@acarmisc/backstage-plugin-litellm-backend 0.3.5 → 0.4.0

package/config.d.ts

@@ -104,6 +104,21 @@ export interface Config {
      * list/mint virtual keys without holding the master key. Disabled by
      * default; enable explicitly when the CLI is in use.
      */
+    /**
+     * Audit log access control. When set, the /audit tab in the plugin is
+     * only visible to members of the specified Backstage group.
+     */
+    audit?: {
+      /**
+       * Backstage group entity ref whose members can view the audit log.
+       * The plugin ships a ready-made group at catalog/litellm-admins.yaml —
+       * register the root catalog-info.yaml and set this to
+       * "group:default/litellm-admins", then add members there.
+       * When omitted the audit tab is hidden for all users.
+       */
+      group?: string;
+    };
+
     bridge?: {
       /**
        * When true, mount the /bridge/keys, /bridge/keys (POST), /bridge/models

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { LiteLLMConfig, UserInfo, VirtualKey, ModelInfo, UsageMetrics, TeamInfo, GenerateKeyRequest, GenerateKeyResponse, UpdateKeyRequest, DeleteKeyRequest, CreateUserRequest, CreateUserResponse } from './types';
+import { LiteLLMConfig, UserInfo, VirtualKey, ModelInfo, UsageMetrics, TeamInfo, GenerateKeyRequest, GenerateKeyResponse, UpdateKeyRequest, DeleteKeyRequest, CreateUserRequest, CreateUserResponse, AuditLogsParams, PaginatedAuditLogs } from './types';
 export declare class LiteLLMClient {
     private baseUrl;
     private masterKey;
@@ -53,6 +53,10 @@ export declare class LiteLLMClient {
     deleteKeys(request: DeleteKeyRequest): Promise<{
         success: boolean;
     }>;
+    blockKey(key: string): Promise<unknown>;
+    unblockKey(key: string): Promise<unknown>;
+    resetKeySpend(key: string): Promise<unknown>;
+    getAuditLogs(params: AuditLogsParams): Promise<PaginatedAuditLogs>;
     /**
      * Rotates an existing key in place, returning a fresh `sk-` secret while
      * keeping the same alias/budget/limits. `token` is the hashed token LiteLLM

package/dist/client.js

@@ -116,9 +116,6 @@ class LiteLLMClient {
     }
     toVirtualKey(k) {
         return {
-            // The hashed `token` never leaves LiteLLM in a usable form; the
-            // masked `key_name` ("sk-...XXXX") is what the UI displays. Fall
-            // back to `token` only when `key_name` is missing.
             key: k.key_name ?? k.token,
             token: k.token,
             key_alias: k.key_alias ?? undefined,
@@ -130,6 +127,7 @@ class LiteLLMClient {
             rpm_limit: k.rpm_limit ?? undefined,
             models: k.models ?? [],
             user_id: k.user_id ?? undefined,
+            blocked: k.blocked ?? undefined,
         };
     }
     /**
@@ -166,6 +164,46 @@ class LiteLLMClient {
             body: JSON.stringify(request),
         });
     }
+    async blockKey(key) {
+        return this.request('/key/block', {
+            method: 'POST',
+            body: JSON.stringify({ key }),
+        });
+    }
+    async unblockKey(key) {
+        return this.request('/key/unblock', {
+            method: 'POST',
+            body: JSON.stringify({ key }),
+        });
+    }
+    async resetKeySpend(key) {
+        return this.request(`/key/${encodeURIComponent(key)}/reset_spend`, {
+            method: 'POST',
+            body: JSON.stringify({ reset_to: 0 }),
+        });
+    }
+    async getAuditLogs(params) {
+        const query = new URLSearchParams();
+        if (params.page !== undefined)
+            query.set('page', String(params.page));
+        if (params.page_size !== undefined)
+            query.set('page_size', String(params.page_size));
+        if (params.start_date)
+            query.set('start_date', params.start_date);
+        if (params.end_date)
+            query.set('end_date', params.end_date);
+        if (params.action)
+            query.set('action', params.action);
+        if (params.table_name)
+            query.set('table_name', params.table_name);
+        if (params.changed_by)
+            query.set('changed_by', params.changed_by);
+        if (params.sort_by)
+            query.set('sort_by', params.sort_by);
+        if (params.sort_order)
+            query.set('sort_order', params.sort_order);
+        return this.request(`/audit?${query.toString()}`);
+    }
     /**
      * Rotates an existing key in place, returning a fresh `sk-` secret while
      * keeping the same alias/budget/limits. `token` is the hashed token LiteLLM

