@acarmisc/backstage-plugin-litellm-backend 0.8.2 → 0.10.0

package/dist/index.d.ts

@@ -5,5 +5,8 @@ export * from './types';
 export { LiteLLMClient } from './client';
 export { resolveUserId, resolveUserProfile, toLiteLLMUserId, getOrProvisionUser, provisionUser, readProvisioningDefaults, readRoleConfigs, applyRoleOverrides, resolveUserRole, ProvisioningError, } from './provisioning';
 export type { BackstageUserProfile } from './provisioning';
+export { readTeamAdminConfig, isTeamManagementEnabled, assertTeamAdmin, validateTeamWriteInput, validateTeamPatchInput, } from './teamAdmin';
+export type { TeamAdminConfig, TeamAdminCheck, TeamWriteInput, TeamWriteValidation, TeamPatchValidation } from './teamAdmin';
 export { KeycloakJWTVerifier, newDefaultVerifier, readBridgeConfig, resolveBridgeUserId, getOrProvisionUserFromClaims, bridgeListKeys, bridgeGenerateKey, } from './bridge';
 export type { BridgeClaims, TokenVerifier, BridgeConfig, KeycloakJWTVerifierOptions, } from './bridge';
+export { litellmPermissions, litellmKeyCreatePermission, litellmKeyRevokePermission, litellmKeyManagePermission, litellmAuditReadPermission, litellmTeamCreatePermission, litellmTeamManagePermission, litellmTeamMembersManagePermission, litellmTeamKnowledgebaseManagePermission, litellmTeamMcpManagePermission, litellmTeamDeletePermission, } from './permissions';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bridgeGenerateKey = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
+exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = exports.litellmPermissions = exports.bridgeGenerateKey = exports.bridgeListKeys = exports.getOrProvisionUserFromClaims = exports.resolveBridgeUserId = exports.readBridgeConfig = exports.newDefaultVerifier = exports.KeycloakJWTVerifier = exports.validateTeamPatchInput = exports.validateTeamWriteInput = exports.assertTeamAdmin = exports.isTeamManagementEnabled = exports.readTeamAdminConfig = exports.ProvisioningError = exports.resolveUserRole = exports.applyRoleOverrides = exports.readRoleConfigs = exports.readProvisioningDefaults = exports.provisionUser = exports.getOrProvisionUser = exports.toLiteLLMUserId = exports.resolveUserProfile = exports.resolveUserId = exports.LiteLLMClient = exports.createRouter = exports.default = exports.litellmPlugin = void 0;
 var plugin_1 = require("./plugin");
 Object.defineProperty(exports, "litellmPlugin", { enumerable: true, get: function () { return plugin_1.litellmPlugin; } });
 var plugin_2 = require("./plugin");
@@ -35,6 +35,12 @@ Object.defineProperty(exports, "readRoleConfigs", { enumerable: true, get: funct
 Object.defineProperty(exports, "applyRoleOverrides", { enumerable: true, get: function () { return provisioning_1.applyRoleOverrides; } });
 Object.defineProperty(exports, "resolveUserRole", { enumerable: true, get: function () { return provisioning_1.resolveUserRole; } });
 Object.defineProperty(exports, "ProvisioningError", { enumerable: true, get: function () { return provisioning_1.ProvisioningError; } });
+var teamAdmin_1 = require("./teamAdmin");
+Object.defineProperty(exports, "readTeamAdminConfig", { enumerable: true, get: function () { return teamAdmin_1.readTeamAdminConfig; } });
+Object.defineProperty(exports, "isTeamManagementEnabled", { enumerable: true, get: function () { return teamAdmin_1.isTeamManagementEnabled; } });
+Object.defineProperty(exports, "assertTeamAdmin", { enumerable: true, get: function () { return teamAdmin_1.assertTeamAdmin; } });
+Object.defineProperty(exports, "validateTeamWriteInput", { enumerable: true, get: function () { return teamAdmin_1.validateTeamWriteInput; } });
+Object.defineProperty(exports, "validateTeamPatchInput", { enumerable: true, get: function () { return teamAdmin_1.validateTeamPatchInput; } });
 var bridge_1 = require("./bridge");
 Object.defineProperty(exports, "KeycloakJWTVerifier", { enumerable: true, get: function () { return bridge_1.KeycloakJWTVerifier; } });
 Object.defineProperty(exports, "newDefaultVerifier", { enumerable: true, get: function () { return bridge_1.newDefaultVerifier; } });
@@ -43,3 +49,15 @@ Object.defineProperty(exports, "resolveBridgeUserId", { enumerable: true, get: f
 Object.defineProperty(exports, "getOrProvisionUserFromClaims", { enumerable: true, get: function () { return bridge_1.getOrProvisionUserFromClaims; } });
 Object.defineProperty(exports, "bridgeListKeys", { enumerable: true, get: function () { return bridge_1.bridgeListKeys; } });
 Object.defineProperty(exports, "bridgeGenerateKey", { enumerable: true, get: function () { return bridge_1.bridgeGenerateKey; } });
+var permissions_1 = require("./permissions");
+Object.defineProperty(exports, "litellmPermissions", { enumerable: true, get: function () { return permissions_1.litellmPermissions; } });
+Object.defineProperty(exports, "litellmKeyCreatePermission", { enumerable: true, get: function () { return permissions_1.litellmKeyCreatePermission; } });
+Object.defineProperty(exports, "litellmKeyRevokePermission", { enumerable: true, get: function () { return permissions_1.litellmKeyRevokePermission; } });
+Object.defineProperty(exports, "litellmKeyManagePermission", { enumerable: true, get: function () { return permissions_1.litellmKeyManagePermission; } });
+Object.defineProperty(exports, "litellmAuditReadPermission", { enumerable: true, get: function () { return permissions_1.litellmAuditReadPermission; } });
+Object.defineProperty(exports, "litellmTeamCreatePermission", { enumerable: true, get: function () { return permissions_1.litellmTeamCreatePermission; } });
+Object.defineProperty(exports, "litellmTeamManagePermission", { enumerable: true, get: function () { return permissions_1.litellmTeamManagePermission; } });
+Object.defineProperty(exports, "litellmTeamMembersManagePermission", { enumerable: true, get: function () { return permissions_1.litellmTeamMembersManagePermission; } });
+Object.defineProperty(exports, "litellmTeamKnowledgebaseManagePermission", { enumerable: true, get: function () { return permissions_1.litellmTeamKnowledgebaseManagePermission; } });
+Object.defineProperty(exports, "litellmTeamMcpManagePermission", { enumerable: true, get: function () { return permissions_1.litellmTeamMcpManagePermission; } });
+Object.defineProperty(exports, "litellmTeamDeletePermission", { enumerable: true, get: function () { return permissions_1.litellmTeamDeletePermission; } });

