@acarmisc/backstage-plugin-litellm-backend 0.5.0 → 0.6.0

package/dist/openapi.d.ts

@@ -0,0 +1,21 @@
+export interface OpenApiSpec {
+    openapi: string;
+    info: {
+        title: string;
+        version: string;
+        description: string;
+    };
+    servers: {
+        url: string;
+        description: string;
+    }[];
+    tags: {
+        name: string;
+        description: string;
+    }[];
+    paths: Record<string, Record<string, any>>;
+    components: {
+        securitySchemes: Record<string, any>;
+    };
+}
+export declare const openApiSpec: OpenApiSpec;

package/dist/openapi.js

@@ -0,0 +1,284 @@
+"use strict";
+// OpenAPI 3.1 contract for the plugin's own backend surface.
+//
+// Kept as a TypeScript object so the router can serve it at
+// GET /api/litellm/openapi.json without a YAML parser dependency, and so
+// a future tool can regenerate the README endpoint table from it.
+//
+// Conventions:
+//   - Every UI route authenticates via a Backstage user bearer token
+//     (Authorization: Bearer <backstage-token>). The bridge routes use a
+//     raw Keycloak access token instead and are gated by
+//     litellm.bridge.enabled.
+//   - Key-mutation routes 403 when the target key does not belong to the
+//     caller (ownership guard; see router.ts authorizeKeyAction).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openApiSpec = void 0;
+exports.openApiSpec = {
+    openapi: '3.1.0',
+    info: {
+        title: 'LiteLLM Governance Plugin API',
+        version: '0.1.0',
+        description: 'Backstage backend surface for the LiteLLM governance plugin. ' +
+            'UI routes authenticate via the Backstage identity system; CLI bridge ' +
+            'routes authenticate with a Keycloak access token.',
+    },
+    servers: [
+        { url: '/api/litellm', description: 'Backstage backend plugin mount point' },
+    ],
+    tags: [
+        { name: 'System', description: 'Health and configuration' },
+        { name: 'User', description: 'Current user info and provisioning' },
+        { name: 'Keys', description: 'Virtual key lifecycle' },
+        { name: 'Models', description: 'Model catalogue' },
+        { name: 'Teams', description: 'Team membership and usage' },
+        { name: 'Usage', description: 'Spend and traffic analytics' },
+        { name: 'Audit', description: 'Audit logs (RBAC-gated)' },
+        { name: 'Provisioning', description: 'Provisioning dry-run (RBAC-gated)' },
+        { name: 'Bridge', description: 'CLI bridge (Keycloak-token auth)' },
+    ],
+    paths: {
+        '/health': {
+            get: {
+                tags: ['System'],
+                summary: 'Health check',
+                responses: {
+                    '200': {
+                        description: 'Plugin health',
+                        content: { 'application/json': { schema: { type: 'object', properties: {
+                                        status: { type: 'string' },
+                                        provisioning: { type: 'boolean' },
+                                    } } } },
+                    },
+                },
+            },
+        },
+        '/config': {
+            get: {
+                tags: ['System'],
+                summary: 'Public LiteLLM proxy base URL (for snippet generation)',
+                responses: {
+                    '200': {
+                        description: 'Proxy URL',
+                        content: { 'application/json': { schema: { type: 'object', properties: {
+                                        baseUrl: { type: 'string' },
+                                    } } } },
+                    },
+                },
+            },
+        },
+        '/openapi.json': {
+            get: {
+                tags: ['System'],
+                summary: 'This OpenAPI document',
+                responses: { '200': { description: 'OpenAPI 3.1 JSON' } },
+            },
+        },
+        '/user/info': {
+            get: {
+                tags: ['User'],
+                summary: "Get the current user's info and quotas",
+                responses: {
+                    '200': { description: 'User info' },
+                    '404': { description: 'User not found in LiteLLM (provisioning disabled)' },
+                },
+            },
+        },
+        '/keys': {
+            get: {
+                tags: ['Keys'],
+                summary: "List the caller's virtual keys",
+                responses: { '200': { description: 'Array of keys' } },
+            },
+        },
+        '/keys/generate': {
+            post: {
+                tags: ['Keys'],
+                summary: 'Generate a new virtual key',
+                requestBody: {
+                    required: true,
+                    content: { 'application/json': { schema: { type: 'object', properties: {
+                                    alias: { type: 'string' },
+                                    models: { type: 'array', items: { type: 'string' } },
