@acarmisc/backstage-plugin-litellm-backend 0.31.0 → 0.32.0

package/dist/openapi.js

@@ -63,6 +63,7 @@ exports.openApiSpec = {
                         content: { 'application/json': { schema: { type: 'object', properties: {
                                         baseUrl: { type: 'string' },
                                         keyGeneration: { type: 'object', properties: {
+                                                allowedDurations: { type: 'array', items: { type: 'string' }, description: 'Durations a new key may have (litellm.keys.allowedDurations); "never" means no expiry' },
                                                 allowUnlimitedBudget: { type: 'boolean' },
                                                 teamRequired: { type: 'boolean' },
                                             } },

package/dist/provisioning.d.ts

@@ -40,6 +40,11 @@ export declare function applyRoleOverrides(defaults: ProvisioningDefaults, role:
  *   tpmLimit:       none — LiteLLM global / team limits still apply
  *   rpmLimit:       none — same
  *   metadata:       backstage source tag only
+ *
+ * With `useGatewayBudgetDefaults: true` the maxBudget / budgetDuration
+ * fallbacks are dropped: an unset field stays undefined, provisionUser leaves
+ * it out of /user/new, and LiteLLM's max_internal_user_budget /
+ * internal_user_budget_duration apply instead (internal_user role only).
  */
 export declare function readProvisioningDefaults(config: Config): {
     enabled: boolean;

package/dist/provisioning.js

@@ -88,12 +88,20 @@ function applyRoleOverrides(defaults, role) {
  *   tpmLimit:       none — LiteLLM global / team limits still apply
  *   rpmLimit:       none — same
  *   metadata:       backstage source tag only
+ *
+ * With `useGatewayBudgetDefaults: true` the maxBudget / budgetDuration
+ * fallbacks are dropped: an unset field stays undefined, provisionUser leaves
+ * it out of /user/new, and LiteLLM's max_internal_user_budget /
+ * internal_user_budget_duration apply instead (internal_user role only).
  */
 function readProvisioningDefaults(config) {
     const enabled = config.getOptionalBoolean('litellm.provisioning.enabled') ?? false;
+    const useGatewayBudgetDefaults = config.getOptionalBoolean('litellm.provisioning.defaults.useGatewayBudgetDefaults') ?? false;
+    const maxBudget = config.getOptionalNumber('litellm.provisioning.defaults.maxBudget');
+    const budgetDuration = config.getOptionalString('litellm.provisioning.defaults.budgetDuration');
     const defaults = {
-        maxBudget: config.getOptionalNumber('litellm.provisioning.defaults.maxBudget') ?? 10,
-        budgetDuration: config.getOptionalString('litellm.provisioning.defaults.budgetDuration') ?? '30d',
+        maxBudget: maxBudget ?? (useGatewayBudgetDefaults ? undefined : 10),
+        budgetDuration: budgetDuration ?? (useGatewayBudgetDefaults ? undefined : '30d'),
         models: config.getOptionalStringArray('litellm.provisioning.defaults.models') ??
             [],
         teams: config.getOptionalStringArray('litellm.provisioning.defaults.teams') ??
@@ -180,8 +188,11 @@ async function provisionUser(client, userId, defaults, profile, backstageEntity,
         user_id: userId,
         ...(profile.email && { user_email: profile.email }),
         ...(profile.displayName && { user_alias: profile.displayName }),
-        max_budget: defaults.maxBudget,
-        budget_duration: defaults.budgetDuration,
+        // Undefined = left out, so LiteLLM's internal-user defaults apply.
+        ...(defaults.maxBudget !== undefined && { max_budget: defaults.maxBudget }),
+        ...(defaults.budgetDuration !== undefined && {
+            budget_duration: defaults.budgetDuration,
+        }),
         models: defaults.models,
         teams: defaults.teams,
         ...(defaults.tpmLimit !== undefined && { tpm_limit: defaults.tpmLimit }),

package/dist/router.js

@@ -112,7 +112,9 @@ async function createRouter(options) {
     const langfuseCfg = (0, langfuse_1.readLangfuseConfig)(config);
     const catalogClient = options.catalogClient ?? new catalog_client_1.CatalogClient({ discoveryApi: discovery });
     if (provisioningEnabled) {
-        logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=$${provisioningDefaults.maxBudget}/${provisioningDefaults.budgetDuration}, models=${provisioningDefaults.models.length
+        logger.info(`LiteLLM auto-provisioning enabled — defaults: budget=${provisioningDefaults.maxBudget === undefined
+            ? 'gateway default'
+            : `$${provisioningDefaults.maxBudget}`}/${provisioningDefaults.budgetDuration ?? 'gateway default'}, models=${provisioningDefaults.models.length
             ? provisioningDefaults.models.join(',')
             : 'all'}, teams=[${provisioningDefaults.teams.join(',')}]`);
     }

package/dist/routes/config.js

@@ -18,7 +18,11 @@ function registerConfigRoutes(router, ctx) {
         res.json({
             baseUrl: ctx.publicBaseUrl,
             supportContact: ctx.supportContact,
-            keyGeneration: { allowUnlimitedBudget: ctx.allowUnlimitedBudget, teamRequired: ctx.teamRequired },
+            keyGeneration: {
+                allowUnlimitedBudget: ctx.allowUnlimitedBudget,
+                teamRequired: ctx.teamRequired,
+                allowedDurations: ctx.keyValidationConfig.allowedDurations,
+            },
             keyActions: { allowOwnerResetSpend: ctx.allowOwnerResetSpend },
             opencode: { enabled: ctx.opencodeCfg.enabled },
             teamManagement: {

