@acarmisc/backstage-plugin-litellm-backend 0.6.0 → 0.6.2

package/dist/bridge.d.ts

@@ -75,13 +75,3 @@ export declare function bridgeListKeys(client: LiteLLMClient, claims: BridgeClai
 export declare function bridgeGenerateKey(client: LiteLLMClient, claims: BridgeClaims, provisioningEnabled: boolean, provisioningDefaults: ProvisioningDefaults, logger: {
     info: (...args: unknown[]) => void;
 }, request: Partial<GenerateKeyRequest>, userIdDomain?: string): Promise<GenerateKeyResponse>;
-/**
- * Rotates the caller's key identified by alias, returning a fresh secret. The
- * bridge can't recover a usable secret from a listing (it's masked), so a CLI
- * that lost its cached key but whose stable alias still exists uses this to
- * rotate in place instead of minting a duplicate. Throws 404 when no key with
- * that alias exists for the caller — the CLI then mints one.
- */
-export declare function bridgeRegenerateKey(client: LiteLLMClient, claims: BridgeClaims, provisioningEnabled: boolean, provisioningDefaults: ProvisioningDefaults, logger: {
-    info: (...args: unknown[]) => void;
-}, alias: string, userIdDomain?: string): Promise<GenerateKeyResponse>;

package/dist/bridge.js

@@ -7,7 +7,6 @@ exports.resolveBridgeUserId = resolveBridgeUserId;
 exports.getOrProvisionUserFromClaims = getOrProvisionUserFromClaims;
 exports.bridgeListKeys = bridgeListKeys;
 exports.bridgeGenerateKey = bridgeGenerateKey;
-exports.bridgeRegenerateKey = bridgeRegenerateKey;
 /**
  * Bridge — lets CLI clients (Abby) list/mint LiteLLM virtual keys without ever
  * holding the LiteLLM master key.
@@ -153,20 +152,3 @@ async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioni
     };
     return client.generateKey(enriched);
 }
-/**
- * Rotates the caller's key identified by alias, returning a fresh secret. The
- * bridge can't recover a usable secret from a listing (it's masked), so a CLI
- * that lost its cached key but whose stable alias still exists uses this to
- * rotate in place instead of minting a duplicate. Throws 404 when no key with
- * that alias exists for the caller — the CLI then mints one.
- */
-async function bridgeRegenerateKey(client, claims, provisioningEnabled, provisioningDefaults, logger, alias, userIdDomain) {
-    await getOrProvisionUserFromClaims(client, claims, provisioningEnabled, provisioningDefaults, logger, userIdDomain);
-    const userId = resolveBridgeUserId(claims, userIdDomain);
-    const keys = await client.listKeys(userId);
-    const match = keys.find(k => k.key_alias === alias);
-    if (!match) {
-        throw new provisioning_1.ProvisioningError('Key not found', `No key with alias "${alias}" for this identity; mint one first.`, false, 404);
-    }
-    return client.regenerateKey(match.token);
-}

package/dist/client.d.ts

@@ -57,13 +57,6 @@ export declare class LiteLLMClient {
     unblockKey(key: string): Promise<unknown>;
     resetKeySpend(key: string): Promise<unknown>;
     getAuditLogs(params: AuditLogsParams): Promise<PaginatedAuditLogs>;
-    /**
-     * Rotates an existing key in place, returning a fresh `sk-` secret while
-     * keeping the same alias/budget/limits. `token` is the hashed token LiteLLM
-     * stores (the same value used for delete/update) — passed in the path because
-     * it isn't an `sk-` prefixed secret, so LiteLLM matches it without re-hashing.
-     */
-    regenerateKey(token: string): Promise<GenerateKeyResponse>;
     /**
      * Returns the proxy's model catalogue normalised to the ModelInfo shape.
      *

package/dist/client.js

@@ -209,15 +209,6 @@ class LiteLLMClient {
             query.set('sort_order', params.sort_order);
         return this.request(`/audit?${query.toString()}`);
     }
-    /**
-     * Rotates an existing key in place, returning a fresh `sk-` secret while
-     * keeping the same alias/budget/limits. `token` is the hashed token LiteLLM
-     * stores (the same value used for delete/update) — passed in the path because
-     * it isn't an `sk-` prefixed secret, so LiteLLM matches it without re-hashing.
-     */
-    async regenerateKey(token) {
-        return this.request(`/key/${encodeURIComponent(token)}/regenerate`, { method: 'POST', body: JSON.stringify({}) });
-    }
     /**
      * Returns the proxy's model catalogue normalised to the ModelInfo shape.
      *

