs)(config);
+    const auditGroup = config.getOptionalString('litellm.audit.group');
     const catalogClient = new catalog_client_1.CatalogClient({ discoveryApi: discovery });
     if (provisioningEnabled) {
         logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length
@@ -70,7 +71,10 @@ async function createRouter(options) {
                 ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
                 : req.query.user_id;
             const userInfo = await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
-            res.json(userInfo);
+            const canViewAudit = auditGroup && tokenEntityRef
+                ? await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, auditGroup, catalogClient, auth, logger)
+                : false;
+            res.json({ ...userInfo, can_view_audit: canViewAudit });
         }
         catch (error) {
             if (error instanceof provisioning_1.ProvisioningError) {
@@ -100,6 +104,23 @@ async function createRouter(options) {
             res.status(500).json({ error: error.message });
         }
     });
+    router.post('/keys/:keyId/regenerate', async (req, res) => {
+        try {
+            const { keyId } = req.params;
+            if (!keyId) {
+                res.status(400).json({ error: 'keyId is required' });
+                return;
+            }
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const result = await client.regenerateKey(keyId);
+            logger.info({ action: 'key.rotate', userId: tokenEntityRef ?? 'unknown', keyId });
+            res.json(result);
+        }
+        catch (error) {
+            logger.error('Failed to rotate key', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
     router.post('/keys/generate', async (req, res) => {
         try {
             // Only alias + max_budget are required. An empty models array is
@@ -151,6 +172,7 @@ async function createRouter(options) {
                 ...(resolvedUserId && { user_id: resolvedUserId }),
             };
             const result = await client.generateKey(request);
+            logger.info({ action: 'key.generate', userId: resolvedUserId ?? 'unknown', keyAlias: body.alias });
             res.json(result);
         }
         catch (error) {
@@ -169,8 +191,10 @@ async function createRouter(options) {
                 res.status(400).json({ error: 'keyId is required' });
                 return;
             }
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
             const request = { ...req.body, key: keyId };
             const result = await client.updateKey(request);
+            logger.info({ action: 'key.update', userId: tokenEntityRef ?? 'unknown', keyId });
             res.json(result);
         }
         catch (error) {
@@ -185,7 +209,9 @@ async function createRouter(options) {
                 res.status(400).json({ error: 'keyId is required' });
                 return;
             }
+            const deleteEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
             await client.deleteKeys({ keys: [keyId] });
+            logger.info({ action: 'key.delete', userId: deleteEntityRef ?? 'unknown', keyId });
             res.json({ success: true });
         }
         catch (error) {
@@ -193,6 +219,78 @@ async function createRouter(options) {
             res.status(500).json({ error: error.message });
         }
     });
+    router.post('/keys/:keyId/block', async (req, res) => {
+        try {
+            const { keyId } = req.params;
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            await client.blockKey(keyId);
+            logger.info({ action: 'key.block', userId: tokenEntityRef ?? 'unknown', keyId });
+            res.json({ success: true });
+        }
+        catch (error) {
+            logger.error('Failed to block key', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.post('/keys/:keyId/unblock', async (req, res) => {
+        try {
+            const { keyId } = req.params;
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            await client.unblockKey(keyId);
+            logger.info({ action: 'key.unblock', userId: tokenEntityRef ?? 'unknown', keyId });
+            res.json({ success: true });
+        }
+        catch (error) {
+            logger.error('Failed to unblock key', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.post('/keys/:keyId/reset_spend', async (req, res) => {
+        try {
+            const { keyId } = req.params;
+            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            await client.resetKeySpend(keyId);
+            logger.info({ action: 'key.reset_spend', userId: tokenEntityRef ?? 'unknown', keyId });
+            res.json({ success: true });
+        }
+        catch (error) {
+            logger.error('Failed to reset key spend', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
+    router.get('/audit', async (req, res) => {
+        if (!auditGroup) {
+            res.status(403).json({ error: 'Audit log is not configured (litellm.audit.group not set)' });
+            return;
+        }
+        const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+        if (!tokenEntityRef) {
+            res.status(401).json({ error: 'Authentication required' });
+            return;
+        }
+        const allowed = await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, auditGroup, catalogClient, auth, logger);
+        if (!allowed) {
+            res.status(403).json({ error: 'Access denied: not a member of the audit group' });
+            return;
+        }
+        try {
+            const { page, page_size, start_date, end_date, action, table_name, changed_by } = req.query;
+            const result = await client.getAuditLogs({
+                page: page ? Number(page) : undefined,
+                page_size: page_size ? Number(page_size) : 25,
+                start_date,
+                end_date,
+                action,
+                table_name,
+                changed_by,
+            });
+            res.json(result);
+        }
+        catch (error) {
+            logger.error('Failed to fetch audit logs', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
     router.get('/models', async (_req, res) => {
         try {
             const models = await client.listModels();

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  spend: number;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n"],
+  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  spend: number;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -9,6 +9,8 @@ export interface UserInfo {
     current_spend?: number;
     soft_limit?: number;
     hard_limit?: number;
+    /** Backstage-computed: true when the user is a member of litellm.audit.group */
+    can_view_audit?: boolean;
 }
 export interface TeamMember {
     user_id: string;
@@ -36,6 +38,7 @@ export interface VirtualKey {
     rpm_limit?: number;
     models?: string[];
     user_id?: string;
+    blocked?: boolean;
 }
 /**
  * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.
@@ -56,6 +59,7 @@ export interface LiteLLMUserKey {
     user_id?: string | null;
     team_id?: string | null;
     created_at: string;
+    blocked?: boolean | null;
 }
 export interface ModelInfo {
     model_name: string;
@@ -206,3 +210,32 @@ export interface CreateUserResponse {
     models?: string[];
     teams?: string[];
 }
+export interface AuditLogEntry {
+    id: string;
+    updated_at: string;
+    changed_by?: string;
+    changed_by_api_key?: string;
+    action?: string;
+    table_name?: string;
+    object_id?: string;
+    before_value?: Record<string, unknown> | null;
+    updated_values?: Record<string, unknown> | null;
+}
+export interface PaginatedAuditLogs {
+    audit_logs: AuditLogEntry[];
+    total: number;
+    page: number;
+    page_size: number;
+    total_pages: number;
+}
+export interface AuditLogsParams {
+    page?: number;
+    page_size?: number;
+    start_date?: string;
+    end_date?: string;
+    action?: string;
+    table_name?: string;
+    changed_by?: string;
+    sort_by?: string;
+    sort_order?: 'asc' | 'desc';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.3.4",
+  "version": "0.4.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -44,4 +44,4 @@
     "@types/node": "^20.0.0"
   },
   "configSchema": "config.d.ts"
-}
+}