+                                    team_id: { type: 'string' },
+                                    duration: { type: 'string' },
+                                    max_budget: { type: 'number', nullable: true, description: 'Positive number caps spend; null = unlimited' },
+                                    tpm_limit: { type: 'number' },
+                                    rpm_limit: { type: 'number' },
+                                    auto_rotate: { type: 'boolean' },
+                                    rotation_interval_days: { type: 'number' },
+                                } } } },
+                },
+                responses: {
+                    '200': { description: 'Generated key (includes the raw secret — shown once)' },
+                    '400': { description: 'Missing required fields' },
+                },
+            },
+        },
+        '/keys/{keyId}': {
+            delete: {
+                tags: ['Keys'],
+                summary: 'Revoke/delete a virtual key (caller must own it)',
+                parameters: [{ name: 'keyId', in: 'path', required: true, schema: { type: 'string' } }],
+                responses: { '200': { description: 'Deleted' }, '403': { description: 'Not the key owner' } },
+            },
+        },
+        '/keys/{keyId}/regenerate': {
+            post: {
+                tags: ['Keys'],
+                summary: 'Rotate a key in place (caller must own it)',
+                parameters: [{ name: 'keyId', in: 'path', required: true, schema: { type: 'string' } }],
+                responses: { '200': { description: 'New secret' }, '403': { description: 'Not the key owner' } },
+            },
+        },
+        '/keys/{keyId}/update': {
+            post: {
+                tags: ['Keys'],
+                summary: 'Update alias / models / budget / limits (caller must own it)',
+                parameters: [{ name: 'keyId', in: 'path', required: true, schema: { type: 'string' } }],
+                requestBody: { content: { 'application/json': { schema: { type: 'object' } } } },
+                responses: { '200': { description: 'Updated' }, '403': { description: 'Not the key owner' } },
+            },
+        },
+        '/keys/{keyId}/block': {
+            post: {
+                tags: ['Keys'],
+                summary: 'Suspend a key without revoking (caller must own it)',
+                parameters: [{ name: 'keyId', in: 'path', required: true, schema: { type: 'string' } }],
+                responses: { '200': { description: 'Blocked' }, '403': { description: 'Not the key owner' } },
+            },
+        },
+        '/keys/{keyId}/unblock': {
+            post: {
+                tags: ['Keys'],
+                summary: 'Re-enable a blocked key (caller must own it)',
+                parameters: [{ name: 'keyId', in: 'path', required: true, schema: { type: 'string' } }],
+                responses: { '200': { description: 'Unblocked' }, '403': { description: 'Not the key owner' } },
+            },
+        },
+        '/keys/{keyId}/reset_spend': {
+            post: {
+                tags: ['Keys'],
+                summary: 'Zero out a key spend counter (caller must own it)',
+                parameters: [{ name: 'keyId', in: 'path', required: true, schema: { type: 'string' } }],
+                responses: { '200': { description: 'Spend reset' }, '403': { description: 'Not the key owner' } },
+            },
+        },
+        '/models': {
+            get: {
+                tags: ['Models'],
+                summary: 'List available LLM models',
+                responses: { '200': { description: 'Model catalogue' } },
+            },
+        },
+        '/teams': {
+            get: {
+                tags: ['Teams'],
+                summary: 'List teams the current user belongs to',
+                responses: { '200': { description: 'Array of teams' } },
+            },
+        },
+        '/teams/{teamId}/usage': {
+            get: {
+                tags: ['Teams'],
+                summary: 'Usage metrics for a team',
+                parameters: [
+                    { name: 'teamId', in: 'path', required: true, schema: { type: 'string' } },
+                    { name: 'start_date', in: 'query', required: true, schema: { type: 'string' } },
+                    { name: 'end_date', in: 'query', required: true, schema: { type: 'string' } },
+                ],
+                responses: { '200': { description: 'Team usage' }, '400': { description: 'Missing date range' } },
+            },
+        },
+        '/usage': {
+            get: {
+                tags: ['Usage'],
+                summary: 'Usage metrics for the current user',
+                parameters: [
+                    { name: 'start_date', in: 'query', required: true, schema: { type: 'string' } },
+                    { name: 'end_date', in: 'query', required: true, schema: { type: 'string' } },