package/dist/index.cjs.js

@@ -251,18 +251,6 @@ var LiteLLMClient = class {
     if (params.sort_order) query.set("sort_order", params.sort_order);
     return this.request(`/audit?${query.toString()}`);
   }
-  /**
-   * Rotates an existing key in place, returning a fresh `sk-` secret while
-   * keeping the same alias/budget/limits. `token` is the hashed token LiteLLM
-   * stores (the same value used for delete/update) — passed in the path because
-   * it isn't an `sk-` prefixed secret, so LiteLLM matches it without re-hashing.
-   */
-  async regenerateKey(token) {
-    return this.request(
-      `/key/${encodeURIComponent(token)}/regenerate`,
-      { method: "POST", body: JSON.stringify({}) }
-    );
-  }
   /**
    * Returns the proxy's model catalogue normalised to the ModelInfo shape.
    *
@@ -571,9 +559,7 @@ var openApiSpec = {
             duration: { type: "string" },
             max_budget: { type: "number", nullable: true, description: "Positive number caps spend; null = unlimited" },
             tpm_limit: { type: "number" },
-            rpm_limit: { type: "number" },
-            auto_rotate: { type: "boolean" },
-            rotation_interval_days: { type: "number" }
+            rpm_limit: { type: "number" }
           } } } }
         },
         responses: {
@@ -590,14 +576,6 @@ var openApiSpec = {
         responses: { "200": { description: "Deleted" }, "403": { description: "Not the key owner" } }
       }
     },
-    "/keys/{keyId}/regenerate": {
-      post: {
-        tags: ["Keys"],
-        summary: "Rotate a key in place (caller must own it)",
-        parameters: [{ name: "keyId", in: "path", required: true, schema: { type: "string" } }],
-        responses: { "200": { description: "New secret" }, "403": { description: "Not the key owner" } }
-      }
-    },
     "/keys/{keyId}/update": {
       post: {
         tags: ["Keys"],
@@ -718,14 +696,6 @@ var openApiSpec = {
         responses: { "200": { description: "Generated key" }, "401": { description: "Invalid token" } }
       }
     },
-    "/bridge/keys/regenerate": {
-      post: {
-        tags: ["Bridge"],
-        summary: "Rotate the caller key by alias (Keycloak token auth)",
-        requestBody: { content: { "application/json": { schema: { type: "object", properties: { alias: { type: "string" } } } } } },
-        responses: { "200": { description: "New secret" }, "401": { description: "Invalid token" }, "404": { description: "No key with that alias" } }
-      }
-    },
     "/bridge/models": {
       get: {
         tags: ["Bridge"],
@@ -2483,28 +2453,6 @@ async function bridgeGenerateKey(client, claims, provisioningEnabled, provisioni
   };
   return client.generateKey(enriched);
 }
-async function bridgeRegenerateKey(client, claims, provisioningEnabled, provisioningDefaults, logger, alias, userIdDomain) {
-  await getOrProvisionUserFromClaims(
-    client,
-    claims,
-    provisioningEnabled,
-    provisioningDefaults,
-    logger,
-    userIdDomain
-  );
-  const userId = resolveBridgeUserId(claims, userIdDomain);
-  const keys = await client.listKeys(userId);
-  const match = keys.find((k) => k.key_alias === alias);
-  if (!match) {
-    throw new ProvisioningError(
-      "Key not found",
-      `No key with alias "${alias}" for this identity; mint one first.`,
-      false,
-      404
-    );
-  }
-  return client.regenerateKey(match.token);
-}
 
 // src/router.ts
 async function createRouter(options) {
@@ -2660,23 +2608,6 @@ async function createRouter(options) {
     }
     return false;
   }
-  router.post("/keys/:keyId/regenerate", async (req, res) => {
-    try {
-      const { keyId } = req.params;
-      if (!keyId) {
-        res.status(400).json({ error: "keyId is required" });
-        return;
-      }
-      const { tokenEntityRef } = await authorizeKeyAction(req, keyId);
-      const result = await client.regenerateKey(keyId);
-      logger.info({ action: "key.rotate", userId: tokenEntityRef ?? "unknown", keyId });
-      res.json(result);
-    } catch (error) {
-      if (sendOwnershipError(error, res)) return;
-      logger.error("Failed to rotate key", error);
-      res.status(500).json({ error: error.message });
-    }
-  });
   router.post("/keys/generate", async (req, res) => {
     try {
       const body = req.body ?? {};
@@ -2731,6 +2662,13 @@ async function createRouter(options) {
         res.status(error.status).json(error.body);
         return;
       }
+      if (typeof error.message === "string" && error.message.includes("Invalid duration format") && req.body?.team_id) {
+        res.status(502).json({
+          error: 'LiteLLM rejected the key duration for this team. The team has a "Team Member Key Duration" set in LiteLLM that is not in a valid <number><unit> format (e.g. "30d") and overrides whatever duration is requested. Fix or clear it in LiteLLM under Teams \u2192 this team \u2192 Team Settings, then retry.',
+          teamId: req.body.team_id
+        });
+        return;
+      }
       logger.error("Failed to generate key", error);
       res.status(500).json({ error: error.message });
     }
@@ -3015,28 +2953,6 @@ async function createRouter(options) {
         handleBridgeError(error, res);
       }
     });
-    router.post("/bridge/keys/regenerate", async (req, res) => {
-      try {
-        const claims = await requireClaims(req);
-        const alias = (req.body ?? {}).alias?.trim();
-        if (!alias) {
-          res.status(400).json({ error: "alias is required" });
-          return;
-        }
-        const result = await bridgeRegenerateKey(
-          client,
-          claims,
-          provisioningEnabled,
-          provisioningDefaults,
-          logger,
-          alias,
-          userIdDomain
-        );
-        res.json(result);
-      } catch (error) {
-        handleBridgeError(error, res);
-      }
-    });
     router.get("/bridge/models", async (req, res) => {
       try {
         await requireClaims(req);