package/dist/index.cjs.js

@@ -172,9 +172,6 @@ var LiteLLMClient = class {
   }
   toVirtualKey(k) {
     return {
-      // The hashed `token` never leaves LiteLLM in a usable form; the
-      // masked `key_name` ("sk-...XXXX") is what the UI displays. Fall
-      // back to `token` only when `key_name` is missing.
       key: k.key_name ?? k.token,
       token: k.token,
       key_alias: k.key_alias ?? void 0,
@@ -185,7 +182,8 @@ var LiteLLMClient = class {
       tpm_limit: k.tpm_limit ?? void 0,
       rpm_limit: k.rpm_limit ?? void 0,
       models: k.models ?? [],
-      user_id: k.user_id ?? void 0
+      user_id: k.user_id ?? void 0,
+      blocked: k.blocked ?? void 0
     };
   }
   /**
@@ -222,6 +220,37 @@ var LiteLLMClient = class {
       body: JSON.stringify(request)
     });
   }
+  async blockKey(key) {
+    return this.request("/key/block", {
+      method: "POST",
+      body: JSON.stringify({ key })
+    });
+  }
+  async unblockKey(key) {
+    return this.request("/key/unblock", {
+      method: "POST",
+      body: JSON.stringify({ key })
+    });
+  }
+  async resetKeySpend(key) {
+    return this.request(`/key/${encodeURIComponent(key)}/reset_spend`, {
+      method: "POST",
+      body: JSON.stringify({ reset_to: 0 })
+    });
+  }
+  async getAuditLogs(params) {
+    const query = new URLSearchParams();
+    if (params.page !== void 0) query.set("page", String(params.page));
+    if (params.page_size !== void 0) query.set("page_size", String(params.page_size));
+    if (params.start_date) query.set("start_date", params.start_date);
+    if (params.end_date) query.set("end_date", params.end_date);
+    if (params.action) query.set("action", params.action);
+    if (params.table_name) query.set("table_name", params.table_name);
+    if (params.changed_by) query.set("changed_by", params.changed_by);
+    if (params.sort_by) query.set("sort_by", params.sort_by);
+    if (params.sort_order) query.set("sort_order", params.sort_order);
+    return this.request(`/audit?${query.toString()}`);
+  }
   /**
    * Rotates an existing key in place, returning a fresh `sk-` secret while
    * keeping the same alias/budget/limits. `token` is the hashed token LiteLLM
@@ -665,6 +694,20 @@ async function getOrProvisionUser(client, tokenEntityRef, userId, provisioningEn
     provisioningInFlight.delete(userId);
   }
 }
+async function isUserMemberOfGroup(userEntityRef, group, catalogClient, auth, logger) {
+  try {
+    const { token } = await auth.getPluginRequestToken({
+      onBehalfOf: await auth.getOwnServiceCredentials(),
+      targetPluginId: "catalog"
+    });
+    const entity = await catalogClient.getEntityByRef(userEntityRef, { token });
+    const groups = (entity?.relations ?? []).filter((r) => r.type === "memberOf").map((r) => r.targetRef);
+    return groups.includes(group);
+  } catch (err) {
+    logger.warn(`Could not check group membership for ${userEntityRef}: ${err.message}`);
+    return false;
+  }
+}
 async function resolveUserRole(userEntityRef, roleConfigs, catalogClient, auth, logger) {
   if (!roleConfigs.length) return void 0;
   try {
@@ -2183,6 +2226,7 @@ async function createRouter(options) {
   const client = options.client ?? new LiteLLMClient({ baseUrl, masterKey });
   const { enabled: provisioningEnabled, defaults: provisioningDefaults } = readProvisioningDefaults(config);
   const roleConfigs = readRoleConfigs(config);
+  const auditGroup = config.getOptionalString("litellm.audit.group");
   const catalogClient = new import_catalog_client.CatalogClient({ discoveryApi: discovery });
   if (provisioningEnabled) {
     logger.info(
@@ -2209,7 +2253,14 @@ async function createRouter(options) {
         auth,
         logger
       );
-      res.json(userInfo);
+      const canViewAudit = auditGroup && tokenEntityRef ? await isUserMemberOfGroup(
+        tokenEntityRef,
+        auditGroup,
+        catalogClient,
+        auth,
+        logger
+      ) : false;
+      res.json({ ...userInfo, can_view_audit: canViewAudit });
     } catch (error) {
       if (error instanceof ProvisioningError) {
         res.status(error.status).json(error.body);
@@ -2245,6 +2296,22 @@ async function createRouter(options) {
       res.status(500).json({ error: error.message });
     }
   });
+  router.post("/keys/:keyId/regenerate", async (req, res) => {
+    try {
+      const { keyId } = req.params;
+      if (!keyId) {
+        res.status(400).json({ error: "keyId is required" });
+        return;
+      }
+      const tokenEntityRef = await resolveUserId(req, auth);