package/dist/permissions.d.ts

@@ -0,0 +1,11 @@
+export declare const litellmKeyCreatePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmKeyRevokePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmKeyManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmAuditReadPermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamCreatePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamMembersManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamKnowledgebaseManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamMcpManagePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmTeamDeletePermission: import("@backstage/plugin-permission-common").BasicPermission;
+export declare const litellmPermissions: import("@backstage/plugin-permission-common").BasicPermission[];

package/dist/permissions.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.litellmPermissions = exports.litellmTeamDeletePermission = exports.litellmTeamMcpManagePermission = exports.litellmTeamKnowledgebaseManagePermission = exports.litellmTeamMembersManagePermission = exports.litellmTeamManagePermission = exports.litellmTeamCreatePermission = exports.litellmAuditReadPermission = exports.litellmKeyManagePermission = exports.litellmKeyRevokePermission = exports.litellmKeyCreatePermission = void 0;
+const plugin_permission_common_1 = require("@backstage/plugin-permission-common");
+exports.litellmKeyCreatePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.key.create',
+    attributes: { action: 'create' },
+});
+exports.litellmKeyRevokePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.key.revoke',
+    attributes: { action: 'delete' },
+});
+exports.litellmKeyManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.key.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmAuditReadPermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.audit.read',
+    attributes: { action: 'read' },
+});
+// Team-management permissions — delegated to litellm-team-admins group
+exports.litellmTeamCreatePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.create',
+    attributes: { action: 'create' },
+});
+exports.litellmTeamManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmTeamMembersManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.members.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmTeamKnowledgebaseManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.knowledgebase.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmTeamMcpManagePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.mcp.manage',
+    attributes: { action: 'update' },
+});
+exports.litellmTeamDeletePermission = (0, plugin_permission_common_1.createPermission)({
+    name: 'litellm.team.delete',
+    attributes: { action: 'delete' },
+});
+exports.litellmPermissions = [
+    exports.litellmKeyCreatePermission,
+    exports.litellmKeyRevokePermission,
+    exports.litellmKeyManagePermission,
+    exports.litellmAuditReadPermission,
+    exports.litellmTeamCreatePermission,
+    exports.litellmTeamManagePermission,
+    exports.litellmTeamMembersManagePermission,
+    exports.litellmTeamKnowledgebaseManagePermission,
+    exports.litellmTeamMcpManagePermission,
+    exports.litellmTeamDeletePermission,
+];