+                ],
+                responses: { '200': { description: 'Usage metrics' }, '400': { description: 'Missing date range' } },
+            },
+        },
+        '/audit': {
+            get: {
+                tags: ['Audit'],
+                summary: 'Audit logs (gated by litellm.audit.group membership)',
+                parameters: [
+                    { name: 'page', in: 'query', schema: { type: 'integer' } },
+                    { name: 'page_size', in: 'query', schema: { type: 'integer' } },
+                    { name: 'start_date', in: 'query', schema: { type: 'string' } },
+                    { name: 'end_date', in: 'query', schema: { type: 'string' } },
+                    { name: 'action', in: 'query', schema: { type: 'string' } },
+                    { name: 'table_name', in: 'query', schema: { type: 'string' } },
+                    { name: 'changed_by', in: 'query', schema: { type: 'string' } },
+                ],
+                responses: { '200': { description: 'Paginated audit logs' }, '403': { description: 'Not configured or not authorized' } },
+            },
+        },
+        '/provisioning/preview': {
+            get: {
+                tags: ['Provisioning'],
+                summary: 'Resolve which role a Backstage group maps to (dry-run)',
+                parameters: [
+                    { name: 'group', in: 'query', required: true, schema: { type: 'string' }, description: 'e.g. group:default/ai-platform' },
+                ],
+                responses: {
+                    '200': { description: 'Resolved role and effective defaults' },
+                    '400': { description: 'Missing group parameter' },
+                    '403': { description: 'Not configured or not authorized' },
+                },
+            },
+        },
+        '/bridge/health': {
+            get: {
+                tags: ['Bridge'],
+                summary: 'Bridge health + configured clientId (no auth)',
+                responses: { '200': { description: 'Bridge health' } },
+            },
+        },
+        '/bridge/keys': {
+            get: {
+                tags: ['Bridge'],
+                summary: 'List the caller virtual keys (Keycloak token auth)',
+                responses: { '200': { description: 'Array of keys' }, '401': { description: 'Invalid token' } },
+            },
+            post: {
+                tags: ['Bridge'],
+                summary: 'Mint a virtual key for the caller (Keycloak token auth)',
+                requestBody: { content: { 'application/json': { schema: { type: 'object' } } } },
+                responses: { '200': { description: 'Generated key' }, '401': { description: 'Invalid token' } },
+            },
+        },
+        '/bridge/keys/regenerate': {
+            post: {
+                tags: ['Bridge'],
+                summary: 'Rotate the caller key by alias (Keycloak token auth)',
+                requestBody: { content: { 'application/json': { schema: { type: 'object', properties: { alias: { type: 'string' } } } } } },
+                responses: { '200': { description: 'New secret' }, '401': { description: 'Invalid token' }, '404': { description: 'No key with that alias' } },
+            },
+        },
+        '/bridge/models': {
+            get: {
+                tags: ['Bridge'],
+                summary: 'List available LLM models (Keycloak token auth)',
+                responses: { '200': { description: 'Model catalogue' }, '401': { description: 'Invalid token' } },
+            },
+        },
+    },
+    components: {
+        securitySchemes: {
+            backstageUserToken: {
+                type: 'http',
+                scheme: 'bearer',
+                description: 'Backstage-issued user token (Authorization: Bearer <token>).',
+            },
+            keycloakAccessToken: {
+                type: 'http',
+                scheme: 'bearer',
+                description: 'Raw Keycloak access token. Bridge routes only; verified against the realm JWKS.',
+            },
+        },
+    },
+};

package/dist/router.js

@@ -38,6 +38,7 @@ exports.createRouter = createRouter;
 const express_1 = __importStar(require("express"));
 const catalog_client_1 = require("@backstage/catalog-client");
 const client_1 = require("./client");
+const openapi_1 = require("./openapi");
 const provisioning_1 = require("./provisioning");
 Object.defineProperty(exports, "ProvisioningError", { enumerable: true, get: function () { return provisioning_1.ProvisioningError; } });
 const bridge_1 = require("./bridge");
@@ -73,6 +74,60 @@ async function createRouter(options) {
     router.get('/config', (_req, res) => {
         res.json({ baseUrl: publicBaseUrl });
     });
+    // Self-hosted OpenAPI 3.1 contract — lets integrators read a spec instead
+    // of router.ts. No swagger-ui dependency; serve the JSON and point external
+    // renderers (Stoplight, Swagger UI hosted elsewhere) at this endpoint.
