@acarmisc/backstage-plugin-litellm-backend 0.8.0 → 0.8.2

package/config.d.ts

@@ -158,7 +158,7 @@ export interface Config {
 
       /**
        * Keycloak realm issuer used to fetch JWKS and verify the token issuer,
-       * e.g. https://auth.ces.abssrv.it/realms/solution-innovation.
+       * e.g. https://auth.example.com/realms/solution-innovation.
        * Required when enabled.
        */
       issuer?: string;

package/dist/bridge.d.ts

@@ -17,7 +17,7 @@ export interface TokenVerifier {
 }
 export interface BridgeConfig {
     enabled: boolean;
-    /** Keycloak realm issuer, e.g. https://auth.ces.abssrv.it/realms/solution-innovation. */
+    /** Keycloak realm issuer, e.g. https://auth.example.com/realms/solution-innovation. */
     issuer?: string;
     /** OIDC public client the CLI uses; checked against azp / aud. */
     clientId: string;

package/dist/bridge.js

@@ -89,7 +89,7 @@ exports.KeycloakJWTVerifier = KeycloakJWTVerifier;
 function newDefaultVerifier(cfg) {
     if (!cfg.issuer) {
         throw new BridgeConfigError('litellm.bridge.issuer is required when litellm.bridge.enabled is true ' +
-            '(e.g. https://auth.ces.abssrv.it/realms/solution-innovation)');
+            '(e.g. https://auth.example.com/realms/solution-innovation)');
     }
     return new KeycloakJWTVerifier({ issuer: cfg.issuer, clientId: cfg.clientId });
 }

package/dist/client.js

@@ -31,6 +31,13 @@ class LiteLLMUpstreamError extends Error {
     }
 }
 exports.LiteLLMUpstreamError = LiteLLMUpstreamError;
+function extractModelList(fallback) {
+    if (Array.isArray(fallback))
+        return fallback;
+    if (Array.isArray(fallback?.data))
+        return fallback.data;
+    return [];
+}
 class LiteLLMClient {
     constructor(config, timeout = DEFAULT_TIMEOUT) {
         this.baseUrl = config.baseUrl.replace(/\/$/, '');
@@ -262,6 +269,7 @@ class LiteLLMClient {
                     output_cost_per_token: info.output_cost_per_token ?? params.output_cost_per_token,
                     max_input_tokens: info.max_input_tokens ?? m.max_input_tokens,
                     max_output_tokens: info.max_output_tokens ?? m.max_output_tokens,
+                    access_groups: info.access_groups ?? m.access_groups,
                 };
             });
             const filtered = normalised.filter(m => m.model_name);
@@ -272,11 +280,7 @@ class LiteLLMClient {
             // fall through to /models
         }
         const fallback = await this.request('/models');
-        const data = Array.isArray(fallback)
-            ? fallback
-            : Array.isArray(fallback?.data)
-                ? fallback.data
-                : [];
+        const data = extractModelList(fallback);
         return data
             .map((m) => ({
             model_name: m.model_name ?? m.id ?? '',
@@ -400,7 +404,7 @@ class LiteLLMClient {
                     };
                     if (!kb.key_alias && kmeta.key_alias)
                         kb.key_alias = kmeta.key_alias;
-                    if (kb.team_id == null && kmeta.team_id)
+                    if (kb.team_id === null && kmeta.team_id)
                         kb.team_id = kmeta.team_id;
                     if (!kb.models.includes(name))
                         kb.models.push(name);