package/dist/plugin.js

@@ -4,6 +4,7 @@ exports.litellmPlugin = void 0;
 const backend_plugin_api_1 = require("@backstage/backend-plugin-api");
 const router_1 = require("./router");
 const bridge_1 = require("./bridge");
+const permissions_1 = require("./permissions");
 exports.litellmPlugin = (0, backend_plugin_api_1.createBackendPlugin)({
     pluginId: 'litellm',
     register(reg) {
@@ -14,9 +15,18 @@ exports.litellmPlugin = (0, backend_plugin_api_1.createBackendPlugin)({
                 logger: backend_plugin_api_1.coreServices.logger,
                 auth: backend_plugin_api_1.coreServices.auth,
                 discovery: backend_plugin_api_1.coreServices.discovery,
+                permissions: backend_plugin_api_1.coreServices.permissions,
+                permissionsRegistry: backend_plugin_api_1.coreServices.permissionsRegistry,
             },
-            async init({ httpRouter, config, logger, auth, discovery }) {
-                const router = await (0, router_1.createRouter)({ config, logger, auth, discovery });
+            async init({ httpRouter, config, logger, auth, discovery, permissions, permissionsRegistry, }) {
+                permissionsRegistry.addPermissions(permissions_1.litellmPermissions);
+                const router = await (0, router_1.createRouter)({
+                    config,
+                    logger,
+                    auth,
+                    discovery,
+                    permissions,
+                });
                 httpRouter.use(router);
                 // The CLI bridge verifies raw Keycloak JWTs itself (it does NOT use a
                 // Backstage-issued token). Exempt its routes from the default auth

package/dist/provisioning.d.ts

@@ -1,5 +1,5 @@
 import { Config } from '@backstage/config';
-import { AuthService } from '@backstage/backend-plugin-api';
+import { AuthService, BackstageCredentials } from '@backstage/backend-plugin-api';
 import { CatalogClient } from '@backstage/catalog-client';
 import { Request } from 'express';
 import { LiteLLMClient } from './client';
@@ -45,6 +45,11 @@ export declare function readProvisioningDefaults(config: Config): {
  * the request carries no user credential (service-to-service calls).
  */
 export declare function resolveUserId(req: Request, auth: AuthService): Promise<string | undefined>;
+/**
+ * Like resolveUserId, but returns the raw BackstageCredentials object
+ * (rather than just the entity ref) for passing into PermissionsService.authorize().
+ */
+export declare function resolveCredentials(req: Request, auth: AuthService): Promise<BackstageCredentials | undefined>;
 /**
  * Profile data extracted from a Backstage Catalog User entity, used to
  * populate user_email / user_alias on the LiteLLM record.

package/dist/provisioning.js

@@ -6,6 +6,7 @@ exports.readRoleConfigs = readRoleConfigs;
 exports.applyRoleOverrides = applyRoleOverrides;
 exports.readProvisioningDefaults = readProvisioningDefaults;
 exports.resolveUserId = resolveUserId;
+exports.resolveCredentials = resolveCredentials;
 exports.resolveUserProfile = resolveUserProfile;
 exports.provisionUser = provisionUser;
 exports.getOrProvisionUser = getOrProvisionUser;
@@ -116,6 +117,21 @@ async function resolveUserId(req, auth) {
     }
     return undefined;
 }
+/**
+ * Like resolveUserId, but returns the raw BackstageCredentials object
+ * (rather than just the entity ref) for passing into PermissionsService.authorize().
+ */
+async function resolveCredentials(req, auth) {
+    const rawToken = req.headers.authorization?.slice(7);
+    if (!rawToken)
+        return undefined;
+    try {
+        return await auth.authenticate(rawToken);
+    }
+    catch {
+        return undefined;
+    }
+}
 /**
  * Looks up the catalog User entity for the authenticated user and returns
  * the profile block. Returns an empty object when the user has no catalog

package/dist/router.d.ts

@@ -1,6 +1,7 @@
 import { Router } from 'express';
 import { Config } from '@backstage/config';
-import { AuthService, DiscoveryService } from '@backstage/backend-plugin-api';
+import { AuthService, DiscoveryService, PermissionsService } from '@backstage/backend-plugin-api';
+import { CatalogClient } from '@backstage/catalog-client';
 import { LiteLLMClient } from './client';
 import { ProvisioningError } from './provisioning';
 import { TokenVerifier } from './bridge';
@@ -10,8 +11,11 @@ export interface RouterOptions {
     logger: any;
     auth: AuthService;
     discovery: DiscoveryService;
+    permissions: PermissionsService;
     /** Override the LiteLLM client (tests). Defaults to one built from config. */
     client?: LiteLLMClient;
+    /** Override the catalog client (tests). Defaults to one built from discovery. */
+    catalogClient?: CatalogClient;
     /** Override the bridge token verifier (tests). Defaults to a Keycloak JWKS verifier. */
     tokenVerifier?: TokenVerifier;
 }