+    router.get('/openapi.json', (_req, res) => {
+        res.json(openapi_1.openApiSpec);
+    });
+    // Provisioning dry-run: resolves which role a Backstage group maps to and
+    // echoes the effective defaults, collapsing the config → deploy → test loop
+    // into one request. Admin-gated by the audit group (same RBAC as /audit).
+    router.get('/provisioning/preview', async (req, res) => {
+        if (!auditGroup) {
+            res.status(403).json({ error: 'Preview is not configured (litellm.audit.group not set)' });
+            return;
+        }
+        const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+        if (!tokenEntityRef) {
+            res.status(401).json({ error: 'Authentication required' });
+            return;
+        }
+        const allowed = await (0, provisioning_1.isUserMemberOfGroup)(tokenEntityRef, auditGroup, catalogClient, auth, logger);
+        if (!allowed) {
+            res.status(403).json({ error: 'Access denied: not a member of the audit group' });
+            return;
+        }
+        const group = req.query.group?.trim();
+        if (!group) {
+            res.status(400).json({ error: 'group query parameter is required (e.g. group=group:default/ai-platform)' });
+            return;
+        }
+        if (!roleConfigs.length) {
+            res.json({
+                group,
+                matched_role: null,
+                effective_defaults: provisioningDefaults,
+                note: 'No litellm.provisioning.roles configured — every group receives the base defaults.',
+            });
+            return;
+        }
+        try {
+            const matched = roleConfigs.find(rc => rc.group === group);
+            const effective = matched
+                ? (0, provisioning_1.applyRoleOverrides)(provisioningDefaults, matched)
+                : provisioningDefaults;
+            res.json({
+                group,
+                matched_role: matched?.group ?? null,
+                effective_defaults: effective,
+            });
+        }
+        catch (error) {
+            logger.error('Failed to resolve provisioning preview', error);
+            res.status(500).json({ error: error.message });
+        }
+    });
     router.get('/user/info', async (req, res) => {
         try {
             const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
@@ -113,6 +168,40 @@ async function createRouter(options) {
             res.status(500).json({ error: error.message });
         }
     });
+    // ── Key ownership guard ──────────────────────────────────────────────────
+    //
+    // Every key-mutation route below runs under the LiteLLM master key, so
+    // without an explicit check any authenticated Backstage user could act on
+    // any key whose token they learn (audit logs expose truncated tokens, and
+    // anyone who has held the raw key knows it). We port the same pattern the
+    // bridge already uses (bridge.ts:bridgeRegenerateKey): fetch the caller's
+    // own key list and 403 if the target token isn't in it.
+    //
+    // Returns the caller's LiteLLM user_id (when resolvable) so handlers can
+    // stamp it in logs without re-deriving it.