package/dist/services/keyService.js

@@ -10,6 +10,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.KeyServiceError = void 0;
 exports.createKeyForUser = createKeyForUser;
 const provisioning_1 = require("../provisioning");
+const backstage_plugin_litellm_common_1 = require("@acarmisc/backstage-plugin-litellm-common");
 const modelAccess_1 = require("./modelAccess");
 const mcpAccess_1 = require("./mcpAccess");
 /** Error thrown during key creation — maps to HTTP responses. */
@@ -145,10 +146,19 @@ async function createKeyForUser(user, input, ctx) {
         upstreamRequest.models = input.models;
     }
     // Never mint a non-expiring key by omission: default to 30d, or the first
-    // allowed duration when 30d isn't offered.
+    // allowed duration other than "never" when 30d isn't offered.
     const durations = ctx.keyValidationConfig.allowedDurations;
-    const defaultDuration = durations.length === 0 || durations.includes('30d') ? '30d' : durations[0];
-    upstreamRequest.duration = input.duration ?? defaultDuration;
+    const defaultDuration = durations.length === 0 || durations.includes('30d')
+        ? '30d'
+        : durations.find(d => d !== backstage_plugin_litellm_common_1.NEVER_KEY_DURATION);
+    const duration = input.duration ?? defaultDuration;
+    if (duration === undefined) {
+        throw new KeyServiceError(400, { error: 'duration is required' });
+    }
+    // LiteLLM treats a missing duration as "never expires".
+    if (duration !== backstage_plugin_litellm_common_1.NEVER_KEY_DURATION) {
+        upstreamRequest.duration = duration;
+    }
     if (input.max_budget !== undefined) {
         // max_budget from input can be null (unlimited) or a number
         upstreamRequest.max_budget = input.max_budget ?? undefined;

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type TeamMemberUsage,\n  type TeamMemberUsageRow,\n  type TeamKeyUsage,\n  type TeamKeyUsageRow,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n  type SpendLogEntry,\n  type SpendLogsParams,\n  type PaginatedSpendLogs,\n  type QualityByModel,\n  type QualityScore,\n  type QualitySummary,\n  type QualityResponse,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["// Re-export common types for backward compatibility\nexport {\n  type UserInfo,\n  type TeamMember,\n  type TeamObjectPermission,\n  type TeamInfo,\n  type CreateTeamResponse,\n  type VirtualKey,\n  type ModelInfo,\n  type UsageModelBreakdown,\n  type UsageKeyBreakdown,\n  type UsageDailyPoint,\n  type UsageDailyModelPoint,\n  type UsageMetrics,\n  type TeamMemberUsage,\n  type TeamMemberUsageRow,\n  type TeamKeyUsage,\n  type TeamKeyUsageRow,\n  type GenerateKeyRequest,\n  type UpdateKeyRequest,\n  type GenerateKeyResponse,\n  type AuditLogEntry,\n  type PaginatedAuditLogs,\n  type SpendLogEntry,\n  type SpendLogsParams,\n  type PaginatedSpendLogs,\n  type QualityByModel,\n  type QualityScore,\n  type QualitySummary,\n  type QualityResponse,\n} from '@acarmisc/backstage-plugin-litellm-common';\n\nexport interface CreateTeamRequest {\n  team_alias: string;\n  models?: string[];\n  max_budget?: number;\n  budget_duration?: string;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, unknown>;\n  object_permission?: {\n    vector_stores?: string[];\n    mcp_servers?: string[];\n    mcp_access_groups?: string[];\n  };\n}\n\nexport interface UpdateTeamRequest extends Partial<CreateTeamRequest> {\n  team_id: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  budget_duration?: string | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n  /** Arbitrary metadata stored on the key record. */\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  /**\n   * max_budget sent on /user/new. Undefined (only possible with\n   * litellm.provisioning.defaults.useGatewayBudgetDefaults) leaves it out, so\n   * LiteLLM's max_internal_user_budget applies.\n   */\n  maxBudget?: number;\n  /**\n   * budget_duration sent on /user/new. Undefined (only possible with\n   * litellm.provisioning.defaults.useGatewayBudgetDefaults) leaves it out, so\n   * LiteLLM's internal_user_budget_duration applies.\n   */\n  budgetDuration?: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -49,8 +49,18 @@ export interface LiteLLMConfig {
     masterKey: string;
 }
 export interface ProvisioningDefaults {
-    maxBudget: number;
-    budgetDuration: string;
+    /**
+     * max_budget sent on /user/new. Undefined (only possible with
+     * litellm.provisioning.defaults.useGatewayBudgetDefaults) leaves it out, so
+     * LiteLLM's max_internal_user_budget applies.
+     */
+    maxBudget?: number;
+    /**
+     * budget_duration sent on /user/new. Undefined (only possible with
+     * litellm.provisioning.defaults.useGatewayBudgetDefaults) leaves it out, so
+     * LiteLLM's internal_user_budget_duration applies.
+     */
+    budgetDuration?: string;
     models: string[];
     teams: string[];
     tpmLimit?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",
@@ -35,7 +35,7 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@acarmisc/backstage-plugin-litellm-common": "0.6.0",
+    "@acarmisc/backstage-plugin-litellm-common": "0.7.0",
     "@backstage/backend-plugin-api": "^1.11.0",
     "@backstage/catalog-client": "^1.9.0",
     "@backstage/config": "^1.3.0",