package/dist/index.cjs.js

@@ -81,6 +81,11 @@ var LiteLLMUpstreamError = class extends Error {
     this.param = param;
   }
 };
+function extractModelList(fallback) {
+  if (Array.isArray(fallback)) return fallback;
+  if (Array.isArray(fallback?.data)) return fallback.data;
+  return [];
+}
 var LiteLLMClient = class {
   constructor(config, timeout = DEFAULT_TIMEOUT) {
     this.baseUrl = config.baseUrl.replace(/\/$/, "");
@@ -294,7 +299,8 @@ var LiteLLMClient = class {
           input_cost_per_token: info.input_cost_per_token ?? params.input_cost_per_token,
           output_cost_per_token: info.output_cost_per_token ?? params.output_cost_per_token,
           max_input_tokens: info.max_input_tokens ?? m.max_input_tokens,
-          max_output_tokens: info.max_output_tokens ?? m.max_output_tokens
+          max_output_tokens: info.max_output_tokens ?? m.max_output_tokens,
+          access_groups: info.access_groups ?? m.access_groups
         };
       });
       const filtered = normalised.filter((m) => m.model_name);
@@ -302,7 +308,7 @@ var LiteLLMClient = class {
     } catch {
     }
     const fallback = await this.request("/models");
-    const data = Array.isArray(fallback) ? fallback : Array.isArray(fallback?.data) ? fallback.data : [];
+    const data = extractModelList(fallback);
     return data.map((m) => ({
       model_name: m.model_name ?? m.id ?? "",
       mode: m.mode ?? "chat",
@@ -421,7 +427,7 @@ var LiteLLMClient = class {
             ...emptyModelBucket()
           };
           if (!kb.key_alias && kmeta.key_alias) kb.key_alias = kmeta.key_alias;
-          if (kb.team_id == null && kmeta.team_id) kb.team_id = kmeta.team_id;
+          if (kb.team_id === null && kmeta.team_id) kb.team_id = kmeta.team_id;
           if (!kb.models.includes(name)) kb.models.push(name);
           kb.total_spend += km.spend ?? 0;
           kb.total_tokens += km.total_tokens ?? 0;
@@ -854,7 +860,7 @@ async function provisionUser(client, userId, defaults, profile, backstageEntity,
     }
   };
   logger.info(
-    `Provisioning new LiteLLM user for Backstage identity: ${userId}` + (profile.email ? ` (email=${profile.email})` : "")
+    `Provisioning new LiteLLM user for Backstage identity: ${userId}${profile.email ? ` (email=${profile.email})` : ""}`
   );
   try {
     await client.createUser(payload);
@@ -2399,7 +2405,7 @@ var KeycloakJWTVerifier = class {
 function newDefaultVerifier(cfg) {
   if (!cfg.issuer) {
     throw new BridgeConfigError(
-      "litellm.bridge.issuer is required when litellm.bridge.enabled is true (e.g. https://auth.ces.abssrv.it/realms/solution-innovation)"
+      "litellm.bridge.issuer is required when litellm.bridge.enabled is true (e.g. https://auth.example.com/realms/solution-innovation)"
     );
   }
   return new KeycloakJWTVerifier({ issuer: cfg.issuer, clientId: cfg.clientId });
@@ -2619,12 +2625,18 @@ async function createRouter(options) {
     const tokenEntityRef = await resolveUserId(req, auth);
     const userId = tokenEntityRef ? toLiteLLMUserId(tokenEntityRef, userIdDomain) : req.query.user_id;
     if (!userId) {
-      throw { status: 403, body: { error: "Cannot verify key ownership without an authenticated user" } };
+      throw Object.assign(new Error("Cannot verify key ownership without an authenticated user"), {
+        status: 403,
+        body: { error: "Cannot verify key ownership without an authenticated user" }
+      });
     }
     const ownKeys = await client.listKeys(userId);
     const owns = ownKeys.some((k) => (k.token ?? k.key) === keyId);
     if (!owns) {
-      throw { status: 403, body: { error: "Access denied: key does not belong to the caller" } };
+      throw Object.assign(new Error("Access denied: key does not belong to the caller"), {
+        status: 403,
+        body: { error: "Access denied: key does not belong to the caller" }
+      });
     }
     return { tokenEntityRef, userId };
   }