+    async function authorizeKeyAction(req, keyId) {
+        const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+        const userId = tokenEntityRef
+            ? (0, provisioning_1.toLiteLLMUserId)(tokenEntityRef, userIdDomain)
+            : req.query.user_id;
+        if (!userId) {
+            throw { status: 403, body: { error: 'Cannot verify key ownership without an authenticated user' } };
+        }
+        const ownKeys = await client.listKeys(userId);
+        const owns = ownKeys.some(k => (k.token ?? k.key) === keyId);
+        if (!owns) {
+            throw { status: 403, body: { error: 'Access denied: key does not belong to the caller' } };
+        }
+        return { tokenEntityRef, userId };
+    }
+    // Normalize the ownership-guard rejection shape into a response.
+    function sendOwnershipError(err, res) {
+        if (err && typeof err.status === 'number' && err.body) {
+            res.status(err.status).json(err.body);
+            return true;
+        }
+        return false;
+    }
     router.post('/keys/:keyId/regenerate', async (req, res) => {
         try {
             const { keyId } = req.params;
@@ -120,12 +209,14 @@ async function createRouter(options) {
                 res.status(400).json({ error: 'keyId is required' });
                 return;
             }
-            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
             const result = await client.regenerateKey(keyId);
             logger.info({ action: 'key.rotate', userId: tokenEntityRef ?? 'unknown', keyId });
             res.json(result);
         }
         catch (error) {
+            if (sendOwnershipError(error, res))
+                return;
             logger.error('Failed to rotate key', error);
             res.status(500).json({ error: error.message });
         }
@@ -204,13 +295,15 @@ async function createRouter(options) {
                 res.status(400).json({ error: 'keyId is required' });
                 return;
             }
-            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
             const request = { ...req.body, key: keyId };
             const result = await client.updateKey(request);
             logger.info({ action: 'key.update', userId: tokenEntityRef ?? 'unknown', keyId });
             res.json(result);
         }
         catch (error) {
+            if (sendOwnershipError(error, res))
+                return;
             logger.error('Failed to update key', error);
             res.status(500).json({ error: error.message });
         }
@@ -222,12 +315,14 @@ async function createRouter(options) {
                 res.status(400).json({ error: 'keyId is required' });
                 return;
             }
-            const deleteEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
             await client.deleteKeys({ keys: [keyId] });
-            logger.info({ action: 'key.delete', userId: deleteEntityRef ?? 'unknown', keyId });
+            logger.info({ action: 'key.delete', userId: tokenEntityRef ?? 'unknown', keyId });
             res.json({ success: true });
         }
         catch (error) {
+            if (sendOwnershipError(error, res))
+                return;
             logger.error('Failed to delete key', error);
             res.status(500).json({ error: error.message });
         }
@@ -235,12 +330,14 @@ async function createRouter(options) {
     router.post('/keys/:keyId/block', async (req, res) => {
         try {
             const { keyId } = req.params;
-            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
             await client.blockKey(keyId);
             logger.info({ action: 'key.block', userId: tokenEntityRef ?? 'unknown', keyId });
             res.json({ success: true });
         }
         catch (error) {
+            if (sendOwnershipError(error, res))
+                return;
             logger.error('Failed to block key', error);
             res.status(500).json({ error: error.message });
         }
@@ -248,12 +345,14 @@ async function createRouter(options) {
     router.post('/keys/:keyId/unblock', async (req, res) => {
         try {
             const { keyId } = req.params;
-            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
             await client.unblockKey(keyId);
             logger.info({ action: 'key.unblock', userId: tokenEntityRef ?? 'unknown', keyId });
             res.json({ success: true });
         }