+      const result = await client.regenerateKey(keyId);
+      logger.info({ action: "key.rotate", userId: tokenEntityRef ?? "unknown", keyId });
+      res.json(result);
+    } catch (error) {
+      logger.error("Failed to rotate key", error);
+      res.status(500).json({ error: error.message });
+    }
+  });
   router.post("/keys/generate", async (req, res) => {
     try {
       const body = req.body ?? {};
@@ -2292,6 +2359,7 @@ async function createRouter(options) {
         ...resolvedUserId && { user_id: resolvedUserId }
       };
       const result = await client.generateKey(request);
+      logger.info({ action: "key.generate", userId: resolvedUserId ?? "unknown", keyAlias: body.alias });
       res.json(result);
     } catch (error) {
       if (error instanceof ProvisioningError) {
@@ -2309,8 +2377,10 @@ async function createRouter(options) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
+      const tokenEntityRef = await resolveUserId(req, auth);
       const request = { ...req.body, key: keyId };
       const result = await client.updateKey(request);
+      logger.info({ action: "key.update", userId: tokenEntityRef ?? "unknown", keyId });
       res.json(result);
     } catch (error) {
       logger.error("Failed to update key", error);
@@ -2324,13 +2394,89 @@ async function createRouter(options) {
         res.status(400).json({ error: "keyId is required" });
         return;
       }
+      const deleteEntityRef = await resolveUserId(req, auth);
       await client.deleteKeys({ keys: [keyId] });
+      logger.info({ action: "key.delete", userId: deleteEntityRef ?? "unknown", keyId });
       res.json({ success: true });
     } catch (error) {
       logger.error("Failed to delete key", error);
       res.status(500).json({ error: error.message });
     }
   });
+  router.post("/keys/:keyId/block", async (req, res) => {
+    try {
+      const { keyId } = req.params;
+      const tokenEntityRef = await resolveUserId(req, auth);
+      await client.blockKey(keyId);
+      logger.info({ action: "key.block", userId: tokenEntityRef ?? "unknown", keyId });
+      res.json({ success: true });
+    } catch (error) {
+      logger.error("Failed to block key", error);
+      res.status(500).json({ error: error.message });
+    }
+  });
+  router.post("/keys/:keyId/unblock", async (req, res) => {
+    try {
+      const { keyId } = req.params;
+      const tokenEntityRef = await resolveUserId(req, auth);
+      await client.unblockKey(keyId);
+      logger.info({ action: "key.unblock", userId: tokenEntityRef ?? "unknown", keyId });
+      res.json({ success: true });
+    } catch (error) {
+      logger.error("Failed to unblock key", error);
+      res.status(500).json({ error: error.message });
+    }
+  });
+  router.post("/keys/:keyId/reset_spend", async (req, res) => {
+    try {
+      const { keyId } = req.params;
+      const tokenEntityRef = await resolveUserId(req, auth);
+      await client.resetKeySpend(keyId);
+      logger.info({ action: "key.reset_spend", userId: tokenEntityRef ?? "unknown", keyId });
+      res.json({ success: true });
+    } catch (error) {
+      logger.error("Failed to reset key spend", error);
+      res.status(500).json({ error: error.message });
+    }
+  });
+  router.get("/audit", async (req, res) => {
+    if (!auditGroup) {
+      res.status(403).json({ error: "Audit log is not configured (litellm.audit.group not set)" });
+      return;
+    }
+    const tokenEntityRef = await resolveUserId(req, auth);
+    if (!tokenEntityRef) {
+      res.status(401).json({ error: "Authentication required" });
+      return;
+    }
+    const allowed = await isUserMemberOfGroup(
+      tokenEntityRef,
+      auditGroup,
+      catalogClient,
+      auth,
+      logger
+    );
+    if (!allowed) {
+      res.status(403).json({ error: "Access denied: not a member of the audit group" });
+      return;
+    }
+    try {
+      const { page, page_size, start_date, end_date, action, table_name, changed_by } = req.query;
+      const result = await client.getAuditLogs({
+        page: page ? Number(page) : void 0,
+        page_size: page_size ? Number(page_size) : 25,
+        start_date,
+        end_date,
+        action,
+        table_name,
+        changed_by
+      });
+      res.json(result);
+    } catch (error) {
+      logger.error("Failed to fetch audit logs", error);
+      res.status(500).json({ error: error.message });
+    }
+  });
   router.get("/models", async (_req, res) => {
     try {
       const models = await client.listModels();