         catch (error) {
+            if (sendOwnershipError(error, res))
+                return;
             logger.error('Failed to unblock key', error);
             res.status(500).json({ error: error.message });
         }
@@ -261,12 +360,14 @@ async function createRouter(options) {
     router.post('/keys/:keyId/reset_spend', async (req, res) => {
         try {
             const { keyId } = req.params;
-            const tokenEntityRef = await (0, provisioning_1.resolveUserId)(req, auth);
+            const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
             await client.resetKeySpend(keyId);
             logger.info({ action: 'key.reset_spend', userId: tokenEntityRef ?? 'unknown', keyId });
             res.json({ success: true });
         }
         catch (error) {
+            if (sendOwnershipError(error, res))
+                return;
             logger.error('Failed to reset key spend', error);
             res.status(500).json({ error: error.message });
         }
@@ -358,7 +459,7 @@ async function createRouter(options) {
     });
     router.get('/usage', async (req, res) => {
         try {
-            const { start_date, end_date, group_by } = req.query;
+            const { start_date, end_date } = req.query;
             if (!start_date || !end_date) {
                 res.status(400).json({ error: 'start_date and end_date are required' });
                 return;
@@ -370,7 +471,7 @@ async function createRouter(options) {
             if (userId) {
                 await (0, provisioning_1.getOrProvisionUser)(client, tokenEntityRef, userId, provisioningEnabled, provisioningDefaults, roleConfigs, catalogClient, auth, logger);
             }
-            const usage = await client.getUsage(start_date, end_date, userId, group_by);
+            const usage = await client.getUsage(start_date, end_date, userId);
             res.json(usage);
         }
         catch (error) {

package/dist/types.cjs.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/types.ts"],
-  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  spend: number;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
+  "sourcesContent": ["export interface UserInfo {\n  user_id: string;\n  user_email?: string;\n  email?: string;\n  teams?: string[];\n  models?: string[];\n  max_budget?: number;\n  spend?: number;\n  current_spend?: number;\n  soft_limit?: number;\n  hard_limit?: number;\n  /** Backstage-computed: true when the user is a member of litellm.audit.group */\n  can_view_audit?: boolean;\n}\n\nexport interface TeamMember {\n  user_id: string;\n  role: 'admin' | 'user';\n}\n\nexport interface TeamInfo {\n  team_id: string;\n  team_alias?: string;\n  max_budget?: number;\n  spend: number;\n  members_with_roles?: TeamMember[];\n  models?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n}\n\nexport interface VirtualKey {\n  key: string;\n  token: string;\n  key_alias?: string;\n  created_at: string;\n  expires_at?: string;\n  spend: number;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n  user_id?: string;\n  blocked?: boolean;\n}\n\n/**\n * Shape of a single entry inside LiteLLM's `/user/info` `keys` array.\n * Differs from VirtualKey: uses `expires` (not `expires_at`), exposes\n * both a hashed `token` and a masked `key_name`, and fields are nullable\n * rather than optional.\n */\nexport interface LiteLLMUserKey {\n  token: string;\n  key_name?: string;\n  key_alias?: string | null;\n  spend?: number;\n  expires?: string | null;\n  models?: string[];\n  tpm_limit?: number | null;\n  rpm_limit?: number | null;\n  max_budget?: number | null;\n  user_id?: string | null;\n  team_id?: string | null;\n  created_at: string;\n  blocked?: boolean | null;\n}\n\nexport interface ModelInfo {\n  model_name: string;\n  mode: string;\n  supports_function_calling?: boolean;\n  supports_vision?: boolean;\n  input_cost_per_token?: number;\n  output_cost_per_token?: number;\n  max_input_tokens?: number;\n  max_output_tokens?: number;\n}\n\nexport interface UsageModelBreakdown {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageKeyBreakdown {\n  key_alias?: string;\n  team_id?: string | null;\n  models: string[];\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyPoint {\n  date: string;\n  spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageDailyModelPoint {\n  date: string;\n  model: string;\n  spend: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  total_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n}\n\nexport interface UsageMetrics {\n  total_spend: number;\n  total_tokens: number;\n  prompt_tokens: number;\n  completion_tokens: number;\n  api_requests: number;\n  successful_requests: number;\n  failed_requests: number;\n  usage_by_model: Record<string, UsageModelBreakdown>;\n  usage_by_key: Record<string, UsageKeyBreakdown>;\n  daily_usage: UsageDailyPoint[];\n  daily_by_model: UsageDailyModelPoint[];\n}\n\nexport interface GenerateKeyRequest {\n  alias?: string;\n  models?: string[];\n  duration?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  user_id?: string;\n  team_id?: string;\n  key_type?: string;\n  metadata?: Record<string, string>;\n  /** When true, LiteLLM rotates the key on a schedule. */\n  auto_rotate?: boolean;\n  /** Rotation interval in days (LiteLLM-enforced when auto_rotate is true). */\n  rotation_interval_days?: number;\n}\n\nexport interface UpdateKeyRequest {\n  key: string;\n  key_alias?: string;\n  models?: string[];\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  team_id?: string;\n  duration?: string;\n}\n\nexport interface GenerateKeyResponse {\n  key: string;\n  key_alias?: string;\n  expires_at?: string;\n  max_budget?: number;\n  tpm_limit?: number;\n  rpm_limit?: number;\n  models?: string[];\n}\n\nexport interface DeleteKeyRequest {\n  keys: string[];\n}\n\nexport interface LiteLLMConfig {\n  baseUrl: string;\n  masterKey: string;\n}\n\nexport interface ProvisioningDefaults {\n  maxBudget: number;\n  budgetDuration: string;\n  models: string[];\n  teams: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  /**\n   * LiteLLM user role applied on /user/new. Defaults to \"internal_user\"\n   * which grants self-service Create/Delete/View on the user's own keys.\n   * Valid values: proxy_admin, proxy_admin_viewer, internal_user,\n   * internal_user_viewer, team.\n   */\n  userRole?: string;\n  metadata: Record<string, string>;\n}\n\nexport interface RoleConfig {\n  group: string;\n  maxBudget?: number;\n  budgetDuration?: string;\n  models?: string[];\n  teams?: string[];\n  tpmLimit?: number;\n  rpmLimit?: number;\n  userRole?: string;\n  metadata?: Record<string, string>;\n}\n\nexport interface CreateUserRequest {\n  user_id: string;\n  user_email?: string;\n  user_alias?: string;\n  user_role?: string;\n  max_budget?: number;\n  budget_duration?: string;\n  models?: string[];\n  teams?: string[];\n  tpm_limit?: number;\n  rpm_limit?: number;\n  metadata?: Record<string, string>;\n  auto_create_key?: boolean;\n}\n\nexport interface CreateUserResponse {\n  user_id: string;\n  user_email?: string;\n  max_budget?: number;\n  models?: string[];\n  teams?: string[];\n}\n\nexport interface AuditLogEntry {\n  id: string;\n  updated_at: string;\n  changed_by?: string;\n  changed_by_api_key?: string;\n  action?: string;\n  table_name?: string;\n  object_id?: string;\n  before_value?: Record<string, unknown> | null;\n  updated_values?: Record<string, unknown> | null;\n}\n\nexport interface PaginatedAuditLogs {\n  audit_logs: AuditLogEntry[];\n  total: number;\n  page: number;\n  page_size: number;\n  total_pages: number;\n}\n\nexport interface AuditLogsParams {\n  page?: number;\n  page_size?: number;\n  start_date?: string;\n  end_date?: string;\n  action?: string;\n  table_name?: string;\n  changed_by?: string;\n  sort_by?: string;\n  sort_order?: 'asc' | 'desc';\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;AAAA;AAAA;",
   "names": []
 }

package/dist/types.d.ts

@@ -68,6 +68,8 @@ export interface ModelInfo {
     supports_vision?: boolean;
     input_cost_per_token?: number;
     output_cost_per_token?: number;
+    max_input_tokens?: number;
+    max_output_tokens?: number;
 }
 export interface UsageModelBreakdown {
     total_spend: number;
@@ -135,6 +137,10 @@ export interface GenerateKeyRequest {
     team_id?: string;
     key_type?: string;
     metadata?: Record<string, string>;
+    /** When true, LiteLLM rotates the key on a schedule. */
+    auto_rotate?: boolean;
+    /** Rotation interval in days (LiteLLM-enforced when auto_rotate is true). */
+    rotation_interval_days?: number;
 }
 export interface UpdateKeyRequest {
     key: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acarmisc/backstage-plugin-litellm-backend",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "The Backstage backend plugin for LiteLLM governance",
   "backstage": {
     "role": "backend-plugin",